Pular para o conteúdo principal

Postagens

Snort 3.0 with ElasticSearch, LogStash, and Kibana (ELK)

The Elastic Stack, consisting of Elasticsearch with Logstash and Kibana, commonly abbreviated "ELK", makes it easy to enrich, forward, and visualize log files.  ELK is especially good for getting the most from your Snort 3.0 logs.  This post will show you how to create a cool dashbaord: The dashboard shows the following: bring_da_heat - a heat map that plots event priority vs classification apple_pie - a pie chart that shows total bytes transferred by app greatest_hits - a data table that shows the rules generating the most events global_hot_spots - a geo plot of the event source address* size_o_gram - a histogram of logged packet / buffer sizes Get Started To get started, you will need to install the following: Snort 3.0 from https://snort.org/downloads/#snort-3.0 or from https://github.com/snortadmin/snort3 snort3-community-rules.tar.gz from https://snort.org/downloads#rules Open App ID from https://snort.org/downloads#openappid Elastic Stack from...

Install SNORT 3.0

The section will walk you through building and running Snort. It is not exhaustive but, once you master this material, you should be able to figure out more advanced usage. Dependencies Required: autotools or cmake to build from source daq from http://www.snort.org for packet IO g++ >= 4.8 or other recent C++11 compiler dnet from https://github.com/dugsong/libdnet.git for network utility functions hwloc from https://www.open-mpi.org/projects/hwloc/ for CPU affinity management LuaJIT from http://luajit.org for configuration and scripting OpenSSL from https://www.openssl.org/source/ for SHA and MD5 file signatures, the protected_content rule option, and SSL service detection pcap from http://www.tcpdump.org for tcpdump style logging pcre from http://www.pcre.org for regular expression pattern matching pkgconfig from https://www.freedesktop.org/wiki/Software/pkg-config/ to locate build dependencies zlib from htt...

Upgrading Iomega ix2-200 to Cloud Edition

You just got your ix2-200 from eBay and there are no disks inside the NAS. Or you have a brand new ix2-200 -yet you could not afford Cloud Edition. No problem. With just a USB stick and a SATA adapter or desktop PC, you will easily upgrade your ix2-200 to ix2-200 Cloud Edition. Not only your ix2-200 will have a brand new interface and Cloud options, but also will become Mac OS X Lion compatible! What do we need? Decrypted! ix2-200 Cloud Edition Firmware 3.1.12.47838 S endSpace or RapidShare * USB Flash Drive with at least 2 GB capacity and LED indicator** SATA to USB adapter or desktop PC Toothpick or paperclip Preparing Hard Drives Preparing hard drives is the first step because you have to wipe all the data inside the hard drives and make them just like brand new. We used 2 x Seagate 2 TB 5900 RPM Drives. Backup any files if you have and then remove both disks from ix2-200 and attach them to SATA to USB adapter or your desktop PC's SATA port. Using ...

Error when found when loading /root/.profile: stdin: is not a tty

The problem is in /root/.profile file. At the end of that file you have: Code: mesg n But it doesn’t works in graphical mode because (taken from man mesg) “mesg assumes that its standard input is connected to your terminal”. Change it to: Code: if `tty -s`; then mesg n fi   Fonte: https://cristhianizaparedes.wordpress.com/2016/12/23/error-when-found-when-loading-root-profile-stdin-is-not-a-tty/

Instalação DOCKER no Kali Linux

I’ve recently upgraded to Kali 2 2016.2 and decided to run some local web apps to exercise exploiting the MEAN stack. To make things as quick and simple as possible, I decided to run these web apps in Docker. To install Docker in Kali, these were the steps I followed: Create a backports file and add the entry for Debian Wheezy: echo 'deb http://http.debian.net/debian wheezy-backports main' > /etc/apt/sources.list.d/backports.list && apt-get update Install ca-certificates and allow APT to operate via https: apt-get install apt-transport-https ca-certificates Add the appropriate GPG key: apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D Add the appropriate Docker source entry: echo 'deb https://apt.dockerproject.org/repo debian-wheezy main' > /etc/apt/sources.list.d/docker.list && apt-get update Install Docker and start its service: apt-...