Tag Info

Hot answers tagged

30

Updated: For HTTP you can use Burp Suite's proxy (Java), or mitmproxy. tcpcatcher is a more general Java-based GUI capture and modify proxy which might be closer to your requirements, it includes content decoding and modification (manual and programmatic). It's HTTP biased, but accepts any TCP. It has SSL support, though the only drawback seems to be ...


29

there's a large number of apps that can be used in web application assessments. One thing to consider is what kind of tool you're looking for. Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools. On top of that there's a huge range of scripts and point ...


28

Your first question is really a legal one, and you seem to be assuming two things: The attacker is a government of some sort. That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys. Neither of those assumptions are necessarily true. For all you know, some ...


19

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...


18

I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above. Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills. Port scanning: Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and ...


18

You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...


17

I personally am partial to Fiddler, a free download from MS. There are many other decent interactive http proxies, but that one serves me the best.


15

My preferred tool bag to do a black box web app pen. test is currently: BURP Suite "is an intercepting proxy server for security testing of web applications. It operates as a man-in-the-middle between your browser and the target application" Fiddler another proxy tool "fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with ...


15

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. My bag specifically contains: Several Network Cables ...


14

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ...


14

Because encrypted files are not compressible, the most useful place to put encryption is in a compression program; that way you can compress the content and then encrypt it. Modern tools generally use well-vetted algorithms such as AES. Avoid classic ZIP encryption because it uses a bad algorithm. 7-zip is a great tool because it's FOSS, cross-platform, and ...


13

yes there is, it's called metasploit unleashed. it is an official metasploit wiki with lots of information, it is structured kind of as a tutorial/course and it gets upgraded and updated regularily. it is probably the best place to start.


13

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...


12

As mentioned above, there are a number of HTTP proxies that allow intercepting and modifying requests and responses. Here is a list of the ones I know about: WebScarab (disclaimer: I wrote it) Paros Burp ZAP (Z Attack Proxy - an updated version of Paros) Fiddler/Fiddler2 Achilles HTTPush Exodus (disclaimer: I wrote it, and it is really old) If you wish ...


12

Another one which causes more issues than you might expect is providing the backups with sufficient security. I have seen numerous instances where there was no protection of backups aside from being stored in a warehouse. This includes storing unencrypted customer account and password data! It makes it very easy for attackers - okay, they need to go back ...


12

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf ...


11

A while ago I used the Tamper Data Firefox Add-on and found it to be quite effective. It has some good features like being able to choose what requests you wish to tamper with and also has some predefined exploits that you can use to populate field values with.


11

I think that both projects will have their strong and weak points. At the moment I'd say that Nessus appears to have a wider range of plugins available and arguably a better user interface than the standard OpenVAS client/server implementation. In addition Nessus seems to have widened their original focus in unauthenticated vulnerability scanning to ...


11

http://www.cryptool.org/ - free, and have all that you need for educational purposes. I use it in different cryptography trainings. From their site: " Numerous classic and modern cryptographic algorithms (encryption and decryption, key generation, secure passwords, authentication, secure protocols, etc.) Visualization of several algorithms (Caesar, Enigma, ...


11

BackTrack USB Live is probably your best bet. BackTrack includes many well known security tools including: Update Kali linux has replaced backtrack now. It's from the same people so the tools described should still be there. Metasploit integration RFMON Injection capable wireless drivers Kismet Nmap Ophcrack Ettercap Wireshark (formerly known as ...


11

There's a couple of ways you could do this, that spring to mind First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type: use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...


11

Truecrypt is appraised and widely used, but most of its usage is for disk encryption. As you are more interested on single files, I would either research how to effectivley use Truecrypt for single files or another option is GnuPG. "GnuPG is a volume and individual file encryption tool with support for a dozen encryption schemes, paired keys, and expiring ...


11

The hardware tool that is suited to his is the Universal Software Radio Peripheral (vendor site). You can get a leg up on decoding the transmissions by looking at the work done for the OpenBTS system. So, hardware-wise it's commodity equipment, though a few thousand dollars because it's not very common. Software wise, the groundwork is already there to pull ...


11

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


11

TrueCrypt is what you're looking for. Other (paid) solutions include PGP Desktop, and Jetico BestCrypt.


11

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for ...


10

Try SET from Social-Engineer.org. Whole site is a great resource.


10

The majority of my forensics work is done after the fact in a lab environment, so by the time I get involved on-line work is too late, i.e. no memory analysis. Historically I would use EnCase Helix LiveCD Argus Recently I have started moving away from that combination and on to Argus Autopsy - For aquisition and system analysis BackTrack (Forensics ...



Only top voted, non community-wiki answers of a minimum length are eligible