We are conspiracy
OS
Purge OS X inactive Memory
0The memory in OSX is divided in four important categories such as shown below :
Those « types » of memory combined together are the full size of your ram, in my case 8Gb. Each type as a specific function in OS X those are described below :
Free:
This is RAM that’s not being used.
Inactive:
This information in memory is not actively being used, but was recently used.
For example, if you’ve been using Mail and then quit it, the RAM that Mail was using is marked as Inactive memory. This Inactive memory is available for use by another application, just like Free memory. However, if you open Mail before its Inactive memory is used by a different application, Mail will open quicker because its Inactive memory is converted to Active memory, instead of loading Mail from the slower hard disk
Wired:
Information in this memory can’t be moved to the hard disk, so it must stay in RAM. The amount of Wired memory depends on the applications you are using.
Active:
This information is currently in memory, and has been recently used.
As you can see, the inactive memory is used for fast access to an application, and sometimes if happened that the memory is not released by OSX or not shared. This can make the mac really slow and buggy. As I got the problem I searched for a solution I found that one :
- If you do not have the developers tools installed, install them.
- open a shell and type in the following command :
$/usr/bin/purge
This command will purge the inactive memory and set this memory as free. This command should help you if your free memory decreased to less than a GB and that you inactive memory increased or wasn’t allowed to be used by other softwares.
And That’s it.
Encrytpted Folder on Mac OS X
1Today a friend of mine told me that while he was traveling his laptop was stolen, unfortunately for him, it was his work laptop containing all his data, projects, presentations and a few clients data. Fortunately, he told me that the laptop was using truecrypt, that all the files contained on the laptop where encrypted and that no one would be able to use the laptop without its consent.
After this small conversation, I began to freak out about my mac being stolen and my projects and personal data being published on the internet so I decided to encrypt my drive, and my fist thought was to use truecrypt or firevault on my mac, but I wasn’t sure to like the fact that my drive would be totally encrypted and that I would not be able to use a forensic method if my drive was crashing. Therefore I finally decided to create an encrypted folder on my mac.
This is the way of doing it step by step:
- On your desktop create the folder that you want to encrypt ( in my case « Projects »)
- Open the Application folder and open the Utilities folder
- Open the Disk Utility application
From an existing folder:
in the Disk Utility application :
- Goto « file » -> « Disk Image From Folder »
- Chose the folder you want to encrypt (in my case « Projects »)
- Chose the encryption (the stronger the best) AES 256 bit
- Enter your Pass-phrase (PLEASE) do not use 5 chars ! *
- Click on
- The process of creating you encrypted folder will begin.
From a non Existing Folder:
As you may see the folder is an image (Projects.img) which means that you can mount and unmount the encrypted image or even copy it to an USB drive.
- Goto « File » -> « Blank Disk Image »
Encrypted Disk Image
- Choose the Size (I took 8.3 GB)
- Choose the Encryption (AES 256-bit)
- Click on Create
- Enter your pass-phrase
Now you will find a encrypted folder on your Desktop at any time, and when you will click on it, it will ask you the pass-phrase to open it.
And That’s it.
–
*To be secure a password rely on:
- On the letters you are using ( A-Z, a-z)
- On the numbers your are using (0-9)
- On the special chars ( @, /, !, #, etc)
- BUT ALSO on the length of it
using a password like the following « ABd2@ » will be anyway less secure than using « ThisIsMyPasswordAndILikeToWearLargeJeansBecauseMyFavoriteNumberIs42″ so please consider using a nice and long and secure password.
Hidden Wi-Fi Diagnostics Tool In Mac OS X 10.7 Lion
0During my search on « How to show the Library Folder on OS X Lion » I found an nice article talking about a hidden Wi-Fi Diagnostic Tool in OS X Lion, and after a few tests, I thought that it was a good idea to publish it on my blog as well.
