Mise à jour de la base de données, veuillez patienter...

Compte local.
J'ai simplement pris une VM ici https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ et je l'ai lancé sans rien toucher.
— Permalink

Suite de https://ecirtam.net/links/?nTNSTw

Quelques paquets bien bavard. Ils apparaissent assez souvent.

```
https://storeedgefd.dsx.mp.microsoft.com/v8.0/products/9WZDNCRD2G0J?
appversion=11712.1001.0.0
&idType=ProductId
&market=FR
&locale=en-US
&deviceType=
&deviceFamily=Windows.Desktop
&catalogLocales=en-US%2Cfr-FR
&hardware=arm0%2Carm640%2Cble0%2Ccmb0%2Ccmf0%2Ccmr0%2Cdcb1%2Cdcc1%2Cdx91%2Cdxa1%2Cdxb1%2Cgyr0%2Chce0%2Chdc0%2Chov0%2Chsa0%2Chss1%2Ckbd1%2Cm041%2Cm060%2Cm080%2Cm120%2Cm160%2Cm200%2Cm301%2Cm751%2CmA01%2Cmct0%2Cmgn0%2Cmic0%2Cmrc0%2Cmse1%2CmT01%2Cnfc0%2Crs10%2Crs20%2Crs30%2Crs40%2Crs50%2Crs60%2Ctch0%2Ctel0%2Cv010%2Cv020%2Cv040%2Cx641%2Cx860%2Cx86a640%2Cxbd0%2Cxbo0%2Cxbs0%2Cxbx0%2Cxgp0
&packageHardware=dcb%2Cdcc%2Cdx9%2Cdxa%2Cdxb%2Cm30%2Cm75%2CmA0%2CmT0
&deviceFamilyVersion=2815750935277839
&preciseDeviceFamilyVersion=2814750991000385
&architecture=x64
```

```
https://arc.msn.com/v3/Delivery/Placement?
pubid=da76df93-3dbc-42ab-a525-b34988683ac7
&pid=356481
&adm=2
&w=1
&h=1
&wpx=1
&hpx=1
&fmt=json
&cltp=app
&dim=le
&rafb=0
&nct=1
&pm=1
&cfmt=text,image,poly
&sft=jpeg,png,gif
&topt=0
&auid=547864bf7a5d727d6d78cda7f88cfce2
&poptin=1
&localid=w:8CA61C5C-685A-8431-C29F-E8EAD3C93E71
&ctry=FR
&time=20181002T135651Z
&lc=en-US
&pl=en-US,fr-FR
&idtp=mid
&uid=505bb224-4f5b-461c-b4cf-0ade15573bc2
&aid=00000000-0000-0000-0000-000000000000
&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29
&asid=20192b9a73874553bf127674f0276fb4
&ctmode=MultiSession
&arch=x64
&cdm=1
&cdmver=10.0.17134.1
&devfam=Windows.Desktop
&devform=Unknown
&devosver=10.0.17134.1
&disphorzres=800
&dispsize=10.4
&dispvertres=600
&isu=1
&lo=232284
&metered=false
&nettype=ethernet
&npid=sc-356481
&oemName=innotek%20GmbH
&oemid=innotek%20GmbH
&ossku=EnterpriseEval
&smBiosDm=VirtualBox
&tl=4
&tsu=230264
&waasBldFlt=1
&waasCfgExp=1
&waasCfgSet=1
&waasRetail=1
&waasRing=
```

Suite https://ecirtam.net/links/?RSVxiA
— Permalink

Suite de https://ecirtam.net/links/?1wRTPw

Les post-it de windows et la barre de recherche envoient tout Microsoft.
https://ecirtam.net/links/myimg/win10_postit.png

