SPLIT LARGE FILES INTO SMALLER PARTS & MERGE : FOR EASY MIGRATION in LINUX SYSTEMS

1.    Routine troubleshooting in system handling gives us a way to explore and try new options.Recently tried a new way to migrate large files(around ~17 GB in my case here ). Although there are easier options available by simply copying in a external device,but in my case external devices were not allowed so attempted to split the large file into 3 GB size files and then finally could merge them....and could also verify the hash....and it was absolutely right...sharing few screen shots :

2.    The entire thing of splitting and merging gets over in simple two commands of SPLIT & CAT

 > split -b file.name
 > cat x* > file.name

3.   I have a .vdi virtual image file which is approx 16 GB in size.The file details are seen in the screen shot below :

Here ..before I go for the split...I have taken the hash of the same to compare it later after i merge the split parts...to check the originality of files and I get the hash of the file as bb867749cf4c0325abe145a0998e3b04

 

In the screen shot below I use the split command,which is inbuilt to UBUNTU and typically all Linux systems....I split the file in 3GB parts...

 

This screen shot shows the watch screen shot of the populating split parts...

 This screen shot shows the watch screen shot of the populating split parts...

 and here i get the final .vdi file as well m able to match the hash as same ie bb867749cf4c0325abe145a0998e3b04

Ubuntu: How To Create an ISO Image from a CD or DVD?

1.   For Ubuntu users this small post gives u a single line command on how to create a ISO image from a physical CD/DVD.

2.    First step is to simply load the CD/DVD.

3.    Second step involves opening the terminal by pressing CTRL+ALT+T

4.    Check where is the CD/DVD mounted by typing "lsblk" without quotes as seen below in a sample shot.

 

5.    Type Execute the following command: cat /dev/sr0 > /home/endhiran/Desktop/kali.iso where /dev/sr0 is the device name for your drive.

                

The disc will begin to spin and the ISO image will start being constructed. Once it has completed, you have an ISO image of your CD. To verify that the image was properly created, mount the ISO file and check the contents.

Power of PING

In our respective interactions with various networks accessible to us.....as administrators we keep pinging so many IPs for testing the connectivity at various times like ping 192.121.23.1 etc....and we get a response...but ping it self has so many switches that most of us hardly use......i came across a chart today that in a summarized form tells the switches of ping command with examples and a brief explanation.....sharing here with you...thanks http://www.activexperts.com

ping -c count	ping -c 10	Specify the number of echo requests to send.
Ping -d	ping -d	Set the SO_DEBUG option.
Ping -f	ping -f	Flood ping. Sends another echo request immediately after receiving a reply to the last one. Only the super-user can use this option.
Ping host	ping 121.4.3.2	Specify the host name (or IP address) of computer to ping
ping -i wait	ping -i 2	Wait time. The number of seconds to wait between each ping
ping -l preload	ping -l 4	Sends "preload" packets one after another.
Ping -n	ping -n	Numeric output, without host to symbolic name lookup.
Ping -p pattern	ping -p ff00	Ping Pattern. The example sends two bytes, one filled with ones, and one with zeros.
Ping -q	ping -q	Quiet output. Only summary lines at startup and completion
ping -r	ping -r	Direct Ping. Send to a host directly, without using routing tables. Returns an error if the host is not on a directly attached network.
Ping -R	Ping -R	Record Route. Turns on route recording for the Echo Request packets, and display the route buffer on returned packets (ignored by many routers).
ping -s PacketSize	ping -s 10	Sets the packet size in number of bytes, which will result in a total  packet size of PacketSize plus 8 extra bytes for the ICMP header
ping -v	ping -v	Verbose Output. Lists individual ICMP packets, as well     as Echo Responses

Upgrading Backtrack R2 to R3 : Distribution Upgrade

Single line terminal command from the BT Terminal to upgrade your Backtrack Dist is

apt-get update && apt-get dist-upgrade

Print to PDF in Ubuntu 12.04 LTS

1.     This is a simple single line of command that u write at the terminal to install a third party app that will install a pdf printer in ur Ubuntu System.

sudo apt-get install cups-pdf

2.     This will be generally handy when u need to print your documents that are ready to print but u don't have a printer installed....actually create a virtual PDF printer on your ubuntu PC that lets you convert all your documents/images/anything into PDFs that you can subsequently send to print as and when u have the facility to print.

