Vulnerability Scanner for Open Source

Finally, Google has released the OSV-scanner as a free tool that gives opensource developers access to vulnerability information which may relevant to their projects.

With the new launching OSV.dev service, it allows all the different opensource ecosystems and vulnerability databases to publish and consume information in one simple, precise, and machine readable format (JSON).

OSV-scanner is an effort to provide supported fronted to the OSV database (OSV.dev) that connects a project's list of dependencies with vulnerabilities that affect them. 

There are a few ways to use OSV:

• Use the API 
• Use the command line
• Integrate with OpenSSF Scorecard's vulnerability check
  

So, let's get start running the OSV-scanner on your project to find all the dependencies that are being used by analyzing manifests, SBOMs, and commit hashes. The scanner hen connects this information with the centralized OSV database and displays the vulnerabilities relevant to your project.

Links:

• Announcing OSV-Scanner: Vulnerability Scanner for Open Source - (Dec 13, 2022)
  
• Announcing a unified vulnerability schema for open source - (Jun 24, 2021) 
  
• Launching OSV - Better vulnerability triage for open source - (Feb 5, 2021)
  
• SLSA
• https://github.com/ossf/osv-schema
• OpenSSF Scorecard 
  

Weather at CmdLine

Check or curl your weather at cmdline with :

$ curl -s wttr.in/Melbourne?format="%l:%c+%C+%t/%f+%h+%w+%m+UV:%u/12+%P"
Melbourne:⛅️  Partly cloudy +15°C/+14°C 59% ↑31km/h 🌗 UV:3/12 1016hPa

$ curl -s wttr.in/New+York?format="%l:%c+%C+%t/%f+%h+%w+%m+UV:%u/12+%P"
New+York:☀️   Clear +1°C/-3°C 56% ↓15km/h 🌗 UV:1/12 1022hPa

PS> Invoke-RestMEthod  'https://wttr.in/New+York?format="%l:%c+%C+%t/%f+%h+%w+%m+UV:%u/12+%P"'
New+York:☀️   Clear +1°C/-3°C 56% ↓15km/h 🌗 UV:1/12 1022hPa

Links:

• https://wttr.in/
  

Windows Commands

This set of documentation describes the Windows Commands you can use to automate tasks by using scripts or scripting tools.

All supported versions of Windows and Windows Server have a set of Win32 console commands built in.

 

Links:

• Windows Commands
  

Command Line Commands – CLI Tutorial

Windows command line is always my favorite tool. It is one of the most powerful utilities where I can interact with OS directly.

Here's are some of the commands, and I put them under 2 groups.

Without Admin Privileges 

C:\> driverquery

C:\> systeminfo

C:\> prompt xx@localhost $$ 

C:\> dir | clip

C:\> assoc

C:\> fc 

C:\> title cmdline

C:\> cipher

C:\> netstat -an

C:\> color 0a

C:\> for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @echo %j | findstr -i -v echo | netsh wlan show profiles %j key=clear

C:\>  ipconfig /all

C:\> powercfg /energy 

C:\> attrib +h + s +r folder_name

C:\> start https://www.google.com

C:\> tree

C:\> ver 

C:\> tasklist /IM "task.exe" /F

C:\> vol

Need Admin Privileges

C:\> powershell start cmd -v runAs

C:\> dism

C:\> sfc   

C:\> taskkill /IM "chrome.exe" /F

C:\> shutdown

Link:

• https://www.freecodecamp.org/news/command-line-commands-cli-tutorial
  

SSH and TLS Enumeration

SSH and TLS/SSL are the two (2) most common encrypted protocols used daily by sysadm. Here, I listed some cmdline commonly used by me daily in troubleshooting the 2 protocols and some links below.

SSH (22/tcp):

Enumerate SSHD configuration with SSHscan

$ python sshscan.py -t 192.168.31.1

Enumerate SSH algorithm with NMAP

$ nmap --script ssh2-enum-algos 192.168.1.1

Print its (client) configuration after evaluating Host and Match blocks.

$ ssh -G 192.168.31.1

Queries ssh for the algorithms supported: cipher, cipher-auth, mac, kex, keq-gss, key, key-cert, key-plain, key-sig, protocol-version.

