Offensive Security Certified Professional

I am now an OSCP.

CTF 6

And the walkthrough for CTF6 is up on my channel as well. It's not too difficult. Although if anyone manages to find an alternative way of escalating privileges from the non-interactive shell without using the udev exploit, I would be grateful if you could drop a note to let me know.

CTF 5

The walkthrough for CTF5 is now up at my youtube channel. It's on a different level from the deIce pentest discs, and I took a longer time than I had expected.

pWnOS and Capture The Flag 4

The walkthroughs for pWnOS and Capture The Flag 4 (CTF4) are now up on youtube. They can be found at my channel here. I included a short supplement on exploiting webmin in pWnOS too.

de-ICE pentest discs completed

I completed the walkthroughs for 1.100, 1.110 and 2.100. You can find them here.

The Command Line

Linux Format talks about Arch Linux in issue 145. It says that "Arch is often described as the Linux distro for users who aren't afraid of the command line."

Well, I think that's incorrect.

Arch is the Linux distro for users who love the command line.

Port scanning in bash

There was a short discussion over at securityoverride on port scanning using only bash, and I whipped up the short piece of code below. Unfortunately, while udp scans are possible, I don't think stealth scans are possible using bash alone.

#!/bin/bash

for p in {1..1024}
do
(echo >/dev/tcp/192.168.0.50/$p) && echo "port $p is open."&
done

If you don't want Connection refuses and Connection timeouts cluttering your screen, add in the /dev/null stuff:

(echo >/dev/tcp/192.168.0.50/$p) >/dev/null 2>&1 && echo "port $p is open."&

And keep an eye on the number of ports you are scanning -> number of child processes being spawned.

Openbox, tint2 and conky

Hmm, just a quick update on Crunchbang Statler... it came with so many pre-installed packages that I got rid of it the same day I installed it, a few weeks ago.

3 good things happened though, namely: openbox, tint2 and conky.

I removed all traces of KDE from my Arch system and installed the 3 above-mentioned items instead. My Arch desktop has never looked so clean and sleek.

The only thing I miss is KDE's Dolphin filemanager. But thus far, qtfm is more than an able replacement.

And right now, I can go from startup to internet-connectivity in less than 60 seconds.

#!

#! Statler looks good!

A simple Syn scanner

I coded a simple Syn scanner in C recently. I can't think of a good name, so I will just call it dearmoScan-0.1 for now. You can download it here.

I only coded it out of interest, and to learn socket programming. It doesn't do much, except send out Syn packets to your target IP and target port(s). It can't capture packets... yet, so you need to run something like tcpdump concurrently to capture replies. (Which can be considered a good thing, since it forces you to learn how to read tcpdump output on the fly.) Anyway, I will add this functionality and implement additional scans in future, if I have the time.

Frankly speaking though, if you need a robust scanner, use nmap, hping3 or scapy.

My primary OS

I use archlinux.

And it is brilliant.