Year: 2024

  • Top Windows Terminal Commands

    Top Windows Terminal Commands

    Introduction

    Although PowerShell has made progress over the last few years as the preferred command line tool, I find that knowledge of the original command line is still very valuable. You can use the command line to quickly get system information or write batch scripts to automate simple tasks.

    Most commands can be run as a regular user. But, as always, depending on what you are doing some commands may need to be run at an elevated prompt. To see all available commands, type “help”. To see help about a specific command use “<command> /?”.

    Navigate & Help

    cd /d H:Change drive to H: drive
    cd \Change directory to C:\
    helpSee all commands.
    <command> /?Get help about command <command>.

    User Information

    net user administrator /active:yesEnable the hidden Administrator acct (run cmd as admin).
    gpupdate /forceUpdate the user’s group policies.
    net user username1 /domainGet current user details (last logon, passwd age, etc).
    gpresult /user <user1> /r | moreGet a list of the user’s domain groups.
    psloggedon \pcname or ipSee who is logged in (sys internals).
    net usersprint a list of all system users.
    sc query | moreDisplay status of active services.
    net localgroup administratorsList all local administrators.
    net localgroup “remote desktop users”List users allowed to login remotely.

    Folder & Files

    dirDisplay files in the current folder.
    cipher s:/<Folder name> Check if a folder/file is encrypted.
    cipher /cDisplay info on the encrypted file.
    mkdirMake a Directory
    find or findstr “Find”Find all lines with the word “joe”.
    del newfile.txtDelete the file newfile.txt.
    move [source] [ target]Move file to new location.
    fc /a monthly.txt sales.txtCompare two text files.
    robocopy /s [src] [dst]Copy directories except empty ones.

    System Information

    msinfo32Launch the system info GUI.
    hostnameDisplay the name of the computer.
    wmic cpu get numberofcores, NumberOfLogicalProcessorsDisplay # of CPU cores and logical processors.
    wmic /node:10.10.56.10 bios get name, versionDisplay BIOS name & ver. from a remote PC.
    wmic os get caption, versionDisplay OS name and version.
    wmic computersystem get manufacturer, modelDisplay PC manufacturer and model.
    systeminfo <hostname> | find “OS Name”Display the OS Name only.
    net shareList all files on the system that you are sharing.

    System Tasks

    msconfigLaunch sys config GUI. Manage startup programs.
    taskkillKill running processes.
    shutdown /rShutdown and reboot the pc.
    mstsc /adminStart an RDP session.
    tasklistdisplay running processes.
    wmic process get description, executablepathdisplay running executables.
    schtasks /query | moreDisplay scheduled tasks

    Networking

    ping -aTest network connectivity and resolve DNS.
    ipconfig /allDisplays current IPv4, DNS server name, and Gateway router IP, and other info.
    nslookupReturns an IP address or a name.
    tracert <url>Trace & displays path to reach an internet host.
    netstat Check the UDP/TCP connections. ( See Article)
    route printList routing table.
    arp -aGet address resolution table.
    netshChange network setting, like whether to use DCHP (See below).
    nbstat Display stats and current connections using NetBIOS over TCP/IP.

    How to Manually Set Your Networking

    Run these commands at an elevated prompt.

    Set a static IP

    netsh interface ip set address name="Local Area Connection" static 192.168.0.1 255.255.255.0 192.168.0.254

    Set DHCP from a static IP address

    netsh interface ip set address name="Local Area Connection" source=dhcp

    Set A Primary DNS Server To a static IP

    netsh interface ip set dns name="Local Area Connection" static 192.168.0.250

    Set the secondary DNS server to a static IP

    netsh interface ip add dns name="Local Area Connection" 8.8.8.8 index=2

    Set your DNS settings to be assigned dynamically

    netsh interface ip set dnsservers name="Local Area Connection" source=dhcp

  • Ansible Ad-Hoc Commands

    Ansible Ad-Hoc Commands

    Introduction

    Ansible gives you a powerful option to run commands ad-hoc. This negates the need to write a script, if you only need some quick information. There are two separate options for gathering data via ad-hoc. If you are running just a single command than use the ‘command’ module. If you need to run multiple commands, use the ‘shell’ module.

