tag:blogger.com,1999:blog-8252703964667857600Thu, 12 Sep 2024 06:05:52 +0000hackinglinuxlifejet-fusecurityprogrammingpythonsysadminkernelworkPKISASLbookdatabasesdovecotinstallerpackage managementpostfixsolusosudevA linux hacker's view of the world.http://compgrokker.blogspot.com/noreply@blogger.com (compgrokker)Blogger19125tag:blogger.com,1999:blog-8252703964667857600.post-2053402987754062212Mon, 19 Jul 2021 19:02:00 +00002021-07-19T15:02:47.426-04:00 This is the second of the labs for SQL Injection, the first section of the apprentice track in Portswigger Academy.  Like the first lab, it doesn't require Burp Suite, although you can use it.  I chose not to.The lab website is a sample store.  Click the My Account link at the top of the page.This takes you to a login page. In the Username box, type administrator'-- and http://compgrokker.blogspot.com/2021/07/portswigger-academy-sql-injection-login.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-16599685952045420Mon, 12 Jul 2021 21:10:00 +00002021-07-12T17:10:42.535-04:00hackinglifeprogrammingsecurity I'm trying to decide whether to even bother writing Copperhead.  It's supposed to run nmap -sV scans against hosts, then check exploitdb for known exploits.  The problem is, it takes a ton of text parsing and massaging to get something vague enough to search exploitdb without being too vague.  Oh, and it'd have to require the offline version of exploitdb and its tools, http://compgrokker.blogspot.com/2021/07/copperhead-job-hunting.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-2322649366038643364Mon, 28 Jun 2021 18:00:00 +00002021-06-28T14:00:20.863-04:00hackinglifeprogrammingsecurity I've been doing little things here and there, but nothing worthy of a full blog post.  I'm trying to get in the habit of writing at least weekly, though.I'm doing little things here and there on TryHackMe, but I'm running into more and more rooms that are premium-only.  Rooms that you need to complete to finish training paths, or even worse, to complete free rooms.  Looking http://compgrokker.blogspot.com/2021/06/miscellany.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-4673845921618496904Mon, 14 Jun 2021 18:32:00 +00002021-06-14T14:32:05.782-04:00booksecurity To brush back up on security and learn new things that have become the standard in the past five years or so, I've bought a stack of books I'm working my way through.  The first two I decided to start with are "Defensive Security Handbook" by Brotherston and Berlin and "Practical Cloud Security" by Dotson."Defensive Security Handbook" built nicely upon what I already knew from doing http://compgrokker.blogspot.com/2021/06/book-reviews-defensive-security.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-4943052069779551937Mon, 07 Jun 2021 21:47:00 +00002021-06-08T13:43:12.181-04:00hackinglinuxprogrammingsecurity Doing the Linux privilege escalation room on TryHackMe reminded me of a trick I've used in the past.  I haven't used it for nefarious purposes, only to get around a web script being run as the woefully unprivileged apache user, when it needed to run as a more privileged user.  It could easily be used as a good pentesting exploit.  I DO NOT endorse using this for evil.  http://compgrokker.blogspot.com/2021/06/changing-users-with-suid-and.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-3863467510758093030Tue, 11 May 2021 15:59:00 +00002021-05-11T11:59:02.624-04:00hackinglifesecuritywork So, yeah, it's been a while since I posted.  I either haven't had anything interesting I've been working on, or things at work have been interesting to me, but not something I think is interesting to others or can be sufficiently sanitized.  I've also been busy with non-computer hobbies like gardening and writing fiction.Now I'm trying to get (back) into cybersecurity, so I'll http://compgrokker.blogspot.com/2021/05/its-been-while.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-6572157654634155568Fri, 24 Oct 2014 18:55:00 +00002014-10-24T15:01:54.955-04:00dovecotlinuxPKIpostfixSASLsysadminworkJust spent roughly 16-18 hours (Monday around 2 or 3 to Wednesday around 4) fixing a problem (well, 4 major problems and a minor problem) with the webmail server.  It only manifested as, mail can be received from the webmail server via IMAP, webmail server can receive mail from the servers that forward it mail, but mail cannot be sent through it.  It runs Postfix SMTP, and Dovecot for http://compgrokker.blogspot.com/2014/10/postfix-dovecot-sasl-and-broken-cert.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-2511996500636178448Mon, 29 Oct 2012 02:25:00 +00002012-10-28T22:26:16.312-04:00lifeprogrammingsysadminworkBit of a work rant. I'm not trying to use this as a whine-fest, although it'll sound like one at points. Take this more of a case study or illustrative, anecdotal example of why it's proper practice to write out a formal specification for your developers. There's a project I've been working on for 9 months now; I'm not sure if I've mentioned it, but if I have it's the pricing update program. http://compgrokker.blogspot.com/2012/10/the-beauty-and-wonder-of-programming.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-2716382562325343339Wed, 04 Jul 2012 18:44:00 +00002012-07-04T14:46:10.174-04:00hackinglifelinuxsolusosI have a new hobby. For the past couple months, I've been working on SolusOS. For those who don't know, in a nutshell it's a desktop distro based on Debian Stable, with some of our own packages thrown in, and Gnome3 Fallback mode hacked up to look like Gnome2. I'd worked with Justin and Ikey on Mint, and left shortly after they did. Around the time they left Mint, they came up with the idea http://compgrokker.blogspot.com/2012/07/solusos.