Now to say that there are many security tools available in BackTrack would be an understatement. In fact there is so many available that I would never start to list theme here. If you wish to see for yourself, simply execute the following within your terminal instance:

[code]
dpkg –list
[/code]

To be honest I have just recently begun experimenting with BackTrack and I have a great deal of learning ahead of me. For that reason I felt compelled to share the following video tutorials, books, and how-to guides that I could locate. Should you have any tips or resources please leave a comment.

Video Tutorials

Guides

• BackTrack User Guide from Braton Groupe sarl.

Books

Introduction to MBSA

Microsoft Baseline Security Analyzer is an easy-to-use tool designed for the IT professional that helps small- and medium-sized businesses determine their security state in accordance with Microsoft security recommendations and offers specific remediation guidance. Improve your security management process by using MBSA to detect common security misconfigurations and missing security updates on your computer systems. A number of options include:

1. Administrative vulnerabilities
2. Week Passwords
3. IIS administrative vulnerabilities
4. SQL administrative vulnerabilities
5. File shares
6. … and more

Best of all Microsoft Baseline Security Analyzer it absolutely free from Microsoft!

Executing MSBA

Once you have downloaded and installed Microsoft Baseline Security Analyzer go ahead and run the application.

If you’re scanning a single computer then go ahead and click “scan a computer”. Once the next dialog has loaded, you will need to uncheck IIS and SQL administrative vulnerabilities unless of course you are running these two services.

The next step is to start the scan. Go ahead and click the button “start scan. The scan can take a few minutes so be patient. Once the scan has completed you are then presented a dialog that tells you exactly what was scanned, the score, issue, and the result. Reporting includes:

1. Microsoft Office Updates
2. Critical Updates or Patches
3. Weak Password Check
4. Services
5. Firewall
6. File Sharing

The scan resulted in a number of critical failures. The failures must be correctly properly secure you system and while you in the process address each line item to further fortify your operating system. Take for example the critical failure of local account password test. The result states user accounts have simple or no password which can lead to others being able to quickly determine your password.

If you’re not positive how to correct the problem then Microsoft has you covered here as well. Go ahead and click “how to correct this” and the issue is explained as well a solution with instructions is provided. Now it just cannot be any simpler and now you have no reason to not properly secure your operating system.

Conclusion

Microsoft Baseline Security Analyzer does a great job of pointing out the holes in security and by following the best practices and guidelines provided you will quickly find yourself on a path of security prosperity. Just remember, security is a never ending process and with that being said you may want to re-run the scan on a monthly or even a quarterly basis.

Have you used Microsoft Baseline Security Analyzer previously? If so what are you thoughts? Does this product provide a valuable tool set that helps in your security endeavors?

References

• Download Microsoft Baseline Security Analyzer

Credits

Featured image: Casey Serin

SQL Injection Cheat Sheet

The SQL Injection Cheat Sheet provides a summary of everything you need to know about SQL Injection. The SQL Injection Cheat Sheet contains the key concepts of SQL Injection and a SQL Injection example and tips for prevention of SQL Injection attacks. Note that you must register with Veracode in order to obtain these cheat sheets.

Download the FREE SQL Injection Cheat Sheet

Cross-Site Scripting (XSS) Cheat Sheet

The Cross-Site Scripting Cheat Sheet provides a summary of what you need to know about Cross-site Scripting. Our XSS cheat sheet details the different types of Cross-site Scripting and shows you how to protect against Cross-site Scripting vulnerabilities.

Download the FREE XSS Cheat Sheet

LDAP Injection Cheat Sheet

The LDAP Injection Cheat Sheet provides a summary of what you need to know about LDAP Injection. It contains a LDAP Injection example and details of how to protect against LDAP Injection vulnerabilities.

Download a FREE LDAP Injection Cheat Sheet

Tools

1. Robocopy: is a command-line directory replication command. It has been available as part of the Windows Resource Kit starting with Windows NT 4.0, and was introduced as a standard feature of Windows Vista, Windows 7 and Windows Server 2008.
2. 7Zip: An open source file archive designed originally for Microsoft Windows. 7-Zip operates with the 7z archive format, and can read and write several other archive formats. The program can be used from a command line interface, graphical user interface, or Windows shell integration. 7-Zip began in 1999 and is actively developed by Igor Pavlov. It is related to a cross-platform port, p7zip.
3. Of course a Dropbox account.
4. Your favorite text editor.

