반응형


1. 빠른 파일 검색


사이트 : http://www.voidtools.com/

프로그램명 : everything



Everything-1.2.1.371.exe





설치 후 실행 화면



TOOLS -> OPTIONS -> HTTP 탭


사용하는 포트 정보 설정 가능


TOOLS -> Start HTTP Server 를 통해 웹 서비스 가능


즉, 웹을 통해 찾을려는 파일등을 쉽게 검색 가능함





2. 파일 내용 검색


사이트 : http://astrogrep.sourceforge.net/

프로그램명 : Astrogrep



AstroGrep_v4.3.0.zip


: 정규 표현식 (. 표준 마이크로 소프트 닷넷 정규식 사용 - 빠른 참조 ) 
동시 여러 파일 형식 - 
- 재귀 디렉토리 검색 
- 위하고 검색 아래 식을 줄을 선택 "컨텍스트"기능 
- 가장 최근에 사용을 검색 경로에 대한 목록 
다소 다양한 인쇄 옵션 - 
- 당신의 선택의 편집기를 사용하여 파일을 열려면 두 번 클릭 
- 상점 가장 최근에 사용한 파일 이름 및 검색 식 
- 단어 단위 만 
- 구문 highlighing 

- 무료 및 오픈 소스의 무료


MS 계열에 정규식 표현 가능...




Regular Expression Language - Quick Reference

.NET Framework 4.5
85 out of 96 rated this helpful Rate this topic

A regular expression is a pattern that the regular expression engine attempts to match in input text. A pattern consists of one or more character literals, operators, or constructs. For a brief introduction, see .NET Framework Regular Expressions.

Each section in this quick reference lists a particular category of characters, operators, and constructs that you can use to define regular expressions:

The backslash character (\) in a regular expression indicates that the character that follows it either is a special character (as shown in the following table), or should be interpreted literally. For more information, see Character Escapes in Regular Expressions.

Escaped character

Description

Pattern

Matches

\a

Matches a bell character, \u0007.

\a

"\u0007" in "Error!" + '\u0007'

\b

In a character class, matches a backspace, \u0008.

[\b]{3,}

"\b\b\b\b" in "\b\b\b\b"

\t

Matches a tab, \u0009.

(\w+)\t

"item1\t", "item2\t" in "item1\titem2\t"

\r

Matches a carriage return, \u000D. (\r is not equivalent to the newline character, \n.)

\r\n(\w+)

"\r\nThese" in "\r\nThese are\ntwo lines."

\v

Matches a vertical tab, \u000B.

[\v]{2,}

"\v\v\v" in "\v\v\v"

\f

Matches a form feed, \u000C.

[\f]{2,}

"\f\f\f" in "\f\f\f"

\n

Matches a new line, \u000A.

\r\n(\w+)

"\r\nThese" in "\r\nThese are\ntwo lines."

\e

Matches an escape, \u001B.

\e

"\x001B" in "\x001B"

\ nnn

Uses octal representation to specify a character (nnn consists of two or three digits).

\w\040\w

"a b", "c d" in

"a bc d"

\x nn

Uses hexadecimal representation to specify a character (nn consists of exactly two digits).

\w\x20\w

"a b", "c d" in

"a bc d"

\c X

\c x

Matches the ASCII control character that is specified by X or x, where X or x is the letter of the control character.

\cC

"\x0003" in "\x0003" (Ctrl-C)

\u nnnn

Matches a Unicode character by using hexadecimal representation (exactly four digits, as represented by nnnn).

\w\u0020\w

"a b", "c d" in

"a bc d"

\

When followed by a character that is not recognized as an escaped character in this and other tables in this topic, matches that character. For example, \* is the same as \x2A, and \. is the same as \x2E. This allows the regular expression engine to disambiguate language elements (such as * or ?) and character literals (represented by \* or \?).

\d+[\+-x\*]\d+\d+[\+-x\*\d+

"2+2" and "3*9" in "(2+2) * 3*9"

Back to top

A character class matches any one of a set of characters. Character classes include the language elements listed in the following table. For more information, see Character Classes in Regular Expressions.

Character class

Description

Pattern

Matches

[ character_group ]

Matches any single character in character_group. By default, the match is case-sensitive.

[ae]

"a" in "gray"

"a", "e" in "lane"

[^ character_group ]

Negation: Matches any single character that is not in character_group. By default, characters in character_group are case-sensitive.

[^aei]

"r", "g", "n" in "reign"

[ first - last ]

Character range: Matches any single character in the range from first to last.

[A-Z]

"A", "B" in "AB123"

.

Wildcard: Matches any single character except \n.

To match a literal period character (. or \u002E), you must precede it with the escape character (\.).

a.e

"ave" in "nave"

"ate" in "water"

\p{ name }

Matches any single character in the Unicode general category or named block specified by name.

\p{Lu}

\p{IsCyrillic}

"C", "L" in "City Lights"

"Д", "Ж" in "ДЖem"

\P{ name }

Matches any single character that is not in the Unicode general category or named block specified by name.

\P{Lu}

\P{IsCyrillic}

"i", "t", "y" in "City"

"e", "m" in "ДЖem"

\w

Matches any word character.

\w

"I", "D", "A", "1", "3" in "ID A1.3"

\W

Matches any non-word character.

\W

" ", "." in "ID A1.3"

\s

Matches any white-space character.

\w\s

"D " in "ID A1.3"

\S

Matches any non-white-space character.

\s\S

" _" in "int __ctr"

\d

Matches any decimal digit.

\d

"4" in "4 = IV"

\D

Matches any character other than a decimal digit.

