mancinglog.sh

berguna untuk mencari korelasi antara ip address / file di access.log
------------------------------------------------------------------------------------
start script
------------------------------------------------------------------------------------

#!/bin/bash
logpath=/var/log/nginx/access.log
ARRAY=()
getip=()
getfile=()

function getfiles {
        echo "getfiles param " ${getip[@]}
        pat=$(echo ${getip[@]}|tr " " "|")
        getfile+=($(grep -Ew $pat $logpath| cut -f 7 -d " " | sort | uniq))
        uniqf=($(printf "%s\n" "${getfile[@]}" | sort | uniq -c | sort -rnk1 | awk '{ print $2 }'))
        unset getfile
        getfile=("${uniqf[@]}")
        printf "%s\n" "${getfile[@]}" > files.txt
        echo "getfiles result " ${getfile[@]}
        getips
}



function getips {
        echo "getips param " ${getfile[@]}
        pat=$(echo ${getfile[@]}|tr " " "|")
        getip+=($(grep -Ew $pat $logpath| cut -f 1 -d " " | sort | uniq))
        uniqi=($(printf "%s\n" "${getip[@]}" | sort | uniq -c | sort -rnk1 | awk '{ print $2 }'))
        unset getip
        getip=("${uniqi[@]}")
        printf "%s\n" "${getip[@]}" > ips.txt
        echo "getips result "${getip[@]}
        getfiles
}

getfile=( `cat "files.txt"` )
getip=( `cat "ips.txt"` )
#getips $1
getfile+=($1)
getips

xss and sql injection prevention

//filtering input for xss and sql injection
$input = strip_tags( $input );
$input = mysql_real_escape_string( $input );
$input = trim( $input );

network security

Now I want to talk about security. After years passed by, I think the noted innovation is:

1. cisco IOS rootkit. I'ts never heard on wild, but it's really a breaktrough.
2. Nero NRG infection. I already guess it's will happen.
3. w32 STUXNET. Haha, welcome to new world weapon.
4. Software based Radio. Now it's easy to server as BTS from your pc, and eavesdrop all sms traffic that pass your bts.

nmap baru jes, nmap baru versi 5 (lima), huandal!

( ) /\ _ (
\ | ( \ ( \.( ) _____
\ \ \ ` ` ) \ ( ___ / _ \
(_` \+ . x ( .\ \/ \____-----------/ (o) \_
- .- \+ ; ( O \____
) \_____________ ` \ /
(__ +- .( -'.- <. - _ VVVVVVV VV V\ \/
(_____ ._._: <_ - <- _ (--_AAAAAAA__A_/ |
. /./.+- . .- / +-- - . \______________//_ \_______
(__ ' /x / x _/ ( \___' \ /
, x / ( ' . / . / | \ /
/ / _/ / + / \/
' (__/ / \
NMAP IS A POWERFUL TOOL -- USE CAREFULLY AND RESPONSIBLY

virus ngirim icmp aneh2

oalah, ada pc klien yang gak dipasang antivirus, jadinya broadcast icmp sampe 300 kbps, hebat tenan, akhirnya ya ya tak disable gatewaynya.
Ketemonnya pas aku liat queue simple bagian icmp. Queue iku sampe merah (pake mikrotik), soalnya tak limit di 64 kbps. Langsung saja tak torch disisi interface klien. Ternyata biang flood nya ... AGUS-AGUS, pelaku lama dibidang per virus an. Komputernya bola bali kena infeksi terus sampe tjapek deehh
....

denzuko before and after :P

http://vx.org.ua/lib/afs00.html
http://www.vaksin.com/2008/0608/seminar-aceh/Seminar%20Aceh.html

skrip deteksi duplikasi mac

Skrip shell openbsd untuk mencari mac address duplicate di router mikrotik, file penunjangnya adalah sshwrap. Ada beberapa bagian yang bikin pusing, yaitu komparasi array dengan if, yang hasilnya gak cocok sama sekali, sehingga harus diakal menggunakan variable biasa.