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-1825434070053710290Mon, 30 Jan 2012 04:02:00 +00002012-01-29T23:02:53.205-05:00hackinglifesysadminMan, it's been a while since I've blogged. I've been busy working, and finding a new balance between working and.. well.. not working. With everything that's been going on in my personal life, I wouldn't say 'relaxing'. And I haven't really been hacking on my days off. I have been hacking at work a lot. And learning. A lot. Didn't realize how incredibly green I was when I took the job-- http://compgrokker.blogspot.com/2012/01/work-hacks.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-7256799741407635606Thu, 28 Jul 2011 03:05:00 +00002011-07-27T23:05:49.911-04:00lifesysadminSudden random real life post... I got a job a couple weeks ago as an assistant sysadmin. :) No more retail hell. I still have 1 idi^H^H^Hluser to deal with, but hey. Better than being surrounded by hundreds. Not sure how much hacking I'm going to do, apparently it's even true for me-- once you work on computers for a living, you're not too inclined to mess with them for fun. :\ I'm stuck on http://compgrokker.blogspot.com/2011/07/new-job.htmlnoreply@blogger.com (compgrokker)2tag:blogger.com,1999:blog-8252703964667857600.post-3029858095754905410Sun, 02 Jan 2011 23:23:00 +00002011-01-02T21:45:54.404-05:00hackingpythonWhiskey is now on launchpad, in 2 places since I can't figure out how to link habanero (trash80's and my project name) to my personal account. https://code.launchpad.net/~compgrokker/+junk/whiskey and https://code.launchpad.net/~habanero/+junk/whiskey. Update on the gui: since pyglet will never upgrade to python 3.0, I'm using pyjamas. PIL hasn't upgraded yet either, but it's tempting to grab http://compgrokker.blogspot.com/2011/01/whiskey-is-on-launchpad.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-7309116155542918425Wed, 29 Dec 2010 05:32:00 +00002011-01-02T21:44:23.097-05:00databaseshackinglinuxpythonAfter playing around with it and reading the specs, yaml is not the right tool for the job. It's too hard to have multiple attributes for the same key (ie, colours: grey, blue, green) and even harder to parse that back out and search it. Some sort of nosql db seems to be what I'm looking for, and mongodb seems to be the friendlier of the python-supported nosql dbs out there. So... scratch the http://compgrokker.blogspot.com/2010/12/whiskey-db-backend.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-4838872303913657680Mon, 27 Sep 2010 02:36:00 +00002010-09-26T23:00:09.844-04:00hackinglinuxpythonNow I'm working on a desktop-agnostic wallpaper manager. I jokingly called it 'whiskey' one night in a chat, and the name kinda stuck. Anyhoo, it walks through the user's home directory, looking for jpegs, gifs, pngs, and xcfs, looks at the size to determine if it's a wallpaper by its size (4:3 and 16:9 sizes are supported), and if it's not a standard size, it asks the user if they want it http://compgrokker.blogspot.com/2010/09/whiskey.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-4180722555422067631Fri, 13 Aug 2010 16:17:00 +00002010-08-13T13:39:01.098-04:00jet-fuRather than using git (or cvs or svn) we're going with a bazaar repo/server. It seems to be the best documented, easiest to use system.I've used cvs in the past, and there's a significant learning curve and little documentation outside of the (typically terse) manpage. trash80 has used svn and hates it. I found the git wiki with a "git for the lazy" guide, and it's still not the clearest docs http://compgrokker.blogspot.com/2010/08/version-control.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-3218248098617217930Fri, 30 Jul 2010 22:45:00 +00002010-07-30T19:27:33.880-04:00jet-fukernellinuxpackage managementpythonOK, I'm bored with the kernel thing right now, and we need something to install before I really get into it. So I'll be moving on to hacking pacman to use a git repository and rewriting package dependencies. But right now it's time to clear my head, step back, and look at the bigger picture-- so on to the promised jet-fu manifesto.The over-all aim of jet-fu is to be a small server. This means:http://compgrokker.blogspot.com/2010/07/manifesto-time.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-5224137840535876266Tue, 27 Jul 2010 19:40:00 +00002010-07-27T18:32:43.826-04:00jet-fukerneludevOK, after digging around, I've learned some things. modprobe.conf doesn't list the modules to be loaded (did it at one point? I don't know. But it doesn't now), just the rules for things like naming/aliasing modules, local dependencies, substituting one module for another, etc. If I'm reading the docs right, that is. It seems mostly for manually running modprobe, and tweaking its behaviour so http://compgrokker.blogspot.com/2010/07/kernel-scripts-2.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-7832785251123703358Sun, 25 Jul 2010 04:58:00 +00002010-07-25T16:28:53.834-04:00installerjet-fukernellinuxRight now the main thing that has my attention is the kernel paring (ironically, one of the minor details and one of the last things that actually needs to be done). It's a 2-part problem, preinstall (or more precisely, during install) and post-install.Jet-fu's vanilla kernel will be as modular as possible to allow it to be as small as possible.For preinstall, the livecd boots, the kernel does http://compgrokker.blogspot.com/2010/07/kernel-scripts.htmlnoreply@blogger.com (compgrokker)0tag:blogger.com,1999:blog-8252703964667857600.post-6084019395447353616Sun, 25 Jul 2010 03:10:00 +00002010-07-24T23:25:58.240-04:00hackingjet-fulinuxOk, got that out of my system. Hi! Mostly this blog will be about stuff I'm hacking on, commentary on Linux, languages, and other computer tech I feel unusually passionate about, and I'll end up at some point touching on the trials and tribulations of being a starving linux hacker working a dead-end non-IT job. Fun!Currently I'm working on a really cool experimental distro called Jet-fu (Just http://compgrokker.blogspot.com/2010/07/first-post1.htmlnoreply@blogger.com (compgrokker)0