Tag: security

Posted on

How to login into OpenID sites Anonymously

OpenID is a standard that allows users to be authenticated in a decentralized manner. OpenID enables user to be identified across the internet using a single unified OpenID identifier (or account).

However some websites (particularly blog and forums) insist users to login in order to leave a short comment or remarks which sometimes is not convenient for some users that value anonymity.

OpenID Tango

The OpenID Anonymity service is an OpenID provider that helps you get around website or application that requires OpenID login. To use OpenID Anonymity service, the user only need to key in its URL Identifier – http://openid.anonymity.com/some_random_id and the user will be automatically authenticated, without the need to log-in or to enter password, which is very convenient if one needs to be anonymous.

Try it!

p/s: Additionally here’s a collection of Public Domain OpenID (tangofied) icons, created by Jakub Szypulka

Posted on

Debian Squeeze 6.0.2 update (Security – important)

Debian project has released update on Debian 6.0 (Squeeze) which addressed several security issues and bugfix. Debian Squeeze users are advised to update their installation using “apt-get update” and “apt-get upgrade” command to ensure all of the updates are installed properly.

p/s: Although I currently use Ubuntu, I was actually a Debian user and I continue to use Debian on my VPS to host this website till this very day. Without Debian, I would never has discovered thousands of wonderful open source software in it vast software repositories :)

Posted on

How to limit MySQL port access to specific network

MySQL service port are not meant to be accessible to the outside world as it would become a security concern to the administrator.

Although MySQL server (mysqld) by itself has a built-in mechanism to deny access from unauthorized ip-address, it still does not protect it from being overwhelmed by multiple malicious requests or buffer overflow attack directed to the server.

One of the solution is to limit the MySQL port access to trusted network using iptables

This assume your trusted network has the address within the range of 192.168.1.1-192.168.1.254


iptables -A INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT

MySQL server (mysqld) uses port 3306.

Note: Always assume the internet as the untrusted network!

Posted on

How to crack SHA1, MD5 and Windows NTLM password hash using Rainbow tables in Linux

Rainbow tables is a form of attack method used to crack stored cryptographic hashes commonly used as passwords in various application.

It is similar to brute-force and dictionary attack that it will try to compare the resulting hash with the hash it attempts to crack, except in Rainbow tables, the possible matching hashes are all precomputed before hand, and it uses reduction function to double the lookup speeds at the expense of the storage space (time vs space trade off).

Project Rainbow-Crack offer downloadable binaries (free but not opensource) for GNU / Linux and Microsoft Windows operating system. The application package comes with several tools that can help in generating (rtgen), sorting (rtsort) and cracking (rcrack) sha1,md5 and NTLM hashes.

How to use rtgen, rtsort and rcrack ?
First before starting to crack sha1 hashes, we need to generate rainbow table with rtgen.
rtgen

rtgen sha1 loweralpha-numeric 1 8 0 5000 6553600 0

Usage:
rtgen <hash type> <loweralpha | loweralpha-numeric | numeric | mixalpha-numeric| alpha-numeric> <min length> <max length> <table_index> <chain_len> <chain_num> <part_index>

rtsort
Then we need to use rtsort to sort the rainbow tables generated by rtgen.

rtsort *.rt

rcrack
Finally run rcrack to crack the hashes

rcrack *.rt -l hash1.txt

or


rcrack *.rt -h af8978b1797b72acfff9595a5a2a373ec3d9106d

crack process

For more examples to generate and use rainbow tables, please refer to Project Rainbow-Table Example