ToolWar | Information Security (InfoSec) Tools: Linux

DFF (Digital Forensics Framework) :: Framework

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIl1DdbsO0WfC9qJDGu02Asu8jmU-fMvvGqJMnoXYIsycbH4eFW775XwZteITm_g2b8WSSdGZMbd7O8O3wZHb-6a1jsPqXb98HsFnIMVxzOlcFkVtQFC1j5SodKKFdqH5k_nWuugslcbtP/s1600/DFF+LOgo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="DFF Logo" border="0" height="166" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIl1DdbsO0WfC9qJDGu02Asu8jmU-fMvvGqJMnoXYIsycbH4eFW775XwZteITm_g2b8WSSdGZMbd7O8O3wZHb-6a1jsPqXb98HsFnIMVxzOlcFkVtQFC1j5SodKKFdqH5k_nWuugslcbtP/s1600/DFF+LOgo.png" title="DFF Logo" width="400" /></a></div>
<div style="text-align: justify;">
<b>DFF (Digital Forensics Framework)</b> is a free and Open Source <b>computer  forensics software</b> built on top of a dedicated Application Programming  Interface (API). It can be used both by professional and non-expert people in order to quickly  and easily collect, preserve and reveal digital evidences without  compromising systems and data.</div>
<h3 style="text-align: justify;">
Features :: </h3>
<ul style="text-align: justify;">
<li>Preserve digital chain of custody - Software write blocker, cryptographic <a href="http://www.toolwar.com/search/label/Hash" target="_blank">hash</a> calculation</li>
<li>Access to local and remote devices - Disk drives, removable devices, remote file systems</li>
<li>Read standard <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">digital forensics</a> file formats - Raw, Encase EWF, AFF 3 file formats</li>
<li><a href="http://www.toolwar.com/search/label/Virtual" target="_blank">Virtual machine</a> disk reconstruction - VmWare (VMDK) compatible</li>
<li><a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> and <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux OS</a> forensics - <a href="http://www.toolwar.com/search/label/Registry" target="_blank">Registry</a>, Mailboxes, NTFS, EXTFS 2/3/4, FAT 12/16/32 file systems</li>
<li>Quickly triage and search for (meta-)data - Regular expressions, dictionaries, content search, tags, time-line</li>
<li><a href="http://www.toolwar.com/search/label/Recovery" target="_blank">Recover</a> hidden and deleted artifacts - Deleted files / folders, unallocated spaces, carving</li>
<li>Volatile <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory forensics</a> - Processes, local files, binary extraction, network connections</li>
</ul>
<div style="text-align: justify;">
<b>Digital Forensics Framework (DFF)</b> is an open source computer forensics software. It advertises the ability to be used by both professionals and non-experts to collect, preserve, and reveal digital evidence without compromising systems and data. </div>
<div style="text-align: justify;">
<b>Digital Forensics Framework</b> offers two user interfaces, a graphical one developed in PyQt and providing classical tree view but also more advanced features such as recursive view, tagging, live search or bookmarking. Its command line interface enables to perform <a href="http://www.toolwar.com/search/label/Investigation" target="_blank">digital investigation</a> remotely and comes with usual functionnalities available in common shell such as completion, tasks management, globing or keyboard shortcuts. DFF can also run batch scripts at startup to automate repetitive tasks. Advanced users and developers can also use DFF directly from a <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> interpreter to script their investigation.</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>DFF Blog :: </b><a href="http://www.digital-forensic.org/blog/" target="_blank">Click Here</a><b><br />
</b></div>
<b>DFF Wiki :: </b><a href="http://wiki.digital-forensic.org/" target="_blank">Click Here</a><br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/02uZv72KS88?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux | Windows :: </b><a href="http://www.digital-forensic.org/en/downloads/dff/" target="_blank">DFF v1.3.0</a> (Free Edition)</div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://wiki.digital-forensic.org/index.php/Main_Page">http://wiki.digital-forensic.org/index.php/Main_Page</a></div>

DFF (Digital Forensics Framework) :: Framework

DFF (Digital Forensics Framework) is a free and Open Source computer forensics software built on top of a dedicated Application Progra...

Liffy (Local File Inclusion Exploitation) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEHgUv3G2cSh18uLQRim8Gb5IXVYRmDrm0RRYDS4PNvOY9nqx1BixII41qCSV_QuR3s_OemRkq0lnNGMxMxDVuUZSsKF7L_yVBxEjzkNtuPb0tWrQVme-kk6yZvRanaLs-Vo9GRkRU6CSJ/s1600/Liffy.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Liffy Tool" border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEHgUv3G2cSh18uLQRim8Gb5IXVYRmDrm0RRYDS4PNvOY9nqx1BixII41qCSV_QuR3s_OemRkq0lnNGMxMxDVuUZSsKF7L_yVBxEjzkNtuPb0tWrQVme-kk6yZvRanaLs-Vo9GRkRU6CSJ/s1600/Liffy.jpg" title="Liffy Tool" width="400" /></a></div>
<div style="text-align: justify;">
<b>Liffy</b> is a tool to exploit local file inclusion <a href="http://www.toolwar.com/search/label/Vulnerability" target="_blank">vulnerability</a> using 
the built-in wrappers php://input, data://, and a process control 
extension called 'expect'. <b>Liffy</b> is written in <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a>.</div>
<ul class="task-list" style="text-align: justify;">
<li>Updates * Now comes with ability to use poisoned Apache access logs,
 and php://filter for code execution and arbitrary file reads.</li>
</ul>
<div style="text-align: justify;">
<b>Liffy</b> requires the following libraries: requests, argparse, blessings, urlparse In order to host the payload you may use Node's HTTP server. Or you can simply spawn python's SimpleHTTPServer in /tmp on port 
8000.  Further development of the tool will eventually include spawning a
 built-in web server in order to download, for now you can adjust the 
location and port in the source code for your needs.  These can be 
changed in core.py under the execute functions.</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>Example Use ::</b> ./liffy --url http://target/pdfs/vulnerable.php?= --data </div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux | Windows | Mac :: </b><a href="https://github.com/rotlogix/liffy/archive/master.zip" target="_blank">Click Here</a><b><br /></b></div>
<div style="text-align: justify;">
<b>Source Website :: </b><a href="https://github.com/rotlogix/liffy">https://github.com/rotlogix/liffy</a></div>

