School of Hacks - Part 2

I continue to discuss the second part of the series, following the Hacker culture post in Part 1, now we discuss Part 2. Before I elaborate in programming in Python or other hacking languages, I want to discuss with you the second important skill in hacking. In case you have not guessed it, if you want to become a hacker, you need know an Open Source UNIX operating system.


Can you hack in Windows?  Yes. Windows is a good operating system, and you can install Python and run programs in C on Windows. But Windows is not Open Source. Windows is distributed in binary, in other words, you can only install Windows and not change nor manipulate the code of the operating system (OS). An open source OS has the option to download the source code and contribute to it by programming features, utilities or tools for it. There are two lessons to be thought in this here skill today, and they go hand in hand. One, if you want to be a hacker, you have use and contribute to the Free and Open Source Software (FOSS). This is a cultural trait. You can contribute in such a community as SourceForge, where you can download and develop FOSS. Hackers share software with their community, they test FOSS they didn’t program, write documentation for it, debug it, and eventually, write their own open source software. That is one reason why hackers use a FOSS UNIX Operating System. There are different variants of UNIX or UX operating systems, free or proprietary such as AIX, BSD, Solaris, SCO, HP-UX and the most popular, Linux, which leads us to the second lesson.

UNIX has been the operating system for scientist by scientists. It goes without saying, that hacking is a science. In the days before the Mac OS and Windows, UNIX was king and in the 1970’s, UNIX creators at Bell Labs, provided the source code to the OS to be taught in universities or enhanced by researchers. A US born professor at Vrije University in Amsterdam wrote his own UNIX (MINIX, or Minimal UNIX) and provided the 12,000 lines of C and Assembly code when you bought his book “’Operating Systems: Design and Implementation” by Andrew S. Tanenbaum. MINIX was created to teach university students how an operating system works. One student, Linus Torvalds, took the source code provided by the book in floppy disks, programmed a kernel, and according to his newsgroup post on compo.os.minix took “feedback on things people like/dislike in minix” and programmed “features most people would want”. As he shared it with the online community, like a good hacker boy that he was, it gained a lot of attention and within one month of releasing Linux 0.01 (or Linus UX) on the Internet, many hackers contributed to 0.02. Eventually Linux grew into the hundreds of Linux distributions today.

There are other Free OSS UNIX operating systems around that are used for hacking, these include FreeBSD and OpenSolaris. However, the importance to becoming a good hacker is to understand UNIX and how it works on the Internet. To do so, one must know the UNIX and Internet Fundamentals. The question here is now, what do you want read about next: should I contribute in detail on programming Python, or would you rather me show you the different ways to run Linux, including Live Distro, virtual or full installation or running Linux off a network. My next part of this series will depend on the reader, this is subliminally training you to a hacker lessons learned, contribute to this by commenting, and you’re on your way to becoming a hacker.

School of Hacks - Part 1

Some rights reserved by dunkv

I began this series for a blog and podcast called Mr. Cracker:


You never ask, “How do I become a hacker?” and you never say “I am a hacker.” Nowadays, you will run into countless YouTube Videos and blogs regarding “hacking.” I’m glad to hear Mr. Cracker’s first few episodes focused on what is a hacker and how does one hack. However, there are many stories that can be credited for tainting the term, like an incident in Los Alamos in 1982.

Webster’s dictionary defined a hacker as an expert at programming and solving problems with a computer. Hackers have otherwise been known as computer geeks or computer wizards; up until the word was tarnished by ruthless wizards that illegally gained access to systems and tamper with information. To this day, the word hacker is used to describe these geniuses that can force their way into an operating system and manipulate data. The term hacker derived from the reference to programmers “hacking away” at the bits and bytes. Since it takes an experienced hacker to gain unauthorized entrance into a secure computer to extract information and perform some prank or mischief at the site, the term has become synonymous with “cracker” or “blackhat”, a person who performs an illegal act. A technical professional that is paid to break into a computer system in order to test its security is called “Pentester” for Penetration Tester.

True hacking, is a culture of these programmers and pentesters that understand code and network security. To become one, is to be called one by an expert. If your friends proclaim you a “hacker” because you brute forced into an account in front of them, unless you wrote the algorithm, you are nothing but a “script kiddie”. If you wrote a program that is useful to the network security and you shared with the community and pentesters or system admins recognize your talent, then you are on your way.

But what is the way, you may ask. I will have to say, it’s a long way. It doesn’t happen overnight, and it doesn’t happen after reading this article of listening to every Mr. Cracker’s podcasts. Yet, there are certain steps you must follow, and I will elaborate in the articles to come. Let me get you started with the basics. A Hacker is a Programmer. Yes, not a MSCE or a CCNA but a programmer. Programming is a THE fundamental skill for hacking. I am a programmer. I began developing software over 10 years ago. I’m not the best, but I recommend you start by learning a language called Python. DO NOT start with a GUI based programming language like Java, or even Visual Basic or C#. Start with Python (http://www.python.org/) for two reasons. One, it’s free and powerful and two, it works on multiple platforms, i.e Windows or Linux. The importance of Linux is for another subject. Stick to semi-colon languages “;” like Perl and PHP, the object will be to move onto C and C++. It is best recommended in this subject that you learn or know all of the mentioned: Python, Perl, PHP, C and C++.

