SQL Injection Cheat Seet

Good notes on SQL Injection:
http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/

Frequent SSL Troubleshooting Commands

Frequent SSL Troubleshooting commands from: http://shib.kuleuven.be/docs/ssl_commands.shtml


debug an SSL connection [server doesn't require certificate authentication]
openssl s_client -connect idp.example.be:443


debug an SSL connection with mutual certificate authentication
openssl s_client -connect idp.example.be:8443 -CAfile MY-CA-CERT.crt -cert MYCERT.crt -key MYKEY.key
- trust chain is in directory (hash format): replace -CAfile with -CApath /path/to/CAchainDir/
- send the starttls command (smtp or pop3 style): -starttls smtp or -starttls pop3


List the certificates inside a keystore
keytool -list -v -keystore KEYSTORE.jks


create self-signed certificate (can be used to sign other certificates)
openssl req -x509 -new -out MYCERT.crt -keyout MYKEY.key -days 365

Checklist for adding new interface on a CheckPoint FW

Checklist for adding a new CheckPoint Interface:
- Add to Toplogy on Firewall/Cluster Object in SmartDashboard
- Add necessary routes
- Add no-nat for new network
- Add new network to appropriate anti-spoofing object groups

Show the name of the installed CheckPoint Policy

fw stat

How to debug a CheckPoint VPN Connection

vpn debug trunc
vpn debug ikeon
vpn debug ikeoff

• Logs will be in: $FWDIR\log\ike.elg
• Can also use CheckPoint "IKEView" tool to parse ike.elg.

CheckPoint SecureClient Ports

    * protocol 50 for ESP
    * UDP 2746 for UDP Encapsulation
    * TCP 18231 for Policy Server logon/FW1_pslogon_NG
    * UDP 18233 for Keepalive protocol/FW1_scv_keep_alive
    * TCP 18232 for Distribution Server/FW1_sds_logon
    * UCP 259 for MEP configuration-RDP
    * UDP 18234 for performing tunnel test when the client is inside the network
    * TCP 18264 for ICA certificate registration-FW1_ica_services
    * UDP 500 for IKE
    * TCP 500 for IKE over TCP
    * UDP 4500 for IKE and IPSEC (NAT-T)
    * TCP 264 for topology download

SecureClient/SecureRemote Troubleshooting Steps

1. Upgrade to latest SecureClient/SecureRemote build.
2. Check connectivity to gateways.
3. Make sure no network interface card is configured on the SecureClient/SecuRemote client with an IP address that belongs to the encryption domain or internal network.
4. Confirm encryption methods are supported both by FW-1 and SecureRemote/SecureClient.
5. Verify Encryption and key setup on the SecureClient.
6. Confirm Interfaces tab of the FW object contains the NIC driver device names.
7. Make sure there is only one default route from the FW to the Internet.
8. Make sure there are not multiple routes to the Internet from the workstation, server, or network objects included in the encryption domain.
9. If SecureClient/SecureRemote can't connect to a workstation inside the network, make sure the object is in the encryption domain.
10. if multiple network objects are defined for the same firewall,  this might lead to enc. tunnel failure.
11. Verify that the hosts table and DNS entries for the firewall match.
12. Check the userc.C file to make sure information is being sent to the SC/SR machine.
13. Make sure the ISP is not blocking certain ports.


SecureRemote = Free
Office Mode = SecureClient


OfficeMode needs a route to the external interface for the Office Mode network.
i.e., 172.16.18.0/24 123.123.123.123 eth0


Make sure policy server is running:
[Expert@firewall]# cpstat -f all polsrv


Check SecureRemote licenses:
[Expert@firewall]# dtps lic


----
Office Mode, which allows you to specify precisely what IP address a client gets, what DNS and WINS servers it gets and the default DNS domain.


Visitor Mode, which is a way to encapsulate IPSec over HTTPS. It allows remote VPN connections to work where IPSec might have issues.


Secure Configuration Verification, a method where the SecureClient software checks various configuration parameters of the client and will not let it connect if it doesn't meet the required configuration.

How to upgrade CheckPoint from R61 to R65

This entry provides the steps for performing an upgrade (R61 to R65) on a CheckPoint cluster and applying the HFA02 hot fix.  This assumes the upgrade files (R65.iso and hfa02.tgz) have been copied to /var/tmp/R65 on both boxes.


Prior to beginning, create a SPLAT backup and snapshot (commands are "backup" and "snapshot"), and copy them off the box for safe keeping.


