Posts

Forensic computer

Forensics is the set of techniques that allows us to obtain as much information as possible after a computer incident or crime. In this practice, you will perform the evidence-taking and analysis phase on one Linux machine and another Windows. We’ll assume we caught the criminal ‘in fraganti’ and the machines were on. Optionally, you can perform an Android device analysis. On each of the machines you must do a memory and a hard drive, taking the necessary measures to certify the chain of custody.

Thursday, March 28, 2024 | 23 minutes Read

Fortinet CLI

Equivalence from GUI to CLI Initially, I started the practice using the command line (CLI), however, I found it more comfortable to do it from the graphic interface. Therefore, I decided to establish an equivalence between the different actions I have carried out during practice and to compare them with their counterpart in the terminal. [NOTE] In this post I do a small summary of the equivalencies between the GUI and the CLI of Fortinet that I have used in the 2 Fortinet firewall posts.

Thursday, March 28, 2024 | 9 minutes Read

Implementation of a perimeter firewall with Fortinet I

Before you start the practice, the scenario you see in the practice is as similar as I can ride to the original practice. I have used version 7.0.9-1 of FortiGate, as the higher versions bring some restrictions. You can download the image from this [link](https://drive.google.com/drive/folders/ 1VGmeLN5inkWNNNUsIvq9ewGUzJLTLkiM). Firewall start-up FortiGate devices are made with the IP 192.168.1.99 / 24, as I am from GNS3 do not need to connect to this interface with a device and change the configuration. Since I can do it from the console.

Thursday, March 28, 2024 | 10 minutes Read

Implementation of a perimeter firewall with Fortinet II

Now let’s emulate firewall practice II, but on GNS3. To this end, I have transformed client 1 into Odin, and added Thor and Loki as virtual machines instead of containers on the LAN network. I have also created a new network called DMZ, in which will be the Hela machine. Since I have transformed the previous scenario into this new one, we have some rules created earlier. Therefore, I will remove from the statement those that are already created, such as making SSH to Odin from port 2222, but with the service listening in the 22.

Thursday, March 28, 2024 | 16 minutes Read

Implementation of a perimeter firewall with Nftables I

In this post on a Debian machine scenario, we will apply rules with Nfables to match the traffic that goes into and out of our network, trying to imitate a scenario. [NOTE] To deploy the stage to perform these exercises you will need to deploy the .yaml file you will find in the link to the next paragraph. This will be in charge of deploying 2 machines one that will make firewall and one that will simulate a client that will be connected to the first machine to simulate a local network.

Thursday, March 28, 2024 | 27 minutes Read

Implementation of a perimeter firewall with Nftables II

On the stage created in the service module with the Odin (Router), Hela (DMZ), Loki and Thor (LAN) machines and using nftables, it sets up a perimeter firewall on the Odin machine so that the stage continues to function completely taking into account the following points: • The creation of different chains for each traffic flow (from LAN to the outside, from LAN to DMZ, etc.) will be valued. • Default DROP policy for all chains. • You can use the extensions that we create appropriate, but at least you should follow the connection when necessary. • We must implement the firewall to work after a machine reboot. • You must show proof of operation of all rules.

Thursday, March 28, 2024 | 42 minutes Read

Installation of android in GNS3 with KVM

To download the android image you can do it from this page – > https://www.fosshub.com/Android-x86.html: wget https://www.fosshub.com/Android-x86.html?dwl=android-x86_64-9.0-r2.iso Create a KVM machine as if it were a Debian, I’ve given it 2GB of RAM and 2 Cores: In our case we can launch an automatic installation: When you have the machine installed, turn off the machine and we’ll import it in gns3. To do this we will take the KVM disk and import it into the directory where we have installed the GNS3 images, then property the copied disk to your user.

Thursday, March 28, 2024 | 1 minute Read

Remote access VPN with Ipsec StrongSwan

StrongSwan is a VPN (Virtual Private Network) implementation based on IPsec, open source, multiplatform, complete and widely used. It works on operating systems such as Linux, FreeBSD, OS X, Windows, Android and iOS. Mainly, it is a key exchange demon that supports Internet Key Exchange protocols (IKEv1 and IKEv2) to establish security associations (SA) between two pairs. [NOTE] I will start from the VPN post remote access with OpenVPN, so you may refer to this during this article. If you want to have the same scenario go first to this.

Thursday, March 28, 2024 | 6 minutes Read

Remote access VPN with OpenVPN and x509 certificates

One of the two teams (which will act as a server) will be connected to two networks For the authentication of the extremes, digital certificates shall be used, which shall be generated using openssl and stored in the / etc / openvpn directory, together with the Diffie- Helman parameters and the certificate of the Certification Authority itself. Network addresses 10.99.99.0 / 24 will be used for VPN virtual addresses. The address 10.99.99.1 shall be assigned to the VPN server. The server and client configuration files will be created in the / etc / openvpn directory of each machine, and will be called servor.conf and cliente.conf respectively. After the establishment of the VPN, the client machine must be able to access a machine on the other network to which the server is connected. Riding the stage To perform this exercise I have mounted the following scenario on GNS3:

Thursday, March 28, 2024 | 17 minutes Read

VPN site to site Wireguard

[!NOTE] I will start from the VPN post remote access with Wireguard, so you may refer to this one during this article. Key generation The first thing we will do is to install both the Wireguard package in both machines: root@servidor1:~# sudo apt update && sudo apt install wireguard debian@servidor2:~$ sudo apt update && sudo apt install wireguard Let’s generate the pairs of keys that will be used to encrypt the connection. We will need a key for the server and a couple of additional keys for each client.

Thursday, March 28, 2024 | 5 minutes Read

VPN site to site with IPsec Cisco

In this post I’m going to mount an IPSEC VPN using swan routers. [!NOTE] This post details the configuration of R2 and R3 routers, however R1 is explained in the post of “VPN OpenVPN remote access.” If you want to see the configuration of the latter, look at the section preparing the stage. # Stage configuration As I have changed stage, the 2 new routers have to be set up on the R2 and R3 network.

Thursday, March 28, 2024 | 6 minutes Read

VPN site to site with IPsec Fortinet

In this post I will mount an IPSEC VPN using Fortinet firewalls, for which I will visualize them on GNS3. Stage preparation To create the VPN I will add a new Fortigate to the stage. So let’s proceed to set it up, the first thing will be to know the IP that the DHCP has given you: FortiGate-VM64-KVM login: admin Password: You are forced to change your password. Please input a new password. New Password: Confirm Password: Welcome! FortiGate-VM64-KVM # get system interface physical port1 == [onboard] ==[port1] mode: dhcp ip: 192.168.122.22 255.255.255.0 ipv6: ::/0 status: up speed: 1000Mbps (Duplex: full) FEC: none FEC_cap: none This IP you’ve given me for DHCP will be configured as static.

Thursday, March 28, 2024 | 3 minutes Read