Liffy (Local File Inclusion Exploitation) :: Tools

Liffy is a tool to exploit local file inclusion vulnerability using the built-in wrappers php://input, data://, and a process control ...

Second Look (Linux Memory Forensics) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both;">
 <img border="0" height="124" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj3s-HN2dZGFNYEv4wk6IGLmblttBSVAhyiADK6Tcg_sE6ucHyhB_M1xINBz418Iy8K5vLizCBYB253oHqRxFsyyY8VZykHyveoJ2XteU5fG4hbI2gGuQ-r6z4iNVCrNR0thbZCaMasHa_/s1600/secondlook.jpg" width="640" /></div>
The Incident Response edition of <b>Second Look®: Linux Memory Forensics</b> is designed for use by investigators who need quick, easy, and effective <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory acquisition</a> and analysis capabilities. Second Look® is a product of Raytheon Pikewerks Corporation. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Acquisition"> Memory Acquisition::</span></h3>
<div style="text-align: justify;">
<b>Second Look®</b> preserves the volatile system state, capturing evidence  and information that does not exist on disk and may otherwise be lost as  an investigation proceeds.  A <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command-line</a> script allows for  acquisition of <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> from running systems without introducing any  additional software.  A memory access driver is provided for use on  systems without a native interface to physical memory. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Analysis"> Memory Analysis ::</span></h3>
<div style="text-align: justify;">
<b>Second Look® </b>interprets live system memory or captured memory images,  detecting and <a href="http://www.toolwar.com/search/label/Reverse" target="_blank">reverse engineering</a> malware, including stealthy kernel <a href="http://www.toolwar.com/search/label/Rootkit" target="_blank"> rootkits</a> and backdoors.  A kernel integrity verification approach is  utilized to compare the Linux kernel in memory with a reference kernel.   Pikewerks provides thousands of reference kernels derived from original  distribution kernel packages, and a script for creating reference  kernels for other systems, such as those running custom kernels. </div>
<div style="text-align: justify;">
<b>Second Look®</b> also applies an integrity verification approach for  the analysis of each process in memory.  This enables it to detect  unauthorized applications as well as stealthy user-level <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a>. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Supported_Systems"> Supported Systems ::</span></h3>
<div style="text-align: justify;">
Second Look® is regularly updated to support analysis of the latest  kernels and the most commonly used <a href="http://www.toolwar.com/search/label/Distribution" target="_blank">Linux distributions</a>.  The following  are its capabilities as of April 2012: </div>
<ul style="text-align: justify;">
<li> Supported target kernels: 2.6.x, 3.x up to 3.2 </li>
<li> Supported target architectures: x86 32- and 64-bit </li>
<li> Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-12.04, and more! </li>
</ul>
<h3 style="text-align: justify;">
Product features (Second Look Incident Response Edition) ::</h3>
<ul style="text-align: justify;">
<li>Memory acquisition and analysis for all 32- and 64-bit x86
(i386/i486/i586/i686, amd64/x86_64) Linux systems running 2.6- and 3-series
kernels. This includes:
<ul>
<li>Amazon Linux 2010.11 through 2014.03, and higher;</li>
<li>Debian 4 through 7, and higher;</li>
<li>Fedora 2 through 20, and higher;</li>
<li>Red Hat Enterprise Linux (RHEL) and CentOS 4.x, 5.x, 6.x, and higher;</li>
<li>Ubuntu 4.10 through 14.04, and higher;</li>
<li>and other distributions.</li>
</ul>
</li>
<li>Analysis via command line interface (CLI) or graphical user interface
(GUI) applications which run on Ubuntu 12.04 (32- or 64-bit) or RHEL/CentOS 6.x
(64-bit).</li>
<li>Automatic kernel version identification — just select a memory image
and go.</li>
<li>Supported memory image formats:
<ul>
<li>raw physical memory images ("mem" format — as produced by
secondlook-memdump, Inception, and other
tools);</li>
<li>SLM memory images ("slm" format — a high-performance compressed
memory image format used by Second Look Enterprise Security Edition);</li>
<li>LiME memory images ("lime", "padded", or LiME "raw" formats — "lime"
and LiME "raw" formats require conversion with secondlook-lime2mem or
secondlook-limeraw2mem, respectively ‐ LiME "padded" is the equivalent of
a raw physical memory image);</li>
<li>VMware virtual machine snapshots ("vmem", "vmsn", or "vmss" formats —
"vmsn" and "vmss" formats, as well as "vmem" files from VMs with >4GB RAM,
require conversion with VMware's vmss2core
and secondlook-core2mem);</li>
<li>VirtualBox snapshots ("vbc" format — via conversion with
secondlook-vbc2mem); and</li>
<li>KVM Libvirt-QEMU-Save or QEMU-savevm snapshots ("lqs" or "qsv" formats
— via conversion with lqs2mem, originally
secondlook-lqs2mem, now an open source project).</li>
</ul>
</li>
<li>Support for analysis of memory images from systems running either
distribution stock kernels or custom kernels.</li>
<li>Support for analysis of memory images from
Amazon EC2 instances (under both pv and hvm virtualization types).</li>
<li>Access to a repository of over 9000 ZRKs (Zipped Reference Kernels)
providing the metadata and baseline for analysis and verification of CentOS,
Debian, Fedora, RHEL, and Ubuntu stock kernels.</li>
<li>An easy-to-use tool for creation of ZRKs for other distributions or for
custom kernels.</li>
<li>Second Look ZRKs
can also be used as Volatility profiles.</li>
<li>Integrity verification of the kernel and processes in memory.</li>
<li>Access to a pagehash database containing hashes of the executable code
pages of the ELF executables and shared libraries from over 2 million
software packages from the Amazon, CentOS, Debian, Fedora, RHEL, and Ubuntu
distributions.</li>
<li>An easy-to-use tool for the addition of pagehashes supporting verification
of custom or third-party software.</li>
<li>Detection of kernel rootkits, backdoors, and other kernel-mode malware
(known and unknown varieties).</li>
<li>Detection of shared library rootkits, keyloggers, spyware, injected
libraries, injected threads, and other user-mode malware (known and unknown
varieties).</li>
<li>Detection of unknown or unauthorized processes.</li>
<li>Recovery of device mapper crypto keys
for LUKS, TrueCrypt, and other full disk encryption schemes.</li>
<li>Extraction of system state from captured memory images, including loaded
kernel modules, running processes, memory mappings, open files, active network
connections, and more.  Output is available in the GUI, in plain text from the
CLI, and in JSON format for ingestion by other programs.</li>
<li>Offline usage is supported via a subscription to our ZRK and pagehash reference data
feeds.</li>
</ul>
<h3 style="text-align: justify;">
More Reasons to Choose Second Look</h3>
<div style="text-align: justify;">

