The Ethical Hacker Network - Tool to track changes?

Latest Additions

Who's Online

EH-Net > Resources > Tools (Moderator: don) > Tool to track changes? - Linux/Unix

Pages: [1] Go Down

	Author	Topic: Tool to track changes? - Linux/Unix (Read 4715 times)
0 Members and 1 Guest are viewing this topic.

Manu Zacharia (-M-)

Sr. Member

Offline

Posts: 393

c0c0n Hacking Conference - where hackers unite

Tool to track changes? - Linux/Unix

« on: June 29, 2008, 09:31:31 PM »

Hi All,

I am looking for a linux based tool (very similar to InCtrl5) that will help me identify the changes resulting from a particular action, i.e., changes made during an installation, files accessed, modified, changed, added, etc.

With InCtrl5, the process is very easy, just 3 steps:

Run InCtrl5 to create a snapshot of the existing system
Run the applicaiton / change the configuration / install the configuration
Run InCtrl5 again to generate the report that will reflect the changes made to the system

Any similar tools for linux?


	Logged

Manu Zacharia
MVP (Enterprise Security), ISLA-2010 (ISC)², C|EH, C|HFI, CCNA, MCP,
Certified ISO 27001:2005 Lead Auditor

There are 3 roads to spoil; women, gambling & hacking. The most pleasant with women, the quickest with gambling, but the surest is hacking - c0c0n

shakuni

Jr. Member

Offline

Posts: 80

Re: Tool to track changes? - Linux/Unix

« Reply #1 on: June 29, 2008, 10:55:11 PM »

Tripwire, AIDE, FCheck etc. may be used for the purpose.


	Logged

There is no rule, law or tradition that apply universally... including this one.

jimbob

Guest

Re: Tool to track changes? - Linux/Unix

« Reply #2 on: June 30, 2008, 03:13:20 AM »

You might consider running strace to log the system calls made by the software installer. It should show you every file access, sockets created etc. It's not the easiest to read but you will see all the program activity. make sure you use the flag that follows fork() to monitor any child processes.

Jimbob