BlackArch in Arch? The way to install BlackArch tools in an Arch distribution

BlackArch Linux is also an Arch Linux-based distribution, but focuses on penetration testing and is geared toward security researchers and independent hackers alike.
BlackArch has an impressive 2,200+ tools indexed on its website. Kali, currently has about 365 tools. It's fair to say BlackArch provides a more significant collection of software for curious penetration testers to experiment with.

This article will be a quick guide for anyone who wants to weaponize their user-friendly Arch distribution like Arch, Arco or Archlabs,... by adding some penetration testing applications to their operating system. This will be an excellent experience for experiment with BlackArch tools. In another way, it also helps beginners who want to use BlackArch on a Desktop Environment with nice-looking and easier to use.

BlackArch Linux is compatible with existing/normal Arch installations. It acts as an unofficial user repository. Below you will find instructions on how to install BlackArch in this manner.
First, make sure you have an Arch VM, boot it and following below.
BlackArch provides a handy installer script designed for manually importing BlackArch tool repositories, download the strap.sh:
curl -O https://blackarch.org/strap.sh
Give the strap.sh script permissions to run: chmod +x strap.sh
Run the strap.sh installer script: sudo ./strap.sh
sudo pacman -Syu

Installing every single tool may take an incredibly long time to download. All of the tools can be installed individually or in bulk by category.
To see the blackarch categories, run: sudo pacman -Sg | grep blackarch

To install a category of tools, run: sudo pacman -S blackarch-<category>
To install all of the tools, run: sudo pacman -S blackarch

All of the tools take about 30GB or greater so make sure that your disk space ready for it.

You also can install BlackArch tools in the Debian or Ubuntu distributions. It just differences in commands, e.g:

Installing packages:

apt-get install <package name>

pacman -S <package name>

Removing packages:

apt-get remove <package name>

pacman -Rs <package name>

Searching repositories:

apt-cache search <package name>

pacman -Ss <package name>

Upgrading the system:

apt-get update && apt-get upgrade

pacman -Syu

Removing old and unneeded dependencies:

apt-get autoremove

pacman -Qdtq

Displaying package information:

apt-cache show <package name>

pacman -Si <package name>

Which distribution is right for me?

The debate of which penetration distribution is the best may never be settled. The truth is, there probably isn't a single perfect distribution capable of satisfying the individual needs of every security researcher out there. We all have different standards, preferences, areas of expertise, and varying degrees of experience.

Thanks BlackArch, Null-Byte

Read More

Install guest additions virtualbox | Setting share folder- Arch Linux

VirtualBox is a very useful tool to install operating systems inside the main system. However, configuring the Virtualbox to share files and anable Auto-resize Guest Display between your main system and the system you installed in a VirtualBox is not trivial. To day, I will show you how to enable Auto-resize Guest Display and setup shared folder in your Arch VM on Virtualbox.
Install guest additions for Debian: https://www.it-vn.com/2019/02/setting-share-folder-virtualbox-linux.html

Install guest additions for your guest system:
First, make sure your Arch is up to date.
sudo pacman -Syu
Then, install kernel headers (not need if your Linux installed kernel-headers). I use the Linux standard kernel so I install with: sudo pacman -S linux-headers
if you use the kernel LTS or Zen, install linux-lts-headers or linux-zen-headers

Next, install the virtualbox-guest-utils package
sudo pacman -S virtualbox-guest-utils
It will show you two package: virtualbox-guest-modules-arch or virtualbox-guest-dkms.
Choose the virtualbox-guest-modules-arch package if you use the Linux kernel and virtualbox-guest-dkms for others kernels like LTS.
I use Linux-headers so I choose virtualbox-guest-modules-arch
See more

After that, enable the VirtualBox kernel modules:
modprobe -a vboxguest vboxsf vboxvideo
sudo systemctl enable vboxservice
Note: you also install guest additions from GuestAdditions.iso by Virtualbox.
reboot, and you will see Auto-resize is enabled