\D

" ", "=", " ", "I", "V" in "4 = IV"

Back to top

Anchors, or atomic zero-width assertions, cause a match to succeed or fail depending on the current position in the string, but they do not cause the engine to advance through the string or consume characters. The metacharacters listed in the following table are anchors. For more information, see Anchors in Regular Expressions.

Assertion

Description

Pattern

Matches

^

The match must start at the beginning of the string or line.

^\d{3}

"901" in

"901-333-"

$

The match must occur at the end of the string or before \n at the end of the line or string.

-\d{3}$

"-333" in

"-901-333"

\A

The match must occur at the start of the string.

\A\d{3}

"901" in

"901-333-"

\Z

The match must occur at the end of the string or before \n at the end of the string.

-\d{3}\Z

"-333" in

"-901-333"

\z

The match must occur at the end of the string.

-\d{3}\z

"-333" in

"-901-333"

\G

The match must occur at the point where the previous match ended.

\G\(\d\)

"(1)", "(3)", "(5)" in "(1)(3)(5)[7](9)"

\b

The match must occur on a boundary between a \w (alphanumeric) and a \W (nonalphanumeric) character.

\b\w+\s\w+\b

"them theme", "them them" in "them theme them them"

\B

The match must not occur on a \b boundary.

\Bend\w*\b

"ends", "ender" in "end sends endure lender"

Back to top

Grouping constructs delineate subexpressions of a regular expression and typically capture substrings of an input string. Grouping constructs include the language elements listed in the following table. For more information, see Grouping Constructs in Regular Expressions.

Grouping construct

Description

Pattern

Matches

( subexpression )

Captures the matched subexpression and assigns it a one-based ordinal number.

(\w)\1

"ee" in "deep"

(?< name >subexpression)

Captures the matched subexpression into a named group.

(?<double>\w)\k<double>

"ee" in "deep"

(?< name1 - name2 >subexpression)

Defines a balancing group definition. For more information, see the "Balancing Group Definition" section in Grouping Constructs in Regular Expressions.

(((?'Open'\()[^\(\)]*)+((?'Close-Open'\))[^\(\)]*)+)*(?(Open)(?!))$

"((1-3)*(3-1))" in "3+2^((1-3)*(3-1))"

(?: subexpression)

Defines a noncapturing group.

Write(?:Line)?

"WriteLine" in "Console.WriteLine()"

(?imnsx-imnsx:subexpression)

Applies or disables the specified options within subexpression. For more information, seeRegular Expression Options.

A\d{2}(?i:\w+)\b

"A12xl", "A12XL" in "A12xl A12XL a12xl"

(?= subexpression)

Zero-width positive lookahead assertion.

\w+(?=\.)

"is", "ran", and "out" in "He is. The dog ran. The sun is out."

(?! subexpression)

Zero-width negative lookahead assertion.

\b(?!un)\w+\b

"sure", "used" in "unsure sure unity used"

(?<= subexpression)

Zero-width positive lookbehind assertion.

(?<=19)\d{2}\b

"99", "50", "05" in "1851 1999 1950 1905 2003"

(?<! subexpression)

Zero-width negative lookbehind assertion.

(?<!19)\d{2}\b

"51", "03" in "1851 1999 1950 1905 2003"

(?> subexpression)

Nonbacktracking (or "greedy") subexpression.

[13579](?>A+B+)

"1ABB", "3ABB", and "5AB" in "1ABB 3ABBC 5AB 5AC"

Back to top

A quantifier specifies how many instances of the previous element (which can be a character, a group, or a character class) must be present in the input string for a match to occur. Quantifiers include the language elements listed in the following table. For more information, see Quantifiers in Regular Expressions.

Quantifier

Description

Pattern

Matches

*

Matches the previous element zero or more times.

\d*\.\d

".0", "19.9", "219.9"

+

Matches the previous element one or more times.

"be+"

"bee" in "been", "be" in "bent"

?

Matches the previous element zero or one time.

"rai?n"

"ran", "rain"

{ n }

Matches the previous element exactly n times.

",\d{3}"

",043" in "1,043.6", ",876", ",543", and ",210" in "9,876,543,210"

{ n ,}

Matches the previous element at least n times.

"\d{2,}"

"166", "29", "1930"

{ n , m }

Matches the previous element at least n times, but no more than m times.

"\d{3,5}"

"166", "17668"

"19302" in "193024"

*?

Matches the previous element zero or more times, but as few times as possible.

\d*?\.\d

".0", "19.9", "219.9"

+?

Matches the previous element one or more times, but as few times as possible.

"be+?"

"be" in "been", "be" in "bent"

??

Matches the previous element zero or one time, but as few times as possible.

"rai??n"

"ran", "rain"

{ n }?

Matches the preceding element exactly n times.

",\d{3}?"

",043" in "1,043.6", ",876", ",543", and ",210" in "9,876,543,210"

{ n ,}?

Matches the previous element at least n times, but as few times as possible.

"\d{2,}?"

"166", "29", "1930"

{ n , m }?

Matches the previous element between n and m times, but as few times as possible.

"\d{3,5}?"

"166", "17668"

"193", "024" in "193024"

Back to top

A backreference allows a previously matched subexpression to be identified subsequently in the same regular expression. The following table lists the backreference constructs supported by regular expressions in the .NET Framework. For more information, see Backreference Constructs in Regular Expressions.

Backreference construct

Description

Pattern

Matches

\ number

Backreference. Matches the value of a numbered subexpression.

(\w)\1

"ee" in "seek"

\k< name >

Named backreference. Matches the value of a named expression.

