Free Best OCR

I just needed a cool yet Free OCR tool and were trying hands on multiple available. BUT finally found the below 3 to be the best in order of perfection and efficiency -

1. OnlineOCR ( One +plus is that - it gives me a download option with various output format)
   
2. Free-OCR
3. NewOCR

Extract of text from image format is so simplified !!

The Engineering attempts at automated recognition of printed characters started much before World War II. But it was only by early 1950's some commercial attempt was undertaken to have funded R&D on this area.

OCR has taken new feats & heights - I know some of the Engineering efforts from IITG where Handwritten Character Recognition has taken a whole new dimension and heading for interesting feats in this niche area.

Thanks/-

DK

OS Fingerprinting

Yo Dawg! You never told me its a pure Windows box and I wasted my time trying to do SSH rather than a RDP! A common fuming statement by most of the Ops guys !?

OS Fingerprinting is normally used by attackers to probe a wide variety of hosts and add them in their hit-lists for the next application/OS exploit is released. Idea is they should not be trying IIS exploits against Linux hosts.


Well - in either case lets empower ourselves too how this can be done.

Network traffic from a computer system can be captured and analyzed to detect what OS the host is running. This is possible due to differences in how the TCP/IP stack is implemented in various operating systems.

The TCP/IP fields that may vary include the following:

1. Initial packet size (16 bits)
2. Initial TTL (8 bits)
3. Window size (16 bits)
4. Max segment size (16 bits)
5. Window scaling value (8 bits)
6. "don't fragment" flag (1 bit)
7. "sackOK" flag (1 bit)
8. "nop" flag (1 bit)

Some of the most common known TTL and TCP windows set is shown below:

Operating System(OS)	Intial TTL	TCP Windows size
Linux Kernel (2.4 and 2.6)	64	5840
Windows XP	128	65535
Windows 7, Vista and Server 2008	128	8192
Free BSD	64	65535
Cisco Router (IOS 12.4)	255	4128
Solaris	255	8760
WINDOWS 2000	128	16384

The initial TTL value usually is a little tricky job to analyze since the TTL value of a sniffed packet varies depending on where you sniff it from. The sender system will set the TTL value to the Operating Systems default TTL value - but this value will then be decremented by one (-1) for every router the packet passes through on its way to the destination IP address. Hence an IP packet with a TTL value of 55 can therefore be expected to be a packet with an initial TTL of 64 that has done 9 router hops before it was sniffed.

Very common tool that can be used -

Ping:

As I said ICMP ping is always the first thing and arrive at some initial level of idea what OS the host might be running

Nmap:

I would try multiple nmap combinations to come to a conclusion:

nmap -sV -P0 -O debatestBox.com
nmap -O -v debatestBox.com
nmap -sV debatestBox.com
nmap -vv -O -P0 debatestBox.com

XProbe2:
Xprobe2 is a basically remote, active OS fingerprinting tool -

[root@DebaTestBox ~]# xprobe2 crusador.sdtie.com

Xprobe2 v.0.3 Copyright (c) 2002-2005 fyodor@o0o.nu, ofir@sys-security.com, meder@o0o.nu

[+] Target is crusador.sdtie.com
[+] Loading modules.
[+] Following modules are loaded:
[x] [1] ping:icmp_ping - ICMP echo discovery module
[x] [2] ping:tcp_ping - TCP-based ping discovery module
[+] Primary guess:
[+] Host 10.X.X.X Running OS: "OpenBSD 2.5" (Guess probability: 90%)



To be contd/-


-DK

Prevent a rpm from Being Updated via patching

A common scenario - unneeded packages got updated via patching and a working application Stopped functioning.

If you you don't want to update it even if a newer version is available YUM actually has a plugin called yum-versionlock.

1. Install the yum-plugin-versionlock package.

2. Make sure - /etc/yum/pluginconf.d/versionlock.conf exists, and contains the following text: enabled = 1

3. Add the list of packages which you do not want to be updated to /etc/yum/pluginconf.d/versionlock.list.

Each package should go on its own line. For example:

screen-4.0.3-4.el5

desktop-backgrounds-basic-2.0-37

That's it!!


[root@svn01dev ~]# yum install screen
Loaded plugins: security, versionlock
Reading version lock configuration
Setting up Install Process
Nothing to do
[root@svn01dev ~]#

Cheers!
D E B A

Automatically reboot server On kernel panic

There is a way to auto reboot your servers on Kernel Panic. This is helpful in a situation where your servers are remote and needs time to arrange a hard reboot.

echo X>/proc/sys/kernel/panic , where X is the timeout in seconds, The kernel waits X seconds and reboots.

e.g. echo "1" > /proc/sys/kernel/panic

Above it is 1 sec. BUT usually I keep it 10sec or more to believe that the problem was transitory.

1. kernel.panic = 1 initiates a hard system reboot whenever the system runs into a kernel panic.
2. kernel.panic_on_oops = 1 extends that behavior to oopses (the kernel will then treat any oops just like it treats a panic)

Thanks/-
DK

insecure password practice in Wget

Wget 1.12 onwards - you don't have to specfy password on command line itself - rather use somethign as below:

wget --user=cvs --ask-password http://svn1.codemagicstore.com/Tools/trunk/WebSense/deploy/secureTools.war -O /cvs/secureTools.war

However since script should also be unattended - please user user/pasword pair in /etc/wgetrc OR ~/wgetrc

user=cvs
password=secret


Thanks/-
D E B A

space command

Someone was fuming why do you provide password at console! anyone can see it later.

Yo Dawg!

if I a prefix a space in my linux command it does not save it in History!

-DK

magic SysRq key to reboot server ..

I am sure most of has seen this issue earlier -

[root@DebaTestBox ~]# reboot
bash: /sbin/reboot: Input/output error
[root@DebaTestBox ~]# shutdown -r now
bash: /sbin/shutdown: Input/output error

Whats the rescue - call the data center guy and hard reboot.

WAIT!! **Just try this :

Theere is some issue with your disc for sure and thats why the kernel is unable to access the '/sbin/reboot' and '/sbin/shutdown' binaries from the disk so that it could execute them.


A fsck in next boot is mandatory now BUT what you need right away is - some way to reboot this BOX. Do we have something to tell the kernal bypassing anything or any command on disc.

Yes!

There is this "magic SysRq key" for your rescue.


First you must activate the magic SysRq option:

How To:

echo 1 > /proc/sys/kernel/sysrq

When you are ready to reboot the machine simply run the following:

echo b > /proc/sysrq-trigger

(Note: This will reboot your server, without trying to umount any file system)

BUT pleas remember this should only be used in dire situation as it wont do any umount of the currently mounted file systems. BUT if your drive is already failing then that may not be a concern.

Make the Sysrq setting permanent -

echo "kernel.sysrq = 1" >> /etc/sysctl.conf

More magic keys here

Thanks/-
D e b a