Ping:
By default,
if TTL <= 128, the os is windows.
if TTL <= 64, the os is lunix.
Active detection
nmap:
nmap -O 192.168.1.1
T1: TCP SYN -> 21
T2: TCP NULL -> 21
T3: TCP SYN|FIN|URG|PSH -> 21
T4: TCP ACK -> 21
T5: TCP SYN -> 23
T6: TCP ACK -> 23
T7: TCP FIN|PSH|URG -> 23
PU: UDP -> 1
T1-T4: TCP OPEN T5-T7:TCP CLOSE PU: UDP CLOSE
According to nmap reply and use the result to compare with the nmap database, the os will be revealed.
Passive detection
p0f: running in a server to monitor incoming/outgoing (TCP/UDP/ICMP) packets, establishing the differential database. p0f will help to know what the source OS is.
Network sniffing
Plain text transfer protocol: TELENT, HTTP, FTP, POP3
Linux tools: Sniffit, Tcpdump, Ettercap, Ethereal.
Windows tools: Cain & Abel, Ethereal.
Showing posts with label tools. Show all posts
Showing posts with label tools. Show all posts
Thursday, 26 May 2011
Thursday, 31 March 2011
Basic Windows PowerShell commands you should already know
1: Get-Help
The first PowerShell cmdlet every administrator should learn is Get-Help. You can use this command to get help with any other command. For example, if you want to know how the Get-Process command works, you can type:
Get-Help -Name Get-Process
and Windows will display the full-command syntax.
You can also use Get-Help with individual nouns and verbs. For example, to find out all the commands you can use with the Get verb, type:
Get-Help -Name Get-*
2: Set-ExecutionPolicy
Although you can create and execute PowerShell scripts, Microsoft has disabled scripting by default in an effort to prevent malicious code from executing in a PowerShell environment. You can use the Set-ExecutionPolicy command to control the level of security surrounding PowerShell scripts. Four levels of security are available to you:
- Restricted — Restricted is the default execution policy and locks PowerShell down so that commands can be entered only interactively. PowerShell scripts are not allowed to run.
- All Signed — If the execution policy is set to All Signed then scripts will be allowed to run, but only if they are signed by a trusted publisher.
- Remote Signed — If the execution policy is set to Remote Signed, any PowerShell scripts that have been locally created will be allowed to run. Scripts created remotely are allowed to run only if they are signed by a trusted publisher.
- Unrestricted — As the name implies, Unrestricted removes all restrictions from the execution policy.
You can set an execution policy by entering the Set-ExecutionPolicy command followed by the name of the policy. For example, if you wanted to allow scripts to run in an unrestricted manner you could type:
Set-ExecutionPolicy Unrestricted
3: Get-ExecutionPolicy
If you’re working on an unfamiliar server, you’ll need to know what execution policy is in use before you attempt to run a script. You can find out by using the Get-ExecutionPolicy command.
4: Get-Service
The Get-Service command provides a list of all the services that are installed on the system. If you are interested in a specific service, you can append the -Name switch and the name of the service (wildcards are permitted). When you do, Windows will show you the service’s state.
5: ConvertTo-HTML
PowerShell can provide a wealth of information about the system, but sometimes you need to do more than just view the information onscreen. Sometimes, it’s helpful to create a report you can send to someone. One way of accomplishing this is by using the ConvertTo-HTML command.
To use this command, simply pipe the output from another command into the ConvertTo-HTML command. You will have to use the -Property switch to control which output properties are included in the HTML file and you will have to provide a filename.
To see how this command might be used, think back to the previous section, where we typed Get-Service to create a list of every service that’s installed on the system. Now imagine that you want to create an HTML report that lists the name of each service along with its status (regardless of whether the service is running). To do so, you could use the following command:
Get-Service | ConvertTo-HTML -Property Name, Status > C:\services.htm
6: Export-CSV
Just as you can create an HTML report based on PowerShell data, you can also export data from PowerShell into a CSV file that you can open using Microsoft Excel. The syntax is similar to that of converting a command’s output to HTML. At a minimum, you must provide an output filename. For example, to export the list of system services to a CSV file, you could use the following command:
Get-Service | Export-CSV c:\service.csv
7: Select-Object
If you tried using the command above, you know that there were numerous properties included in the CSV file. It’s often helpful to narrow things down by including only the properties you are really interested in. This is where the Select-Object command comes into play. The Select-Object command allows you to specify specific properties for inclusion. For example, to create a CSV file containing the name of each system service and its status, you could use the following command:
Get-Service | Select-Object Name, Status | Export-CSV c:\service.csv
8: Get-EventLog
You can actually use PowerShell to parse your computer’s event logs. There are several parameters available, but you can try out the command by simply providing the -Log switch followed by the name of the log file. For example, to see the Application log, you could use the following command:
Get-EventLog -Log "Application"
Of course, you would rarely use this command in the real world. You’re more likely to use other commands to filter the output and dump it to a CSV or an HTML file.
