Assuming you guys have a terminal on MacOs, use the command below to install wifi-password. This app display the Wi-Fi password of the network you’re currently connected to, or another network in your Keychain.

brew install wifi-password

Once the installation is complete, use the command below to get the password of the current network.

wifi-password

You will be prompted with a window asking for credentials.

username = your user displayed on the terminal. ( in my case its rahulgolam )

Password = the same password used when logging on your Macbook

Successful authentication will result in a similar output.

$ wifi-password

 … getting password for "WIFI_5GHz".
 … keychain prompt incoming.
 ✓ "XX123XX456"

Hope this little information can be used instead of logging into your router and try to find the appropriate settings and reveal the password.

What is WSL ?

WSL stands for Windows Subsystem for Linux. It is a feature in Windows 10 and later versions that allows users to run native Linux command-line tools directly on the Windows operating system, without the need for a virtual machine or dual-boot setup. With WSL, users can access and use many Linux applications and tools, such as Bash, Git, and Ruby, from within a Windows environment. WSL operates by creating a lightweight, virtualised Linux environment within Windows, allowing for seamless integration between the two operating systems.

Enabling WSL on WIndows 10

To get WSL installed on your Windows 10 is pretty forward. Follow this link here to get yours.

After installation, update your packages using this sudo apt-get update.

Continue to the next step once everything is working correctly.

Installing ZSH

Use the command below to install your zsh.

sudo apt install zsh -y

Installing Oh-My-Zsh

Before proceeding, please make sure that git is installed.

sudo apt-get install git

Using curl, we are going to clone the repo for oh-my-zsh and replace the existing ~/.zshrc with a template from oh-my-zsh.

sh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)

Oh-My-Zsh includes many themes and plugins. You will find .oh-my-zsh directory inside your home directory. For curiosity, you can navigate pre-shipped themes and plugins. If you add a custom or external theme or plugin, they should be stored inside the custom directory. 

This conclude our setup for the WSL with Oh-my-Zsh. My next blog post will focus on Themes and adjusting fonts.

Subscribe for receiving updates.

Already 2 days gone since we started the IETF 104 hackathon. For the TLS 1.3 working group, Avi Soomirtee and me have been working for the implementation of PHA ( Post Handshake Authentication) to wget and Nagios-plugins respectively.

We had great food and beverages to keep the flow going. As always the tense atmosphere is present while everyone is struggling with their code and trying to get it to work.

After several tries we managed to compile our software and tested with wireshark to see the change.

Stay tuned for more post after the hackathon.

Im relating to you my experience with cyberstorm.mu for the last 3 days. It was pure coding madness for very member of the team.

We had different working group namely :

TLS 1.3 protocol

• Loganaden Velvindron
• Rahul Golam
• Codarren Velvindron
• Nathan Sunil Mangar
• Jeremie Daniel

HTTP 451 protocol

• Kheshav Sewnundun
• Kifah Meeran
• Veegish Ramdani

SSH protocol

• Nitin J Mutkawoa
• Diresh Soomirtee
• Jagveer Loky

I had to add an option to disable middlebox compatibility for TLS 1.3 in Curl. There were many hurdles on the way to achieve this change.

Day 0, I had issues in compiling my code. After many trials I got on the right track with guidance from Logan.

Day 1, was quite intense for me as i had to analyze packets and traffics in Wireshark to see the change. After lots of debugging I finally managed to see it. Now the only thing left to do was to implement a switch to use this option.

Day 2, I implemented the switch –disable-tls13-middlebox in curl :

I ran the newly compiled curl with the new switch without any errors. I created a pull request for curl repository in github.

Day 3, as i had enough time to accomplish another task, i opted for implementing PHA ( Post Handshake Authentication ) in Nagios-plugins.

I compiled the code successfully, unfortunately i had to test it using an Apache server using TLS 1.3 protocol to see the change. Currently no servers are running apache with TLS 1.3.

I tried to compile Apache with TLS 1.3 but i had many issues with it.
So we could not test it. The work is still in progress.

We had a tough time to accomplish the tasks that was assigned to us. Apart coding we also had lots of fun in the pool and have delicious meal.

Thank you.

Im going to share with you the amazing experience i had during 3 days of pure coding with hackers.mu

We had to implement the new protocol TLS 1.3 to the Nagios Remote Plugin Executor ( NRPE .

