Avi's blog

 

  What is cname record in dns? Say your server name is local92.avi.com and it resolves a public ip of say 103.23.24.25 Now you want the same server should be used for another purpose and also should resolve the same public ip address.  Say you want to call your server using this name  smsplus.avi.com , then the same ip should resolve. In that case you need to configure cname record in your dns server forward lookup zone configuration file.  Create a new cname record there.  Alias : smsplus FQDN : local92.avi.com It will take some time to propagate in the internet. Now when you call smsplus.avi.com then  103.23.24.25 this ip should resolve.  Use cases: Say in your server have some more resources to utilize. Instead of purchasing another server for another purpose, you can use the same server to do so.  Avi

WMI cheat sheet: To see powershell version: $psversiontable To see commands with wmi & cim keyword: Get-Command -CommandType cmdlet *wmi* Get-Command -CommandType cmdlet *cim* If you want to go to powershell version 2: powershell -version 2 If you want to take help from a powershell cmdlets: help get-wmiobject   or  help get-wmiobject -full or help get-wmiobject -example How to know all the namespaces name: Get-WmiObject -Namespace "root" -Class "__Namespace" | select Name Get-CimInstance -Namespace "root" -Class "__Namespace" | select Name To see nested namespace: https://www.youtube.com/watch?v=Nkxj4leucdM&list=PLDWrevYFyjcpH12DrlS3KPK5HOMihQzUz&index=2&ab_channel=FuturisticHacker https://powershellmagazine.com/2013/10/18/pstip-list-all-wmi-namespaces-on-a-system/ To know all the nested namespace of current namespace or default namespace which is cimv2: Get-WmiObject -Class __NAMESPACE | select Name To know all the  nested names...

In windows powershell, give the following command: Format: Get-FileHash <filename> -Algorithm SHA256 | Format-List Example: Get-FileHash C:\Users\user1\Downloads\Contoso8_1_ENT.iso -Algorithm SHA256 | Format-List In linux: sha1sum <filename> Alternative of powershell is certutil.exe: C:\Windows\System32>certutil.exe -hashfile "file path" SHA256 C:\Windows\System32>certutil.exe -hashfile OptionalFeatures.exe SHA256 Avi

Test I am Avi  

https://geekswipe.net/technology/computing/swoop-chrome-passwords-decrypt-with-python/  https://www.thepythoncode.com/code/extract-chrome-passwords-python https://www.thepythoncode.com/article/extract-chrome-passwords-python https://null-byte.wonderhowto.com/how-to/hacking-windows-10-steal-decrypt-passwords-stored-chrome-firefox-remotely-0183600/ Avi

https://attack.mitre.org/techniques/T1552/003/   attacker may search bash command history on compromised systems because sometimes users tend to pass username and password over command line to the program.  when user logs out then all the commands are flushed out to .bash_history file. for each user the file resides in the same location. ~/.bash_history  attacker can abuse this by looking through the file for potential credentials.    Mitigation: there are multiple methods of preventing a users command history from being flushed to their .bash_history file, including use of the following commands: off logging: set +o history and set -o history to start logging again.    another way: clean command history: history -c to make sure changes are written to disk, use: history -w   to make more sure the history is cleared when existing a session, the following command comes in handy: cat /dev/null > ~/.bash_history && history -c && ex...