Format pcap file
Dalam Global Header, ada timzone info.
Dalam Packet Header ada timestamp.
Dalam Packet Data ada network traffic yg lalu (dihantar/diterima) NIC tersebut.
Packet vs Frame
Frame is refer to data link layer
Packet refer to network layer
Ref:
- https://www.elvidence.com.au/understanding-time-stamps-in-packet-capture-data-pcap-files/
Elastic will auto create index when it receive request from client.
If the index state by the client not exist, it will auto create it base on template.
List of available template:
GET /_template
To put new template:
PUT /_template/supertimeline
{
"index_patterns": "st-*",
"settings": {
"index" : {
"refresh_interval": "10s" ,
"number_of_shards" : 20,
"number_of_replicas" : 1
}
}
}
Scapy adalah library python yang boleh digunakan untuk edit packet dalam dalam fail pcap.
Cara nak tukar timestamp pada setiap packet
wrpcap("out.pcap", cooked)
Cara nak tukar mac address
mac_asal = a
mac_baru = b
if ARP in p:
if p[ARP].hwsrc == mac_asal
p[ARP].hwsrc = mac_baru
enable/disable firewall
netsh advfirewall set currentprofile state off netsh advfirewall set allprofiles state off
enable file sharing:
netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes, and hit Enter.
create share folder:
net share Public=s:\Public /GRANT:Everyone,FULLnet share share_folder_name /deletenet use Z: \\computer_name\share_name /PERSISTENT:YES
net use Z: /delete
/E – Copy subdirectories, including any empty ones.
/H - Copy files with hidden and system file attributes
/C - Continue copying even if an error occurs.
/I - If in doubt, always assume the destination is a folder. e.g. when the destination does not exist.
SFTP Setup:
/etc/ssh/sshd_config:
Subsystem sftp internal-sftp
Match Group sftpusers
PasswordAuthentication yes
ChrootDirectory /srv/sftponly
AllowTCPForwarding no
X11Forwarding no
ForceCommand internal-sftp
Adding the sftp group:
groupadd sftpusers
Creating the only account for SFTP Access
useradd -d /srv/sftponly -g sftpusers -s /bin/false sftpuser
passwd sftpuser
Restart openssh:
/etc/init.d/ssh restart
Setting Permission for the directory
chown root:root /srv ; chown root:root /srv/sftponly ; chmod 755 /srv ; chmod 755 /srv/sftponly
Making a Public Directory:
mkdir /srv/sftponly/public
chown sftpuser:sftpusers /srv/sftponly/public/
chmod 333 /srv/sftponly/public/
ls -ltd
d-wx-wx-wx 2 sftpuser sftpusers 4096 Oct 15 14:51 /srv/sftponly/public/ref
https://www.unix.com/unix-for-advanced-and-expert-users/238265-sftp-resticting-only-uploading-file.html
winlogbeat.exe test config -c winlogbeat.yml -e
...
...
#output.elasticsearch:
# Array of hosts to connect to.
# hosts: ["localhost:9200"]
...
...
output.logstash:
# The Logstash hosts
hosts: ["localhost:5044"]
...
...
# Install Service
.\install-service-winlogbeat.ps1
# Uninstall Service
.\uninstall-service-winlogbeat.ps1
Join Domain:
netdom join %computername% /domain:vdom /reboot /UserD:user /PasswordD:* /Force
netdom remove %computername% /domain:vdom /reboot /UserD:user /PasswordD:* /Force
Ref
- https://www.dell.com/support/article/en-my/how10118/joining-and-removing-a-server-from-an-active-directory-domain-using-netdom-exe?lang=en
- https://serverfault.com/questions/412263/command-to-remove-computer-from-non-existant-domain
1) create template json
vim elasticsearch-template_v00005.json
{
"index_patterns": "logstash_v00005-*",
"settings": {
"index" : {
"refresh_interval": "10s" ,
"number_of_shards" : 1,
"number_of_replicas" : 0
}
}
} 2) import template and check
$ curl -XPUT -H 'Content-Type: application/json' 'http://localhost:9200/_template/logstash_v00005?pretty' -d@elasticsearch-template_v00005.json
{
"acknowledged" : true
}and check..
$ curl -XGET 'http://localhost:9200/_template/logstash_v00005?pretty'
{
"logstash_v00005" : {
"order" : 0,
"index_patterns" : [
"logstash_v00005-*"
],
"settings" : {
"index" : {
"number_of_shards" : "1",
"number_of_replicas" : "0",
"refresh_interval" : "10s"
}
},
"mappings" : { },
"aliases" : { }
}
}3) set logstash output config
cat /etc/logstash/conf.d/98-elasticsearch-output.conf
output {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => true
template_overwrite => true
template => '/etc/logstash/elasticsearch-template_v00005.json'
template_name => 'logstash_v00005'
index => 'logstash_v00005-%{+YYYY.MM.dd}'
}
stdout { codec => rubydebug }
}last, dont forget to restart your logstash
ref https://github.com/elastic/logstash/issues/10687
1) net share
2) $ at the end(eg: C$):
- is an administrative share.