9: Get-Process
Just as you can use the Get-Service command to display a list of all the system services, you can use the Get-Process command to display a list of all the processes that are currently running on the system.
10: Stop-Process
Sometimes, a process will freeze up. When this happens, you can use the Get-Process command to get the name or the process ID for the process that has stopped responding. You can then terminate the process by using the Stop-Process command. You can terminate a process based on its name or on its process ID. For example, you could terminate Notepad by using one of the following commands:
Stop-Process -Name notepad
Stop-Process -ID 2668
Keep in mind that the process ID may change from session to session.
Thursday, 9 December 2010
10 Sysinternals tools you shouldn't be without
Sysinternals has been around for quite some time and was acquired by Microsoft in 2006. These are great little tools for getting some heavy-hitting Windows things done and sometimes done better than when using the built-in tools for a task. The entire suite of products is available for download. While this is the easiest way to get the tools because they are bundled together, there are some tools that I find myself using far more than others. Here’s a look at my favorite tools in the Sysinternals collection (or the ones that I use the most).
Note: This article is also available as a TechRepublic photo gallery.
1: PsList and PsKill
I listed these together because I typically use them in this order. The goal here is to see processes on a machine — with PsList, I find the process ID, and then use PsKill to terminate the process.
There are quite a few ways to return information with PsList, and the best part is that it works on local and remote machines. PsKill works similarly to PsList except it is used to terminate processes by process ID.
2: Process Explorer
Process Explorer is a great tool for digging into open files or resources. Trying to open a file, but getting a notification that it’s already open? Process Explorer can help determine which application or process has the file open. It is a GUI-based utility and can be used as a Task Manager replacement. The utility has two panes of information. The top pane shows currently active processes on your system and includes information about the name, the account that owns the process, and the CPU usage of the process.
The bottom pane has two modes of operation, handle mode and DLL mode. When handle mode is enabled, selecting a process in the top portion of the window will show you the handles that the process has open. In DLL mode, the pane displays the DLLs and memory-mapped files loaded by the selected process.
3: ZoomIt
ZoomIt is a utility for the public speaker in all of us. When presenting information, sometimes it is helpful to show a certain area of the screen, magnified to call attention to a dialog box or other item. This is what ZoomIt does. When configured, it will integrate with PowerPoint to allow macro keys to trigger functions during a presentation.
4: PsLoggedOn
PsLoggedOn uses a registry scan to look through the HKEY_USERS key to see which profiles are loaded. Looking at the keys with a user ID SID, PsLoggedOn looks up the username of the SID and displays it. This shows you who is logged on in any session to a PC. When querying remote systems, your userid will be found as a connected user session as well. The remote and local users are returned separately to help distinguish logon types.
5: Autoruns
You know how malware likes to invade the startup folder and other locations on infected systems? Seems that these are the hardest things to find and get rid of when trying to clean up spyware/malware/ infections. Autoruns can help with that. It looks through all possible locations where applications can be listed to automatically launch when Windows starts. Then, it displays them in a tabbed, easy-to-follow GUI. You can hide Microsoft-signed entries to eliminate the good items from the list of things that start up on your system.
6: Contig
Some files have trouble with disk defragmenting applications and for one reason or another, can’t be corrected. This is where you might use Contig. It is a single file defrag utility, which can be helpful if you use a file often and suspect it might be suffering from performance issues due to fragmentation.
7: Disk2vhd
Disk2vhd creates a virtual hard disk file from a physical system for use with Hyper-V or even with Windows 7 or Server 2008 R2. Disk2vhd supports Windows XP SP2 and Windows Server 2003 SP1 and higher, including 64-bit versions of these systems.
A great use of this utility might be to create a snapshot of an entire disk for backup purposes. There are also options that allow Disk2vhd to be run at the command line. You can use these options to script vhd creation. Using the utility in this way would allow you to use Task Scheduler and Disk2vhd to create a snapshot of your PC at scheduled intervals with no user intervention. One caveat: When creating vhds, be sure not to attach them to the same system you created them from if you are going to boot from the vhd.