3.    Thanks http://ubuntuportal.com

HOW DO U FIND IF YOUR PC IS HACKED?- PART 6

FIND COMMAND

1.   Most of the commands I have discussed so far spew a lot of output on the screen, which could be hard for a human to look through to find a specific item of interest. But, Windows comes to the rescue. Users can search through the output of a command using the built-in find and findstr commands in Windows. The find command looks for simple strings, while findstr supports regular expressions, a more complex way to specify search patterns. Because the regular expressions supported by findstr go beyond the scope of this tip article, let's focus on the find command. By default, find is case sensitive - use the /i option to make it case insensitive.

2.    The find command also has the ability to count. Invoked with the /c command,it'll count the number of lines of its output that include a given string.Users often want to count the number of lines in the output of a command to determine how many processes are running, how many startup items are present  or a variety of other interesting tidbits on a machine. To count the lines of output, users could simply pipe their output through find /c /v "". This command will count (/c) the number of lines that do not have (/v) a blank line ("") in them. By counting the number of non-blank lines, the command is,in effect, counting the number of lines.

3.  Now, with the find command, users can look through the output of each of the commands I've discussed so far to find interesting tidbits. For example , to look at information every second about cmd.exe processes running on a machine, type:

C:\> wmic process list brief /every:1 | find "cmd.exe"

Or, to see which autostart programs are associated with the registry hive H KLM, run:

C:\> wmic startup list brief | find /i "hklm"

To count the number of files open on a machine on which openfiles accounting is activated, type:

C:\> openfiles /query /v | find /c /v ""

Whenever counting items in this way, remember to subtract the number of lines associated with column headers. And, as a final example, to see with one-second accuracy when TCP port 2222 starts being used on a machine, along with the process ID using the port, run:

C:\> netstat -nao 1 | find "2222"

THANKS www.amazingit.blogspot.com

HOW DO U FIND IF YOUR PC IS HACKED?- PART 5

NETSTAT COMMAND

1.  The Windows netstat command shows network activity, focusing on TCP and UDP by default. Because malware often communicates across the network, users can look for unusual and unexpected connections in the output of netstat, run as follows:

C:\> netstat –nao

2.  The -n option tells netstat to display numbers in its output, not the names of machines and protocols, and instead shows IP addresses and TCP or UDP port numbers. The -a indicates to display all connections and listening ports. The -o option tells netstat to show the processID number of each program interacting with a TCP or UDP port. If, instead of TCP and UDP, you are in interested in ICMP, netstat can be run as follows:

C:\> netstat -s -p icmp

3.   This indicates that the command will return statistics (-s) of the ICMP protocol. Although not as detailed as the TCP and UDP output, users can see if a machine is sending frequent and unexpected ICMP traffic on the network. Some backdoors and other malware communicate using the payload of ICMP Echo messages, the familiar and innocuous-looking ping packets seen on most networks periodically.

4.  Like WMIC, the netstat command also lets us run it every N seconds. But, instead of using the WMIC syntax of "/every:[N]", users simply follow their netstat invocation with a space and an integer. Thus, to list the TCP and UDP ports in use on a machine every 2 seconds, users can run:

C:\> netstat -na 2

HOW DO U FIND IF YOUR PC IS HACKED?- PART 4

OPENFILES COMMAND

1.  Many Windows administrators are unfamiliar with the powerful openfiles command built into Windows. As its name implies, this command shows all files that are opened on the box, indicating the process name interacting with each file. It's built into modern versions of Windows, from XP Pro to Vista. Like the popular ls of command for Linux and Unix, it'll show administrators all open files on the machine, giving the process name and full path for each file. Unlike lsof, however, it doesn't provide many more details, such as process ID number, user number and other information.

2.  Considering the volume of information it gathers, it's no surprise that the openfiles command is a performance hog. Thus, the accounting associated with

openfiles is off by default, meaning users can't pull any data from this command until it is turned on. This function can be activated by running:

C:\> openfiles /local on

3.  Users will need to reboot, and when the system comes back, they will be able to run the openfiles command as follows:

C:\> openfiles /query /v

4.  This command will show verbose output, which includes the user account that each process with an open file is running under. To get an idea of what malware has been installed, or what an attacker may be doing on a machine,users should look for unusual or unexpected files, especially those associated with unexpected local users on the machine.

