Uncategorized

HOW TO : Compare two directories in Linux

Quick post on using diff to compare two directories in Linux. This will show the list of files and subdirectories that are different in either directories

[code]diff /PATH_TO_FIRST_DIRECTORY /PATH_TO_SECOND_DIRECTORY -r –brief  [/code]

Options used

  • r : Searched recursively through the directory
  • –brief : Only shows the names of the files that differ. If you want details of the content that differs, remove this option

HOW TO : grep for response codes in apache logs

If you want to grep for certain http response codes in a apache log file

  • Look for all access requests with a 200 response code[code] grep -i "[: ]200[: ]" HTTP_ACCESS_LOG [/code]
  • Look for all access requests that do NOT have a 200 response code[code] grep -i -v "[: ]200[: ]" HTTP_ACCESS_LOG [/code]

Details of the options

  • [code]"[: ]"[/code]

    tells grep to look for space or tab before the specified string, which in this case is 200.

Another day.. Another Hack

The net is up in arms about a new release from team Ghostshell of compromise data. Details of the leak can be found at http://www.theregister.co.uk/2012/08/28/team_ghostshell_megahack/ and the source of the data is at http://pastebin.com/BuabHTvr .

I thought I would put my nascent python skills to use and write a simple script to parse through the release and download all the data. Hoping to analyze it later on. It is pretty basic, but does the job of parsing the release and downloading the content. You can get the script at https://github.com/kudithipudi/Misc-Scripts/blob/master/parseHellfire.py

Watch out for an analysis of the content soon :).

HOW TO : Use Python to look for credit card numbers

Simple script in python to look for credit card numbers in a file.

[code]

#Importing modules
import re
import os

# Define variables
inputFile = ‘test.txt’
searchPattern = ‘((\D(6011|5[1-5]\d{2}|4\d{3}|3\d{3})\d{11,12}\D)|(^(6011|5[1-5]\d{2}|4\d{3}|3\d{3})\d{11,12}\D))’

tempinputFile = open(inputFile)
tempLine = tempinputFile.readline()

while tempLine:
print ("LINE: " + tempLine)
foundContent = re.search(searchPattern,tempLine, re.IGNORECASE)
if foundContent:
print("FOUND: " + foundContent.group())
tempLine = tempinputFile.readline()

tempinputFile.close() [/code]

The script started out as a simple check for any 16 digit numbers that had a non numeric character on either end. But I tweaked it a little bit to look for credit card like numbers using the regex from http://www.regular-expressions.info/creditcard.html. Finally I added an option to match credit card like numbers if the numbers start at the beginning of the line (i.e there is no non-numeric number before the credit card number)

HOW TO : Find files, search for content in them, replace the content

The title pretty much says it all :). Here is a quick  one liner, using multiple tools, to look for files in a directory, search for certain content in them and replace them with other content

[code]find -type f | xargs grep -l ORIGINAL_CONTENT | xargs perl -p -i -e ‘s/ORIGINAL_CONTENT/NEW_CONTENT/g’ [/code]

You can theoretically take out the grep (second command) and directly pipe the find output to perl and get the same outcome.

Going over list of the options used

find

  • “-type f” lists all objects of type file in the directory (and sub directories)

grep

  • “-l” lists the names of the files (with relative path) which have the text ORIGINAL_CONTENT in them

perl

  • “-p” forces perl to loop through requests. In this case files
  • “-e” tells perl that the next argument is a perl statement
  • “-i” tells perls to edit the file in place (i.e. no need for an output file)

HOW TO : Use word boundaries in Regular Expressions

If you are every looking to match strings as a whole word instead of literal strings using a regular express, Word Boundaries are your friend

For example if you are looking to match a string of 10 numbers in a log file, you can use

[code]grep -i ‘\b[0-9]\{10,\}\b’ –color -H -n FILE_NAME_TO_SEARCH [/code]

The \b is the option that tells grep to look for a word character.

More information about the option is available at http://www.regular-expressions.info/wordboundaries.html