Nmap

Nmap is a tool for scaning and monitoring host. Nmap is stand for Network Mapper. Main utilities of Nmap is to audit for each host. This tool is developed from time to time. The usefulness of Nmap that favorite is OS Fingerprinting ( To verify what os of the destination host are running ) Nmap can mapping network to determine what hosts are available. This tool is popular in hackker world including administrator because it's very profitably and creditably for securities scanning

Example of nmap command

It's useful for sweep ping of your network
#nmap -sP 192.168.1.*

Ping over tcp connection
#nmap -PT[port_number] host
ex
#nmap -PT6000 192.168.1.1

TCP-Connect
#nmap -sT 192.168.1.1

TCP SYN
#nmap -sS 192.168.1.1

Source Port
#nmap -sS 192.168.1.1

FIN Scan
#nmap -sF 192.168.1.1

Reverse Ident Scans
#nmap -I -sS -p 80 192.168.1.1

XMAS Scan
#nmap -sX 192.168.1.1

How to NULL SCAN
#nmap -sN 192.168.1.1

How to RPC Scan
#nmap -sR 192.168.1.1

IP Protocol Scan
#nmap -sO 192.168.1.1

How to ACK Scan
#nmap -sA target_address

How to UDP Port Scan
#nmap -sU 192.168.1.1

Check OS (Operating System)
#nmap -o 192.168.1.1

How to do a Windows XP Repair Install

1. Place your Windows XP set up disk in your CD drive.
2. Turn off your computer and change your BOOT order to boot from CDs first.
3. Turn your computer back on.
4. Press any key on your keyboard when it asks you to.
5. Press enter when you see a blue screen, one of the options should say, "To setup Windows XP now, press ENTER.".
6. Press enter to start the windows set up.
7. Accept the Licence and Agreement and confirm that the setup is searching for current versions on XP.
8. Press "R" when the set up has found your current version of XP.
9. Notice that the Set up is deleting all your windows xp files and replacing them. (This will not cause loss of data)

Windows Command (Run)

access.cpl : Program Accessibility Options
hdwwiz.cpl : Program Add Hardware
appwiz.cpl : Add/Remove Programs
admintools : Administrative Tools control
wuaucpl.cpl : Setting Automatic Updates
fsquirt : Program Bluetooth Transfer Wizard
calc : Calculator
certmgr.msc : Program Certificate Manager
charmap : Program Character Map
chkdsk : Check Disk Utility
clipbrd : Clipboard Viewer
cmd : Command Prompt
dcomcnfg : Component Services
compmgmt.msc : Computer Management
timedate.cpl : date and time
devmgmt.msc : Device Manager
dxdiag : Direct X (Direct X Troubleshooter)
cleanmgr : Disk Cleanup Utility
dfrg.msc : Disk Defragment
diskmgmt.msc : Disk Management
diskpart : Disk Partition Manager
desk.cpl : Display Properties control desktop
control color : Display Properties
drwtsn32 : Dr. Watson
verifier : Driver Verifier Utility
eventvwr.msc : Event Viewer
sigverif : File Signature Verification Tool
folders : Folders Options control
control fonts : Fonts Folder
fonts : Fonts Folder
freecell : Game Free Cell
joy.cpl : Game Controllers
gpedit.msc : Group Policy
iexpress : Iexpress Wizard
ciadv.msc : Indexing Service
inetcpl.cpl : Internet Properties
control keyboard : Keyboard Properties
secpol.msc : Local Security Settings
lusrmgr.msc : Local Users and Groups
logoff : Log-off
main.cpl : Mouse Properties control mouse
ncpa.cpl : Network Connections control netconnections
netsetup.cpl : Network Setup Wizard
notepad : Notepad
osk : On Screen Keyboard
perfmon.msc : Performance Monitor
powercfg.cpl : Power Options Properties
eudcedit : Private Character Editor
intl.cpl : Regional Settings
regedit : Registry Editor
mstsc : Remote Desktop
ntmsmgr.msc : Removable Storage
ntmsoprq.msc : Removable Storage Operator Requests
rsop.msc : Policy
sticpl.cpl : Scanners and Cameras
schedtasks : Scheduled Tasks control
wscui.cpl : เรียกหน้าต่าง Security Center
services.msc : Services
fsmgmt.msc : Shared Folders
shutdown : Shuts Down
mmsys.cpl : Sounds and Audio
spider : Spider Solitare
sysedit : System Configuration Editor
msconfig : System Configuration Utility
sfc /scannow : System File Checker Utility
sfc /scanonce : System File Checker Utility
sysdm.cpl : System Properties
taskmgr : Task Manager
nusrmgr.cpl : User Account Management
utilman : Utility Manager
firewall.cpl : Windows Firewall
magnify : Windows Magnifier
wmimgmt.msc : Windows Management Infrastructure
syskey : Windows System Security Tool
wupdmgr : (Windows Update)
write : Wordpad