    You may or may not need to reference the your inventory file, if you are using DNS names. If you are using IP addresses, then you probably do not need it.

    -m = module (shell or command)
    -a = argument (command you want to run on the remote system).

    Run a Single Command against Multiple Hosts

    ansible -i inventory.ini -m command -a 'ip a' server1,server2

    Run Multiple Commands against a Single Machine

    ansible -i inventory.ini -m shell -a 'hostname ; ipa | grep 10.10 ; df -h | grep /dev/mapper ; lsb_release -a' server1
  • Tips to Safeguard Your Digital Secrets

    Tips to Safeguard Your Digital Secrets

    Introduction

    Password manager databases, asynchronous keys, digital signatures, and MFA recovery passcodes are designed to identify you, decrypt files, or help you recover from a failed 2FA login. Care must be taken to protect these digital items so they do not fall into unwanted hands.

    The below techniques are not a cure all, and other options should be considered. But, these are basic beginning steps that can be taken to help keep your data private.

    What ever options you choose, always make sure to BACKUP your data on a flash drive and store it in a “real world” safe. If keys, digital signatures, databases are lost or corrupted, there is no method to recover them.

    Method 1 – Hide the Folder

    Place your password database or asynchronous keys in a hidden folder. In Linux, to make a hidden folder, use a dot in front of the directory name like”.ssh”. To make a folder hidden in Windows, right click the folder, select properties, to go the general tab and select “hidden”. Although this method does not provide much protection by itself, it is a good starting point.

    Method 2 – Set File Permissions

    Change permissions on the files or folder so that only your account can access it. Use an explicate deny to all users including the system and administrator accounts. In Linux, this means changing a file’s rwx permissions to something like 400. In Windows, files are inherited by the parent folder. Right click on file, select properties, select, security tab. Under the “Group or username” section, select the edit button. Highlight each account, except your account, and select “Remove”.

    Method 3 – Print a Hard Copy

    After initially setting up an account on an application or website, you may given recovery or one-time authentication passcodes. This is an backup procedure to grant you access to the application in the event of an emergency that your regular MFA fail to work. Rather than printing these codes to PDF and keeping them on your PC. Print the passcodes to paper and store them off the network in a physical “real world” safe.

    Method 4 – Add a Passphrase

    In asymmetric cryptography, you have a public key and a private key. The private key is to remain confidential. To help protect your private key, you can add a passphrase to it. A passphrase is a password for your private key. When used in conjunction with other security features, it may help slow down attackers. They will have to crack, yet another password, before they can access the key.

    Method 5 – Encrypt Files

    Store important files in an encrypted folder. In Windows, any file dropped into an encrypted folder will automatically be encrypted too. Simply right click on a folder, select properties, go to general tab, select advanced attributes, and select “Encrypt contents to secure data”. The Microsoft OS will automatically take care of encrypting and decrypting the folder and contents when it is accessed locally.

    Ensure that your password manager database is encrypted. If you are using KeePass it is automatically encrypted when the database is generated.

    Method 6 – Flash Drive (preferred method)

    Store the private key or database on a portable flash drive or YubiKey and only plug it in to your computer when you need to access it. For added safety, encrypt the flash drive.

  • Managing Your Passwords

    Managing Your Passwords

    Forward

    Good password habits are essential for any person who works regularly online. Due to regulations or contracts with customers, many business are required to have specific password polices. In 2024, here are some of the most recent recommendations concerning passwords.

    Password Best Practices

    As part of a good password management practice, whether at home or work, you should incorporate some or all of the below ideas.

    • Do not reuse old passwords. Maintain a password history.
    • Always use 2FA, where possible.
    • Require long complex passwords. (12+ characters)
    • Change your password, whenever you are involved in a data breach.
    • Use a unique password for each separate application.
    • Store passwords in an encrypted format.
    • Use a password manager.
    • Change your passwords on a regular basis.
    • Use public/private passkeys, instead of passwords, where possible.

