blog.andrewallen.co.uk

blog.andrewallen.co.uk

Jul 9 / 2:02am

Maltego 3.0 Community Edition - A Quick First Look

Just announced on the Maltego blog (http://maltego.blogspot.com/2010/07/ce-is-live.html), the community edition of version 3.0 is now available. I downloaded and did a quick test of the new product this morning, which already seems quicker than the previous versions, and is themed with a Microsoft ribbon style interface.

You now need to register to use the software (you're prompted during installation), and some of the tasks that needed manual intervention are now automated (such as updating the transforms, which is now done as part of the installation process). Also, where previously you needed to go through and accept the disclaimers on certain transforms before you used them, now on first use you are presented with a dialog box which helps with not breaking up your work flow.

Limits are also reduced - one which I reached regularly on 2.0 was the 75 transforms per day - I don't remember seeing where these new limits are documented, but maybe there is something over on the Maltego blog I missed.

                                 
Click here to download:
Maltego_3.0_Community_Edition_.zip (1626 KB)

Loading mentions Retweet

Comments (0)

Jun 3 / 4:31am

Silently Install the Java Runtime on Windows

Java is one of those components that most users have installed, but can be infrequently updated and forgotten about. Updates are published on a regular basis, the most recent of which having been set free in April of this year, and although supplied with a self-updating mechanism, it's just not suitable within controlled corporate environments with good acceptable use polices in place.

Following the trend of other popular software, the Java Runtime is also bloating out with other 'useful-less' components, so on a default install you can find yourself with extra memory resident processes, browser plug-ins and helper objects which are just not required to provide applications access to the Java Runtime.

Because of this, I now update my own lab environment with a scripted silent install of Java - it does not include the extra plug-ins and browser helper objects during installation, or the memory resident updater tool. Are there any other suggestions to keep the Java Runtime installation down to a minimum? I believe in only installing what is absolutely required.


Loading mentions Retweet

Comments (0)

Dec 10 / 5:56am

Security Podcasts on my Podroll

There are now quite a number of podcasts available, covering all areas of Information Security - I find it a great way to stay up to date with the industry news, particularly when commuting. A fairly comprehensive list can be found at http://getmon.com/, while my current regular favorites are below:

  • Paul Dot Com Security Weekly (feed) - one of the longest established US based security podcasts, normally around 2 hours long, with interviews, technical segments and industry news.
  • Risky Business (feed) - an Australian based ~30 minute show, neatly split into news, interview and sponsor interview
  • 2600 | Off The Hook (feed) - airs every Wednesday night at 7:00 PM EST in New York City on listener supported WBAI 99.5 FM.

I've created an aggregated feed of my Podroll, which makes subscribing quick and simple - on my phone, it means adding just one feed, instead of lots of different feeds for different podcasts (very useful when rebuilding your phone after flashing the latest ROM)... I did try RSSmix.com, which IronGeek also uses, but I found updates through the site don't seem to be that regular (and the site itself can run pretty slow as well), which means missing out on the latest content. Instead, I use Yahoo Pipes to merge and manipulate the various feeds together, and then publish through Feedburner to get some extra control / statistics.

You can subscribe to my Podroll feed here (http://feeds.andrewallen.co.uk/andrewallen/podroll), or you can view the Yahoo Pipes source here.

Update - Dec 14

I've updated the pipe to include the following feeds, and also strip posts with no enclosures:

Loading mentions Retweet

Comments (0)

Nov 13 / 1:51pm

PostgreSQL not starting on BackTrack 4 Pre-Final

If you are following the latest releases in regards to BackTrack, following a recent update you may have experienced error when PostgreSQL attempts to start:

Starting PostgreSQL 8.3 database server: main* The PostgreSQL server failed to start. Please check the log output:

Then further down:

could not load server certificate file “server.crt”: No such file or directory

Here is a quick fix - at the console, type:

cd /etc/ssl/certs
ls -ld /etc/ssl/private
sudo ls -l /etc/ssl/private/
make-ssl-cert generate-default-snakeoil -force-overwrite
cd /etc/ssl/certs

Re-run the update commands, and you should be good to go:

apt-get update
apt-get upgrade
apt-get dist-upgrade

Loading mentions Retweet

Comments (0)

Nov 3 / 5:45am

Connecting USB Devices to VirtualBox Guests

About 6 months ago I switched to using VirtualBox on my Mac, in place of VMware Fusion - It provided decent performance, works well across multiple spaces and of course is free. I have always felt that VMware have dumbed down the Fusion client when compared to Workstation on Windows, as various options seem hidden away from view (although configurable when you get down and dirty in the VMX files).

