I found this little gem waiting for me to approve. I get a bit of spam that Akismet doesn’t toss automatically, but this one struck me as an absolute failure to come across as human. It also struck me that Akismet didn’t toss this one automatically.. .:-\

Russ McRee over at HolisticInfoSec.org wrote a great article talking about Mandiant Highlighter that I and Jason Luttgens wrote. We just released a minor bug fix version, 1.1.3. Here’s the link.

holisticinfosec.blogspot.com/2011/10/toolsmith-log-analysis-with-highlighter.html

Here’s the link to the download:

www.mandiant.com/products/free_software/highlighter/

Here’s a link to the forums:

forums.mandiant.com/forum/highlighter

Highlighter v1.1.3 has been released. Check out the sweet blog post by yours truly over at blog.mandiant.com/.

I recently had to get my iPhone restored at an Apple store because I was away from my home computer and my phone was stuck on the loading screen (with the pretty metal apple). I was a little pissed because I knew they were going to upgrade me to the newest firmware (3.1.3) and I didn’t know there was a jailbreak out for it, but I needed my phone!

When I got home, I started sniffing around for a 3.1.3 jailbreak and came across sn0wbreak (ih8sn0w.com/index.php/welcome.snow). I started the app and followed the instructions to get into DFU mode, but the app never moved on from there… always stayed at the DFU Starter Help screen. Realizing sn0wbreeze is not an “official” dev-team release, I went to their blog to see what was going on: that’s where I learned about the Spirit hack.

The Spirit hack (spiritjb.com/) is a small download and a simple screen. You run it with your iPhone attached (some stipulation if you’re using a 3GS) and when the process is over, you have a jailbroken iPhone. Done. The people rejoice.

I consider myself relatively browser agnostic but I use Firefox for a lot of my work.  I utilize multiple profiles and use the –no-remote option to actually run these multiple profiles at the same time.  It keeps the cookies, extensions, add-ons and sessions all separate which allows me to work more efficiently.

I also rely rather heavily on Firefox extensions to do my work: Hackbar, Web Developer, Firebug, FireTitle and several others are my staples.  I recently upgraded to FF 3.6 and that unfortunately broke my FireTitle extension. (side note: FireTitle is used to change the title bar of my different browsers so I know which profile I’m working under in each window).  Looking for a solution and not finding any, I decided to try to “fix it” on my own.  I tried to alter the install.rdf file that sits in the C:\Users\foo\AppData\Roaming\Mozilla\Firefox\Profiles\y1g9vafa.WebAppTest1\extensions\{f4b962b4-ab75-41bf-8da7-a0435258a27c} folder.  There’s a line in there that says <em:maxVersion>3.5.*</em:maxVersion>.  Knowing how clever I am, I changed that 3.5 to 3.6 and restarted FF!  FAIL.  So I looked for something else…

I can across the Add-on Compatibility Reporter and, just wanting to have an avenue to report that the extension wasn’t working, installed it.  I restarted FF 3.6, went to the add-on screen, clicked the Compatibility button next to FireTitle, selected “This add-on no longer works” from the drop-down, submitted my report and restarted FF.  Much to my surprise, the Options button for FireTitle was now enabled!  The settings were reset to default, but something about that whole process enabled the extension.  I repeated it for each of my profiles and now I’m back to where I want to be.

Of course, none of this would be necessary if Mr. Nowitz would just update it.  Cheers Jonathan, and thanks for a great tool.  I truly do enjoy it.

I’m experimenting with permalinks for the my blog. Instead of www.cyberpir8.net?p=192, you’ll see a link to www.cyberpir8.net/2009/10/06/quick-nslookup-bash-script/. Let me know in the comments if this causes any pain or consternation.

Thanks,
Cyberpir8

I recently had to determine if a large set of URLs resolved to the same set of IP addresses. Knowing a little about a few different scripting languages/technologies let me know that this was definitely possible, so I just had to figure out which one I wanted to use for the most efficient results. I decided to just go with Bash shell scripting (since I’ve recently gotten a little used to it).

Say I have a file called urls.txt (newline delimited). This file started with more than just the hostname (e.g., www.example.com/foo/bar.aspx). I had to pare those down so I opened the list in vim and did a little replacement. I could have done the same thing with sed but I’m most familiar with doing this in vim. In vim, open the file and type:

:%s#/.*##g

Ok, ready for some nslookup action in a Cygwin Bash loop. Note that this does not output what I’d like to do, which is the format of “url,ip” and output to a .csv file. It’s also important to note that the loop will take the input line-by-line, so the output file will have all the results in the right order. I could do this in perl very quickly and get the results I’m looking for, but it takes that much more time to write the script. Anyway, here it is:

$ for i in `cat urls.txt`; do nslookup $i 198.6.1.4 2>/dev/null | grep Address | tail -n 1 | cut -d " " -f 3; done > ips.txt

The “$” is the prompt, so don’t write that. For all values (i.e. lines) in urls.txt, do an nslookup of the url and specify the uu.net DNS server to avoid any problems with local resolution (I was having trouble, so had to go outside my corporate DNS server). Redirect all nslookup STDERR messages to /dev/null (there’s a header). Only show me the lines with “Address” and only give me the last of those lines (head & tail working together). Then strip the “Address: ” from the remaining line to give me the IP address by itself. And when you’re done with all that work, redirect to ips.txt instead of STDOUT.

Now I open an Excel or Calc spreadsheet and drop the values from urls.txt right next to ips.txt and I’m cooking with gas.

Hey everyone, I just wanted to let you know that MANDIANT Highlighter v1.1.1 is released and ready to rock and roll!

MANDIANT is proud to announce a new version of Highlighter (version 1.1.1).

We use Outlook 2007 at work to manage all our emails, calendars, and contacts.

Ok, so Highlighter is that log file analysis tool that Jason Luttgens and I created and Nick Harbour contributed a huge amount to in version 1.1 (thanks Nick!).