ARP PoiSoning MenGgaGalkan DownLoadku…hix3.

Allo Broo..

Gw lagi rajin-rajinnya neh blogging…hehe.. Gw kesel bgt kemaren malem,coz da yg maen2 ARP poisoning yg ganggu jaringan bgt…hix3. Gw kena imbasnya,lagi asik2 download,eeeehh jadi keputus gara2 da yg spoofing punya gw,padahal tinggal dikit tuh downloadan gw..hix3. Mungkin da yg blom tau yak apa seh ARP..Gw cm mau sharing dikit aja,ne gw ambil dari wiki..hehehe..

ARP adalah singkatan dari Address Resolution Protocol yang dalam istilah komputer networking nya adalah sebuah metode untuk menemukan suatu host pada sebuah jaringan yang menterjemahkan sebuah logical address ( IP = internet Protocol )  kedalam sebuah Hardware Address atau lebih dikenal dengan MAC ( Media Access Control ) Address untuk mendukung  komunikasi di dalam sebuah jaringan. Jadi dengan adanya protocol tersebut setiap Hardware yang ada dalam sebuah jaringan (Ethernet Card) dapat berkomunikasi satu sama lain.

Nah,ntu  penjelasan singkat ttg ARP..Lha trus apa ARP poisoning??

ARP poisoning atau lebih keren disebut dengan ARP spoofing adalah sebuah teknik  penyerangan jaringan yang digunakan untuk mengacaukan jaringan atau sebuah routing didalam jaringan.  Nah,trus orang yang melakukan ARP  spoofing dapat mengintip data frame dalam sebuah jaringan, memanipulasi traffic, atau memberhentikan traffic atau routing. Biasanya seh orang yg nglakuin ARP Spoofing pingin tau tentang komputer kita,misalnya password VPN kita ato pesan2 yg kita kirim di jaringan…

Masih bingung neh gw ilustrasiin..hehehe

Nah, Gambar diatas ngejelasin gmn ARP Spoofer bekerja..Jadi gini,pertama-tama ada hubungan komunikasi antara Client POP dan POP server,Kemudian datang attacker yg melakukan Spoofing untuk menipu Client POP,cara yg dilakukan adalah dengan Teknik ARP Spoofing yg telah gw jelasin tadi,si Attacker membuat dirinya seolah-olah menjadi POP server yaitu dengan memanipulasi MAC addressnya menjadi sama dengan MAC address POP server.. Nah,kalo udah kyak gini si ClientPOP tidak akan menyadari bahwa sebenernya dia tidak berkomunikasi dengan POP server melainkan dengan Attacker yg menyamar menjadi POP server.. Gmn??bahaya bgt bukan??

Lalu gimana neh caranya mencegah atau usaha apa yang bisa dilakukan agar tidak terpengaruh ARP poisoning ini?

salah satu caranya adalah dengan men set arp static pada komputer
Kalo di windows loe ketikin di Command Promt kayak gini neh :

arp  -s  10.14.200.1  00-00-cd-25-fe-e0 –> mac sesuai IP nya

Kalo loe pake Linux,coabain di konsolemu kyak gini :

arp -s  10.14.200.1  00:00:cd:25:fe:e0

jika banyak host yang mau di set di linux bisa dengan cara membuat file list  ether dan IP :

/home/ethers

10.14.200.1  00-00-cd-25-fe-e0

10.14.200.67  00-1f-d0-52-a0-2f

10.14.200.30  00-1d-92-f5-02-51

kemudian loe jalanin perintah kyak gni :

arp -f /etc/ethers

Nah,gitu bro cara yg gw pakai buat nyegah ARP poisoning ke gw..Selama carantu ampuh seh masih gw pakai,tapi kalo cara yg laen gw blom tau bro..hehehe..:))

Mungkin ada beberapa tools pendukung buat tau da ARP poisoning or ga:
1. arpwatch
2. tcpdump
3.wireshark

Source : http://www.en.wikipedia.org/wiki/ARP_poisoning

MAC address Allowing in Squid FreeBSD 7

Allo Prenz…

gw mau sharing2 pengalaman gw neh..kali ini gw lagi demen ma yg namanya FreeBSD…q oprek2 lah tuh freeBSD..Nah,kale ini gw pingin nyoba share ilmu neh tentang konfigurasi acces list untuk Squid di FreeBSD 7…hehe.

Gw pingin nyoba buat access list berdasarkan MAC address komputer..jadi yg bisa ngenet nglewatin proxy gw,harus mendaftarkan MAC address mereka..hehehe..

Okeh..langsung saja..sebenernya cm di tambahin dikit aja di settingan squid.conf-nya..