Me and Nigel we diverged into a deep state of concentration. On the first day our code was ready. Our only obstacle left was to prove a way it was using TLS1.3 locally.

After 1 day gone we continue to strive harder , even when i was having fever. But at the end the fever overtook me and i was forced to sleep and recover. The work was continued by Nigel who stayed up till 1 am to complete the testing. Finally after long hours of debugging he managed to test the protocol being used by NRPE locally:

Here is a picture :

The next day, we all woke up early, we started with full force. The fever was gone,after some good debugging we managed to test the ssl connection of NRPE with a client. We tested the connection and used wireshark to test the protocol being used:

Finally we proved the code to be working. We made a pull request #186

After 2 days of hard work we can see the results.

Please see the blog of Nigel for more information: niyon.me

Thank you for your comprehension.

Installation of WordPress:

1.Download the latest WordPress package and extract it:

wget http://wordpress.org/latest.tar.gz

tar -zxvf latest.tar.gz

2.Then move the WordPress files from the extracted folder to the Apache default root directory, /var/www/html/:

cp -a wordpress /var/www/html/

3.Set the correct permissions on the website directory, which means giving ownership of the WordPress files to the web server as follows:

chmod -R 755 /var/www/html/

chmod -R 755 /var/www/html/

4.Create a WordPress Database :

mysql -u root -p

Remember to use your own, values for databaseName, databaseUser, and also use a strong and secure password as databaseuserPassword:

MariaDB [(none)]> create database DatabaseName;

MariaDB [(none)]> grant all privileges on DatabaseName* to 'DatabaseUser@localhost' identified by 'DatabaseuserPassword';

MariaDB [(none)]> flush privileges;

Exit

5.Go the /var/www/html/ directory and rename existing wp-config-sample.php to wp-config.php:

mv wp-config-sample.php wp-config.php

then update it with your database information under the MySQL settings section shown below :


// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'database_name_here');

/** MySQL database username */
define('DB_USER', 'username_here');

/** MySQL database password */
define('DB_PASSWORD', 'password_here');

Afterwards, restart the web server  service using the command below:

service apache2 restart

Open your web browser, then enter your server address: http://localhost to get the welcome page below. Read through the page and click on “Let’s go!” to proceed further and fill all requested on screen information .

You can now enjoy WordPress on your system.

Hackers.mu organised a Cybersecurity event with Philipp as the speaker  on the 10th September at 15:00 at Voila Hotel Bagatelle. A number of topics was discussed during the event.

Many questions was raised and many explanations was given to have a clear understanding.  This could actually proved to be a good opportunity for UOM students to think of their career.

Here is the link to the presentation: click

You can find photos for the event on the following page: click

It allows sites to report and /or  enforce Certificate Transparency requirements, that denies the use of mississued certificates for that site from being ignored. When a site enables the Expect-CT header, they are requesting to check if any certificate for that site appears in public CT logs.

The Expect-CT header requires very little configuration with only few options :

enforce – optional directive. This is minimum expected to be present. This controls whether the browser should enforce the policy or not.
max-age – optional directive. This is second expected thing to be present. This directive specifies the number of seconds that the browser should cache and apply the received policy. Max-age depends onhow many hours a user should be using old cache.
report-uri – optional directive. Ideally should be on own server or on server or trusted party.

Im interested with IETF99 , so i have been following the HTTP working group .

Link: click here

RC4’s simplicity and speed were what made it so widely used.

How it works :

To begin the process of RC4 encryption, you will need a key, which is often defined by the user and between 40-bits and 256-bits.

A 40 bit character = 5 character ASCII code

For example the ASCII key “rah12” = 0111001001100001010010000011000100110010 in binary

The key-scheduling algorithm (KSA), listed below (from Wikipedia).

for i from 0 to 255
    S[i] := i
endfor
j := 0
for i from 0 to 255
    j := (j + S[i] + key[i mod keylength]) mod 256
    swap values of S[i] and S[j]
endfor

• KSA creates an array S that contains 256 entries with the digits 0 through 255

• j = [(j + S(i) + key[i mod keylength]) mod 256]

1. Each of the 256 entries in S are  swapped with the j-th entry in S,
2. which is calculated to be where j is the previous j value (which is initially zero)
3. S[i] is the value of the current entry in S.
4. key[i mod keylength] can either be zero or  one.

For example, if we are at the 54th entry in S and the keylength was 40-bit, then 54 mod 40 = 14.