The Batch File Broken Down

Now it is important to understand that my intent is to demonstrate how to backup items such as your favorites, email, and anything else that you deem important. I will not go into the details of the command line switches as they apply to 7Zip and Robocopy rather I will explain the use in my example.

First, define the variables. I prefer this method because it is clean and provides a single line item.

:: variables
set dailyDrive=C:\Users\SomeUser\Dropbox\Backup
set backupCmd=robocopy /S /Z /COPY:DAT /MIR
set zipCmd="C:\Program Files\7-Zip\7z.exe" a -tzip

So what is really happening here?

• dailyDrive defines where my backup is stored (remember by using Dropbox it automatically syncs to the cloud)
• backupCmd defines the robocopy executable and the switches
  /S :: copy Subdirectories, but not empty ones
  /Copy:DAT :: What to COPY (default is /COPY:DAT)
  /Z :: copy files in restartable mode
  /MIR :: Mirror a directory tree (equivalent to /E plus /PURGE)
• zipCmd defines the 7Zip executable and the switches
  a :: This command stands for ‘archive’ or ‘add’. Use it to put files in an archive.
  -tzip :: format zip

I use to goto statements to both run the backup as well as exiting once complete.

:FULL_BACKUP

echo ### Backing up Favorites...
%backupCmd% "%USERPROFILE%\Favorites" "%dailyDrive%\Favorites"

echo ### Compress and Backing up Email...
%zipCmd% C:\Users\SomeUser\Dropbox\Backup\Email\email.zip "%USERPROFILE%\Documents\Outlook Files"\*.pst"

echo ### Backing up Wallpaper...
%backupCmd% "%USERPROFILE%\Documents\Wallpaper" "%dailyDrive%\Wallpaper"

cls
Echo Congratulations you have backed up your data!
goto EXIT_BACKUP

:EXIT_BACKUP
exit

It is important to state that “%USERPROFILE%” is simply the environment variable within Windows for the individual. In the example above I am performing three basic actions:

• Backing of up my favorites
• Compressing and backing up my email
• Backing up my wallpapers

While there is much more data you may wish to backup this should clearly demonstrate how to get started. For example, say you have a folder called “TaxRecords”, all you need to do is add the following to the batch file.

echo ### Backing up the user defined data...
%backupcmd% " c:\TaxRecords" %drive%\TaxRecords"

Finally, add the batch file as a scheduled task or as a start-up item to execute each time you log into Windows. Upon execution you will see a command window similar to the following:

Complete Batch File

@echo off

:: variables
set dailyDrive=C:\Users\SomeUser\Dropbox\Backup
set backupCmd=robocopy /S /Z /COPY:DAT /MIR
set zipCmd="C:\Program Files\7-Zip\7z.exe" a -tzip

cls

goto FULL_BACKUP

:FULL_BACKUP

echo ### Backing up Favorites...
%backupCmd% "%USERPROFILE%\Favorites" "%dailyDrive%\Favorites"

echo ### Compress and Backing up Email...
%zipCmd% C:\Users\SomeUserDropbox\BackupEmail\email.zip "%USERPROFILE%DocumentsOutlook Files"\*.pst"

echo ### Backing up Wallpaper...
%backupCmd% "%USERPROFILE%\Documents\Wallpaper" "%dailyDrive%\Wallpaper"

cls
Echo Congratulations you have backed up your data!
goto EXIT_BACKUP

:EXIT_BACKUP
exit

Conclusion

That is all it takes to backup your important data all without spending anything. Of course as your data needs grow there may be a time that you find yourself needed more than the free 2GB that Dropbox provides and cost for additional space is very reasonable.

Do you have any tips on data backups? If so, leave a comment.

First things first, I am not advocating violating copyright laws and you should clearly understand the Digital Millennium Copyright Act surrounding digital media before you try capturing media. Previously I wrote about How to Backup DVDs with Handbrake and this article is very different in nature. Because you do not own the content that you wish to capture you will likely find yourself in a legal battle should you distribute such content. That being said since I am a paying NetFlix subscriber there are often times that I may be traveling and I don’t have access to the internet. Because of this fact I thought to myself there must be a way to capture that movie or television show and play it on my iPad and then ultimately deleting the media once I have watched it.

