WAN emulation (wanem) can be a useful tool. Here are two scripts that can be used on a standard Linux distribution.

Don't forget to:

$ sudo sysctl -w net.ipv4.ip_forward=1
$ sudo iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE # assumes ens18 is nat interface

fleet is an open source device management system that uses osquery for endpoint visibility.

I use docker-compose and a stand-alone MariaDB server outside of Docker for my setup. The following are just notes to self (based on the following docker-compose.yml file):

$ docker-compose down
$ docker-compose pull
$ docker-compose run fleetdm fleet prepare db
$ docker-compose up -d

Because there's always room for one more SSH brute force scanner. This one can both scan single and multiple hosts and subnets, attempt multiple logins and execute a given command once successful.

To scan a single host on port 1022 with the username of 'foo', the password of 'bar', give up after trying to connect for 1 second, and if successful, run 'id' on the host, do:

  ./pysshscan.py --host 192.168.0.64 --user foo --pass bar --command 'id' --port 1022 --timeout 1

To scan a single subnet with a file full of usernames and a file full of passwords, do:

  ./pysshscan.py --host 192.168.0.0/16 --ufile usernames.txt --pfile passwords.txt --command 'id' --timeout 1

To scan multiple targets, use a file full of subnets and hosts, like so:

  ./pysshscan.py --hfile targets.txt --user test --pass test --command 'w'

Download pysshscan.py today! (It requires the Python paramiko and netaddr libraries to work -- both are easy to install).

I wrote a couple of KSH scripts to read and write Cisco running-configuration using SNMP if you know the RW community.

  ./getconfig.sh private 10.10.10.1 192.168.16.1 

The above will copy the running-configuration to 10.10.10.1-config to the tftp server at 192.168.16.1, and:

  ./putconfig.sh private 10.10.10.1 192.168.16.1 modified-config 

which will write the contents of 'modified-config' to the router at 10.10.10.1. The two scripts are getconfig.sh and putconfig.sh and should be self-explanatory.

An old issue resurfaced in the news recently, that many Apache servers were leaking information via its /server-status page. Login pages using GET requests may be particularly vulnerable (leaking login parameters in the URL). This Ruby tool takes either a domain name as input or none at all (then tries to find some likely candidates).

For example, try:

   ./grabstatus.rb example.com | egrep -i '(=>|GET)'

More examples in the code. Find it here. Please note that you need rubygems and the sanitize gem to make it work.

Found an open (reverse) proxy? Keen to see what it's able to connect to? Don't want to do it by hand? The Perl tool, proxymap.pl, takes the following arguments:

$ ./proxymap.pl -h
proxymap.pl v0.2 (c) 2011 th@bogus.net
usage: proxymap.pl [-h|-s|-b] [-p <port>] [-ph <proxy>] [-pp <proxy>] [-m <timeout>]] -t <target>
-h : this
-b : print returned response body on success
-t : targets to test for (range support in last octet: e.g. 192.168.0.1-255)
-p : target port(s) (default: 80)
-ph : proxy to use (default: 193.214.208.185)
-pp : proxy port to use (default: 8080)
-m : timeout (seconds) before giving up, default: 5
-s : probe scan (map permitted ports in proxy)


Please note that the default proxy won't work for you. Sorry.

Sometimes, nmap just can't be used, but Perl can! Scan TCP ports with this little tool.