ToolWar | Information Security (InfoSec) Tools: Analysis

Nmap and Zenmap (Network Discovery and Security Auditing) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="nmap scanner logo" border="0" height="210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPn1QPXq_tY_zK1uLIjY-6fyXimOMxgo3rq52s-03wGFIiM3FEUXb1R_uZpS2QvMEucVny6EK7w0eYYGJ5JKDgUtasnKL7WqkAIA5QMKqB05XXAv_va-hOLNd2wlIHxv1cUDpxCVa4kxbF/s1600/nmap.jpg" title="nmap scanner logo" width="400" /></div>
</div>
<div style="text-align: justify;">
<b>Nmap ("Network Mapper")</b> is a free and open source (license) utility for <b>network discovery and security auditing.</b> Many systems and network administrators also find it useful for tasks such as <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> inventory, managing service upgrade schedules, and <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">monitoring</a> host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of <a href="http://www.toolwar.com/search/label/Packet" target="_blank">packet</a> filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>, and <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X</a>. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced <a href="http://www.toolwar.com/search/label/GUI" target="_blank">GUI</a> and results viewer <b>(Zenmap)</b>, a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis tool</a> (Nping).<br />
<br />
<b>Nmap</b> was named “<a href="http://www.toolwar.com/search/label/Security" target="_blank">Security</a> Product of the Year” by Linux Journal, Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in twelve movies, including The Matrix Reloaded, Die Hard 4, Girl With the Dragon Tattoo, and The Bourne Ultimatum.<br />
<br />
<b>Nmap is::</b></div>
<ul style="text-align: justify;">
<li>    Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, <a href="http://www.toolwar.com/search/label/IDS" target="_blank">firewalls</a>, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), <b>OS detection</b>, version detection, ping sweeps, and more. See the documentation page.</li>
<li>    Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.</li>
<li>    Portable: Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more.</li>
<li>    Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -v -A targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.</li>
<li>    Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the license.</li>
<li>    Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, tutorials, and even a whole book! Find them in multiple languages here.</li>
<li>    Supported: While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the Nmap mailing lists. Most bug reports and questions should be sent to the nmap-dev list, but only after you read the guidelines. We recommend that all users subscribe to the low-traffic nmap-hackers announcement list. You can also find Nmap on Facebook and Twitter. For real-time chat, join the #nmap channel on Freenode or EFNet.</li>
<li>    Acclaimed: <b>Nmap</b> has won numerous awards, including "Information Security Product of the Year" by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the press page for further details.</li>
<li>    Popular: Thousands of people download <b>Nmap</b> every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities. </li>
</ul>
<h3>
Tutorials ::</h3>
<b>Tutorial (Max OS X) :: </b><a href="http://nmap.org/book/inst-macosx.html#inst-macosx-source">Click Here</a><br />
<b>Tutorial (Windows) :: </b><a href="http://nmap.org/book/inst-windows.html#inst-win-source">Click Here</a> <b><br />
</b><br />
<b>Tutorial (Linux) ::</b> <a href="http://nmap.org/book/inst-source.html">Click Here</a><br />
<b>Installation :: </b><a href="http://nmap.org/book/install.html" target="_blank">Click Here</a>   <br />
<b>Tutorials From Basics :: </b><a href="http://nmap.org/bennieston-tutorial/">Click Here </a><br />
<b>Video Tutorial :: </b><br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/RJxF7puQFXI?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<b> </b>
<br />
<h3>
Download ::</h3>
<h3>
</h3>
<b>Download ZenMap (GUI of Nmap) :: </b><a href="http://nmap.org/zenmap/">Click Here</a><b> </b><br />
<b>Windows :: </b><a href="http://nmap.org/dist/nmap-6.40-setup.exe">Nmap-Latest</a> (.exe)
<b> </b><br />
<b>Linux :: </b><a href="http://nmap.org/dist/nmap-6.40.tar.bz2">Nmap Latest</a> (.tar.bz2)<b> </b><br />
<b>Mac :: </b><a href="http://nmap.org/dist/nmap-6.40-2.dmg">Nmap Latest</a> (.dmg)<b> </b>
<b>  </b><br />
<b>Official Website ::</b> <a href="http://nmap.org/">http://nmap.org/</a>
<br />
<div style="text-align: justify;">
</div>

Nmap and Zenmap (Network Discovery and Security Auditing) :: Tools

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many syste...

SARA (Security Auditor's Research Assistant) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="SARA - Security Auditor's Research Assistant" border="0" height="328" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTrFtEfewv2qJbhJrO35NMjPReB75buAjazNxPAGzn_8ewu8Kl2MR6bqR7jOcWgPl2nauo85Ttm13awIkk-HKsG3RzQwwaqJLguI0HYkFQBNeOqERU6aVXWY7Iloxk6dJPbufNj51Rz3NM/s1600/network-security-tips.jpg" title="SARA - Security Auditor's Research Assistant" width="640" /></div>
<div style="text-align: justify;">
The <b>Security Auditor's Research Assistant (SARA)</b> is a third generation <b>network security analysis tool</b> that that has been available and actively updated for over 10 years. Sadly, all good things have to come to an end and so it goes for SARA. <b>SARA 7.9.1</b> is our last release.(1 May 2009) Actually, SARA-7.9.2a is the final release (1 August 2009).<br /><br />SARA:</div>
<ol style="text-align: justify;">
<li>    Operates under Unix, <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, <a href="http://www.toolwar.com/search/label/Mac" target="_blank">MAC OS/X</a> or <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> (through coLinux) OS'.</li>
<li>    Integrates the National Vulnerability Database (NVD).</li>
<li>    Performs SQL injection tests.</li>
<li>    Performs exhaustive XSS tests</li>
<li>    Can adapt to many firewalled environments.</li>
<li>    Support remote self scan and API facilities.</li>
<li>    Used for CIS benchmark initiatives</li>
<li>    Plug-in facility for third party apps</li>
<li>    CVE standards support</li>
<li>    Enterprise search module</li>
<li>    Standalone or daemon mode</li>
<li>    Free-use open SATAN oriented license</li>
</ol>
<div style="text-align: justify;">
The first generation assistant, the Security Administrator's Tool for Analyzing <a href="http://www.toolwar.com/search/label/Network" target="_blank">Networks</a> (SATAN) was developed in early 1995. It became the benchmark for <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">network security analysis</a> for several years. However, few updates were provided and the tool slowly became obsolete in the growing threat environment. <br /><br /><h3>
Tutorials ::</h3>
<b><span style="font-size: small;">Installation ::</span></b> <span style="font-weight: normal;"><a href="http://www-arc.com/sara/cosara/index.shtml" target="_blank">Click Here</a></span><br />
<h3>
Download ::</h3>
<b>Windows :: </b><a href="http://www-arc.com/sara/downloads/cosara/cosara-7.4.1.exe" target="_blank">coSARA v7.4.1</a> (.exe)<b><br />Linux :: </b><a href="http://www-arc.com/sara/downloads/sara-7.9.2a.tgz" target="_blank">SARA v7.9.2a</a> (.tar.gz)<b><br />Official Website :: </b><a href="http://www-arc.com/sara/">http://www-arc.com/sara/</a><br /><br /></div>

SARA (Security Auditor's Research Assistant) :: Tools

The Security Auditor's Research Assistant (SARA) is a third generation network security analysis tool that that has been available ...