Reset Password Windows

1. Dowload from here
2. Unzip
3. Burn to CD
4. Boot from CD
5. Press enter
6. Select drive windows system, There are a lot of words like this (Candidate Windows partitions ...). Look at word 'BOOT' and select it.
7. [Windows/system32/config] press enter
8. Select 1 is Password reset press enter
9. Then select 1 Edit user data and passwords press enter
10. Now it's show you all user, you have to type 'Adminstrator'
11. Select 1 remove password
12. Finish, select ! for exit
13. Type y and press enter
14. You can try again if it somehow failed, or you selected ........ type n and press enter
15. Reboot and remove CD

Gnome (X-Window)

Installation

1. install package
#yum -y groupinstall gnome

2. create file xorg.conf
#cp /root/xorg.conf.new /etc/X11/xorg.conf
or
#vi /etc/X11/xorg.conf
and copy below and paste it in 'xorg.conf'

# Xorg configuration created by system-config-display

Section "ServerLayout"
Identifier "single head configuration"
Screen 0 "Screen0" 0 0
InputDevice "Mouse0" "CorePointer"
InputDevice "Keyboard0" "CoreKeyboard"
EndSection

Section "Files"
# RgbPath is the location of the RGB database. Note, this is the name of the
# file minus the extension (like ".txt" or ".db"). There is normally
# no need to change the default.

# Multiple FontPath entries are allowed (they are concatenated together)
# By default, Red Hat 6.0 and later now use a font server independent of
# the X server to render fonts.

RgbPath "/usr/X11R6/lib/X11/rgb"
FontPath "unix/:7100"
EndSection

Section "Module"
Load "dbe"
Load "extmod"
Load "fbdevhw"
Load "glx"
Load "record"
Load "freetype"
Load "type1"
Load "dri"
EndSection

Section "InputDevice"
# Specify which keyboard LEDs can be user-controlled (eg, with xset(1))
# Option "Xleds" "1 2 3"

# To disable the XKEYBOARD extension, uncomment XkbDisable.
# Option "XkbDisable"

# To customise the XKB settings to suit your keyboard, modify the
# lines below (which are the defaults). For example, for a non-U.S.
# keyboard, you will probably want to use:
# Option "XkbModel" "pc102"
# If you have a US Microsoft Natural keyboard, you can use:
# Option "XkbModel" "microsoft"
#
# Then to change the language, change the Layout setting.
# For example, a german layout can be obtained with:
# Option "XkbLayout" "de"
# or:
# Option "XkbLayout" "de"
# Option "XkbVariant" "nodeadkeys"
#
# If you'd like to switch the positions of your capslock and
# control keys, use:
# Option "XkbOptions" "ctrl:swapcaps"
# Or if you just want both to be control, use:
# Option "XkbOptions" "ctrl:nocaps"
#
Identifier "Keyboard0"
Driver "kbd"
Option "XkbModel" "pc105"
Option "XkbLayout" "us"
EndSection

Section "InputDevice"
Identifier "Mouse0"
Driver "mouse"
Option "Protocol" "IMPS/2"
Option "Device" "/dev/input/mice"
Option "ZAxisMapping" "4 5"
Option "Emulate3Buttons" "yes"
EndSection

