Elsa To Moloch

Let’s say you’re using Bro, and you have this bad assed app called ELSA to search through the mountains of logs produced. You find exactly what you’re looking for but you need the payload from the stream. One option is to integrate ELSA and Moloch.  It’s super easy. edit /etc/elsa_web.conf Read more…

WPMU Change Email From Field

WordPress MU uses a PHP mailer function to send email. Therefore you have to change the setting in /wp-includes/pluggable.php. Unlike regular wordpress, where you can change the setting in wp-functions.php or wp-mail.php. Edit pluggable.php // From email and name// If we don’t have a name from the input headersif ( Read more…

CISSP

I have started my training for my CISSP, so many many cool links will be posted on this site. Well, cool if you’re a huge nerd. Here’s the first few. Pentesting Framework:http://www.vulnerabilityassessment.co.uk/index.htm CISSP Training Resources:http://cccure.org/ISO 17799http://www.17799.com/http://www.isaca.org/http://www.itil-officialsite.com/home/home.asp

Password Protect Splunk

Here’s my fig for Ubuntu 8.10 Server. $ cat /etc/apache2/sites-available/splunk<virtualhost X.X.X.X:80> ServerAdmin root@localhost ServerAlias splunk.example.com ProxyPass / http://127.0.0.1:8000/ ProxyPassReverse / http://127.0.0.1:8000/ ErrorLog /var/log/splunk.example.com-error_log CustomLog /var/log/splunk.example.com-access_log common</virtualhost><proxy http://127.0.0.1:8000/*> Order deny,allow Deny from all Allow from all AuthName “splunk.example.com” AuthType Basic AuthUserFile /var/www/.htpasswd Require valid-user</proxy>$ cat /var/www/.htaccessAuthUserFile /var/www/.htpasswdAuthName “Authorized Users Only”AuthType Basicrequire Read more…

Overclock the EEE PC in Backtrack 3

Get the cpufrequtils package from http://www.linuxpackages.netCreate a script like so: #!/bin/bashmodprobe p4-clockmodmodprobe freq_tablemodprobe cpufreq_ondemandmodprobe cpufreq_conservativemodprobe cpufreq_powersavemodprobe cpufrew_performancecpufreq-set -g performance You can use any of the governor options listed above as the g option for cpufreq-set. cat /proc/cpuinfo.

Transparent Proxy

I’ve been working with Websense for many years. It’s very pricey and since not everyone can afford it, I have had to find a workaround. The answer for me is simply safesquid. Here’s how I did it with very little user intervention, and no touching of client pcs/macs. Step 1. Read more…