ACE (Telephony Analysis) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWLRvwL7u17Q85XO9IPzEMIVsSg9m8CoZRlKLo-f6NhIRybAW0vQo3-YLRAXw_xVs3yOaaI3CQClkkVlDjbGbvYks6TS9rXYckfQzKMuMOSTC0JF9EmfHYq9swqpI1cBXSTCePFuQDtCaG/s1600/VoIP+Phones.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="304" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWLRvwL7u17Q85XO9IPzEMIVsSg9m8CoZRlKLo-f6NhIRybAW0vQo3-YLRAXw_xVs3yOaaI3CQClkkVlDjbGbvYks6TS9rXYckfQzKMuMOSTC0JF9EmfHYq9swqpI1cBXSTCePFuQDtCaG/s1600/VoIP+Phones.jpg" width="640" /></a></div>
<div style="text-align: justify;">
<b>ACE (Automated Corporate Enumerator)</b> is a simple yet  powerful <b><a href="http://www.toolwar.com/search/label/VOIP" target="_blank">VoIP</a> Corporate Directory enumeration tool</b> that mimics the  behavior of an IP Phone in order to download the name and extension  entries that a given phone can display on its screen interface.  In the  same way that the "corporate directory" feature of VoIP hardphones  enables users to easily dial by name via their VoIP handsets, ACE was  developed as a research idea born from <b>"VoIP Hopper"</b> to automate VoIP  <a href="http://www.toolwar.com/search/label/Attack" target="_blank">attacks</a> that can be targeted against names in an enterprise Directory.   The concept is that in the future, attacks will be carried out against  users based on their name, rather than targeting VoIP traffic against  random RTP audio streams or IP addresses.  ACE works by using DHCP,  TFTP, and HTTP in order to download the VoIP corporate directory.  It  then outputs the directory to a text file, which can be used as input to  other VoIP assessment tools. <b> ACE is a standalone utility,</b> but its  functions are integrated into UCSniff.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Features ::</b></div>
<div style="text-align: justify;">
ACE currently supports the VoIP corporate directory used in Cisco Unified IP Phones.  It works in the following way:</div>
<ul style="text-align: justify;">
<li>Spoofs CDP to get VVID</li>
<li>Adds Voice VLAN Interface (VLAN Hop) - subsequent traffic is tagged with VVID</li>
<li>Sends DHCP request tagged with VVID</li>
<li>Decodes TFTP Server IP Address via DHCP Option 150</li>
<li>Sends a TFTP request for IP Phone configuration file</li>
<li>Parses file, learning Corporate Directory URL</li>
<li>Sends an HTTP GET request for Directory</li>
<li>Parses XML Data, writing directory users to a formatted text file</li>
</ul>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>Usages :: </b></div>
<div style="text-align: justify;">
ACE can be used in one of two ways. First, it can auto-discover the TFTP Server IP Address via DHCP, or (second) the user can specify the TFTP Server IP address as a command line parameter of the tool. In either case, you must supply the MAC Address of the IP Phone with the -m option in order for the tool to correctly download the configuration file via TFTP.<br />ACE v1.0: Automated Corporate (Data) Enumerator<br />Usage: ace [-i interface] [ -m mac address ] [ -t tftp server ip address | -c cdp mode | -v voice vlan id | -r vlan interface | -d verbose mode ]<br /><br />-i (Mandatory) Interface for sniffing/sending packets<br />-m (Mandatory) MAC address of the victim IP phone<br />-t (Optional) tftp server ip address<br />-c (Optional) 0 CDP sniff mode, 1 CDP spoof mode<br />-v (Optional) Enter the voice vlan ID<br />-r (Optional) Removes the VLAN interface<br />-d (Optional) Verbose | debug mode<br /><br />Example Usages:<br />Usage requires MAC Address of IP Phone supplied with -m option<br />Usage: <span style="font-family: "Courier New",Courier,monospace;">ace -t -m</span><br /><br />Mode to automatically discover TFTP Server IP via DHCP Option 150 (-m)<br />Example: <span style="font-family: "Courier New",Courier,monospace;">ace -i eth0 -m 00:1E:F7:28:9C:8e</span><br /><br />Mode to specify IP Address of TFTP Server<br />Example: <span style="font-family: "Courier New",Courier,monospace;">ace -i eth0 -t 192.168.10.150 -m 00:1E:F7:28:9C:8e</span><br /><br />Mode to specify the Voice VLAN ID<br />Example: <span style="font-family: "Courier New",Courier,monospace;">ace -i eth0 -v 96 -m 00:1E:F7:28:9C:8E</span><br /><br />Verbose mode<br />Example: <span style="font-family: "Courier New",Courier,monospace;">ace -i eth0 -v 96 -m 00:1E:F7:28:9C:8E -d</span><br /><br />Mode to remove vlan interface<br />Example: <span style="font-family: "Courier New",Courier,monospace;">ace -r eth0.96</span><br /><br />Mode to auto-discover voice vlan ID in the listening mode for CDP<br />Example: <span style="font-family: "Courier New",Courier,monospace;">ace -i eth0 -c 0 -m 00:1E:F7:28:9C:8E</span><br /><br />Mode to auto-discover voice vlan ID in the spoofing mode for CDP<br />Example: <span style="font-family: "Courier New",Courier,monospace;">ace -i eth0 -c 1 -m 00:1E:F7:28:9C:8E</span></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://sourceforge.net/projects/ucsniff/files/ace/ace-1.10.tar.gz/download" target="_blank">ACE v1.10</a> (.tar.gz)<b><br />
</b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://ucsniff.sourceforge.net/ace.html">http://ucsniff.sourceforge.net/ace.html</a></div>

ACE (Telephony Analysis) :: Tools

ACE (Automated Corporate Enumerator) is a simple yet powerful VoIP Corporate Directory enumeration tool that mimics the behavior of ...

FruityWiFi (Wireless Auditing) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="FruityWiFi Screenshot" border="0" height="311" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1JHrHssrXvjVxrIiXhQ2a_6Nw0cQ6Io_oxLac-3nYxXA0ztQBVccfe8XxahD3MDwUa0nN_AyCnTwyNYqRew1esXzke6jIE0oEZJ9-UqWX7VbnNqecm1eywx_ksuFf4SRuUs0ISrTb68ij/s320/FruityWiFi+Screenshot.JPG" title="FruityWiFi Screenshot" width="320" /></div>
<div style="text-align: justify;">
<b>FruityWifi</b> is a <i>wireless network auditing tool</i> based in the <a href="http://www.toolwar.com/search/label/WiFi" target="_blank">wifi</a> 
Pineapple. The application can be installed in any Debian based system 
adding the extra packages. Tested in Debian, <a href="http://www.toolwar.com/2013/09/kali-linux-toolwar.html" target="_blank">Kali Linux</a>, Kali Linux ARM 
(Raspberry Pi), Raspbian (Raspberry Pi), Pwnpi (Raspberry Pi).</div>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div style="text-align: justify;">
<b> Wiki :: </b><a href="https://github.com/xtr4nge/FruityWifi/wiki" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="https://github.com/xtr4nge/FruityWifi/archive/master.zip" target="_blank">FruityWiFi</a></div>

FruityWiFi (Wireless Auditing) :: Tools

FruityWifi is a wireless network auditing tool based in the wifi Pineapple. The application can be installed in any Debian based syst...