- hidden,
- need membership in the local Administrators security group.
3) fsmgmt.msc
4) Default sharre
- DriveLetters$
- ADMIN$ (c:\Windows)
- IPC$
- NETLOGON (on DC only)
- SYSVOL (on DC only)
5) EVENT LOG
a) 5142 - success create file share
b) 4657 - registry value was modified
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Shares
Sometime task take a very long time to complete such as reindex a big index. This will cause a timeout.
Actually the task is not terminate, but still continue on the background. How to check/list these background process?
1) list all tasks
GET _tasks?actions=indices*reindex- KVM is linux kernel modul. No gui. Only provide CPU and RAM, not hd, network etc.
- Qemu is an emulator of varied cpu. It also has features to use KVM which will boost performance compare to other emulated cpu type.
-Libvirt as wrapper to start QEMU with the right options.
For more, refer this good explanation:
create snapshot:
sudo virsh snapshot-create-as <domain> <snapshot-name>
This will create xml file in /var/lib/libvirt/qemu/snapshot/<domain>/<snapshot-name>.xml
Normally for snapshot, will have Copy-On-Write. Means anything changes will be save somewhere else instead of main disk image.
But for qcow2, little bit different. The changes still will be store on the main disk image.
To list snapshot:
# qemu-img snapshot -l /var/lib/libvirt/qemu/centos7-server.qcow2
Snapshot list:
ID TAG VM SIZE DATE VM CLOCK
1 live_snapshot1 2.3G 2020-08-25 12:44:09 00:32:40.190https://unix.stackexchange.com/questions/570414/understanding-how-libvirt-snapshots-are-stored
How to install qemu in a proxmox guest.
(Baremetal has proxmox, guest will has qemu(to install another guest on top of qemu)
Qemu/KVM is a hypervisor, same also as proxmox.
1) Enable Nested virtualization on proxmox
a)- check is nested enabled:
cat /sys/module/kvm_intel/parameters/nestedY - yes
# echo "options kvm-intel nested=Y" > /etc/modprobe.d/kvm-intel.conf
modprobe -r kvm_intel modprobe kvm_intel
egrep '(vmx|svm)' --color=always /proc/cpuinfo
-list storage(pool)
virsh pool-list
-list volume
virsh vol-list __poolName__
-list vm
# virsh list --all
good one: https://serverfault.com/questions/434064/correct-way-to-move-kvm-vm/434070#434070
1- to list available package:
pip install thepackage==randomwords
(attemp to install unexist package, will return error, and pip will display available package)
2- install certain version of package
pip install libvirt-python==5.10.0
Laravel has capability to send task/job to worker. Means when the request coming from client/browser, certain task/code can be pass to be process later by worker. This will enable laravel to complete the http response faster, without need to wait for that certain code to finish process.
In laravel, this can be done by creating a class that implements ShoudQueue.
class ProcessPodcast implements ShouldQueuephp artisan queue:retry all
$ curl -H "host: www.google.com.au" www.google.co.uk
You have installed your custom CA in your client machine. Using curl, everthing is fine(refer here).
But since your python script use virtenv, your script cannot see the custom CA.
This is because python virtualenv looking the certifcates in different place than the normal python
$ python -c "import requests; print ( requests.certs.where() )"
/etc/ssl/certs/ca-certificates.crt
$ (.venv) python -c "import requests; print (requests.certs.where())"
.../.venv/lib/python3.6/site-packages/certifi-2020.6.20-py3.6.egg/certifi/cacert.pemSolution, is to import the custom CA to the virtual Environtment.
openssl x509 -in $specific_ca.crt -text >> $virtualenv/lib/python3.6/site-packages/certifi-2020.6.20-py3.6.egg/certifi/cacert.pemref:
openssl x509 -outform der -in CERTIFICATE.pem -out CERTIFICATE.crt
ss command from iproute2 with key -Kss -K dst 192.168.1.214 dport = 49029
the kernel have to be compiled with CONFIG_INET_DIAG_DESTROY option enabled.$ git fetch --all --tags$git tag$ git checkout tags/_tag-name_ -b __branch-name__ $ git merge branch_with_new_features$ git tag vX.x$ git push origin vX.x no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 user@legacyhost
Host myhost.example.org KexAlgorithms +diffie-hellman-group1-sha1
GET _cat/shards?v=true&h=index,prirep,shard,store&s=prirep,store&bytes=gb&index=index_name*
output {
rabbitmq {
codec => plain
host => localhost
exchange => yomtvraps
exchange_type => direct
key => yomtvraps
# these are defaults but you never know...
durable => true
port => 5672
user => "guest"
password => "guest"
}
}
Ctrl+b c Create a new window (with shell)Ctrl+b w Choose window from a listCtrl+b 0 Switch to window 0 (by number )Ctrl+b , Rename the current windowCtrl+b % Split current pane horizontally into two panesCtrl+b " Split current pane vertically into two panesCtrl+b o Go to the next paneCtrl+b ; Toggle between the current and previous paneCtrl+b x Close the current pane