Tag Info

Hot answers tagged

29

there's a large number of apps that can be used in web application assessments. One thing to consider is what kind of tool you're looking for. Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools. On top of that there's a huge range of scripts and point ...


22

Updated: For HTTP you can use Burp Suite's proxy (Java), or mitmproxy. tcpcatcher is a more general Java-based GUI capture and modify proxy which might be closer to your requirements, it includes content decoding and modification (manual and programmatic). It's HTTP biased, but accepts any TCP. It has SSL support, though the only drawback seems to be ...


17

I personally am partial to Fiddler, a free download from MS. There are many other decent interactive http proxies, but that one serves me the best.


15

My preferred tool bag to do a black box web app pen. test is currently: BURP Suite "is an intercepting proxy server for security testing of web applications. It operates as a man-in-the-middle between your browser and the target application" Fiddler another proxy tool "fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with ...


15

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. My bag specifically contains: Several Network Cables ...


13

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ...


13

yes there is, it's called metasploit unleashed. it is an official metasploit wiki with lots of information, it is structured kind of as a tutorial/course and it gets upgraded and updated regularily. it is probably the best place to start.


12

As mentioned above, there are a number of HTTP proxies that allow intercepting and modifying requests and responses. Here is a list of the ones I know about: WebScarab (disclaimer: I wrote it) Paros Burp ZAP (Z Attack Proxy - an updated version of Paros) Fiddler/Fiddler2 Achilles HTTPush Exodus (disclaimer: I wrote it, and it is really old) If you wish ...


12

Another one which causes more issues than you might expect is providing the backups with sufficient security. I have seen numerous instances where there was no protection of backups aside from being stored in a warehouse. This includes storing unencrypted customer account and password data! It makes it very easy for attackers - okay, they need to go back ...


12

What you are asking to find out is called enumeration. Reading the SQLMap manual under the enumeration topic provides me with the following information: --dbs for databases --tables for tables --columns for columns There is also a lot of other good information in the manual, so I suggest reading over it if you have more questions about flags and ...


12

Because encrypted files are not compressible, the most useful place to put encryption is in a compression program; that way you can compress the content and then encrypt it. Modern tools generally use well-vetted algorithms such as AES. Avoid classic ZIP encryption because it uses a bad algorithm. 7-zip is a great tool because it's FOSS, cross-platform, and ...


12

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...


11

A while ago I used the Tamper Data Firefox Add-on and found it to be quite effective. It has some good features like being able to choose what requests you wish to tamper with and also has some predefined exploits that you can use to populate field values with.


11

I think that both projects will have their strong and weak points. At the moment I'd say that Nessus appears to have a wider range of plugins available and arguably a better user interface than the standard OpenVAS client/server implementation. In addition Nessus seems to have widened their original focus in unauthenticated vulnerability scanning to ...


11

http://www.cryptool.org/ - free, and have all that you need for educational purposes. I use it in different cryptography trainings. From their site: " Numerous classic and modern cryptographic algorithms (encryption and decryption, key generation, secure passwords, authentication, secure protocols, etc.) Visualization of several algorithms (Caesar, Enigma, ...


11

BackTrack USB Live is probably your best bet. BackTrack includes many well known security tools including: Update Kali linux has replaced backtrack now. It's from the same people so the tools described should still be there. Metasploit integration RFMON Injection capable wireless drivers Kismet Nmap Ophcrack Ettercap Wireshark (formerly known as ...


11

Microsoft has had a horrific security track record. But the real problem in 2011 isn't operating systems, its web applications and web browsers. You should explore projects like Damn Vulnerable Web App, OWASP WebGoat and especially Google Gruyere. You can find pre-built VM's for all of them, and Google is hosting theirs so you don't have to install ...


11

TrueCrypt is what you're looking for. Other (paid) solutions include PGP Desktop, and Jetico BestCrypt.


11

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for ...


10

The majority of my forensics work is done after the fact in a lab environment, so by the time I get involved on-line work is too late, i.e. no memory analysis. Historically I would use EnCase Helix LiveCD Argus Recently I have started moving away from that combination and on to Argus Autopsy - For aquisition and system analysis BackTrack (Forensics ...


10

Truecrypt is appraised and widely used, but most of its usage is for disk encryption. As you are more interested on single files, I would either research how to effectivley use Truecrypt for single files or another option is GnuPG. "GnuPG is a volume and individual file encryption tool with support for a dozen encryption schemes, paired keys, and expiring ...


10

It's difficult to keep this list up-to-date. In my opinion -- this is a BAD QUESTION. The correct question should be "What techniques are available to asses the security of a web application, how are they commonly implemented, and how do you keep up on the latest improvements to both the techniques and their implementations?" For example, better tools are ...


10

The hardware tool that is suited to his is the Universal Software Radio Peripheral (vendor site). You can get a leg up on decoding the transmissions by looking at the work done for the OpenBTS system. So, hardware-wise it's commodity equipment, though a few thousand dollars because it's not very common. Software wise, the groundwork is already there to pull ...


10

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf ...


10

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


9

I think that -Tfields -eframe.protocols would be the closest thing you'll get. The output looks something like this: eth:ip:tcp:http eth:ip:tcp eth:ip:tcp:http:media eth:ip:tcp eth:ip:udp:nbdgm:smb:browser eth:ip:tcp eth:arp eth:arp eth:ipv6:udp:http eth:ip:udp:http As it can be seen the information displayed will vary a bit depending on which protocol ...


9

There's a couple of ways you could do this, that spring to mind First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type: use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...


9

how can a bad guy recover data that's been overwritten just once, since it would change the reflective or height of the gap? There are three basic methods: multiple copies, error correction, and enhanced detection. A hard disk, or CD-ROM for that matter contains a filesystem. A filesystem is an organization of files in a way that makes sense to the ...



Only top voted, non community-wiki answers of a minimum length are eligible