Christmas Challenge 2011

Well....I didn't win the annual Ed Skoudis and friends Christmas Challenge (http://pen-testing.sans.org/blog/2012/01/26/holiday-challenge-2011-winners-answers) but thought I would share my solution anyway.
Please fell free to sing along................


Well now Rudolph was frantic
cause Grandma was missing
The police thought he did it
His iPhone confirmed it.
The GPS on the phone
Matched a jpg showing Grandma's coat alone.

Rudolph heard little Timothy
interrupt and tell the court.
He had found some evidence
but did not know how to parse it out.

Cupid had mad Wireshark skills
and went right to work.
The first thing that he noticed
was an email and a doc in Word.

The email revealed a secret plan
that Grandma had cooked up.
She planned to frame Rudolph
and topped her insurance up.

The capture showed a fatal flaw
with Santaslist PHP.
Grandma took over MyDNS,
by hacking her some Apache.

Then with trojaned updates
and the DNS manipulation,
SQLite was used to add
the damning CellLocation.
Rudolph was proven innocent.
The Plaza was where they knew,
the police could find Grandma
wearing one red shoe.

BONUS: Extended special live only verse
And so little Timmy Tweeted,
"Network Miner is 'freein'
Rudolph’s not a flea bitten beast
and for Grandma there'll be no Caribbean"

W3AF update on Samurai WTF

Here is my unscientific will probably only work once method for getting the latest version of w3af to run in Samurai WTF (http://samurai.inguardians.com/):

After I updated w3af using the svn update menu in Samurai, launching the w3af GUI present some errors. It seems that the latest version of w3af needs some extra python fu libraries. Fortunately, w3af is very helpful and suggests which packages to install. Unfortunately, doing an apt-get for the required packages returned a message of Couldn't find package __X__ for each package.

The Samurai WTF version I am using, .9something, is running an older version of Ubuntu, Jaunty, whose packages are not actively maintained.
:
To get the required packages, the following worked for me"

Add the following to /etc/apt/sources

deb http://old-releases.ubuntu.com/ubuntu/ jaunty main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ jaunty-updates main restricted universe multiverse
deb http://old-releases.ubuntu.com/ubuntu/ jaunty-security main restricted universe multiverse

Do an apt-update
apt-get python-svn python-scapy and python2.6-dev
The next piece of the puzzle was python-nltk, which had to be installed manually from nltk.org. The source is available on the site. It require one python-yaml, which could be added with another apt-get install python-yaml..
Then finally, follow the instructions from w3af on how to install pybloomfiltermap and success....w3af GUI goodness.

Your mileage may vary.

Wow...has it been that long

In typical blogger fashion, I have let this slip to the bottom of my list. Also in typical Blogger fashion, I am now promising that I am going to post more.

Not sure if you can tell from the past posts, but I did put a lot of work into making sure everything worked which meant a little longer publishing cycle.

I am going to try to make it a little more "off the cuff". Future posts may not be quite as detailed of follow any certain format.

I have a variety of things queued up that I will be publishing over the next while. Some customizing Backtrack tips, exploration of tools and targets in Samurai WTF  and some short reviews of books (mostly technical).

Speaking of Samurai WTF....I will be (hopefully) mentoring SANS Security 542 Web App Penetration Testing and Ethical Hacking in beautiful down town Regina...see http://www.sans.org/info/97196.and keep watching the blog for updates.