cyberlabs.us | home | subscribe | contact | admin
Monday, July 7th  
« newer posts »   « top »
 list | rss  
Arkime: Installation Steps
Informational

Basic Arkime Installation steps:
1) Download an Arkime build for your OS from http://arkime.com/index.html#downloads
2) Install the downloaded package
3) Configure basic arkime items by running the Configure script (this needs to be done only once)
     /opt/arkime/bin/Configure
4) The Configure script can install elasticsearch for you or you can install yourself
      systemctl start elasticsearch.service
5) Initialize/Upgrade Elasticsearch Arkime configuration
  a) If this is the first install, or want to delete all data
      /opt/arkime/db/db.pl http://ESHOST:9200 init
  b) If this is an update to a moloch/arkime package
      /opt/arkime/db/db.pl http://ESHOST:9200 upgrade
6) Add an admin user if a new install or after an init
      /opt/arkim... more

August 20th, 2022 - 09:47 am | read more | comments  

MS-SQL Query for Binary File Detection
Informational

select t.table_schema as schema_name,
    t.table_name, c.COLUMN_NAME
from information_schema.columns c
    inner join INFORMATION_SCHEMA.tables t
        on c.TABLE_SCHEMA = t.TABLE_SCHEMA
        and c.TABLE_NAME = t.TABLE_NAME
where t.TABLE_TYPE = 'BASE TABLE'
and ((c.data_type in ('VARCHAR', 'NVARCHAR') and c.character_maximum_length = -1)
or data_type in ('BINARY','TEXT', 'NTEXT', 'IMAGE', 'VARBINARY', 'XML', 'FILESTREAM'))
order by t.table_schema, t.table_name  

August 20th, 2022 - 08:44 am | read more | comments  

This is a 'nping' Example with a 'tcpdump' Output
Informational

nping --tcp -c 1 -p 50 --flags rst --flags ack --flags urg --flags fin --flags syn --flags psh --df --data-string 'Anonymous' 192.168.0.20

The 3f stands out, I wish I could set the evil bit with nping.

22:57:20.072093 IP (tos 0x0, ttl 64, id 50219, offset 0, flags [DF], proto TCP (6), length 49)
    192.168.0.165.30149 > 192.168.0.20.50: Flags [FSRP.U], cksum 0x360f (correct), seq 2207896699:2207896708, ack 2871421896, win 1480, urg 0, length 9 [RST Anonymous]

0x0000:  4500 0031 c42b 4000 4006 f491 c0a8 00a5
0x0010:  c0a8 0014 75c5 0032 8399 d47b ab26 6bc8
0x0020:  503f 05c8 360f 0000 416e 6f6e 796d 6f75
0x0030:  73

August 9th, 2022 - 07:05 pm | read more | comments  

 
 list | rss