Knoppix-STD

[Elena_FranciX]

Knoppix-STD es una distribución que hereda directamente de Knoppix LiveCD su fiabilidad y estabilidad, pero dotándole de toda la panoplia de aplicaciones y herramientas orientadas a la seguridad y administración de redes, desde las herramientas de autentificación hasta utilidades de encriptación, pasando por tests de vulnerabilidad ante los hackers

Basado en el kernel 2.4.20 y KDE 3.1, Knoppix-STD detecta casi cualquier tipo de material e incorpora una variedad impresionante de programas, repartidos entre varias categorías como la autentificación, descifrado de contraseñas, utilidades de encriptación como GPG, OpenSSL, Stunnel, cortafuegos, evaluación de vulnerabilidad montando unas especies de servidores trampa que alientan a los hackers (Honeypots), test de penetración de sistemas y detección de intrusos, múltiples sniffers y herramientas de redes wireless, así como varios servidores y herramientas de administración de redes, etc.

Un listado completo está disponible desde la página web del autor, dando luz así a una distro GNU/Linux formada por nada más ni menos que unas 200 aplicaciones de administración y monitorización de redes, así como sniffers de paquetes, tests de vulnerabilidad y utilidad de análisis de debilidades de seguridad... eso es tanto como decir que se puede obtener todo un arsenal de seguridad, con tan sólo descargar y lanzar una distro GNU/Linux desde un LiveCD concentrado: Knoppix STD.

• Para utilizar Knoppix STD necesitas:

    * Sistema operativo: Consola

  Descargar Knoppix STD


http://s-t-d.org/download.html

[/b]

Knoppix-STD. Knoppix-STD es básicamente, un Knoppix, pero orientado completamente a seguridad informática y manejo de redes.

A la instalación base, los muchachos de Knoppix-STD le agregaron varias aplicaciones, como ser, crackers para passwords, herramientas de encriptación (gpg, openssl, stunnel,etc), herramientas para montar firewalls (shorewall) , herramientas para armar Honeypots, (como ser Honeyd y Labrea), herramientas para detección de intrusos (snort, aide, etc), herramientas generales de red (LinNeighboorhood, etherape, iptraf, ntop, etc) , varios sniffers (varios productos y varios tipos) , herramientas para realizar test de penetración a sistema y varias herramientas
para redes wireless. (para ver el listado completo, miren

http://www.knoppix-std.org/tools.html

Por lo tanto, arrancando con este Cd, tenemos un linux completamente usable, y con mas de 200 tools para administrar redes, analizarlas, monitorearlas, etc.

Ideal para auditores de seguridad, etc.

Tools are grouped as follows:
authentication
/usr/bin/auth/

    * freeradius 0.9.3 : GPL RADIUS server

encryption
/usr/bin/crypto/

    * 2c2 : multiple plaintext -> one ciphertext
    * 4c : as with 2c2 (think plausible deniability)
    * acfe : traditional cryptanalysis (like Vigenere)
    * cryptcat : netcat + encryption
    * gifshuffle : stego tool for gif images
    * gpg 1.2.3 : GNU Privacy Guard
    * ike-scan : VPN fingerprinting
    * mp3stego : stego tool for mp3
    * openssl 0.9.7c
    * outguess : stego tool
    * stegbreak : brute-force stego'ed JPG
    * stegdetect : discover stego'ed JPG
    * sslwrap : SSL wrapper
    * stunnel : SSL wrapper
    * super-freeSWAN 1.99.8 : kernel IPSEC support
    * texto : make gpg ascii-armour look like weird English
    * xor-analyze : another "intro to crytanalysis" tool

forensics
/usr/bin/forensics/

    * sleuthkit 1.66 : extensions to The Coroner's Toolkit forensic toolbox.
    * autopsy 1.75 : Web front-end to TASK. Evidence Locker defaults to /mnt/evidence
    * biew : binary viewer
    * bsed : binary stream editor
    * consh : logged shell (from F.I.R.E.)
    * coreography : analyze core files
    * dcfldd : US DoD Computer Forensics Lab version of dd
    * fenris : code debugging, tracing, decompiling, reverse engineering tool
    * fatback : Undelete FAT files
    * foremost : recover specific file types from disk images (like all JPG files)
    * ftimes : system baseline tool (be proactive)
    * galleta : recover Internet Explorer cookies
    * hashdig : dig through hash databases
    * hdb : java decompiler
    * mac-robber : TCT's graverobber written in C
    * md5deep : run md5 against multiple files/directories
    * memfetch : force a memory dump
    * pasco : browse IE index.dat
    * photorec : grab files from digital cameras
    * readdbx : convert Outlook Express .dbx files to mbox format
    * readoe : convert entire Outlook Express .directory to mbox format
    * rifiuti : browse Windows Recycle Bin INFO2 files
    * secure_delete : securely delete files, swap, memory....
    * testdisk : test and recover lost partitions
    * wipe : wipe a partition securely. good for prep'ing a partition for dd
    * and other typical system tools used for forensics (dd, lsof, strings, grep, etc.)