(?<char>\w)\k<char>

"ee" in "seek"

Back to top

Alternation constructs modify a regular expression to enable either/or matching. These constructs include the language elements listed in the following table. For more information, see Alternation Constructs in Regular Expressions.

Alternation construct

Description

Pattern

Matches

|

Matches any one element separated by the vertical bar (|) character.

th(e|is|at)

"the", "this" in "this is the day. "

(?( expression )yes | no )

Matches yes if the regular expression pattern designated by expression matches; otherwise, matches the optional nopart. expression is interpreted as a zero-width assertion.

(?(A)A\d{2}\b|\b\d{3}\b)

"A10", "910" in "A10 C103 910"

(?( name ) yes |no )

Matches yes if name, a named or numbered capturing group, has a match; otherwise, matches the optional no.

(?<quoted>")?(?(quoted).+?"|\S+\s)

Dogs.jpg, "Yiska playing.jpg" in "Dogs.jpg "Yiska playing.jpg""

Back to top

Substitutions are regular expression language elements that are supported in replacement patterns. For more information, see Substitutions in Regular Expressions. The metacharacters listed in the following table are atomic zero-width assertions.

Character

Description

Pattern

Replacement pattern

Input string

Result string

$ number

Substitutes the substring matched by group number.

\b(\w+)(\s)(\w+)\b

$3$2$1

"one two"

"two one"

${ name }

Substitutes the substring matched by the named group name.

\b(?<word1>\w+)(\s)(?<word2>\w+)\b

${word2} ${word1}

"one two"

"two one"

$$

Substitutes a literal "$".

\b(\d+)\s?USD

$$$1

"103 USD"

"$103"

$&

Substitutes a copy of the whole match.

(\$*(\d*(\.+\d+)?){1})

**$&

"$1.30"

"**$1.30**"

$`

Substitutes all the text of the input string before the match.

B+

$`

"AABBCC"

"AAAACC"

$'

Substitutes all the text of the input string after the match.

B+

$'

"AABBCC"

"AACCCC"

$+

Substitutes the last group that was captured.

B+(C+)

$+

"AABBCCDD"

AACCDD

$_

Substitutes the entire input string.

B+

$_

"AABBCC"

"AAAABBCCCC"

Back to top

You can specify options that control how the regular expression engine interprets a regular expression pattern. Many of these options can be specified either inline (in the regular expression pattern) or as one or more RegexOptions constants. This quick reference lists only inline options. For more information about inline and RegexOptions options, see the article Regular Expression Options.

You can specify an inline option in two ways:

  • By using the miscellaneous construct (?imnsx-imnsx), where a minus sign (-) before an option or set of options turns those options off. For example, (?i-mn) turns case-insensitive matching (i) on, turns multiline mode (m) off, and turns unnamed group captures (n) off. The option applies to the regular expression pattern from the point at which the option is defined, and is effective either to the end of the pattern or to the point where another construct reverses the option.

  • By using the grouping construct (?imnsx-imnsx:subexpression), which defines options for the specified group only.

The .NET Framework regular expression engine supports the following inline options.

Option

Description

Pattern

Matches

i

Use case-insensitive matching.

\b(?i)a(?-i)a\w+\b

"aardvark", "aaaAuto" in "aardvark AAAuto aaaAuto Adam breakfast"

m

Use multiline mode. ^ and $ match the beginning and end of a line, instead of the beginning and end of a string.

For an example, see the "Multiline Mode" section in Regular Expression Options.

n

Do not capture unnamed groups.

For an example, see the "Explicit Captures Only" section inRegular Expression Options.

s

Use single-line mode.

For an example, see the "Single-line Mode" section in Regular Expression Options.

x

Ignore unescaped white space in the regular expression pattern.

\b(?x) \d+ \s \w+

"1 aardvark", "2 cats" in "1 aardvark 2 cats IV centurions"

Back to top

Miscellaneous constructs either modify a regular expression pattern or provide information about it. The following table lists the miscellaneous constructs supported by the .NET Framework. For more information, see Miscellaneous Constructs in Regular Expressions.

Construct

Definition

Example

(?imnsx-imnsx)

Sets or disables options such as case insensitivity in the middle of a pattern. For more information, see Regular Expression Options.

\bA(?i)b\w+\b matches "ABA", "Able" in "ABA Able Act"

(?# comment)

Inline comment. The comment ends at the first closing parenthesis.

\bA(?#Matches words starting with A)\w+\b

# [to end of line]

X-mode comment. The comment starts at an unescaped # and continues to the end of the line.

(?x)\bA\w+\b#Matches words starting with A

Back to top


반응형
반응형

살다보면


모든 환경에서 쓸일이 있다... -_-...




EchoServer.java 파일(1024 포트 사용 예)

 import java.io.* ;

import java.net.* ;

class EchoServer {

public static void main( String[] args )

 throws IOException {

// 포트 설정

int port = 1024 ;

// 서버 소켓 생성

ServerSocket ss = new ServerSocket(port) ;

System.out.println( "Server Ready" ) ;

// 클라이언트 연결을 계속해서 받는다.

while( true ) {

// 클라이언트 연결을 받는다.

Socket client = ss.accept() ;

// 네트워크 입출력 스트림 설정

BufferedReader net_in = 

new BufferedReader( new InputStreamReader( client.getInputStream() ) ) ;

PrintWriter net_out = 

new PrintWriter( new OutputStreamWriter( client.getOutputStream() ) ) ;

System.out.println( "Client Socket Accepted" + client ) ;

System.out.flush() ;

// 클라이언트의 데이터를 받는다.

