Book : Backtrack 5 Wireless Penetration Testing

Book : Backtrack 5 Wireless Penetration Testing by Vivek Ramachandran

This book will provide a highly technical and in-depth treatment of Wi-Fi security. The emphasis will be to provide the readers with a deep understanding of the principles behind various attacks and not just a quick how-to guide on publicly available tools. We will start our journey with the very basics by dissecting WLAN packet headers with Wireshark, then graduate to the next level by cracking WEP, WPA/WPA2 and then move on to real life challenges like orchestrating Man-in-the-Middle attacks, creating Wi-Fi Honeypots and compromise networks running WPA-Enterprise mechanisms such as PEAP and EAP-TTLS.

Even though touted as a Beginner's Guide, this book has something for everyone - from the kiddies to the Ninjas. You can purchase the book from:
Global:  http://lnx.lu/4Cf
India:  http://lnx.lu/4Cq

Sample Chapter can be downloaded here: 
http://lnx.lu/4E7

Author Bio:
Vivek Ramachandran, the author of the book has been into Wireless security research since 2003. He has spoken at conferences such as Blackhat, Defcon and Toorcon on Wireless Security and is the discoverer of the Caffe Latte attack. He also broke WEP Cloaking, a WEP protection schema in 2007 publically at Defcon. He was one of the programmers of the 802.1x protocol and Port Security in Cisco's 6500 Catalyst series of switches. He was one of the winners of Microsoft Security Shootout contest held in India among a reported 65,000 participants. He is best known in the hacker community as the founder of SecurityTube.net where he routinely posts videos on Wi-Fi Security, Assembly Language, Exploitation Techniques etc. Vivek's work on wireless security has been quoted in BBC online, InfoWorld, MacWorld, The Register, IT World Canada etc. places. This year he is either speaking or training at Blackhat, Defcon, Hacktivity, HITB-ML, Brucon, Derbycon, HashDays, SecurityByte etc.
For those who cannot afford to purchase the book, Vivek's Wireless Megaprimer Video series (12+ hours of HD videos on Wi-Fi Hacking) is the next best thing to it.

Read More

AnDOSid the DOS tool for Android

AnDOSid the DOS tool for Android

A new product released by SCOTT HERBERT for Android mobile phones,Its AnDOSid - the DOS tool for Android Phones. The rise of groups like Anonymous and LuzSec, as well as constant India / Pakistan cyberwar has raised the issue of cyber-security high(er) in the minds of web owners.

Pentesting tools exist to simulate such attacks and help website security people defend against them, however for the most part they currently only exist for desktop computers. Mobile phones have, over the last few years, grown from simple devices that send and receive calls to mobile computing platforms which can be purchased for less than $100 a device.

AnDOSid fills that gap, allowing security professionals to simulate a DOS attack (An http post flood attack to be exact) and of course a dDOS on a web server, from mobile phones. AnDOSid is actively being developed and I welcome feedback from the security community as to how you would like the application to evolve.


What's in this version:

• Requires Internet access to send the http post data
• Requires phone state to access the IMEI (one of the two identifiers sent with each post)

AnDOSid can be downloaded from the Android Market place and costs just £1 or Rs.74.58/-Only.

Read More

sqlsus v0.7 (SQL Injection and Takeover Tool)

sqlsus is an open source MySQL injection and takeover tool, written in perl. Via a command line interface, you can retrieve the database(s) structure, inject your own SQL queries (even complex ones), download files from the web server, crawl the website for writable directories, upload and control a backdoor, clone the databases, and much more. sqlsus is an open source (My)SQL injection tool, written in perl. It focuses on speed and efficiency, optimising the available injection space. It provides an easy to use interface with lots of neat features.

Features of Sqlsus v0.7:-

• Added time-based blind injection support (added option “blind_sleep”, and renamed “string_to_match” to “blind_string”).

• It is now possible to force sqlsus to exit when it’s hanging (i.e.: retrieving data), by hitting Ctrl-C more than twice.

• Rewrite of “autoconf max_sendable”, so that sqlsus will properly detect which length restriction applies (WEB server / layer underneath). (removed option “max_sendable”, added options “max_url_length” and “max_inj_length”)

• Uploading a file now sends it into chunks under the length restriction.

• sqlsus now saves variables after each command, so that forcing it to quit (or killing it) will not discard the changes that were made.