Beyond the unique and powerful Linux Incident Response feature set listed
above, what sets Second Look apart is the team behind it and the quality
of the software they deliver.

</div>
<ul style="text-align: justify;">
<li>The Second Look Team provides professional support via phone and
email, with on-site consulting services available.  You get direct access to
experts in Linux system internals and security.</li>
<li>Customer feedback often quickly leads to new features.</li>
<li>Second Look ships with comprehensive documentation, including a
User Guide with explanations of the techniques most commonly used by
attackers to maintain stealthy persistence on Linux systems.</li>
<li>Second Look is regression tested against a large suite of sample
memory images to ensure maximum quality and compatibility.</li>
<li>If you like the visibility that Second Look gives you during
investigations, you can upgrade to the Enterprise Security edition to monitor
your systems on an ongoing basis.</li>
</ul>
<ul style="text-align: justify;">
</ul>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/wt326aXmDMA?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b>$1495 (USD) | <a href="http://secondlookforensics.com/contact/" target="_blank">Contact Here</a> for Purchase</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://secondlookforensics.com/">http://secondlookforensics.com/</a></div>

Second Look (Linux Memory Forensics) :: Tools

The Incident Response edition of Second Look®: Linux Memory Forensics is designed for use by investigators who need quick, easy, and e...

Android Data Extractor Lite (ADEL) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBpxZgandE5D5alwBw5L_UGL3iMqOEB0ajg_cfYZfsGPuJNAb6b2XDZfvsItEsMGGwHvN19IrpDsUI8B7mEdp8miG2w4DADZEoN2Q964MIdgKQA_fMBhm-xtiEUygQ23IwbcP7PNdMoOI/s1600/ADEL+Image.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ADEL Android" border="0" height="287" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBpxZgandE5D5alwBw5L_UGL3iMqOEB0ajg_cfYZfsGPuJNAb6b2XDZfvsItEsMGGwHvN19IrpDsUI8B7mEdp8miG2w4DADZEoN2Q964MIdgKQA_fMBhm-xtiEUygQ23IwbcP7PNdMoOI/s1600/ADEL+Image.png" title="ADEL Android" width="400" /></a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Android Data Extractor Lite (ADEL)</b> is a <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> script that dumps all important SQLite Databases from a 
connected <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a> smartphone to the local disk and analyzes these files 
in a forensically accurate workflow. If no smartphone is connected you 
can specify a local directory which contains the databases you want to <a href="http://www.toolwar.com/search/label/Anaysis" target="_blank">analyze</a>. Afterwards this script creates a clearly structured XML report.</div>
<div style="text-align: justify;">
If you connect a smartphone you need a rooted and insecure kernel or a custom recovery installed on the smartphone.</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
ADEL needs a predefined configuration for each device to work proper. This configuration has to be added in the following file:</div>
<div style="text-align: justify;">
<pre><code>xml/phone_configs.xml</code></pre>
<pre><code> </code></pre>
</div>
<div style="text-align: justify;">
As an example we added the configuration for the Samsung Galaxy S2 running Android 2.3.3, more phone configurations will follow. Example for the use of ADEL with a connected smartphone:</div>
<div style="text-align: justify;">
<pre><code>adel.py -d device -l 4</code></pre>
<pre><code> </code></pre>
</div>
<div style="text-align: justify;">
Example for the use of ADEL with database backups:</div>
<div style="text-align: justify;">
<pre><code>adel.py -d /home/user/backup -l 4
</code></pre>
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Python Supported Platform :: </b><a href="https://github.com/mspreitz/ADEL/archive/master.zip" target="_blank">ADEL</a> (.py)<br /><b>Source Website ::</b> <a href="https://github.com/mspreitz/ADEL">https://github.com/mspreitz/ADEL</a></div>