Create a shared folder: 
Go to setting your virutal machine add a folder which you want to share, note: disable "read-only"

Change the user permission for the shared folder:
To gain access to this folder as a regular user, open the terminal in your guest system and add your user to the vboxsf group.
sudo usermod -a -G vboxsf <yourusername>
or sudo usermod -a -G vboxsf `whoami` 
`whoami` command will get your username
e.g sudo usermod -a -G vboxsf laladee
Now, give that user a permission to access the media folder.
sudo chown -R `whoami`:users /media/
e.g sudo chown -R laladee:users /media/

Then, reboot or logout. After that you should be able to access the shared folder as a regular user.

Read More

Arch Kernel - Difference between kernel linux, linux-lts, linux-hardened, linux-zen

Linux is a clone of the operating system Unix, written from scratch by Linus Torvalds with assistance from a loosely-knit team of hackers across the Net. It aims towards POSIX and Single UNIX Specification compliance.
On a normal installation you will have the package linux installed and contains your kernel. The kernel will update with the normal updates with the command “update” in the terminal. You see the version and the name in the neofetch parameters.
All information about the kernel can be read on this link : https://wiki.archlinux.org/index.php/Kernel


If you're new to Linux, you don't want to download the kernel, which is just a component in a working Linux system. Instead, you want what is called a distribution of Linux, which is a complete Linux system. There are numerous distributions available for download on the Internet as well as for purchase from various vendors; some are general-purpose, and some are optimized for specific uses. We currently have mirrors of several distributions available at https://mirrors.kernel.org/.

Arch Linux is based on the Linux kernel. There are various alternative Linux kernels available for Arch Linux in addition to the stable Linux kernel

Linux
frequent updates
main version changes all the time
security features
new features
likely to work on latest hardware
ideal for newer hardware

Linux-lts 
less frequent updates
main version is same
security features
no new features
may not work on latest hardware
ideal for older hardware

Linux-hardened
A security-focused Linux kernel applying a set of hardening patches to mitigate kernel and userspace exploits.

Linux-zen
Result of a collaborative effort of kernel hackers to provide the best Linux kernel possible for everyday systems.

Read More

Malware Analysis - Setting Up Environment

FLARE VM is the first of its kind reverse engineering and malware analysis distribution on Windows platform. It covering everything you need to know to get started in Malware Analysis professionally. Since its introduction in July 2017, FLARE VM has been continuously trusted and used by many reverse engineers, malware analysts, and security researchers as their go-to environment for analyzing malware. Just like the ever-evolving security industry, FLARE VM has gone through many major changes to better support our users’ needs. FLARE VM now has a new installation, upgrade, and uninstallation process, which is a long anticipated feature requested by our users. FLARE VM also includes many new tools such as IDA 7.0, radare and YARA. Therefore, we would like to share these updates, especially the new installation process.

Let set it up
FLARE VM is designed to be installed on Windows 7 Service Pack 1 or newer; therefore, you can select a version of windows that best suits your needs. From this point forward, all installation steps should be performed within your VM. You can download from: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms
When you have a Windows VM, download the compressed FLARE VM repository onto your VM: https://github.com/fireeye/flare-vm

Now, start Windows PowerShell as admin permissions "Run as administrator"

Then, go to Flare-vm path, e.g: cd C:\Users\IEUser\Downloads\flare-vm-master
Enable unrestricted execution policy for PowerShell by executing the following command: Set-ExecutionPolicy unrestricted
Start installing: .\install.ps1

The rest of the installation process is fully automated. Depending upon your internet speed the entire installation may take up to one hour to finish. The VM also reboots multiple times due to the numerous software installations’ requirements. Once the installation completes, the PowerShell prompt remains open waiting for you to hit any key before exiting. After completing the installation, you will be presented with the following desktop environment:

Congratulations! You have successfully installed FLARE VM.

