is a VIPER Lab live distribution that contains VIPER developed tools such as UCsniff, VoipHopper, Videojak, videosnarf, ACE, Warvox, and more. Along with VIPER tools and other essential VoIP security tools, it also contains tools penetration testers utilize such as Metasploit, Nmap, Netcat, Hydra, Hping2 etc.
OWASP AntiSamy
é uma API que permite que os usuários possam inserir HTML e CSS em uma página Web (como o perfil de uma rede social ou o campo de comentários de um blog) sem ficar exposto à vulnerabilidades Cross-SiteScripting (XSS).
XPLICO
é um NFAT (Network Forensic Analysis Tool), o objetivo desta ferramenta é extrair diversas informações de um arquivo pcap ou realizar a mesma analise em tempo real, com o xplico você pode extrair informações como: email (POP, IMAP e SMTP), HTTP, VoIP (SIP), FTP, TFTP etc.
Recursos:
-Protocols supported: HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, …;
-Port Independent Protocol Identification (PIPI) for each application protocol;
Multithreading;
-Output data and information in SQLite database or Mysql database and/or files;
-At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;
-Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer -RAM, CPU, HD access time, …-);
-TCP reassembly with ACK verification for any packet or soft ACK verification;
-Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;
-No size limit on data entry or the number of files entrance (the only limit is HD size);
-IPv4 and IPv6 support;
-Modularity. Each Xplico component is modular. The input interface, the protocol decoder (Dissector) and the output interface (dispatcer) are all modules;
-The ability to easily create any kind of dispatcer with which to organize the data extracted in the most appropriate and useful to you.
A Engenharia Social Toolkit (SET)
é um conjunto de ferramentas escrito em python com foco em ataques de engenharia social, sua principal finalidade é aumentar e simular ataques de engenharia social e permitir que o testador teste como um ataque deste tipo poderia acorrer com sucesso. Assista a um vídeo aqui.
é um conjunto de ferramentas escrito em python com foco em ataques de engenharia social, sua principal finalidade é aumentar e simular ataques de engenharia social e permitir que o testador teste como um ataque deste tipo poderia acorrer com sucesso. Assista a um vídeo aqui.
distribuição linux com foco em segurança
Front end gráfico para o John the Ripper (JtR)
distribuição linux (live system) com foco em análise forense.
é um poderoso scan de IP e NetBIOS, whois e traceroute, com função de desligamento remoto e Wake-On-Lan, LAN messenger e monitoramento de rede.
é um aplicativo que busca por servidores proxy SOCKS.
é uma ferramenta de código aberto e grátis de Controle de Acesso a Rede (NAC). Com ele você pode:
- Criar um Captive-portal
- Centralizar a rede sem fio e cabeada
- Suporte 802.1X
- Isolar dispositivos problemáticos que atuam na camada 2
- Integrar com o Snort e Nessus
- Bloquear acesse de IPODS
- Elimitar tráfego peer-to-peer
- Oferecer Acesse aos Visitantes
- Simplificar o gerenciamento de VLANS
esta ferramenta não é open source, mas é FREE para usar e sem restrições, com ela você identifica qualquer processo não desejado que esteja executando no seu sistema, menos rootkits, podendo até remover de forma fácil este processo. Ótima ferramenta para detectar malware.
é um live CD Linux baseado no Ubuntu que também pode ser instalado na máquina e que tem como foco testes de segurança.
é uma nova maneira de escrever exploits, analisar malware e realizar engenharia reversa em arquivos binários.
é um proxy local que pode interceptar e modificar pacotes TCP gerados por aplicativos rodando no Windows.
a Free Penetration Testing and Vulnerability Research Toolkit .
is a network tool designed to take advantage of some weakeness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.
GRAUDIT
Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.
Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very flexible.
a virtual appliance weielding best-of-breed technologies on a single appliance. Intrusion Detection, Vulnerability Scanning, network & server capacity and availability management, a business intelligence platofrm for reporting, and a learning management & collaboration system for rollout of Policies, Procedures, and Standards throughout the organization. Don't waste precious budgetary dollars on high-cost commercial applications- start using STOCKADE today!