String line ;

line = net_in.readLine() ;

// 받은 데이터를 다시 전송한다.

net_out.println( line ) ;

net_out.flush() ;

}

}

}





EchoClient.java 파일 내용


 import java.io.* ;

import java.net.* ;

class EchoClient {

public static void main( String[] args )

 throws IOException {

// 접속 대상 설정

String host = "127.0.0.1" ;

int port = 1024 ;

// 소켓을 생성

Socket s = new Socket( host , port ) ;

System.out.println( "Client Socket Created" + s ) ;

System.out.flush() ;

// 네트워크 통신을 위한 스트림 설정

Reader from_server = new InputStreamReader(s.getInputStream()) ;

PrintWriter to_server = 

new PrintWriter(new OutputStreamWriter(s.getOutputStream()) ) ;

// 콘솔 입출력을 위한 스트림 설정

BufferedReader from_user = 

new BufferedReader( new InputStreamReader( System.in ) ) ;

PrintWriter to_user = 

new PrintWriter( new OutputStreamWriter( System.out ) ) ;

// 사용자의 입력을 받는다.

String line ;

while( (line = from_user.readLine()) != null ) {

// 받은 입력은 네트워크로 전송한다.

to_server.println( line ) ;

to_server.flush() ;

// 네트워크에서 데이터를 받는다.

int char_cnt ;

char[] buffer = new char[1024] ;

char_cnt = from_server.read(buffer) ;

// 받은 데이터를 화면에 뿌린다.

to_user.write( buffer , 0 , char_cnt ) ;

to_user.flush() ;

}

}

}


특정 서버에 대한 포트 스캔 프로그램 (PortScanner.java)


 import java.net.*;

public class PortScanner {

public static void main(String args[]) {

int startPortRange=0;

int stopPortRange=0;

startPortRange = Integer.parseInt(args[0]);

stopPortRange = Integer.parseInt(args[1]);

for (int i=startPortRange; i <=stopPortRange; i++) {

try {

Socket ServerSok = new Socket("127.0.0.1",i);

System.out.println("Port in use: " + i );

ServerSok.close();

}

catch (Exception e) {

}

System.out.println("Port not in use: " + i );

}

}

}



반응형
반응형


두개의 툴이 있다..


하나는 패스워드...


다른 하나는 다운로드




20120511_HTTP Analyzer v3.0.5 (Full Edition).zip



핀들러는


https 프로토콜도 검색 가능하다.



https 프로토콜 검색 방법 : http://blog.danggun.net/734


프록시 설정(웹 해킹시 사용할 때) : http://cafe.naver.com/webprogrammer2/108



다운로드 : http://www.fiddler2.com/Fiddler2/version.asp



Fiddler2Setup.exe


반응형
반응형

오늘 모르는 한자를 찾기를 하다가

필기로 한자 찾아주는 곳을 발견했다...

네이X 이다...

http://hanja.naver.com

아래의 필기인식기 에 내용을 입력하면 쉽게 모르는 한자를 찾을수 있다. !!!



반응형

'일상다반사' 카테고리의 다른 글

안드로이드 프로그래밍...  (0) 2012.01.03
클라우드 ? 클라우드 !  (0) 2011.06.28
아동 전집 할인 사이트  (0) 2010.10.27
이쁜 여자 아이 이름  (0) 2010.07.20
보안과 네트워크...  (0) 2010.06.28
반응형

몇일전 NAT를 걸어놨던 외부 IP로 부터 리눅스 시스템이 해킹을 당했다 -_-ㅋ

아놔....

무슨 광고 사이트가 뜨고 침입한 녀석 IP까지 찾았다...

외국 IP이라... 하앍....

오라클 리스너 설정 변경, apache 웹 시스템 적용 등

알수 없는 짓들만 실컷(?) 하고 나갔다....

그래서 간만에 rkhunter를 사용하여 점검중에 있다.

홈페이지 : http://www.rootkit.nl/projects/rootkit_hunter.html
다운로드 : http://sourceforge.net/projects/rkhunter/


* 지원 OS 버젼들... 참고로 내 리눅스는 centos 5.3이었다.

 Supported operating systems
Supported:
- Most Linux distributions
- Most *BSD distributions

Currently unsupported:
- NetBSD

Tested on:
- AIX 4.1.5 / 4.3.3
- ALT Linux
- Aurora Linux
- CentOS 3.1 / 4.0
- Conectiva Linux 6.0
- Debian 3.x
- FreeBSD 4.3 / 4.4 / 4.7 / 4.8 / 4.9 / 4.10
- FreeBSD 5.0 / 5.1 / 5.2 / 5.2.1 / 5.3
- Fedora Core 1 / Core 2 / Core 3
- Gentoo 1.4, 2004.0, 2004.1
- Macintosh OS 10.3.4-10.3.8
- Mandrake 8.1 / 8.2 / 9.0-9.2 / 10.0 / 10.1
- OpenBSD 3.4 / 3.5
- Red Hat Linux 7.0-7.3 / 8 / 9
- Red Hat Enterprise Linux 2.1 / 3.0
- Slackware 9.0 / 9.1 / 10.0 / 10.1
- SME 6.0
- Solaris (SunOS)
- SuSE 7.3 / 8.0-8.2 / 9.0-9.2
- Ubuntu
- Yellow Dog Linux 3.0 / 3.01

Confirmed to work also on:
- CLFS
- DaNix (Debian clone)
- PCLinuxOS
- VectorLinux SOHO 3.2 / 4.0
- CPUBuilders Linux
- Virtuozzo (VPS)





뭐 간단히 /tmp/에 파일을 복사하여 넣고

gzip -d rkhunter-1.3.6.tar.gz (압축 풀고)
tar xvf rkhunter-1.3.6.tar (타르 파일 풀고)


/tmp/rkhunter-1.3.6/ 디렉토리 파일이 풀린다...

