Technology Errors

vsftpd: pam_listfile(vsftpd:auth): Refused user root for service vsftpd

ErrorsLeave a comment

If you are attempting to FTP to a server running vsftpd as its FTP daemon you will be refused if this is a default vsftpd installation. It is strongly recommended to not allow root access to FTP because of security concerns which would provide the ftp user access to destroy anything on the server running FTP at will. Regardless it might be necessary for specific tasks and the below information will assist you in configuring vsftpd to allow the root user to login.

Information Security

weevely – Backtrack 5 – Maintaining Access – Web Backdoors – weevely

SecurityLeave a comment

Need a quick way to generate a PHP backdoor for a compromised server you want to come back to later, then weevely is your application. I was pleasantly surprised when I started playing around with weevely in more detail as it provides a ton of built in functionality and does a lot more than I initially though that weevely did. The weevely application is built using Python and its current version on Backtrack 5 R3 is weevely v0.7. The weevley.py Python script is located in the /pentest/backdoors/web/weevely directory and some of its uses are described in more detail below.

Information Security

xplico – Backtrack 5 – Information Gathering – Network Analysis – Network Traffic Analysis – xplico

SecurityLeave a comment

Xplico is a NFAT or Network Forensics Analysis Tool that is designed to either capture traffic in real time sessions or to provide an interface to upload PCAP (Packet Capture Data) files for analysis. The current version in Backtrack Linux 5 release 3 is 0.7 however the latest Xplico version is Xplico 1.0.1. I believe there are some dependencies required in the later versions of Xplico so I will write an updated article once Backtrack 6 comes up and the latest version of Xplico can easily be installed.

Technology Insights

View Historical Bandwidth Usage On FortiGate 200A Including Amount Of Bandwidth Per Protocol

InsightsLeave a comment

A company asked me to analyze some of their network traffic to verify some of the projects they are working on to cut costs won’t impact their business. One of the projects includes removing a 100 Mbps fiber connection to their colocation and replacing it with a cable modem that is asynchronous with 50 Mbps download and 5 Mbps upload. Unfortunately they do not have any solid historical network data capture software such as Cacti so before setting up such a service I had to provide initial data via what was available. One of the tools I was able to use was the dashboard data that lives in memory on their FortiGate 200A. Below is information on where to find this information in the FortiGate 200A dashboard.

Technology Insights

How To Not Be Prompted For Every File When Using Linux FTP mget Command

InsightsLeave a comment

The other day I was attempting to use the Linux ftp command line application to obtain all of the files, sub directories, and files within the sub directories from an FTP site. The first issue I ran into was the issue of being prompted to confirm each and every file that is downloaded. Below I describe how to accomplish turning off the prompt and just to note I ended up using “wget” to download all of the files, sub directories, and files within the sub directories via FTP on the remote server.