• Added a progress bar to inband mode, sqlsus now determines the number of rows to be returned prior to fetching them.

• get db (tables/columns) in inband mode now uses multithreading (like everything else).

• clone now uses count(*) if available (set by “get count” / “get db”), instead of using fetch-ahead.

• In blind mode, “start” will now test if things work the way they should, by injecting 2 queries : one true and one false.

• sqlsus now prints what configuration options are overridden (when a saved value differs from the configuration file).

To Download sqlsus (My SQL Injection Tool) 

• Tar file

• Debian Package

Read More

PHP Vulnerability Hunter v.1.1.4.6

PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool. is the application that detected almost all of the web application vulnerabilities listed on the advisories page. PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool capable of triggering a wide range of exploitable faults in PHP web applications. Minimal configuration is necessary to begin a scan; PHP Vulnerability Hunter doesn’t even need a user specified starting URI. At the core of the PHP Vulnerability Hunter scan algorithm is dynamic program analysis. Unlike many vulnerability scanners and fuzz tools that rely on static analysis, PHP Vulnerability Hunter analyzes the program as it’s running to get a clear view of all input vectors. That means better code coverage and as a result greater confidence in code security.

Features :-

•     Automated input vector discovery.
•     Integrate fault detection
•     Minimal configuration.
•     Proven effective
•     Added code coverage report
•     Updated GUI validation
•     Several instrumentation fixes
•     Fixed lingering connection issue
•     Fixed GUI and report viewer crashes related to working directory

To Download PHP Vulnerability Hunter Click Here

Read More

X-Scan A Free Network Vulnerability Scanner

X-Scan is a general scanner for scanning network vulnerabilities for specific IP address range or stand-alone computer by multi-threading method, plug-ins are supported. This is an old tool (last update in 2005), but some people still find it useful and there are certain situations where it can be useful (especially in those jurassic companies using old kit). It supports Nessus NASL plugins for vulnerability scanning – which makes it pretty useful. It also has both a GUI and command line version for scripting.

Features :-

•     Remote OS type and version detection,
•     Standard port status and banner information,
•     SNMP information,
•     CGI vulnerability detection,
•     IIS vulnerability detection,
•     RPC vulnerability detection,
•     SSL vulnerability detection,
•     SQL-server,
•     FTP-server,
•     SMTP-server,
•     POP3-server,
•     NT-server weak user/password pairs authentication module,
•     NT server NETBIOS information,
•     Remote Register information, etc.

The results of the scan are saved in /log directory, and are title index_ip_address.htm (if you used the GUI) or ip_address if you used the command line option. These can be directly browsed by any normal WebBrowser. Basic user and password lists are supplied to carry out a basic attack on certain services, (above), if found enabled on the host. 

To Download X-Scan Click Here

Read More

John the Ripper 1.7.9 Released

John the Ripper version 1.7.9 released & available for download. John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. It supports several crypt(3) password hash types commonly found on Unix systems, as well as Windows LM hashes.

Official change log for John the Ripper 1.7.9 :-

•  Added optional parallelization of the MD5-based crypt(3) code with OpenMP.
•  Added optional parallelization of the bitslice DES code with OpenMP.
•  Replaced the bitslice DES key setup algorithm with a faster one, which significantly improves performance at LM hashes, as well as at DES-based crypt(3) hashes when there’s just one salt (or very few salts).
• Optimized the DES S-box x86-64 (16-register SSE2) assembly code.
• Added support for 10-character DES-based tripcodes (not optimized yet).
• Added support for the “$2y$” prefix of bcrypt hashes.
• Added two more hash table sizes (16M and 128M entries) for faster processing of very large numbers of hashes per salt (over 1M).
•  Added two pre-defined external mode variables: “abort” and “status”, which let an external mode request the current cracking session to be aborted or the status line to be displayed, respectively.
•  Made some minor optimizations to external mode function calls and virtual machine implementation of John the Ripper.
• The “–make-charset” option now uses floating-point rather than 64-bit integer operations, which allows for larger CHARSET_settings in params.h.
• Added runtime detection of Intel AVX and AMD XOP instruction set extensions, with optional fallback to an alternate program binary.
• In OpenMP-enabled builds, added support for fallback to a non-OpenMP build when the requested thread count is 1.
• Added relbench, a Perl script to compare two “john –test” benchmark runs, such as for different machines, “make” targets, C compilers, optimization options, or/and versions of John the Ripper.
• Additional public lists of “top N passwords” have been merged into the bundled common passwords list, and some insufficiently common passwords were removed from the list.
•     Many minor enhancements and a few bug fixes were made.