    Use a Password Manager

    Rather than using the same password to login to everything, it is recommended to use a desktop password manager. Avoid browser based password managers. An application like KeePass, allows you to set unique strong passwords for each website or application.

    • Use 2FA to login to the password manager.
    • Authorize specific users to only access specific vaults.
    • Identify risky users and risky accounts in advance.
    • Disable browser based password managers.
    • Set to automatically generated strong passwords.
    • Train all employees / users on how to use the password manager.
    • Consider enabling PAM, if appropriate.

    Reference: https://keepass.info

    Conduct Regular Password Audits

    Just as important, as creating and maintaining passwords, is conducting a routine audit on your password database. A routine audit could catch unwanted activity early and prevent undesired access being granted. Things to look for, would be:

    • Who has been accessing the passwords?
    • Was there after hours access?
    • Was there multiple sequential failed attempts in a short time frame?
    • Did a user accessed all passwords in a short time frame?
    • How frequently has a single key been accessed?
    • Identify at-risk users who are accessing the database (been a victim of a breach lately?)
    • Review logs for restricted functions (create, delete, copy, or modify passwords).
  • Run a Basic NMap Scan

    Run a Basic NMap Scan

    Introduction

    NMAP (Network Mapper) is a utility for identifying all hosts on a network and what ports are open on those devices. Historical, it can also tell what the OS is of the identified hosts and what services are running on the open ports. I have not found the OS or the service identifiers to be very accurate.

    Below are some common use cases for nmap.

    NMAP Command

    nmap <scan type> <options> <targets>

    What are the common switches

    -sS = TCP SYN Scan. (Is the port listening?, does not complete the handshake). Default Scan.
    -sT = TCP connect scan. Use this, if -sS is not available.
    -sU = UDP scan
    -sV = probe open ports and determine what service are running.
    -p = only scan specified port or range. [53, 443, ssh, 22-23, 80-44, 1-17000].
    -p- = scan all 65,000 ports
    -v = verbose.
    -T5 = set timing to highest level. Higher is fastest. (-T3 is default).
    -f = scan 100 most common port (fast scan)
    -O or -A = Detect OS
    -n = do not do DNS resolution.
    –open = only display open ports.

    State of the ports

    • open – An application is actively accepting TCP connections or UDP datagrams.
    • closed – A port is accessible, but nothing is listening.
    • filtered – Can not determine if the port is open (typically blocked by firewall).
    • unfiltered – Port is accessible, but unable to determine if open or closed.
    • open/filtered– Unable to determine if port is open or filtered.
    • closed/filtered – Unable to determine if port is closed or filtered.

    Run a TCP Scan

    nmap -sS -v -p 443 -sV -O -T4 10.32.123.10

    -sS = TCP/SYN connect
    -v = verbose
    -p = scan port 443
    -sV= get the running service
    -O = Determine the OS
    -T4 = Set timing to aggressive.

    Run a UDP scan

    nmap -sU --open www.someURL.com

    -sU = conduct a UDP scan
    –open = display only open ports.

    Run a TCP scan and display only the open ports

    nmap -sV -T4 -p- -n 66.161.240.21 --open

    -sV = determine the running services.
    -T4 = use number 4 timing template, Aggressive: fast scan, -T3 = default
    -p- = Scan all 65535 ports.
    -n = do not due DNS resolution.
    –open = only show open ports.

    Scan multiple IP addresses using TCP & send results to a text file

    nmap -sV -T4 -p- -n -iL /opt/targets --open -oX /opt/colo_20221108

    -sV = get the running service.
    -T4 = conduct an aggressive scan.
    -p- = scan all 65000 ports.
    -n = do not convert to a DNS name.
    –open = list only the open ports.
    -oX = /path/filename.txt = output scan in XML format
    iL= input from a file /path/filename.txt.

    Ping a specific port

    nmap -p 443 facebook.com

    Check a cipher suite

    nmap -sV --script ssl-enum-ciphers -p 443 website.com

    Reference:

    https://nmap.org

  • Standards & Organizational Controls (SOC)

    Standards & Organizational Controls (SOC)

    Brief Overview

    Standards and Organization Controls (SOC) is an information security framework designed to help companies stress test their information security controls and catch any deficiencies in a company’s security posture PRIOR to a government inspection or external third party audit.