뭐. 설치는 어렵지않다.

/tmp/rkhunter-1.3.6/installer.sh --install

/tmp/rkhunter-1.3.6/installer.sh 쉘을 치면 설명이 나온다.... 한번 읽어 보면 좋다.

1. 설치 화면

 # ./installer.sh  --install
Checking system for:
 Rootkit Hunter installer files: found
 A web file download command: wget found
Starting installation:
 Checking installation directory "/usr/local": it exists and is writable.
 Checking installation directories:
  Directory /usr/local/share/doc/rkhunter-1.3.6: creating: OK
  Directory /usr/local/share/man/man8: exists and is writable.
  Directory /etc: exists and is writable.
  Directory /usr/local/bin: exists and is writable.
  Directory /usr/local/lib64: exists and is writable.
  Directory /var/lib: exists and is writable.
  Directory /usr/local/lib64/rkhunter/scripts: creating: OK
  Directory /var/lib/rkhunter/db: creating: OK
  Directory /var/lib/rkhunter/tmp: creating: OK
  Directory /var/lib/rkhunter/db/i18n: creating: OK
 Installing check_modules.pl: OK
 Installing filehashmd5.pl: OK
 Installing filehashsha1.pl: OK
 Installing filehashsha.pl: OK
 Installing stat.pl: OK
 Installing readlink.sh: OK
 Installing backdoorports.dat: OK
 Installing mirrors.dat: OK
 Installing programs_bad.dat: OK
 Installing suspscan.dat: OK
 Installing rkhunter.8: OK
 Installing ACKNOWLEDGMENTS: OK
 Installing CHANGELOG: OK
 Installing FAQ: OK
 Installing LICENSE: OK
 Installing README: OK
 Installing language support files: OK
 Installing rkhunter: OK
 Installing rkhunter.conf: OK
Installation complete

2. 위의 정상적으로 설치 완료 화면을 보고 난뒤
    /usr/local/bin/rkhunter 폴더를 볼수 있다.
    - 실행해 보기

 # ./rkhunter

Usage: rkhunter {--check | --unlock | --update | --versioncheck |
                 --propupd [{filename | directory | package name},...] |
                 --list [{tests | {lang | languages} | rootkits}] |
                 --version | --help} [options]

Current options are:
         --append-log                  Append to the logfile, do not overwrite
         --bindir <directory>...       Use the specified command directories
     -c, --check                       Check the local system
  --cs2, --color-set2                  Use the second color set for output
         --configfile <file>           Use the specified configuration file
         --cronjob                     Run as a cron job
                                       (implies -c, --sk and --nocolors options)
         --dbdir <directory>           Use the specified database directory
         --debug                       Debug mode
                                       (Do not use unless asked to do so)
         --disable <test>[,<test>...]  Disable specific tests
                                       (Default is to disable no tests)
         --display-logfile             Display the logfile at the end
         --enable  <test>[,<test>...]  Enable specific tests
                                       (Default is to enable all tests)
         --hash {MD5 | SHA1 | SHA224 | SHA256 | SHA384 | SHA512 |
                 NONE | <command>}     Use the specified file hash function
                                       (Default is SHA1, then MD5)
     -h, --help                        Display this help menu, then exit
 --lang, --language <language>         Specify the language to use
                                       (Default is English)
         --list [tests | languages |   List the available test names, languages,
                 rootkits]             or checked for rootkits, then exit
     -l, --logfile [file]              Write to a logfile
                                       (Default is /var/log/rkhunter.log)
         --noappend-log                Do not append to the logfile, overwrite it
         --nocolors                    Use black and white output
         --nolog                       Do not write to a logfile
--nomow, --no-mail-on-warning          Do not send a message if warnings occur
   --ns, --nosummary                   Do not show the summary of check results
 --novl, --no-verbose-logging          No verbose logging
         --pkgmgr {RPM | DPKG | BSD |  Use the specified package manager to obtain or
                   NONE}               verify file hash values. (Default is NONE)
         --propupd [file | directory | Update the entire file properties database,
                    package]...        or just for the specified entries
     -q, --quiet                       Quiet mode (no output at all)
  --rwo, --report-warnings-only        Show only warning messages
     -r, --rootdir <directory>         Use the specified root directory
   --sk, --skip-keypress               Don't wait for a keypress after each test
         --summary                     Show the summary of system check results
                                       (This is the default)
         --syslog [facility.priority]  Log the check start and finish times to syslog
                                       (Default level is authpriv.notice)
         --tmpdir <directory>          Use the specified temporary directory
         --unlock                      Unlock (remove) the lock file
         --update                      Check for updates to database files
   --vl, --verbose-logging             Use verbose logging (on by default)
     -V, --version                     Display the version number, then exit
         --versioncheck                Check for latest version of program
     -x, --autox                       Automatically detect if X is in use
     -X, --no-autox                    Do not automatically detect if X is in use


헉스,,, 옵션을 줘야 한다.

처음에는 rkhunter가 사용하는 DB부터 만들어주는것을 권고한다.

# rkhunter --propupd

끝나면

실제로 check를 해보자

# rhunter -c

실행화면 (칼라로 나온다 잇힝...)

 [ Rootkit Hunter version 1.3.6 ]

Checking system commands...