In the past few months I have begun using my MacBook Pro more and more and when it comes to digital media and software associated in this area I feel nothing performs better than the Mac Operating System. Case in point is ScreenFlow which is a professional screencasting studio. Just stop and think about it for a moment and I am sure you will begin to understand just how simple it is to capture streaming media.

Recording NetFlix Streaming Media with ScreenFlow on a Mac

• Grab ScreenFlow, a screen video capture software for Mac.
• Launch ScreenFlow for Mac and the following dialog window will appear:

• When you finish your recording, press command-shift-2 to stop recording. ScreenFlow will create a new video files with the recording.
• Press Command-E or select “Export” from the File menu to export your recorded video:

The end result is a high quality recording, grab ScreenFlow and see for yourself.

Update, I just ran across an article titled Media Converter for OS X is the Simplest Drag-And-Drop Video Converter Around where Whitson Gordon says, “If you need to convert a video for your iPod, a DVD, or even just rip the audio out of a movie, free app Media Converter will do it with just a quick drag-and-drop.”

The first step is to create a div wrapper that will contain the photos which is named photo-gallery and will hold the photos.

<h1><span>Microsoft PDC 2009</span></h1>
<a href="#" class="large polaroid img1"><img src="pdc-2009-01.jpg" alt="">PDC #1</a>
<a href="#" class="medium polaroid img2"><img src="pdc-2009-02.jpg" alt="">PDC #2</a>
<a href="#" class="large polaroid img3"><img src="pdc-2009-03.jpg" alt="">PDC #3</a>
<a href="#" class="medium polaroid img4"><img src="pdc-2009-04.jpg" alt="">PDC #4</a>
<a href="#" class="large polaroid img5"><img src="pdc-2009-05.jpg" alt="">PDC #5</a>
<a href="#" class="medium polaroid img6"><img src="pdc-2009-06.jpg" alt="">PDC #6</a>
</div>

.photo-gallery {
	position: relative;
	width: 80%;
	margin: 0 auto;
	max-width: 70em;
	height: 450px;
	margin-top: 5em;
	min-width: 800px;
	max-width: 900px;
}

.photo-gallery .polaroid {
	position: absolute;
}

.photo-gallery h1 {
	position: absolute;
	z-index: 5;
	top: 150px;
	text-align: center;
	width: 100%;
	line-height: 1.9;
}

.photo-gallery h1 span {
	background-color: white;
	font-family: "Helvetica Neue",Arial,Helvetica,sans-serif;
	padding: 0.4em 0.8em 0.3em 0.8em;
	-webkit-box-shadow: 2px 2px 4px rgba(0,0, 0, 0.3);
	-moz-box-shadow: 2px 2px 4px rgba(0,0, 0, 0.3);
	box-shadow: 2px 2px 4px rgba(0,0, 0, 0.3);
	border: 5px solid #000000;
}

.photo-gallery .small {
	width: 75px;
	padding: 6px 6px 12px 6px;
	font-size: 0.6em;
}

.photo-gallery .small img {
	width: 75px;
	height: 75px;
}

.photo-gallery .medium {
	width: 200px;
	padding: 13px 13px 26px 13px;
	font-size: 0.8em;
}

.photo-gallery .medium img {
	width: 200px;
	height: 200px;
}

.photo-gallery .large {
	width: 300px;
	padding: 20px 20px 30px 20px;
	font-size: 1em;
}

.photo-gallery .large img {
	width: 300px;
	height: 300px;
}

.photo-gallery .img1 {
	bottom: 60px;
	right: 565px;
	-webkit-transform: rotate(10deg);
	-moz-transform: rotate(10deg);
	transform: rotate(10deg);
}

.photo-gallery .img2 {
	top: 220px;
	right: 20px;
	-webkit-transform: rotate(-4deg);
	-moz-transform: rotate(-4deg);
	transform: rotate(-4deg);
}

.photo-gallery .img3 {
	left: 250px;
	top: -20px;
	-webkit-transform: rotate(-5deg);
	-moz-transform: rotate(-5deg);
	transform: rotate(-5deg);
}

.photo-gallery .img4 {
	top: 210px;
	left: 215px;
	-webkit-transform: rotate(-20deg);
	-moz-transform: rotate(-20deg);
	transform: rotate(-20deg);
}

