Aprendiendo a usar los blogs

desarrollando contenidos para nuestro entorno

Archive for 18 noviembre 2005

Por fin…

Posted by buson en noviembre 18, 2005

TOMADO DE:

http://www.atinachile.cl/node/5077

Nicholas Negroponte y el Laptop de 100 dólares

Enviado por Equipo Web el 28 Octubre, 2005 – 10:34
Atina Chile! | Región Metropolitana

De quién estamos hablando
Fundador y líder del Instituto Tecnológico de Massachusetts (MIT) y Director del proyecto de crear un computador portátil (One Laptop per Child – OLPC) que cueste menos de 100 dólares y que pueda ser usado con fines educativos. Con este propósito viajó a Chile para presentar una conferencia en la Universidad de Los Andes y luego reunirse con el Ministro de Educación, Sergio Bitar.

Es además autor de uno de los libros más apasionantes sobre tecnología, sociedad y predicciones sobre el uso de la computación, el Best-Seller Being Digital (Ser Digital). Además fue uno de los fundadores de la revista Wired.

Lo que dijo en la conferencia internacional
Esta es una selección de los pasajes más destacados que presentó en la conferencia de hoy:

“El propósito de tener un Laptop en la sala de clases es para aprender, pero no aprender a usar Word, Excel u otras aplicaciones, como lo hemos visto hasta ahora. Nosotros queremos que los niños tengan la oportunidad de tener una mejor educación con estos equipos”

“Algunos elementos, como la banda ancha por ejemplo, son elásticos. Si en esta sala tenemos Wi-Fi, y conectamos 10 o 20 equipos, realmente no importa porque el ancho de banda se distribuye. Pero si llegan 10 o más personas sin equipos, tendré que entregarles uno. (los equipos) entonces no son elásticos. Esta fue una de las primeras cosas que definimos para poner el énfasis en crear un equipo de bajo costo, porque detectamos que ahí está el problema.

El término “100 dólares” es sólo denominativo. Podría costar 70, o 90, pero en el fondo da lo mismo. Lo que prometemos es que cueste menos de 100 US$, y la tendencia es que el valor irá bajando con el tiempo.”

“Porqué un laptop: por su mobilidad. Porque a través de él la educación se realiza dentro y fuera de la sala de clases. La educación a través de un profesor no es la única forma, tan sólo es una de las maneras de educar/aprender.

Nos sucedió que en una pequeña localidad de Cambodia, donde no hay teléfonos, no hay electricidad, dificilmente hay caminos, entregamos 15 equipos con conexión satelital a los alumnos y les dijimos “llevenlos a casa”. La primera noche, nadie los abrió, porque los padres les dijeron que no lo hicieran. Al día siguiente tuvimos que redactar una nota avisando para que pudieran abrirlos. Esa misma noche, los padres adoraron los laptops: eran el elemento más brillante de la casa.

Adivinen cuál fue la primera palabra en inglés que aprendieron estos niños: Google

“En el mundo hay 1 billón de niños en etapa escolar. El 70% de ellos son de China e India, lo que resulta impresionante. Creemos que tenemos la capacidad para alcanzar a 100 millones de estos niños por año.

Uno de los puntos críticos en la elaboración de estos equipos son los displays (pantallas) por su costo. Al comienzo los productores no se interesaban en crear estas pantallas chicas y simples: ellos están en el negocio de las pantallas más grandes y brillantes. Todo cambió cuando les dijimos que necesitábamos 100 millones de ellas por año.

No competimos con el marketing tradicional de laptops. La finalidad de este PC es distribuirlos a través de los Ministerios de Educación de cada país. No entramos al retail o las tiendas.

Los notebooks hoy son menos poderosos que antes. Cargar un programa resulta insoportable: cada vez tienen más código y son más pesados. Tendríamos que contratar programadores para que eliminen códigos.”

“El Open Source es una solución perfecta, no porque sea libre o de bajo costo, sino porque es mejor. Wikipedia por ejemplo. Es fantástico, colaborativo y se actualiza tan frecuentemente. Es lo ideal.

Nos preocupa el tema de que los equipos sean personales, para cada niño. Estamos trabajando en ello para que no sean robados y vendidos en el mercado, por ejemplo. También nos preocupa el medio ambiente.

Los resultados que hemos tenido hasta hoy en donde hemos hecho las pruebas son asombrosos. Los niños son más participativos, más entusiatas, de mejor comportamiento. Los profesores casi no reciben preguntas al final de la clase, si queda alguna se resuelve via email. Incluso los índices de asistencia a clases son mucho mejores… (traducción: hacer la cimarra) “ha bajado a cero.”