The 15th element (because numbering for arrays begins at zero) in the binary version of “rah12” is 0.

Then, since i = 0, i mod 256 = 0. So, the element at the index 0 of the key is r, and its ascii value is 114. So, the new j is calculated as
j = [(0 + 0 + 114) mod 256] = 114.

So, swapping the i-th and the j-th elements, we obtain the following array after the first iteration:

The next part of RC4 is the pseudo-random generation algorithm (PRGA). The PRGA is
below:

i := 0
j := 0
while GeneratingOutput:
    i := (i + 1) mod 256
    j := (j + S[i]) mod 256
    swap values of S[i] and S[j]
    K := S[(S[i] + S[j]) mod 256]
    output K
endwhile

In PRGA, we start with the array S that was swapped in the KSA. In PRGA, an element in S (at index i) is swapped with another element in S (at index j). Then, the next element in the encrypted text is the element of S at the index calculated by (S[i] + S[j] mod 256). At each iteration, i is recalculated as (i + 1) mod 256, and j is recalculated as (j + S[i]) mod 256. The number of iterations performed is the length of the key, and every value of S is swapped at least once beyond 256 iterations (due to the fact that i and j are calculated by some number n mod 256). The result of this is the code.

Strengths of RC4

• The difficulty of knowing where any value is in the table.
• The difficulty of knowing which location in the table is used to select each value in the sequence.
• A particular RC4 Algorithm key can be used only once.

reference

Members of Hackers.mu discovered that there were a lot of software that uses this encryption. We saw that we could make it more secure. Hence we started making patches.

Here is the link : http://hackers.mu/news/operation-crypto-redemption.

Below are the steps to install Drupal :

Before installation the following requirement should be met:

1.LAMP server ( view my previous post )

step 1 : Get  drupal from drupal.org

• First of all,download drupal 8.2.3 from here.
• extract the file by using the following command

              sudo tar -xvzf drupal-8.2.3.tar.gz 

• copy the file to the following directory

               sudo cp -r drupal.8.2.3 /var/www/html

step2 : Create database for drupal

•  start MYSQL

 mysql -u username -p

(*change username to your actual username for mysql-server)

• create database

CREATE DATABASE drupal; 

• grant privileges

 GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES ON drupal.* TO 'username'@'localhost' IDENTIFIED BY 'PASSWORD';

• do the following to reload permissions on new database

FLUSH PRIVILEGES;

• exit

mysql> exit

step 3 : ONE more step before installation process begins

• set poper permissions to necessary folders inside drupal and the settings.php file must be present.

sudo mkdir /var/www/html/drupal-8.2.3/sites/default/files

sudo cp /var/www/html/drupal-8.2.3/sites/default/default.settings.php /var/www/html/drupal-8.2.3/sites/default/settings.php

sudo chmod 760 /var/www/html/drupal-8.2.3/sites/default/settings.php

sudo chmod 760  /var/www/html/drupal-8.2.3/sites/default/files

step 4 : Installing drupal

• Open http url for the local apache web session.In my case, it is http://127.0.0.1/drupal-8.2.3/
• this page should appear:

• You may face some errors on the next page, displaying requirements reviews. Make sure you meet all the requirements needed, specially, concerning the clean urls, before proceeding

Here are the steps i did to solve the clean urls requirements:

• Enable mod_rewrite for Apache. To test if mod_rewrite is available in Apache2:

apache2ctl -M

• In the output, check to see if the rewrite_module is included in the list of modules.

• If the rewrite module is not in the list,  you can tell Apache to load the module by including:

a2enmod rewrite

• restart apache

/etc/init.d/apache2 restart

• check apache status

systemctl status apache2

• The next step is to locate the appropriate Apache configuration file for your site.The appropriate Apache configuration file could be httpd.conf, a virtual-host-specific file (vhost.conf), a specific site file (e.g. “default”), or apache2.conf.

find /etc/apache2/apache2.conf

• use a text editor to modify the following content:

vim /etc/apache2/apache2.conf

• search for  the following :

 <Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

• change it into :

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
</Directory>

• save and quit the apache2.conf. This should solve the clean URL requirements.
• Apache needs to be explicitly told to respect the instructions in your sites .htaccess file. This is off by default, though most hosts will have turned it on. That is what the AllowOverride All directive above does – it makes .htaccess start working.

Refresh your browser.

You’re done. Drupal should now be running successfully on your browser.