nothink.org
| Here you can find some informations about "malwares IRC/DNS network activity". You can download a "TOTAL CSV FILE" (md5, file size, anubis results, dns query, irc server, irc server asn, irc server asn_org, irc server geo, irc nickname, irc username, irc password, irc channel, irc topic) : hash.csv. |
| Here you can find some malwares collected by my ADSL homed honeypots (Amun/Nepenthes) and comparison between several free Antivirus scanners.\n Write me if you want a copy of binaries. Some sandbox for malware analysis : CWSandbox, Norman, Anubis, ThereatExpert, Joebox. |
| Here you can find some statistics about "remote file inclusion attacks", collected parsing web log files. |
Writings
Hardening OpenBSD: situazioni reali - Lab, Smau 05 in Milano on 22 October 2005;
Systrace: sicurezza alla base, a basic introduction to Systrace;
Metasploit modules
awstats_configdir_exec, AWStats configdir Remote Command Execution;
frontpage, display version information about FPSE;
frontpage_login, queries the FrontPage Server Extensions and determines whether anonymous access is allowed;
phpnuke_search_module, PHPNuke Search Module SQL Injection Vulnerability;
sphpblog_file_upload, Simple PHP Blog remote command execution;
snmp_enum, enumerate information from SNMP enabled devices; Net::SNMP perl module is required;
tikiwiki_information_disclosure, Tikiwiki information disclosure;
tikiwiki_remote_exec, Tikiwiki remote command execution;
file_disclosure, Webmin file disclosure;
Perl scripts
googlegath, simple Google-Search to gathering site/domain informations;
gpsdriveToGoogleEarth, extract data from gpsdrive db and build a "kml" file for Google Earth (example, example);
nmapdb, script to insert nmap results into a MySQL database (create_nmapdb);
snmpcheck, useful to get information via SNMP protocols for Windows, Linux, Cisco and other platforms...
Perl modules
Mail::Maps::Lookup, query the MAPS lookup service via DNS;
Mail::OpenRelay::Simple, check if a mail server runs as an open relay;
Net::DNS::Version, grab DNS server version;
Net::IP::Extract, extract Ip Address from a document;
Net::Netcraft::Query, query the Netcraft webserver search;
Net::Netstat::Wrapper, Perl module for getting the current tcp open ports;
Net::Scan::Fork, a simple way to manage fork processess;
Net::Scan::Ftp::Anonymous, scan for anonymous read/write access FTP servers;
Net::Scan::HTTP::Server::Directory, scan for directory on a web server;
Net::Scan::HTTP::Server::Methods, retrieve allowed http methods;
Net::Scan::HTTP::Server::Version, grab HTTP server version;
Net::Scan::SMTP::Banner, scan for banner message from a SMTP server;
Net::Scan::SNMP, scan devices to verify SNMP community;
Net::Scan::SSH::Server::Version, grab SSH server version;
Wireless
WL-172, Sitecom WL-172 on Ubuntu 7.10;
wardriving, my wardriving stuff;
Miscellaneous
Linkedin.com, my LinkedIn profile;
Flickr.com, my photos repository;
|
This page were 100% AUTO-GENERATED via customize Perl scripts. The data on this website is provided for research purposes only. It is provided for your personal use only and is supplied AS IS WITHOUT WARRANTY OF ANY KIND. Use or reliance on this data is at your own risk. |
Matteo Cantoni, matteo.cantoni@nothink.org
|
ADSL homed honeypot summary report
last update 2008-05-17 (packets statistics)Total attacks (last 24 hours) : 419
| Top 5 source attackers (last 24 hours) | |||
| # | ip address | country | flag |
| 51 | 79.20.227.21 | it |  |
| 16 | 79.20.214.197 | it | |
| 12 | 79.20.22.110 | it | |
| 9 | 79.20.172.206 | it | |
| 8 | 79.11.130.48 | it | |
| Top 5 destination ports (last 24 hours) | ||
| # | port | dshield link |
| 216 | 135 | dshield port details |
| 46 | 445 | dshield port details |
| 1 | 2967 | dshield port details |
| 1 | 8080 | dshield port details |
| Top 5 vulnerabilities (last 24 hours) | |
| # | vulnerability |
| 216 | dcom |
| 42 | asn1 |
| 2 | lsass |
| 2 | pnp |
| 1 | symantec |
| Top 5 urls (last 24 hours) | |
| # | url |
| 51 | bind://hidden ip:1534/ |
| 9 | cbackf://79.20.214.197:17319/e7Hftw== |
| 8 | bind://hidden ip:1670/ |
| 8 | bind://hidden ip:2937/ |
| 7 | bind://hidden ip:1499/ |
| Top attackers coutries (month) : 30873 | ||
| # | country | flag |
| 5471 | it | |
| 55 | de |  |
| 21 | se |  |
| 15 | ro |  |
| 15 | ru |  |
| 12 | us |  |
| 11 | ar |  |
| 10 | pl |  |
| 10 | fr |  |
| 8 | gb |  |
| 7 | cn |  |
| 6 | es |  |
| 3 | jp |  |
| 2 | gr |  |
| 2 | mk |  |
| 1 | unk |  |
| 1 | ph |  |
| 1 | at |  |
| 1 | dk |  |
| 1 | sk |  |
| 1 | tr |  |
| 1 | tw |  |
| 1 | in |  |
| 1 | my |  |
| 1 | nl |  |