Rumors say that str0ke, the maintainer of milw0rm has
died. There has been a lag recently in publishing new exploits on this website, so it might be true?
— Update —
Seems it was a fake: http://twitter.com/str0ke says he’*s alive and kicking.
Author Archive
str0ke dead?
Wednesday, November 4th, 2009FD: Wireshark Plugin for Mariposa Botnet
Thursday, October 29th, 2009Yamata Li from the Palo Alto Networks threat research team has developed a plugin for wireshark that allows you to view the obfuscated traffic generated by a Mariposa (Botnet) infected client.
This info was published on Full Disclosure today. The website mariposa-tool shows the detailed usage of this tool.
Nikto
Wednesday, October 21st, 2009A post in Full Disclosure reminded me of Nikto,
a security tool for webservices. Based on libwhisker it tests a whole lot of possible bugs
in a webserver/application. Works nice .. just wondering why it says spamversand.de runs on Microsoft IIS 5/0 ..?
50.000 complaints
Thursday, October 15th, 2009Whow.. I finally crossed the 50.000 complaints line. I got about 18.600 replies to
my complaints; either being autoreplies by abuse departments, activity statements of the
providers or “over quota” or similar bounce messages from abuse-mailboxes.
I hope that this service does something good.
20.000 complaints
Wednesday, August 19th, 2009Since the beginning of sending automated complaints due to attacks of my honeypot the system now has send out more than 20.000 emails. Some positive reactions have reached me, so I hope that this service is somewhat helpful. Funny are the bounces from the not reachable abuse-addresses .. will put them on a different page soon.
honeypot now complaints actively
Tuesday, July 14th, 2009I started the honeypot-complaint service – now every attck is reported to the appropriate email-address. This was kind of tricky, since the abusix-database does not match every time. I added a whois-query and grep in the output, too..
Milw0rm down
Wednesday, July 8th, 2009The exploit-portal Mil0rm has stopped.
Too many exploits and not enough time to verify them are the reasons.
Bad news..
Legato Networker: dynamic directory listing
Tuesday, July 7th, 2009You use Legato Networker and your directory-path are changing quite often? You want wo
parallelize your SaveSets? Here is how I do it:
on the backup server:
* enter “savepnpc” in the clients backup command.
* create 2 groups with this client starting shortly one after the other
on the client:
* in the /nsr/res directory create 2 file named <groupname1>.res and <groupname2>.res
group1 (which runs first) contains:
type: savepnpc;
precmd: "/usr/local/sbin/nsrupdate";
group2 contains:
----------------------------------
type: savepnpc;
precmd: "/usr/local/sbin/nsrupdate";
pstcmd: "/usr/local/sbin/nsrpostupdate";
The file nsrupdate reads the dir-listing and changes networker via nsradmin;
in the second group this saveset is then used and afterwards changed to something
small, which will be modified again in the the next run..
------------------------------
#!/usr/bin/expect
# erstelle Directory-Listing:
set var [glob -nocomplain -types d /backup_dir/*]
# trenne Dateien mit kommas
foreach f [lsort $var] {
set g $f,
append dir $g
append dir " "
}
# Kontrolle?
#puts $dir
#
# entferne Lerrezeichen Komma vom letzten Dir-Eintrag
set dir [string trim $dir ]
set dir [string trim $dir ,]
# starte das backup-administrationsprogramm
spawn /usr/sbin/nsradmin -s backupserver
expect "nsradmin>"
send ". type : NSR client;name:dummyr"
expect "nsradmin>"
send "update save set: $dirr"
expect "Update?"
send "Yr"
expect "updated resource"
send "quitr"
exit 0
------------------------------
------------------------------
#!/usr/bin/expect
# starte das backup-administrationsprogramm
spawn /usr/sbin/nsradmin -s backupserver
expect "nsradmin>"
send ". type : NSR client;name:dummyr"
expect "nsradmin>"
send "update save set: /tmp/yr"
expect "Update?"
send "Yr"
expect "updated resource"
send "quitr"
exit 0
---------------------------------
nice Stop – Sign
Saturday, July 4th, 2009looks like CDU has been hacked : http://www.cdu-bundestag.de/
shows a nice Stop-Sign 🙂
Actually, it isn’t hacked: cdu-bundestag.de (same as spd-bundestag.de) is a hoax;
it never belonged to the party.
New Honeypot
Tuesday, June 16th, 2009The nepenthes-teammembers have been busy working on a new (low interaction) honeypot.
The name dionaea is taken from another carnivore. Here is the link to the project-homepage. Sounds interesting, since it is written in C with python-modules attached.