Suite : https://ecirtam.net/links/?YgWg9Q
— Permalink

Suite de https://ecirtam.net/links/?U23nFA

Liste un peut plus complète des sites appelés par Windows 10.
Note mitn.lan est le nom du réseau local.

```
_ldap._tcp.dc._msdcs.mitn.lan
a-ring-fallback.msedge.net
a-ring.msedge.net
a3698060313.cdn.optimizely.com
activation-v2.sls.microsoft.com
ad.sxp.smartclip.net
adl.windows.com
ajax.aspnetcdn.com
appexmapsappupdate.blob.core.windows.net
arc.msn.com
auth.gfx.ms
az416426.vo.msecnd.net
az725175.vo.msecnd.net
b-ring.msedge.net
bailfjjeqfhhl.mitn.lan
c.bing.com
c.urs.microsoft.com
canonicalizer.ucsuri.tcs
casual-solitaire.cloudapp.net
cdn.onenote.net
cdn.optimizely.com
cdnjs.cloudflare.com
client-office365-tas.msedge.net
client.wns.windows.com
cloudfront-vs-afd.azurefd.net
cm.g.doubleclick.net
code.jquery.com
compass-ssl.microsoft.com
config.edge.skype.com
connect.facebook.net
contentstorage.osi.office.net
crl.verisign.com
ctldl.windowsupdate.com
d1l0kcze0h5pmt.cloudfront.net
definitionupdates.microsoft.com
dev.virtualearth.net
dis.criteo.com
displaycatalog.mp.microsoft.com
dmd.metaservices.microsoft.com
dns.msftncsi.com
download-ssl.msgamestudios.com
ecn.dev.virtualearth.net
edgewelcomecdn.microsoft.com
endpoint-quwfbp3teyq4e.azureedge.net
europe.smartscreen-prod.microsoft.com
exo-ring.msedge.net
fp-afd.azureedge.net
fp-vp.azureedge.net
fp-vs.azureedge.net
fp.msedge.net
fs.microsoft.com
g.live.com
go.microsoft.com
ib.adnxs.com
iecvlist.microsoft.com
img-prod-cms-rt-microsoft-com.akamaized.net
inference.location.live.net
insights.notes.microsoft.com
l-ring.msedge.net
livetileedge.dsx.mp.microsoft.com
login.live.com
logx.optimizely.com
m.adnxs.com
markets.books.microsoft.com
match.adsrvr.org
microsoftcasualgames.com
microsoftedgewelcome.microsoft.com
mitn.lan
nav.smartscreen.microsoft.com
nexusrules.officeapps.live.com
o-ring.msedge.net
ocos-office365-s2s.msedge.net
ocsp.digicert.com
ocsp.verisign.com
officeclient.microsoft.com
oneclient.sfx.ms
onecs-live.azureedge.net
outlookmobile-office365-tas.msedge.net
ow1.res.office365.com
pixeltrack.eyeviewads.com
privacy.microsoft.com
q-ring-fallback.msedge.net
q-ring.msedge.net
qbiaovisdlh.mitn.lan
query.prod.cms.rt.microsoft.com
ris.api.iris.microsoft.com
rum8.perf.linkedin.com
s-ring.msedge.net
s1.symcb.com
s2.symcb.com
sb.scorecardresearch.com
segments-s.msedge.net
settings-win.data.microsoft.com
settings.data.microsoft.com
sf.symcb.com
sf.symcd.com
site-cdn.onenote.net
sls.update.microsoft.com
sls.update.microsoft.com
soavqlqthzdqx.mitn.lan
spo-ring.msedge.net
store-images.microsoft.com
store-images.s-microsoft.com
storeedgefd.dsx.mp.microsoft.com
sv.symcb.com
sv.symcd.com
sync.outbrain.com
sync.search.spotxchange.com
t-ring.msedge.net
t0.ssl.ak.dynamic.tiles.virtualearth.net
t0.ssl.ak.tiles.virtualearth.net
t1.ssl.ak.tiles.virtualearth.net
t2.ssl.ak.tiles.virtualearth.net
tile-service.weather.microsoft.com
track.eyeviewads.com
trc.taboola.com
v10.events.data.microsoft.com
v10.events.data.microsoft.com
validation-v2.sls.microsoft.com
watson.telemetry.microsoft.com
wdcp.microsoft.com
wdcpalt.microsoft.com
web.vortex.data.microsoft.com
wpad.mitn.lan
www.bing.com
www.facebook.com
www.googleapis.com
www.microsoft.com
www.msftconnecttest.com
www.msn.com
www.windowssearch.com
www.xboxab.com
www2.bing.com
xqmamtfwmp.mitn.lan
```

Emplacement des serveurs : https://ecirtam.net/links/?RSVxiA

Suite : https://ecirtam.net/links/?nTNSTw
— Permalink

J'ai fais une écoute réseau d'un windows 10 build 17134.rs4_release.180410-1804.
https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/

Voici la liste des serveurs au quel il se connecte au démarrage :

# Adresses inconnues (mitn.lan == mon réseau local)

_ldap._tcp.dc._msdcs.mitn.lan
soavqlqthzdqx.mitn.lan, fteqzgtmomwsj.mitn.lan, sbnaxxbhslo.mitn.lan, ygdgatupsifnoow.mitn.lan, ....
wpad.mitn.lan
canonicalizer.ucsuri.tcs