5.   When finished with the openfiles command, its accounting functionality can be shut off and the system returned to normal performance by running the following command and rebooting:

C:\> openfiles /local off

HOW DO U FIND IF YOUR PC IS HACKED?- PART 3

1.  While WMIC is a relatively new command, let's not lose site of some useful older commands. One of my favourites is the venerable "net" command. Administrators can use this to display all kinds of useful information. For example, the "net user" command shows all user accounts defined locally on the machine. The "net localgroup" command shows groups, "net localgroup administrators" shows membership of the administrators group and the "net start" command shows running services.

2.  Attackers frequently add users to a system or put their own accounts in the administrators groups, so it's always a good idea to check the output of these commands to see if an attacker has manipulated the accounts on a machine. Also, some attackers create their own evil services on a machine, so users should be on the lookout for them.

More here.....

HOW DO U FIND IF YOUR PC IS HACKED?- PART 2

1.    WMIC stands for Windows Management Instrumentation Command-line It lets administrative users access all kinds of detailed information about a Windows machine, including detailed attributes of thousands of settings and objects. WMIC is built into Windows XP Professional, Windows 2003 and Windows Vista.

C:\> wmic process

2.    When you run this command, the output may not be an easy to understand format but the same can be formatted in several different ways, but two of the most useful for analysing a system for compromise are the "list full" option, which shows a huge amount of detail for each area of the machine a user is interested in, and the "list brief" output, which provides one line of output per report item in the list of entities, such as running processes, autostart programs and available shares. For example, we can look at a summary of every running process on a machine by running:

C:\> wmic process list brief

3.   That command will show the name, process ID and priority of each running process, as well as other less-interesting attributes.

C:\> wmic process list full

4.   This command shows all kinds of details, including the full path of the executable associated with the process and its command-line invocation. When

investigating a machine for infection, an administrator should look at each process to determine whether it has a legitimate use on the machine, researching unexpected or unknown processes using a search engine.

5.   Beyond the process alias, users could substitute startup to get a list of all auto-start programs on a machine, including programs that start when the system boots up or a user logs on, which could be defined by an auto-start registry key or folder:

C:\> wmic startup list full

6.   A lot of malware automatically runs on a machine by adding an auto-start entry alongside the legitimate ones which may belong to antivirus tools and various system tray programs. Users can look at other settings on a machine with WMIC by replacing "startup" with "QFE" (an abbreviation which stands for Quick Fix Engineering) to see the patch level of a system, with "share" to see a list of Windows file shares made available on the machine and with "useraccount" to see detailed user account settings.

7.   A handy option within WMIC is the ability to run an information-gathering command on a repeated basis by using the syntax "/every:[N]" after the rest of the WMIC command. The [N] here is an integer, indicating that WMIC should run the given command every [N] seconds. That way, users can look for changes in the settings of the system over time, allowing careful scrutiny of the output. Using this function to pull a process summary every 5 seconds, users could run:

C:\> wmic process list brief /every:1

Hitting CTRL+C will stop the cycle.

More good examples here

HOW DO U FIND IF YOUR PC IS HACKED?- PART 1

1.   We all keep ourselves worried over issues pertaining to our PC security including issues like if or not it is a zombie or if the same is already a compromised one etc. But how would you find the answer to these......call an expert and pay from your pocket? NO....the answer is MS it self...yesss!!....Microsoft Windows has a series of commands with the help of which a normal PC user would be able to find out the answers.....

2.   Following are the list of commands which would be used

WMIC Command

            - C:\> wmic process

            - C:\> wmic process list brief

- C:\> wmic process list full

- C:\> wmic startup list full

- C:\> wmic QFE list full

- C:\> wmic process list brief /every:1

The net Command

-         net localgroup

-         net localgroup administrators

Openfiles Command

          - C:\> openfiles /local on

Netstat Command

-         C:\> netstat –nao

-         C:\> netstat -s -p icmp

-         C:\> netstat -na 2

Find Command

For more details on these commands...click here....