2020 BSIDESROC load out!

ASullivan

Welcome to 2020. This year, we have BSIDESROC coming up in late March and, with a few of us hoping to compete and learn, I’ve adjusted my hacking kit and tools a little for this.

First things first, the rig: a Dell Precision M4800. This monster is perfect for VMs, compiling code (Arduino much?), and just a general work horse for travel. The machine is a Quad-core i7 (4C/8T) with 16GB of RAM and a 1TB SSD. I have two VMs specifically for this: One with Kali (latest rolling release) and ParrotOS which has grown on me quite a lot with its attractive GUI and driver support, especially with the Alfa chipsets.

For the kit: I’m using a SwissGear low key airport backpack that allows scanning without removing the laptop. It’s flat black, no obvious markers or anything that stands out; Grey man approach is key in any place as a hacker/pentester. I’m using an Alfa AWUS036NH 2W Wifi adapter for the packet injection and long range Wifi testing and monitoring. This has proven again and again to offer exceptional range with 2.4GHz bands and has been a go-to now for a while. I also bring an Alfa AC1900 WiFi Adapter as a backup if needed, but with the quad antenna layout, it tends to be far from discreet when using in public. Also in the pack are multiple flash drives, small screwdriver set and my Raspberry Pi loadout.

The Raspberry Pi’s are going to be a new thing this year. One, a PiratePi, is specifically set up for people to tinker, upload files onto and just general sh*tpost on and mess with. This unit is running another Alfa AWUS036NH for a massive upgrade in range; In testing, I could walk several houses away and still connect without issues. I also have something I stumbled on fairly recently: A “pwnagotchi” Pi Zero W unit that collects data on local networks with an AI driven system. This AI self learns and adjusts to local networks and is just a wonder to monitor and watch as it works. Both of these with a battery bank will be running on a Grid-It organizer, here:

Once I swap the case for the Pi Zero for one with a proper heatsink, this will easily fit in my pack and can run for over 30 hours at a time.

I absolutely cannot wait for this year and will hopefully be able to compete with the CTF tournament as well. Hopefully more information and photos coming in the future. Thanks for reading!

WordPress permalinks issues

ASullivan

After running into this issue once more with a fresh WordPress install, I’ve found the only way to use custom permalinks is to have them custom set up like this:

Go under Settings > Permalinks

Click on “Custom Structure” and insert like this:

/index.php/%year%/%monthnum%/%day%/%postname%/

After hours of google searching with people saying anything from disabling plugins (there were none) to reverting settings (it was a NEW site with no posts prior to changes), this is the ONLY way I’ve gotten the custom WordPress Permalinks to work in the manner I wanted. Hopefully this saves others time/frustration.

Worms Armageddon Drinking Game

ASullivan

Drinking situations for normal drink/beer/wine-cooler:

  • When a worm of yours gets hit for more than 50 damage, drink once
  • When a worm of yours gets hit for more than 100 damage, drink twice
  • When a worm of yours is killed by falling into the water, (NOT by homerun!), drink twice.
  • When a worm of yours is killed and leaves a tombstone on the playing field, drink thrice.
  • When two or more of your worms are killed at the same time, drink half of your drink (or finish if less than half full).
  • For every of your team’s tombstones that are dropped into the water, drink once. If it happens off-screen and cannot be verified, no drink needed.
  • When you grab a tool kit/weapon kit, all other players drink once.
  • When you grab a health kit, all other players drink twice.
  • When you grab both a toolkit and a health kit, all other players drink 4 times.
  • When you shoot, and your projectile ends up in the water without hitting anything, drink twice.
  • When you use your special weapon and miss, drink 4 times.
  • When you teleport out of harm’s way, drink twice.
  • Skip go, drink once.

Drinking situations for shots:

  • When you commit suicide, drink 1 shot
  • When you jetpack and end up killing yourself, drink one shot and drink once.
  • If you get killed by a prod, the only way of alleviating yourself of some of the shame is to drink 1 shot chased by a hearty chug of your drink.
  • If you get homerun’ed into the water, drink 1 shot and give your best Worm voice impression.
  • If a player skips a turn without moving AT ALL, everyone takes a shot
  • If you sit on a worm and make a wormstack for 15 seconds, bottom player takes a shot

Archiving youtube and website data

ASullivan

YouTube has become a bit of a dilemma for many people like myself who enjoy music and video edits with said music; We love supporting artists we enjoy along with the video edits. But, with companies locking down on content, these videos and channels are going offline suddenly and often without warning. I’ve taken to downloading backups of these as often as possible. With a little help from r/datahoarding, I now have a great set up that does this with minimal user intervention.