Android Data Extractor Lite (ADEL) :: Tools

Android Data Extractor Lite (ADEL) is a Python script that dumps all important SQLite Databases from a connected Android smartphone...

Fern WiFi Cracker (Wireless Security Auditing) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_r9FW3TnXSaixk_XdPQeulTjkmnrUgCEaSMttahhSYB74fXxI7yrdv1fpiOwsdke6A8UYl_jOglpFZZF0snnVewT3z3Er5LlcI-Roo6j-vtoGbv6kPZMrd9BUb6gl3IdqLt_Iqp2tDCCF/s1600/fern+wifi+cracker+toolwar.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_r9FW3TnXSaixk_XdPQeulTjkmnrUgCEaSMttahhSYB74fXxI7yrdv1fpiOwsdke6A8UYl_jOglpFZZF0snnVewT3z3Er5LlcI-Roo6j-vtoGbv6kPZMrd9BUb6gl3IdqLt_Iqp2tDCCF/s1600/fern+wifi+cracker+toolwar.png" /></a></div>
<div style="text-align: justify;">
<b>Fern Wifi Cracker</b> is a <b><i>Wireless security auditing</i></b> and attack software program written using the <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> Programming Language and the Python Qt GUI library,  the program is able to crack and recover WEP/WPA/WPS keys and also run  other <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> based <a href="http://www.toolwar.com/search/label/Attack" target="_blank">attacks</a> on wireless or ethernet based networks.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Features :-</b></div>
<div style="text-align: justify;">
<ul>
<li>WEP <a href="http://www.toolwar.com/search/label/Cracking" target="_blank">Cracking</a> with Fragmentation,Chop-Chop, Caffe-Latte, Hirte, ARP Request Replay or WPS attack </li>
<li>WPA/WPA2 Cracking with Dictionary or WPS based attacks</li>
<li>Automatic saving of key in database on successful crack</li>
<li>Automatic Access Point Attack System</li>
<li>Session Hijacking (Passive and Ethernet Modes)</li>
<li>Access Point MAC Address Geo Location Tracking</li>
<li>Internal <a href="http://www.toolwar.com/search/label/MITM" target="_blank">MITM</a> Engine</li>
<li>Bruteforce Attacks (HTTP,HTTPS,TELNET,FTP)</li>
<li>Update Support</li>
</ul>
<h3>
<b>Tutorials ::  </b></h3>
<b>Session Hijacking Demonstration ::</b><br />
<b> </b> <br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/Bi-8JRNpMqo?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<b>Bruteforcing Routers with Fern-Wifi-Cracker ::</b>  <br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/_ztQQWMoVX4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<b>Cracking WEP Security with Fern-Wifi-Cracker ::</b>  <br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/vpiOPEZD6qw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<h3>
<b>Download :: </b></h3>
<b>Download Here :: </b><a href="http://code.google.com/p/fern-wifi-cracker/downloads/list" target="_blank">Fern WiFi Cracker</a> <b> </b><br />
<b>Source Website ::</b> <a href="http://code.google.com/p/fern-wifi-cracker/">http://code.google.com/p/fern-wifi-cracker/</a></div>
</div>

Fern WiFi Cracker (Wireless Security Auditing) :: Tools

Fern Wifi Cracker is a Wireless security auditing and attack software program written using the Python Programming Language and the P...

