Pentester Blogs

As we always do, we’ll start from the scratch, the very basics. OSSIM is most widely used open source SIM tool. The appliance is developed by the Alienvault. Other than OSSIM there are lots of open source SIM like LOGalyze, Kustodian, Prelude etc. But out of these SIM tools, OSSIM is my favorite. It is much user friendly and very stable with respect to performance and resilience. They also have a very good documentation center which gives step-by-step instructions and very good community forum to get help Before we start, if you haven’t seen my blog post on SOC please go through it first. http://pentesterblogs.blogspot.in/2017/05/beginners-guide-how-to-setup-soc.html

Lot of people asks me to put something about setting up a SOC. So from today onwards, I’ll be posting articles about, how to set up a SOC. Unlike my other tutorials, SOC is not a specific tool/device, which you can simply ‘fit and forget’. So you need lots of patience and hard work to build one. As usual I’ll posting set-by-step instructions from planning to setting up the SOC.   But before that we need to learn some basics. We need all of you networking, system administration and security skills for this. As a minimum requirement to start, you need to have the following skills Networking basics (Preferred CCNA) Basic system administration (Linux and windows) Security administration (Firewall / UTM management) In other words if know how to configure networking devices, knows how to install package in windows and Linux, and knows at least how to open close ports in firewall, then we’re good to go. I’ve tried my best to write the article from the very basics stuff.

This is one of the top questions I hear at the time of a SIEM implementation. Most people (non-technical) think that just like doing a ‘ping’ to an IP address, we can do ping ports. Honestly, that is not possible. Then how can we actually check accessibility to a port, well there is a way. But before we jump in to it, we need to know a few basics about what a port is, and why we are not able to ping it.

  I hope all of you have already read my blog on OSI layers.   http://pentesterblogs.blogspot.in/2016/07/networking-terminologies.html Today we are going to discuss the TCP/IP suite. When compared with the OSI layer, we can see that few layers have been merged together in TCP/IP suite. Just like the OSI layers, TCP/IP suite is also made up of hierarchical protocols which are interactive and are not necessarily interdependent. OSI layer specifically defines functions of each layer in the model, whereas in TCP/IP suite, these independent protocols can be mixed and matched depending upon the need of the system. Just like the OSI model, upper level layers are supported by one or more lower level protocols in TCP/IP suite also.

Wireshark essential tutorial What we are going to do? In this post, we will start learning Wireshark from the scratch. I’ll show the menus, filters and many other options. Most of the people know about Wirehsark, but they don’t want to try it, because they simply don’t know how to write filters. My key focus will be on creating filter, not writing filters. Yes it is true, that you can make filters without learning those filter parameters. On simple words, you can use Wireshark without touching the keyboard. Those who have kali linux, they have it in Kalilinux. I’ll be using wireshark 32 bit version. I’ll concentrate on HTTP traffic throughout the tutorial. So let’s start with little bit of theory

How to run Maltego Chlorine What is Maltego Maltego is proprietary software by Paterva commonly used for open-source intelligence and forensics,. It mainly focuses on discovering of data from open sources and visualizing that information suitable for link analysis and data mining. The core focus of the application is to analyze real-world relationships between people or a group, sometimes websites, domains or even networks, internet infrastructure, and connection with online social networking sites. Maltego has gained lots of attention from security researchers, according to the Open Web Application Security Project (OWASP).