To Download John the Ripper 1.7.9 Click Here

Read More

RainbowCrack 1.5 (A Brute Force Hash Cracker)

RainbowCrack is a general propose implementation of Philippe Oechslin's faster time-memory trade-off technique. It crack hashes with rainbow tables. RainbowCrack uses time-memory tradeoff algorithm to crack hashes. It differs from the hash crackers that use brute force algorithm. A brute force hash cracker generate all possible plaintexts and compute the corresponding hashes on the fly, then compare the hashes with the hash to be cracked. Once a match is found, the plaintext is found. If all possible plaintexts are tested and no match is found, the plaintext is not found. With this type of hash cracking, all intermediate computation results are discarded. A time-memory tradeoff hash cracker need a pre-computation stage, at the time all plaintext/hash pairs within the selected hash algorithm, charset, plaintext length are computed and results are stored in files called rainbow table. It is time consuming to do this kind of computation. But once the one time pre-computation is finished, hashes stored in the table can be cracked with much better performance than a brute force cracker. In this RainbowCrack project, we focus on the development of optimized time-memory tradeoff implementation, and generation of large rainbow tables.

Features :-

• Full time-memory tradeoff tool suites, including rainbow table generation, sort, conversion and lookup
• Support rainbow table of any hash algorithm
• Support rainbow table of any charset
• Support rainbow table in raw file format (.rt) and compact file format (.rtc)
• Computation on multi-core processor support
• Computation on GPU (via NVIDIA CUDA technology) support
• Computation on multi-GPU (via NVIDIA CUDA technology) support
• Runs on 32-bit Windows operating systems 
• Unified rainbow table file format on all supported operating systems
• Command line user interface
• Graphics user interface (Windows only)
• Support 64-bit Windows operating systems
• Support 32-bit Linux operating systems (x86 only)
• Support 64-bit Linux operating systems (x86_64 only)
• Support rainbow table file larger than 2 GB

To Download RainbowCrack 1.5 Click Here

Read More

THC-HYDRA 7.2 - Fast and Flexible network login Bruteforce Tool Updated

THC-HYDRA 7.2 - Fast and Flexible network login Bruteforce Tool Updated

One of the most famous network logon cracker – THC-HYDRA 7.2 get latest Update. Hydra is a parallized login cracker which supports numerous protocols to attack. New modulesare easy to add, beside that, it is flexible and very fast.Hydra was tested to compile on Linux, Windows/Cygwin, Solaris 11, FreeBSD 8.1 and OSX, andis made available under GPLv3 with a special OpenSSL license expansion.

Hydra is best for Samba, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support and is part of Nessus.

Changelog v7.2

• Speed-up http modules auth mechanism detection
• Fixed -C colonfile mode when empty login/passwords were used (thanks to will(at)configitnow(dot)com for reporting)
• The -f switch was not working for postgres, afp, socks5,
• firebird and ncp, thanks to Richard Whitcroft for reporting!
• Fixed NTLM auth in http-proxy/http-proxy-url module
• Fixed URL when being redirected in http-form module, thanks to gash(at)chaostreff(dot)at
• Fix MSSQL success login condition, thanks to whistle_master(at)live(dot)com
• Fix http form module: optional headers and 3xx status redirect, thx to Gash
• Fix in configure script for –prefix option, thanks to dazzlepod
• Update of the dpl4hydra script by Roland Kessler, thanks!
• Small fix for hydra man page, thanks to brad(at)comstyle(dot)com

Download THC-Hydra v7.2

Read More

BFT- Browser forensic tool Released by DarkCoderSc

BFT- Browser forensic tool Released by DarkCoderSc

From the Developer of Famous DarkComet RAT Tool, DarkCoderSc Yesterday Release Another Interesting tool called BFT- Browser forensic tool. Browser forensic tool, is a software that will search in all kind of browser history (even archived) in a few seconds.It will retrieve URLS and Title with the chosen keywords of all matching search.You can use default example profiles or create yours, with thematic search.