Here is an incomplete list of some major tools available on FLARE VM:
Disassemblers:
IDA Free 5.0 and IDA Free 7.0
Binary Ninja
Radare2 and Cutter
Debuggers:
OllyDbg and OllyDbg2
x64dbg
Windbg
File Format parser:
CFF Explorer, PEView, PEStudio
PdfStreamdumper, pdf-parser, pdfid
ffdec
offvis and officemalscanner
PE-bear
Decompilers:
RetDec
Jd-gui and bytecode-viewer
dnSpy
IDR
VBDecompiler
Py2ExeDecompiler
Monitoring tools:
SysInternal suite
RegShot
Utilities:
Hex Editors (010 editor, HxD and File Insight)
FLOSS (FireEye Labs Obfuscated String Solver)
Fakenet-NG
Yara
Malware Analyst Pack

We strongly recommend you use FLARE VM within a virtualized environment for malware analysis to protect and isolate your physical device and network from malicious activities. We assume you already have experience setting up and configuring your own virtualized environment. Happy Reversing!

Thanks Fireeye

Read More

How to make read-only partition to writable? - Fix lỗi phân vùng không ghi được | Lấy quyền ghi đặt lại tệp nhật ký NTFS

The issue is sometimes the partition lost writable permissions and that means many processes, many things we do will take error but sometimes it writable normally.
So why? After solutions suggested by different people failed to fix the issue, I went to research and found out that because there was some problem with my hard drive that was caused dual with Windows.
So we can fix it with ntfsfix, fix common errors and force Windows to check NTFS
Ntfsfix is a utility that fixes some common NTFS problems.  ntfsfix is NOT a Linux version of chkdsk.  It only repairs some fundamental NTFS inconsistencies, resets the NTFS journal file and schedules an NTFS consistency check for the first boot into Windows. You may run ntfsfix on an NTFS volume if you think it was damaged by Windows or some other way and it cannot be mounted.

sudo ntfsfix <your partition>
e.g: sudo ntfsfix /dev/sdb1
You can use blkid to show all your partition

If still not work, try remounting it read-write:
sudo mount -o remount,rw <your mounted partition path>
e.g: sudo mount -o remount,rw /media/root/DATA/

Thanks

Read More

How to crack Linux shadow password file - Zydra

The /etc/shadow file stores actual password in encrypted format (more like the hash of the password) for user’s account with additional properties related to user password. Basically, it stores secure user account information.

Zydra is a file password recovery tool and Linux shadow file cracker. It uses the dictionary search or Brute force method for cracking passwords.

Supported Files
RAR Files
Legacy ZIP Files
PDF Files
Linux Shadow Files (zydra can find all the user’s password in the linux shadow file one after the other)

Require:
Python >= 3.3
debian-based linux distro
qpdf and unrar packages. Install it: sudo apt-get install qpdf unrar
some python modules: zipfile, rarfile, crypt, pyfiglet, py-term 
pip3 install zipfile rarfile crypt pyfiglet py-term 
notice: rar,zip and pdf files must have an extension, shadow files does not need an extension.

Features
Cracking files password using two methods: 1. dictionary method 2. brute force method
In the brute force method, you can specify the min length and max length of the passwords.
In the brute force method, you can specify the type of characters that may be used in the password.
There is a percent progress bar showing how much of the process has been performed.
Error handling.
One of the most important features of Zydra is the multiprocessing feature that speeds up the program. For example if you have 8 CPU cores, Zydra will use all of them for processing at the same time.

