Tools used by security professionals

learn more… | top users | synonyms

2
votes
3answers
11k views

What sites are still vulnerable to FireSheep?

Am doing a Firesheep Demo in a few weeks as a security awareness project. However I can't seem to get it working, and I'm wondering if it's just because the handlers it ships with are now outdated ...
2
votes
1answer
193 views

Tools for Verifying Secure Deletion [closed]

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...
1
vote
0answers
83 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
1answer
593 views

RK Hunter Warns about /usr/lib/apache2/mpm-event/apache2 uses deleted files, how to further investigate the matter and how shall I treat it?

I have a cloud server that I am preparing for a small E-Commerce website deployment. I've used a RSA-2048 keys right before booting the newly purchased server, with the help of the Provider's Control ...
2
votes
4answers
18k views

Tools for performing HTTP FLOOD attack?

I'm looking for tools which can perform HTTP FLOOD ATTACK . I seached a lot and this is the only tool I've found DoSHTTP. Does anyone know another tool? I want to test them on my localhost to find ...
2
votes
2answers
3k views

Sniffing From Squid SSL

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I ...
0
votes
2answers
362 views

How to use WinObj for detecting security issues?

The description of WinObj says: WinObj is a must-have tool if you are a system administrator concerned about security What kind of security issues can it detect and what is the rough usage?
2
votes
2answers
173 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
9
votes
5answers
3k views

How can I remotely wipe the contents of a Linux Laptop if its been stolen?

I am currently investigating using Linux Laptops for my development team. We currently run Windows. The one advantage that keeps coming up for Windows over Linux from a system administration / ...
1
vote
1answer
164 views

Is there a compatibility issue between IPv6 and security testing tools?

Now that IPv6 is slowly coming into the picture, will there be a compatibility issue with using security testing tools, e.g.,: Network vulnerability scanning tools Web Applicaiton vulnerability ...
0
votes
2answers
607 views

In TrueCrypt Hidden / Normal overriding?

If I have a normal TrueCrypt volume, and I want to create a Hidden volume inside of it, how do I stop the 2 from overriding each other? Or do I just have to manually make sure the inner volume does ...
9
votes
0answers
371 views

CERT FOE Fuzzing Framework documentation

So I read another post here about fuzzing local standalone applications. I have understood how to exploit basic buffer overflow vulnerabilities in standalone applications and am now looking on how to ...
0
votes
2answers
270 views

How can we trust the tools? [closed]

There is a lot of tools out there to do a lot of things with, like sniffing, scanning, and even backdoors. However, I have a really hard time trusting these tools. When I install them at home and ...
5
votes
2answers
5k views

How can I view the NTFS $MFT using correct field names?

I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say ...
5
votes
4answers
7k views

Does setting a WiFi AP to channel 14 avoid the most common detection methods used in Europe or the Americas?

The legally allowable band for WiFI in the US covers channels 1-11. Europe goes to 13, Japan to 14. I suspect that most tools use the WiFi driver of the machine and only scan for the channels it is ...
15
votes
6answers
5k views

Lightweight Live Pen-test OS [closed]

Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
2
votes
2answers
3k views

What exactly is 'single' mode in John the Ripper doing?

I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
0
votes
1answer
1k views

Where can I find a list of Indicators of Compromise (IOC) conditions?

OpenIOC.org has several schemas defining Indicators of Compromise. The Schema is defined here: http://schemas.mandiant.com/2010/ioc/ioc.xsd While under IndicatorItemContext/search says it is ...
0
votes
2answers
479 views

Tools to extract code comments from sites? [closed]

I often come across sites that have way to many comments included in their source code, sometimes these comments offer valuable insight into whats happening in the code, the logic of functions, unused ...
3
votes
1answer
314 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
4
votes
2answers
7k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
4
votes
2answers
1k views

SQL Injection - Automating the fingerprinting of the DBMS

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS. I am in ...
3
votes
1answer
261 views

What are good tools for CRLF discovery? [closed]

What are good tools for finding CRLF injection vulnerabilities?
6
votes
1answer
8k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
9
votes
3answers
1k views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
2
votes
1answer
845 views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
5
votes
3answers
1k views