Autopsy (Digital Investigation Analysis) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Autopsy logo" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjf21td83eNESL_QTE9NjV-ZSQnqexy4JbWFatUW-4KkqydKjwnSYKqQmPFBy6cnZG7rQZEG7X211P1v_klRTAzd3_Ee5pDqpYn3sfpupP4ff-ao6WwTUaeq8fqKi0PgJQiwb-loD4CvqrI/s1600/autopsy+logo.jpg" title="Autopsy logo" width="200" /></div>
<div style="text-align: justify;">
<b>Autopsy</b> is a graphical interface to the <a href="http://www.toolwar.com/search/label/CLI" target="_blank"><i>command line</i></a> <b>digital investigation analysis tools</b> in <a href="http://www.toolwar.com/2014/01/the-sleuth-kit-tsk-forensics-framework.html" target="_blank"> The Sleuth Kit</a>. Together, they can analyze <i>Windows and UNIX</i> disks and file systems (NTFS, FAT, UFS1/2, Ext2/3).</div>
<div style="text-align: justify;">
<b>The Sleuth Kit </b>and <b>Autopsy</b> are both Open Source and run on UNIX platforms (you can use Cygwin to run them both on <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>). As <b>Autopsy</b> is HTML-based, you can connect to the <b>Autopsy</b> server from any platform using an HTML browser. Autopsy provides a "File Manager"-like interface and shows details about deleted data and file system structures.</div>
<h3 style="text-align: justify;">
<span style="font-size: small;">Analysis Modes</span></h3>
<ul style="text-align: justify;">
<li>A <b>dead analysis</b> occurs when a dedicated <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a> system is used to examine the data from a suspect system. In this case, <b>Autopsy</b> and The Sleuth Kit are run in a trusted environment, typically in a lab. Autopsy and TSK support raw, Expert Witness, and AFF file formats. </li>
<li>A <b>live analysis</b> occurs when the suspect <a href="http://www.toolwar.com/search/label/System" target="_blank">system</a> is being analyzed while it is running. In this case, <b>Autopsy</b> and The Sleuth Kit are run from a CD in an untrusted environment. This is frequently used during incident response while the incident is being confirmed. After it is confirmed, the system can be acquired and a dead analysis performed. </li>
</ul>
<h3 style="text-align: justify;">
Evidence Search Techniques</h3>
<ul style="text-align: justify;">
<li><b>File Listing</b>: Analyze the files and directories, including the names of deleted files and files with Unicode-based names.</li>
<li><b>File Content</b>: The contents of files can be viewed in raw, hex, or the ASCII strings can be extracted. When data is interpreted, Autopsy sanitizes it to prevent damage to the local analysis system. Autopsy does not use any client-side scripting languages.</li>
<li><b>Hash Databases</b>: Lookup unknown files in a <a href="http://www.toolwar.com/search/label/Hash" target="_blank">hash</a> database to quickly identify it as good or bad. Autopsy uses the NIST <i>National Software Reference Library (NSRL)</i> and user created databases of known good and known bad files </li>
<li><b>File Type Sorting</b>: Sort the files based on their internal signatures to identify files of a known type. Autopsy can also extract only graphic images (including thumbnails). The extension of the file will also be compared to the file type to identify files that may have had their extension changed to hide them.</li>
<li><b>Timeline of File Activity</b>: In some cases, having a timeline of file activity can help identify areas of a file system that may contain evidence. Autopsy can create timelines that contain entries for the Modified, Access, and Change (MAC) times of both allocated and unallocated files.</li>
<li><b>Keyword Search</b>: Keyword searches of the file system image can be performed using ASCII strings and grep regular expressions. Searches can be performed on either the full file system image or just the unallocated space. An index file can be created for faster searches. Strings that are frequently searched for can be easily configured into Autopsy for automated searching. </li>
<li><b>Meta Data Analysis</b>: Meta Data structures contain the details about files and directories. Autopsy allows you to view the details of any meta data structure in the file system. This is useful for recovering deleted content. Autopsy will search the directories to identify the full path of the file that has allocated the structure.</li>
<li><b>Data Unit Analysis</b>: Data Units are where the file content is stored. Autopsy allows you to view the contents of any data unit in a variety of formats including ASCII, hexdump, and strings. The file type is also given and Autopsy will search the meta data structures to identify which has allocated the data unit. </li>
<li><b>Image Details</b>: File system details can be viewed, including on-disk layout and times of activity. This mode provides information that is useful during data recovery. </li>
</ul>
<h3 style="text-align: justify;">
Case Management</h3>
<ul style="text-align: justify;">
<li><b>Case Management</b>: Investigations are organized by <i>cases</i>, which can contain one or more <i>hosts</i>. Each host is configured to have its own time zone setting and clock skew so that the times shown are the same as the original user would have seen. Each host can contain one or more file system images to analyze. </li>
<li><b>Event Sequencer</b>: Time-based events can be added from file activity or IDS and firewall logs. Autopsy sorts the events so that the sequence of incident events can be more easily determined. </li>
<li><b>Notes</b>: Notes can be saved on a per-host and per-investigator basis. These allow you to make quick notes about files and structures. The original location can be easily recalled with the click of a button when the notes are later reviewed. All notes are stored in an ASCII file. </li>
<li><b>Image Integrity</b>: It is crucial to ensure that files are not modified during analysis. Autopsy, by default, will generate an MD5 value for all files that are imported or created. The integrity of any file that Autopsy uses can be validated at any time. </li>
<li><b>Reports</b>: Autopsy can create ASCII reports for files and other file system structures. This enables you to quickly make consistent data sheets during the investigation.</li>
<li><b>Logging</b>: Audit logs are created on a case, host, and investigator level so that actions can be easily recalled. The exact Sleuth Kit commands that are executed are also logged.</li>
<li><b>Open Design</b>: The code of Autopsy is open source and all files that it uses are in a raw format. All configuration files are in ASCII text and cases are organized by directories. This makes it easy to export the data and archive it. It also does not restrict you from using other tools that may solve the specific problem more appropriately.</li>
<li><b>Client Server Model</b>: Autopsy is HTML-based and therefore you do not have to be on the same system as the file system images. This allows multiple investigators to use the same server and connect from their personal systems.</li>
</ul>
<div style="text-align: justify;">
<b>Autopsy</b> is written in <a href="http://www.toolwar.com/2013/09/perl-language.html" target="_blank">Perl</a> and runs on the same UNIX platforms as <a href="http://www.toolwar.com/2014/01/the-sleuth-kit-tsk-forensics-framework.html" target="_blank">The Sleuth Kit</a>:</div>
<ul style="text-align: justify;">
<li><a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a></li>
<li><a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X</a></li>
<li>Open & FreeBSD</li>
<li>Solaris</li>
<li>Cygwin (you cannot use the win32 executables that can be downloaded from this site, you must build in Cygwin) </li>
</ul>
<h3>
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/RUgmkvt2WNg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
 </h3>
<h3>
Download ::</h3>
<b>Windows :: </b><a href="http://sourceforge.net/projects/autopsy/files/autopsy/3.0.8/autopsy-3.0.8-32bit.msi/download" target="_blank">Autopsy 3.0.8x32</a> (.msi) | <a href="http://sourceforge.net/projects/autopsy/files/autopsy/3.0.8/autopsy-3.0.8-64bit.msi/download" target="_blank">Autopsy 3.0.8x64</a> (.msi)<br />
<b>Linux :: </b><a href="http://sourceforge.net/projects/autopsy/files/autopsy/2.24/autopsy-2.24.tar.gz/download" target="_blank">Autopsy 2.08</a> (.tar.gz)<br />
<b>Official Website :: </b><a href="http://www.sleuthkit.org/autopsy/index.php" target="_blank">http://www.sleuthkit.org/autopsy/index.php </a>

Autopsy (Digital Investigation Analysis) :: Tools

Autopsy is a graphical interface to the command line digital investigation analysis tools in The Sleuth Kit . Together, they can anal...

MobiSec (Mobile Penetration Testing) :: Distribution

<div class="separator" style="clear: both; text-align: center;">
<img alt="MobiSec Logo" border="0" height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjW59x4V_GWksXI63xJZsmQMOSfrNW-Ii9BKcCHQs0KpNexigf5nqIW5Pt5JcSmZpM7Uxe08zCrygo5pOcxAKd1lXE3ahraIJm1PGjx0zhX1wk_aVJwBdE77smzaA_kljI8pBqlY8MP4d_L/s1600/MobiSec+Logo.jpg" title="MobiSec Logo" width="400" /></div>
<div style="text-align: justify;">
The <b>MobiSec</b> Live Environment <b>Mobile Testing open source project</b> is a live     environment for testing <a href="http://www.toolwar.com/search/label/Phone" target="_blank">mobile</a> environments, including devices, applications, and     supporting infrastructure. The purpose is to provide attackers and defenders the     ability to test their mobile environments to identify design weaknesses and     vulnerabilities.</div>
<div style="text-align: justify;">
<b>MobiSec</b> provides a single environment for testers to leverage the best of all     available open source <a href="http://www.toolwar.com/search/label/Phone" target="_blank">mobile testing tools</a>, as well as the ability to install     additional <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a> and platforms, that will aid the penetration tester through the     testing process as the environment is structured and organized based on an     industry-proven testing <a href="http://www.toolwar.com/search/label/Frameworks" target="_blank">framework</a>. Using a live environment provides penetration     testers the ability to boot the <b>MobiSec</b> Live Environment on any Intel-based system     from a DVD or USB flash drive, or run the test environment within a virtual machine.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>MobiSec</b> is a <b>bootable Linux distribution</b> that penetration testers,  ethical hackers, and other information <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> pros can use to evaluate  and analyze mobile devices, applications, and supporting  infrastructures. Created by <b>SecureIdeas</b>, the <b>MobiSec framework</b> lets you  test mobile environments to identify design weaknesses and  vulnerabilities, all with the goal of improving security. Instead of you  having to download countless tools, install them in your own  environment, and then troubleshoot interoperability issues, the <b>MobiSec</b>  team has done all of that work for you, pulling together best-of-breed  free tools for mobile device and infrastructure <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a> into one handy  distribution.</div>
<div style="text-align: justify;">
The <b>MobiSec</b> Live Environment includes the following capabilities:</div>
<ul style="text-align: justify;">
<li>Creates a single environment for testers to leverage the best of all available open source mobile testing tools</li>
<li>Allows installation of additional tools and platforms</li>
<li>Assists the penetration tester throughout the testing process as  the environment is structured and organized based on an industry-proven  testing framework</li>
<li>Provides penetration testers the ability to boot the MobiSec Live  Environment on any x86- or x64-based system from a DVD or <a href="http://www.toolwar.com/search/label/USB" target="_blank">USB flash  drive</a>, or run the test environment within a <a href="http://www.toolwar.com/search/label/Virtual" target="_blank">virtual machine</a></li>
</ul>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/n1GlXOvBuqg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://sourceforge.net/projects/mobisec/files/latest/download" target="_blank">MobiSec 1.1</a> (.iso)</div>
<div style="text-align: justify;">
<b>Official Website :: </b>http://mobisec.professionallyevil.com/</div>

MobiSec (Mobile Penetration Testing) :: Distribution

The MobiSec Live Environment Mobile Testing open source project is a live environment for testing mobile environments, including d...