You can Download it from here : BFT Download

Video Demonstration: 

Read More

Acunetix Web Vulnerability Scanner v8 Released

Acunetix Web Vulnerability Scanner v8 Released  

Earlier we have discussed various times about Acunetix. November last year the team has released Acunetix Web Vulnerability Scanner 8 BETA and now in February we finally got the most awaited Final resale of Acunetix 8. Before this final resale in January this year Release Candidate (RC) of Acunetix 8. Version 8 echoes years of counter-hacking experience through its new ability to lock hackers out by integrating scan results into Imperva’s Web Application Firewall, and by recognizing a new breed of vulnerabilities through new detection methods. Additionally, Acunetix WVS 8 takes vulnerability scanning to a new level by integrating smarter and more reliable automated features, making it quicker to launch a scan with less configuration required. In the official blog Mr. Nick Galea the CEO of Acunetix  told:- “Acunetix WVS 8 continues to set new standards for web vulnerability scanners. Web security exploit statistics are steadily on the rise — unfortunately not in favor of website owners — which is why version 8 of WVS focuses on providing a comprehensive solution to anyone wanting to make their online presence a safe one. Acunetix WVS 8′s high performance scanning engine provides even more accurate exploit detection, and coupled with the new automation enhancements securing a web application has never been easier. WVS 8 makes it clear why Acunetix is the number one choice for companies to audit and secure their websites.”

Features At a Glance:- 

* Manipulation of inputs from URLs:
Acunetix WVS can automatically identify URL parameters and manipulate them to detect vulnerabilities. This technology is not present in any other competing vulnerability scanner.
Replace manual intervention with scanner intelligence
* Automatic custom 404 error page identification:
Acunetix WVS 8 can automatically determine if a custom error page is in use, and recognizes it without needing any recognition patterns to be configured before the scan.
Interpret IIS 7 rewrite rules automatically
Using the web application’s web.config file, WVS 8 can automatically interpret rewrite rules without requiring any manual input.
Fix vulnerabilities while locking hackers out
* Imperva Web Application Firewall integration:
An exciting co-operation between Imperva and Acunetix; WVS 8 scan results can be imported into an Imperva Web Application Firewall and interpreted automatically as firewall rules.
Use WVS 8 as a true security scanning workhorse
* Multiple instance support:
Acunetix WVS 8 can be relaunched as multiple instances on the same machine, allowing the user to scan multiple websites enabling further support for multi-user scenarios on the same server/workstation.
Re-scan without re-configuring
* Scan settings templates:
WVS 8 can save the settings for the scan of a specific application as a template, making it quick and easy to recall those exact settings for the same application each time it is scanned. This is particularly useful when auditing multiple sites, enabling the user to load the template for each site instead of re-configuring everything manually.
Launch a scan quicker than before
* Simplified Scan Wizard:
In addition to the introduction of Scan Settings Templates and automatic custom 404 error page recognition, the Scan Wizard contains far less options so it’s much easier and quicker to kick off a scan.
Access your results from anywhere and everywhere
* Web-based scheduler:
Accessible via a web interface, the new Scheduler allows administrators to download scan results from any workstation, laptop, or smartphone. The new Scheduler will automatically launch another instance of WVS when multiple web scans are due, preventing multiple processes from depending on the resources of one WVS instance, and thereby allowing scans to complete in less time.
Identify threats unseen by other black-box scanners
* New HTTP Parameter Pollution vulnerability class:
At the time of writing, Acunetix WVS 8 is the only scanner that tests for this security vulnerability.
Ensure complex scans will complete automatically and successfully
* Smart memory management:
The following settings have been added to optimise scanning efficiency:
Define number of files per directory
Limit number of subdirectories per website
Assign Crawler memory limit

Other New Features:-

• Real time Crawler status (number of crawled files, inputs discovered, etc.)
• Support for custom HTTP headers in automated scans
• Configurable log file retention
• Detailed Crawler coverage report
• Scan status included in report

To Download Acunetix Web Vulnerability Scanner v8 Click Here

Read More

DPScan : Drupal Security Scanner Released

DP Scan : Drupal Security Scanner Released

The First Security scanner for Drupal CMS has been released by Ali Elouafiq, on his Blog. His team develop a tool that will enumerate at least the modules used by Drupal so we can simulate a White Box audit on our private machines.

This small tool is public and accessible to you for use however you please. It may help other auditors or penetration testers do their job faster, Here is a little demonstration. After downloading the script (in python), you simply type:

> python DPScan.py [website url]

You can download Drupal Security Scanner here.

Read More