Pen Test Lab

I just wanted to update my blog with a diagram of my pen testing lab. My lab is not connected to the internet and I made it easy to take with me to events.

Still Living

Everything sounds like a great idea when you are looking to start something new. I wanted to start blogging about IT security and fitness a few years ago, but after the first blog entry I realized that this would not be something easy since I am involved in so much. I am going to at least try and post something monthly about things that I am working on in the home lab.

I am currently reloading my security environment.

Main Servers

Ubuntu 9.04 Server
SLES 10
RHEL 5
M$ server 2008 - Yes, I am actually going to install Windows in my environment. It is a must in order to test security vulns.
M$ server 2003 " "

Software

DB
SQL 2008
SQL 2003
MySQL

Web
Apache
IIS
Tomcat

I am going to be testing web applications for vulnerabilities.

Ohio Linux Fest

Just got back from the OLF (Ohio Linux Fest). It was alright. Always good to hang out with people from the community.

John "maddog" Hall gave a good talk on Sustainable computing. He is always encouraging to listen to. You can tell he meditates and is very focus on his mission to learn and bring education everywhere. I would enjoy spending some time with John.

intx80 and remyforbes from Dual Core (http://dualcoremusic.com/nerdcore/) rocked the after party with there unique nerdcore hip hop sound. The beats from c64 is off the hook. The guys from notacon did a good job on the mixes and video game setup.

I have to get back to the books. I will try and post something again soon. I think my next post would be about my round table dream team (people that inspire me the most in the field of technology).

Try Again

If time allows i am going to try and write on my blog. I have been so busy in the last few months. I have not stop doing security research. I am always messing around with security techniques in my lab. I test out different types of Linux flavors. Read through source code to learn how applications work and see if i can tweak it for my personal use (open source code that is).

Got to go.

-RH

Third Post!!! woo hoo

Today was pretty laid back. I was playing around with AJAX technique. I am making myself a portal to perform all my tasks i do daily. I enjoy scripting and automating tasks. I hate when it's already done and you just become a user of some script or application. I need to pop the hood open and see whats going on, or have a challenge of coming up with a solution to make someone else's job easier. The worst job to have is being in maintenance mode of some application and doing day to day support and no major upgrades and new development.

I have been asked time after time why do I like Linux and the open source community so much. The answer is plain and simple. Linux and open source allowed my curiosity of technology to be taken to another level. I was able to learn about operating systems, application development, networking, etc... without breaking license agreements. I am not saying the only way for you to have a deep understanding about technology you need to be running Linux. I would say that i feel that Linux and open source push more for people to learn and know what's going on. My normal process with apps is, wow! this is a cool app, okay now this is getting boring what else can this app do, I wonder how did they do this or that, lets pop the hood open, that interesting, I wonder why they did it this way, then just keep gone on and on. Open source allows me to follow that process.

Enough about Linux and open source.

I have started back eating descent and drinking my green tea everyday. It is amazing how you feel when trying to eat healthy majority of the time. I used to work out twice a day and had a good diet. Getting married and having kids threw me off my routine. I don't blame marriage or having kids for my lack of working out and eating right. I allowed myself to slow down and eventually got out of the routine. One of the hardest things is getting back in the routine of working out. When I was working out, i hated getting sick and taking time off because I knew that once you stop for a week or two you can be easily influenced to not workout. I also trained myself not to rely on having a work out partner. If you rely on a work out partner and they missed a work out, you would most likely miss also. I just went to the gym and worked out. If someone joined me, great. But if not I was fine. I actually enjoyed working out by myself. I was in my own little world. Just like I get when I am exploring on the computer. Most people call it the zone. What is quite odd is, I acutally liked working out to classical music. I felt more calm and that I was able to concentrate on the muscle I was working out. When I saw people listening to hard rock or rap, they were always frowned up and angry looking. I guess what ever gets you in the zone you are looking for. I am more of a layed back, observant type of person. You can definitely hear it in my voice.

Books to read.

iWoz (Woz is awesome. This book only makes you want to meet him)

Linus for fun (Linus is another person that i would love to meet)

Mind Performance Tweaks (Some cool brain excercises. I am all about challenging your self and finding ways to push yourself to the max)

Brain Hacks (More good info about the brain and how it works)

I promise i am going to give a list of all the good books i read with quick reviews.

Good sites

www.infosyssec.com
www.ethicalhacker.net
www.silicon.com
www.digg.com
www.slashdot.org


Ronnie Hash

Second Post

I've been thinking about what I am going to write all day. I know I said the next thing I might write about was books, but that will take to long tonight. I will write about the books I read or am reading when I have more time.

Something caught my eye today on www.silicon.com. It was an article talking about WEB 2.0 social network scene and a UK Union.
http://networks.silicon.com/webwatch/0,39024667,39168295,00.htm?r=3

Here is a simple policy in plain English I think companies should force.

1.Do not write about or disclose any information about the company.
2.Do not use company equipment or time for your personal use. (I think most companies have something like this already, but it wouldn't hurt to state again in this policy)
3.If you are an executive or a company representative, think twice, better yet, talk to the legal department before doing anything that can be read by the public.

Now it is up to regular employees to be responsible about how we want to be viewed. So, if you think you can post how you party all the time then complain about having chronic migraines and need to leave work, that might not fly once your site is found, or your friend's site who you have a link to. Kids should really think about this. When you get older and a company does a search on google and find's your youtube or Myspace post, you might not get the job or if you do, you might not be treated with the respect you think you should have.

Should companies be able to use sites to search for employees? Yes

I believe companies have the right to know who they are hiring. It's just like them pulling your criminal records.

Off subject a little, another thing that I like about open source is that if a company is hiring someone from the open source community, they can easily view the code that an individual wrote. This allows a company to somewhat verify the skills someone is stating they have.

Well it is getting late and I don't want to complain at work that I'm tired :)

Good night !!!

First Post

I am not sure how serious i am going to be about blogging. This blog is going to be more of a journal of the work that i do for fun (computer security research and exercising).

Current Projects that i am testing and hacking away with in my lab:

Trixbox (Open Source PBX solution)
GrandCentral www.grandcentral.com Beta Tester
Honeyd (Honey Pot)
Vyatta (Router)
Sugarcrm (CRM)
Google Hacking (creating interesting search queries) I have learned alot from Johnny Long's site and book. www.Johnny.ihackstuff.com and Google Hacking for Pen testers.
Parralax micro controller programming kit
Packet Analysis (testing several packet sniffers and analyzing data over my own network)
Programming (C, Java, ASM, perl, and shell scripting)
Linux ( I usually download diffrent distro's off distrowatch just to see what they have to offer)

My main system is a Macbook Pro. I have parallels vm installed with slackware on it.

I have another mini toshiba notebook with BT2 on it for pen testing.

I am done writing for tonight. Next time i think i will write about the tech books i have read.



Well, i guess it's time for me to hit the sack. Good night.