wop

joined 2 years ago
MODERATOR OF
 

Set up new #FreshRSS instance for now. I want to read more and stay up to date on certain topics and I figured I could give RSS another chance. Stays invite-only for now, but feel free to hit me up if you want to have an account.

 
 

Focus on decoding unknown strings.

 

Not gonna lie, wasn't that fun. Learned a lot, but felt lost multiple times. Probably gets better over time.

 

Doing some rooms on TryHackMe. Decided to create a write up of one room. Have to work on the format, but it should be fine for now.

Feedback is welcome!

 

I think I've never share one of my favorite articles with you.

Creating this was great and it has been a great resource ever since. I use SSH tunnel a lot in troubleshooting sessions and security demonstrations.

 

I am pleased to announce the launch of: forum.ittavern.com

More information can be found in this thread, but in short I miss the forum culture and want to create an open-minded and sustainable community.

I welcome you and look forward to great discussions.

[–] wop@infosec.pub 3 points 1 year ago
 

I am happy to share with you the new design of my blog.

New logo, new thumbnails, lots of CSS changes and everything is now hosted in a German DC.

The goal was to create a clean design and reduce the loading time even further.

Feedback is welcome.

 

Sending files over the internet. Been a pain in the past and I finally decided to host my own instance. It should be 'production' ready, but let me know if you encounter any problems.

[–] wop@infosec.pub 2 points 1 year ago

Currently using HedgeDoc for taking notes, but it is lacking some features, so I am trying to find and host some alternatives and compare them. And I hope I can find some time to play with my Flipper Zero....

 

So, every network engineer knows it: everyone else will blame the network and you have to prove them wrong.

There are multiple reason:

  • lack of knowledge
  • ignorance
  • passing on responsibility
  • laziness
  • ... There are more.

I am interested in how you react to 'The network is causing the problems' requests.

  • do you request certain information?
  • need an explanation?
  • what are you first steps?
  • do you have a runbook or some policy in place?

Without getting into too much detail, I request some or all of the following information before I start looking:

  • what are they trying to do? What is the desired outcome?
  • what is the error message? *(pref a screenshot!) *+ timestamp (for logs)
  • has it ever worked before?
  • since when isn't it working?
  • can you resolve domains?
  • Source Host > Destination Host:Port
  • Results of Ping + Powershell Test-NetConnection on Windows and Netcat on Linux (to test general connection, assuming TCP connection)

What I ask for and in what order depends on the person I am talking to. By the way, monitoring is my friend. If it says everything is fine, it usually is.

Side note Describing the actual proof that it is not the network depends heavily on the infrastructure and the problem, so this may be a discussion for another thread.


What are your first steps?

 

A quick & dirty solution that is available on most Linux hosts.

[–] wop@infosec.pub 2 points 1 year ago

I want to get into Ansible and I am building a testing env for it - home lab with various switches and routers, Fortinet, Palo, and a proxmox host server and some remote VPS. One of my goals for Q1 '24. Today I am going to prep the switches.

Besides that, I want to host my own NFTY server and I hope that I can get it online within this week.

[–] wop@infosec.pub 5 points 1 year ago (3 children)

I am currently transitioning into a Security role at work. One question would be: what are the must-have tools for every blue team?

  • Vuln-Scanner
  • Logging/ SIEM-Server
  • ...
[–] wop@infosec.pub 3 points 1 year ago

Learning things about Wireguard and implement it to secure my internet facing servers.

[–] wop@infosec.pub 1 points 2 years ago (1 children)

Getting a pcap of another client could bring some insight, yeah.

SSH is used for the data transfer. Without knowing it at this moment, I'd assume scp or rsync. You mean whether all their internet traffic is routed through the active SSH session?

[–] wop@infosec.pub 1 points 2 years ago

Gotcha! - I thought Wireguard might has some logging features that could provide some insights. Thank you.

[–] wop@infosec.pub 1 points 2 years ago (2 children)

Not yet. Wouldn't expect it tbh, but you'll never know. How would you utilize Wirehuard for it? I'd like to hear more about it.

[–] wop@infosec.pub 1 points 2 years ago (4 children)

Valid question. We've checked it multiple times, on the client and via monitoring that it is 10 Mbits. Thank you.

view more: ‹ prev next ›