Hunting Packets » Uncategorized

ms08-067 – it starts

huntingpackets — Sun, 26 Oct 2008 02:31:48 +0000

new project

huntingpackets — Thu, 28 Aug 2008 00:20:27 +0000

New project for the home network – “network black box”. More details and a build doc later.

dns fun

huntingpackets — Fri, 25 Jul 2008 08:44:07 +0000

My ISP has patched their DNS and my firewall dns process (pfsense) does not need patch so I should be good. Now I just need to ride the storm of infected systems at work over the next few weeks as people bring them in from home. The bots shall come marching!

another good podcast

huntingpackets — Thu, 17 Jul 2008 18:05:51 +0000

This time from WatchGuard. Usually the podcasts by a company are no good. WatchGuard has done something great. They split the “company propoganda” and the good stuff. If you own a WatchGuard device then you will like the ones that start with “firebox special”, if you don’t just skip them and listen to the others. The hosts, Scott and Corey do a great job and running you through an exploit or vulnerability instead of just listing off news items like some of the other security podcasts do.

http://www.watchguard.com/education/radiofreesecurity.asp

(also in ITunes catalog)

podcast recomendation

huntingpackets — Wed, 09 Jul 2008 17:27:21 +0000

I am always in search of a good podcast. Lately i have found Ricky Business. It is from Australia and meets all of my “likes” below.

http://itradio.com.au/security/

1. Good audio – there are many that start but don’t invest in good equipment. There is nothing harder than trying to listen to a podcast that has horrible audio.

2. Boring content. I don’t want to listen to something that sounds like someone is reading the newspaper. I can do that. I like podcasts that sound like I am eavesdropping on a group of gurus at a security conference.

3. Keep it to the subject matter. There are a few out there that get too childish. I am all for jokes but when it is more than your subject matter that is too much.

side effects of this job

huntingpackets — Sat, 14 Jun 2008 04:07:52 +0000

Thanks to looking at url obfuscation all day I know write 50% as %50.

What is the purpose of this….

huntingpackets — Fri, 30 May 2008 03:16:57 +0000

Doing a little google for my domain and I find a url from webalizer from Feb 2008 on a few foreign sites. It is with hundreds of other domains with the same url string in the comment fields of a blog.

What is the point of this? If it were a list being stored by someone who choose Feb 2008? If there was a bug or something in that page would it not be for all months?

with death there is life

huntingpackets — Thu, 29 May 2008 05:08:54 +0000

I was sad to give up my box that hosted my Active Directory servers but now I have the hardware to implement OSSIM. Hope its as good as the screen shots or as good as the pfsense project. This will be the first publish project on the new wiki.

wiki

huntingpackets — Thu, 29 May 2008 04:57:43 +0000

Most of the content on this site will be on the wiki.

Topics so far are:

- events – sorted by vendor, product then event name – with real world notes and links to other posted write ups.

- tools and syntax – like it says

- project list – notes from builds I have run

Any more ideas would be great.

network update day today

huntingpackets — Wed, 28 May 2008 07:19:00 +0000

updated the NAS – new firmware and the usb hookup works! – now I can backup the NAS over usb instead of from another pc with a usb drive

updated my wap to new version of tomato – since i only run as wap not much to notice

no update for pfsense -1.3 should be out soon – wish they would get their traffic graphs from tomato!

killed both domain controllers (needed the hardware, very sad!) and the wsus server, had to go around and config the xp clients to auto update (will have a very nice box for logs now though!)