“Nuestros propósitos son comenzar a entregar los equipos a fines del 2006. Pero hay países que tienen más prioridad que Chile, ustedes pertenecen a un segundo grupo, por lo que debieran formar parte de este programa a finales del 2007. Por ello el consejo que les damos es: no nos esperen. Comiencen a integrar los equipos en las aulas ahora.

Los profesores siempre serán destacados y recordados por lo que son: grandes profesores. Sin duda su trabajo cambiará cuando se integren estos equipos, pero la misión de excelencia se mantiene.

¿Qué pueden hacer ustedes por esto, hoy? Primero: hagan ruido. Segundo: no nos esperen y empiezen a integrar equipos hoy mismo. Tercero: olvidarse de burocracias, estudios previos, análisis de casos, etc. Se los aseguro vehementemente: los resultados son impresionantes.”

Links:
US$100 Laptop
Web de Nicholas Negroponte
Nicholas Negroponte en la Universidad de Los Andes

Posted in Uncategorized | Leave a Comment »

Test vulnerabilidad online

Posted by buson en noviembre 9, 2005

Antes de instalar nada en nuestras máquinas podemos probar algunas herramientas de prueba para ver lo eficaces que puedens ser.

PC Vulnerability Testing

BrowserSpyThis tool will tell you all sorts of information that can be obtained about you and your browser! It’s free.

HackerWhacker™See your computer the way hackers do! Run a free security check, and get tons of information.

ShieldsUP!™Can anyone crawl into your computer while you’re connected to the Internet? Check and see here! It’s free.

WinNuke Test PageThis page allows you to test your PC (free) for vulnerability to the “WinNuke” attack, which is a Denial of Service (DOS) attack that completely disables networking on many Win95 and WinNT machines. Try this at your own peril.

Sygate Online ServicesMany different kinds of security scans are offered here.

Security Space Security CheckThis site offers many different security tests. Any number of individual tests may be run free; however, if you want to run a complete audit, there’s a fee.

Port Scan Security CheckThe Secure Design Port Scan Security Check can give you a free report of open ports that may put you at risk to the security threats on the SANS Institute’s “Top Ten Most Critical Internet Security Threats” list.

CyberCop ASaP Online Vulnerability Assessment Service McAfee’s CyberCop ASaP is an online vulnerability assessment service that you can try for free.

IRCBot DetectorThis tool will tell you if you have an IRCBot running on your system without your permission.

Free ibh Online NETBIOS Vulnerability CheckHere is another free online vulnerability check which includes NetBus und BO checks.

Test Your E-mail DefensesIf you wish, you will be sent an e-mail with a harmless .VBS file attached in order to see if your system detects it.

PCWorld’s PC Pit Stop Run all sorts of diagnostics on your machine here.

Virus/Trojan InformationBe sure to also check your system for viruses and trojans here.

Spyware InformationBe sure to also check your system for spyware here.

As with all software, etc., try it at your own peril, and it is always wise to make a backup of your systerm before installing anything new.

Posted in Uncategorized | Leave a Comment »

google y sus búsquedas….

Posted by buson en noviembre 8, 2005

Hack con google, hackear con google, hacking

cosas que se pueden hacer en google:

Prueba a escriber lo que aparece abajo en el buscador de google podras acceder a base de datos, contraseñas, webs con bugs, hasta a numeros de targeta de credito. Practica un poco y prueba los distintos comandos, luego crea tus propias lineas para buscar. Un buen sitio de información de como hackear con google es http://johnny.ihackstuff.com/ está en inglés, pero no llegarás a nada si no visitas páginas como esta

filetype:htpasswd htpasswd
intitle:”Index of” “.htpasswd” -intitle:”dist” -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurl:passlist.txt (para encontrar listas de passwords)
intitle:”Index of..etc” passwd
intitle:admin intitle:login
“Incorrect syntax near” (SQL script error)
intitle:”the page cannot be found” inetmgr (debilidad en IIS4)
intitle:index.of ws_ftp.ini
“Supplied arguments is not a valid PostgreSQL result” (possible debilidad SQL)
_vti_pvt password intitle:index.of (Frontpage)
inurl:backup intitle:index.of inurl:admin
“Index of /backup”
index.of.password
index.of.winnt

inurl:”auth_user_file.txt”
“Index of /admin”
“Index of /password”
“Index of /mail”
“Index of /” +passwd
Index of /” +.htaccess
Index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin”
allintitle: “index of/root”
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurl:passwd filetype:txt
inurl:admin filetype:db
inurl:iisadmin
inurl:”auth_user_file.txt”
inurl:”wwwroot/*.”
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:”Index of” .sh_history
intitle:”Index of” .bash_history
intitle:”Index of” passwd
intitle:”Index of” people.1st
intitle:”Index of” pwd.db
intitle:”Index of” etc/shadow
intitle:”Index of” spwd
intitle:”Index of” master.passwd
intitle:”Index of” htpasswd
intitle:”Index of” members OR accounts
intitle:”Index of” user_carts OR user _cart