  Performing 'strings' command checks
    Checking 'strings' command                               [ OK ]

  Performing 'shared libraries' checks
    Checking for preloading variables                        [ None found ]
    Checking for preloaded libraries                         [ None found ]
    Checking LD_LIBRARY_PATH variable                        [ Not found ]

  Performing file properties checks
    Checking for prerequisites                               [ OK ]
    /bin/awk                                                 [ Warning ]
    /bin/basename                                            [ OK ]
    /bin/bash                                                [ OK ]
    /bin/cat                                                 [ OK ]
    /bin/chmod                                               [ OK ]
    /bin/chown                                               [ OK ]
    /bin/cp                                                  [ OK ]
    /bin/csh                                                 [ OK ]
    /bin/cut                                                 [ OK ]
    /bin/date                                                [ OK ]
    /bin/df                                                  [ OK ]
    /bin/dmesg                                               [ OK ]
    /bin/echo                                                [ OK ]
    /bin/ed                                                  [ OK ]
    /bin/egrep                                               [ OK ]
    /bin/env                                                 [ OK ]
    /bin/fgrep                                               [ OK ]
    /bin/grep                                                [ OK ]
    /bin/kill                                                [ OK ]
    /bin/logger                                              [ OK ]
    /bin/login                                               [ OK ]
    /bin/ls                                                  [ OK ]
    /bin/mail                                                [ OK ]
    /bin/mktemp                                              [ OK ]
    /bin/more                                                [ OK ]
    /bin/mount                                               [ OK ]
    /bin/mv                                                  [ OK ]
    /bin/netstat                                             [ OK ]
    /bin/ps                                                  [ OK ]
    /bin/pwd                                                 [ OK ]
    /bin/rpm                                                 [ Warning ]
    /bin/sed                                                 [ OK ]
    /bin/sh                                                  [ OK ]
    /bin/sort                                                [ OK ]
    /bin/su                                                  [ OK ]
    /bin/touch                                               [ OK ]
    /bin/uname                                               [ OK ]
    /bin/gawk                                                [ Warning ]
    /bin/tcsh                                                [ OK ]
    /usr/bin/awk                                             [ Warning ]
    /usr/bin/chattr                                          [ OK ]
    /usr/bin/curl                                            [ Warning ]
    /usr/bin/cut                                             [ OK ]
    /usr/bin/diff                                            [ OK ]
    /usr/bin/dirname                                         [ OK ]
    /usr/bin/du                                              [ OK ]
    /usr/bin/elinks                                          [ Warning ]
    /usr/bin/env                                             [ OK ]
    /usr/bin/file                                            [ OK ]
    /usr/bin/find                                            [ OK ]
    /usr/bin/groups                                          [ Warning ]
    /usr/bin/head                                            [ OK ]
    /usr/bin/id                                              [ OK ]
    /usr/bin/kill                                            [ OK ]
    /usr/bin/killall                                         [ OK ]
    /usr/bin/last                                            [ OK ]
    /usr/bin/lastlog                                         [ OK ]
    /usr/bin/ldd                                             [ Warning ]
    /usr/bin/less                                            [ OK ]
    /usr/bin/links                                           [ Warning ]
    /usr/bin/locate                                          [ OK ]
    /usr/bin/logger                                          [ OK ]
    /usr/bin/lsattr                                          [ OK ]
    /usr/bin/md5sum                                          [ OK ]
    /usr/bin/newgrp                                          [ OK ]
    /usr/bin/passwd                                          [ OK ]
    /usr/bin/perl                                            [ Warning ]
    /usr/bin/pgrep                                           [ OK ]
    /usr/bin/pstree                                          [ OK ]
    /usr/bin/readlink                                        [ OK ]
    /usr/bin/runcon                                          [ OK ]
    /usr/bin/sha1sum                                         [ OK ]
    /usr/bin/sha224sum                                       [ OK ]
    /usr/bin/sha256sum                                       [ OK ]
    /usr/bin/sha384sum                                       [ OK ]
    /usr/bin/sha512sum                                       [ OK ]
    /usr/bin/size                                            [ OK ]
    /usr/bin/stat                                            [ OK ]
    /usr/bin/strings                                         [ OK ]
    /usr/bin/sudo                                            [ OK ]
    /usr/bin/tail                                            [ OK ]
    /usr/bin/test                                            [ OK ]
    /usr/bin/top                                             [ OK ]
    /usr/bin/tr                                              [ OK ]
    /usr/bin/uniq                                            [ OK ]
    /usr/bin/users                                           [ OK ]
    /usr/bin/vmstat                                          [ OK ]
    /usr/bin/w                                               [ OK ]
    /usr/bin/watch                                           [ OK ]
    /usr/bin/wc                                              [ OK ]
    /usr/bin/wget                                            [ OK ]
    /usr/bin/whatis                                          [ Warning ]
    /usr/bin/whereis                                         [ OK ]
    /usr/bin/which                                           [ OK ]
    /usr/bin/who                                             [ OK ]
    /usr/bin/whoami                                          [ OK ]
    /usr/bin/gawk                                            [ Warning ]
    /sbin/chkconfig                                          [ OK ]
    /sbin/depmod                                             [ OK ]
    /sbin/fuser                                              [ OK ]
    /sbin/ifconfig                                           [ OK ]
    /sbin/ifdown                                             [ Warning ]
    /sbin/ifup                                               [ Warning ]
    /sbin/init                                               [ OK ]
    /sbin/insmod                                             [ OK ]
    /sbin/ip                                                 [ OK ]
    /sbin/kudzu                                              [ OK ]
    /sbin/lsmod                                              [ OK ]
    /sbin/modinfo                                            [ OK ]
    /sbin/modprobe                                           [ OK ]
    /sbin/nologin                                            [ OK ]
    /sbin/rmmod                                              [ OK ]
    /sbin/runlevel                                           [ OK ]
    /sbin/sulogin                                            [ OK ]
    /sbin/sysctl                                             [ OK ]
    /sbin/syslogd                                            [ OK ]
    /usr/sbin/adduser                                        [ OK ]
    /usr/sbin/chroot                                         [ OK ]
    /usr/sbin/groupadd                                       [ OK ]
    /usr/sbin/groupdel                                       [ OK ]
    /usr/sbin/groupmod                                       [ OK ]
    /usr/sbin/grpck                                          [ OK ]
    /usr/sbin/kudzu                                          [ OK ]
    /usr/sbin/lsof                                           [ OK ]
    /usr/sbin/prelink                                        [ OK ]
    /usr/sbin/pwck                                           [ OK ]
    /usr/sbin/sestatus                                       [ OK ]
    /usr/sbin/tcpd                                           [ OK ]
    /usr/sbin/useradd                                        [ OK ]
    /usr/sbin/userdel                                        [ OK ]
    /usr/sbin/usermod                                        [ OK ]
    /usr/sbin/vipw                                           [ OK ]
    /usr/local/bin/rkhunter                                  [ OK ]
    /etc/rkhunter.conf                                       [ OK ]