$ ssh -Q query_option

TLS/SSL (443/tcp):

$ sslyze www.facebook.com

$ ./sslscan.exe 192.168.31.1

$ tlsscan 192.168.31.1

$ ./tls-scan -c www.facebook.com --cacert=./ca-bundle.crt --pretty

Links:

• https://myseq.blogspot.com/2022/07/ssltls-recon.html
• https://myseq.blogspot.com/2022/07/sshscan.html
• https://myseq.blogspot.com/2022/07/sslyze-fast-and-powerful-ssltls.html
• https://myseq.blogspot.com/2022/07/ssl-configuration-generator.html
• https://security.stackexchange.com/questions/94390/whats-the-purpose-of-dh-parameters
• https://www.infoworld.com/article/3027557/openssl-patches-two-vulnerabilities-in-cryptographic-library.html
• https://nmap.org/nsedoc/scripts/ssh2-enum-algos.html
• https://stackoverflow.com/questions/16212816/setting-up-openssh-for-windows-using-public-key-authentication?rq=1 
• https://www.activestate.com/blog/how-to-manage-tls-certificate-expiration-with-python/
  

Patch_Tuesday Utils

A step-by-step how I generate patch_tuesday.exe from python script. You can download the python script or the executable directly (at GitHub).

c:\home> pip install colorama

c:\home> pip install pyfiglet

c:\home> pip install pyinstaller

 

Method 1:

c:\home> pyinstaller --onefile --add-data "C:\Python3\Lib\site-packages\pyfiglet";./pyfiglet   patch_tuesday.py

Method 2:

c:\home> pyinstaller --onefile --collect-all pyfiglet patch_tuesday.py

c:\home> cd dist

c:\home\dist> patch_tuesday.exe -h

patch_tuesday.exe -h

c:\home\dist> patch_tuesday.exe -k 2022-jun -v

patch_tuesday.exe -k 2022-jun -v

Tips: Try "patch_tuesday.exe -k 2022-jun -vc" for chart output.

Links:

• MS Patch Tuesday (MSRFC - Security Update Guide)

Using winget

A quick note on learning how to use winget.exe cmdline.

Install Packages

PS> winget install python

Search for Packages

PS> winget search mysql

Show Package Details

PS> winget show Notepad++

Manage Sources (List, Add, Update, Remove, Reset)

PS> winget source list

PS> winget source add --name azure https://winget.azureedge.net/cache

PS> winget source update

PS> winget source remove --name azure

PS> winget source reset --force

List Packages

PS> winget list

Uninstall Packages

PS> winget uninstall Notepad++.Notepad++

Links:

• How to Install winget (Windows Package Manager)

Switch Between CLI and GUI

How to change between the cmdline interface and the GUI by editing the boot target.

First, we no longer use the runlevel term. Instead, we refer to boot choices as targets. The 2 primary targets here: multi-user.target (the CLI or runlevel 3 in legacy) and the graphical.target (the GUI or runlevel 5 in legacy).

To identify the current target:

$ sudo systemctl get-defeault

To launch GUI from the multi-user.target:

$ sudo systemctl isolate graphical.target

And to switch back to CLI mode:

$ sudo systemctl usolate multi-user.target

To set a default target

$ sudo systemctl  set-default multi-user.target

To reboot and confirm the appropriate target:

$ sudo systemctl reboot

Target Files

Targets are managed by .target files that simply group units and dependencies into a convenient format. It;s really the .unit files that define exactly what services and other features start when the target is initiated.

$ sudo systemctl enable sshd

$ sudo systemctl disable sshd

 

Links:

• Linux Run Levels
  

History in ZSH

I switched to zsh from bash many years ago. 

Today, I like to share a few tips on using zsh, and those are included in my dotfiles.

How to SKIP a cmdline from .zsh_history

$ echo "This cmdline saved in history."

$  echo "This cmdline will not be saved in history (bcos of leading space. Try it."

Show datetime and elapsed times in history

I would like to show the datetime and the elapsed time of my cmdline in my history. Thus I modified the alias in my .zshrc:

alias history='history -i -D 0'

Where -i is for datetime in iso-format, -D is for showing elapsed times spent, and 0 is for showing all the history.