In Mac OS X Lion and Previous versions, a tool for connections test was existing (e.g. Utilities -> Network Utilities ) but it was not dedicated to Wi-Fi. However this one is, and is accessible at :
/System/Library/CoreServices/Wi-Fi\ Diagnostics.app/
To access it :
- Open the Terminal
- Copy, paste the previous Link in the Terminal preceded by « open »
open /System/Library/CoreServices/Wi-Fi\ Diagnostics.app/
- Press Enter
You should see the following window appear on your screen (Open your Wi-Fi):
As shown above, you will have the choice between four options, lets resume them fast :
Monitor Performance:
This option will give you a few information about the Wi-Fi connection you are using, and the signal rate etc ( such as shown in the print screen below )
You will the be able to export all the data into a PLIST (XML) file.
Record Events :
This will allow you the possibility to monitor all the events appearing on your Wi-Fi. ( This could be useful when you know that a friend is trying to hack your Wi-Fi for fun )
In this case you will be able to export everything as well in a Plist file.
Capture raw frames :
This option will allow you to capture data going on the network, going to and from your computer, or data that could be listened on other networks :
Below You might see the capture Process :
To see the data, you will have to click on continue and export the data, finally a ZIP file will be created with a Plist file and a PCAP file that you will be able to open with a tool such as wireshark.
Turn On debug logs :
This option is just a log system about your connection. Most of the information received are kernel calls.
Now you will be able to monitor your Wi-Fi connection in the best way.
And that’s it.
[Source]
Show the ~/Library Folder on OS X Lion
0I discovered a few days ago that on my brand new version of OS X Lion, my library folder was hidden, and that the only way to access it was to use the Terminal. After a few searches on the web, I found the right command to apply to my Library folder.
chflags :
The chflags utility modifies the file flags of the listed files as specified by the flags operand.
To make the ~/Library folder visible you may follow these steps :
- Open the Terminal and type :
chflags nohidden ~/Library/
- Press enter
Now that your folder is visible, you might also use this command in the terminal to see the flags of the folders in the current directory.
ls -lO
The above command will print out in your Terminal the following output when a folder is hidden :
drwx------@ 53 noktec staff hidden 1802 Aug 00 00:00 Library
And that’s it
[source]
PPTP VPN With Debian (add button disabled)
0164 jours
Today I had to create a PPTP VPN in a Debian virtual machine, therefore I installed the following packets :
- $sudo apt-get install pptpd
- $sudo apt-get install pptp
- $sudo apt-get instapp network-manager-pptp
but when I tried to add the VPN ( in System -> Preferences -> Network Connections ) the « add » button was disabled.
I tried to use the installed tools such as « pptpsetup », but I couldn’t connect remotely to my VPN, but after a few searches on apt with apt-cache search, and with the help of a friend we found out that other packages were missing. To solve the problem you might install the following package :
- $sudo apt-get network-manager-pptp-gnome ( which was the Gnome GUI)
If this doesn’t solve the problem yet, ( and to install everything ), I finally installed also those :
- $sudo apt-get install network-manager-openvpn
- $sudo apt-get install network-manager-vpnc
- $sudo apt-get install network-manager-vpnc-gnome
after this I restarted the following services :
- /etc/init.d/pptpd restart
- /etc/init.d/network-manager restart
and I could configure my VPN.
and that’s it.
Export Path OS X Lion
2Today I searched how to export a path in OSX Lion for the installation of NetDiscover. After a few searches on Google I found the following blog post from Adam Jordens (link) explaining how Lion was managing the paths, I will resume it briefly.
On most of the Linux distributions, and on the previous versions of OS X, we had to edit the following file:
~/.bash_profile
In it we could export all the PATH needed for any application. But in OS X Lion we can directly edit the following directory
/etc/paths.d/
In there we can create files containing the path and it will be directly and automatically added to the path system.
For example :
- $ sudo vim name_of_the_app
Then we can edit the file and add a path such as (depending on your path)
/usr/lib/name_of_the_app/bin
And that’s it.
NAT is blocked
0412 jours
Today, I got a new laptop at home, and I wanted to connect it to the internet, but my ISP required me to
give the mac address of each device I wanted to connect to the internet, so for 10£, I could register on internet
4 mac addresses !
Unfortunately for me, I have really more than 10 devices to connect.
That’s why I decided to buy a Cisco Linksys E2000 router to use the NAT (Network address translation).
