Linux Blog

Automatic SQL Injection Exploitation Tool - TheMole

Author is not responsible for any damage or illegal actions caused by the use of this program.
Use on your own risk!

SQL injection is yet another common vulnerability that is the result of lax input validation. Unlike cross-site scripting vulnerabilities that are ultimately directed at your site’s visitors, SQL injection is an attack on the site itself—in particular its database. The goal of SQL injection is to insert arbitrary data, most often a database query, into a string that’s eventually executed by the database. The insidious query may attempt any number of actions, from retrieving alternate data, to modifying or removing information from the database.

TheMole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based technique.

TheMole Features
* Support for injections using Mysql, SQL Server, Postgres and Oracle databases.
* Command line interface. Different commands trigger different actions.
* Auto-completion for commands, command arguments and database, table and columns names.
* Support for query filters, in order to bypass certain IPS/IDS rules using generic filters, and the possibility of creating new ones easily.
* Developed in python 3.

Basic Ubuntu System Security Checks - CheckSecurity

The checksecurity command runs a small collection of simple system checks which are designed to catch a few common security issues.

The checksecurity command scans the mounted files systems (subject to the filter defined in /etc/checksecurity.conf) and compares the list of setuid programs to the list created on the previous run. Any changes are printed to standard output. Also, it generates a list of nfs and afs filesystems that are mounted insecurely (i.e. they are missing the nodev and either the noexec or nosuid flags).

checksecurity is run by cron on a daily basis, and the output stored in /var/log/setuid/setuid.changes.

Checksecurity Installation:
Under Ubuntu Linux, open the terminal and type following command to install checksecurity:

sudo apt-get install checksecurity

GUI Tool to build Firewall on Ubuntu Linux - Firestarter

Firestarter is a firewall tool for Linux, and uses GNOME. You can use the wizard to create a basic firewall, then streamline it further using the dynamic rules. You can open and close ports with a few clicks, or stealth your services giving access only to a select few. It features a real-time hit monitor which you can watch as attackers probe your machine for open ports.

Firestarter itself is not a firewall, rather, it is a frontend for configuring iptables, which is the firewall system built into the Linux kernel.

Firestarter features
    Open Source software, available free of charge
    User friendly, easy to use, graphical interface
    A wizard walks you through setting up your firewall on your first time
    Suitable for use on desktops, servers and gateways
    Real-time firewall event monitor shows intrusion attempts as they happen
    Enables Internet connection sharing, optionally with DHCP service for the clients
    Allows you to define both inbound and outbound access policy
    Open or stealth ports, shaping your firewalling with just a few mouse clicks
    Enable port forwarding for your local network in just seconds
    Option to whitelist or blacklist traffic
    Real time firewall events view
    View active network connections, including any traffic routed through the firewall
    Support for tuning ICMP parameters to stop Denial of Service (DoS) attacks
    Support for tuning ToS parameters to improve services for connected client computers
    Ability to hook up user defined scripts or rulesets before or after firewall activation
    Supports Linux Kernels 2.4 and 2.6

Utilities to benchmark UNIX systems - Lmbench

Lmbench is a suite of simple, portable, ANSI/C microbenchmarks for UNIX/POSIX. In general, it measures two key features: latency and bandwidth. lmbench is intended to give system developers insight into basic costs of key operations.

There are two attributes that are critical for performance - latency and bandwidth, and lmbench timing harness makes it easy to measure and report results for both. Latency is usually important for frequently executed operations, and bandwidth is usually important when moving large chunks of data.

Bandwidth benchmarks
* Cached file read
* Memory copy (bcopy)
* Memory read
* Memory write
* Pipe
* TCP

Latency benchmarks
* Context switching.
* Networking: connection establishment, pipe, TCP, UDP, and RPC hot potato
* File system creates and deletes.
* Process creation.
* Signal handling
* System call overhead
* Memory read latency

Clone an Ubuntu Installation to Another Computer

dpkg is a tool to install, build, remove and manage Debian packages. dpkg itself is controlled entirely via command line parameters, which consist of exactly one action and zero or more options. The action parameter tells dpkg what to do and options control the behavior of the action in some way.

dpkg –get-selections:
First get list of package selections, and write it to a file. Without a pattern, non-installed packages (i.e. those which have been previously purged) will not be shown in the file.
Use following command:

dpkg --get-selections | tee package_names