Download:
git clone https://github.com/hamedA2/Zydra.git 
now, we can use Zydra without install
python3 Zydra.py -h to get help

Example:
crack a zip file password and use rockyou.txt dictionary
python3 Zydra.py –f file.zip –d rockyou.txt

Brute force search to find the password for the users in the shadow file 
Minimum length of password is 4 and maximum length is 4 and we try to find passwords that are composed of numbers and symbols letters. 
python3 Zydra.py –f /etc/shadow –b digits,symbols –m 4 –x 4

Read More

Basic Linux Terminal Command

System Info
date – Show the current date and time
cal – Show this month's calendar
uptime – Show current uptime
w – Display who is online
whoami – Who you are logged in as
finger user – Display information about user
uname -a – Show kernel information
cat /proc/cpuinfo – CPU information
cat /proc/meminfo – Memory information
df -h – Show disk usage
du – Show directory space usage
free – Show memory and swap usage

Keyboard Shortcuts
Enter – Run the command
Up Arrow – Show the previous command
Ctrl + R – Allows you to type a part of the command you're looking for and finds it
Ctrl + Z – Stops the current command, resume with fg in the foreground or bg in the background
Ctrl + C – Halts the current command, cancel the current operation and/or start with a fresh new line
Ctrl + L – Clear the screen
Ctrl + A – Return to the start of the command you're typing
Ctrl + E – Go to the end of the command you're typing
Ctrl + U – Cut everything before the cursor to a special clipboard, erases the whole line
Ctrl + K – Cut everything after the cursor to a special clipboard
Ctrl + Y – Paste from the special clipboard that Ctrl + U and Ctrl + K save their data to
Ctrl + T – Swap the two characters before the cursor (you can actually use this to transport a character from the left to the right, try it!)
Ctrl + W – Delete the word / argument left of the cursor in the current line
Ctrl + D – Log out of current session, similar to exit
Alt + F – Move forward one word.
Alt + B – Move backward one word

Learn the Commands
apropos subject – List manual pages for subject
man -k keyword – Display man pages containing keyword
man – Show the manual for command
man -t man | ps2pdf - > man.pdf  – Make a pdf of a manual page
which  – Show full path name of command
time – See how long a command takes
whereis app – Show possible locations of app
which app – Show which app will be run by default; it shows the full path
!! – Repeats the last command
!$ – Repeats the last argument of the previous command

Searching
grep pattern <files> – Search for "pattern" in files
grep -r pattern dir – Search recursively for "pattern" in dir
| grep pattern – Search for "pattern" in the output of command
locate file – Find all instances of file
find / -name filename – Starting with the root directory, look for the file called filename
find / -name ”*filename*” – Starting with the root directory, look for the file containing the string filename
locate filename – Find a file called filename using the locate command; this assumes you have already used the command updatedb (see next)
updatedb – Create or update the database of files on all file systems attached to the Linux root directory
which filename – Show the subdirectory containing the executable file  called filename

File Permissions
chmod octal file – Change the permissions of file to octal, which can be found separately for user, group, and world by adding: 4 – read (r), 2 – write (w), 1 – execute (x)
Examples:
chmod 777 – read, write, execute for all
chmod 755 – rwx for owner, rx for group and world
For more options, see man chmod.

File Commands
ls – Directory listing
ls -l – List files in current directory using long format
ls -laC – List all files in current directory in long format and display in columns
ls -F – List files in current directory and indicate the file type
ls -al – Formatted listing with hidden files

cd dir – Change directory to dir
cd – Change to home
mkdir dir – Create a directory dir
pwd – Show current directory

rm name – Remove a file or directory called name
rm -r dir – Delete directory dir
rm -f file – Force remove file
rm -rf dir – Force remove an entire directory dir and all it’s included files and subdirectories (use with extreme caution)

cp file1 file2 – Copy file1 to file2
cp -r dir1 dir2 – Copy dir1 to dir2; create dir2 if it doesn't exist
cp file /home/dirname – Copy the filename called "file" to the /home/dirname directory

mv file /home/dirname – Move the file called filename to the /home/dirname directory
mv file1 file2 – Rename or move file1 to file2; if file2 is an existing directory, moves file1 into directory file2

ln -s file link – Create symbolic link link to file
touch file – Create or update file
cat > file – Places standard input into file
cat file – Display the file called file

more file – Display the file called file one page at a time, proceed to next page using the spacebar
head file – Output the first 10 lines of file
head -20 file – Display the first 20 lines of the file called file
tail file – Output the last 10 lines of file
tail -20 file – Display the last 20 lines of the file called file
tail -f file – Output the contents of file as it grows, starting with the last 10 lines