The fine folks over at r/datahoarding swear by a tool called “youtube-dl”. For an example install on an Ubuntu WSL in Windows:

 sudo yum install python-pip ffmpeg
 sudo pip install youtube-dl

Then it’s just a matter of providing content to download:

 youtube-dl -o '%(playlist)s/%(playlist_index)s - %(title)s.%(ext)s'  --format bestvideo+bestaudio/best --continue --sleep-interval 10  --verbose --download-archive PROGRESS.txt --ignore-errors --retries 10  --add-metadata --write-info-json --embed-subs --all-subs  https://www.youtube.com/channel/UCuCkxoKLYO_EQ2GeFtbM_bw

This will output everything from the channel its own directory (in this case “Uploads from Half as interesting”), sleep 10 seconds between downloads, store info/subs and store progress to prevent excessive traffic attempting to redownload videos. This is running on a dedicated system now called from Windows Task Manager once a week. The bonus is I have several playlists to download that I simply tag into whatever playlist I choose and the videos are download automatically in the background for future perusal.

Now, what about backing up an entire website/directory/open directory? Well, there’s a handy tool for that too: wget

Over at r/opendirectories (I love Reddit), the lads and lasses there have found some great data/images/videos/music/etc and it’s always a rush to get those downloaded before they’re gone. In some cases, it’s old software and images; Other times it’s old music from another country which is interesting to myself and others. In this case, again using the Windows Subsystem for Linux (WSL), you could do similar to below:

/usr/bin/wget -r -c -nH  --no-parent --reject="index.html*" "http://s2.tinydl.info/Series/6690c28d3495ba77243c42ff5adb964c/"

In this case, I’m skipping downloading the index files (not needed), the “-c” flag continues where it left off, and it downloads everything from that directory. This is handy for cloning a site or backing up a large amount of items at once. This can run for days possibly and can choke on large files (I’ve only seen issues with files over 70GB; Your mileage may vary) but this has worked well so far. I now have a bunch of music from Latin America in a folder for some reason.

What are your thoughts? Do you see a lot of videos missing or being copyrighted? Do you have a better way of doing this? Let me know!

My choices for browser addons

ASullivan

A web browser is something everyone uses but no one really thinks about. Sure, some people prefer Chrome or FireFox (myself being in the latter), or some even stick with the MS choice of Edge or IE. But what a lot of people don’t know, is there is a myriad of add ons, themes and plugins that make them so much more than just a browser. Some of these addons also provide extra layers of security. That’s where today’s discussion will be: The addons I run for security and privacy and what they do.

To start: Most of the addons I’ve looked into work on both Chrome AND FireFox. I recently switched back to FireFox after about a decade of chrome. Between the slowness, the RAM consumption and the amount of privacy issues, I’m glad I made this choice.

The first addon I’ll always run on ANY web browser is Adblock Plus. This should be a staple for everyone and anyone using the web and provides the first layer of security and privacy. This will knock out about 95% of ads in my experience with it and will greatly help your browsing experience. This also has a bonus perk: A lot of malware seen in the wild comes from bad or unsecure ads on websites so this will be a nice line of defense against these.

The second one I run is Privacy Badger. This prevents websites from tracking your progress site to site and will prevent such things as Facebook from monitoring your browsing after you leave a web page and continue on. The biggest surprise for this plugin was the sheer amount of trackers on news sites (localsyr.com is a great example). It’s a pleasant feeling seeing the numbers pop up and seeing how many trackers are stopped.

Next up is uBlock Origin which takes the role as a duplicate ad blocker as a second line of defense against ads. Per their website from the link above: ” An efficient blocker: easy on memory and CPU footprint, and yet can load and enforce thousands more filters than other popular blockers out there. ” I run this as a redundant blocker and it does seem to catch some of the items that Adblock plus might not hit.

Last, but not least: LastPass. I used a Google sync account for years to sync all my saved passwords and forms. In hindsight, it’s incredibly insecure and a terrible idea; Stealing someone’s unencrypted computer would allow extremely simple access to all of this information including passwords, logins and site history. With lastpass, this is all stored in an encrypted space which prevents someone with local access getting into it. I’m still testing it but so far it’s been a bumpy but improving ride. I look forward to being able to continue testing it.

Bonus add on: Disable HTML5 Autoplay. Almost ALL news sites (looking at you again localsyr…) have videos automatically play and scare the crap out of anyone not ready for a loud blast of audio. This is a huge pet peeve of mine and this app has been an absolute godsend for browsing.

What addons do you run? Have you tried these before? Thanks for reading and cheers!