BitPim (Manage and Forensics Data of CDMA Phones) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGX39dkjXOp48ppF7W5r8iXJLZS1jOmRfKmVlp9jLAZFgaU5PIGahTf_Iiw0eutIdq4-D27rsZynrg-L2XzUbJA1o-uUt_JhAsfHSND1q85iTITrSMONIlUygkv81G4mk_Ytn8npz2r84N/s1600/BitPim.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="BitPim Screenshot" border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGX39dkjXOp48ppF7W5r8iXJLZS1jOmRfKmVlp9jLAZFgaU5PIGahTf_Iiw0eutIdq4-D27rsZynrg-L2XzUbJA1o-uUt_JhAsfHSND1q85iTITrSMONIlUygkv81G4mk_Ytn8npz2r84N/s1600/BitPim.jpg" title="BitPim Screenshot" width="400" /></a></div>
<b>BitPim</b> is a program that allows you to <b>view and manipulate       data on many CDMA phones</b> from LG, Samsung, Sanyo and other       manufacturers. This includes the PhoneBook, Calendar,       WallPapers, RingTones (functionality varies by phone) and the       Filesystem for most Qualcomm CDMA chipset based <a href="http://www.toolwar.com/search/label/Phone" target="_blank">phones</a>.<br />
<b>BitPim</b> is a free, open source, cross-platform program for viewing and editing data on a CDMA cell phone. Roger Binns was the founder, project manager, and lead developer of the project, first releasing it on March 1st, 2003. Since then leadership has been handed over to another party and over two million users have downloaded it. The program has been developed in python and originally only supported the LG VX4400 but it now supports a variety of phone manufactures including Audiovox, Kyocera, LG, Motorola, Nokia, Palm, Samsung, Sanyo, and Toshiba.<br /><br />In order to use the program, a data cable and it's drivers, usually available from the supplier/manufacturer, are required. <b>BitPim</b> will try and automatically detect a phone but its recommended that settings are manually configured.<br />
<h3>
<b>Features :: </b> </h3>
The program can examine the phonebook, calendar, media (e.g. sounds, ringers, images), memos, todo lists, SMS messages, call history, play lists, and raw filesystem from devices.<br /><br />Features are dependent on the phone model. For a full list of each phones supported features see BitPim's supported phones list.<br /><br />The data can be manipulated through the software and changes can be uploaded to the phone. Calendar, Phonebook, Memo, Todo, and Playlist data can all be imported from an external file. For backup purposes all of the data can be exported to external files.<br />
<h3>
Forensics :: </h3>
If doing a <a href="http://www.toolwar.com/search/label/Investigation" target="_blank">forensic investigation</a> the application should always be in read only mode, which claims to block all write commands to the phone. The program will not recover deleted data nor does it always recover all undeleted data. The file system view is a very important feature forensically as it allows a raw view of data from the phone, possibly uncovering data that <b>BitPim</b> missed or found unimportant. An advanced feature that could also be vital to a <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic</a> investigation is BitFling. This feature allows another computer to remotely access a phones data over the internet. A phone could be confiscated in California, connected to BitPim with BitFling configured, and be forensically analyzed in New York. Lastly exporting the data is very important so that copies of the data can be made, ensuring no data is lost or manipulated. <br />
<br /></div>
<div style="text-align: justify;">
<b>All Supported model of Phones ::</b> <a href="http://www.bitpim.org/help/" target="_blank">Click Here</a> </div>
<div style="text-align: justify;">
<b>FAQ ::</b> <a href="http://www.bitpim.org/help/faq.htm" target="_blank">Click Here</a></div>
<div style="text-align: justify;">
<b>Help and Support :: </b><a href="http://www.bitpim.org/help/support.htm" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/75tNvKLz0F8?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows | Linux | Mac :: </b><a href="http://prdownloads.sourceforge.net/bitpim/bitpim-1.0.7-setup.exe?download" target="_blank">BitPim</a> (.exe) | <a href="http://prdownloads.sourceforge.net/bitpim/bitpim-1.0.7-0.i386.rpm?download" target="_blank">BitPim</a> (.rpm) | <a href="http://prdownloads.sourceforge.net/bitpim/LEOPARD-bitpim-1.0.7.dmg?download" target="_blank">BitPim</a> (.dmg)</div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.bitpim.org/">http://www.bitpim.org/</a></div>

BitPim (Manage and Forensics Data of CDMA Phones) :: Tools

BitPim is a program that allows you to view and manipulate data on many CDMA phones from LG, Samsung, Sanyo and other manuf...