iPhone Analyzer :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="iphone analysis" border="0" height="265" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyVrxfsAbT1zhDHt5nIp-4u2AZSwoZbbGPfy91RQmjyHX4TU-0qcH4M5fHpd1PuEVma0RI6zVJLki1tJcwrYoHZ3x9BTvqnrE-LvuJsFDLDqOG_K8IX0B0eufoAkJj5cB1qEqlO8f79Kjw/s1600/iphone+analysis.jpg" title="iphone analysis" width="400" /></div>
</div>
<div style="text-align: justify;">
<b>iPhone Analzyer</b> allows you to <i>forensically examine or recover date from 
in iOS device</i>. It principally works by <i>importing backups</i> produced by 
iTunes or third party software, and providing you with a rich interface 
to explore, <i><a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyse</a> and recover data</i> in human readable formats. Because 
it works from the backup files everything is <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensically</a> safe, and no 
changes are made to the original data.</div>
<h3 style="text-align: justify;">
<span style="font-size: small;">Features ::</span></h3>
<ul style="text-align: justify;">
<li>Supports iOS 2, iOS 3, iOS 4 and iOS 5 devices</li>
<li>Multi-platform (<a href="http://www.toolwar.com/search/label/Java" target="_blank">Java</a> based) product, supported on <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> and <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac</a></li>
<li>Fast, powerful search across device including regular expressions</li>
<li>Integrated mapping supports visualisation of geo-tagged information,
 including google maps searches, photos, and cell-sites and <a href="http://www.toolwar.com/search/label/WiFi" target="_blank">wifi</a> 
locations observed by the device (the infamous "locationd" data)</li>
<li>Integrated support for text messages, voicemail, address book 
entries, photos (including metadata), call records and many many others</li>
<li>Recovery of "deleted" sqlite records (records that have been tagged 
as deleted, but have not yet been purged by the device can often be 
recovered),/li>
</li>
<li>Integrated visualisation of plist and sqlite files</li>
<li>Includes support for off-line mapping, supporting mapping on computers not connected to the Internet</li>
<li>Support for KML export and direct export to Google Earth</li>
<li>Browse the device file structure, navigate directly to key files or 
explore the device using concepts such as "who", "when", "what" and 
"where".</li>
<li>Analyse jail broken device directly over SSH without need for backup (experimental)</li>
<li class="feature">iPhone Backup Browsing</li>
<li class="feature">Native file viewing (plist, sqlite, etc)</li>
<li class="feature">Searching including regular expressions</li>
<li class="feature">ssh access for <a href="http://www.toolwar.com/search/label/Jailbreak" target="_blank">jailbroken</a> phones (beta)</li>
<li class="feature">Reports</li>
<li class="feature">Restore files</li>
<li class="feature">Recover backups</li>
<li class="feature">View all iPhone photos</li>
<li class="feature">examine address book, sms and loads of others</li>
<li class="feature">find and recover passwords</li>
<li class="feature">Export files to local filesytem </li>
<li class="feature"><a href="http://www.toolwar.com/search/label/Online" target="_blank">Online</a> and offline mapping</li>
<li class="feature">Geo track where a device has been</li>
<li class="feature">IOS5 and earlier versions supported</li>
<li class="feature">IOS6 is only partially supported (several known problems) </li>
</ul>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>User Manual (PDF) ::</b><a href="http://www.crypticbit.com/files/ipa_user_guide.pdf" target="_blank"> Click Here </a></div>
<h3 style="text-align: justify;">
Download ::  </h3>
<div style="text-align: justify;">
<b>JAR :: </b><a href="http://sourceforge.net/projects/iphoneanalyzer/files/latest/download" target="_blank">iPhone Analyzer (.jar)</a></div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.crypticbit.com/zen/products/iphoneanalyzer">http://www.crypticbit.com/zen/products/iphoneanalyzer</a></div>

iPhone Analyzer :: Tools

iPhone Analzyer allows you to forensically examine or recover date from in iOS device . It principally works by importing backups pr...

RegistryDecoder (Windows Registry Forensics) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="registrydecoder icon" border="0" height="261" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMIhBRUMLX-a4LG7hoynF82A7nZ5ngAu4onGUOBohjYbLn-IK4dmej-52Gm9WbEUW3G_GW8-L8FWNEUG7vINlaxS0WNP8AiLqL_PFc5P8OfHcpf-3A5H4yMIdRnaZIx6-GlK3wDOKDOHhm/s1600/registrydecoder.png" title="registrydecoder icon" width="400" /></div>
<span itemprop="description" style="font-size: small;"><b>RegistryDecoder</b> is a automated <i>Acquisition, Analysis, and Reporting of Registry</i> Contents</span><span style="font-size: small;">. <b>Registry Decoder</b> provides a single tool in which to perform <i>browsing,
 searching, <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a>, and reporting of <a href="http://www.toolwar.com/search/label/Registry" target="_blank">registry</a> hive</i> contents. All 
functionality is exposed through an intuitive <a href="http://www.toolwar.com/search/label/GUI" target="_blank">GUI</a> interface and 
accommodates even novice investigators. <b>Registry Decoder</b> also acts as a great resource for new research and experimenting within the registry.</span><br />
<div style="text-align: justify;">
<span style="font-size: small;"><b>Digital <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a></b> deals with the analysis of artifacts on all types of 
digital devices. One of the most prevalent analysis techniques performed
 is that of the registry hives contained in Microsoft <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> operating 
systems. <b> Registry Decoder</b> was developed with the purpose of providing a
 single <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tool</a> for the acquisition, analysis, and reporting of registry 
contents.</span></div>
<div class="MsoNormal" style="text-align: justify;">
<span style="font-family: "Times New Roman","serif"; font-size: small; line-height: 115%;"><b>Registry
 Decoder</b> consists of two components, the first of which is a tool for 
<a href="http://www.toolwar.com/search/label/Online" target="_blank">online</a> acquisition of registry files from a running machine.
 To safely acquire files from a running machine, we ‘freeze’ a copy of 
the current registry files using the System Restore Facility. This 
places the files into a read-only location and ensures that the 
operating system will not have the files opened (which would prevent 
them from being copied to external storage).</span></div>
<div class="MsoNormal" style="text-align: justify;">
<span style="font-family: "Times New Roman","serif"; font-size: small; line-height: 115%;">Beyond
 the current set of registry files, the acquisition component can also 
acquire historical files from the running system. These historical files
 are acquired from XP machines through the <a href="http://www.toolwar.com/search/label/System" target="_blank">System </a>Restore Point facility
 and through the Volume Shadow Service on Vista and Windows 7 machines.</span></div>
<div style="text-align: justify;">
<span style="font-size: small;"><br /></span></div>
<div class="MsoNormal" style="text-align: justify;">
<span style="font-family: "Times New Roman","serif"; font-size: small; line-height: 115%;">The
 analysis section of the offline component contains a number of powerful
 features. The first feature is Search, which allows for powerful 
searching across <a href="http://www.toolwar.com/search/label/Registry" target="_blank">registry</a> hives. The searching abilities include:</span></div>
<div class="MsoNormal" style="text-align: justify;">
<br /></div>
<ul style="text-align: justify;">
<li><span style="font-family: Symbol; font-size: 12pt; line-height: 115%;"><span style="font: 7pt "Times New Roman";"> </span></span><span style="font-family: "Times New Roman","serif"; font-size: 12pt; line-height: 115%;">Filtering by hive keys, name, and data</span></li>
<li><span style="font-family: Symbol; font-size: 12pt; line-height: 115%;"><span style="font: 7pt "Times New Roman";"> </span></span><span style="font-family: "Times New Roman","serif"; font-size: 12pt; line-height: 115%;">Filtering by the last write time of keys</span></li>
<li><span style="font-family: Symbol; font-size: 12pt; line-height: 115%;"><span style="font: 7pt "Times New Roman";"> </span></span><span style="font-family: "Times New Roman","serif"; font-size: 12pt; line-height: 115%;">Searching individual terms or with a newline delimited search term file</span></li>
<li><span style="font-family: Symbol; font-size: 12pt; line-height: 115%;"><span style="font: 7pt "Times New Roman";"> </span></span><span style="font-family: "Times New Roman","serif"; font-size: 12pt; line-height: 115%;">Exact or wildcard based search</span><span style="font-family: Symbol; font-size: 12pt; line-height: 115%;"><span style="font: 7pt "Times New Roman";"> </span></span></li>
<li><span style="font-family: Symbol; font-size: 12pt; line-height: 115%;"><span style="font: 7pt "Times New Roman";"> </span></span><span style="font-family: "Times New Roman","serif"; font-size: 12pt; line-height: 115%;">Viewing of search results</span></li>
<li><span style="font-family: Symbol; font-size: 12pt; line-height: 115%;"><span style="font: 7pt "Times New Roman";"> </span></span><span style="font-family: "Times New Roman","serif"; font-size: 12pt; line-height: 115%;">Automated reporting of search contents to HTML, PDF, or XLS</span></li>
</ul>
<br />
<h3>
Tutorials ::</h3>
<b>Text Tutorial (PDF) :: </b><a href="http://registrydecoder.googlecode.com/files/RegistryDecoder-Offline-Analysis-Instructions-v1.1.pdf" target="_blank">Click Here </a><br />
<b>FAQ ::</b> <a href="http://code.google.com/p/registrydecoder/wiki/FAQ" target="_blank">Click Here </a><br />
<br />
<h3>
Download ::</h3>
<b>Windows :: </b><a href="http://registrydecoder.googlecode.com/files/regedcoderR103.zip" target="_blank">RegistryDecoder (.zip)</a><b><br /></b><br />
<b>Official Website :: </b><a href="http://www.registrydecoder.com/">http://www.registrydecoder.com/</a><b><br /></b>

RegistryDecoder (Windows Registry Forensics) :: Tools

RegistryDecoder is a automated Acquisition, Analysis, and Reporting of Registry Contents . Registry Decoder provides a single tool in w...