To show history from all the login terminals

I do open multiple terminals for work, and I would like to see the history of cmdline from all the terminals. Thus I enable the setopt in my .zshrc:

setopt share_history

 

Running Commands Over SSH

Running commands on a remote server vi SSH is common nowadays. For example:

• Get the file system and disk info
• Get user info
• Get all the running process

 

The syntax is as follows:

$ ssh xx@192.168.31.215 command1

$ ssh xx@192.168.31.215 -- command1 -arg1 -arg2

$ ssh xx@192.168.31.215 -- "command1 && command2"

$ ssh xx@192.168.31.215 -- command1 -arg1 > /tmp/local.out

$ ssh -t xx@192.168.31.215 -- sudo command1 -arg1 -arg2

 

The double dash “--“, means “end of command line flags.” It tells ssh not to try to parse what comes after command line options.

The -t option needed when using sudo command over ssh.

Links:

• https://www.cyberciti.biz/tips/linux-running-commands-on-a-remote-host.html
• https://www.cyberciti.biz/faq/what-does-double-dash-mean-in-ssh-command/
  

Drop-in Replacement For Nmap

Smap - a drop-in replacement for NMAP that powered by Shodan. It is a replica of Nmap which uses shodan.io's free API for port scanning. It takes similar cmdline arguments as Nmap and produces the same output which makes it a drop-in replacement for Nmap.

Smap is super fast since it simple fetches existent port data from shodan.io. It can be used as:

• a super fast port scanner (200 hosts per second)
  
• vulnerability detection (services/version fingerprinting)
  
• reconnaissance on most common ports (limited to top 1237) 
  
• connection-less or passive-scan to the target
  

 

 Most important is, it doesn't require any account/api key.

Links:

• https://github.com/s0md3v/Smap
• https://www.kitploit.com/2022/04/smap-drop-in-replacement-for-nmap.html

Print Colors And Formatted Text in Terminal

This is my note on how to print formatted text and colors in terminal using Python. There are several methods to output colored text to terminal.

Terminal can be so plain. And formatted text (aka styled text or rich text) can be used as opposed to plan text, has styling info like:

• color (text and background)
• style (bold and italic)
• others (strike-through, underline)

 

1. Using ANSI Escape Codes

ANSI escape codes are used to control the formatting and color in Linux terminal. To encode this formatting info, certain sequences of bytes are embedded into the text, which the terminal looks for and interprets as commands and executes them.

print('\x1b[3;31;43m' + 'Hello world!' + '\x1b[0m')

The python statement above will produce the output in "red" text-color, with "yellow" background, and "italic" style.

The general syntax is \x1b[A;B;C   and the first ANSI escape code used is  \x1b[3;31;43m  . The second ANSI escape code used is \x1b[0m , and this is the code used to reset the color/style to defaults values. 

A is for text formatting style, ranges from 1 to 9.

• 1 : bold
• 2 : faint
• 3 : italic
• 4 : underline
• 5 : blinking
• 6 : fast blinking
• 7 : reverse
• 8 : hide
• 9 : strikethrough
  

B is for text color, ranges from 30 t0 37.

C is for background color, ranges from 40 to 47.

• 30/40 : black
• 31/41 : red
• 32/42 : green
• 33/43 : yellow
• 34/44 : blue
• 35/45 : magenta
• 36/46 : cyan
• 37/47 : white

2. Using built-in modules : colorama, termcolor

Example of using colorama

from colorama import init, Fore, Back, Style

init (autoreset=True, strip=False)

print(Fore.RED + + Back.GREEN + Style.DIM + f'Red text on Green in dim')

print(f'Normal')

 

Example of using termcolor

>>> from termcolor import colored
>>> print(colored('Hello, World!', 'green', 'on_red'))

A more complex example:

# Python program to print
# colored text and background
import sys
from termcolor import colored, cprint

text = colored('Hello, World!', 'red', attrs=['reverse', 'blink'])
print(text)
cprint('Hello, World!', 'green', 'on_red')

print_red_on_cyan = lambda x: cprint(x, 'red', 'on_cyan')
print_red_on_cyan('Hello, World!')
print_red_on_cyan('Hello, Universe!')