Secure source code review tool for jQuery

Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
4
votes
1answer
270 views

Finding all AJAX entrypoints

Is there any tool to (automatically) find all backend JavaScript entrypoints within a site? I have to check a site for vulnerabilities in the backend code that validates AJAX parameters and I would ...
0
votes
2answers
2k views

Msf and exploitdb on Backtrack 5

Metasploit (msf) doesn't see exploits from exploitdb. I've just updated directory on my Backtrack cd /pentest/exploits/exploitdb svn update How can I load them now into msf? When i use a script ...
4
votes
1answer
920 views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
10
votes
3answers
3k views

How to recover securely deleted data

Since we all know files are recoverable with programs after being deleted from the recycling bin, everyone is told to do secure wipes by putting random data over the files you're deleting on the disk ...
3
votes
2answers
1k views

Tools for analyzing Perl 5 code? [closed]

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but ...
4
votes
3answers
2k views

Are there any tools that focus on shellcode analysis?

Shellcode presents certain challenges for disassembly. It often self-modifies, jumps to the stack (where the shellcode will likely be placed), and relies on certain unusual tricks that standard ...
0
votes
1answer
176 views

Comparison between Data Encryption Tools and Data Sanitization Tools [closed]

What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites? Which Data Sanitization tools have the best results? Difference between Data encryption and Data ...
-3
votes
2answers
165 views

GPS tracking device [closed]

Could anyone please tell me if there exists a GPS tracking device that is light, small and safe (e.g., does not cause harmful radiation) and can be tracked back via say an app on a phone?
8
votes
1answer
628 views

Identifying, analyzing, and predicting weak session cookies

To elaborate on this, I'm looking at this from the perspective of a hacker/penetration tester. Many times I have seen web applications that I know have weak cookies. I can tell this because I can ...
7
votes
3answers
2k views

Who (which process) is calling curl?

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server. Basically I installed little Snitch and find out that "somebody" is using curl periodically. ...
11
votes
3answers
4k views

Can anyone suggest good open source tools for scanning source code for vulnerabilities? [closed]

I'm particularly looking ones which detect vulnerabilities in C/C++ code. I've seen a bunch of proprietary tools but no open source ones.
4
votes
1answer
544 views

Is Window's system restoration useful for getting rid of malware?

If your computer has been infected with some kind of malware, could a restoration of the system, using the tool provided by windows, help you getting rid of that malware? We should suppose that it ...
3
votes
2answers
158 views

What information will dig leak to an attacker?

What information will the axfr and ixfr commands in DIG provide to an attacker?
8
votes
6answers
2k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
1
vote
2answers
4k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
3
votes
1answer
220 views

Complex Consumer Matching Queries with PGP Universal

For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. ...
1
vote
1answer
505 views

Diagnosing possible svchost.exe thread on Windows 7

I used win64dd.exe to get a memory image on a 64-bit computer running Windows 7 and had Mandiant Redline analyze the image. One of the things marked red was one of the svchost.exe processes. Redline ...
2
votes
1answer
2k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ...
2
votes
3answers
2k views

How to intercept an application that bypasses local proxy

I am behind a corporate proxy and the application that i have to test will work only if it is given an exception for using proxy server(i.e it is added to the exceptions list of the sites that do not ...
5
votes
5answers
2k views

What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source. EDIT: I am actually looking to crack my passwords used on services I ...
5
votes
5answers
416 views

Tool to grab sensitive information from command lines [closed]

Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps). Is there a known tool to automate this kind ...
20
votes
6answers
2k views

Backing up sensitive data - pitfalls and best practices

Obviously, securely backing up sensitive data is a challenge. A remote backup is important for surviving a variety of disasters. What are some of the "gotcha's" lurking out there, and what best ...
0
votes
1answer
450 views

IR Jump Bag - What kind of bag/container to use?

I am working on putting together an Incident Response Jump Bag (detailed here). Any suggestions on what type of container/bag to use for this? It seems like a lot of little items that could be ...