Vittorio Pavesi

List of IIS Sites

2011-09-01T08:41:00.000+02:00

The following command generate an excel file with the list of web sites in IIS 7

%windir%\system32\inetsrv\appcmd list site > c:\sites.xls

Analyze MS Cluster Logs (Windows 2008)

2011-08-24T14:57:00.000+02:00

Do you need to analyze cluster logs but you're not able to find them on Windows 2008 ?

Use the following from Administrative Command Prompt

Cluster /Cluster:"clustername" log /gen / copy "C:\Windows\Cluster\Reports"

View more here: http://blogs.technet.com/b/askcore/archive/2010/04/13/understanding-the-cluster-debug-log-in-2008.aspx

Error 0xc0000225 on Windows Server

2011-08-22T14:31:00.000+02:00

After resizing the primary partition of a Windows 2008 Server, I received error
0xc0000225 from Windows Boot Manager.

The solution is:
1) boot from the original Windows DVD
2) get to the command prompt using Repair option
3) run x:\sources\recovery\StartRep.exe

Android change Default Gallery

2011-08-12T15:34:00.000+02:00

I spent a lot of time in order to find how to replace the default gallery for my Android phone.

The solution is really easy:

Tap the Menu button on your phone and select the Android Settings option.
Scroll down to the Applications section and tap it.
On the next screen, tap Manage Applications and then the All tab on the subsequent screen.
Scroll down the list of apps until you see the old browser listed and tap that entry.
On the next screen look for the "Launch by default" section and hit the Clear defaults button.

iDump Extract MP3 from iPod

2011-08-12T00:06:00.001+02:00

iDump will allow you extract your songs off your iPod to a PC.
It's available into an installer package and in a standalone exe format.

Connect your iPod and run iDump and you'll have access to all your MP3
, select the songs you want to transfer then pick a destination directory and how you would like your songs to be named

Download it from http://www.escsoft.com/idump.php

Upgrade Windows 2008 R2 Standard to Enteprise

2011-05-17T21:36:00.001+02:00

If you want to upgrade your Windows 2008 R2 Server Standard to Enterprise Version, you can use this simple procedure:

dism /online /Set-Edition:ServerEnterprise /ProductKey:489J6-VHDMP-X63PK-3K798-CPX3Y (this is a code provided by Microsoft for this task)
Restart Server
SLMGR /REARM
Restart Server
Insert MAK Code
Restart Server

Thanks to Claudio for it.

Graph DB

2011-04-06T23:50:00.002+02:00

I just learned that exist a new type of DB called Graph DB.

A graph database is a kind of NoSQL database that uses graph structures with nodes, edges, and properties to represent and store information. Nodes are very similar in nature to the objects that object-oriented programmers will be familiar with.

More details on http://en.wikipedia.org/wiki/Graph_database

NOSQLEU - Graph Databases and Neo4j

View more presentations from Tobias Ivarsson

CyberDuck a FTP client with Cloud Support

2011-03-19T21:15:00.003+01:00

CyberDuck is an FTP client created for MAC but recently ported to Windows.

The real innovative feature is the possiblity to manage Emerging open cloud software standards such as:

Amazon S3
Google DOCS
RackSpace Cloud
Windows Azure
DropBox

More details on http://cyberduck.ch/

WINDOWS 7 WiFi Support as HOTSPOT

2011-03-18T22:54:00.001+01:00

Alfredo point me out to a really interesting article: how to make your Windows 7 a WiFi HotSpot.

Basically the article explain that latest Intel Wireless Driver allow you to share your LAN connectivity using Wireless Adapter.

He used it for my smartphone in order to reduce 3G traffic.

The procedure is really simple:

1) Open an elevated command line with administrative privileges and type

netsh wlan set hostednetwork mode=allow ssid=Test key=password
replacing the name and password with your own preference.

2 )Start the adapter by
netsh wlan start hostednetwork

3) Share an existing connection to it by going to the “Properties” of a connection, selecting the “Sharing” tab and enabling ICS and choosing the corresponding Virtual WiFi adapter

Tool for finding SQL Injection (1) - Scrawlr

2011-03-13T09:17:00.000+01:00

HP Web Security Research Group in coordination with the MSRC developed Scrawlr, a Tool that crawl a website while simultaneously analyzing the parameters of each individual web page for SQL Injection vulnerabilities.

This tool has some limitations:

Will only crawls up to 1500 pages
Does not support sites requiring authentication
Does not perform Blind SQL injection
Cannot retrieve database contents
Does not support JavaScript or flash parsing
Will not test forms for SQL Injection (POST Parameters)

Source: http://www.hacktoolrepository.com/tool/122/Scrawlr (the download URL is wrong, use https://h30406.www3.hp.com/campaigns/2008/wwcampaign/1-57C4K/index.php)

Scrawlr - Tool for finding SQL Injection — PenTestIT

SQL Doesn't start and Event ID = 17204

2011-03-11T20:49:00.001+01:00

After hardening a server, the service didn't start anymore and I found the following error:

Event ID = 17204
FCB::Open failed: Could not open file d:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\mastlog.ldf for file number 2. OS error: 5(failed to retrieve text for this error. Reason: 15105).

Solution:
Provide FULL CONTROL (not just modify) to the service logon account (in my scenario was Network Service).

Empty Start Menu

2011-03-08T08:49:00.001+01:00

If you find an Empty Start Menu and there aren't permission problems, check the GPO (Group Policy Objects), maybe someone removed Run menu from Start Menu and this generate this bad behavior..