Utilize documentation provided on their site to learning Python. You would have to teach yourself in the next few days, months or years to be strong at that language. Then you can move onto another language, and it would become easier to learn once you understand data structuring and variables, etc. Hacking is the ability to use those languages and applying them to solve your problems. As you learn, keep in mind you are practicing how you think and you’re not really focusing on a particular language.

Meme Monday: 04042011

I saw on the twittersphere this morning that Thomas LaRock (blog | @SQLRockstar) began Meme Monday today, "Write a SQL blog post in 11 words or less". So I jumped in, answering a question I was asked at my last presentation on SQL  Security, can you change the SA user name:


"use master go alter login sa with name = notsausername" Nough Said!


Since most people are tagging others to participate, I challenge 
Bill Fellows | @billinkc
Meredith Ryan-Smith | @coffegrl
Kelly Martinez | @greeleygeek to follow

Denver Presentation at Rocky Mountain Tech Trifecta

I'm speaking this Saturday at the Rocky Mountain Tech Trifecta in Denver's Tech Center. It is the first talk I do outside my comfort zone of Colorado Springs, not to mention at a large event. Sold out with six hundred registered attendees and over 80 on reserve trying to get in and 47 talks. Below is my slide deck for my presentation "Securing your SQL Servers", and lastly, please rate this session if you attend.


I'd appreciate your honest evaluations, in hopes these critiques will assist me to deliver improved sessions as time goes by.

Securing you SQL Server - Denver, RMTT

View more presentations from Gabriel Villa

Visual Studio External GAC Tool

Binary Easter Egg

If you develop in a DLL Hell like I do, it can become tedious to GAC each time you build your class library and want to run a test against your changes. Our product shares an array of files across hundreds of Visual Studio solution projects, in order for dependencies to pick up changes made on the various objects, you have to deploy the assembly to the global assembly cache or GAC. To make matters worse, our team development sandbox is a non-isolated model and the builds deploy to a network shared directory. Therefore each time a change is made, rather, each time I build the class library, I have to point my Visual Studio Command Prompt to the Network Directory where our debug binaries are built, and run the Gacutility:

gacutil [options] [assemblyName | assemblyPath | assemblyListFile]

Maybe it's just me, but I found myself getting a little lazy after doing this several times a day. I looked at all the diverse set of tools in Visual Studio 2008 to look for a command to add in my toolbar, a button, a short-cut, anything. To my dismay, I came out empty handed. Online forums pointed to the MSDN Library and advises two methods to deploy your assemblies into cache:

·         Use an installer designed to work with the global assembly cache. This is the preferred option for installing assemblies into the global assembly cache.

·         Use a developer tool called the Global Assembly Cache tool (Gacutil.exe), provided by the Windows Software Development Kit (SDK).

So I figured I could create my own menu command to add my binaries to the Global Assembly Cache from Visual Studio, with my own external tool. It’s very easy to do by following these few simple steps: create a command file, add the cmd file to an external tool and pass target name and extension as arguments.

Cmd File 

In your favorite text editor, create a batch file. (For the record, I like writing the words “In your favorite text editor”, it gives me a chance to mention my editor of choice, Notepad ++). The trick is that you know the Visual Studio Command Prompt is really just a glorified DOS prompt. First step on the batch is to redirect to your Visual Studio directory, then execute the vcvarsall.bat file, which starts the Visual Studio tools SDK on the DOS prompt, hence, converting the DOS prompt to a Visual Studio Command Prompt. Then change directory to your development environment where your class library will build the DLL. Lastly, add the gacutility command and options with an argument parameter (%1). 

cd c:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\

vcvarsall.bat

cd c:\development

gacutil /if %1

UPDATE

I am amending that by running the vcvarsall.bat, unless your DDL built to the Visual Studio 9.0 directory, it may not change directory to push the gacutil command on your class library. Instead, you can run the utility without having to execute the Visual Studio Tool environment. 

cd c:\development

gacutil /if %1

External Tools
In Visual Studio, open the Tools menu and click on "External Tools". Add a new tool, and name it, GacCmd on the title. At the command text box, include the path to the above .cmd file. In the arguments text box, choose Target Name and Target Extension. You will see this $(TargetName)$(TargetExt). Choose to Use Output Window. When complete, this will add GacCmd under the Tools menu. This will execute the .cmd file and pass the Target Name and Extension as arguments to the file. You will be able to see the execution in the Output window and see the message of file name "successfully added to assembly cache."