firewall
/usr/bin/fw/

    * blockall : script to block all inbound TCP (excepting localhost)
    * flushall : flush all firewall rules
    * firestarter : quick way to a firewall
    * firewalk : map a firewall's rulebase
    * floppyfw : turn a floppy into a firewall
    * fwlogwatch : monitor firewall logs
    * iptables 1.2.8
    * gtk-iptables : GUI front-end
    * shorewall 1.4.8-RC1 : iptables based package

honeypots
/usr/bin/honeypot/

    * honeyd 0.7
    * labrea : tarpit (slow to a crawl) worms and port scanners
    * thp : tiny honeypot

ids
/usr/bin/ids/

    * snort 2.1.0: everyone's favorite networks IDS
    * ACID : snort web frontend
    * barnyard : fast snort log processor
    * oinkmaster : keep your snort rules up to date
    * hogwash : access control based on snort sigs
    * bro : network IDS
    * prelude : network and host IDS
    * WIDZ : wireless IDS, ap and probe monitor
    * aide : host baseline tool, tripwire-esque
    * logsnorter : log monitor
    * swatch : monitor any file, oh like say syslog
    * sha1sum
    * md5sum
    * syslogd

network utilities
/usr/bin/net-utils/

    * LinNeighboorhood : browse SMB networks like windows network neighborhood
    * argus : network auditor
    * arpwatch : keep track of the MACs on your wire
    * cdpr : cisco discovery protocol reporter
    * cheops : snmp, network discovery and monitor tool
    * etherape : network monitor and visualization tool
    * iperf : measure IP performance
    * ipsc : IP subnet calculator
    * iptraf : network monitor
    * mrtg : multi router traffic grapher
    * mtr : traceroute tool
    * ntop 2.1.0 : network top, protocol analyzer
    * rrdtool : round robin database
    * samba : opensource SMB support
    * tcptrack : track existing connections

password tools
/usr/bin/pwd-tools/

    * john 1.6.34 : John the Ripper password cracker
    * allwords2 : CERIAS's 27MB English dictionary
    * chntpw : reset passwords on a Windows box (including Administrator)
    * cisilia : distributed password cracker
    * cmospwd : find local CMOS password
    * djohn : distributed John the Ripper
    * pwl9x : crack Win9x password files
    * rcrack : rainbow crack

servers
/usr/bin/servers

    * apache
    * ircd-hybrid
    * samba
    * smail
    * sshd
    * vnc
    * net-snmp
    * tftpd
    * xinetd

packet sniffers
/usr/bin/sniff/

    * aimSniff : sniff AIM traffic
    * driftnet : sniffs for images
    * dsniff : sniffs for cleartext passwords (thanks Dug)
    * ethereal 0.10.0 : the standard. includes tethereal
    * ettercap 0.6.b : sniff on a switched network and more.
    * filesnarf : grab files out of NFS traffic
    * mailsnarf : sniff smtp/pop traffic
    * msgsnarf : sniff aol-im, msn, yahoo-im, irc, icq traffic
    * ngrep : network grep, a sniffer with grep filter capabilities
    * tcpdump : the core of it all
    * urlsnarf : log all urls visited on the wire
    * webspy : mirror all urls visited by a host in your local browser

tcp tools
/usr/bin/tcp-tools/

    * arpfetch : fetch MAC
    * arping : ping by MAC
    * arpspoof : spoof arp
    * arpwatch : montior MAC addresses on the wire
    * despoof : detect spoofed packets via TTL measurement
    * excalibur : packet generator
    * file2c@ble : replay a packet capture
    * fragroute : packet fragmentation tool (thanks again Dug)
    * gspoof : packet generator
    * hopfake : spoof hopcount replies
    * hunt : tcp hijacker
    * ipmagic : packet generator
    * lcrzoex : suite of tcp tools
    * macof : flood a switch with MACs
    * packetto : Dan Kaminsky's suite of tools (includes 1.10 and 2.0pre3)
    * netsed : insert and replace strings in live traffic
    * packETH : packet generator
    * tcpkill : die tcp, die!
    * tcpreplay : replay packet captures

tunnels
/usr/bin/tunnels/

    * cryptcat : encrypted netcat
    * httptunnel : tunnel data over http
    * icmpshell : tunnel data over icmp
    * netcat : the incomparable tcp swiss army knife
    * shadyshell : tunnel data over udp
    * stegtunnel : hide data in TCP/IP headers
    * tcpstatflow : detect data tunnels
    * tiny shell : small encrypted shell

vulnerability assessment
/usr/bin/vuln-test/
Way too many to list them all. There's much from THC, ADM, RFP, NMRC, TESO, Phenoelit. Be very careful with these tools. Remember, no guarantees are offered and you are entirely responsible for your own actions.