.photo-gallery .img5 {
	bottom: 100;
	right: 0;
	-webkit-transform: rotate(1deg);
	-moz-transform: rotate(1deg);
	transform: rotate(1deg);
}

.photo-gallery .img6 {
	bottom: 10px;
	right: 256px;
	-webkit-transform: rotate(6deg);
	-moz-transform: rotate(6deg);
	transform: rotate(6deg);
}

a:hover,
a:focus {
z-index: 5;
}

During my search for a product that would capture media content that I was interested in many came at a cost and did not allow a trial run. I for one typically do not pay up front for something that I am not entirely sure will work as expected. I ran across StreamTransport and best of all it is free, however the author does accept donations. this application is able to browse and download video clips from video hosting websites of HTTP, RTMP, RTMPT, RTMPE, RTMPTE protocol, and these cover overwhelming majority of websites such as Hulu, Veoh, Boxee, Joost, YouTube, Yahoo Video, CBS, etc. Setup is very simple and in no time at all I was capturing media.For example, the following video is that I captured of my daughter playing the piano as a Flash video.

http://www.youtube.com/watch?v=jfImDnjJpsQ?

The user interface is simple in nature and therefore extremely easy to use. All that is needed is to enter a URL and click start. This software will auto capture any video clip being played and you can then download the media with a single click. I love the fact that I can also save the media as MP4 and sych to my iPad for mobility.

As you can see it is very simple to capture that “legal” media that you are interested in. You can download StreamTransport here and if you are in need of a basic, no frills, and free FLV player, I recommend Wimpy. I hope that you find this article useful and if you have any tips and tricks that you would like to share with other readers please leave a comment.

What Is Encryption?

Encryption is the process of changing data into a form that can be read only by the intended receiver. To decipher the message, the receiver of the encrypted data must have the proper decryption key (password). In traditional encryption schemes, the sender and the receiver use the same key to encrypt and decrypt data. In this case the key is the password you supply.

Example Uses For Encryption

Many modern day systems process data which is considered sensitive. For example, doctors store patient information, stock brokers store client financial data and home computer users store personal information on their computers — their own personal information. All this information is vulnerable to exposure in the event of the theft of the computer itself.

Should you find yourself fortunate enough to be developing software in C# then you may find the following code snippets beneficial.

Helper:

public static string Encrypt(string PlainText, string Password, string Salt, string HashAlgorithm, int PasswordIterations, string InitialVector, int KeySize)
{
try
{
byte[] InitialVectorBytes = Encoding.ASCII.GetBytes(InitialVector);
byte[] SaltValueBytes = Encoding.ASCII.GetBytes(Salt);
byte[] PlainTextBytes = Encoding.UTF8.GetBytes(PlainText);
PasswordDeriveBytes DerivedPassword = new PasswordDeriveBytes(Password, SaltValueBytes, HashAlgorithm, PasswordIterations);
byte[] KeyBytes = DerivedPassword.GetBytes(KeySize / 8);
RijndaelManaged SymmetricKey = new RijndaelManaged();
SymmetricKey.Mode = CipherMode.CBC;
ICryptoTransform Encryptor = SymmetricKey.CreateEncryptor(KeyBytes, InitialVectorBytes);
MemoryStream MemStream = new MemoryStream();
CryptoStream cryptoStream = new CryptoStream(MemStream, Encryptor, CryptoStreamMode.Write);
cryptoStream.Write(PlainTextBytes, 0, PlainTextBytes.Length);
cryptoStream.FlushFinalBlock();
byte[] CipherTextBytes = MemStream.ToArray();
MemStream.Close();
cryptoStream.Close();
MemStream.Dispose();
cryptoStream.Dispose();
Encryptor.Dispose();
return Convert.ToBase64String(CipherTextBytes);
}
catch (Exception ex)
{
throw ex;
}
}

Implementation:

Encrypt("mykey", "mypassword", "mysalt", "MD5",5, "qwertyuiqwertyui", 256);