Compression
tar cf file.tar files – Create a tar named file.tar containing files
tar xf file.tar – Extract the files from file.tar

tar czf file.tar.gz files – Create a tar with Gzip compression
tar xzf file.tar.gz – Extract a tar using Gzip

tar cjf file.tar.bz2 – Create a tar with Bzip2 compression
tar xjf file.tar.bz2 – Extract a tar using Bzip2

gzip file – Compresses file and renames it to file.gz
gzip -d file.gz – Decompresses file.gz back to file

Network
ifconfig – List IP addresses for all devices on the local machine
iwconfig – Used to set the parameters of the network interface which are specific to the wireless operation (for example: the frequency)
iwlist – used to display some additional information from a wireless network interface that is not displayed by iwconfig
ping host – Ping host and output results
whois domain – Get whois information for domain
dig domain – Get DNS information for domain
dig -x host – Reverse lookup host
wget file – Download file
wget -c file – Continue a stopped download

SSH
ssh user@host – Connect to host as user
ssh -p port user@host – Connect to host on port port as user
ssh-copy-id user@host – Add your key to host for user to enable a keyed or passwordless login

User Administration
adduser accountname – Create a new user call accountname
passwd accountname – Give accountname a new password
su – Log in as superuser from current login
exit – Stop being superuser and revert to normal user

Process Management
ps – Display your currently active processes
top – Display all running processes
kill pid – Kill process id pid
killall proc – Kill all processes named proc (use with extreme caution)
bg – Lists stopped or background jobs; resume a stopped job in the background
fg – Brings the most recent job to foreground
fg n – Brings job n to the foreground

Installation from source
./configure
make
make install
dpkg -i pkg.deb – install a DEB package (Debian / Ubuntu / Linux Mint)
rpm -Uvh pkg.rpm – install a RPM package (Red Hat / Fedora)

Source: community.linuxmint.com

Read More

Install guest additions virtualbox | Setting share folder- Debian

VirtualBox is a very useful tool to install operating systems inside the main system. However, configuring the Virtualbox to share files and anable Auto-resize Guest Display between your main system and the system you installed in a VirtualBox

1. Setting share folder.
Go to setting your VM. Add a folder which you want to share, click OK and Start your machine.

Open a terminal and install the build-essential, dkms, and linux-headers packages. 
sudo apt install build-essential dkms linux-headers-$(uname -r)
Next, click to Devices and choose Insert Guest Additions CD image... or open machine setting > Storage and add iso file: C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions. (Power off your machine)
Now you can see on desktop appear the VBox_GAs iso file. Open it and run file autorun.sh "bash autorun.sh".

ERROR 1: VirtualBox Guest Additions: modprobe vboxsf failed
sudo apt-get update
sudo apt-get upgrade
sudo apt-get dist-upgrade -y
sudo apt-get install virtualbox-guest-dkms
reboot

ERROR 2: The folder contents could not be displayed or Permission denied
To gain access to this folder as a regular user, open the terminal in your guest system and add your user to the vboxsf group.
sudo adduser <your_username> vboxsf
e.g: sudo adduser laladee vboxsf
reboot

Read More

Kali Linux vs Parrot Security OS | Lý do chọn chúng?

So sánh 2 distro pentesting mạnh mẽ nhất trong lĩnh vực hacking và bảo mật: Kali Linux và Parrot Security.