Here is the procedure for the upgrade:


1)  Login to Dashboard and change the version of the Cluster firewall object to R65.  Save and perform an install database (do not push policy)!
2)  Select the backup firewall first and perform a cphastop and cpstop
3)  Mount the ISO:

• cd /var/tmp/R65
• mount -o loop  R65_CD1.iso /mnt/cdrom
• patch add cd

Choose a patch to install:
1) SecurePlatform NGX R65 Upgrade Package (CPspupgrade_R65.tgz)
2) Exit


Your choice: 1


Calculating the MD5 checksum of the package.
The MD5 checksum is: 67d9c047965fe71da7b93939becd1da0
Is that right (Y/N)? y
------------------------------------------------------------------------------------------
Upgrade program will now upgrade your system. This process may take several minutes ..

• *click n*
• *click n*

Do you accept all the terms of this license agreement (Yes/Exit) ?: Click Y for yes


Please select the SmartCenter upgrade option
1 (*) Upgrade
2 ( ) Export SmartCenter configuration
3 ( ) Perform pre-upgrade verification only

• *click n*

Please specify one of the following upgrade options:
1 (*) Upgrade installed products
2 ( ) Upgrade installed products and install new products

• *click n*

You have selected the following products for installation:
* Primary SmartCenter


*click n*
*click n*
*click n*


The upgrade process requires a valid support contract.
1 ( ) Download contract information from User Center
2 ( ) Import a local service contract file
3 (*) Continue without contract information (download later using SmartUpdate)

• *click n*

Your gateway is not eligible for upgrade.
Please remember to download contract information later using SmartUpdate.


Please select the source of the upgrade utilities.
The most up-to-date upgrade utilities are located at Check Point's website


1 ( ) Download most updated files from Check Point's website (recommended)
2 (*) Use the upgrade files from the CD

• *click n*

The pre-Upgrade Verification was completed successfully.
Your configuration is ready for upgrade.

• Click o for ok

Upgrade of Check Point products has been successfully completed.
Installation finished successfully


Please remove Check Point CD from the CDROM drive.
Upgrade files completed successfully.


-------------------------------------------------------------------
In order to complete the upgrade process please reboot your system!
-------------------------------------------------------------------
Patch installed successfully.
[Expert@firewall]# reboot
--------------------------------------------------------------------


Upon reboot perform the following
1) fw ver  (should be R65)
2) fw stat  (should be initial policy)
3) cphaprob stat  ( it should not be taking traffic- it should just say ready)


Before pushing policy we need to patch it with hfa02.
reboot then check following again:


1) fw ver  (should be R65)
2) fw stat  (should be initial policy)
3) cphaprob stat  ( it should not be taking traffic- it should just say ready)
4) Push policy (use the setting that will push policy even if it fails as one of the devices is still running older fw ver.)
5) Once policy successfully installed run:

•             fw stat (on new cluster member - validate policy installed)
•             cphaprob stat (make sure at 100% active)
•             jump on the acitve/primary fw and run 
•             cphastop
•             cpstop
•             get back on primary and run cphaprob to make sure your newly upgraded server is taking connections.

Repeat on active/primary

How to install a CheckPoint HFA (hot fix accumulator)

** SPLAT & LINUX **


1. SCP (SSH secure copy) the HFA files to the box
2. Create a backup - Splat GUI -> Backup (or type "backup" from the CLI)
3. Untar the HFA (tar -xzvf HFA.tgz)
4. Run the install script: /var/HFA/./UnixInstallScript
5. Reboot
6. Push Policiy


Confirm firewall version shows upgraded HFA version:
fw ver
cpshared_ver


[Expert@firewall]# fw ver
This is Check Point VPN-1(TM) & FireWall-1(R) NGX (R61) HFA_01, Hotfix 601 - Build 012

Policy Based Routing Example on Juniper Netscreen/SSG

set vrouter trust-vr
set access-list extended 100 src-ip 10.1.1.7/24 dst-ip 10.2.2.2/32 dest-port 22-22 protocol tcp entry 1 
set access-list extended 100 src-ip 10.1.1.7/24 dst-ip 10.2.2.2/32 dest-port 443-443 protocol tcp entry 2


set match-group name PBR_GROUP
set match-group PRB_ROUTE ext-acl 10 match-entry 1 
set match-group PRB_ROUTE ext-acl 10 match-entry 2 


set action-group name Action_PBR_ROUTE
set action-group Action_PBR_ROUTE next-hop 10.1.2.7 action-entry 1 
set action-group Action_PBR_ROUTE next-interface ethernet2 action-entry 2
set pbr policy Redirect_PBR_ROUTE match-group PBR_GROUP action-group Action_PBR_ROUTE 1 exit
set interface ethernet4 pbr Redirect_PBR_GROUP set vrouter trust-vr pbr Redirect_PBR_ROUTE

