Sans has a bit on defeating a DOS attack. They also have a webcast I’d like to check out on the same topic.
Author: michael
scripted secure runas
Sometimes you need to regularly runas an admin in Windows, but you might not necessarily want to give the user the local or domain admin password or save it in a cleartext file or shortcut or run over to type it in when needed. These are some options for secure ways of performing a runas. I’ve once used CPAU and it worked rather well. I had to give a SQL DBA access to production SQL servers and allow him to access other servers through admin shares via Enterprise Manager. Rather than give him a domain admin account or mess with permissions or store it in cleartext in a file or shortcut where he could look it up if he wanted to, I made a “secure” shortcut using CPAU. Pretty slick, and while it may have holes, it likely will stop any insiders from easily obtaining the credentials. This can be used for lesser instances like a user’s program that might need some admin rights somewhere and not run otherwise.
Thie page has a bunch of choices for situations where runas needs to be secure.
attacks and defenses for web apps
Article on attacks against web servers (app level) and mitigations to stopping them, with full examples on the attacks. Some interesting things to try out someday would be mod_security and Tripwire-like programs to monitor file integrity. I would love to start getting alerts like these on my own systems whenever something changes, even if it is me updating a web page on my site. I also have a project to get some sort of centralized monitoring on my network to check for creation/changes to local user accounts and other things. I’d love to be able to centrally pull my firewall logs (Sygate), but I bet that will require my own scripting. At any rate, the paper is much of the same tried-and-true stuff with security, but the examples are pretty cool.
logparser site and book
I should get the Log Parser book sometime, as it goes over things on this site about the Microsoft logparser tool. This should be useful to use to perform adhoc and maybe some scripted queries against single or groups of logs.
dns cache snooping
Having just watched Dan Kaminsky’s Black Ops of TCP/IP 2005 presentation that he gave at the 22nd Chaos Communications Congress, I have a couple links on dns snooping, which he (in typical Kaminsky fashion) utilized in creative fashions. First, a paper on dns cache snooping. And second, a site on how dns snooping actually works.
insertion, evasion, and denial of service
The paper, Insertion, Evasion, and Denial of Service: Eluding Intrusion Detection, is the definitive guide to beating IDS and has been the foundation of IDS attacks ever since. I must read this sometime, for historical reasons and more.
netbios null sessions
NetBIOS Null Sessions are elementary and a first stop for anyone performing system recon. They should always be turned off, and this link is a nice reminder of the issues, the dangers, and the fixes.
cracking wep on windows
Wow, just wow! This is one of the hottest and best links I’ve seen in a long time. I HAVE to try this out. I’ve worked on cracking WEP before on my neighbors, but I always had to resort to using a livecd Linux install (since I don’t have a permanent Linux box around). Cracking WEP with Windows XP is a huge, detailed, complete article which I am tempted to actually copy/print just to make sure I always have it.
This was found whilst checking out a site I’d not seen before: wardriving.com.
im lock to lock down im apps
IM Lock sounds like it can lock IM programs from operating in Windows. I think this can be better solved with software policies and audits, and removing admin rights for users. And the method to get around all of the above, using stand-alone, non-installable “underground” apps for IMs still works regardless of any of these methods. So…might be interesting in case someone wants something like this.
windows xp firewall gui tool
A GUI for the Windows XP firewall sounds like a wonderful idea…if there weren’t better firewalls out there that I trusted more, like ZoneAlarm or Sygate. Still, might be cool to try out.
roguescanner
RogueScanner is a rogue wireless access point detection tool. Pretty cool…and it’s free! Also peek at the other free tools available here, Packtyzer (Ethereal front-end, as if there needs to be another one…) and BlueScanner which scans for BlueTooth devices. To be honest, both of the scanner tools are pretty nice for being free tools!
winsshd: windows ssh server
WinSSHD is not a free app, but is still one of those rare Windows-based SSH servers. A few other tools to download on their site as well.
spaceobserver and treesize
Spaceobserver and Treesize are some interesting and well-equipped tools for storage utilization analysis on systems. Free evaluations are well-worth it.