Helper:

public static string Decrypt(string CipherText, string Password, string Salt, string HashAlgorithm, int PasswordIterations, string InitialVector, int KeySize)
{
try
{
byte[] InitialVectorBytes = Encoding.ASCII.GetBytes(InitialVector);
byte[] SaltValueBytes = Encoding.ASCII.GetBytes(Salt);
byte[] CipherTextBytes = Convert.FromBase64String(CipherText);
PasswordDeriveBytes DerivedPassword = new PasswordDeriveBytes(Password, SaltValueBytes, HashAlgorithm, PasswordIterations);
byte[] KeyBytes = DerivedPassword.GetBytes(KeySize / 8);
RijndaelManaged SymmetricKey = new RijndaelManaged();
SymmetricKey.Mode = CipherMode.CBC;
ICryptoTransform Decryptor = SymmetricKey.CreateDecryptor(KeyBytes, InitialVectorBytes);
MemoryStream MemStream = new MemoryStream(CipherTextBytes);
CryptoStream cryptoStream = new CryptoStream(MemStream, Decryptor, CryptoStreamMode.Read);
byte[] PlainTextBytes = new byte[CipherTextBytes.Length];
int ByteCount = cryptoStream.Read(PlainTextBytes, 0, PlainTextBytes.Length);
MemStream.Close();
cryptoStream.Close();
MemStream.Dispose();
cryptoStream.Dispose();
Decryptor.Dispose();
return Encoding.UTF8.GetString(PlainTextBytes, 0, ByteCount);
}
catch (Exception ex)
{
throw ex;
}
}

Implementation:

Decrypt("ND5lYPo4czOk5ZT7KNmU2Q==", "mypassword", "mysalt", "MD5",5, "qwertyuiqwertyui", 256);

There you have it. Now there is no reason to secure your sensitive data.

A system image is an exact copy of a drive. By default, a system image includes the drives required for Windows to run. It also includes Windows and your system settings, programs, and files. You can use a system image to restore the contents of your computer if your hard disk or computer ever stops working. When you restore your computer from a system image, it’s a complete restoration—you can’t choose individual items to restore, and all of your current programs, system settings, and files are replaced with the contents of the system image.

You should know that an image will contain any data you may have but do not confuse an image with a backup. The do differ greatly, for this reason you must implement a backup plan.

Why Have A Data Backup Plan

There are instances when a computer becomes your life and you would feel completely lifeless without it. I know some people may say people should get a life, but if you work in the field of Information Technology you have no recourse but to regularly backup your data. There are various reasons for the failure and I will not begin to list them. Just know this, what can go wrong will go wrong! For this reason consider a backup plan that works best for you.

Create A System Image

Open the Control Panel and select “Back up your computer“:

Click “Create system image“:

Decide where you want to save the image:

Confirm your backup:

As you can from the screen shot above, a high number of blank DVD disc will be required. Once the process completes be sure to store these disc in a safe location for future needs. When you are ready to restore the system image utilize the “System Recover Options” to refresh your computer.

Once you complete this process your computer is as it was the day you first opened it with the difference being you also have all your software in place. Not bad! I can tell you from first hand experience that the process is painless both in the area of creating and restoring an image and it does in fact save a great deal of time in the event you want to format your computer and start from scratch.

Trust me, a little time spent up front can both save time in the future. A system image is a must for anyone who is picky about housekeeping when it comes to a safe a reliable computer.

Now the hurdle I faced was to be able to peek at the class files in a manner that they were readable by the human eye. Before I proceed any further take a moment to understand what a JAR file is in the event you are not sure.

In computing software, a JAR file (or Java Archive) aggregates many files into one. Software developers generally use .jar files to distribute Java applications or libraries, in the form of classes and associated metadata and resources (text, images, etc.) JAR files build on the ZIP file format. Computer users can create or extract JAR files using the jar command that comes with a JDK. (via WikiPedia)

There probably are a number of ways to extract a JAR file, but I do not recall the syntax for doing this, therefore I turned to a piece of software to help me do this job. For the purpose of this discuss, I will discuss two products that I am aware of which are JD-GUI are DJ Java Decompiler. Each of these software products will do the job, but there are differences from my point of view and I will cover these later.

JD-GUI

This product is the clear winner from my point of view. It is free (donate if you use it, developers have to eat also) and it requires no installation, extremely small in size, and comes in Windows, Linux, and Apple flavors.

DJ Java Decompiler

This product is much more robust and may be overkill, in the context of my need I saw no need to open up my wallet.

I hope these two products can help you in the event you find yourself in a similar situation as myself. Do you now of any other products or a command line interface to extract classes? If so, please leave a comment and share with the other readers.