Scalpel (Data Carving / Forensics) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Scalpel File Carving" border="0" height="401" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3VpA7fvHWtvtTu1En4hyKfrQQ-P789lCCdh2-IYD099ppsXp5Vhruf9DLfp_3pcxvEU9irpL6sjH0wpQQua8wSJVqplQItpzc4tlOPDG__ydIAUTBDybUKBMBHnVX60mxAi3pbZ0zZSJD/s1600/Scalpel+Forensics.jpg" title="Scalpel File Carving" width="640" /></div>
<br />
<b>Scalpel</b> is a <b>file carving and indexing application</b> that runs on <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> and <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>.  The first version of <b>Scalpel</b>, released in 2005, was based on <a href="http://www.toolwar.com/2013/11/foremost-tools.html" target="_blank">Foremost</a> 0.69. There have been a number of internal releases since the last public release, 1.60, primarily to support our own research.  The newest public release v2.0, has a number of additional features, including:<br />
<ul>
<li>Minimum carve sizes.</li>
<li>Multithreading for quicker execution on multicore CPUs.</li>
<li>Asynchronous I/O that allows disk operations to overlap with pattern matching--this results in a substantial performance improvement.</li>
<li>Regular expression support for headers/footers.</li>
<li>Embedded header/footer matching for better processing of structured file types that may contain embedded files.</li>
<li>For advanced users, support for massively-threaded execution on Graphics Processing Units (GPUs).  This feature is available only on Linux and requires installation of the NVIDIA CUDA SDK, modification of scalpel.h to enable the GPU threading mode, and compilation with the CUDA toolchain.  Our implementation also requires an NVIDIA GPU with compute capability >= 1.2, so older CUDA-capable cards probably won't work.  The NVIDIA GTX 260 is relatively inexpensive and powerful and has the appropriate compute capability.  The GPU-enhanced version of Scalpel is able to do preview carving at rates that exceed the disk bandwidth of most file servers, so for big jobs, it may be worth the extra effort required to use this feature.  Note that regular expression-based headers and footers are NOT currently supported when GPU acceleration is in use!  We might address this in a future release.</li>
</ul>
<br />
<b>Scalpel</b> performs <a href="http://www.toolwar.com/search/label/Carving" target="_blank">file carving</a> operations based on patterns that describe particular file or data fragment "types".  These patterns may be based on either fixed binary strings or regular expressions. A number of default patterns are included in the configuration file included in the distribution, <b>"scalpel.conf"</b>.  The comments in the configuration file explain the format of the file carving patterns supported by <b>Scalpel</b>.<br />
<br />
Important note: The default configuration file, "scalpel.conf", has all supported file patterns commented out--you must edit this file before running Scalpel to activate some patterns.  Resist the urge to simply uncomment all file carving patterns; this wastes time and will generate a huge number of false positives.  Instead, uncomment only the patterns for the file types you need.<br />
<br />
<b>Scalpel </b>options are described in the <b>Scalpel</b> man page, "scalpel.1". You may also execute Scalpel w/o any <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command line</a> arguments to see a list of options.<br />
<br />
NOTE: Compilation is necessary on Unix platforms and on <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X</a>.  For Windows platforms, a precompiled scalpel.exe is provided.  If you do wish to recompile <b>Scalpel</b> on Windows, you'll need a mingw (gcc) setup. Scalpel will not compile using Visual Studio C compilers.  Note that our compilation environment for <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> is currently 32-bit; we haven't tested on the 64-bit version of mingw, but will address this int the future.<br />
<br />
<b>Other Supportive Platforms :: </b></div>
<div style="text-align: justify;">
<br />
We are not currently supporting <b>Scalpel</b> on <a href="http://www.toolwar.com/search/label/Unix" target="_blank">Unix</a> variants other than Linux. Go ahead and try a ./configure and make and see what happens, but be sure to do thorough testing before using <b>Scalpel</b> in production work.  If you are interested in supporting a version of <b>Scalpel </b>on an alternate platforms, please contact us.  If you are interested in supporting a GPU-enhanced version of Scalpel on Windows, we are also interesting in hearing from you.<br />
<br />
<b>Limitations ::</b> <br />
<br />
Carving Windows physical and logical device files (e.g., \\.\physicaldrive0 or \\.\c:) isn't currently supported because it requires us to rewrite some portions of <b>Scalpel </b>to use Windows file I/O functions rather than standard Unix calls.  This may be supported in a future release.<br />
<br />
Block map features are currently disabled, as we are rewriting this subsystem to enhance interoperability with the <a href="http://www.toolwar.com/2014/01/the-sleuth-kit-tsk-forensics-framework.html" target="_blank">Sleuthkit</a>.  An improved version of the block map features will return in a subsequent release. The -s command line option ("skip") has been removed and will be replaced with a more robust facility in the next major release.<br />
<br />
<br />
<b>Dependencies ::</b><br />
<br />
Scalpel uses the POSIX threads library.  On Win32, Scalpel is distributed with the Pthreads-win32 - POSIX Threads Library for Win32, which is Copyright(C) 1998 John E. Bossom and Copyright(C) 1999,2005 by Pthreads-win32 contributors.  This library is licensed under the LGPL.<br />
<br />
Scalpel for Win32 uses the tre regular expression library and is distributed with tre-0.7.5, which is licensed under the LGPL.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<h3>
Tutorials :: </h3>
<b>COMPILE INSTRUCTIONS ON SUPPORTED PLATFORMS :: </b><br />
<b>Linux/Mac OS X ::</b> <br />
<div style="text-align: justify;">
<span style="font-family: "Courier New",Courier,monospace;">./configure and then make</span><br />
<br />
<b>Windows :: </b> </div>
cd to src directory and then:<br />
<span style="font-family: "Courier New",Courier,monospace;">mingw32-make -f Makefile.win</span><br />
<br />
and  enjoy.  If you want to install the binary and man page in a more  permanent place, just copy "scalpel" (or "scalpel.exe") and "scalpel.1"  to appropriate locations, e.g., on Linux, "/usr/local/bin" and  "/usr/local/man/man1", respectively.  On Windows, you'll also need to  copy the pthreads and tre regular expression library dlls into the same  directory as "scalpel.exe".<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/5Z9JsBazOdw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
</div>
<div style="text-align: justify;">
<b>Linux | Windows | Mac :: </b><a href="https://github.com/sleuthkit/scalpel/archive/master.zip" target="_blank">Scalpel</a> (.zip)<b>
</b></div>
<div style="text-align: justify;">
<b>Official Website :: </b> <a href="https://github.com/sleuthkit/scalpel">https://github.com/sleuthkit/scalpel</a></div>

Scalpel (Data Carving / Forensics) :: Tools

Scalpel is a file carving and indexing application that runs on Linux and Windows . The first version of Scalpel , released in 2005,...

