dnssecaudit.py

Since I was on a roll with Copilot, I decided to automate DNSSEC auditing with the following Python script. Not the most creative tool name.

Modded script to keep Ubuntu packages and snaps updated.

Used Copilot to update my Ubuntu maintenance script. I did tweak it slightly though since I am running LTS and don't want all packages to be updated to the latest version.

#!/bin/bash

# Function to handle errors
function handle_error {
  echo "$1 Exiting."
  exit 1
}

# Function to update apt packages
function update_apt {
  echo "Updating apt package lists..."
  sudo apt update || handle_error "Error updating apt package lists."
 
  echo "Upgrading apt packages..."
  sudo apt upgrade -y || handle_error "Error upgrading apt packages."
 
  echo "Cleaning up apt packages..."
  sudo apt autoremove -y && sudo apt clean || handle_error "Error cleaning up apt packages."
}

# Function to update snap packages
function refresh_snaps {
  echo "Updating Snap packages..."
  sudo snap refresh
  if [[ $? -ne 0 ]]; then
    echo "Refresh failed. Attempting to kill running Snap processes..."
    sudo pkill -f snap
    sudo snap refresh || handle_error "Error updating Snap packages after killing processes."
  else
    echo "Snap packages updated successfully."
  fi
}

# Function to update Maldet database and run a scan
function run_maldet {
  echo "Updating Maldet database..."
  sudo maldet -u || handle_error "Error updating Maldet database."
 
  echo "Starting Maldet scan of /home (recent changes, quiet mode)..."
  sudo maldet -r -q /home || handle_error "Error running Maldet scan."
 
  SCAN_LOG=$(sudo maldet --report list | tail -n 1 | awk '{print $NF}')
  if [[ -n "$SCAN_LOG" ]]; then
    echo "Maldet scan log located at: $SCAN_LOG"
  else
    echo "Could not retrieve Maldet scan log location."
  fi
}

# Main script execution
update_apt
refresh_snaps
run_maldet

echo "All done!"

Autobots.py

Had an epiphany to try writing a working "Python" script using "Copilot". I call the following script "Autobots" to help audit the presence of "robots.txt".

"sslyze" on "Ubuntu"

 I have used "sslyze" primarily on "Windows" and I figured it was time to use it on "Ubuntu".

Wrote a "shell script" to run on "Ubuntu".

#!/bin/bash
## Get current date ##
_now=$(date +"%m_%d_%Y")
sudo python3 -m sslyze --update_trust_stores
sudo python3 -m sslyze --regular --targets_in=targets.txt > "sslyze_$_now.txt"
sudo cat "sslyze_$_now.txt"
#sslyze script to run on Ubuntu.
#Please edit "targets.txt" in current folder.
#Results will be stored in current folder.
#Written by commandrine.
#Last updated on 23 Nov 2020.

DNSSEC check

Was recently triggered to research how to verify if a domain has DNSSEC enabled.
The manual way would be to run a "dig" command to query the domain you want to check but the DNS server you query has to support DNSSEC.

Plan B was using an API provided by SIDN Labs. You can leverage their API by running a "curl" command as seen below. Any status other than "secure" is bad.

This method is tedious if you want to check multiple domains. Alternatively, you can populate a CSV file with the domains you want to check and upload them to SIDN Labs using this form. I replicated the form below.

DNSSEC check form

Upload the CSV containing the domains you want to test using SIDN Lab's API.

Nessus update for Ubuntu

Decided to incorporate Nessus update as part of my Ubuntu update script.

#!/bin/sh
#Update Ubuntu
sudo apt-get update
sudo apt-get upgrade
sudo apt-get autoremove
#Update Nessus
sudo /etc/init.d/nessusd stop
sudo /opt/nessus/sbin/nessuscli update --all
sudo /etc/init.d/nessusd start

Script to dump contents of "Robots.txt"

Recently picked up "Python" and decided to try my hand at a "n00b" script to dump the contents of "Robots.txt" file residing on a webserver.

# Ask for Protocol and store it in protocol
protocol = input('Enter HTTP or HTTPS: ')

# Ask for URL or IP and store it in domain
domain = input('Enter URL or IP: ')

robots = "/robots.txt"

from urllib.request import Request, urlopen
print('Checking "Robots.txt" for:')
print(domain)
print()
from urllib.error import URLError, HTTPError
req = Request(protocol+"://"+domain+robots)
try:
    response = urlopen(req)
except HTTPError as e:
    print('The server couldn\'t fulfill the request.')
    print('Error code: ', e.code)
except URLError as e:
    print('We failed to reach the server.')
    print('Reason: ', e.reason)
else:
    print('Contents of "Robots.txt" is as follows.')
    print()
with urlopen((protocol+"://"+domain+robots)) as stream:
    print(stream.read().decode("utf-8"))

#Written by commandrine.
#Last updated on 22 Jun 2017.

Windows Nessus batch job

Wrote a simple Nessus batch job to get the updates.

cd \
cd "Program Files"/Tenable/Nessus/
net stop "Tenable Nessus"
nessuscli update --all
net start "Tenable Nessus"

#Written by commandrine.
#Last updated on 15 Feb 2017.

nessusjob

Was lazy to memorise the Nessus commands to start/stop the service as well as update its plugins so I decided to dump them into the following script.

#!/bin/sh
echo "\033[0;34mPrepping Nessus for scanning.\033[0m"
sudo /etc/init.d/nessusd stop
echo "\033[0;31mUpdating Nessus plugins.\033[0m"
sudo /opt/nessus/sbin/nessus-update-plugins
echo "\033[0;31mStart Nessus service.\033[0m"
sudo /etc/init.d/nessusd start
echo "\033[0;31mAccess Nessus console on https://127.0.0.1:8834.\033[0m"

#"nessusjob" written by commandrine.
#Please send comments and queries to commandrine[at]gmail[dot]com.
#Version 1.0 dated 23rd September 2011.
#Pre-requisite is having "Nessus" installed, registered license key configured and the Nessus user created.
#Save this script to your home folder. Run "sudo chmod +x nessusjob.sh" to make it executable.

Download it here.

NeXpose vs Nessus

I've used Nessus for years. I only recently heard of NeXpose after Rapid7 started funding Metasploit and promised to integrate their scanner with Metasploit. I decided to give NeXpose a whirl. The learning curve wasn't steep when using the scanner.

Scanned the same target machine with Nessus.

The 2 scanners produce the same result but I always believe in the need to use multiple tools to assess vulnerabilities in infrastructures, networks, systems and applications to uncover the full state of insecurity.