Use snoop (packet capture) on Juniper Netscreen/SSG

snoop filter ip src-ip  
snoop filter ip dst-ip 
snoop filter on
snoop

Useful troubleshooting commands on Juniper Netscreen/SSG

get event
get av all
get av scan
get av stat
get mem
get session info
get os task
get perf cpu all detail
get perf session detail
get socket
get log sys

Perform offline attack update using guiSvrCli.sh if the NSM server does not have internet access

Perform Juniper NSM offline attack update using guiSvrCli.sh if the NSM server does not have internet access (KB ID: KB10092)


./guiSvrCli.sh --attack-update --post-action -none          

Debug AV Scan-Mgr Updates on a Juniper Netscreen/SSG?

How To: Debug AV Scan-Mgr Updates on a Juniper Netscreen/SSG? 
debug scan-mgr pm


For details, see http://kb.juniper.net/KB7250

Juniper USB Flash Drive

The Juniper USB flash drive is USB 2.0 compliant.  The maximum USB flash that can be used is 1 GB.  This applies to SSG-5, SSG-20, SSG-140, SSG-520, and SSG-550.


To list the contents of the flash memory, run:

Firewall(M)-> exec vfs ls flash:

    CONFIG.BIN                112            

    $NSBOOT$.BIN              10,246,895     

  488,284,160 bytes free (515,506,176 total) on disk

Setting MSS (Maximum Segment Size) on Netscreen/SSG

By default it is set at 1500. If you're experiencing issues with MSS, trying lowering it to 1360.


set flow all-tcp-mss 1360

Set Netscreen/SSG Interface as Manageable

From the command line, it should look similiar to this:


set interface trust ip manageable
set interface trust manage ping
set interface trust manage ssh
set interface trust manage-ip 10.1.1.0/24
set ssh version v2
set ssh enable
save


Note: You may need to subsitute "trust" with the actual interface name of the trust interface from "get int".


From the GUI, this can be done through: 
1) Admin -> Permitted IPs & Admin -> Management Enable SSH (V2) & Enable SCP
2) Network -> Interfaces -> Edit -> Service Options -> Management Services -> SSH/Ping

Troubleshoot Performance Issues on Juniper Netscreen/SSG

get performance cpu
get counters
show alarm ?
get event level alert
get event level critical
get event level emergency
get event level warning

Lost Admin Password for Juniper Netscreen/SSG

This is a last resort to restoring a Netscreen/SSG to factory default settings if the administrative password has been lost. Note: This will remove your configuration and reset the device to factory default settings.


Items Needed:

Laptop
Serial Console Cable w/ RJ-45 End
Crossover (PC -> PC) Ethernet Cable
Serial Number (from sticker on back of the Netscreen/SSG device)


Device Recovery:
1) Console Connection (Console -> Hyperterm -> Baud Rate 9600 & Flow = None -> Enter)
2) Username/Password = Serial # / Serial #
3) Yes / Yes
4) Reset Device
5) Login with netscreen/netscreen @ 192.168.1.1 (factory default IP)
(Ethernet -> Laptop -> Trust Interface -> Set your laptop laptop = 192.168.1.2, and browse to the firewall at 192.168.1.1).


Reconfigure Basic Access
Then use the GUI or CLI to reconfigure the Untrust interface and default gateway for outside access.
set interface "ethernet0" zone "Untrust"
set interface ethernet0 ip 1.1.1.2/24
set interface ethernet0 route
set interface ethernet0 ip manageable
set interface ethernet0 manage-ip 1.1.1.2
set interface ethernet0 manage scs
set interface ethernet0 manage ssl
set interface ethernet0 manage web
set scs enable
set route 0.0.0.0/0 interface ethernet0 gateway 1.1.1.1

Packet Capture on a Juniper Netscreen/SSG

--
Basic Traffic Capture
--
Set up capture
clear db
set console dbuf
set ffilter src-ip 1.1.1.1 dst-ip 2.2.2.2
debug flow basic

generate some traffic


view the output of the capture
get dbuf stream


when done, turn off debugging-
undebug all

--

Example to Capture VPN/IPSEC Traffic:

--

set console dbuf

set ffilter dst-ip 1.1.1.1 ip-proto 50

set ffilter src-ip 1.1.1.1 ip-proto 50

debug ike basic

debug flow all

cl db

get dbuf stream