+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Networking (https://sinister.ly/Forum-Networking)
+---- Forum: Anonymity (https://sinister.ly/Forum-Anonymity)
+---- Thread: Puting system into stealth mode. (/Thread-Puting-system-into-stealth-mode)
Pages:
1
2
Puting system into stealth mode. - masters121 - 05-01-2014
Whooo hooo, I can finally post, boy are you guys in trouble now
I have been working on puting my system into a stealth mode, This way I do not have to use virtual box which is an advantage on lets say a netbook, which is small and highly mobile but lacking in any real power.
System is Kali Linux base and stock (meaning no zeigiest ect)
Question, when rsyslog is turned off, not meaning the service as there are programs that can kick the service back in, but acutally turning it off stop all logging.
Logging is in reference to anything that maybe logged while attempting a pen test of a system that would be increminating.
I also know to set histzise = 0 then when comming out of stealth mode reset it back to 500.
Thanking you in advance
Masters
RE: Puting system into stealth mode. - Ligeti - 05-01-2014
I didn't understand your question tbh, where is the question?
Well, it is not advisable to turn off the log system (any log), specially when doing a pentest (because they form part of the test/result), don't you agree?
Also (from my experience) these systems/services are monitored (using Nagios/Icinga or any other monitoring system), so they may trigger a warning/alert as soon the service is down!
Another thing, you have to know the environment well! Local machine is not the only thing that log events, sometimes there will be a plugin installed, or a firewall, or IDS... or even just a simple SQL query (user made) that will record all events/access.
Peace
RE: Puting system into stealth mode. - masters121 - 05-01-2014
Thank you for the prompt reply,
Ok perhaps not doing pen testing but wanting to make sure my system is not recording my actions which might come back to haunt me.
So the answer to my question is "No" rsyslog such as this
/etc/init.d/rsyslog stop
does not turn off all logging.
Yes this would be a local machine, see
System is Kali Linux base and stock (meaning no zeigiest ect)
I have moved my home directory structure to a thumb drive leaving only the root on the hard drive which should help aleviate any add on, database ect that may be logged in the home directory.
I would use an external recording device which I would have more control over to record my actions should they require further review.
RE: Puting system into stealth mode. - Ligeti - 05-01-2014
living where I live one should be a true ninja in order to hide
my advice:
- learn on one machine work from another
- attack from a laptop connected to coffeshop wifi, using live CD and change the mac address.
- stay away from cctv, cams, girls (they love to take photos), and so on
- shut up and listen.....
- never trust anything/anyone
RE: Puting system into stealth mode. - masters121 - 05-02-2014
Thanks man,
Several months back I trotted on down to my local city hall and got my self a network security business license. This allows me to scan sites. While I am still liable for any damages my scans can do I can pretty much legally scan away with the pupose of (cough cough,) prospecting for clients.
I would never actually attack a system on my home computer, but I can scan, do hashes ect. What I am trying to do is protect my home system as much as possible should something go wrong.
While I am new here I am not a noob. And as such feel as if I have covered my bases very fairly thoughly and just really need to know how effective stopping rsyslog is as far as logging in Var. It is my understanding that it does indeed stop all root logging which is fine since my home directory is located on a removable drive.
The rest I have contigancys for or will clear up with a post stealth scrip that will cover my bases and delete any futher logs needed (yes I have a Sata drive). But I kinda need to know what logs would still be active if any to delete.
Sorry, dont mean to double post but I do want to add,
Using a CD is really not a very good option since if you were to use like Openvas it takes several hours to setup.
then you would have to update your system. I really dont want to spend several hours at a coffe shop just to get ready to start. Persistanc is a nice feature to a thumb drive but still lacks the speed of a hard drive or sata drive and you may become limited in space.
edit, corrected openvas spelling
RE: Puting system into stealth mode. - The Real Slim Shady - 05-02-2014
(05-02-2014, 12:40 AM)masters121 Wrote: Several months back I trotted on down to my local city hall and got my self a network security business license. This allows me to scan sites. While I am still liable for any damages my scans can do I can pretty much legally scan away with the pupose of (cough cough,) prospecting for clients.
I dont know where you live - But I have never seen anyone arrested for scanning, and I dont know of any jurisdiction where it is actually illegal.
And its "etc.", not "ect". Its an abbreviation for the latin expression "et cetera". repeatedly using "ect" just makes you look stupid/uneducated.
RE: Puting system into stealth mode. - masters121 - 05-02-2014
Thanks Geoff I will work on that, (really need a spell checker here)
This is true Geoff it is not illegal, but should you be tracked for many scans, and your system is discovered, and you have Kali or Backtrack on your system. Does this not put you in a defensive position in having to explain why you have these hacking tools?
Would it not be better to have a point of defense and a reason for having such.
For instance if I have lock picking tools and do not have a locksmith license I have some explaining to do.
RE: Puting system into stealth mode. - masters121 - 05-02-2014
OK it appears as if I am more advanced in this area (since the only fault that can be found is in my spelling of ect or etc) than the readers of this site. I will either write a tut on this or move on to another site. I am really looking to advance my skill set.
RE: Puting system into stealth mode. - The Real Slim Shady - 05-02-2014
(05-02-2014, 01:25 AM)masters121 Wrote: This is true Geoff it is not illegal, but should you be tracked for many scans, and your system is discovered, and you have Kali or Backtrack on your system. Does this not put you in a defensive position in having to explain why you have these hacking tools?
Would it not be better to have a point of defense and a reason for having such.
For instance if I have lock picking tools and do not have a locksmith license I have some explaining to do.
You only /need/ to explain yourself after you have done something illegal.
So I would propose that how could a company report you to the police for doing something that was not illegal. So how would the police track you down for doing a bunch of stuff that wasnt illegal?
I would also suggest that how would the police even know you had Kali or Backtrack on your system? Would they not need a warrant and other cause to search the device? You could easily write whatever you want in the boot menu so they would need your password.
And by that time, you should have a lawyer?
And again... lock picking tools arent illegal either. the mere act of having them is not an issue regardless of whether you are a locksmith.
RE: Puting system into stealth mode. - masters121 - 05-02-2014
my friend,
You are not aware of the law and how law enforcement works. I stated to my attorornys what my intentions where. And what they told me to do is the above.
Please take no offence but I will do what my attorneys say over what a moderator says.
The police can get a suponea for you te relinquish your password. Not doing so will be contempt of court.
I am not saying that the above will occure but for a wise man to cover his bases. Should for whatever reason Law enforcement find you and your system. You should have a reason for having (kali "ETC"). Just makes your life easier and gives you a basis for defence.
Yes lock picking tools are not illegal, but they will get you questions from Law enforcement should they find you have them. Its just the way it works. I would prefer to say "hey man here is my licence, this is why i am doing it."