8: MoveFile
As we all know, there are times when files need to be moved or deleted to help get things cleaned off a PC (malware/bots/viruses). Sometimes, this can’t be done because files are in use, which prevents actions on the files until they are closed or the computer is rebooted. MoveFile provides an API that marks files for move/rename/delete at the next restart of the Windows system. Doing this allows the file to be acted on before it is referenced by the system.
9: PSFile
The PStools utilities are all popular and useful, but one that I recently discovered is PSFile. This utility shows files on a system that are open by remote systems by default but that can be passed parameters to return information about remote systems as well. This tool is a good way to check for open files on file servers when users might report read-only issues or have problems getting files to open properly.
10: Sync
This utility was created to mirror a UNIX utility that will allow you to flush cached file system data to disk. Doing this can help prevent problems with lost system information in the event of a system failure and helps to ensure live system information is getting written to disk.
The way I see this being useful depends on how stable your system is. If your computer tends to crash more than you would like (or if you are testing some scenarios), you might create a scheduled task to ensure that the system info is flushed back to disk once per hour or some other predefined timeframe. Another cool thing about this sync utility is that USB or ZIP drives or other removable drives can be flushed. You will need administrative privileges to use Sync.
Thursday, 4 November 2010
Any Video Converter 影片轉檔、切割、畫面翻轉編修工具
Free Video Converter是個操作簡單、速度也算快的影片檔轉檔軟體，主要功能就是讓我們將各種格式的影片檔轉成其他你要用的影片格式。在轉檔、輸出時，我們可以在輸出格式選單中依照影片檔、音樂檔、手機專用格式與光碟燒錄等分類，選擇你要用的格式。除了輸出成其他格式的影片之外，還可直接輸出成MP3、WAM、 agg等格式的音樂檔，或轉成一般手機用的MPEG-4檔案。可支援的影片格式有：
- 輸入格式：avi, asf, mov, rm, rmvb, flv, mkv, mpg, 3gp, m4v, vob, YouTube videos
- 輸出格式：avi, mp4, wmv, swf, flv, mkv, MPEG-1 and MPEG-2, mpg (PAL or NTSC), asf, m2ts, mp3, wma, ogg, aac, wave, m4a
除了提供包括繁體中文在內的多國語言介面之外，Free Video Converter可支援批次轉檔功能，只要先選取好檔案、調整好轉檔設定，按一下即可自動處理到好。除此之外還可支援從Google Video或Youtube下載影片、直接轉檔功能。