O site do Sysinternals foi criado em 1996 por Mark Russinovich e Bryce Cogswell para hospedar seus utilitários de sistema avançados e informações técnicas e a Microsoft adquiriu a Sysinternals em julho de 2006. Seja você um profissional de TI ou um desenvolvedor, você encontrará os utilitários Sysinternals para ajudá-lo a gerenciar, solucionar problemas e diagnosticar seus aplicativos e sistemas Windows. Se você tiver alguma dúvida sobre uma ferramenta ou como usá-la, visite o Sysinternals Forum para procurar respostas e ajuda de outros usuários e de nossos moderadores.
was developed from my own personal need for a web application analysis tool. It represents the exact functionality I found necessary in the trenches of a security audit.
is a forensic file recovery tool written in Perl. It was inspired by the Air Force Office of Special Investigations' forensic tool known as "Foremost", which uses defined headers and footers of certain file types to search a raw disk image and extract files with those characteristics.
a PAM module that provides auto blacklisting of hosts and users responsible for repeated failed authentication attempts. Generally configured so that blacklisted users still see normal login prompts but are guaranteed to fail to authenticate.
is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible
Another little project I put together a couple of years ago is sessionthief. When I need to quickly demonstrate the insecurity of open wireless networks, this is my first choice, as it has the ability to immediately hack into most websites another user on the same LAN is logged into.
It performs HTTP session cloning by cookie stealing. It can issue basic nmap and nbtscan commands to see which IPs are on the subnet, or just listen for IPs broadcasting packets. It can quickly perform ARP poison routing to get packets given the IP of the client if not on an open network or hub, and should also work with interfaces in monitor mode. It integrates automatically with Firefox, dynamically creating a temporary profile for each attack performed. In this way, in contrast to tools like the middler, it doesn’t require any additional configuration, and makes it easy to simultaneously own multiple logins to the same site. (although the middler is a much larger and more capable project).
is like a fire hydrant full of bad HTML and CSS code to test the stability and security of web browsers. Available as a standalone webserver or CGI script, it continuously feeds browsers bad data in the hope that they will eventually crash. It is designed to run for hours, or even days until the browser crashes. namebench was initially written as a QA tool for the Mozilla Project to test the Firefox 1.0 release, and is now included and used by Apple's Webkit project.
is an Open Source database firewall used to protect databases from SQL injection attacks. GreenSQL works as a proxy for SQL commands and has built in support for MySQL & PostgreSQL .
is a web application firewall (WAF). With over 70% of attacks now carried out over the web application level, organisations need all the help they can get in making their systems secure. WAFs are deployed to establish an increased external security layer to detect and/or prevent attacks before they reach web applications. ModSecurity provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring and real-time analysis with little or no changes to existing infrastructure.
is an open source penetration testing tool that automates the process of detecting and exploiting XSS injections against different applications.
is a simple tool to analyze suspicious PDF files which can contain obfuscated JS code and shellcodes, trying to retrieve them.
is a automated website malware detection tools. It can be used to decode and analyze weather the URL exist malware. Also, NSDECODER will analyze which vulnerability been exploit and the original source address of malware.
is a proof of concept python-based cookie hijacking utility that is able to capture cookies of improperly secured HTTPS sites via the local network.
is an open-source, Unix-based Network Intrusion Detection System (NIDS) that passively monitors network traffic and looks for suspicious activity. Bro detects intrusions by first parsing network traffic to extract its application-level semantics and then executing event-oriented analyzers that compare the activity with patterns deemed troublesome. Its analysis includes detection of specific attacks (including those defined by signatures, but also those defined in terms of events) and unusual activities (e.g., certain hosts connecting to certain services, or patterns of failed connection attempts).
is an information gathering tool designed for obtaining hostnames from DNS servers using dictionary attack (forcedns) and reverse lookup (dnsreverser).
is an information gathering tool designed for obtaining subdomain names from public sources, like Google, Msn search, Yahoo, PgP servers, etc.