The only remaining issue I had experienced until recently, was that some USB devices would not map through correctly to the guest - in my case Windows 7 Ultimate 64-bit. When trying to connect the device on the first attempt, nothing would appear to happen, then when you tried to map it through again you'd get various error messages.

After a brief Googling session, I found the fix was to add a 'USB Device Filter' for the affected device, under the 'USB Settings' of the guest, but making sure to clear all fields except the 'Name'. Once the guest was powered up, I no longer had any issues mapping through the USB device.

Loading mentions Retweet

Comments (0)

Oct 12 / 2:32am

Update the Search Behaviour of the Firefox Address Bar

After having used Chrome for so long on my Mac (in the dev channel via the very useful Chromium Updater), switching back to Firefox reveals an interesting habit - searching via the address bar. In Chrome, you can type your search directly in the address bar and you'll get redirected to Google for your search results, however in Firefox it reacts slightly differently - it will carry out a Google "I'm feeling lucky" search which will direct you to the first result Google returns.

You can customise this behavior in the 'about:config' page within Firefox. Type 'about:config' into the address bar, and then update the 'keyword.URL' field to your chosen search engine. For example, if you wanted to use Scroogle instead, you would type:

By the way, If you are not already using Scroogle, it's a simple way to anonymise your search requests.

Loading mentions Retweet

Comments (0)

Oct 10 / 6:18am

Installing and Uninstalling Software in Windows Safe Mode

It's quite common that you need to remove some software when running in Safe Mode, particularly when you find your system is unusable when running normally. However, by default, the key service required to manage installed software is not running, and cannot be started (the Windows Installer Service, aka MSIServer).

Here is a quick way around this issue - by adding the registry entry below, you'll then be able to start the service and remove / install the software you require.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer" /VE /T REG_SZ /F /D "Service"
sc start msiserver`

Once this change is made, it will remain permanent, and you won't need to re-apply it in the future, although you'll still need to start the msiserver service when required.

Loading mentions Retweet

Comments (0)

Oct 1 / 5:59am

Transferring Files from a Decommissioned Netware Server

Here's the situation - you've remotely migrated all the data and printing services from a Netware server onto it's replacement, and you have just completed uninstalling eDirectory / NDS... the servers are locked away in the data center.

Just before you power it off, you find that one of the migrated volumes are not complete - data is missing! D'oh!

The old server is still powered up, but you can no longer authenticate to it across the network (no longer in the tree) - tools such as Adrem Free Console are no good, since you need to be able to authenticate. You still access to the server console, via the iLO (Integrated Lights-Out) / DRAC (Dell Remote Access Controller) - whew!

Getting the data off via ftp is the most straight forward, but is not a native app - thankfully it can be accessed via Bash. At the console prompt, type 'bash' then <enter> to drop into the shell. By default you'll find yourself on the SYS volume, with no obvious way of getting onto any of the other volumes. The data you need to rescue is on the DATA volume.
  1. At the Bash prompt, type 'mkdir /data', then press <enter>
  2. Type 'vi /etc/PATHTAB', then <enter>.
  3. Hit 'i' to enter insert mode and type '/data data:\'.
  4. Press 'Escape', then ':wq' and <enter>.
  5. Type 'exit' <enter> to unload the Bash shell, then type 'BASH' <enter> at the console prompt to load the shell again.
  6. Type 'cd /data' <enter> then 'ls' <enter> to display the root of the DATA volume - voila.
Now you have access to the data, the final step is to manually transfer over the missing portions of the data - using ftp, navigate to your selected folder, type 'ftp' <enter>, then 'open <new server>'. Once you've entered your username and password, you can now 'put <file>' to transfer across your missing data - you get the idea anyway.
Loading mentions Retweet