# Microsoft (https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints)

fs.microsoft.com                ; 23.210.40.121   ; France, Paris           ; Font streaming
go.microsoft.com                ; 23.223.224.178  ; France, Paris           ; Windows Defender

iecvlist.microsoft.com          ; 152.199.19.161  ; USA, Ashburn            ; ?
g.live.com                      ; 65.55.108.210   ; USA, Boydton            ; OneDrive
v10.events.data.microsoft.com   ; 13.68.93.109    ; USA, Boydton            ; ?
activation-v2.sls.microsoft.com ; 65.52.98.233    ; USA, Cheyenne           ; ?
www.bing.com                    ; 13.78.130.220   ; USA, Cheyenne           ; Cortana and Search
config.edge.skype.com           ; 13.107.3.128    ; USA, Redmond            ; Skype
dns.msftncsi.com                ; 131.107.255.255 ; USA, Redmond            ; dns
www.msftconnecttest.com         ; 13.107.21.200   ; USA, Redmond            ; test de connexion
watson.telemetry.microsoft.com  ; 52.114.128.43   ; USA, West Des Moines    ; Diagnostic Data

settings-win.data.microsoft.com ; 52.138.216.83   ; Ireland, Dublin         ; Settings
sls.update.microsoft.com        ; 52.138.216.83   ; Ireland, Dublin         ; Windows Update
inference.location.live.net     ; 40.112.71.128   ; Ireland, Dublin         ; ?
c.urs.microsoft.com             ; 40.112.74.45    ; Ireland, Dublin         ; ?

nav.smartscreen.microsoft.com   ; 52.232.101.203  ; Netherlands, Amsterdam  ; ?
onecs-live.azureedge.net        ; 52.232.101.203  ; Netherlands, Amsterdam  ; ?
client-office365-tas.msedge.net ; 52.232.69.150   ; Netherlands, Amsterdam  ; Office

Partie 2 https://ecirtam.net/links/?1wRTPw
— Permalink

En root :
```
mkdir -p /var/log/bind/
chown -R bind:bind /var/log/bind/
chmod -R 755 /var/log/bind/

echo '
logging {
    channel queries_file {
        file "/var/log/bind/queries.log" versions 3 size 5m;
        severity dynamic;
        print-time yes;
    };
    category queries { queries_file; };
};
' >> /etc/bind/named.conf.local
systemctl restart bind9
```
— Permalink

Le wifi, c'est toujours merdique. Il n'y a rien de mieux que le câble.

Il y a des années, j'utilisais ça https://www.ekahau.com/products/heatmapper/overview/ pour localiser les box.
(J'ai pas encore trouvé de version Gnu/Linux :-( )

Les interférences peuvent venir de :
- la composition des murs
- la position des murs. Le signal rebondi.
- les autres réseaux wifi
- peut être les micro-ondes. C'est les même fréquences.
- d'autres appareils électroniques
— Permalink

Voilà pourquoi j'aime pas le fichage -_-
via https://www.lagilb.fr/Shaarli/?xOoWgg
— Permalink

https://superuser.com/questions/307678/how-do-i-extract-files-from-an-msi-package
https://superuser.com/questions/427980/extracting-msi-files-using-linux

$ 7z e <fichier_install>.msi
— Permalink

— Permalink

http://www.bortzmeyer.org/files/web-vieprivee-abeilles-SHOW.pdf
https://peertube.tamanoir.foucry.net/videos/watch/0a60a924-7551-427a-8f41-75ebdc7edb4b
— Permalink

— Permalink

Le mouchard s'améliore.
— Permalink

https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf
— Permalink

— Permalink

http://paletton.com/
https://www.canva.com/color-palette/
— Permalink

Pour mener une campagne de sensibilisation au phishing.
https://github.com/gophish/gophish
https://alexnogard.com/gophish-familiarisez-vos-employes-au-phishing-part-i-installation/
— Permalink

Outil en ligne pour gérer pleins de conversions, chiffrement, hashage, formatage, ...
https://github.com/gchq/CyberChef

via https://www.youtube.com/watch?v=CF8rvdrb9uA
— Permalink

«Explaining Incidents to executives in ways they understand»
https://www.logicallysecure.com/wp-content/uploads/SANS-London-Sept18-Released-V1.pdf

via https://www.youtube.com/watch?v=CF8rvdrb9uA
— Permalink

https://www.youtube.com/user/s4myk
https://www.youtube.com/watch?v=iSSRaIU9_Vc
https://leventozturk.com/engineering/random/
— Permalink