Lista de comandos mais usados para os comandos “openssl” e “keytool”

Generate a new key

openssl genrsa -out server.key 2048

Generate a new CSR

openssl req -sha256 -new -key server.key -out server.csr

Check certificate against CA

openssl verify -verbose -CApath ./CA/ -CAfile ./CA/cacert.pem cert.pem

Self Signed

openssl req -new -sha256 -newkey rsa:2048 -days 1095 -nodes -x509 -keyout server.key -out server.pem

crlf fix

perl -pi -e ‘s/\015$//’ badcertwithlf.pem

match keys, certs and requests

Simply compare the md5 hash of the private key modulus, the certificate modulus, or the CSR modulus and it tells you whether they match or not.

openssl x509 -noout -modulus -in yoursignedcert.pem | openssl md5
openssl rsa -noout -modulus -in yourkey.key | openssl md5
openssl req -noout -modulus -in yourcsrfile.csr | openssl md5

criar uma CA

/usr/share/ssl/misc/CA -newca

Generate a CSR

/usr/share/ssl/misc/CA.sh -newreq

Cert -> CSR

openssl x509 -x509toreq -in server.crt -out server.csr -signkey server.key

Sign

/usr/share/ssl/misc/CA.sh -sign

Decrypt private key (so Apache/nginx won’t ask for it)

openssl rsa -in newkey.pem -out wwwkeyunsecure.pem
cat wwwkeyunsecure.pem >> /etc/ssl/certs/imapd.pem

Encrypt private key AES or 3DES

openssl rsa -in unencrypted.key -aes256 -out encrypted.key
openssl rsa -in unencrypted.key -des3 -out encrypted.key

Get some info

openssl x509 -noout -text -nameopt multiline,utf8 -in certificado.pem
openssl x509 -noout -text -fingerprint -in cert.pem
openssl s_client -showcerts -connect www.google.com:443
openssl req -text -noout -in req.pem

list P7B

openssl pkcs7 -in certs.p7b -print_certs -out certs.pem

PEM -> PFX

openssl pkcs12 -export -out alvaro.p12 -name “Certificado do Alvaro” -inkey newreq.pem -in newcert.pem -certfile cacert.pem

PFX -> pem (with key)

openssl pkcs12 -in ClientAuthCert.pfx -out ClientAuthCertKey.pem -nodes -clcerts

DER (.crt .cer .der) to PEM

openssl x509 -inform der -in MYCERT.cer -out MYCERT.pem

PEM -> DER

openssl x509 -outform der -in MYCERT.pem -out MYCERT.der
openssl rsa -in key.pem -outform DER -out keyout.der

JKS -> P12

keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore keystore.p12

P12 -> JKS

keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore keystore.jks

Revoke

openssl ca -revoke CA/newcerts/cert.pem
openssl ca -gencrl -out CA/crl/ca.crl
openssl crl -text -noout -in CA/crl/ca.crl
openssl crl -text -noout -in CA/crl/ca.der -inform der

Base64 encoding/decoding

openssl enc -base64 -in myfile -out myfile.b64
openssl enc -d -base64 -in myfile.b64 -out myfile.decoded

echo username:passwd | openssl base64
echo dXNlcm5hbWU6cGFzc3dkCg== | openssl base64 -d

Generate a Java keystore and key pair

keytool -genkey -alias mydomain -keyalg RSA -keysize 2048 -keystore mykeystore.jks

Generate a certificate signing request (CSR) for an existing Java keystore

keytool -certreq -alias mydomain -keyalg RSA -file mydomain.csr -keystore mykeystore.jks

Import a root or intermediate CA certificate to an existing Java keystore

keytool -import -trustcacerts -alias ca-root -file ca-root.pem -keystore cacerts
keytool -import -trustcacerts -alias thawte-root -file thawte.crt -keystore keystore.jks

Generate a keystore and self-signed certificate

keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360

openssl pkcs8 -topk8 -nocrypt -in key.pem -inform PEM -out key.der -outform DER
openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER

For L7: intermediate CA1 >>> intermediate CA2 >>> root CA)

openssl pkcs12 -export -in input.crt -inkey input.key -certfile root.crt -out bundle.p12

Better DH for nginx/Apache

openssl dhparam -out dhparam.pem 2048

Grab a certificate from a server that requires SSL authentication

openssl s_client -connect sslclientauth.reguly.com:443 -cert alvarows_ssl.pem -key alvarows_ssl.key

Ferramentas de análise selecionadas com base na descrição e na facilidade de implementação – baseado no artigo do site Geek Flare:

Qualys: apresenta o teste focado em vulnerabilidades HTTPS

UpGuard: faz uma avaliação de risco incluindo SSL, Clickjack attack, Cookie, DNSSEC, Headers, etc.

Tinfoil: faz o teste com 10 vulnerabilidades OWASP, bem como outras brechas de segurança conhecidas.

Menção honrosa: Scan My Server – provê testes de segurança em SQL Injection, Cross Site Scripting, PHP Code Injection, Source Disclosure, HTTP Header Injection, Blind SQL Injection, entre outros. Entretanto, exige colocar um código HTML de imagem e link na página para rodar a varredura de vulnerabilidade.

/var/log/alienvault/devices/ – diretório das logs recebidas pelo syslog no SIEM

/etc/ossim/agent/plugins – diretório de plugins

/etc/init.d/ossim-agent restart – para efetuar restart do agente, após alterar plugins

tail -f /var/log/alienvault/api/api_access.log — lista de acessos à Internet feitos pela API

dpkg -l | grep alienvault – verificar a versão do OSSIM

Códigos de facilities do Syslog

Facility code	Keyword	Description
0	kern	kernel messages
1	user	user-level messages
2	mail	mail system
3	daemon	system daemons
4	auth	security/authorization messages
5	syslog	messages generated internally by syslogd
6	lpr	line printer subsystem
7	news	network news subsystem
8	uucp	UUCP subsystem
9		clock daemon
10	authpriv	security/authorization messages
11	ftp	FTP daemon
12	–	NTP subsystem
13	–	log audit
14	–	log alert
15	cron	scheduling daemon
16	local0	local use 0 (local0)
17	local1	local use 1 (local1)
18	local2	local use 2 (local2)
19	local3	local use 3 (local3)
20	local4	local use 4 (local4)
21	local5	local use 5 (local5)
22	local6	local use 6 (local6)
23	local7	local use 7 (local7)

1. Verificar quais colunas trazem o MD5 Hash:
   SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE COLUMN_NAME LIKE ‘%md5hash%’
2. Verificar quais eventos caracterizam infecção:
   SELECT TOP 100 * FROM EPOEvents WHERE ThreatName != ‘none’
3. Verificar quais eventos são de JTI Client – Entender melhor:
   SELECT * FROM JTIClientEventInfo