Comments (0)

Sep 30 / 5:23am

Customising the Command Prompt

If you don't currently follow the Command line Kung Fu blog, I highly suggest you do! Originally started back in February this year by Paul Asadoorian (of PaulDotCom), Ed Skoudis and Hal Pomeranz, each week they publish solutions to challenges posed to each other, using only the command line utilities included on a default installation of Windows, Linux and Mac OS - many of the published solutions contain really useful snippets of code to include in your own scripts.

Something that was covered in Episodes #28, #49 and #52 was customising the command prompt in various ways. On my own Windows systems I now include the following command prompt customisation by default:

30/09/2009 13:30:34.98 C:\>

Why? The biggest benefit is knowing when commands were started, and when they completed. Many tools don't provide feedback with time and dates, and so by the nature of the date and time being printed on screen each time a prompt is provided, you get a quick and dirty way to see how long a command took to execute.

Setting the prompt temporarily can be done with the 'prompt' command (or 'set prompt'), while making the change permanently can be done by adding an entry to the registry - both can be seen below.

In addition, my prompt also displays how many paths are on the pushd and popd stack, as also seen above.
Loading mentions Retweet

Comments (0)

Sep 28 / 6:14am

Indisposable Tools - Notepad++, a Notepad Replacement for Windows

Microsoft Notepad is probably (and unintentionally) one of my most used utilities, for example, when when stripping text formatting from content cut/copied from Word or Internet Explorer, or editing batch, vb, or <insert language here> scripts.

It's very quick to bring up Notepad (Windows + R, notepad <return>) as quick dumping ground for the clipboard, and uses very little resources, however it does have it's limitations - Unix carriage returns, no regular expression support to name but a few.

A highly recommended tool open-source replacement, which has now become one of my indisposable tools, is Notepad++.

"Notepad++ is a free (as in "free speech" and also as in "free beer") source code editor and Notepad replacement that supports several languages. Running in the MS Windows environment, its use is governed by GPL License."

"Based on a powerful editing component Scintilla, Notepad++ is written in C++ and uses pure Win32 API and STL which ensures a higher execution speed and smaller program size. By optimizing as many routines as possible without losing user friendliness, Notepad++ is trying to reduce the world carbon dioxide emissions. When using less CPU power, the PC can throttle down and reduce power consumption, resulting in a greener environment."

Some of the key benefits, for me anyway, include:
  • Syntax Highlighting and Syntax Folding for various languages (including XML, HTML, Perl, Python, VB/VBS, Batch etc)
  • Multi-Document and Multi-View allowing you to view multiple documents and have multiple views between them, or in the same document
  • Regular expression Search/Replace is fully supported
  • File status Auto-detection, which is particularly useful when working on live files, such as logs etc

There are also a large number of plugins, which extend Notepad++ even further.

Installation is straight forward - just download the latest installer (or the .zip file), and accept all the defaults. I can also highly recommend installing the Notepad++ launcher, which will allow you to replace Notepad completely:
  1. Backup your original Notepad.exe
  2. Copy notepad.exe which comes with this package into 4 directories (in given order) :
    - c:\windows\servicepackfiles\i386
    - c:\windows\system32\dllcache
    - c:\windows\system32
    - c:\windows
  3. When you replace notepad.exe in c:\windows\system32 and c:\windows, a "Windows File Protection" message box appears, click Cancel. Then another message box appears, click OK.
  4. Modify you registry (if you use installer to install your Notepad++, you don't need to do this step): Create key \HKEY_LOCAL_MACHINE\SOFTWARE\Notepad++, then add your Notepad++ full path as the default value of this key. In my case, it's C:\Program Files\Notepad++.
If you need any further information, check out the NpWiki++.
Loading mentions Retweet

Comments (0)