for i in range(10):
    cprint(i, 'magenta', end=' ')

cprint("Attention!", 'red', attrs=['bold'], file=sys.stderr)

Links

• https://www.geeksforgeeks.org/print-colors-python-terminal/
• https://www.geeksforgeeks.org/formatted-text-linux-terminal-using-python/

Display Images on Terminal

This is easy way to display images on a terminal using Python. The module is called climage and has the following features:

• convert images to NASI Escape codes
• allow 8/16/256 bit color codings
• provide ASCII/Unicode support
  

Installation

$ pip install climage

Usage (in Python)

convert(filename, is_unicode=False, is_truecolor=False, is_256color=True, is_16color=False, is_8color=False, width=80, palette=”default”)

Parameters:
filename : Name of image file.
is_unicode :  If true, conversion is done in unicode format, otherwise ASCII characters will be used.
is_truecolor :  Whether to use RGB colors in generation, if supported by terminal. Defaults False.
is_256color : Whether to use 256 colors encoding. Defaults True.
is_16color : Whether to use 16 colors encoding. Defaults False.
is_8color : Whether to use first 8 System colors. Defaults False.
width : Number of blocks of console to be used. Defaults to 80.
palette : Sets mapping of RGB colors scheme to system colors. Options are : [“default”, “xterm”, “linuxconsole”, “solarized”, “rxvt”, “tango”, “gruvbox”, “gruvboxdark”]. Default is “default”.

 

to_file(infile, outfile, is_unicode=False, is_truecolor=False, is_256color=True, is_16color=False, is_8color=False, width=80, palette=”default”)

Parameters:
infile : The name/path of image file.
outfile :   File in which to store ANSI encoded string. 

Links:

• https://www.geeksforgeeks.org/display-images-on-terminal-using-python/
• https://pypi.org/project/climage/
  

Create Progress Bar in Terminal

This is easy way to create and show the progress bar in terminal using Python. This is useful for installation or loading a page. The module is called tqdm and it eases your mind with a small progress bar to show an estimation of a process.

Installation

$ pip install tqdm

Usage (in Python)

A simple example for testing

from tqdm import tqdm

 

for i in tqdm(range(int(9e6))):
    pass

Use a parameter to specify the description of progress bar.

from tqdm import tqdm
from time import sleep

for i in tqdm(range(0, 100), desc ="Loading"):
    sleep(.1)

To specify the total number of expected iterations.

from tqdm import tqdm
from time import sleep

for i in tqdm(range(0, 100), total = 500,desc ="Loading"):
    sleep(.1)

To specify the entire width.

from tqdm import tqdm
from time import sleep

for i in tqdm(range(0, 100), ncols = 100,desc ="Loading"): 

    sleep(.1)

To specify the minimum progress display update (default is 0.1 seconds).

from tqdm import tqdm
from time import sleep

for i in tqdm(range(0, 100), mininterval = 3, desc ="Loading"):
    sleep(.1)

To fill the progress bar with ASCII characters.

from tqdm import tqdm
from time import sleep

for i in tqdm(range(0, 100), ascii ="123456789$"):
    sleep(.1)

Links:

• https://www.geeksforgeeks.org/python-how-to-make-a-terminal-progress-bar-using-tqdm/
• https://pypi.org/project/tqdm/
  

Linux System Monitoring Tools

One thing I like Linux is about "command line", and the other is the terminal-based system monitoring tools.

Other the the standard "top" utility that helps to display al the running processes and gives some important information on the performance of the system.

Here are a list of "top" alternatives.

1. htop - http://hisham.hm/htop/
   
2. atop - https://www.atoptool.nl/index.php
   
3. nmon - http://nmon.sourceforge.net/pmwiki.php?n=Main.HomePage
   
4. vtop - https://github.com/MrRio/vtop
   
5. bashtop - https://github.com/aristocratos/bashtop#installation
   
6. gtop - https://github.com/aksakalli/gtop
   
7. glance - https://nicolargo.github.io/glances/
   

 

Getting started with Vim visual mode

Just learn about VIM's visual mode today.

