AD CLI FOR DELETE INACTIVE COMPUTERS

dsquery computer -inactive 60
dsquery computer -inactive 60 -limit 0| dsrm -noprompt

HOW TO FIX SHUTTER PRINTER EDIT FUNCTION

wget https://launchpad.net/ubuntu/+archive/primary/+files/libgoocanvas-common_1.0.0-1_all.deb
wget https://launchpad.net/ubuntu/+archive/primary/+files/libgoocanvas3_1.0.0-1_amd64.deb
wget https://launchpad.net/ubuntu/+archive/primary/+files/libgoo-canvas-perl_0.06-2ubuntu3_amd64.deb

dpkg -i libgoocanvas-common_1.0.0-1_all.deb
dpkg -i libgoocanvas3_1.0.0-1_amd64.deb
dpkg -i libgoo-canvas-perl_0.06-2ubuntu3_amd64.deb

apt install libappindicator-dev
apt install libgoo-canvas-perl


sudo apt-get install -f
shutdown -r now

HOW TO MOUNT WINDOWS BOOTABLE VIA USB IN LINUX

sudo add-apt-repository ppa:nilarimogard/webupd8
apt-get update
apt-get install woeusb

Source:

https://github.com/slacka/WoeUSB
https://www.youtube.com/watch?v=A8KNg6e3aKc

FANTASTIC MALWARE AND WHERE TO FIND THEM

https://www.megabeets.net/fantastic-malware-and-where-to-find-them/

AZURE LATENCY TEST

http://www.azurespeed.com/Azure/Latency

HOW TO DOWNOAD AND CONFIGURE FTK

http://asgard-forensiks.blogspot.com/2017/08/how-to-install-ftk-imager-on-linuxubuntu.html
https://www.computersecuritystudent.com/FORENSICS/FTK/IMAGER/FTK_IMG_313/lesson1/index.html

http://comp4n6.blogspot.com/2013/02/using-sans-siftworkstation-you-have.html

SECURITY INFORMATION AND TECNOLOGY OF INFORMATION - LAW ENFORECEMENT IN BRAZIL

12737  commonly nicknamed Carolina Dieckmann
12965 internet civil landmarks
13709 protection personal data

Constituição Federal
Código Civil
Código de Processo Civil
Código Penal
Código de Processo Penal
Marco Civil da Internet
Decreto Regulamentador do Marco Civil da Internet
Estatuto da Criança e do Adolescente art 240
Lei do Software
Lei das Perícias Oficiais
Lei Eduardo Azeredo
Lei dos Crimes Hediondos
Lei das Contravenções Penais

HOW TO ALLOW SOPHOS XG CAPTIVE PORTAL FQDN

This configuration is allow for firmware 17.1 and after.

How you can switch to using the device hostname for the Captive Portal and other end-user interactions as follows:

Log in to the Firewall console over ssh
Select option 4 (Device Console)
Enter the following command at the prompt: (use the command)
set http_proxy proxy_url_use_hostname on
To confirm that it has set, enter the following command:
show http_proxy
Type ‘exit’ to return to the menu and logout.


source: https://ideas.sophos.com/forums/330219-sophos-xg-firewall/suggestions/11580213-captive-portal-fqdn-support

HOW TO CHECK ALL TERM OF ONLINE SERVICE

https://tosdr.org/#

HOW TO CUT MP3 AND MERGE FILES IN LINUX UBUNTU

First do the download the audacity
sudo apt-get install audacity

After open the program and add your music select for delete  stretch that you want and export the file for .mp3.

for know how is possible cut the files you can see this kb:
source1: https://manual.audacityteam.org/man/tutorial_editing_an_existing_file.html
source2: https://www.wikihow.com/Remove-Unnecessary-Audio-with-Audacity

after  that, execute that for all files thtat you want start the merge executing this procedure in terminal.



ffmpeg -i "concat:1.mp3|2.mp3|3.mp3|4.mp3|55.mp3" -acodec copy output.mp3

and walla... done my friend. just play your new music.