    A SOC audit is an internal company audit primarily designed to provide the company management and potential external investors with assurances that the company is following industry best practices, internal polices and procedures, and is meeting obligatory government regulations. The audits are typically conducted annually .

    There are two different SOC audits. SOC1 verifies information security controls are in place relating to possible financial impacts (i.e. external investors). SOC2 is to verify the security and privacy of the data itself (i.e. the customer data).

    In total, there are 4 versions of a SOC audit.

    • SOC1, Type 1 – verifies controls actually exist and reviews an organization processes and controls.
    • SOC1, Type 2 – verifies if controls actually work and looks at if processes and procedures are actually being followed.
    • SOC2, Type 1 – verifies controls actually exist and reviews an organization processes and controls.
    • SOC2, Type 2 – verifies if controls actually work and looks at if processes and procedures are actually being followed.

    The primary audit of interest to most users is a SOC 2. It defines requirements to manage and store customer data based these five Trust Services Criteria (TSC):

    • Security – Protect information from unauthorized access.
    • Availability – Ensure employees and customers can rely on the systems to work.
    • Processing integrity – Verify the company systems operate as intended.
    • Confidentiality – Protect confidential information by limiting its access, storage, and use.
    • Privacy – Safeguard PII against unauthorized users.

    In order to pass a SOC2 audit, you must meet all five Trust Services Criteria. The criteria are defined specifically in the nine (9) categories listed below.

    General Criteria

    • CC1 – Organization – It establishes how your organization has been incorporated and addresses how your Board of Directors was formed. It also includes HR topics such as recruitment and training practice. Does the organization value integrity and security?
    • CC2 – Communication – Establish your obligation to collect information and describe how it will be disseminated internally and externally. Are policies and procedures in place to ensure security?
    • CC3 – Risk – Financial risks, but many modern technology companies pivot implementation of these controls towards technical risk. Does the organization analyze risk and monitor changes?
    • CC4 – Monitoring – How you intend to monitor your adherence to the controls themselves. They establish the cadence for your audit and how you intend to communicate the results to internal and external stakeholders. Does the organization monitor, evaluate, and communicate the effectiveness of its controls?
    • CC5 – Control Activities – Take place within the technology environment you’ve deployed, as well as within the policies and procedures you’ve adopted. The most important element of the CC5 controls is the establishment of the policies themselves and how these are distributed to personnel. Are the proper controls, processes, and technologies in place to reduce risk?

    Specific Criteria

    • CC6 – Logical & Physical Access – The biggest section of controls. Everything you have to say about access, data handling and disposal, and threat prevention is included somewhere in the CC6 series. Does the organization encrypt data? Does it control who can access data and restrict physical access to servers?
    • CC7 – Operations – The pillars of your security architecture. Specifies certain tool choices such as those regarding vulnerability detection and anomaly detection. Are systems monitored to ensure they function properly? Are incident response and disaster recovery plans in place?
    • CC8 – Changes – It seeks to establish an approval hierarchy around significant elements of the control environment such as policies, procedures, or technologies. As long as your environment does not permit unilateral changes to these elements of the control environment, you should be in good shape. Are material changes to systems properly tested and approved beforehand?
    • CC9 – Mitigations – To prescribe the activities and steps that should be taken to mitigate those risks. For example, if database failure were identified as a risk, a mitigation action would be taking backups of that database. Does the organization mitigate risk through proper business processes and vendor management?

    Additional Criteria

    Two additional criteria have been developed that may or may not be included in an audit. It depends on the type of data a company handles.

    • P Series – Privacy – Focused on businesses that have substantial privacy obligations and are already equipped with solid policy. So what’s needed is to map the existing controls to the P series controls.
    • PI Series – Processing Integrity – Situations where your organization is performing transactions on behalf of another organization. Just as with the privacy controls, it’s likely that your customer contract already contains many of the guarantees the PI controls seek to address. Your task will be to map your existing contracts, commitments, and policies back to the PI series controls.