Tools used by security professionals

learn more… | top users | synonyms

15
votes
6answers
4k views

Lightweight Live Pen-test OS [closed]

Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
2
votes
2answers
2k views

What exactly is 'single' mode in John the Ripper doing?

I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
-1
votes
1answer
697 views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is ...
0
votes
2answers
323 views

Tools to extract code comments from sites? [closed]

I often come across sites that have way to many comments included in their source code, sometimes these comments offer valuable insight into whats happening in the code, the logic of functions, unused ...
3
votes
1answer
278 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
4
votes
2answers
5k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
4
votes
2answers
1k views

SQL Injection - Automating the fingerprinting of the DBMS

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS. I am in ...
3
votes
1answer
191 views
6
votes
1answer
6k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
4
votes
3answers
969 views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
2
votes
1answer
668 views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
5
votes
5answers
7k views

Affordable web application attack tools

I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
5
votes
3answers
1k views

Secure source code review tool for jQuery

Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
4
votes
1answer
257 views

Finding all AJAX entrypoints

Is there any tool to (automatically) find all backend JavaScript entrypoints within a site? I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would ...
0
votes
2answers
2k views

Msf and exploitdb on Backtrack 5

Metasploit (msf) doesn't see exploits from exploitdb. I've just updated directory on my Backtrack cd /pentest/exploits/exploitdb svn update How can I load them now into msf? When i use a script ...
4
votes
1answer
773 views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
9
votes
3answers
2k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
3
votes
2answers
751 views

Tools for analyzing Perl 5 code? [closed]

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but ...
4
votes
3answers
2k views

Are there any tools that focus on shellcode analysis?

Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
0
votes
1answer
170 views

Comparison between Data Encryption Tools and Data Sanitization Tools [closed]

What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites? Which Data Sanitization tools have the best results? Difference between Data encryption and Data ...
-3
votes
2answers
152 views

GPS tracking device [closed]

Could anyone please tell me if there exists a GPS tracking device that is light, small and safe (e.g., does not cause harmful radiation) and can be tracked back via say an app on a phone?
7
votes
1answer
437 views

Identifying, analyzing, and predicting weak session cookies

To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can ...
7
votes
3answers
1k views

Who (which process) is calling curl?

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server. Basically I installed little Snitch and find out that "somebody" is using curl periodically. ...
11
votes
3answers
3k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities? [closed]

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
4
votes
1answer
454 views

Is Window's system restoration useful for getting rid of malware?

If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware? We should suppose that it ...
3
votes
2answers
153 views

What information will dig leak to an attacker?

What information will the axfr and ixfr commands in DIG provide to an attacker?
7
votes
6answers
2k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
0
votes
2answers
3k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
3
votes
1answer
192 views

Complex Consumer Matching Queries with PGP Universal

For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. ...
1
vote
1answer
263 views

What CVE identifier will follow after CVE-2012-9999?

I am writing an application which uses CVE identifiers to cross-reference vulnerabilities. I would like to make it compatible with future CVE identifiers. If it happens that there are more than 9999 ...
1
vote
1answer
406 views

Diagnosing possible svchost.exe thread on Windows 7

I used win64dd.exe to get a memory image on a 64-bit computer running Windows 7 and had Mandiant Redline analyze the image. One of the things marked red was one of the svchost.exe processes. Redline ...
2
votes
1answer
2k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ...
2
votes
3answers
1k views

How to intercept an application that bypasses local proxy

I am behind a corporate proxy and the application that i have to test will work only if it is given an exception for using proxy server(i.e it is added to the exceptions list of the sites that do not ...
5
votes
5answers
2k views

What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source. EDIT: I am actually looking to crack my passwords used on services I ...
4
votes
5answers
384 views

Tool to grab sensitive information from command lines [closed]

Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps). Is there a known tool to automate this kind ...
19
votes
6answers
1k views

Backing up sensitive data - pitfalls and best practices

Obviously, securely backing up sensitive data is a challenge. A remote backup is important for surviving a variety of disasters. What are some of the "gotcha's" lurking out there, and what best ...
0
votes
1answer
357 views

IR Jump Bag - What kind of bag/container to use?

I am working on putting together an Incident Response Jump Bag (detailed here). Any suggestions on what type of container/bag to use for this? It seems like a lot of little items that could be ...
7
votes
1answer
2k views

How to Perform Vulnerability Assessment for WCF services

Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
1
vote
1answer
151 views

Reliability of DNSBLs for Stopping Forum Spam

I know that certain DNS blacklists are considered more reliable than others, in that they don't have as many false positives. I run a forum that is known to be spammed, and I've installed a mod to ...
8
votes
4answers
6k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
5
votes
4answers
1k views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
2
votes
2answers
403 views

How can I protect content distributed on a linux virtual machine?

What assets am I trying to protect? An unofficial pre-alpha software prototype provided as a reproducible example for evaluation during the scientific peer-review process. The software will be ...
8
votes
4answers
2k views

extract from pcap all protocols found

I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark I think tshark is able to do it, but ...
9
votes
6answers
10k views

Good file encryption tools [closed]

Could you please help me find a good file encryption tool? The target OS is Linux, but tools for Windows are welcome, too. FOSS tools are preferred. The tool must be reliable both for the recovery of ...
2
votes
2answers
767 views

up2date tools for security audit linux / centos

I'm setting up a new CentOS 6 server and am looking into some security audit tools to validate my configuration and to point out weak spots in the server. There are a lot of non up2date tools out ...
4
votes
1answer
195 views

Data analyzer tools [closed]

I have to find information that can be located in files on a hard drive. Are there good tools to search for specific keywords (even in the hard disk free space area ;-), detect encrypted files, detect ...
1
vote
4answers
546 views

Completely wiping a HDD (i.e. nothing is recoverable) [duplicate]

Possible Duplicate: How can I reliably erase all information on a hard drive? I'm looking to see if there's a method that can completely wipe out the content of a HDD, so that nothing ...
0
votes
3answers
536 views

How to rewrite config files using SNMP?

I scanned a router and found that the community string is public. The write access is also enabled. Now I want to change the configuration of the router. Can anybody tell me about tools and tutorials ...
2
votes
2answers
237 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
5
votes
2answers
2k views

Firewall Configuration Audits

I'm looking to perform policy audits against firewall configurations and/or rulesets. This should be performed independently of any configuration management systems, ideally by operating off the ...