URL SKYPE

avcdn.net
digicert.com
skype.com
live.com
login.live.com
auth.gfx.ms

PDF ANALYZING TOOL - PEEPDF

SOURCE: http://eternal-todo.com/tools/peepdf-pdf-analysis-tool

HOW TO FIX MESSAGE "/usr/bin/pip: No such file or directory"

execute: pip
look message return: /usr/bin/pip: No such file or directory


execute:which pip
look message return: -su: /usr/bin/pip: No such file or directory

execute:type pip
look message return: pip is hashed (/usr/bin/pip)

So in this case, pip is definintely in /usr/local/bin/pip but it is been cached as in /usr/bin/pip,
thanks to the Stackoverflow question, the solution is very simple, just execute:

hash -r


source master: http://cheng.logdown.com/posts/2015/06/14/-usr-bin-pip-no-such-file-or-directory

MESSAGE: /usr/bin/pip: No such file or directory but then checked which pip was being called.

execute: which pip

after that:
/usr/local/bin/pip uninstall pip 
apt-get remove python-pip 
apt-get install python-pip 

HOW TO UPGRADE YOUR PYTHON VERSION

sudo add-apt-repository ppa:jonathonf/python-3.x
sudo apt update
sudo apt install python3.x

Afterchange the default Python folder by this way:

sudo rm /usr/bin/python
sudo ln -s /usr/bin/python3 /usr/bin/python
Check the default


for check your python version:
 python -V

HOW TO INSTALL OWASPZAP FOR DEBIAN 9.0

For Debian 9.0 run the following as root:
echo 'deb http://download.opensuse.org/repositories/home:/cabelo/Debian_9.0/ /' > /etc/apt/sources.list.d/home:cabelo.list
apt-get update
apt-get install owasp-zap

Source:

https://software.opensuse.org/download.html?project=home%3Acabelo&package=owasp-zap
http://appseclive.org/apt/stable/

ACCESS APPLE TIME CAPSULE

First :

sudo apt-get install cifs-utils

download script  "timecapsule-handler"
from: https://mega.nz/#!vUVBiaBQ!WHlCvhZVeOdd5fnqfnyJjWI0OJ2X14efuRXK8seosCg

gedit timecapsule -handler

set yours data:
ip time capsule:
volume shared:
password registred:
mount point


TIMECAPSULE_IP="" # e.g. "192.168.1.100" TIMECAPSULE_VOLUME="/Time\ Capsule" # also try "/Data" TIMECAPSULE_PASSWORD="YOURPASSWORDHERE" # prefix special characters, e.g. \! MOUNT_POINT=/mnt/timecapsule # no need to create the directory

after that save your file

chmodc +x timecapsule-handler && sudo mv timecapsule-handler /usr/local/bin
cd /usr/local/bin

sudo timecapsule-handle


worked on debian 9

source and dedicated for my friend:

https://ineed.coffee/418/how-to-automatically-mount-and-umount-apple-time-capsule-on-linux/

MOUNT USB DEVICE ON VIRTUALBOX BY LINUX

First:
you must install virtual box extension pack compatible

Second:
execute by terminal this command:

#usermod -aG vboxusers <username> # for add user in group vboxusers # virtualbox group
#usermod -a -G vboxusers <username> # for add user in group vboxusers # virtualbox group
#groups <username> # for list user group added
#sudo apt-get install gnome-system-tools # program for check user group by gui

After that restart your computer....
After restart i'll be available add devices on usb device filter filed.

DNS AVAILABLE

DNS OPENDNS
208.67.222.222 and 208.67.220.220

DNS CLOUD FLARE
1.1.1.1 and 1.0.0.1

KASPERSKY SECURITY 10 FOR WINDOWS SERVER (KSWS10.1)

You can find following this path folder after installed:

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security 10.1 for Windows Server\mibs

https://mega.nz/#F!GY1BRCZJ!tb9q9m2Z04FXgNNQxsu4zw

HOW TO LIST SUBPROCESS FROM WINDOWS SCVHOST.EXE

tasklist /svc |find "scvhost;exe"

HOW TO CHANGE LISTENING PORT SSH ON UBUNTU

vi /etc/ssh/sshd_config

vi /etc/ssh/ssh_config

Obs, was change from 22 for 2222

HOW TO COMPRESS (ZIP) FILES AND FOLDER WITH PASSWORD ON LINUX

Just do that:

root@station-0:/home/andrevianna/Desktop# zip -P infected -r files.zip F <localfolder>

HOW TO CONNECT VIA PPPOE OVER LINUX

sudo apt install pppoeconf
sudo pppoeconf
ifconfig

to disconect sudo poff

sudo pon dsl-provider

HOW TO ZIP FILE WITH PASSWORD ON LINUX

zip --encrypt secure.zip file
Enter password:
Verify password:
  adding: file (deflated 8%)

HOW TO FIX NO INTERNET ACCESS NOTIFICATION

For windows 10 there is this message:

Access this registry key:

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/NlaSvc/Parameters/Internet

Under the Internet key, double-click EnableActiveProbing, and then in Value data, type: 0.The default for this value is 1. Setting the value to 0 prevents NCSI from connecting to a site on the Internet during checks for connectivity.

for windows 7 there is this reg information:

for windows 10 there is this reg information:

Is recommend allow access for those sites for this protcolo: HTTP/ DNS

PROBE MICROSOFT 
dns.msftncsi.com
dns.msftncsi.com
www.msftconnecttest.com
ipv6.msftconnecttest.com

SOURCE:
http://blog.superuser.com/2011/05/16/windows-7-network-awareness/

HOW TO CONFIGURE SOPHOS XG SSO IN THE RIGH WAY

There are many KB from sophos xg, sophos utm, cyberoam and astaro, however nobody know the righ way for configure this feature. was including open many tickets on sophos support without sucessfully.

after long time collecting and testing many sophos kb i'm developer my procedure and work really good.

