[security] File descriptor connecting to nix system and danger of using exec() in python

I have been writing python for quite a while about 2 years to be exact and mostly I am writing network related scripts or API calling scripts, but I have never used the python statement exec before, according to the help the exec is to execute the python statements. So supposed I need to print … Continue reading [security] File descriptor connecting to nix system and danger of using exec() in python

[security]Update new exploitdb script to metasploit

So I was doing hackthebox.eu and realize there the target used a vulnerable web application, the exploit was developed and can be downloaded from exploitdb, but it was not updated in msfconsole when I do a search openadmin I could only see an outdated exploit that was disclosed on the 2017. The ruby script that … Continue reading [security]Update new exploitdb script to metasploit

[security] File upload

The lab uses metasploitable. This lab gives awareness of file upload vulnerability, there are three levels of security - low, medium and high, the objective is to try to upload a forward shell code then connect to it to gain the server access. Low security This is the php code of low security file upload: … Continue reading [security] File upload

[python]Cisco FMC REST API example – GET Server version and add device to Cisco FMC

Introduction The version used for this lab is Cisco FMC 6.4.0, and Cisco FTD used is 6.3.0. To access the Cisco FMC REST API, you need to ensure it is enabled. You can test it by going to https:///api/api-explorer if you can see the swagger like documentation then the REST API is enabled, you can … Continue reading [python]Cisco FMC REST API example – GET Server version and add device to Cisco FMC

[python]Grow commands from a template with jinja2

Problem I made a template to push object network configuration to Cisco ASA, this is how the template looks like: conf_attr is the keyword to store the payload I sent to Cisco ASA via Nornir/netmiko, the problem with this template is only one command is sent per session. In order to commands to be sent … Continue reading [python]Grow commands from a template with jinja2

[python]Capture return values after threads are finished.

Return value lost after threads finished I have made two functions: The jinja template for preparing the object network {name} command: Then I create a test code to push multiple object network {name} commands to a single cisco asa - fw02. To achieve concurrency I use the threading.Thread module, however my return value of send_net_objs_to_asa_host … Continue reading [python]Capture return values after threads are finished.

[python]show run object network

Cisco ASA's show run object network will show the subnet, host and range objects, netmiko has a textfsm template to match the result in dictionary, however there is no template to match show run object service hence for the service part you will need to write your own textfsm template. On this example I will … Continue reading [python]show run object network

[python]Convert TextFSM nested list data into dictionary

Introduction Reference: http://gratuitousarp.info/a-quick-example-of-using-textfsm-to-parse-data-from-cisco-show-commands/ The reference article alluded a method known as value_map, I immediately knew it is possible to change to dictionary easily when I saw the output of value_map. This is how the output of value_map looks like, and this explains how the variable maps to the regex, if you are using re module … Continue reading [python]Convert TextFSM nested list data into dictionary