1. Sơ lược:
+ Kali Linux là hậu thế của Backtrack OS, một pentesting distro có bề dày lịch sử với thương hiệu nổi tiếng. Kali cực mạnh mẽ với lượng fan hùng hậu, các course pentest đi kèm, lịch sử lâu đời luôn đứng đầu về hacking và pentesting khét tiếng với cái tên "Backtrack".
+ Parrot OS là một "hiện tượng mới nổi" vài năm gần đây sau khi "nổi dậy" đánh bại các pentesting distro khác như Black Arch, Backbox, etc.... trở thành vị trí á quân trong danh sách top các pentesting distro tốt nhất. Parrot liên tục được đem ra so sánh giữa những người mới muốn lựa chọn cho mình công cụ để làm việc.

2. Điểm chung:
- Đều based Debian testing nên tương đối dễ sử dụng, dễ làm quen.
- Đều có tool list gần tương đương (Parrot có thêm một số tool + bỏ một số tool out of date). (E.g: vega-shit-for-script-kiddies).
- Đều được optimize packages hướng tới hacking and pentesting.
- Do quá trình phát triển, cả 2 đã có một cộng đồng sử dụng đông đảo, từ những newbie mới học đến các chuyên gia.

3. Khác biệt:
+) Kali
- Thường xuyên update tools. Mục đích chủ yếu hướng vào pentesting nên các tool được chăm chút thường xuyên.
- Chạy nặng, ngốn tài nguyên. Lý do được đưa ra bởi Kali dùng gnome 3 như DE chính. Nhưng điều này không hẳn đúng: Ví dụ: Kali sử dụng mate chạy vẫn nặng và chậm. Debian sử dụng gnome 3 vẫn chạy phà phà.
- Có nhiều tài liệu, cho phép tùy biến cao.

+) Parrot OS
- Tập trung vào tính ổn định của hệ thống và bảo vệ người dùng. Ví dụ:
+ Anonsurf: Đưa toàn bộ traffic qua tor. (Độc quyền)
+ Firejail: Sandbox giới hạn truy câp của các ứng dụng. Điều này gây ra một số lỗi khi sử dụng các ứng dụng, nhưng đây là một tính năng đắt giá giúp người dùng tránh khỏi một số nguy cơ tấn công. (Profiles độc quyền)
+ Một số tool mã hóa
- Có sẵn các IDE
- Có sẵn hacking tools (hơn Kali về tool list default)
- GUI tiện dụng, hợp mắt.
- Chạy rất mượt (có vẻ dev team đã optimize để cải thiện tốc độ chạy - ý kiến cá nhân)
- Firefox được cài sẵn các add-on nhằm bảo vệ người dùng, bảo vệ quyền riêng tư.
- Một số tool trục trặc, ít update tool.
- "Kén chọn" tool tạo usb boot. Hay gặp các lỗi liên quan driver, phần cứng.

Kết: cả 2 đều là những OS tuyệt vời với dev team giỏi, chuyên nghiệp. Mục đích hướng tới sử dụng của 2 OS có một số điểm khác biệt. Việc lựa chọn OS dựa trên mục đích sử dụng. OS có mạnh hay không dựa vào kiến thức và kinh nghiệm người dùng.

Read More

What is ext partition? Linux file systems: Ext2, Ext3 and Ext4 - Understanding file system superblock linux

AT32, NTFS, exFAT are three different files systems used to store data in a storage device. Created by Microsoft, these file systems have their own set of pros and cons which will help you choose the correct file system for different needs. Ext2, ext3 and ext4 are all filesystems created for Linux system. Ext4 was born as a series of backward-compatible extensions to ext3, many of them originally developed by Cluster File Systems for the Lustre file system between 2003 and 2006, meant to extend storage limits and add other performance improvements.

