Сканиране за заразени файлове ( php троянски коне, php backdoors )

# ТЪрси php файлове със съдържание eval и GLOBALS
find $PWD -iname \*.php -print0 | xargs -0 grep -E "eval.*GLOBALS"|awk -F ": " '{print $1}' >> trojans.txt

#Търси eval +стрингове над 200 символа
find $PWD -iname \*.php -print0 | xargs -0 grep -e '[^\ ]\{200,\}'|grep "eval"
#Търси eval
find $PWD -iname \*.php -print0 | xargs -0 grep "eval"
cat impulsko_trojans.txt |grep ".php"|awk -F ".php:" '{print $1.".php"}';

VN:F [1.9.22_1171]
Rating: 5.0/5 (1 vote cast)
VN:F [1.9.22_1171]
Rating: +1 (from 1 vote)

ssl letsencrypt nginx

Проверка на сертификат: https://www.sslshopper.com/ssl-checker.html

Подновяване на letsencrypt сертификатите: certbot-auto renew

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)

Интересни dev приложения за android

Ftp Server
https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver&hl=bg

Palapa Web Server
https://play.google.com/store/apps/details?id=com.alfanla.android.pws&hl=en

SSHDroid
https://play.google.com/store/apps/details?id=berserker.android.apps.sshdroid

JuiceSSH
https://play.google.com/store/apps/details?id=com.sonelli.juicessh&hl=bg

VN:F [1.9.22_1171]
Rating: 5.0/5 (1 vote cast)
VN:F [1.9.22_1171]
Rating: +1 (from 1 vote)

Защита на WordPress от Bruteforce

Много ботово се опитват да се логнат с brutforce и ето едно просто решение (не е 100% гаранция, но е втора бариера един вид…)
# Protect wp-login
<Files wp-login.php>
AuthUserFile /www/.htpasswd
AuthName "Private access"
AuthType Basic
require user amri
</Files>

VN:F [1.9.22_1171]
Rating: 5.0/5 (1 vote cast)
VN:F [1.9.22_1171]
Rating: +1 (from 1 vote)

Voice recognition

Разпознаване на глас, чрез гугъл: https://github.com/amsehili/gspeech-rec

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)

Обратен ssh тунел (reverse ssh)

Клиента се свързва с машината която има реално IP(DOMAIN.bg) и прави отворен порт 19999

ssh -R 19999:127.0.0.1:22 user@DOMAIN.bg -oPort=33

Когато на DOMAIN.bg се вържем през ssh на 19999 ще се свържем директно със ssh-а на машината с нереално IP

Пример
На машината с реално ИП (DOMAIN.bg):
ssh amri@127.0.0.1 -p 19999

Свързваме се директно към машината с нерелно IP

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)
VN:F [1.9.22_1171]
Rating: +1 (from 1 vote)

Подслушване на пароли, чрез tcpdump (ftp, http и т.н.)

Проблема беше, че има фтп потребител на машината който влиза, но се знае паролата и за да не се променя затова се реши да се пусне tcpdump и така да се прослуша с каква парола влиза потребител в съответната машина:

tcpdump -l -A src IP_CLIENT and port ftp

tcpdump port http or port ftp or port smtp or port imap or port pop3 -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)

Инсталиране на Electrum Bitcoin Wallet под Linux

su-;
apt-get install python3-setuptools python3-pyqt5 python3-pip;
pip3 install https://download.electrum.org/3.0.6/Electrum-3.0.6.tar.gz;

Грешка:
error: invalid command 'bdist_wheel'

Решение:
pip install wheel;
pip install setuptools --upgrade;
pip3 install https://download.electrum.org/3.0.6/Electrum-3.0.6.tar.gz
Collecting https://download.electrum.org/3.0.6/Electrum-3.0.6.tar.gz
Using cached https://download.electrum.org/3.0.6/Electrum-3.0.6.tar.gz
Requirement already satisfied (use --upgrade to upgrade): Electrum===3.0.6 from https://download.electrum.org/3.0.6/Electrum-3.0.6.tar.gz in /usr/local/lib/python3.5/dist-packages
Requirement already satisfied (use --upgrade to upgrade): pyaes>=0.1a1 in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): ecdsa>=0.9 in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): pbkdf2 in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): requests in /usr/lib/python3/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): qrcode in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): protobuf in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): dnspython in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): jsonrpclib-pelix in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): PySocks>=1.6.6 in /usr/local/lib/python3.5/dist-packages (from Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): six in /usr/lib/python3/dist-packages (from qrcode->Electrum===3.0.6)
Requirement already satisfied (use --upgrade to upgrade): setuptools in /usr/lib/python3/dist-packages (from protobuf->Electrum===3.0.6)
Building wheels for collected packages: Electrum
Running setup.py bdist_wheel for Electrum … done
Stored in directory: /root/.cache/pip/wheels/3f/90/d2/d93db52c5f0a5c620ff486c44e1810e86c7b97d9496d01bcff
Successfully built Electrum

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)
VN:F [1.9.22_1171]
Rating: 0 (from 0 votes)

Личен Блог на Мартин Петров