Bulk Extractor (Computer Forensics) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Bulk Extractor" border="0" height="267" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSwFRjzP4nYzs-ILiilqCBkm5oZiif74oCtqJU8AR5h2mTI_uHT4qyVykTzAKntroljTwfaPMVl2vcJLfpgcd6GaTRTidtiwi8dgXrG0Sp6F0pMD2_DCiaA94q7R02Bz4t8-nz_dhg07WE/s1600/computer-forensic-analysis.jpg" title="Bulk Extractor" width="400" /></div>
<div style="text-align: justify;">
<b>Bulk Extractor</b> is a <b>computer forensics tool</b> that scans a disk  image, a file, or a directory of files and extracts useful information  without parsing the file system or file system structures. The results  can be easily inspected, parsed, or processed with automated tools. <b>Bulk Extractor</b>  also created a histograms of features that it finds, as features that  are more common tend to be more important. The program can be used for  law enforcement, defense, intelligence, and <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">cyber-investigation</a>  applications. </div>
<div style="text-align: justify;">
bulk_extractor is distinguished from other forensic tools by its  speed and thoroughness. Because it ignores file system structure, <b>Bulk Extractor</b> can process different parts of the disk in parallel. In  practice, the program splits the disk up into 16MiByte pages and  processes one page on each available core. This means that 24-core  machines process a disk roughly 24 times faster than a 1-core machine. <b>Bulk Extractor</b> is also thorough. That’s because <b>Bulk Extractor</b>  automatically detects, decompresses, and recursively re-processes  compressed data that is compressed with a variety of algorithms. Our  <a href="http://www.toolwar.com/search/label/Testing" target="_blank">testing</a> has shown that there is a significant amount of compressed data  in the unallocated regions of file systems that is missed by most  <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic tools</a> that are commonly in use today. </div>
<div style="text-align: justify;">
Another advantage of ignoring file systems is that <b>Bulk Extractor</b>  can be used to process any digital media. We have used the program to  process hard drives, SSDs, optical media, camera cards, <a href="http://www.toolwar.com/search/label/Phone" target="_blank">cell phones</a>,  network packet dumps, and other kinds of digital information. </div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;"><b>Compiling for MacOS or Linux</b> :: </span></span></div>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;">From the downloaded source directory run bootstrap.sh, configure and make: </span></span> </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ cd bulk_extractor </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sh bootstrap.sh </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sh configure </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ make </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo make install </span></li>
</ul>
<div style="text-align: justify;">
<b>Compiling for Windows :: </b></div>
<div style="text-align: justify;">
There are three ways to compile for Windows: </div>
<div style="text-align: justify;">
1. Cross-compiling from a Linux or Mac system with mingw. </div>
<div style="text-align: justify;">
2. Compiling natively on Windows using mingw. </div>
<div style="text-align: justify;">
3. Compiling natively on Windows using cygwin (untested)</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Cross-compiling for Windows using Debian Testing (wheezy) or Ubuntu 12.04 LTS (with mingw) :: </b></div>
<div style="text-align: justify;">
You will need to install mingw-w64 and zlib-dev: </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo apt-get update </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo apt-get upgrade </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo apt-get -y install mingw-w64 </span></li>
</ul>
<div style="text-align: justify;">
Next, download zlib from zlib.net </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ ./configure --host=i686-w64-mingw32 </span></li>
</ul>
<div style="text-align: justify;">
This allows the cross-compiling of the 64-bit and the 32-bit bulk_extractor.exe, although we do not recommend running the 32-bit version. </div>
<div style="text-align: justify;">
Now you are ready to compile: </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ git clone --recursive https://github.com/simsong/bulk_extractor.git </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ cd bulk_extractor </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sh bootstrap.sh </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ mingw64-configure</span></li>
</ul>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Installing on a Linux/MacOS/Mingw system :: </b></div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ ./configure </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ make </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo make install  </span></li>
</ul>
<div style="text-align: justify;">
<b>Usages :: </b> </div>
<div style="text-align: justify;">
To get started and send an extract of image.raw to OUTPUT, use this command: </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ /usr/local/bin/bulk_extractor -o OUTPUT image.raw </span> </li>
</ul>
<div style="text-align: justify;">
<b>For more & Troubleshooting :: </b><a href="https://github.com/simsong/bulk_extractor" target="_blank">Click Here</a><br />
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/wTBHM9DeLq4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux | Mac | Windows :: </b><a href="https://github.com/simsong/bulk_extractor/archive/master.zip" target="_blank">Bulk Extractor</a> (tarball)<b> | </b><a href="http://digitalcorpora.org/downloads/bulk_extractor/bulk_extractor-1.4.1-windowsinstaller.exe" target="_blank">Bulk Extractor</a> (.exe)<b> | </b><a href="http://digitalcorpora.org/downloads/bulk_extractor/bulk_extractor-1.4.4.tar.gz" target="_blank">Bulk Extractor</a> (.tar.gz)<b>
</b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="https://github.com/simsong/bulk_extractor">https://github.com/simsong/bulk_extractor</a></div>

Bulk Extractor (Computer Forensics) :: Tools

Bulk Extractor is a computer forensics tool that scans a disk image, a file, or a directory of files and extracts useful information ...