Section "Monitor"
Identifier "Monitor0"
VendorName "Monitor Vendor"
ModelName "Samsung Samtron 56E/57E/56V"
DisplaySize 280 210
HorizSync 30.0 - 55.0
VertRefresh 50.0 - 120.0
Option "dpms"
EndSection

Section "Device"
Identifier "Videocard0"
Driver "vesa"
VendorName "Videocard vendor"
BoardName "VESA driver (generic)"
EndSection

Section "Screen"
Identifier "Screen0"
Device "Videocard0"
Monitor "Monitor0"
DefaultDepth 16
SubSection "Display"
Viewport 0 0
Depth 16
Modes "800x600" "640x480"
EndSubSection
EndSection

Section "DRI"
Group 0
Mode 0666
EndSection


3. reboot system
#reboot

4. use command startx
#startx

VOIP (Voice Over IP)

VoIP (Voice over Internet Protocol) is voice communication over internet network or other that over internet protocol. Voice signal will be separated and packaged. It will be sent over network that ordinary use to communicate substitute of traditional telephony communication.

Codec
G.711 (64 kbps)
G.726 (32 kbps)
G.729 (8 kbps)
G.723 (5.3 & 6.3 kbps)
GSMFR (13.2 kbps)

Port
TCP 1720
UDP 5060 – 5070
UDP 10000 – 20000
UDP 4569

VNC Server

Installation

1. check package
#rpm -q vnc-server

2. install package vnc-server
#yum -y install vnc-server

3. check box service vnc-server
#ntsysv

4. restart service http
#service httpd reload

5. open port vnc
#vncserver :9

6. reboot system
#reboot

7. Client PC go to program vnc type ip and port
ex
192.168.1.6:9

8. If cannot connect vnc, you need to config following below
- (if login root) vi /root/.vnc/xstartup
- (if login user) vi /home/username/.vnc/xstartup
remove # exec /etc/x11/xinit/xinitrc save and reboot Server

9. Every time of reboot, you have to open port following no. 5

10. After finish of remote, using 'vncserver -kill :9' to closing port for security concern.

MRTG (Multi Router Traffic Grapher)

Installation

MRTG (Multi Router Traffic Grapher) The Multi Router Traffic Grapher is a tool primarily used to monitor the traffic load on network links (typically by using SNMP). MRTG generates HTML pages containing PNG images which provide a LIVE visual representation of this traffic. MRTG typically produces daily, weekly, monthly, and yearly graphs. In addition to monitoring via SNMP, MRTG can also generate graphs based on the output of any application, allowing one to generate graphs of anything that needs monitoring (for example, CPU and memory usage, email volumes, web hits, etc).

1. Install package MRTG
#yum install mrtg

2. path folder mrtg
#/var/www/mrtg

3. add Allow from all
#vi /etc/httpd/conf.d/mrtg.conf

Alias /mrtg /var/www/mrtg

Order deny,allow
Deny from all
Allow from all
Allow from 127.0.0.1
#Allow from ::1
#Allow from .example.com


4. restart service http
#service httpd reload

5. sniff SNMP
#export LANG=en_US
#mkdir /var/www/mrtg/myhost
cfgmaker -global "options[_]:bits,growright" --global "workdir: /var/www/mrtg/myhost" public@myhost.domain > /etc/mrtg/mrtg-myhost.cfg

6. Run MRTG
#mrtg /etc/mrtg/mrtg-myhost.cfg

7. Create file index.html
#indexmaker --column=1 --output=/var/www/mrtg/myhost/index.html /etc/mrtg/mrtg-myhost.cfg

8. create command to run MRTG every 5 miniute
#vi /etc/cron.d/mrtg-myhost

0-59/5 * * * * root /usr/bin/mrtg/etc/mrtg/mrtg-myhost.cfg


9. restart crond
#service crond reload

10. show MRTG http://mywebserver/mrtg/myhost

ZABBIX (Monitoring, Network, CPU, Memory, Process)

Installation on Fedora Core 6

ZABBIX is software for monitoring of your applications, network and servers. ZABBIX supports both polling and trapping techniques to collect data from monitored hosts. A flexible notification mechanism allows easy and quickly configure different types of notifications for pre-defined events