DumpIt (Memory Dumper) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhl1bY2gWBxFbDW6zcu5qqN5pd8LX2USAWKhJjUlLmtBS1KoN1FMMaR3s8W1oHCYpWEuPHEbHidQAWflYj5GdkPp4Q-pEW29n_qEHr12TYWvtkt0W84JFga96n0xFyymp6wnhs0Bt6O4A0a/s1600/System-Memory-icon.png" style="margin-left: 1em; margin-right: 1em;"><img alt="dumpit icon" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhl1bY2gWBxFbDW6zcu5qqN5pd8LX2USAWKhJjUlLmtBS1KoN1FMMaR3s8W1oHCYpWEuPHEbHidQAWflYj5GdkPp4Q-pEW29n_qEHr12TYWvtkt0W84JFga96n0xFyymp6wnhs0Bt6O4A0a/s1600/System-Memory-icon.png" title="dumpit icon" /></a></div>
<br />
<b>DumpIt</b> is a fusion of two trusted <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a>, win32dd and win64dd, combined  into one one executable. <b>DumpIt</b> is designed to be provided to a  non-technical user using a removable USB drive. The person needs to  simply double-click the <b>DumpIt</b> executable and allow the tool to run. <b> DumpIt</b> will then take the snapshot of the host’s physical <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> and  save it to the folder where the <b>DumpIt</b> executable was located.</div>
<div style="text-align: justify;">
Memory <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a> is becoming an essential aspect of digital forensics  and incident response. When a system is believed to have been  compromised or infected, the investigator needs a convenient way to take  a memory snapshot of the host. <b>DumpIt</b>, a new tool from <b>MoonSols</b>, makes this very easy, even if the person in front of the affected computer isn’t technical.</div>
<div style="text-align: justify;">
The user can then provide the investigator with the USB key, which  will contain the memory snapshot file. The administrator can use free  memory forensics tools such as The <a href="http://www.toolwar.com/2013/09/volatility-framework.html" target="_blank">Volatility Framework,</a> Mandiant Redline and HB Gary Responder Community Edition to examine the memory file’s contents for malicious artifacts.</div>
<div style="text-align: justify;">
<b>DumpIt</b> provides an easy way of obtaining a memory image of a <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>  system even if the investigator is not physically sitting in front of  the target computer. It’s so easy to use, even a naive user can do it.  It’s not appropriate for all scenarios, but it will definitely make  memory acquisition easier in many situations.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials :: </h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/SEs4ZAolED0?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
 </h3>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows ::  </b><a href="https://github.com/thimbleweed/All-In-USB/blob/master/utilities/DumpIt/DumpIt.exe?raw=true" target="_blank">DumpIt.exe</a><br />
<b>Official Website :: </b><a href="http://www.moonsols.com" rel="nofollow" target="_blank">http://www.moonsols.com/</a></div>
<div style="text-align: justify;">
</div>

DumpIt (Memory Dumper) :: Tools

DumpIt is a fusion of two trusted tools , win32dd and win64dd, combined into one one executable. DumpIt is designed to be provided to...

Hook Analyzer (Malware Analysis and Cyber Intelligence) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Hook Analyser 3.0" border="0" height="324" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0OmIirqGeQmdgB2nH4Gn-Cqwf17KXdZUVLYFVDBGbtK70u1NfT5MPvoVYbSj89mfPHKKK9qJbxCL4tIc_vpxb7syDkjmX59Dk7oizgHoIhfCoQ6GvkGLEhf5EwK0_GI4yov3373V6Ljyz/s640/Hook+Analyser+3.0.png" title="Hook Analyser 3.0" width="640" /></div>
<div style="text-align: justify;">
<b>Hook Analyser</b> is a <i>malware analysis</i> and <i>cyber intelligence</i> (gathering and analysis) utility. As well as <b>Hook Analyzer</b> performs spawn and hook to application, hook to a specific running application process, perform static <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a> analysis, application crash <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a>, EXE extractor from process, and cyber threat intelligence.<br />
<b><br />
The project/utility has six (6) key functionalities -</b><br />
<b>1.         Spawn and Hook to Application</b> - This feature allows analyst to  spawn an application, and hook into it. The module performs the  following -<br />
a.        PE validation<br />
b.        Static <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a> analysis.<br />
c.        Other options (such as pattern search or dump all)<br />
d.        Type of hooking (Automatic, Smart or manual)<br />
e.        Spawn and hook<br />
<br />
With the ‘hook’ module, there are three types of hooking being supported –<br />
<br />
a)        Automatic – The tool will parse the application import tables, and based upon that will hook into specified APIs<br />
b)        Manual – On this, the tool will ask end-user for each API, if it needs to be hooked.<br />
c)        Smart – This is essentially a subset of automatic hooking however, excludes uninteresting APIs.<br />
<br />
<b>2.         Hook to a specific running process</b>- The option allows analyst to  hook to a running (active) process. The module performs the following  operations –<br />
<br />
a.        List all running process<br />
b.        Identify the running process executable path.<br />
c.        Perform static malware analysis on executable (fetched from process executable path)<br />
d.        Other options (such as pattern search or dump all)<br />
e.        Type of hooking (Automatic, Smart or manual)<br />
f.         Hook to a specific running process<br />
g.        Hook and continue the process<br />
<br />
<b>3.         Static Malware Analysis -</b> This module is one of the most  interesting and useful module of <b>Hook Analyzer</b>, which performs scanning  on PE or <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> executable (and DLLs) to identify potential malware  traces. <br />
<br />
a.        PE file validation<br />
b.        CRC and timestamps validation<br />
c.        PE properties such as Image Base, Entry point, sections, subsystem<br />
d.        TLS entry <a href="http://www.toolwar.com/search/label/Detect" target="_blank">detection</a>.<br />
e.        Entry point verification (if falls in suspicious section)<br />
f.        Suspicious entry point detection<br />
g.        Packer detection<br />
h.         Signature trace (extended from malware analyzer project), such  as Anti VM aware, debug aware, keyboard hook aware etc. This particular  function searches for more than 20 unique malware behaviors (using  100’s of signature).<br />
i.        Import Intel scanning.<br />
j.        Deep search (module) <br />
k.        Online search of MD5 (of executable) on Threat Expert.<br />
l.        String dump (ASCII)<br />
m.        Executable file information<br />
n.        Hexdump<br />
o.        PEfile info dumping<br />
p.        ...and more.<br />
<br />
<b>4.         Application crash analysis</b> - This module enables <a href="http://www.toolwar.com/search/label/Exploitation" target="_blank">exploit</a>  researcher and/or application developer to analyse memory content when  an application crashes. This module essentially displays data in  different <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> register (such as EIP).<br />
<br />
<br />
<b>5.         Exe extractor</b> - This module essentially extracts executables  from running process/s, which could then be further analyzed using Hook Analyzer, Malware Analyzer or other solutions. This module is  potentially useful for incident responders<br />
<br />
<br />
<b>6.        Cyber  Threat Intelligence </b>- This module is being created to gather and analyze  information related to Cyber Threats and <a href="http://www.toolwar.com/search/label/Vulnerability" target="_blank">vulnerabilities</a>. The module  can be run using HookAnalyser.exe (via Option 6), or can be run  directly.<br />
<br />
The module present information on a web browser (with dashboard alike representation). It has three (3) presentations - <br />
•        Threat Vectors - by Country (through url.txt - provided)<br />
•        Threat Vectors - by Geography (through url.txt - provided)<br />
•        Vulnerability / Threat Feed (through rss.txt)</div>
<div style="text-align: justify;">
<b><br />
</b></div>
<h3 style="text-align: justify;">
<b>Tutorials :: </b></h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/msYo7pPsu6A?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<b>
</b></div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/sdnRP90weT4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
<b>Download ::</b></h3>
<div style="text-align: justify;">
<b>Windows :: </b><a href="https://docs.google.com/file/d/0B4eYJx0xZdQAcDlvS3JhcmxmMjQ/edit" target="_blank">Hook Analyzer v3.0</a><b>
</b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://hookanalyser.com/">http://hookanalyser.com/</a></div>
<div style="text-align: justify;">
<b>Submitted By :: </b>Beenu Arora </div>

Hook Analyzer (Malware Analysis and Cyber Intelligence) :: Tools

Hook Analyser is a malware analysis and cyber intelligence (gathering and analysis) utility. As well as Hook Analyzer performs spawn ...