    * ADM tools : like ADM-smb and ADMkillDNS
    * amap 4.5 : maps applications running on remote hosts
    * IRPAS : Internet Routing Protocol Attack Suite
    * chkrootkit 0.43 : look for rootkits
    * clamAV : virus scanner. update your signatures live with freshclam
    * curl : commandline utility for transferring anything with a URL
    * exodus : web application auditor
    * ffp : fuzzy fingerprinter for encrypted connections
    * firewalk : map a firewall rulebase
    * hydra : brute force tool
    * nbtscan : scan SMB networks
    * ncpquery : scan NetWare servers
    * nessus 2.0.9 : vulnerability scanner. update your plugins live with nessus-update-plugins
    * nikto : CGI scanner
    * nmap 3.48 : the standard in host/port enumeration
    * p0f : passive OS fingerprinter
    * proxychains: chain together multiple proxy servers
    * rpcinfo : hmmmm.... info from RPC?
    * screamingCobra : CGI scanner
    * siege : http testing and benchmarking utility
    * sil : tiny banner grabber
    * snot : replay snort rules back onto the wire. test your ids/incidence response/etc.
    * syslog_deluxe : spoof syslog messages
    * thcrut : THC's "r you there?" network mapper
    * vmap : maps application versions
    * warscan : exploit automation tool
    * xprobe2 : uses ICMP for fingerprinting
    * yaph : yet another proxy hunter
    * zz : zombie zapper kills DDoS zombies

wireless tools
/usr/bin/wireless/

    * airsnarf : rogue AP setup utility
    * airsnort : sniff, find, crack 802.11b
    * airtraf : 802.11b network performance analyzer
    * gpsdrive : use GPS and maps
    * kismet 3.0.1 : for 802.11 what else do you need?
    * kismet-log-viewer : manage your kismet logs
    * macchanger : change your MAC address
    * wellenreiter : 802.11b discovery and auditing
    * patched orinoco drivers : automatic (no scripts necessary)

[Elena_FranciX]

Instalar Knoppix STD en el Disco Duro del PC (por traducir)

Upgrading S-T-D via apt etc after install is not longer a trivial task. Do not ask for advice on how to do this as it is too complicated to explain.



ONLY APT-GET UPDATE IF YOU KNOW WHAT YOU ARE DOING!!!

========================================


Some notes I made during my own setup. Hope they help.
============================================================ ===================
S-T-D Version: 0.1
Live or HD: Hard Disk Install
Notes: S-T-D is not a Hard Disk distro it is meant to be live. If you
want to have a hard disk version you do so at your own risk.
You should expect things that do work on the live CD not to
work on the Hard Disk intall (until you fix them).Try this at
your own risk.
============================================================ ===================

Hard Disk Install
=====================================
Get the S-T-D iso and burn to CD. Make 100% sure it is perfect by checking MD5sums etc as any glitch will cause problems.

I am using the new knoppix-installer rather than the old knx-installer. The reason.... well the old one isnt supported anymore so we might as well start using and finding S-T-D specific bugs with the new one.

Note: I already have the partiotioning sorted so this is not listed.
boot S-T-D live from the CD.
open a root console (alt-f5)
type knoppix-installer choose option 1 Configure Installation
Select the partition you want to install knoppix to.
next
Select the type of install (I go for Debian)
Enter your whole name including surname
next Enter(edit) your preffered username
next enter your user password twice
next enter your root password twice
next choose and enter a new hostname for you box (default is box)
next choose where to install lilo to (default MBR)
next

Now you are back to the main menu.
Choose option 2 Start Installation
OK
read and make sure that the summary of installations settings are correct
Next
Wait .....make some coffee...
When it is finished shut down S-T-D and remove CD.