Visual mode can be useful for manipulate chunks of text. It has 3 modes: character, line and block.

• character mode : v [lowercase]
• line mode: V [uppercase] 
• block mode: ctrl+v

 

Character Mode

• Press <v> to activate visual character mode. [VISUAL]
• Use <arrow key> to highlight the desired text.
• Press <d> to delete the text.
• Press <u> to undo.
• Press <p> to paste the text.
• Press <c> to change the text. [INSERT] 
  

 

Line Mode

• Press <shirt-v> (or capital V) to enter line mode. [VISUAL LINE]
• Use <arrow key> to highlight multiple lines.
• Press <d> to delete those lines.
• Press <y> to yank those lines.
• Press > to increase the indentation of those lines.
• Press < to decrease the indentation of those lines.

 

Block Mode

• Useful for manipulation of specific tabular data.
  
• Press <ctrl-v> to enter visual block mode. [VISUAL BLOCK]
• Use <arrow key> to highlight the single character column and verify the indentation
  

 

Links:

• https://www.freecodecamp.org/news/vim-editor-modes-explained/
  

Managing VMware Player Like Pro

After I have setup my headless VMware Player, I want to be able to manage my virtual machines like sysadm. 

Next I need to get the command line to manage (start/stop/restart) my VM.

 

Here are part of the batch file script for me to manage my VMware Player.

set vmrun="C:\Program Files (x86)\VMware\VMware Player\vmrun.exe"
set vmjt="c:\users\sysadm\Documents\Virtual Machines\zf\zf.vmx" 

 

To start my VM without GUI (headless mode):

%vmrun% -T player start %vmx% nogui

To reboot my VM without GUI:

%vmrun% -T player reset %vmx% soft

To power off my VM without GUI:

%vmrun% -T player stop %vmx% soft

For Vmware Workstation Pro or Vmware Fusion, you can take snapshot without GUI:

$ vmrun -T ws (or fusion) snapshot /path/to/vm/my.vmx my_snapshot 

Links:

•  https://www.xmodulo.com/how-to-launch-vmware-player-vms-without-gui.html
  

Linux Distribution for Lab21

Here, I just finalized the Linux distribution for my Lab21.

 

c:\>certutil -hashfile ubuntu-20.04.1-live-server-amd64.iso sha256
SHA256 hash of ubuntu-20.04.1-live-server-amd64.iso:
443511f6bf12402c12503733059269a2e10dec602916c0a75263e5d990f6bb93
CertUtil: -hashfile command completed successfully.

 

C:\>certutil -hashfile ubuntu-20.04.3-desktop-amd64.iso sha256
SHA256 hash of ubuntu-20.04.3-desktop-amd64.iso:
5fdebc435ded46ae99136ca875afc6f05bde217be7dd018e1841924f71db46b5
CertUtil: -hashfile command completed successfully.

 

C:\>certutil -hashfile AlmaLinux-8.5-x86_64-dvd.iso sha256
SHA256 hash of AlmaLinux-8.5-x86_64-dvd.iso:
54b8881bebd924e4699ed12634187a82156fdb0fa57ec24058d04d70d2f033b3
CertUtil: -hashfile command completed successfully.

Control Facebook Video Playing Speed

Today learned a simple way to increase the speed of playing Facebook video. And the steps below is the same for Firefox or Chrome or Edge browsers.

Steps:

1. Open the console [press ctrl-shitft-i and then click Console tab]
• Or you can press ctr-shift-j to open the console tab directly
  
2. Paste the following at the prompt:
• document.getElementsByTagName("video")[0].playbackRate = 1.25
  

Instead of 1.25, you can put like 1.5 (for 50% speed increase) or 2 (for 100% speed increase)

console

Links:

• https://pletaura.com/how-to-speed-up-facebook-videos/
  

HPV for Kenna.VI+

Just added the high profile vulnerability section into the python script today. 

This help to quickly identify those critical CVE with real world exploitation including malware.

The HPV section is a summary of searched CVE with the risk score (from Kenna) and the following criteria:

• At least 1 successful exploitation recorded.
• At least 1 malware information found.
  

Result of 8 CVE searched

The summary above has 7 CVE listed because 1 of them cannot be found.