GDB GNU Debugger :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="gdb logo" border="0" height="255" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtcV7G_5LSgJmJVC3QAj64NTirUIMtUbntKldesIZ8v0GBoSxbgoqxPZo67Icvw7I_Ppk27F8UIyqslHsk26Gp3S1WOVzXcwuYbEQ35s36pYuxP41VWN0UWFH3WO3x0clk7PGxh3yFsKYf/s400/gdb-logo.png" title="gdb logo" width="400" /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>GDB, the GNU Project <a href="http://www.toolwar.com/search/label/Debugger" target="_blank">debugger</a></b>, allows you to see what is going on `inside' another program while it executes -- or what another program was doing at the moment it crashed.  </div>
<div style="text-align: justify;">
<b>GDB </b>can do four main kinds of things (plus other things in support of these) to help you catch bugs in the act:  </div>
<ul style="text-align: justify;">
<li>Start your program, specifying anything that might affect its behavior. </li>
<li>Make your program stop on specified conditions. </li>
<li>Examine what has happened, when your program has stopped. </li>
<li>Change things in your program, so you can experiment with correcting the effects of one bug and go on to learn about another. </li>
</ul>
<div style="text-align: justify;">
The program being debugged can be written in Ada, C, C++, Objective-C, Pascal (and many other <a href="http://www.toolwar.com/search/label/Language" target="_blank">languages</a>).  Those programs might be executing on the same machine as GDB (native) or on another machine (remote).  GDB can run on most popular UNIX and Microsoft <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> variants.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials :: </h3>
<div style="text-align: justify;">
<b>Video Tutorials ::</b> </div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/sCtY--xRUyI?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/k-zAgbDq5pk?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<b>Text Tutorials :: </b><a href="http://sourceware.org/gdb/current/onlinedocs/gdb/" target="_blank">Click Here</a> <br />
<h3>
Download :: </h3>
<b>Linux ::</b> <a href="ftp://sourceware.org/pub/gdb/releases/gdb-7.6.tar.gz" target="_blank">GDB v7.6.tar.gz</a>
<b> </b><br />
<b>Official Site :: </b><a href="http://www.gnu.org/">http://www.gnu.org/</a>

GDB GNU Debugger :: Tools

GDB, the GNU Project debugger , allows you to see what is going on `inside' another program while it executes -- or what another pr...

WinDbg (Windows Debugger) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIZ53_pO0bAOCjl_oxpv2f2XhKxp-Z63nXIjIntBQxqPPcI_HT1qhdI4UMOb7ZHKD6D-KSRcJC068J4vvrq4tnFkTp0rQw0pgwPGLIASpGS7YoWpZ1srx4fVezCo-TPQ5gjHVyw-uyEUUw/s1600/windbg+screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Windbg screenshot" border="0" height="271" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIZ53_pO0bAOCjl_oxpv2f2XhKxp-Z63nXIjIntBQxqPPcI_HT1qhdI4UMOb7ZHKD6D-KSRcJC068J4vvrq4tnFkTp0rQw0pgwPGLIASpGS7YoWpZ1srx4fVezCo-TPQ5gjHVyw-uyEUUw/s400/windbg+screenshot.png" title="Windbg screenshot" width="400" /></a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>WinDbg</b> is a <i>graphical debugger from Microsoft</i>. It is actually 
just one component of the <i>Debugging Tools for <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> package</i>, which 
also includes the KD, CDB, and NTSD <a href="http://www.toolwar.com/search/label/Debugger" target="_blank">debuggers</a>. Its claim to fame is 
debugging <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> dumps produced after a crash. It can even debug in 
kernel mode. For downloads and more information.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/q-IWHHFQcXg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/1R0zqStq7ss?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows (x86) ::</b> <a class="FileNameLink" href="http://archive.msdn.microsoft.com/Project/Download/FileDownload.aspx?ProjectName=debugtoolswindows&DownloadId=13748" id="ctl00_ctl00_Content_TabContentPanel_Content_ReleaseFiles_FileList_ctl01_FileNameLink" tabindex="9" target="_blank">dbg_x86_6.12.2.633</a></div>
<div style="text-align: justify;">
<b>Windows (x64) ::</b> <a href="http://archive.msdn.microsoft.com/Project/Download/FileDownload.aspx?ProjectName=debugtoolswindows&DownloadId=13747" target="_blank">WinDbg_x64</a>  </div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="https://www.microsoft.com/" target="_blank">https://www.microsoft.com/ </a></div>

WinDbg (Windows Debugger) :: Tools

WinDbg is a graphical debugger from Microsoft . It is actually just one component of the Debugging Tools for Windows package , which...

Immunity Debugger :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Immunity Debugger logo" border="0" height="340" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9Tz7osQXiMIGssd8NGbnuYt2UuNlyHH6exkoSIEvMi6eJWYewN-waCLbYG-2ZjR-PbZhLWL2A9wBOmtAo9V0AKXaUBpGgoDlDoMAhMep5Qott6zJB-zoqQuUaLf0pzc5oMPvczcOOL0pJ/s400/debugger-logo.png" title="Immunity Debugger logo" width="400" /></div>
<div style="text-align: justify;">
<b>Immunity Debugger</b> is a powerful new way to <i>write exploits, <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyze</a> <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a>, and reverse engineer binary files.</i>  It builds on a solid user interface with function graphing, the industry's first heap analysis tool built specifically for heap creation, and a large and well supported <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> API for easy extensibility.</div>
<div style="text-align: justify;">
<img border="0" src="http://www.immunityinc.com/bullet.gif" /> A <a href="http://www.toolwar.com/search/label/Debugger" target="_blank">debugger</a> with functionality designed specifically for the security industry<br />
<img border="0" src="http://www.immunityinc.com/bullet.gif" />Cuts exploit development time by 50%<br />
<img border="0" src="http://www.immunityinc.com/bullet.gif" />Simple, understandable interfaces<br />
<img border="0" src="http://www.immunityinc.com/bullet.gif" />Robust and powerful scripting language for automating intelligent debugging<br />
<img border="0" src="http://www.immunityinc.com/bullet.gif" />Lightweight and fast debugging to prevent corruption during complex analysis<br />
<img border="0" src="http://www.immunityinc.com/bullet.gif" />Connectivity to fuzzers and exploit development <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<h3>
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/fIUOiwYTpho?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/KlcLLzdtT2U?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
</div>
<div style="text-align: justify;">
<h3>
Download ::</h3>
</div>
<div style="text-align: justify;">
<b>Windows :: </b><a href="http://debugger.immunityinc.com/ID_register.py" target="_blank">Immunity Debugger </a><b>
</b></div>
<div style="text-align: justify;">
<b>Official Website ::</b>  <a href="http://debugger.immunityinc.com/">http://debugger.immunityinc.com/</a></div>

Immunity Debugger :: Tools

Immunity Debugger is a powerful new way to write exploits, analyze malware , and reverse engineer binary files. It builds on a solid ...

Comodo Instant Malware Analysis :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZXpq3vpAdfRoyhd2TuuLhRbcxvLUBdg7j0s0qs-de-oL4mMDVYHrSC1fhR8Qi8WvGxs01xNpvkrcfzmLAOEgynz-P-VuNsBvQuCYbzN19hY690b6aG_bmqqkqa8rOkCqfFeXpt3YG86co/s1600/malware_submission.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Comodo Instant Malware Analysis :: Tools" border="0" height="60" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZXpq3vpAdfRoyhd2TuuLhRbcxvLUBdg7j0s0qs-de-oL4mMDVYHrSC1fhR8Qi8WvGxs01xNpvkrcfzmLAOEgynz-P-VuNsBvQuCYbzN19hY690b6aG_bmqqkqa8rOkCqfFeXpt3YG86co/s640/malware_submission.gif" title="Comodo Instant Malware Analysis :: Tools" width="640" /></a></div>
<div style="text-align: justify;">
<b>COMODO Automated Malware Analysis System</b> will scan it and report back its findings. If you have a suspicious file, please submit it online by using the form that available in below download section.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Online :: <a href="http://camas.comodo.com/">http://camas.comodo.com/</a></div>

Comodo Instant Malware Analysis :: Tools

COMODO Automated Malware Analysis System will scan it and report back its findings. If you have a suspicious file, please submit it onli...

Anubis (Malware Analysis) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTmAx_NudzfUupSdKvSkb0hV3Z5-uet6DMoIU6IOOLV2D1jhrwUKJ1J0Nr8Y10u30CXriHeCoN7-RrUyMg2I2OXk-tJ-Nx16UORipoRzOCFsusKV1b90cEopYLaxyWRrAdtMGtf-nBFaQ5/s1600/anubis+logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="anubis logo" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTmAx_NudzfUupSdKvSkb0hV3Z5-uet6DMoIU6IOOLV2D1jhrwUKJ1J0Nr8Y10u30CXriHeCoN7-RrUyMg2I2OXk-tJ-Nx16UORipoRzOCFsusKV1b90cEopYLaxyWRrAdtMGtf-nBFaQ5/s200/anubis+logo.png" title="anubis logo" width="114" /></a></div>
<div style="text-align: justify;">
<b>Anubis</b> is a service for<b> analyzing malware.</b> Submit your <b>Windows executable</b> or <b>Android APK</b> and receive an analysis report telling you what it does.
  Alternatively, submit a <b>suspicious URL</b> and receive a report that shows you all the activities
  of the Internet Explorer process when visiting this URL. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Online :: </b><a href="http://anubis.iseclab.org/">http://anubis.iseclab.org/</a> </div>

Anubis (Malware Analysis) :: Tools

Anubis is a service for analyzing malware. Submit your Windows executable or Android APK and receive an analysis report telling you ...

