BackBox OS - Revision history

Atootsi: /* Summary */

2017-05-08T21:02:20Z

Summary

← Older revision		Revision as of 00:02, 9 May 2017
Line 807:		Line 807:
	== Summary ==		== Summary ==

	As seen above, BackBox has many tools that can be used for security purposes. Learning about it gave me a good overview of what is needed to become a good cybersecurity specialist, especially in terms of what tools ~~need to~~ be ~~learned~~.		As seen above, BackBox has many tools that can be used for security purposes. Learning and writing about it gave me a good overview of what is needed to become a good cybersecurity specialist, especially in terms of what tools can be used.

	== References ==		== References ==

Atootsi at 21:01, 8 May 2017

2017-05-08T21:01:16Z

← Older revision		Revision as of 00:01, 9 May 2017
Line 1:		Line 1:
	= BackBox Linux =		= BackBox Linux =

	== ~~What is BackBox~~ ==		== Introduction ==

	BackBox is an open source Ubuntu based Linux distribution. Its main purpose is to provide a desktop environment for network and systems analysis, penetration and security assessment. It is a community project and full of some of the most commonly used security and analysis tools. It runs a desktop environment based on the XFCE window manager, which makes it very easy to use.		BackBox is an open source Ubuntu based Linux distribution. Its main purpose is to provide a desktop environment for network and systems analysis, penetration and security assessment. It is a community project and full of some of the most commonly used security and analysis tools. It runs a desktop environment based on the XFCE window manager, which makes it very easy to use.
Line 804:		Line 804:

	For this feature, BackBox has a tool called sipcrack. This is a set of utilities to perform sniffng and cracking of SIP protocols.		For this feature, BackBox has a tool called sipcrack. This is a set of utilities to perform sniffng and cracking of SIP protocols.

			== Summary ==

			As seen above, BackBox has many tools that can be used for security purposes. Learning about it gave me a good overview of what is needed to become a good cybersecurity specialist, especially in terms of what tools need to be learned.

	== References ==		== References ==

Atootsi at 20:55, 8 May 2017

2017-05-08T20:55:13Z

← Older revision		Revision as of 23:55, 8 May 2017
Line 87:		Line 87:
	This utility sends ARP requests to the hosts on a specific subnet.		This utility sends ARP requests to the hosts on a specific subnet.

	[[File:BB_OS_Arping.png\|center\|thumb\|Arping Manual]]		[[File:BB_OS_Arping.png\|400x500px\|center\|thumb\|Arping Manual]]

	Example command:		Example command:
Line 107:		Line 107:
	This is a Python script, written by Gianni 'guelfoweb' Amato, designed to enumerate sub-domains on a target domain through a word-list.		This is a Python script, written by Gianni 'guelfoweb' Amato, designed to enumerate sub-domains on a target domain through a word-list.

	[[File:BB_Knock.png\|center\|thumb\|knock manual]]		[[File:BB_Knock.png\|400x500px\|center\|thumb\|knock manual]]

	Example command would be this:		Example command would be this:
Line 123:		Line 123:
	This is an information collector used to harvest e-mails, subdomains, hosts and personal information about individuals.		This is an information collector used to harvest e-mails, subdomains, hosts and personal information about individuals.

	[[File:TheHarvester.png\|center\|thumb\|theHarvester Manual]]		[[File:TheHarvester.png\|400x500px\|center\|thumb\|theHarvester Manual]]

	Example command:		Example command:
Line 143:		Line 143:
	In the opened window, type the ip address of the host that you want to scan in the Target field and select the desired profile from the Profile drop-down box:		In the opened window, type the ip address of the host that you want to scan in the Target field and select the desired profile from the Profile drop-down box:

	[[File:Zenmap_Example.png\|center\|thumb\|Zenmap Example]]		[[File:Zenmap_Example.png\|500x600px\|center\|thumb\|Zenmap Example]]

	To find the scanned host’s list of open ports, port states, the services corresponding to the ports and it’s version details etc., click on the Ports/Hosts tab.		To find the scanned host’s list of open ports, port states, the services corresponding to the ports and it’s version details etc., click on the Ports/Hosts tab.
Line 350:		Line 350:
	Common commands:		Common commands:

	[[File:Msfconsolepng.png\|~~800x600px~~\|center\|thumb\|msfconsole common commands]]		[[File:Msfconsolepng.png\|1000x800px\|center\|thumb\|msfconsole common commands]]

	==== Web Application ====		==== Web Application ====

Atootsi at 20:51, 8 May 2017

2017-05-08T20:51:33Z

Show changes

Atootsi: /* Malware Analysis */

2017-05-08T20:28:48Z

Malware Analysis

← Older revision		Revision as of 23:28, 8 May 2017
Line 792:		Line 792:

	- Volatility Framework - Volatile memory extraction utility framework - a completely open ollection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.		- Volatility Framework - Volatile memory extraction utility framework - a completely open ollection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.


