How Crunch – Password file maker works

Reference: Kali Linux - Hacking Tools Introduction









Crunch is a wordlist generator where you can specify a standard character set or a character set you specify.

Crunch can generate all possible combinations and permutations.

With specifying the minimum and maximum length of characters, and the characters themselves,

Crunch will create a comprehensive list of words that can be used for password cracker programs.

Below shows how crunch command is used:

rassoul @kali:~# crunch

Usage: crunch <min> <max> [options]


Below example, will create a password list with words between 2 to 3 character using one of “01234567890abcdef#!” characters. And the result will be saved into a file called password.txt.

rassoul @kali:~# crunch 2 3 0123456789abcdef#! -o password.txt


Below shows part of the created file above as a result of using crunch command:

rassoul@kali:~$cat password.txt

00
01
02
03
….
01#
01!
020
021
….
!!f
!!#
!!!

Essential Application Vulnerabilities and Security Controls

Below list is a high level view of what application vulnerabilities are and how we can mitigate them by introducing proper controls.

Vulnerability Category	Potential Problem Due to Bad Design	Controls
Input Validation	Attacks performed by embedding malicious strings in query strings, form fields, cookies, and HTTP headers. These include command execution, cross-site scripting (XSS), SQL injection, and buffer overflow attacks.	WAF, Input validation and verification
Authentication	Identity spoofing, password cracking, elevation of privileges, and unauthorized access.	WAF, Session Management, Passwords, Two Factor, IDM
Authorization	Access to confidential or restricted data, tampering, and execution of unauthorized operations.	Session Management, Access Controls, IDM
Configuration Management	Unauthorized access to administration interfaces, ability to update configuration data, and unauthorized access to user accounts and account profiles.	Path Management, Access Filtering, IDM, PIM, Session Management
Sensitive Data	Confidential information disclosure and data tampering.	Encryption, Hashing controls
Session Management	Capture of session identifiers resulting in session hijacking and identity spoofing.	IDM, Session Management
Cryptography	Access to confidential data or account credentials, or both.	Encryption, Hashing controls, DB Access Controls
Parameter Manipulation	Path traversal attacks, command execution, and bypass of access control mechanisms among others, leading to information disclosure, elevation of privileges, and denial of service.	WAF, Input validation, Parameter validation, Header validation
Auditing and Logging	Failure to spot the signs of intrusion, inability to prove a user's actions, and difficulties in problem diagnosis.	Detailed logging, Syslog server, SIEM, Alerting, Reporting

Quick CISSP Security Course References Summary

Here are my ISC2 CISSP notes.

If you need a quick and summary index of what is required to pass CISSP exam, this would help.

Click here to get the file

What is PII, PHI and how they are considered Sensitive Information

Below is a quick summary of what PHI and PII records are and under what circumstances they are considered sensitive information.
Note: Take care of your personal records at all time, do not provide these information to anyone unless they are absolutely trusted....


Protected Health Information (PHI)


Protected Health Information (PHI) is an individual’s health information that is created or received by a health care provider related to the provision of health care by a covered entity that identifies or could reasonably identify the individual. The 18 identifiers that are considered PHI are included in OHRPP Guidance & Procedures: Health Insurance Portability and Accountability Act (HIPAA)


An individual’s personal and health information that is created, received, or maintained by a health care provider or health plan and includes at least one of the 18 personal identifiers listed below in association with the health information:

• Name
• Street address
• All elements of dates except year
• Telephone number
• Fax number
• Email address
• URL address
• IP address
• Social Security number
• Account numbers
• License numbers
• Medical Record number
• Health plan beneficiary #
• Device identifiers and their serial numbers
• Vehicle identifiers and serial number
• Biometric identifiers (finger and voice prints)
• Full face photos and other comparable images
• Any other unique identifying number, code, or characteristic

Limited Data Set - a limited data set can include the following identifiers: a unique number code, or characteristic that does not include any of the above listed identifiers, geographic data (without street address), and/or dates


Personal Identifiable Information (PII)


Personal Identifiable Information (PII) is defined as data or other information which otherwise identifies, an individual or provides information about an individual in a way that is reasonably likely to enable identification of a specific person and make personal information about them known. Personal information includes, but is not limited to, information regarding a person's home or other personal address, social security number, driver's license, marital status, financial information, credit card numbers, bank accounts, parental status, sex, race, religion, political affiliation, personal assets, medical conditions, medical records or test results, home or other personal phone numbers, non-university address, employee number, personnel or student records and so on.


Information about an individual which includes any of the identifiers below:

• Name
• Street address
• All elements of dates except year
• Telephone number
• Fax number
• Email address
• URL address
• IP address
• Social Security number
• Account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial account
• Driver’s License numbers or California or other identification card number
• Device identifiers and their serial numbers
• Vehicle identifiers and serial number
• Biometric identifiers (finger and voice prints)
• Full face photos and other comparable images
• Any other unique identifying number, code, or characteristic (e.g., student identification number).

Sensitive Data or Information

An individual’s first name (or first initial) and last name in combination with any of the following:
Social Security Number
Driver’s License Number or California ID card number
Financial account information such as a credit card number
Medical Information