1. Loe harus install dulu FreeBSDnya tentunya…hehehe.:))

2. Loe install Squidnya..caranya lewat ports aja..(FreeBSD it so sexy…:)))

#cd /usr/ports/www/squid/

#make install clean

Nah,loe jangan mpe lupa tu pilih yg SQUID_ARP_ACL soalnya ntu yg akan kita pakai ntar..okey..

3. Klo udah,silahkan loe edit file squid.conf yg ada di /usr/local/etc/squid/

#pico /usr/local/etc/squid/squid.conf

4. Kalo udah loe tambahin deh kek gini buat masing-masing MAC address yg bisa ngenet nglewatin proxy..Misalnya neh kyak gni :

acl lokal1 arp 00:0b:6a:7b:51:b7  #danphi
acl lokal2 arp 00:1D:72:20:87:b4  #Bayu
acl lokal3 arp 00:1a:4d:80:02:5d  #Udin
acl lokal4 arp 00:30:18:a7:6b:04  #sompil

http_access allow lokal1
never_direct allow lokal1
http_access allow lokal2
never_direct allow lokal2
http_access allow lokal3
never_direct allow lokal3
http_access allow lokal4
never_direct allow lokal4

5. Penjelasannya kek gini :

acl <nama_acl> arp MAC ADDRESS

http_access allow <nama_acl>

6. Kalo udah loe restart deh squid loe atau loe reboot aja server kamu…hehehe.

#/usr/local/etc/rc.d/squid restart

#squid -k reconfigure

#reboot

Nah sekarang loe cobain deh browsing menggunakan MAC addres yg telah di-add di acl pasti bisa jalan..sedangkan MAC address yg tidak ada di acl tidak akan bisa browsing…

Gampang bukan caranya…selamat mencoba…

SaVing YouR FreeBSD from BruteForce Attacks

Allow Bro…

Now, I will sharing my experience about FreeBSD…I talk about The BruteForce attack..

While this often once I get the bruteforce attacks to ssh and ftp service to almost all internet servers. I find the rather good tools to prevent this attack, it is called Bruteblock.

Bruteblock allows system administrators to block various bruteforce attacks on UNIX Service. The program analyzes the system work the system log and add the IP address of attacker ipfw2 to the table, so that effectively block them.

IP addresses are automatically removed from the table after a certain time period that has been set. Bruteblock use regular expressions to parse logs, which provide the flexibility to operate it can be used almost all the service network.

Okey,,I will explain the installation of BruteBlock. The installation it so easy..Check it out!!

1. I am using ports for installation of BruteBlock

#cd /usr/ports/security/bruteblock
#make install clean

2. Add the following lines in /etc/rc.conf so that bruteblock can directly boot while running

bruteblockd_enable=”YES”
bruteblockd_table=”1″
bruteblockd_flags=”-s 5″

3. Edit file /etc/syslog.conf

Change this line :

auth.info;authpriv.info                                /var/log/auth.log

to be

auth.info;authpriv.info                         |exec /usr/local/sbin/bruteblock -f /usr/local/etc/bruteblock/ssh.conf

4. Restart Syslogd

#/etc/rc.d/syslogd restart

5. Running the bruteblock application with this command :

#/usr/local/etc/rc.d/bruteblockd.sh start

6. Add in the ipfw settings for IP-IP memblock who enter in by bruteblock

#ipfw add 400 deny ip from me to table\(1\)
#ipfw add 410 deny ip from table\(1\) to me

7. To change the settings for each service that is protected, eg I will change the settings for ssh in /usr/local/etc/bruteblock/ssh.conf

regexp          = sshd.*Illegal user \S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
regexp1         = sshd.*Failed password for (?:illegal user )?\S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

# Number of failed login attempts within time before we block
max_count       = 4

# Time in seconds in which all failed login attempts must occur
within_time     = 60

# Time in seconds to block ip in firewall

# 10 minutes
reset_ip       = 600

# IPFW table number to add “bad” hosts
ipfw2_table_no = 1

we can only apply for another service, eg ftp. we only need to change in the regexp. adjusted to the format of the log servicenya.

Okey…the installation is complete..You can try in your machine..

Source : http://samm.kiev.ua/bruteblock/

WeBmiN InsTallaTion on FreeBSD 7

Allo guys..

Now I try to sharing with my experience about FreeBS server..Now I talking about Webmin..

Webmin is a Web-based administration interface for the system (System Administration) in Unix, including FreeBSD. Using a browser that supports tables and forms, we can set up user accounts, Apache, firewall, and so forth. Webmin consists of a simple web server and some CGI programs which directly update system files like /etc/inetd.conf.

Webmin requires PERL, so PERL then make sure that already installed on your machine..