1. ==================potongdisini=====================================
2. # cat /sbin/macduplicate.sh
3. #!/bin/sh
4. #x=`telnetmikrotik.exp`
5. /sbin/sshwrap.exp 10.20.30.1 22000 diag diag "ip arp print without-paging terse file=maclist"
6. wget -O /tmp/maclist.txt ftp://diag:diag@10.20.30.1/maclist.txt
7. a=`cat /tmp/maclist.txt | cut -f 3 -d "=" | egrep "([0-9A-F]{2}:){5}[0-9A-F]{2}" | cut -f 1 -d " " | sort`
8. i=`cat /tmp/maclist.txt | cut -f 3 -d "=" | egrep "([0-9A-F]{2}:){5}[0-9A-F]{2}" | cut -f 1 -d " " | sort | wc -l`
9. b=`cat /tmp/maclist.txt | cut -f 3 -d "=" | egrep "([0-9A-F]{2}:){5}[0-9A-F]{2}" | cut -f 1 -d " " | sort | uniq -d`
10. j=`cat /tmp/maclist.txt | cut -f 3 -d "=" | egrep "([0-9A-F]{2}:){5}[0-9A-F]{2}" | cut -f 1 -d " " | sort | uniq -d | wc -l`
11. rm -rf /tmp/maclist.txt
12. x=0
13. y=0
14. z=0
15. alarm=4
16. while [ $z -lt $i ]; do
17. let "z=$z+1"
18. maclist[z]=`echo $a |cut -f $z -d " "`
19. # echo "$z- ${maclist[z]}"
20. done
21. z=0
22. while [ $z -lt $j ]; do
23. let "z=$z+1"
24. macduplist[$z]=`echo $b |cut -f $z -d " "`
25. # echo "$z- ${macduplist[$z]}"
26. done
27. z=0
28. y=0
29. while [ $y -lt $i ]; do
30. let "y=$y+1"
31. while [ $z -lt $j ]; do
32. let "z=$z+1"
33. f=${maclist[$y]}
34. g=${macduplist[$z]}
35. if [ $f == $g ]; then
36. # if [ {$maclist[$y]} == {$macduplist[$z]} ]; then
37. let "dupcount[$z]=${dupcount[$z]}+1"
38. # echo "$y dup $f $g"
39. else
40. # echo "$y ${maclist[$y]} ${macduplist[$z]}"
41. echo
42. fi
43. done
44. z=0
45. done
46. z=0
47. y=0
48. while [ $z -lt $j ]; do
49. let "z=$z+1"
50. if [ ${dupcount[z]} -ge $alarm ]; then
51. # echo "awas! ${macduplist[z]}"
52. /sbin/sshwrap.exp 10.20.30.1 22000 diag diag "system script run sirine"
53. /sbin/sshwrap.exp 10.20.30.1 22000 diag diag ":log info ${dupcount[z]}-mac-address-${macduplist[z]}-more-than-$alarm-entries"
54. fi
55. # echo "${macduplist[z]}-${dupcount[z]}"
56. done
57. #
58. ==================potongdisini=====================================
59. # cat /sbin/sshwrap.exp
60. #!/usr/local/bin/expect -f
61. #spawn "ssh $argv 1 -p $argv 2 -l $argv 3 $argv 5"
62. #expect assword:
63. #send $argv 4\r
64. set addr [lindex $argv 0]
65. set port [lindex $argv 1]
66. set user [lindex $argv 2]
67. set password [lindex $argv 3]
68. set command [lindex $argv 4]
69. spawn ssh $addr -p $port -l $user
70. expect assword:
71. send $password\r
72. expect >
73. send $command\r
74. expect >
75. send quit\r
76. #
77. ==================potongdisini=====================================
78. [yusuf81@linkmedia] > system script print terse from=16
79. 0 name=sirine source=:for t from=1000 to=2000 step=20 do={:beep frequency=$t length=10ms; :delay 10ms}\r\n:for t from=2000
80. to=1000 step=-20 do={:beep frequency=$t length=10ms; :delay 10ms}
81. owner=yusuf81 policy=ftp,read,winbox last-started=dec/08/2008 20:25:16 run-count=48
82. [yusuf81@linkmedia] >

virus win32.sality

Sifat win32.sality yang aneh yaitu ketika kita mau menginstall antivirus, maka virus akan menghalangi dengan cara virus tersebut akan memblok running proses setup. Namun virus tersebut mendeteksi setup antivirus tersebut dengan melihat nama file master nya hahaha. Contohnya ketika kita akan menginstall avira atau antivirus "cap payung", nama file setup dari antivirus tersebut adalah "antivir_workstation_winu_en_h.exe". Jika kita tidak merename file tersebut, maka kita tidak bakalan bisa melakukan proses instalasi.
Namun jika file setup tersebut kita rename menjadi "a.exe", maka proses instalasi akan berjalan dengan mulusnya. Hahahaha, aneh tho, sifat ini bisa kita jadikan penanda apakah system telah tertular win32.sality.

Setelah lihat referensi, ternyata yang di stop itu proses yang mengandung nama "anti". Keterangan lebih lanjut silahkan lihat link referensi berikut ini:
http://www.eset.eu/buxus/generate_page.php?page_id=20180
http://www.bitdefender.com/VIRUS-1000232-en--Win32.Sality.M.html
http://www.sophos.com/security/analyses/viruses-and-spyware/w32salityaa.html
http://www.symantec.com/security_response/writeup.jsp?docid=2006-011714-3948-99&tabid=2