Sep
30

Top 10 Security Assessment Tools – Repost

Jon Security, Technical, Uncategorized Add a comment

To fulfil the purpose of this site, I am reposting a collection of tools.  The Top 10 Security Assessment Tools.

Number Name Assessment Tool Description
1 Metasploit Download Metasploit
The Metasploit Framework provides a framework which consists of vulnerabilities, exploits, and payloads. Once a vulnerability is identified, the tester can then correlate the vulnerability to exploits stored in the framework. The exploit carries varying types of payloads which can gather passwords, provide a remote command channel, etc.
2 Nessus Download Nessus
Nessus is the de-facto standard for open-source vulnerability scanning. Available for both Windows and Linux. There is a commercial offering, and also Inprotect at Sourceforge however development on Inprotect has stopped.
3 Nmap Download Nmap
A network mapping tool that is another de-facto open-source tool. This is used to identify active hosts, running services, OS fingerprinting, etc- very fast!
4 Webscarab Download Webscarab
Webscarab is one of my personal favorites when it comes to hacking and conducting web-application security testing. This proxy application is Java-Based and provides an HTTP editor, Fuzzer, Decoders, and session ID analysis tools.
5 Firefox Development Tools Download Firefox Development Tools
Firefox is the preferable browser for most web-application security auditors/assessors. The Development plug-ins facilitate circumventing client-side security including input validation, lethth requirements, etc. Also can convert POST to GET commands.
6 Phishers Toolkit Download Phishers Toolkit
Up until this software was developed I had to construe my own hacks for conducting remote social engineering/phishing for my security assessments. This application simplifies creating a server, distributing the nefarious content, and gaining remote command-line-interface on the pwned machine.
7 Wireshark Download Wireshark
Wireshark, previously known as Ethereal, is a great network sniffing tool. Another standard, this is the most comprehensive network sniffing tool outside of the commercial space.
8 Aircrack-NG Download Aircrack-NG
Hacking WEP, and Hacking WPA, are both easily accomplished leveraging the Aircrack-NG toolset. Network monitoring, wireless sniffing, WEP cracking, & WPA Hack acquisition are all easily conducted with the Aircrack-NG suite.
9 USB Switchblade Download Switchblade
The primary purpose of this tool is to silently recover information from Windows systems, such as password hashes, LSA secrets, IP information as well as browser history and autofill information as well as create a backdoor to the target system for later access.
10 Brutus Download Brutus
Brutus is a great brute-force password hacking tool. Great for banging on passwords on SSH, Telnet, FTP, etc..
, ,
Aug
28

GMail Vulnerability & Fix

Jon How-To, Security, Technical Add a comment

During Defcon a new tool was mentioned that would automate the hacking of GMail accounts.   This only applies that those of you using GMail, not the Google Hosted Apps.

The problem is in how GMail encrypts traffic.  It only does SSL encryption during the login session.  As described here and here, this leaves your actual email unencrypted and a door for someone to get into your account later.

The simple fix is to go into your account Settings, scroll to the bottom, select “Always Use HTTPS” and click save changes.  This will cause your entire session with GMail to be encyrpted and mitigate the risk of your account being hijacked.  Combine this with Perspectives and you have a pretty solid security setup.

, , , ,
Aug
09

MIT Undergrads Hack Metro

Jon Security, Technical Add a comment

I was perusing the news and came across this artical on Wired talking about how the Massachusetts Bay Transportation Authority has sued a trio of students and their professor at MIT to prevent them from disclosing the details of the vulnerabilities that found and exploited.  It is an interesting read, but not too detailed.  The funny part is, because they included a MTBA Vulnerability Assessment Report in their filings with the court, it is not public record.

As I moved onto Reddit, I came across this posting which has the Defcon Presentation – MBTA Exploit Slides.  They were published by MIT’s student newspaper, The Tech.

, , ,