User Configuration
Administrative Templates
Start Menu and Taskbar
Remove Run menu from Start Menu

PostGreSQL error Failed to run initdb: 128!

2010-12-26T15:20:00.000+01:00

During installation of PostGreSQL 8.2 on Windows I got the error "Failed to run initdb: 128! " with an error log that is empty

I found a workaround:
Launch Setup, skip Initialize Task and Complete Installation

Verify permission on folders for user PostGres

Launch CMD and type runas /profile /user:postgres cmd
Type set pgdata=c:\PostgreSQL\data
Type CD C:\PostgreSQL\Bin
Type initdb -E SQL_ASCII
Start Service

MRemote Free

2010-11-30T21:05:00.003+01:00

I've been using MRemote since 2008, this utility acts a tabbed remote connection manager many protocols such as: RDP, VNC, SSH...

I liked it very much but later this tool merge VisionApp and you need to pay in order to get the updated version.

I actually found a fork of the original project called MRemoteNG and I hope they will work on it and keep it free.

For more details see: http://www.mremoteng.org

Access Denied when you try to Remote Control User Session from Terminal Server

2010-11-03T13:50:00.002+01:00

We experienced random access denied error when using Remote Control User Session from Terminal Server on Windows 2008.

The cause was client with Multiple Monitor.

Analyze Network Trace Online

2010-06-26T14:57:00.005+02:00

CloudShark is a web site that displays network capture files right in your browser instead of running desktop tools such as Wireshark. You upload, link, or email your capture files and it'll display them.

I think it's a great tool even if it expose security problems people uploading traces containing password !!

A similar service (but still in Beta) is xtractr

GrimWepa a Wifi Password Cracker

2010-06-15T22:39:00.003+02:00

I just tried GrimWepa on Ubuntu, it's a password cracker for WEP and WPA Access Point.
I think it's really good and the java GUI make it very user friendly.

WEP Attacks Available:
- ARP-Replay attack
- Chop-chop attack
- Fragmentation attack
- p0841 attack
- Cafe-Latte attack

WPA Attacks Available:
- Basic deauthorization attack to get handshake.

There is also a video on youtube explaining how it works.

Enjoy with it on http://code.google.com/p/grimwepa

MD5 Decrypt

2010-06-07T16:28:00.000+02:00

Just a couple of MD5 Decrypt Online Services

http://www.md5decrypter.co.uk
http://md5.rednoize.com
http://md5-hash-online.waraxe.us

SecurityTube

2010-06-06T23:21:00.004+02:00

I was looking at this video from Symantec showing a demo of the Trojan.Twetbot trojan. It use a Twitter account to issue command-and-control instructions to the Trojans.

And I found a really useful site: http://securitytube.net , a website listing hundreds of computer security related videos aggregated from the web and submitted by users.

Remove Deleted Domain Controller

2010-06-05T09:29:00.001+02:00

Let suppose you lost a domain controller and you need to cleanup Active Directory, follow these instructions:

ntdsutil
ntdsutil: metadata cleanup
metadata cleanup: connections
server connections: connect to server Server1 <-- This is a valid Domain Controller server connections: q metadata cleanup: Select operation target select operation target: list domains select operation target: Select domain 0
select operation target: List sites
select operation target: Select site 0
select operation target: List servers in site
select operation target: Select server 0 <-- This is the deleted Domain Controller select operation target: q metadata cleanup: Remove selected server

Then remove the failed server object from Active Directory Sites and Services.

2010-06-04T09:05:00.002+02:00

TempAlias is a new service to avoid spam with a temporary email like 10MinuteMail, Mailinator, 10MinuteMail, 30MinuteMail, MintEmail, IncognitoMail.

Access Denied on EventLog in Windows 2008

2010-06-01T07:28:00.004+02:00

After hardening file system permissions on a Windows 2008 server, I got the following error when I opened EventViewer:

Event Viewer cannot open the event log or custom view. Verify that Event Log service is running. Access id denied (5).

The problem was generated by missing permissions for NT Service\EventLog user on the folder containing evtx files, by default Local Service Builtin Group has read permissions, if EventLog user miss permission you'll receive Access Denied.

32 Bit HP BiDi Channel Components Installer

2010-05-31T15:05:00.000+02:00

I got a lot of these events on some Windows 2003 running Terminal Services in Application Mode

Event Type: Error
Event Source: MsiInstaller
Event Category: None
Event ID: 10005
Date: 31/05/2010
Time: 10.56.18
User: NT AUTHORITY\SYSTEM
Computer: ATOOLS03
Description:
Product: 32 Bit HP BiDi Channel Components Installer -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2753. The arguments are: ipm12.CF34E983_546C_421F_A494_3C30281E4CF3, ,

It seems that every time a user with a specific printer logon to the server, the Windows Installer Service try to install again the driver running MSI.

I fixed it putting a deny on MSI files present into drivers folder.

The command is:
cacls %windir%\system32\spool\drivers\w32x86\3\*.msi /E /D USERS SYSTEM

Only one instance of the Array Configuration Utility can be running’ when opening the ACU utility on a HP Server

2010-05-13T09:22:00.003+02:00

If you get error: Only one instance of the Array Configuration Utility can be running’ when opening the ACU utility on a HP Server, you may encounter a bug of A.C.U.

The solution is UPGRADE ACU

iPhone Simulator

2010-05-06T20:50:00.001+02:00

This web site is great for testing your webapps on iPhone.
http://www.testiphone.com