Tools used by security professionals

learn more… | top users | synonyms

1
vote
0answers
251 views

What hardware tools are useful to detect cyber crimes? [closed]

As the title says, I would ask about some tools or sensors that are available to be used to detect cyber crimes, specially I am looking for sensors that can be used to read and recover data from ...
6
votes
2answers
2k views

Tools to scan for PII

I'm looking for well known tools that will scan for any PII within a network. For example, I would like to be able to use a plug and play method, meaning I drive to a client, plug my laptop in, and ...
2
votes
3answers
247 views

Which languages are better for attacks against websites?

Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?
4
votes
1answer
373 views

How to encrypt an entire portable HDD, so that it cannot be read/written without the password for it?

I use a portable USB drive (Seagate FreeAgent Go Flex) to keep all my personal stuff, and though the HDD company does offer a password scheme to control access to it, that would work only on windows, ...
5
votes
2answers
2k views

Virus detection with Process Explorer

Can Process Explorer ( Windows apparently) detect a virus? Is it even possible?
15
votes
3answers
411 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...
12
votes
2answers
3k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
-2
votes
1answer
625 views

Is there a need for a simple SAAS security risk assessment application?

Apologies if this is question is not quite right for this site, I have been working on a small startup simple security risk assessment application, mainly to scratch my own itch and am looking to get ...
0
votes
1answer
220 views

System image that does not allow for recovery of deleted files?

We are working with an contractor regarding a compromised computer. The contractor has asked for a dd dump of the drive. However, my understanding is that dd would allow the contractor to recover ...
7
votes
3answers
450 views

Which resources can help me learn how to use metasploit?

I tried google search but I can't find good resources to learn how to use the metasploit framework. Where would you suggest a beginner go to learn about using metasploit?
6
votes
3answers
291 views

Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?

I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't. ...
3
votes
4answers
1k views

Comparing penetration testing suites

I've been using Backtrack for a while now. I was wondering if there is anything better, or on par with, that is worth looking into. Thoughts?
3
votes
1answer
140 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
13
votes
3answers
814 views

Starting with sandbox development

I am looking for some security related project in which I can contribute and also learn something. Since I am new with this stuff It will be better if that project is less complex and digestible for a ...
6
votes
4answers
776 views

Benefits of secure code review in-IDE vs. fatapp vs. webapp

For those of you who have worked with commercial secure code review tools such as: Klocwork Coverity Armorize Fortify Checkmarx Appscan Source Edition (formerly Ounce) Or perhaps a free or ...
5
votes
2answers
1k views

What tools exist to help me monitor OCSP certificate validation failures?

The discussion at Why isn't OCSP required by default in browsers? notes that many browsers by default simply ignore failure to check web site TLS certificate revocation status via the Online ...
7
votes
4answers
467 views

What kind of IT security applications do you guys run on your laptop/desktop?

I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
4
votes
1answer
2k views

Are there any tools for automated penetration testing of Silverlight applications?

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
16
votes
4answers
2k views

Open-source penetration-test automation

Has anyone built a metascript, or a `script of scripts' useful during a penetration-test? Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...
6
votes
1answer
4k views

High concentration of UDP traffic, good or bad?

Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security? I'm looking at my organization's network protocol ...
10
votes
2answers
541 views

Tools and methodologies to share pentest and/or source code analysis results

I would like to hear from you which tools (commercial and open source) do you use to share results during collaborative penetration test or source code/binary analysis. Well-known Dradis framework ...
5
votes
1answer
754 views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
3
votes
2answers
583 views

What is the proper priority/mix of (people, tools and technology, processes) to optimize defense?

I'm curious if people have different views on this and why. Update based on comments: Defend enterprises. Quotes: "Long-time blog readers should know that I don't rely on tools to defend my ...
14
votes
2answers
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
7
votes
2answers
1k views

Classical Cryptography Tools

I'm wondering if there are any tools out there that can assist in solving classical cipher text. I'm looking into developing some tools such as frequency analysis, transposition tools and so on but ...
0
votes
2answers
280 views

is there any solution to manage network forensic, SIEM and intelligence analysis and investigation in a enterprise network?

Anyone have experience in a solution to manage in an integrated view this functionality ? - network forensic - SIEM - intelligence analysis and investigation Like Niksun or Solera solution do ? I'm ...
4
votes
2answers
1k views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
8
votes
2answers
252 views

Why is FireSheep such a big deal?

We've had WireShark and other tools for a long time before. Why does everybody make such a big deal about FireSheep?