It provides basic backdoor functionality through opening a conection against a specified server and port and waiting for any order to execute in the trojanized database.
is a tool to perform dictionary attacks to the SSH servers, it's a simple tool, you set the target server, target account, wordlist, port and wait...
ARP attack tool with 4 major functions, 3 of witch attempt to MITM one or more computers on a network with a passive method or flood type method.
is built by network security analysts for network security analysts. Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis. The Sguil client is written in tcl/tk and can be run on any operating system that supports tcl/tk (including Linux, *BSD, Solaris, MacOS, and Win32).
is a program for monitoring system logs in real-time, and reporting on the occurrence of events. It is similar to the well-known swatch program on which it is based, but offers a number of advanced features which swatch does not support.
is scanning tool to ensure you for about 99.9%* you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits.
is the data engine for IT. It collects, indexes and harnesses the fast moving IT data generated by all your IT systems and infrastructure - physical, virtual and in the cloud. Use Splunk and your IT data to deliver new levels of visibility and intelligence for IT and the business.
is an Open Source Next Generation Intrusion Detection and Prevention Engine.
is a collection of web application security testing tools that complement the feature set of current web proxies and automated scanners. CAL9000 gives you the flexibility and functionality you need for more effective manual testing efforts. Works best when used with Firefox or Internet Explorer.
A fully automated, active web application security reconnaissance tool.
provides a restricted set of free Web Security Assessment checks to enhance the overall security of your web server infrastructure, using the most complete web attack signature database available in the market - "N-Stealth Web Attack Signature Database".
is a Proactive Computer Network Security Vulnerability Assessment Scanner with over 5000 audits.
verifique as vulnerabilidades de aplicativos para web de maneira segura com esta poderosa ferramenta da IBM.
is a network security scanner that proactively reports on network vulnerabilities and helps to remediate them and ensure compliance.
a Free Penetration Testing and Vulnerability Research Toolkit .
is a network tool designed to take advantage of some weakeness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.
is a versatile passive OS fingerprinting tool. P0f can identify the operating system on:
- machines that connect to your box (SYN mode),
- machines you connect to (SYN+ACK mode),
- machine you cannot connect to (RST+ mode),
- machines whose communications you can observe.
- machines you connect to (SYN+ACK mode),
- machine you cannot connect to (RST+ mode),
- machines whose communications you can observe.
P0f can also do many other tricks, and can detect or measure the following:
- firewall presence, NAT use (useful for policy enforcement),
- existence of a load balancer setup,
- the distance to the remote system and its uptime,
- other guy's network hookup (DSL, OC3, avian carriers) and his ISP.
- existence of a load balancer setup,
- the distance to the remote system and its uptime,
- other guy's network hookup (DSL, OC3, avian carriers) and his ISP.
is a console program to recover files based on their headers, footers, and internal data structures.
an opensource inventory and package deployment software for Windows and Unix like computers.
Web-based hardware/software inventory management for Windows, Linux, BSD computers. H-Inventory provides incident and intervention management, user and network management, network maps, services monitoring and application deployment.
is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company (computer, software, printers...). It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-system with mail-notification and methods to build a database with basic information about your network-topology.
is a tool that automates queries against Google search appliances, but with a twist. These particular queries are designed to find potential vulnerabilities on web pages. Think “cgi scanner” that never communicates directly with the target web server, since all queries are answered by a Google appliance, not by the target itself.
is a Man in the Middle tool to demonstrate protocol middling attacks.
advanced password recovery.
stands for Open Source Security Information Management. Its goal is to provide a comprehensive compilation of tools which, when working together, grant network/security administrators with a detailed view over each and every aspect of his or her networks, hosts, physical access devices, server, etc.
is an application to tell you exactly what is on your network, how it is configured and when it changes. Open-AudIT will run on Windows and Linux systems. Essentially, Open-AudIT is a database of information, that can be queried via a web interface. Data about the network is inserted via a Bash Script (Linux) or VBScript (Windows). The entire application is written in php, bash and vbscript. These are all 'scripting' languages - no compiling and human readable source code. Making changes and customisations is both quick and easy.
run a shell with logging.