=====================================
How to boot a Hard Disk Install

Turn on the computer up again and
You should see a LILO menu
Choose Linux
You should see a S-T-D prompt, this is where you enter any Cheat Codes
Wait until you see a login prompt
Note: S-T-D uses fluxbox whereas Knoppix uses KDE. This means that when you boot
you will no longer get the GUI login (KDM) but only the text login. Once you
have this login as your user.
Login using your username (not root as this should be kept for specififc
things)
To start flux type startx

=====================================
Fix Sudoers

So that all the fluxbox menu items and console programs work correctly
you have to give your new user sudo priveledges.

open console
type su
enter root password
vi /etc/sudoers
add line below current root line identical but with a different username
(i.e. username ALL=(ALL) ALL
as the file is read only save file using :wq!
=====================================
Fix Fluxbox to look correct

Open a root console (Alt-F5)
type cd ~
cd .fluxbox/
cp * /home/yourusername/.fluxbox/
choose yes to overwrite init, keys, menu
Edit init by vi ~/.fluxbox/init
and change the changesession.menuFile entry to
changesession.menuFile to ~/.fluxbox/menu
exit the shell
If necessary open the root File manager and change the permissions of your
home directory files and folders to be your user and not root. Restart fluxbox
from the menu
=====================================
Changing your home partition

(There can also do this will editing the installer .konfig before you do a
Hard Disk install but incase you did not remember)
Login into S-T-D as root
Mount your new HOME partition
Note : hdax should be replaced with the partiotion you choose as you new home

mount /dev/hdax /mnt/hdax
Move to the root of your current home directory
cd /home
Note not cd~ as this would miss any other users you may have

Copy your current home over to the new partition preserving permissions
cp -Rp * /mnt/hdax
Check the files are there by
cd /mnt/hdax
ls -al
Edit S-T-D to boot this partition as home on next reboot
vi /etc/fstab
Change or add an entry for hdax e.g.
/dev/hdax /home ext3 auto,rw,users,exec 0 0

Note: You may need to change ext3 to the type of partition you have
(although S-T-D probably entered most of this entry for you)

Remove the old home directory BE VERY CAREFUL WITH THIS!!!

rm -rf /home/

make a new empty home directory
cd /
mkdir home

Reboot (type reboot)

Note: Dont move the root home "cd /root" as well

Update your APT
=====================================
Open a root console (ALT-F5)
type
apt-get update
=====================================



 Knoppix STD 0.1b
http://www.knoppix-std.org/

STD (Security Tools Distribution) es una versión personalizada de
Knoppix, una distribución de Linux pensada para ser ejecutada
directamente desde el CD-ROM ("Live CD"). Utiliza el núcleo 2.4.20 y KDE 3.1, da soporte a una gran cantidad de dispositivos de hardware (que son detectados y configurados automáticamente).

Cuando se arranca la máquina con Knoppix STD, no se realiza ningún tipo de modificación en la configuración del ordenador.

Knoppix STD incluye un gran número de herramientas de interés para la seguridad, todas ellas preparadas para ser ejecutadas directamente desde el CD.

Las herramientas se dividen en varias categorías:

autenticación, identificación de contraseñas, cifrado; herramientas
para el análisis forense, cortafuegos, honeypots, sistemas de
detección de intrusiones; herramientas para la gestión de redes; un
gran número de herramientas para la realización de pruebas de
penetración, sniffers; herramientas para la realización de
valoraciones de seguridad y herramientas para la realización de
pruebas de redes sin fines.

El Driver NTFS-3G que permite leer y escribir en particiones NTFS ya es estable

Parece ser que NTFS-3G (http://www.ntfs-3g.org) anunció que este driver de código abierto para GNU/Linux que permite la lectura y escritura transparente de particiones NTFS (de Windows 2000, 2003, XP y Vista) acaba de alcanzar su versión 1.0, es decir, ya puede considerarse como un software estable.

En la instalación se menciona que se debe tener instaldo FUSE. Cómo yo soy un novato en Linux y no entiendo bien que es FUSE, dejo aquí el anuncio para que alguien experto nos indique ahora como instalar esta última versión del driver con seguridad.

 NTFS-3G: nuevo driver de lectura y escritura de particiones NTFS

El proyecto Linux-NTFS acaba de llegar a un hito con el anuncio de ntfs-3g, un nuevo driver de código abierto de lectura y escritura de particiones NFTS (de Windows 2000, XP, etc.), que aún en sus primeras pruebas no optimizadas ya muestra ser por lo menos 2 veces más rápido que ext3 y entre 20 y 50 veces que la alternativa comercial Parangon NTFS (hasta U$S 149.95).
Irónicamente, la otra alternativa abierta, Captive NTFS (que usa los mismos drivers de Windows XP) falló las mismas pruebas en las que triunfó ntfs-3g, con pérdida de datos.
Esta tercera generación del driver NTFS ha sido probado a fondo para que el soporte de escritura sea estable al máximo. Una particularidad del driver es que solo funciona en arquitecturas de 32 bits y little endian.

    * Download: ntfs-3g Beta (Fuentes).
http://mlf.linux.rulez.org/mlf/ezaz/ntfs-3g-20070714-BETA.tgz