The way and solution is simple:

so there are 3 steps that you must care when you plan implementing the sophos sso, following:


1: Firewall configuration
2: Active directory configuration/ gpo configuration
3: Workstation configuration

following the detail about those this steps:

for 1: Firewall configuration

create a user domain admins for the procedure inside firewall:

• create a connection association
• Import user groups for sso

for 2: Active directory configuration/ gpo configuration

After install the stas sso sophos xg software for autentication correctly you mus do:
grant firewall permission on AD server (if firewall is enable)
TCP port 5566 inbound and outbound

UDP port 5566,6060 and 6677


for wmi execution from stas you need do that:

Configure Windows Firewall using Group Policy
1.Launch the Group Policy Editor:
GUI:Go to Start Administrative Tools > Group Policy Management.
Command Line: Go to Start > Run. Enter gpmc.msc and click OK
2.Expand Domains > Domain Name > Group Policy Objects. Select the GPO that applies to the machines you need to allow WMI requests to query, and click Edit
3.Expand Computer Configuration > Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile. Select Domain Profile if the management console is in the domain; otherwise, select Standard profile.
Double-click Windows Firewall: Allow inbound remote administration exception to open its properties window.

Select Enabled to enable the Windows Firewall Rule and click OK to save the settings. You can also lock the incoming IP addresses down to only allow the queries from the your Domain Controller IPs, if desired.

there are 3 event id that must be in log on this step:

they are:

Event ID 4634 -  An account was successfully logged off
Event ID 4624 - An account was successfully logged on
Event ID 4768 - A Kerberos authentication ticket (TGT) was requested


For Event ID 4634 and ID 4624 you must do that:

Go to Start > Administrative Tools > Local Security Policy to view Security Settings. Browse to Security Settings > Local Policies > Audit Policy and double click on Audit account logon events to view the Audit account logon events Properties window.
Enable the Success and Failure logon events, as shown in the screen below.







 Expand Computer Configuration, and go to the node Audit Policy (Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Audit Policy).

Double-click on the policy setting Audit logon events, check Success and Failure audit, and click OK

For Event ID 4768 - A Kerberos authentication ticket (TGT) was requested

Obs, over all kb from sophos there no commented that is necessary log this event id 4768 and there no is mentioned how is possible configure this event id for log on the server:

 To enable event id 4768  in every Domain Controller, We need to configure audit settings in Default Domain Controllers Policy, or you can create new GPO and links it to the Domain Controllers OU via GPMC console, or else you can configure the corresponding policies on Local Security Policy of each and every Domain Controller..

Follow the below steps to enable Active Directory Kerberos Logon Audit event 4768 via Default Domain Controllers Policy.

Press the key 'Window' + 'R'
Type the command gpmc.msc, and click OK.       
Note: Skip the above steps by clicking Start -->Administrative Tools -->Group Policy                      Management.
Expand the domain node and Domain Controllers OU,  right-click on the Default Domain Controllers Policy, then click Edit.

Expand Computer Configuration node and Security Settings and navigate to the node Audit Policy (Computer Configuration->Policies->Windows Settings->Security Settings-> Advanced Audit Policy Configuration -> Audit Policies->Account Logon).

In right-side pane, double-click on Audit account logon events and set Success and Failure setting to enable kerberos logon event 4768.

 Note: In Windows 2008 R2 and later versions, you can also control this event by subcategory-level setting via Advanced Audit Policy Configuration.

    Expand Computer Configuration and Security Settings and navigate to the node Account Logon (Computer Configuration->Policies->Windows Settings->Security Settings-> Advanced Audit Policy Configuration -> Audit Policies->Account Logon) and set the setting Audit Kerberos Authentication Service as Success and Failure

Run the command gpupdate /force from command prompt to update Group Policy settings.


for 3: Workstation configuration


When performing the test, STAS displays the "remote procedure call failure" error, to solve the problem follow the procedures below.