_vti_inf.html
service.pwd
users.pwd
authors.pwd
administrators.pwd
test-cgi
wwwboard.pl
www-sql
pwd.dat
ws_ftp.log

Posted in Uncategorized | Leave a Comment »

Algunas herramientas…

Posted by buson en noviembre 8, 2005

Siempre es bueno disponer de buenas herramientas, por lo que pueda hacer falta:
tomado de:
http://www.cert-in.org.in/securitytools.htm

Attack & Penetration tools:

Nessus:
http://www.nessus.org/

The premier Open Source vulnerability assessment tool
Nessus is a remote security scanner forWindows, Linux, BSD, Solaris, and other Unices. It is plug-in-based, has a GTK interface, and performs over 1200 remote security checks. It allows for reports to be generated in HTML, XML, LaTeX, and ASCII text, and suggests solutions for security problems

Hping2
http://www.hping.org/

A network probing utility like ping on steroids
hping3 assembles and sends custom ICMP/UDP/TCP packets and displays any replies. It was inspired by the ping command, but offers far more control over the probes sent. It also has a handy traceroute mode and supports IP fragmentation. This tool is particularly useful when trying to traceroute/ping/probe hosts behind a firewall that blocks attempts using the standard utilities.

DSniff
http://naughty.monkey.org/~dugsong/dsniff/

A suite of powerful network auditing and penetration-testing tools
This popular and well-engineered suite by Dug Song includes many tools. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI. A separately maintained partial Windows port is available here.

GFI LANguard
http://www.gfi.com/lannetscan/

A commercial network security scanner for Windows
LANguard scans networks and reports information such as service pack level of each machine, missing security patches, open shares, open ports, services/applications active on the computer, key registry entries, weak passwords, users and groups, and more. Scan results are outputted to an HTML report, which can be customised/queried. Apparently a limited free version is available for non-commercial/trial use.

Sam Spade
http://www.samspade.org/ssw/

SamSpade provides a consistent GUI and implementation for many handy network query tasks. It was designed with tracking down spammers in mind, but can be useful for many other network exploration, administration, and security tasks. It includes tools such as ping, nslookup, whois, dig, traceroute, finger, raw HTTP web browser, DNS zone transfer, SMTP relay check, website search, and more. Non-Windows users can enjoy online versions of many of their tools.

ISS Internet Scanner:
Application-level vulnerability assessment
http://www.iss.net/products_services/enterprise _protection/vulnerability_assessment/ scanner_internet.php

Internet Scanner started off in ’92 as a tiny Open Source scanner by Christopher Klaus. Now he has grown ISS into a billion-dollar company with a myriad of security products. ISS Internet Scanner is pretty good, but is not cheap. So companies on a tight budget may wish to look at Nessus instead. A March 2003 Information Security magazine review of 5 VA tools (including these) is available here. Note that VA tools only report vulnerabilities. Commercial tools for actually exploiting them include CORE Impact and Dave Aitel’s Canvas. Free exploits for some vulnerabilities can be found at sites like Packet Storm and SecurityFocus

Nikto
http://www.cirt.net/code/nikto.shtml

Nikto is a web server scanner which looks for over 2600 potentially dangerous files/CGIs and problems on over 625 servers. It uses LibWhisker but is generally updated more frequently than Whisker itself.

SuperScan: Foundstone’s Windows TCP port scanner
http://www.foundstone.com/index.htm?subnav= resources/navigation.htm&subcontent=
/resources /proddesc/superscan.htm

A connect-based TCP port scanner, pinger and hostname resolver. No source code is provided. It can handle ping scans and port scans using specified IP ranges. It can also connect to any discovered open port using user-specified “helper” applications (e.g. Telnet, Web browser, FTP).

Retina:
http://www.eeye.com/html/Products/Retina/index.html

Commertial vulnerability assessment scanner by eEye Like Nessus and ISS Internet Scanner mentioned previously, Retina’s function is to scan all the hosts on a network and report on any vulnerabilities found.

SAINT
http://www.saintcorporation.com/saint/

Security Administrator’s Integrated Network Tool
Saint is another commercial vulnerability assessment tool (like ISS Internet Scanner or eEye Retina). Unlike those Windows-only tools, SAINT runs exclusively on UNIX. Saint used to be free and open source, but is now a commercial product.

