08.29.08
Posted in OpenSourceSoftware, Ubuntu, Snort, daemonlogger at 11:12 am by Edward Bjarte Fjellskål
I am posting this, as a reminder to myself (And others), of how to compile Martin Roeschs daemonlogger on Ubuntu. Each time I download daemonlogger on to a new system (As I did yesterday with the new daemonlogger 1.2.0) and tries to compile it, I end up spending time finding out where Ubuntu hides the dnet.h file. The fix is simple, though installing libdnet-dev like you would assume, does not give you what you need. Ubuntu uses the DECnet libraries, and the correct package for compiling daemonlogger (And also snort if I remember right) is libdumbnet-dev. But daemonlogger looks for dnet.h (/usr/include/dnet.h) which is the same file as /usr/include/dumbnet.h. So all you have to do then, is to make a symlink from dnet.h to dumbnet.h.
# aptitude install libdumbnet-dev
# ln -s /usr/include/dumbnet.h /usr/include/dnet.h
Happy Daemon-pcap-logging!
Permalink
08.28.08
Posted in OpenSourceSoftware, Security at 9:51 am by Edward Bjarte Fjellskål
When it comes to having a secure website, it is always a challenge. An Internal website/portal, you have a bit more control over who is accessing your site, but that does not mean it should not be secure! Well, having it all thought out, and you feel that all your programing has been 100% top notch, there are still some things you can do, to check yourself.
There are a lot of tools out there, but I am just focusing on some “quick to use” Open Source tools. Just to get you started!
First I will point to Pixy, it static scans your PHP4 code for cross-site scripting (XSS) and SQL injection (SQLI) vulnerabilities. Pixy is written in java. Last update seems to be in the end of July 2007, so it seems abit dead at the moment.
To other cool tools, xss-me and sql-inject-me from the Security Compass exploitme suite (Firefox plug-ins), are also two quick tools to check your website for XSS and SQLi. I recommend to try them out, and if you know of any other tools alike, please let me know!
Last but not least I want to bring out Ratproxy. It checks a whole lot of things about your website, and its worth your time!
Happy bug-hunting!
Permalink