New user profile
The user profile is a collection of settings that make your computer look and function the way you want it to. It contains settings for desktop backgrounds, screen savers, pointer preferences, sound settings, and other features. Due to this variety of personal settings and changes caused by other programs can happen to corrupt the user profile or malfunction in the use of the system, so the need for a new profile.

1. Press the Windows + X keys, Control Panel;
2. Click User Accounts and Family Protection;
3. Click User Accounts;
4. Click Manage Another Account;
5. Now click on Add a new user in the computer settings;
6. Add the name to the new profile and add it as administrator.

Test and see if the behavior repeats, if the behavior continues, perform the next procedure.

Clean Boot
Clean boot is used to determine if a background program is interfering with the system.
Press the Windows + R keys, type MSconfig and click Ok;
In the System Configuration window, click the services tab;
At the bottom of the screen check the Hide All Microsoft Services box and click Disable All;
Now click the Programs Initialization tab and click on Open Task Manager;
In the task manager window on the boot tab, disable all non-Microsoft programs, close the task manager, and then click ok in system setup and restart the computer if prompted.

 NOTE: This disables all third-party services and programs. You can later, if the problem is solved in this way, enable the programs and services that will be started with Windows selectively instead of keeping them all disabled. If the problem comes back after enabling the initialization of a specific service or program, the problem is exactly with that software and it is advisable to remove it.

If the behavior continues, perform the next procedure.

        Run Dism and Scannow repair tools.
        These tools are diagnostic and aid in the repair of the system image.

        Press the Windows + X keys, select Command Prompt (Admin), copy and paste the commands below and press enter after each command.
        Sfc / ScanNow
        Dism / Online / Cleanup-image / RestoreHealth

Test and see if the behavior repeats, if the behavior continues, perform the next procedure.

 Run the CHKDSK tool
 Chkdsk.exe is the command line interface for a program that checks the logical integrity of a file system in Windows. When CHKDSK encounters logical inconsistencies, it performs actions to repair file system data as long as it is not in read-only mode.

       Click Start, on the search bar type CMD right-click on the application and select the Run as administrator option.
       Now copy and paste the command below.

       chkdsk / f / r / x / b

Note: You will receive a message that "CHKDSK can not be run because the volume is in use" press S to confirm and press Enter and restart the computer. Before starting the operating system will check, this procedure may take a few minutes wait until it is finished.

Test again and see if the behavior repeats itself.


Press the Windows + X keys, select Command Prompt (Admin), copy and paste the commands below and press enter after each command.

create a bat file with this information:

@echo off 

netsh advfirewall firewall add rule name="Open Port 139" dir=in action=allow protocol=TCP localport=139

netsh advfirewall firewall add rule name="Open Port 1070" dir=in action=allow protocol=TCP localport=1070

netsh advfirewall firewall add rule name="Open Port 135" dir=in action=allow protocol=TCP localport=135

netsh advfirewall firewall add rule name="Open Port 445" dir=in action=allow protocol=TCP localport=445

netsh advfirewall firewall add rule name="Open Port 69" dir=in action=allow protocol=TCP localport=69

netsh advfirewall firewall add rule name="Open Port 137" dir=in action=allow protocol=TCP localport=137

netsh advfirewall firewall add rule name="Open Port 138" dir=in action=allow protocol=TCP localport=138

netsh firewall set service REMOTEADMIN enable

net start RpcLocator

net start wmiApSrv

net start WinRM 

net start Winmgmt

net start Spooler

net start RpcSs

net start lmhosts

net start SSDPSRV

echo.

exit%uFEFF

execute on the computer the bat file

Enable these windows services.msc to start automagically, it took me a while to get it running as well:

Remote Procedure Call (RPC)
Remote Procedure Call (RPC) Locator
Remote Registry
Secondary Login
Windows Management Instrumentation

Windows Remote Management (WS-Management)





sources:

http://www.morgantechspace.com/2014/05/Event-ID-4768-A-Kerberos-authentication-ticket-was-requested.html
https://community.spiceworks.com/topic/285215-wmi-access-denied

HOW TO CREATE A USER AND GROUP IN LINUX

create a grop# groupadd ftp_vi4nn4
create a user# useradd  vi4nn4
add user on group# usermod -a -G ftp_vi4nn4 vi4nn4
list user on group# grep ftp_vi4nn4 /etc/group
list user on group# members ftp_vi4nn4
change password from the user# passwd vi4nn4

for delete group# deletegroup <group>
for delete user#  userdel <user>

HOW TO CUT PDF ON UBUNTU

sudo apt-get update
sudo apt-get install pdftk
pdftk myoldfile.pdf cat 1 2 4 5 output mynewfile.pdf