	==== Mobile Analysis ====		==== Mobile Analysis ====

Atootsi at 20:25, 8 May 2017

2017-05-08T20:25:10Z

@@ Line 757: / Line 757: @@
 BackBox also offers it's users the option to wipe the computer's RAM at shutdown/reboot. Simply search for 'RAM Wiping' on the services menu and turn it on. Pulling the PC's cord usually does the trick, but this feature makes extra sure that no data can be recovered.
-==== Sipcrack ====
+==== Forensic Analysis ====
-This is a set of utilities to perform sniffng and cracking of SIP protocols.
+==== VoIP Analysis ====
-==== Forensic Analysis ====
+For this feature, BackBox has a tool called sipcrack. This is a set of utilities to perform sniffng and cracking of SIP protocols.
 == References ==
@@ Line 856: / Line 901: @@
 [https://discuss.cantact.io/t/using-can-utils/24 can-utils]
 [[Category:Operatsioonisüsteemide administreerimine ja sidumine]]

Atootsi: /* Other Useful Features */

2017-05-08T19:56:50Z

Other Useful Features

← Older revision		Revision as of 22:56, 8 May 2017
Line 760:		Line 760:

	This is a set of utilities to perform sniffng and cracking of SIP protocols.		This is a set of utilities to perform sniffng and cracking of SIP protocols.

			==== Forensic Analysis ====

	== References ==		== References ==

Atootsi: /* BackBox Features */

2017-05-08T19:55:32Z

BackBox Features

← Older revision		Revision as of 22:55, 8 May 2017
Line 6:		Line 6:

	=== BackBox Features ===		=== BackBox Features ===
	* Forensic Analysis
			Main BackBox features discussed in this article:

	* Information Gathering		* Information Gathering
	* Vulnerability Assessment		* Vulnerability Assessment
Line 16:		Line 18:
	* Documentation and Reporting		* Documentation and Reporting
	* Reverse Engineering		* Reverse Engineering
	* VoIP Analysis

	== Installing and Tuning ==		== Installing and Tuning ==

Atootsi at 19:54, 8 May 2017

2017-05-08T19:54:01Z

@@ Line 574: / Line 574: @@
 Maintaining Access comes into play once we have gained access to a system. The tools in this category allow us to access it again without repeating all the tasks done initially.
-==== Iodine ====
+==== Tunneling ====
 This is a free (ISC licensed) tunnel application to forward IPv4 traffc through DNS servers. This can be usable in different situations where internet access is firewalled, but DNS queries are allowed.
@@ Line 595: / Line 597: @@
 Scripts to configure the client can be found [http://dev.kryo.se/iodine/wiki/TipsAndTricks here].
-==== Weevely ====
+===== Others =====
 This is a stealth PHP web shell that simulates a telnet-like connection. The weevely modules ecosystem provides a working shell interface even with no shell command execution, replacing the standard shell commands (e.g. the file editors, cd and ls, SQL cli and dump, compression utilities, port scanners, etc.) with the weevely modules.
@@ Line 614: / Line 628: @@
 And now you have access to the webserver with weevely module.
 == Documentation and Reporting ==
@@ Line 663: / Line 667: @@
 The tools in this menu are used for reversing the system by analyzing its structure from both hardware and software perspective.
-==== Flasm ====
+- Flasm: This is a command-line assembler/disassembler of Flash ActionScript bytecode. Flasm disassembles your entire swf including all the timelines and events. looking at disassembly, you learn how the flash compiler works. you can also do some optimization on the disassembled code by hand or adjust the code as you wish. flasm can then re-assemble the bytecode into a new swf.
 [[File:Flasm.png]]
@@ Line 674: / Line 676: @@
 This disassembles the example file to your terminal.
 - Ghex: This is a simple binary GUI hex editor.
@@ Line 720: / Line 720: @@
 == Other Useful Features ==
 ==== Anonymous mode ====
@@ Line 839: / Line 849: @@
 [https://packages.debian.org/sid/comm/ussp-push Client for OBEX PUSH]
 [[Category:Operatsioonisüsteemide administreerimine ja sidumine]]

Atootsi at 19:38, 8 May 2017

2017-05-08T19:38:05Z

Show changes