[Press <ENTER> to continue]


Checking for rootkits...

  Performing check of known rootkit files and directories
    55808 Trojan - Variant A                                 [ Not found ]
    ADM Worm                                                 [ Not found ]
    AjaKit Rootkit                                           [ Not found ]
    Adore Rootkit                                            [ Not found ]
    aPa Kit                                                  [ Not found ]
    Apache Worm                                              [ Not found ]
    Ambient (ark) Rootkit                                    [ Not found ]
    Balaur Rootkit                                           [ Not found ]
    BeastKit Rootkit                                         [ Not found ]
    beX2 Rootkit                                             [ Not found ]
    BOBKit Rootkit                                           [ Not found ]
    cb Rootkit                                               [ Not found ]
    CiNIK Worm (Slapper.B variant)                           [ Not found ]
    Danny-Boy's Abuse Kit                                    [ Not found ]
    Devil RootKit                                            [ Not found ]
    Dica-Kit Rootkit                                         [ Not found ]
    Dreams Rootkit                                           [ Not found ]
    Duarawkz Rootkit                                         [ Not found ]
    Enye LKM                                                 [ Not found ]
    Flea Linux Rootkit                                       [ Not found ]
    FreeBSD Rootkit                                          [ Not found ]
    Fu Rootkit                                               [ Not found ]
    Fuck`it Rootkit                                          [ Not found ]
    GasKit Rootkit                                           [ Not found ]
    Heroin LKM                                               [ Not found ]
    HjC Kit                                                  [ Not found ]
    ignoKit Rootkit                                          [ Not found ]
    iLLogiC Rootkit                                          [ Not found ]
    IntoXonia-NG Rootkit                                     [ Not found ]
    Irix Rootkit                                             [ Not found ]
    Kitko Rootkit                                            [ Not found ]
    Knark Rootkit                                            [ Not found ]
    ld-linuxv.so Rootkit                                     [ Not found ]
    Li0n Worm                                                [ Not found ]
    Lockit / LJK2 Rootkit                                    [ Not found ]
    Mood-NT Rootkit                                          [ Not found ]
    MRK Rootkit                                              [ Not found ]
    Ni0 Rootkit                                              [ Not found ]
    Ohhara Rootkit                                           [ Not found ]
    Optic Kit (Tux) Worm                                     [ Not found ]
    Oz Rootkit                                               [ Not found ]
    Phalanx Rootkit                                          [ Not found ]
    Phalanx2 Rootkit                                         [ Not found ]
    Phalanx2 Rootkit (extended tests)                        [ Not found ]
    Portacelo Rootkit                                        [ Not found ]
    R3dstorm Toolkit                                         [ Not found ]
    RH-Sharpe's Rootkit                                      [ Not found ]
    RSHA's Rootkit                                           [ Not found ]
    Scalper Worm                                             [ Not found ]
    Sebek LKM                                                [ Not found ]
    Shutdown Rootkit                                         [ Not found ]
    SHV4 Rootkit                                             [ Not found ]
    SHV5 Rootkit                                             [ Not found ]
    Sin Rootkit                                              [ Not found ]
    Slapper Worm                                             [ Not found ]
    Sneakin Rootkit                                          [ Not found ]
    'Spanish' Rootkit                                        [ Not found ]
    Suckit Rootkit                                           [ Not found ]
    SunOS Rootkit                                            [ Not found ]
    SunOS / NSDAP Rootkit                                    [ Not found ]
    Superkit Rootkit                                         [ Not found ]
    TBD (Telnet BackDoor)                                    [ Not found ]
    TeLeKiT Rootkit                                          [ Not found ]
    T0rn Rootkit                                             [ Not found ]
    trNkit Rootkit                                           [ Not found ]
    Trojanit Kit                                             [ Not found ]
    Tuxtendo Rootkit                                         [ Not found ]
    URK Rootkit                                              [ Not found ]
    Vampire Rootkit                                          [ Not found ]
    VcKit Rootkit                                            [ Not found ]
    Volc Rootkit                                             [ Not found ]
    Xzibit Rootkit                                           [ Not found ]
    X-Org SunOS Rootkit                                      [ Not found ]
    zaRwT.KiT Rootkit                                        [ Not found ]
    ZK Rootkit                                               [ Not found ]

  Performing additional rootkit checks
    Suckit Rookit additional checks                          [ OK ]
    Checking for possible rootkit files and directories      [ None found ]
    Checking for possible rootkit strings                    [ None found ]

  Performing malware checks
    Checking running processes for suspicious files          [ None found ]
    Checking for login backdoors                             [ None found ]
    Checking for suspicious directories                      [ None found ]
    Checking for sniffer log files                           [ None found ]
    Checking for Apache backdoor                             [ Not found ]

  Performing Linux specific checks
    Checking loaded kernel modules                           [ OK ]
    Checking kernel module names                             [ OK ]

[Press <ENTER> to continue]


Checking the network...