Ext2

• Ext2 stands for second extended file system.
• It was introduced in 1993. Developed by Rémy Card.
• developed to overcome the limitation of the original ext file system.
• Ext2 does not have journaling feature.
• On flash drives, disk, usb drives, ext2 is recommended, as it doesn’t need to do the over head of journaling.
• Maximum individual file size can be from 16 GB to 2 TB
• Overall ext2 file system size can be from 2 TB to 32 TB

Ext3

• Ext3 stands for third extended file system.
• It was introduced in 2001. Developed by Stephen Tweedie.
• Starting from Linux Kernel 2.4.15 ext3 was available.
• The main benefit of ext3 is that it allows journaling.
• Journaling has a dedicated area in the file system, where all the changes are tracked. When the system crashes, the possibility of file system corruption is less because of journaling.
• Maximum individual file size can be from 16 GB to 2 TB
• Overall ext3 file system size can be from 2 TB to 32 TB
• There are three types of journaling available in ext3 file system.
• Journal – Metadata and content are saved in the journal.
• Ordered – Only metadata is saved in the journal. Metadata are journaled only after writing the content to disk. This is the default.
• Writeback – Only metadata is saved in the journal. Metadata might be journaled either before or after the content is written to the disk.
• You can convert a ext2 file system to ext3 file system directly (without backup/restore).

Ext4

• Ext4 stands for fourth extended file system.
• It was introduced in 2008.
• Starting from Linux Kernel 2.6.19 ext4 was available.
• Supports huge individual file size and overall file system size.
• Maximum individual file size can be from 16 GB to 16 TB
• Overall maximum ext4 file system size is 1 EB (exabyte). 1 EB = 1024 PB (petabyte). 1 PB = 1024 TB (terabyte).
• Directory can contain a maximum of 64,000 subdirectories (as opposed to 32,000 in ext3)
• You can also mount an existing ext3 fs as ext4 fs (without having to upgrade it).
• Several other new features are introduced in ext4: multiblock allocation, delayed allocation, journal checksum. fast fsck, etc. All you need to know is that these new features have improved the performance and reliability of the filesystem when compared to ext3.
• In ext4, you also have the option of turning the journaling feature “off”.

How to create an ext file system:

ext2: mke2fs /dev/sda1

ext3: mkfs.ext3 /dev/sda1
ext4: mkfs.ext4 /dev/sda1
sda1 is e.g your ext partition.

Blocks in File System
When a partition or disk is formatted, the sectors in the hardisk is first divided into small groups. This groups of sectors is called as blocks. The block size is something that can be specified when a user formats a partition using the command line parameters available.
Block Size for Ext2 can be 1Kb, 2Kb, 4Kb, 8Kb
Block Size for Ext3 can be 1Kb, 2Kb, 4Kb, 8Kb
Block Size for Ext4 can be 1Kb to 64Kb

Why block size has an impact on performance?
The file system driver sends block size ranges to the underlying drive, while reading and writing things to files system. Just imagine if you have a large file, reading smaller blocks (which combined together makes the file size) one by one will take longer. So the basic idea is to keep bigger block size, if your intention is to store large files on the file system.

A linux Kernel performs all its operations on a file system using block size of the file system. The main important is the block size can never be smaller than the hard disk's sector size, and will always be in multiple of the hard disk sector size. Kernel also requires the file system block size to be equal or smaller to the system page size.

File System Superblock
Its the metadata of the file system. Superblocks store metadata of the file system. As it stores critical information about the file system, the utmost importance is preventing corruption of superblocks. Superblocks also stores configuration of the file system.

• Blocks in the file system
• No of free blocks in the file system
• Inodes per block group
• Blocks per block group
• No of times the file system was mounted since last fsck.
• Mount time.
• UUID of the file system.
• Write time.
• File System State (e.g: was it cleanly unounted, errors detected etc)
• The file system type etc(e.g: whether its ext2,3 or 4).
• The operating system in which the file system was formatted.

If the superblock of a file system is corrupted, then you will face issues while mounting that file system such as bad superblock

How to view Superblock Information?
type: dumpe2fs -h /dev/sda1

sda1 is e.g your ext partition.

Thanks for reading.

Read More