4get
Advanced Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
HTTP Log plugin
http://agnitum.com/forum/showthread.php?threadid=4414&perpage=90
download: http://www.agnitum.com/forum/attachment.php?postid=29071
Цитата: This plug-in logs a complete list of HTTP URLs requested by application. It's only a interface/GUI plugin because it uses the HTTPFILT kernel plugin.
It also logs all the HTTP events in verbose mode (subset of Debug->TDI plugin).
How to install plug-in:
1) 'Exit and Shutdown' Outpost Firewall
2) Run the installation program
3) Restart Outpost Firewall or reboot.
The plug-in don't have Properties Dialog, it only uses a pop-up menu to toggle the Verbose mode on/off.
This is provided 'as is' and is only written to test the SDK (source code included), so if you have any comment write it here.
Regards,
Attachment: httplog.zip
This has been downloaded 113 time(s).
Last edited by muchod on 07-11-2002 at 07:13 AM |
Blockpost plug-in ( AKA spyblocker, AKA "Untrusted Zone")
http://agnitum.com/forum/showthread.php?&threadid=3394&perpage=90
download: http://outpostfirewall.com/dmut/sstealth_2002_07_11.exe
Цитата: ATTENTION: READ FOLLOWING README FILE VERY CAREFULLY BEFORE USING BLOCKPOST PLUGIN
Blockpost plug-in ( AKA "spyblocker", AKA "Restricted Zone")
THIS SOFTWARE BELONG TO ME AND OFFICIALLY UNSUPPORTED BY AGNITUM.
If you have a question regarding that plug-in, please post it on Official Agnitum Forum in Plug-in Developers area.
This plug-in provided "Restricted Zone" feature, i.e. every IP-packet and every higher protocols packet: ICMP, TCP, UDP, HTTP, etc. from or to IP address in "Restricted Zone" list would be dropped/rejected.
This plug-in has maximum possible priority in OP packet processing algorithm, that's means: higher than "Trusted application", "Trusted Zone", etc. No one from your application, including operation system, could be able to send or receive any IP data and higher from or to host included in "Restricted Zone".
How to install:
1) Shutdown your outpost, paranoids may also plug off network/modem cable before shutdown OP.
2) Run "Blockpost.exe" and follow instructions.
3) Load Agnitum Outpost manually or restart operation system to load it automatically.
4) When Blockpost has been installed successfully, you will see new plug-in in outpost's left panel.
IMPORTANT: install will overwrite all blockpost plugin files, including your own customized blockpost.lst
How to uninstall:
1) Click "Start/Programs/Agnitum/Blockpost plug-in uninstall" or use Windows "Add/Remove Programs" applet.
IMPORTANT: uninstall will delete all blockpost plugin files, including your own customized blockpost.lst
Known issues and limitations:
- When OP going to shutdown, plug-in store it's configuration saving all list of "Untrusted IP's" to "blockpost.lst", every time erasing and creating that file again, so any manual changes to that file when plug-in is loaded will be discarded.
- Plug-in log window store only 30 last events and did not save events on the disk. This is my own way to fix Oupost logger engine problem.
- Some of blocked packets are appear in OP "Allowed" log, do not worry, that's GUI bug, and those packets are really blocked.
- When plug-in properties displayed, button "Cancel" do the same as "OK", i.e. it confirm new configuration.
Sources included. Project files compatible with MS VS 6.0 and MS VS .NET ( VC++ 7.0 ) |
Super Stealth - ARP filtering plug-in
http://agnitum.com/forum/showthread.php?&threadid=3037&perpage=90
download: http://outpostfirewall.com/dmut/sstealth_2002_07_11.exe
Цитата: DO NOT RUN THIS PLUG-IN, IF YOU DO NOT CLEARLY UNDERSTAND HOW ETHERNET LAN AND ARP PROTOCOL WORKS!
THIS SOFTWARE BELONG TO ME AND OFFICIALLY UNSUPPORTED BY AGNITUM.
What is it and how it's works: plug-in filter-off ARP requests from all hosts which are not included in trusted list. When ARP request filtered, system can not send info about your IP's to requester host. From requester side it is looks like your machine is not presented in LAN.
This situation only applied for hosts in your Ethernet segment, other hosts resolving your IP via ARP requests to your nearest router.
With correct using this plug-in you will get complete security in your Ethernet segment. It will shield you against any IP-based attack, scans, floods, connection requests, all IP-based (and higher: TCP, HTTP, FTP) incoming traffic from your LAN neighbors.
How to install:
1) Shutdown Agnitum Outpost.
2) Run "super stealth.exe" and follow instructions.
3) Load Agnitum Outpost manually or restart operation system to load it automatically.
4) When "Super Stealth" has been installed successfully, you will see new plug-in in outpost's left panel.
IMPORTANT: install will overwrite all prevision "super stealth" plug-in files, including your own customized "trusted_mac.lst"
You should set up configuration for "super stealth" after installation to continue working with internet by entering MAC addresses of your router/gateway ( otherwise it could not be able to send to you IP packets), and other critical machines, like your DNS servers, DHCP servers, etc, of course if they are located in your Ethernet segment.
Before first setup you must disable "super stealth" - right click on plug-in name, un-check "enable".
To make easy setup, do following:
1) clear your ARP table running "arp -d"
2) run "tracert" to any external fast internet site, like yahoo, save the tracing result.
3) run "arp -a" and select MAC address from first IP in your trace route, save MAC, it is your nearest router's MAC
4) clear your ARP table again
5) ping to any external fast internet site
6) run "arp -a" and select additional MAC's ( sometimes route in and route out going through different servers ), save those MACs too.
Enter those saved MAC addresses to "Trusted MAC list" in "super stealth" plug-in configuration and enable plug-in.
Known issues and limitations:
1) With shutdown OP, plugin store it is local MAC and trusted MAC list configuration in "trusted_mac.lst", every time erasing and creating that file again, so any manual changes to that file, while plug-in running, will be discarded.
2) Plug-in doesn't collecting any logs, because logs are useless in this case.
Sources included, project files provided for VC6 and VC7.
Important: After installation check "super stealth" configuration to make sure your local MAC address detected successfully, otherwise you could not be able to surf. |
|
Всего записей: 956 | Зарегистр. 19-09-2001 | Отправлено: 03:28 17-07-2002 | Исправлено: 4get, 03:46 17-07-2002 |
|
v 1.0.1817.1645