  Performing check for backdoor ports
    Checking for TCP port 1524                               [ Not found ]
    Checking for TCP port 1984                               [ Not found ]
    Checking for UDP port 2001                               [ Not found ]
    Checking for TCP port 2006                               [ Not found ]
    Checking for TCP port 2128                               [ Not found ]
    Checking for TCP port 6666                               [ Not found ]
    Checking for TCP port 6667                               [ Not found ]
    Checking for TCP port 6668                               [ Not found ]
    Checking for TCP port 6669                               [ Not found ]
    Checking for TCP port 7000                               [ Not found ]
    Checking for TCP port 13000                              [ Not found ]
    Checking for TCP port 14856                              [ Not found ]
    Checking for TCP port 25000                              [ Not found ]
    Checking for TCP port 29812                              [ Not found ]
    Checking for TCP port 31337                              [ Not found ]
    Checking for TCP port 33369                              [ Not found ]
    Checking for TCP port 47107                              [ Not found ]
    Checking for TCP port 47018                              [ Not found ]
    Checking for TCP port 60922                              [ Not found ]
    Checking for TCP port 62883                              [ Not found ]
    Checking for TCP port 65535                              [ Not found ]

  Performing checks on the network interfaces
    Checking for promiscuous interfaces                      [ None found ]

[Press <ENTER> to continue]


Checking the local host...

  Performing system boot checks
    Checking for local host name                             [ Found ]
    Checking for system startup files                        [ Found ]
    Checking system startup files for malware                [ None found ]

  Performing group and account checks
    Checking for passwd file                                 [ Found ]
    Checking for root equivalent (UID 0) accounts            [ Warning ]
    Checking for passwordless accounts                       [ None found ]
    Checking for passwd file changes                         [ None found ]
    Checking for group file changes                          [ None found ]
    Checking root account shell history files                [ OK ]

  Performing system configuration file checks
    Checking for SSH configuration file                      [ Found ]
    Checking if SSH root access is allowed                   [ Warning ]
    Checking if SSH protocol v1 is allowed                   [ Not allowed ]
    Checking for running syslog daemon                       [ Found ]
    Checking for syslog configuration file                   [ Found ]
    Checking if syslog remote logging is allowed             [ Not allowed ]

  Performing filesystem checks
    Checking /dev for suspicious file types                  [ None found ]
    Checking for hidden files and directories                [ Warning ]

[Press <ENTER> to continue]


Checking application versions...

    Checking version of GnuPG                                [ OK ]
    Checking version of Apache                               [ Warning ]
    Checking version of OpenSSL                              [ Warning ]
    Checking version of PHP                                  [ Warning ]
    Checking version of Procmail MTA                         [ OK ]
    Checking version of OpenSSH                              [ Warning ]


System checks summary
=====================

File properties checks...
    Files checked: 134
    Suspect files: 14

Rootkit checks...
    Rootkits checked : 253
    Possible rootkits: 0

Applications checks...
    Applications checked: 6
    Suspect applications: 4

The system checks took: 1 minute and 56 seconds

All results have been written to the log file (/var/log/rkhunter.log)

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)

 



자 끝났다... 실제 체크 옵션의 Warning 부분인데.. 어라.. 자세히 안나온다

자세한 내용은 /var/log/rkhunter.log를 살펴보자... 그럼 더 자세한 경고 문구들이 나온다.

조치방법은 워낙 많기 때문에 구글링(www.google.co.kr)을 통해 검색해 보자 ~

하앍.............
반응형

'OS > Linux' 카테고리의 다른 글

CENTOS 7에 XRDP 설치하기  (0) 2017.08.26
리눅스 백업 및 복구  (0) 2013.01.25
삼성 컴퓨터 유분투 설치기.  (0) 2012.02.06
ps auxc 와 ps aux 결과 비교하기  (0) 2010.01.21
AWK & SED chunk_1  (0) 2010.01.21
반응형

다운로드 주소 : http://www.foundstone.com/us/resources/proddesc/fport.htm



Pid Process Port Proto Path
392 svchost -> 135 TCP C:\WINNT\system32\svchost.exe
8 System -> 139 TCP
8 System -> 445 TCP
508 MSTask -> 1025 TCP C:\WINNT\system32\MSTask.exe
392 svchost -> 135 UDP C:\WINNT\system32\svchost.exe
8 System -> 137 UDP
8 System -> 138 UDP
8 System -> 445 UDP
224 lsass -> 500 UDP C:\WINNT\system32\lsass.exe
212 services -> 1026 UDP C:\WINNT\system32\services.exe

The program contains five (5) switches. The switches may be utilized using either a '/'
or a '-' preceding the switch. The switches are;

Usage:
/? usage help
/p sort by port
/a sort by application
/i sort by pid
/ap sort by application path

반응형

+ Recent posts