Once my router seted up and connected, I discovered with horror that I couldn’t go on the internet, and always
received a message like the following: « NAT was detected … bla bla bla Illegal … bla bla bla ».
As you may imagine, a basic connection is like the following :
but in my case, it could be designed like the following :
and I wanted to add a router, implementing NAT to avoid me to buy « mac addresses ».
After a few readings ( RFC of NAT) and a few tests with Wireshark, I discovered that the only field which was modified by the router was the TTL (Time To Live) field .
That’s how I came with the idea to upgrade the TTL from 2 on my machines, and I fastly discovered that with only one IpTables command I could do that :
iptables -t mangle -I postrouting -j TTL --ttl-set inc 2
and this is how I bypassed the TTL check of my ISP.
Have fun 
Next step: Linux Router to increment the ttl by 1 on the router !
Forensic Bookmark.plist from Safari
0I was reading some documents on Mac Os X forensic, and I was searching
how to get back the Bookmark.plist from safari to parse it and read it easily …
I knew that this file is located in the following folder :
~Library/Safary/Bookmarks.plist
I was thinking that plist files where always XML documents and tried with python to read the file, I opened python and typed the following commands.
>>> import plistlib
>>> plist.readPlist('Bookmarks.plist)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/System/Library/Frameworks/Python.framework/Versions/2.6/lib/python2.6/plistlib.py", line 78, in readPlist
rootObject = p.parse(pathOrFile)
File "/System/Library/Frameworks/Python.framework/Versions/2.6/lib/python2.6/plistlib.py", line 405, in parse
parser.ParseFile(fileobj)
xml.parsers.expat.ExpatError: not well-formed (invalid token): line 1, column 9
Yeah ! Error …
I got back to my shell and tried to read it with
$ cat Bookmarsk.plist
[...] it was not an XML output at all !
I directly decide to go to developer.apple.com/ , to find the plist use, and find out that some plist files are in
BINARY FORMAT PROPERTY LISTS
WTF ??
hopefully the command was given to translate it to XML
plutil -convert xml1 -o - Bookmarks.plist
I tried it, and it gave me a cool XML format.
I could then put the output of this command in an XML file and use it.
Ping Script
0568 jours
A few minutes ago I completed this little ping script,
for non initiated users.
It first pings the 192.168.1.1
then pings the 192.168.2.1
after that it pings the 8.8.8.8
and finally pings the www.google.com address
Why does it pings 1.1 and 2.1 ?
Because my friend wanted to use it in different areas, ( he his not familiar with the shell ) for example at work 1.1 and home 2.1.
Why does it pings 8.8.8.8 and google.com ?
Similar as above 8.8.8.8 is the DNS of google .. and google.com is just reaching the web
How does it work ? :
Execute the script.sh and it will print out 5 pings to 1.1 and write the result in GREEN / RED and then 5 pings to 2.1 and the result in GREEN / RED
and so one.
The script :
#!/bin/sh GREEN="\\033[1;32m" NORMAL="\\033[0;39m" RED="\\033[1;31m" clear ####################### 1.1 ################ ping -c 5 192.168.1.1 if [ ! "$?" -eq 0 ]; then echo -e "$RED" "ping 1.1 failed" "$NORMAL" else echo -e "$GREEN" "ping 1.1 passed" "$NORMAL" fi ########################## 2.1 ############## ping -c 5 192.168.2.1 if [ ! "$?" -eq 0 ]; then echo -e "$RED" "ping 2.1 failed" "$NORMAL" else echo -e "$GREEN" "ping 2.1 passed" "$NORMAL" fi ########################## 8.8 ############## ping -c 5 8.8.8.8 if [ ! "$?" -eq 0 ]; then echo-e "$RED" "ping 8.8 failed" "$NORMAL" else echo -e "$GREEN" "ping 8.8 passed" "$NORMAL" fi ########################## GOOGLE ############## ping -c 5 www.google.com if [ ! "$?" -eq 0 ]; then echo -e "$RED" "ping google failed" "$NORMAL" else echo -e "$GREEN" "ping google passed" "$NORMAL" fi
So have fun