VirusTotal (Analyze files and URLs) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="virustotal logo" border="0" height="70" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_tdl85tCDSMyYMpacR9LL_CK2AehDKuIiji7z27f0HCHva-H4cBOUdzchlHBuKhIMi7y-qAjBkrxhPNy9QG9vMIgh180-_lugQgdYdr5OKvqWU_gT4lZqr9v8ppC2b39ZnvLE-LyNkSWa/s400/virustotal+logo.png" title="virustotal logo" width="400" /> </div>
<div style="text-align: justify;">
<b>VirusTotal</b>, a subsidiary of Google, is a <i><b>free <a href="http://www.toolwar.com/search/label/Online" target="_blank">online</a> service that           analyzes files and URLs</b></i> enabling the <i>identification of viruses,           worms, trojans and other kinds of malicious content</i> detected by           antivirus engines and website <a href="http://www.toolwar.com/search/label/Scanner" target="_blank">scanners.</a> At the same time, it may be           used as a means to detect false positives, i.e. innocuous resources           detected as malicious by one or more scanners.         </div>
<div style="text-align: justify;">
<b>VirusTotal’</b>s mission is to help in improving the antivirus and           <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> industry and make the internet a safer place through the           development of free tools and services.<b> VirusTotal's</b> main characteristics are highlighted below.         </div>
<h3 style="text-align: justify;">
Free unbiased service ::</h3>
<div style="text-align: justify;">
<b>VirusTotal</b>, is offered freely to end users as long as its use has no           commercial purpose and does not become part of any business activity.           Even though the service works with engines belonging to different           enterprises and organizations, <b>VirusTotal</b> does not distribute or           advertise any products belonging to third parties, but simply acts           as an aggregator of information. This prevents us from being           subjected to any kind of bias and allows us to offer an objective           service to our users.         </div>
<h3 style="text-align: justify;">
Runs multiple antivirus engines and website scanners ::</h3>
<div style="text-align: justify;">
<b>VirusTotal</b> simply acts as an information aggregator. The aggregated           data is the output of different antivirus engines, website scanners,           file and URL <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a> tools and user contributions. The full list           of antivirus solutions and website scanners used in VirusTotal           can be found in the            credits and collaboration acknowledgements section.         </div>
<h3 style="text-align: justify;">
Runs multiple file and URL characterization tools ::</h3>
<div style="text-align: justify;">
As previously stated,<b> VirusTotal</b> also aggregates the output of a           number of file and URL characterization tools. These tools cover a           wide range of purposes, ranging from providing structural information           about Microsoft Windows portable executables (PEs) to identifying           signed software. The full list of file and URL characterization           tools used in <b>VirusTotal</b> can be found in the           credits and collaboration           acknowledgements section.         </div>
<h3 style="text-align: justify;">
Real time updates of virus signatures and blacklists ::</h3>
<div style="text-align: justify;">
The <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a> signatures of antivirus solutions present in VirusTotal           are periodically updated as they are developed and distributed by the           antivirus companies. The update polling frequency is 15 minutes—this           makes sure that the products are using the latest signature sets.         </div>
<div style="text-align: justify;">
<a href="http://www.toolwar.com/search/label/Web" target="_blank">Website</a> scanning is done via API queries to the different companies           providing the particular solution, hence, the most updated version           of their dataset is always used.         </div>
<h3 style="text-align: justify;">
Detailed results from each scanner ::</h3>
<div style="text-align: justify;">
<b>VirusTotal </b>not only tells you whether a given antivirus solution           detected a submitted file, but also displays the exact detection           label returned by each engine (e.g.           <span class="label important">I-Worm.Allaple.gen</span>).         </div>
<div style="text-align: justify;">
This feature is also present in URL scanners. Most of them will           discriminate malware sites, phishing sites, suspicious sites, etc.           Moreover, some of the engines will provide additional information           explicitly stating whether a given URL belongs to a particular           botnet, which brand is targeted by a given phishing site, etc.         </div>
<h3 style="text-align: justify;">
Real time global service operation statistics ::</h3>
<div style="text-align: justify;">
Information about the number of resources (files and URLs) processed           by <b>VirusTotal</b> can be found in the            statistics section. These statistics provide a number of notions           and groupings, such as global detection ratios for the received files,           submissions per country, most popular detection labels, etc. No           statistics comparing the different antivirus products and website           detection engines are generated—neither will they ever be generated           (on a public or private basis), even though their calculation is           trivial. The reason is that using <b>VirusTotal </b>          for antivirus testing is a bad idea.         </div>
<h3 style="text-align: justify;">
Automation API ::</h3>
<div style="text-align: justify;">
File and URL scanning can be automated with a free public API. For           obvious reasons (including prevention of competition with the           antivirus products present in <b>VirusTotal</b>), the public API is           subjected to a strong request rate limitation. Should a user require           a higher request rate, a honeypot API is available for researchers           and a private mass API is offered to individuals with commercial and           product enhancement intentions. A detailed specification of the           different APIs can be found in the            advanced features section.         </div>
<h3 style="text-align: justify;">
Online malware research community ::</h3>
<div style="text-align: justify;">
In August 2010 <b>VirusTotal </b>integrated a pseudo-social network that           allows its users to interact with other users and comment on files           and URLs. These comments may range from deep malware analyses to           information on the distribution vector and in-the-wild locations           of the submitted files, hence, the community acts as the collective           intelligence component of VirusTotal. Files and URLs can be voted as           malicious or innocuous, building a community maliciousness score for           the resource.         </div>
<div style="text-align: justify;">
In other words, when security products fail (false positives/false           negatives), there is still a chance that some VirusTotal Community           user will have produced a useful review of the resource for its           community peers.         </div>
<h3 style="text-align: justify;">
Desktop applications for interacting with the service ::</h3>
<div style="text-align: justify;">
With the aim of making the Internet a safer place <b>VirusTotal's</b> team           has released a number of desktop applications and tools for           interacting with the service (one-click file uploader, <a href="http://www.toolwar.com/search/label/Browser" target="_blank">browser</a>           extensions, etc.). Many of <b>VirusTotal's</b> users have also developed           their own applications and have made them publicly available on the           Internet. More information about these resources can be found in the           advanced features section. </div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/TFSmJaiO_G0?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br />
<b>Online :: </b><a href="https://www.virustotal.com/">https://www.virustotal.com/</a></div>

VirusTotal (Analyze files and URLs) :: Tools

VirusTotal , a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of v...

Cuckoo Sandbox (Malware Analysis) :: Tools

<div class="row" style="text-align: justify;">
<div class="span6" style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Cockoo sandbox logo" border="0" height="128" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgibr626QwfgXHYV4JYq_X59SkjRlgqtUxt37xeoKA02je4VxQCzLHM2HF_UMNOs73aOU78-Ym3kDdcNf_Sh4lu8veicfMPHF_ExBSG4ZSq32iari06OXQx68KZJGay6AFbiMYSwZObGuUD/s400/cuckoo+sandbox+logo.png" title="Cockoo sandbox logo" width="400" /></div>
<h3>
What is Cuckoo Sandbox?</h3>
<b>Cuckoo Sandbox</b> is a <b><i>malware analysis system</i></b>. What does that mean? It simply means that you can  throw any <i>suspicious file</i> at it and in a matter of seconds Cuckoo will  provide you back some detailed results outlining what such file did when  executed inside an isolated environment.<br />
<h3>
Why should you use it?</h3>
<i><b>Malware</b> is the swiss-army knife of cybercriminals</i> and any other adversary to your corporation or organization.<br />
In these evolving times, detecting and removing <a href="http://www.toolwar.com/search/label/Malware" target="_blank"> malware</a> artifacts is not enough: it's vitally important to understand  how they work and what they would do/did on your systems when deployed  and understand the context, the motivations and the goals of a breach.<br />
In this way you are able to more effectively understand the incident, respond to it and protect yourself for the future.<br />
There are infinite other contexts where you might  need to deploy a sandbox internally, from <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyzing</a> an internal breach  to proactively scouting wildly distributed threats, collect actionable  data and analyzing the ones actively targeting your infrastructure or  products.<br />
In any of these cases you'll find Cuckoo to be perfectly suitable, incredibly customizable and well... free!</div>
<div class="span6" style="text-align: justify;">
<h3>
What does it produce?</h3>
Cuckoo generates a handful of different raw data which include:<br />
<ul>
<li>Native functions and <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> API calls traces</li>
<li>Copies of files created and deleted from the filesystem</li>
<li>Dump of the memory of the selected process</li>
<li>Full <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> dump of the analysis machine</li>
<li>Screenshots of the desktop during the execution of the malware analysis</li>
<li><a href="http://www.toolwar.com/search/label/Network" target="_blank">Network</a> dump generated by the machine used for the analysis</li>
</ul>
In order to make such results more consumable to the  end users, Cuckoo is able to process them and generate different type of  reports, which could include:<br />
<ul>
<li>JSON report</li>
<li>HTML report</li>
<li>MAEC report</li>
<li>MongoDB interface</li>
<li>HPFeeds interface</li>
</ul>
Even more interestingly, thanks to Cuckoo's extensive  modular design, you are able to customize both the processing and the  reporting stages. Cuckoo provides you all the requirements to easily  integrate the sandbox into your existing <a href="http://www.toolwar.com/search/label/Framework" target="_blank">frameworks</a> and storages with  the data you want, in the way you want, with the format you want.<br />
<h3>
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/720Vh3FaGN8?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/KVoDCrYeCXo?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/-npWBiDloRQ?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download :: </h3>
<b>Alternative Downloads ::</b><br />
<pre>git clone git://github.com/cuckoobox/cuckoo.git</pre>
If you want to clone a specific branch ::<br />
<pre>git clone -b <branch name> git://github.com/cuckoobox/cuckoo.git</pre>
<b><span style="font-family: inherit;">Linux ::</span></b> <a href="http://www.cuckoosandbox.org/download.html" target="_blank">Cuckoo Sandbox 0.6</a><br />
<b>Official Website :: </b>http://www.cuckoosandbox.org/<br />
<h3>
</h3>
</div>
</div>

Cuckoo Sandbox (Malware Analysis) :: Tools

What is Cuckoo Sandbox? Cuckoo Sandbox is a malware analysis system . What does that mean? It simply means that you can throw any su...