SARA: Security Auditor’s Research Assistant
http://www-arc.com/sara/

SARA is a vulnerability assessment tool that was derived from the infamous SATAN scanner. They try to release updates twice a month and try to leverage other software created by the open source community (such as Nmap and Samba).

N-Stealth: Web server scanner
http://www.nstalker.com/nstealth/

N-Stealth is a commercial web server security scanner. It is generally updated more frequently than free web scanners such as whisker and nikto, but do take their web site with a grain of salt. The claims of “20,000 vulnerabilities and exploits” and “Dozens of vulnerability checks are added every day” are highly questionable. Also note that essentially all general VA tools such as nessus, ISS, Retina, SAINT, and SARA include web scanning components. They may not all be as up-to-date or flexible though. n-stealth is Windows only and no source code is provided.

Firewalk: Advanced traceroute
http://www.packetfactory.net/projects/firewalk/

Firewalk employs traceroute-like techniques to analyze IP packet responses to determine gateway ACL filters and map networks. This classic tool was rewritten from scratch in October 2002. Note that much or all of this functionality can also be performed by the Hping2 –traceroute option.


XProbe2:
Active OS fingerprinting tool
http://www.sys-security.com/html/projects/X.html

XProbe is a tool for determining the operating system of a remote host. They do this using some of the same techniques as Nmap as well as many different ideas. Xprobe has always emphasized the ICMP protocol in their fingerprinting approach.

SolarWinds Toolsets: A plethora of network discovery/monitoring/attack tools
http://www.solarwinds.net/

SolarWinds has created and sells dozens of special-purpose tools targetted at systems administrators. Security related tools include many network discovery scanners and an SNMP brute-force cracker. These tools are Windows only, cost money, and do not include source code.


THC-Amap:
An application fingerprinting scanner
http://www.thc.org/releases.php

Amap (by THC) is a new but powerful scanner which probes each port to identify applications and services rather than relying on static port mapping.

Hunt: An advanced packet sniffing and connection intrusion tool for Linux
http://lin.fsid.cvut.cz/~kra/index.html#HUNT

Hunt can watch TCP connections, intrude into them, or reset them. Hunt is meant to be used on ethernet, and has active mechanisms to sniff switched connections. Advanced features include selective ARP relaying and connection synchronization after attacks. If you like Hunt, also take a look at Ettercap and Dsniff.

Achilles: A Windows web attack proxy
http://achilles.mavensecurity.com/

Achilles is a tool designed for testing the security of web applications. Achilles is a proxy server, which acts as a man-in-the-middle during an HTTP session. A typical HTTP proxy will relay packets to and from a client browser and a web server. Achilles will intercept an HTTP session’s data in either direction and give the user the ability to alter the data before transmission. For example, during a normal HTTP SSL connection a typical proxy will relay the session between the server and the client and allow the two end nodes to negotiate SSL. In contrast, when in intercept mode, Achilles will pretend to be the server and negotiate two SSL sessions, one with the client browser and another with the web server. As data is transmitted between the two nodes, Achilles decrypts the data and gives the user the ability to alter and/or log the data in clear text before transmission.

Brutus: A network brute-force authentication cracker
http://www.hoobie.net/brutus/

This Windows-only cracker bangs against network services of remote systems trying to guess passwords by using a dictionary and permutations thereof. It supports HTTP, POP3, FTP, SMB, TELNET, IMAP, NTP, and more. No source code is available. UNIX users should take a look at THC-Hydra.

Fragroute: IDS systems’ worst nightmare
http://www.monkey.org/~dugsong/fragroute/

Fragroute intercepts, modifies, and rewrites egress traffic, implementing most of the attacks described in the Secure Networks IDS Evasion paper. It features a simple ruleset language to delay, duplicate, drop, fragment, overlap, print, reorder, segment, source-route, or otherwise monkey with all outbound packets destined for a target host, with minimal support for randomized or probabilistic behaviour. This tool was written in good faith to aid in the testing of intrusion detection systems, firewalls, and basic TCP/IP stack behaviour. Like Dsniff, and Libdnet, this excellent tool was written by Dug Song.

SPIKE Proxy: HTTP Hacking
http://www.immunitysec.com/resources-freesoftware.shtml

Spike Proxy is an open source HTTP proxy for finding security flaws in web sites. It is part of the Spike Application Testing Suite and supports automated SQL injection detection, web site crawling, login form brute forcing, overflow detection, and directory traversal detection.

Shadow Security Scanner: A commercial vulnerability assessment tool
http://www.safety-lab.com/en2/products/1.htm

nmap
http://www.insecure.org

A popular tool used for portsscaning and OS finger printing

Posted in Uncategorized | Leave a Comment »