而Any Video Converter也提供了一個相當簡單實用的影片裁剪功能，可以讓我們把影片中不要的片段剪掉，也可支援影片合併輸出功能，將多個影片檔合併成一個。另外還有畫面切割、亮度/對比/飽和度調整等功能，還可將影片上下翻轉、鏡像翻轉、左右旋轉90度或加入雜訊、影片銳化...等等特效，相當實用。
▇ 軟體小檔案 ▇ (錯誤、版本更新回報)
軟體名稱：Any Video Converter 軟體版本：3.1.0 軟體語言：繁體中文（內建20國語言介面） 軟體性質：免費軟體（另有功能更完整的Pro付費版） 檔案大小：22.1MB 系統支援：Windows 2000/XP/2003/Vista/Win7 官方網站：http://www.any-video-converter.com/products/for_video_free/ 軟體下載：按這裡 使用方法：
第1步 開啟Any Video Converter軟體之後，直接按一下左上角的「添加視訊」按鈕，將你要轉檔、修改的影片檔拉到軟體視窗中。
第2步 接著從右上角的「輸出格式」選單點選影片輸出格式，再按一下「編碼」按鈕，即可開始轉檔。
第3步 另外Any Video Converter提供YouTube、Google Video與NicoVideo...等網站的影片下載功能，下載完可直接轉成你要用的格式。
第4步 選取影片後，可以在右邊的預覽視窗下方按「Clipping Video」或「Video Crop_Effect」等按鈕，執行影片裁剪、翻轉或套用視覺特效...等功能。
第5步 這是影片裁剪功能，我們可以自行設定啟動與終點，把你要的部份保留下來，其他的剪掉。
第6步 這是影片畫面裁切功能，可以只保留畫面中我們要的區域，使用方法很簡單，先設定「Crop Area Size」的尺寸，然後移動右邊預覽畫面中的方框，對準你要保留的部份即可，其他沒被框選住的部分則會被剪掉。
第7步 這是影片特效設定頁面，除了可以調整影片的亮度、對比與飽和度之外，還可將影片上下顛倒、鏡面翻轉或左右90度翻轉，還可加入雜訊特效、銳化特效..等等。
裁剪好影片或設定好特效之後，記得回主視窗時要再按一下「編碼」按鈕，將你調整好的影片另外編碼、輸出，轉檔完成即可使用。
HWM BlackBox 電腦硬體效能評比、檢測工具（繁體中文版）
HWM BlackBox是個電腦硬體資訊的檢測工具，跟之前介紹過的EVEREST、Speccy與HWiNFO32…等軟體相當類似。它可以幫我們列出電腦中的CPU、記憶體、顯示卡、主機板…等等主要硬體配備的廠牌、型號與運作效能，包括時脈、倍頻、電壓與目前溫度…等等資訊，以及各種專業玩家才會用到的詳細硬體運作數據..等等。
除此之外，HWM BlackBox還內建了一個效能評比工具，測試出來的效能評比數據還可上傳到Top10hardware網站上跟其他人比大小，包含CPU、記憶體、顯示卡、影片編碼效能、3D遊戲效能與硬碟讀寫效能…等等的綜合評分，讓我們透過更具體、更精確的數據來測試不同電腦規格、不同平台間的硬體效能好壞。
▇ 軟體小檔案 ▇ (錯誤、版本更新回報)
軟體操作介面：
第1步 將HWM BlackBox程式下載回來之後，不用安裝直接執行「BlackBox21.exe」程式即可開始使用。「處理器」頁面會列出CPU相關資訊。
第2步 這是「記憶體」相關資訊的頁面。
第3步 這是顯示卡相關資訊的頁面。
第4步 這是主機板與光碟機、硬碟機及網路卡的相關資訊。
第5步 「效能」頁面提供了一個相當簡單、實用的硬體效能評比工具，按一下「效能評估分」按鈕即可開始測試。
Friday, 29 October 2010
绿雨一气呵成 iPad 3.2.2固件越狱不求人
从来没有像iOS 4.1、iOS 3.2.2越狱这样一波三折——久负盛名的DEV-Team早在一个月前就宣布要放出基于SHAtter漏洞的绿毒（GreenPis0n），并在一周前确认发布时间为2010年10月10日10点10分。可就在发布前夕，神奇小子Geohot突然发力，直接拿出了Limera1n，轻松解决了iPad iOS 3.2.2、iPhone iOS 4.1越狱，让DEV Team被迫推迟绿毒发布。与此同时，Geohot也在不断修正Limera1n程序。截至发稿前，Limera1n最新版本为Beta 4。
在绿雨LimeRa1n发布不久，我们就为大家准备好了苹果iPhone iOS 4.1的越狱教程。接下来当然是要搞定iPad iOS 3.2.2越狱，事实上iOS 3.2.2越狱和iOS 4.1越狱大致相当，只要胆大心细谁都能不求人轻松搞定。
iPad 3.2.2越狱不求人 准备篇
和之前神奇小子Geohot发布的所有越狱工具一样，Limera1n也无需重刷iOS系统。只是相比以往，由于Cydia撞墙，所以完成越狱后我们必须使用VPN或者代理服务器才能成功加载。
与此同时，我们还需要把iTunes升级到最新的iTunes 10版本，并确保iTunes能和iPad正常同步。最后当然是要猛击此处下载最新的Limera1n Beta 4(解压密码：www.evolife.cn)，顺带通过iTunes做好备份。
iPad 3.2.2越狱不求人 实战篇
完成准备功夫之后，自然就开始实战iPad 3.2.2固件越狱了。我们首先确保iPad和iTunes正常连接，关闭所有的杀毒软件防火墙。然后找到下载来解压缩后的limera1n.exe文件，点击右键“以管理员身份运行”。