PDFMiner (PDF Parser and Analyzer) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="PDF Analyzer Logo" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMCjJJbO6cbhxU25HoYQQ8ON_84A1pWFiyQLa-JFIozC6ngptY0JwR3i0kmDfGHn30rDY8c8i1AKJlt85WCyQGkQ1xtKs733iaogmoBtlkajjWUsAMFPoLlIFMdiiDWpacJze0pKS8trfk/s320/PDF+Analyzer+logo.png" title="PDF Analyzer Logo" width="320" /></div>
<div style="text-align: justify;">
<b>PDFMiner </b>is a tool for <i>extracting information from PDF documents.</i>
Unlike other <b>PDF-</b>related tools, it focuses entirely on getting 
and<i> <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyzing</a> text data</i>. <b>PDFMiner </b>allows one to obtain
the exact location of text in a page, as well as 
other information such as fonts or lines.
It includes a PDF converter that can transform <a href="http://www.toolwar.com/search/label/PDF" target="_blank">PDF</a> files
into other text formats (such as HTML). It has an extensible
PDF parser that can be used for other purposes than text analysis.

</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Features</h3>
<ul style="text-align: justify;">
<li> Written entirely in Python. (for version 2.4 or newer)
</li>
<li> Parse, analyze, and convert PDF documents.
</li>
<li> PDF-1.7 specification support. (well, almost)
</li>
<li> CJK <a href="http://www.toolwar.com/search/label/Language" target="_blank">languages</a> and vertical writing scripts support.
</li>
<li> Various font types (Type1, TrueType, Type3, and CID) support.
</li>
<li> Basic encryption (RC4) support.
</li>
<li> PDF to HTML conversion (with a sample converter web app).
</li>
<li> Outline (TOC) extraction.
</li>
<li> Tagged contents extraction.
</li>
<li> Reconstruct the original layout by grouping text chunks.
</li>
</ul>
<div style="text-align: justify;">
<b>PDFMiner</b> is about 20 times slower than 
other C/C++-based counterparts such as XPdf. </div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<h4>
How to Install</h4>
<ol>
<li> Install <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> 2.4 or newer.
     (<b>Python 3 is not supported.</b>)
</li>
<li> Download the PDFMiner source.
</li>
<li> Unpack it.
</li>
<li> Run <code>setup.py</code> to install:<br />
<blockquote>
<pre><span style="font-family: "Courier New",Courier,monospace;"># <b>python setup.py install</b></span>
</pre>
</blockquote>
</li>
<li> Do the following test:<br />
<blockquote>
<pre><span style="font-family: "Courier New",Courier,monospace;">$ <b>pdf2txt.py samples/simple1.pdf</b>
Hello
World
Hello
World
H e l l o
W o r l d
H e l l o
W o r l d</span>
</pre>
</blockquote>
</li>
<li> Done!
</li>
</ol>
<div style="text-align: justify;">
For more tutorials visit official website.</div>
<h3 style="text-align: justify;">
<b>Download ::</b></h3>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="https://pypi.python.org/packages/source/p/pdfminer/pdfminer-20131113.tar.gz" target="_blank">PDFMiner-20131113.tar.gz</a><b> </b></div>
<div style="text-align: justify;">
<b>Official Website :: </b> <a href="http://www.unixuser.org/~euske/python/pdfminer/index.html">http://www.unixuser.org/~euske/python/pdfminer/index.html</a></div>

PDFMiner (PDF Parser and Analyzer) :: Tools

PDFMiner is a tool for extracting information from PDF documents. Unlike other PDF- related tools, it focuses entirely on getting and ...

APKinspector (Android Application Analysis) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDfll6W-RvD12nGiztawoL8QzR2hiHtY9U0CyFpiOh8DIlhHtylQu4GXGEeJOXGgm-Kn-50SpKrC-tMzOnEz3XmJq8OPzHGd1s1Cbwz9hJkW4ewca_vWW6qMKYQEEKP3C2IbytnRVmnsY7/s1600/APKinspector+Logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="APKinspector Logo" border="0" height="283" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDfll6W-RvD12nGiztawoL8QzR2hiHtY9U0CyFpiOh8DIlhHtylQu4GXGEeJOXGgm-Kn-50SpKrC-tMzOnEz3XmJq8OPzHGd1s1Cbwz9hJkW4ewca_vWW6qMKYQEEKP3C2IbytnRVmnsY7/s320/APKinspector+Logo.png" title="APKinspector Logo" width="320" /></a></div>
<div style="text-align: justify;">
<span itemprop="description"><br />
</span></div>
<div style="text-align: justify;">
<span itemprop="description"><b>APKinspector</b> is a powerful GUI tool for analysts to <b>analyze the Android applications.</b></span> The goal of this project is to aide analysts and  reverse engineers to visualize compiled <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a> packages and their  corresponding DEX code. <b>APKInspector</b> provides both <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a> functions  and graphic features for the users to gain deep insight into the  malicious apps: </div>
<ul style="text-align: justify;">
<li>    CFG   </li>
</ul>
<ul style="text-align: justify;">
<li>    Call Graph </li>
</ul>
<ul style="text-align: justify;">
<li>Static Instrumentation </li>
</ul>
<ul style="text-align: justify;">
<li>Permission Analysis </li>
</ul>
<ul style="text-align: justify;">
<li>Dalvik codes  </li>
</ul>
<ul style="text-align: justify;">
<li>Smali codes  </li>
</ul>
<ul style="text-align: justify;">
<li>Java codes  </li>
</ul>
<ul style="text-align: justify;">
<li>APK Information  </li>
</ul>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div style="text-align: justify;">
This  is a guide to get <b>APKInspector</b> running on your own computer. The latest  version is tested on Ubuntu 10.10 and Ubuntu 11.04.  </div>
<ol style="text-align: justify;">
<li>Download the latest version of <b>APKInspector</b> via GIT </li>
<li>Run “./Install.sh” </li>
<li>Test if APKInspector can boot correctly, go to the directory of “<b>APKInspector</b>”, run “python StartQT.py”. </li>
</ol>
<h3 style="text-align: justify;">
<a href="http://www.blogger.com/null" name="What’s_new?"></a></h3>
<h3>
Download ::</h3>
<b>Windows or Linux ::</b> <a href="http://apkinspector.googlecode.com/files/apkinspector.Beta.zip" target="_blank">APKInspector Beta</a><br />
<b>Source :: </b><a href="http://code.google.com/p/apkinspector/">http://code.google.com/p/apkinspector/</a>

APKinspector (Android Application Analysis) :: Tools

APKinspector is a powerful GUI tool for analysts to analyze the Android applications. The goal of this project is to aide analysts a...

Moblie Sandbox (Malware Analysis) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_qbvIc8E9v5X4r0t44FgOmDqC7zmSCQI18Co_RwJhj0LT7b4V-Fj-eVHPAknjUafduiYnS9pLdD13ccoRx_BiMGYy_llqPPE47AkWGQqbljQmA3IhxZeudMKZ9SsaZtPxKZpIvhO9NBXn/s1600/Mobile+Sandbox+Logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Mobile Sandbox Logo" border="0" height="146" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_qbvIc8E9v5X4r0t44FgOmDqC7zmSCQI18Co_RwJhj0LT7b4V-Fj-eVHPAknjUafduiYnS9pLdD13ccoRx_BiMGYy_llqPPE47AkWGQqbljQmA3IhxZeudMKZ9SsaZtPxKZpIvhO9NBXn/s400/Mobile+Sandbox+Logo.png" title="Mobile Sandbox Logo" width="400" /></a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Mobile-Sandbox</b>.com is part of the <b>MobWorm</b> project and provides<b> static and dynamic malware analysis</b> for Android OS smartphones.<br />
<b>Mobile Sandbox</b> provides static analysis of <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a> images with an easy accessible <a href="http://www.toolwar.com/search/label/Web" target="_blank">web</a> interface for submission.<br />
This  service is still under continuous development and is run purely as a  research tool and a best effort service. We reserve the right to take it  down at any point for maintenance or other reasons.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Online Website ::<a href="http://www.blogger.com/goog_1673190333"> </a></b><a href="http://mobilesandbox.org/">http://mobilesandbox.org/</a></div>

Moblie Sandbox (Malware Analysis) :: Tools

Mobile-Sandbox .com is part of the MobWorm project and provides static and dynamic malware analysis for Android OS smartphones. Mob...

Subscribe to: Posts ( Atom )