I am using ports for install of Webmin on FreeBSD..Try this script :

#cd /usr/ports/sysutils/webmin/

#make install clean

Okee..please wait your installation and if you have finished, you can config the Webmin configuration like this :

Once installed the Webmin configuration now …. make sure that webmin is running at the time of booting. So edit file /etc/rc.conf and adding this script :

webmin_enable=”YES”

Save and close this file..Then we run the /usr/local/lib/webmin/setup.sh to setup the next configuration, type:

#/usr/local/lib/webmin/setup.sh

So Will appear :

***********************************************************************
*            Welcome to the Webmin setup script, version 1.420        *
***********************************************************************
Webmin is a web-based interface that allows Unix-like operating
systems and common Unix services to be easily administered.

Installing Webmin in /usr/local/lib/webmin ...

***********************************************************************
Webmin uses separate directories for configuration files and log files.
Unless you want to run multiple versions of Webmin at the same time
you can just accept the defaults.

Log file directory [/var/log/webmin]: [ Push Enter]

***********************************************************************
Webmin is written entirely in Perl. Please enter the full path to the
Perl 5 interpreter on your system.

Full path to perl (default /usr/bin/perl):  [Push Enter]

Testing Perl ...
Perl seems to be installed ok

***********************************************************************
Operating system name:    FreeBSD
Operating system version: 7.0

***********************************************************************
Webmin uses its own password protected web server to provide access
to the administration programs. The setup script needs to know :
 - What port to run the web server on. There must not be another
   web server already using this port.
 - The login name required to access the web server.
 - The password required to access the web server.
 - If the webserver should use SSL (if your system supports it).
 - Whether to start webmin at boot time.

Web server port (default 10000):  [push enter]
Login name (default admin):  [push enter]
Login password: [set your Password]
Password again:
Use SSL (y/n): y
***********************************************************************
Creating web server config files..
..done

Creating access control file..
..done

Creating start and stop scripts..
..done

Copying config files..
..done

Changing ownership and permissions ..
..done

Running postinstall scripts ..
..done

Okey..If your Installation is done,you can reboot your machine and you can check this installation through the web browser with set this url :

https://domain.com:10000/

or

https://your_ip_server:10000/

do not forget to remember to use https rather than http because webmin using SSL

during the first run webmin from a browser, you will receive a certificate message, accept and execute aja webmin.

Okey..You have finished the installation and it’s so simple allraight??!!

InStaLL BackTrack4 Beta in HarDisk..

Allo preenzz…

Waktu browsing-browsing di internet,gw tanpa sengaja membaca artikel tentang backtrack yg baru rilis yaitu Backtrack4.. Setelah aq baca2 ternyata Backtrack4 ini masih Beta belum Final.. Karena penasaran dengan distro ini akhirnya q mencoba install ke Hardisk gw n mulai ngulak-ngulik.. Setelah beberapa ngutak-atik,q merasa da yg aneh ma Backtrack4 ini,dan ternyata benar,yaitu BackTrack4 dah tidak lagi menjadi turunan dari Slax(Slackware) akan tetapi Mrupakan turunan dari Debian.. wah makin penasaran aja aq ma Backtrack4 ini…

Bagi yg penasaran ma BackTrack4  bisa langsung install n ngulik2..hehehe.. gw mau coba sharing neh gmn instalasi BackTrack4 ke hardisk,cz beda bgt ma linux kek biasanya yg telah terinstall di hardisk gw..

1. Berdoa dolo tentunya..hehehe..:))

2. Buat partisi buat BackTrack4

3. Kalo udah silahkan loe Booting CD Backtrack4Beta ke komputer dan login username/password:root/toor

4. Klo udah coba ketik “cfdisk” dan loe lihat apakah ada partisi linux,kalo belum silahkan dibuat. Misalkan kita buat partisi Linux di /dev/hda2 seperti yg ada di komputerku buat tempat Backtracknya.

5. Kalo udah ikutin perintah dibawah ini :

• root@bt:~# mkreiserfs /dev/sda3
• root@bt:~# mkdir /mnt/backtrack4
• root@bt:~# mount /dev/sda3 /mnt/backtrack4/
• root@bt:~# cp –preserve -R /{bin,dev,home,pentest,root,usr,boot,etc,lib,opt, sbin,var} /mnt/backtrack4/
• root@bt:~# mkdir /mnt/backtrack4/{mnt,tmp,proc,sys}
• root@bt:~# chmod 1777 /mnt/backtrack4/tmp/
• root@bt:~# mount -t proc proc /mnt/backtrack4/proc
• root@bt:~# mount -o bind /dev /mnt/backtrack4/dev/
• root@bt:~# chroot /mnt/bt/ /bin/bash

6. Nah,Kalo udah sekarang loe seting lilonya biar bisa booting, seperti ini neh punya gw :

root@bt:~#nano /etc/lilo.conf

boot=/dev/hda
root=/dev/hda2

# bitmap=/boot/sarge.bmp
# bmp-colors=1,,0,2,,0
# bmp-table=120p,173p,1,15,17
# bmp-timer=254p,432p,1,0,0
# install=bmp

# delay=20

prompt
timeout=50

# map=/boot/map

vga=0×317

image=/boot/vmlinuz
label=”BackTrack4″
read-only
initrd=/boot/splash.initrd
append=quiet