此时会弹出Limera1n的提示界面。我们点击make it ra1n。iPad就会自动重启进入恢复模式，iTunes也会提示找到一个处于恢复状态的设备。
然后我们根据limera1n提示同时按住Home键和电源键，一直到出现提示“Release Power Button”后保持按住Home键，然后松开电源键大约10秒。此时limera1n就会提示Entering the DFU Mode——此时我们就可以松开所有按键，等待Limera1n自动搞定剩下的工作。
完成上述所有工作后，你的iPad会显示出一个绿色雨滴Logo，随即自动关机——随着屏幕上Limera1n提示Done，iPad 3.2.2/3.2.1固件的越狱就此完成！接下来我们要再度打开iPad，开始安装Cydia和AppSync补丁了！
iPad 3.2.2越狱不求人 安装篇
完成了越狱后，iPad程序中会出现Limera1n图标，由于在国内因为众所周知的原因无法连接到Limera1n网站和Cydia，所以这个图标暂时是白色的。此时我们配置好VPN或者代理服务器，确保可以访问Limera1n.com网站的情况下，点击该白色图标，然后在弹出界面中选择Install Cydia。Limera1n就会开始下载Cydia到你的iPad中。整个过程大约耗时5分钟。
完成下载后，Cydia会自动运行——如果没有，在主界面中运行也没问题。首次运行Cydia，Cydia会自动加载配置程序，完成后自动退出Cydia。我们此时要确保网络、代理服务器或者VPN正常运行，然后慢慢等待Cydia完成配置——整个配置过程大概需要5分钟。
完成配置后，Cydia和Limera1n的图标就不再是一片惨白。我们再点击Cydia运行，Cydia将会提示以什么样的用户身份进行配置。如果不需要命令行，我们点User即可。随后Cydia还会自动进行在线更新，我们强力建议大家不要嫌麻烦，点击Compelety Upgrade，完成所有更新后再进入下一步。更新过程中Cydia还可能重启或自行关闭。
更新完成后我们再度进入Cydia，选择下方的Manage，然后找到Source，点击右上角Add，然后添加一个新源：http://cydia.hackulo.us。注意该源同样需要代理服务器或VPN链接才能正确下载。
完成添加后，在该源提供的软件中找到AppSync for OS 3.2进行安装。然后退出Cydia，重新启动iPad就完成了所有越狱破解动作——此时你安装任何APP都将不受限制。必须注意的是，iPad 3.2.2/3.2.1越狱只能安装AppSync for OS 3.2补丁，除此以外安装其他任何版本的补丁都将直接导致白苹果系统崩溃。
Tuesday, 19 October 2010
Square Privacy Cleaner 一鍵清除：電腦操作記錄、個人隱私資料
當我們在操作電腦時都會留下一些暫存檔、快取資料與網路連線記錄、檔案開啟記錄…等等，此外在瀏覽網頁時，也會在瀏覽器中留下網址記錄、搜尋關鍵字、下載檔案記錄與Cookies、快取檔案.…等等資訊，甚至在使用軟體、應用程式時，也都會留下一些檔案清單、歷史紀錄...等資訊，如果你不希望其他人透過某些方法挖出這些跟你有關的秘密，可以試試看本文所介紹的Square Privacy Cleaner個人隱私清除程式。
Square Privacy Cleaner把常見的電腦操作痕跡、隱私資料分為「Windows General」、「Web Browsers」、「Temp Folders」、「Applications」與「Junk Files」等5個分類，我們可以依照實際需求勾選你要清除的項目，然後再按一下「Delete Traces」按鈕，即可開始搜尋、刪除你已選取的操作記錄與隱私資料，整體來說相當簡單易用。
▇ 軟體小檔案 ▇ (錯誤、版本更新回報)
使用方法：
第1步 Square Privacy Cleaner的使用方法很簡單，就是勾選你要清除的項目後再按一下「Delete Traces」按鈕即可搞定。以下簡單擷取幾張軟體操作介面，列出全部可清除的項目。
「Windows General」裡面大部分都是跟系統有關的操作記錄，很可惜此軟體目前只有英文介面，如果不太了解哪個項目是啥功能，可以用Google搜尋一下。
第2步 「Web Browsers」裡面列出了包括IE、Firefox、opera與Google Chrome等常見瀏覽器的瀏覽記錄、快取、Cookies、網址記錄與下載清單...等等。
第3步 「Temp Folders」裡面有電腦暫存資料夾裡面的一些暫時使用的檔案。
第4步 「Applications」裡面列出了大部分使用者會用到的各種知名軟體，包括WinRAR、MediaPlyaer、Foxit Reader、WinZIP、VNC、MS Office、7-zip、Java、Adobe Reader… 等，勾選並按下「Delete Traces」按鈕即可清除相關歷史紀錄與操作痕跡。
第5步 「Junk Files」就是一些電腦沒出事時用不到的log記錄檔，可依實際需求勾選、刪除。如果不是因為空間不夠或特殊隱私控管的需求，log檔留著還是有些好處，以後電腦出啥問題時，還可以挖出來檢查看看是否有啥問題。
Subscribe to:
Posts (Atom)