1. update and intstall package
#yum clean all
#yum -y update yum
#yum -y update httpd
Iksemel library and header files
Required to enable Jabber messaging. Optional.
#yum -y install iksemel
#yum -y install jabberd
#yum -y install php php-mysql mysql-server gcc-gfortran gcc-c++ gcc net-snmp-devel mysql-devel php-bcmath php-gd gd zabbix-agent
#service httpd start
#service mysqld start
#service jabberd start

2. download package Zabbix
#cd /usr/src/
#wget http://nchc.dl.sourceforge.net/sourceforge/zabbix/zabbix-1.4.2.tar.gz

3. extractl zabbix
#tar xvfz zabbix*.gz
#cd zabbix-1.4.2

4. config mysql
#mysql -u root
mysql>SET PASSWORD FOR root@localhost=PASSWORD('new_password');
mysql>quit
#mysql -u root -p
Enter password:
mysql>create database zabbix;
mysql>quit


5. install Database
#cd create/schema
#cat mysql.sql mysql -u root -p zabbix
#cd ../data
#cat data.sql mysql -u root -p zabbix
#cat images_mysql.sql mysql -u root -p zabbix
#cd ..
#cd ..

6. install Zabbix
#./configure --enable-server --with-mysql --with-net-snmp –with-jabber –with-libcurl
#make install
#mkdir /etc/zabbix
#cp misc/conf/zabbix_server.conf /etc/zabbix/

7. config Zabbix
#vi /etc/zabbix/zabbix_server.conf

Server=1 --------------------------> add
StartSuckers=6 -----------------------> add
StartTrappers=5 ----------------------> disable #
ListenPort=10051 ---------------------> disable #
HousekeepingFrequency=1 -------------> disable #
UnavailablePeriod=20 ------------------> add
PidFile=/var/tmp/zabbix_server.pid
LogFile=/tmp/zabbix_server.log
FpingLocation=/usr/sbin/fping
AlertScriptsPath=/home/zabbix/bin/
DBName=zabbix
DBUser=root
DBPassword=1234567


8. Start server
#cd /usr/local/bin
#./zabbix_server or
#cat /tmp/zabbix_server.log

9. test port 10051
#telnet localhost 10051

10. config agentd
#vi /etc/zabbix/zabbix_agentd.conf

Server=127.0.0.1
Hostname=localhost
StartAgents=5
DebugLevel=3
PidFile=/var/tmp/zabbix_agentd.pid
LogFile=/tmp/zabbix_agentd.log
Timeout=3


11. config Database
#cd /var/www/html
#vi /usr/src/zabbix-1.4.2/frontends/php/include/db.inc.php

$DB_TYPE ="MYSQL";
$DB_SERVER ="localhost";
$DB_DATABASE ="zabbix";
$DB_USER ="root";
$DB_PASSWORD ="";

#cp -r /usr/src/zabbix-1.4.2/frontends/php/* ./
#ls

- Open browser type ip Zabbix server.
- Open status Zabbix Server to Activate, go to Menu Configuration --> Hosts press ZABBIX Server --> change ip from 127.0.0.1 to IP ZABBIX Server.
- Check status server go to Menu Configuration --> Hosts --> ZABBIX Server click ZABBIX Server, status show Available.
- Add server go to Menu Configuration --> Hosts and config
- Go to Server open service ZABBIX.
- We investigate on server log to make sure that its connect ( /var/log/zabbix/zabbix_agentd.log).
- Go to create graphs for server.
- Create graph finish then go to Screen menu for matching graph with server.



Server will monitoring

for linux
- yum install zabbix-agent
- vi /etc/zabbix/zabbix_agentd.conf

Server= ip ZABBIX server
Hostname= ip host

- /etc/init.d/zabbix-agent restart
- #ntsysv check zabbix-agent
- vi /var/log/zabbix/zabbix_agentd.log



for windows
download from http://www.suiviperf.com/zabbix/
- double click zabbix_agent-1.4.1_installer.exe
- Next
- I Agree
- Next
- Zabbix Server Name: Server Zabbix, Hostname: My PC
- Install
- Completed


Run Service go to
- start
- Control Panel
- Administrative Tools
- Services
- ZABBIX Agent start