#WINDOWS BOOT
other = /dev/sda1
label = Windows
table = /dev/sda

7. Apply Lilo dengan mengetikkan : lilo -v

Kalo udah loe simpen trus loe reboot deh komputer loe..dan rasakan WiFU Backtrack4…

Nah,skarang gw tunjukkin Snapshotnya BackTrack4 di Komputer gw…Keren gak WiFU-nya?? )

Source : http://wilsonsihombing.6te.net

Perang Desktop…

Alloo prenz..

Kemaren malem ketika aq lagi enak-enak ngerjain tugas,tiba ada temen gw yg asik ngutak-atik desktop linux nya…trus ada temenku lagi yg ngutak-atik jga,sampe akhirnya ada 3 anak yaitu mail,sompil,dan bayu yg pada nguta-atik desktop komputer mereka..

Tiba-tiba ada yg nyeletuk “gmn klo kita ngadain perang desktop..”

pada  bengong setelah denger ntu..gw jg yg denger ntu merasa tertantang..dan akhirnya kita berempat melakukan perang bintang,yaitu saling mempercantik desktop masing-masing n secara kebetulan kita semua emang penggemar Linux..soalnya kalo wind*** mana bisa di utak-atik sesuai kemauan…hihihihi..

Nah,perang desktop td malem dilakukan pengoprekan desktop mpe jam 9 malam,trus hasil dari desktopnya akan di upload ke fesbuk n masing-masing anak di tag ke dalam poto tersebut…hihii..aneh2 aja…tp karena gw tertantang oleh mereka2 neh..hehehe..

Dari kita berempat,cm mail yg bermasalah ma komputernya,coz komputernya kagak bisa 3D,secara dia masih pake VGA VIA Unichrome jaman kapan gitu…wakakaka..kasian bgt loe il…hehehe…

Oiya dari pada cm ngomoong doank,neh gw uploadin desktop2 gw..minta komentarnya yak kalo bisa bagus or nggak nya…hihihihii….

yo dipilih2 mau desktop yg gimana??

LAMP InstallatioN in My JaunTy

Hello My Prenz…

I will share my experience about LAMP server.. I am using LAMP to do my duty, altough I haven’t to install LAMP server. Therefore, I am searching in google and I am found the answer..xixixixi..:))

LAMP is software bundle which usually use for web server.  LAMP consist of :

• Linux, referring to the Operating System
• Apache, web Server
• MySql, Database Management System or Database Server
• and PHP, is a Scripting Language

Now, check it out this my installation in my Jaunty..it’s so Easy man…xixixi

1. You must Pray..

2. First make sure that ubuntu has been installed correctly and properly

3. Install Apache http server : sudo apt-get install apache2

4. Install PHP for Apache server : sudo apt-get install php5

5. Install Mysql Server Database : sudo apt-get install mysql-server

6. Install mysql for apache server :

sudo apt-get install libapache2-mod-auth-mysql

sudo apt-get install php5-mysql

sudo apt-get install phpmyadmin

Now, after the installation is finished, we will check this, whether already installed correctly or not. Checking is as follows :

1. Restart your apache server : sudo /etc/init.d/apache2 restart

2. Check the apache service via the browser, type the following address : http://localhost

3. Check PHP whether the services are integrated correctly or not. How is making any php file in the folder /var/www /. Listing Program is:

<?php
phpinfo();
?>

After the save, please be opened in the browser. If the browser already displayed the data about PHP,so PHP is running the service.

4. Check Mysql whether the services are integrated with PHP or not. I make any php files in /var/www/. Listing Program is:

<?php
$connect=mysql_connect(”localhost”,”root”,”yourpassword”);
if($connect){
echo “yeeaahhh..berhasil…”;
}else{
echo “aseeemiik..kok gagal…”;
}
?>

After the save, then open the browser. If successful then any posts appear PHP and Mysql are integrated correctly. If any posts appear to fail, then the PHP and Mysql has not been properly integrated.

5.Check phpmyadmin (optional) whether or not already running. Go to the following address in the browser:

http://localhost/phpmyadmin

Enter root for the user, while the password does not need to fill in, because the default password Mysql installation has not been set, so do not need a password. If successful the log,phpmyadmin already installed correctly.

Okey, way before it installs a LAMP-based web server. How the above is just the standard way, meaning that configuration is done only as needed, so there is no password set mysql, domain settings, etc.. So just for basic course, to further learn more please yourself…

Okey,thanks guys… I wish this tutorial can help you..

source : http://www.howtoforge.com