AndiParos (Web Application Security Assessments) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjH1vpXX0DjZZItydH0KB9zNnfXlCbRkY7UWHW5FiqbE4Hx-kZMJEJs4iZIKQXj74FOKOYKrBbA0ws0u1Dw5qCx02GfzGD3M8_BRJhHOetEmnneVAQP2WANvMYpwj_5WJdX8W1M8Ndcsq2S/s1600/Andiparos_Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="AndiParos Screenshot" border="0" height="307" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjH1vpXX0DjZZItydH0KB9zNnfXlCbRkY7UWHW5FiqbE4Hx-kZMJEJs4iZIKQXj74FOKOYKrBbA0ws0u1Dw5qCx02GfzGD3M8_BRJhHOetEmnneVAQP2WANvMYpwj_5WJdX8W1M8Ndcsq2S/s1600/Andiparos_Screenshot.png" title="AndiParos Screenshot" width="400" /></a></div>
<div style="text-align: justify;">
<b>Andiparos</b> is a fork of the famous <a href="http://www.toolwar.com/2013/09/paros-proxy-tools.html" rel="" target="_blank">Paros Proxy</a>.
 It is an open source <b>web application security assessment tool</b> that 
gives <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">penetration</a> testers the ability to spider websites, analyze 
content, intercept and modify requests, etc. </div>
<div style="text-align: justify;">
The advantage of 
<b>Andiparos</b> is mainly the support of Client Certificates on Smartcards. 
Moreover it has several small interface enhancements, making the life 
easier for penetration testers... </div>
<div style="text-align: justify;">
Features: </div>
<ul style="text-align: justify;">
<li>Smartcard support </li>
<li>BeanShell support </li>
<li>History Filter (URLs) </li>
<li>Passive Scanner </li>
<li>Advanced search functionality </li>
<li>MultiTags for request/response </li>
<li>Mark Request/Response </li>
<li>Better<a href="http://www.toolwar.com/search/label/Mac" target="_blank"> Mac OS X</a> integration </li>
<li>other nice enhancements... </li>
</ul>
<h3>
Tutorials ::</h3>
<b>Wiki ::</b> <a href="https://code.google.com/p/andiparos/w/list" target="_blank">Click Here</a>  <br />
<h3>
Download ::</h3>
<b>Linux | Windows | Mac :: </b><a href="https://code.google.com/p/andiparos/downloads/detail?name=Andiparos-1.0.6.zip" target="_blank">Andiparos v1.0.6</a> (.zip) | <a href="https://code.google.com/p/andiparos/downloads/detail?name=Andiparos-1.0.6-Installer.exe" target="_blank">Andiparos v1.0.6</a> (.exe) | <a href="https://code.google.com/p/andiparos/downloads/detail?name=Andiparos-v1.0.6.dmg" target="_blank">Andiparos v1.0.6</a> (.dmg) <br />
<b>Source Website :: </b><a href="https://code.google.com/p/andiparos/">https://code.google.com/p/andiparos/</a>

AndiParos (Web Application Security Assessments) :: Tools

Andiparos is a fork of the famous Paros Proxy . It is an open source web application security assessment tool that gives penetration ...

FS-NyarL (Pentesting and Forensics) :: Framework

<div class="separator" style="clear: both; text-align: center;">
<img alt="FS-NyarL Logo" border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyvqhfIV1vfEKDsDPoTq-IY5y6kdJuGAIfRzvtSPL90-6xtK2hDdppU1kPwgvztn_cudPZFcOqOalRYynOeDEflS5wufjqugLOyzJNrbZhqLjb34aHNnZuPJhRLZ_SInYW0BFppZeFQqDm/s1600/FS-NyarL+Logo.jpg" title="FS-NyarL Logo" width="248" /></div>
<div style="text-align: justify;">
<b>NyarL</b> it's Nyarlathotep, a mitological chaotic deity of the writer HP. Lovecraft's cosmogony.  It's represent Crawling Chaos and <b>FS-NyarL</b> it's The <b>Crawling Chaos of Cyber Security</b>. A <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> takeover & <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic analysis tool</a> - useful to advanced  PenTest tasks & for fun and profit - but use it at your own risk! </div>
<ul style="text-align: justify;">
<li>Interactive Console</li>
<li>Real Time Passwords Found</li>
<li>Real Time Hosts Enumeration</li>
<li>Tuned Injections & Client Side Attacks</li>
<li>ARP Poisoning & SSL Hijacking</li>
<li>Automated HTTP Report Generator</li>
</ul>
<div style="text-align: justify;">
<b>ATTACKS IMPLEMENTED:</b> </div>
<ul style="text-align: justify;">
<li>MITM (Arp Poisoning)</li>
<li>Sniffing (With & Without Arp Poisoning)</li>
<li>SSL Hijacking (Full SSL/TLS Control)</li>
<li>HTTP Session Hijaking (Take & Use Session Cookies)</li>
<li>Client Browser Takeover (with Filter Injection in data stream)</li>
<li>Browser AutoPwn (with Filter Injection in data steam)</li>
<li>Evil Java Applet (with Filter Injection in data stream)</li>
<li>DNS Spoofing</li>
<li>Port Scanning</li>
</ul>
<table class="notableborder" style="margin-left: 0px; margin-right: 0px; text-align: left;"><tbody>
<tr><td colspan="2"><b>POST ATTACKS DATA OBTAINED:</b><br />
<ul>
<li>Passwords extracted from data stream</li>
<li>Pcap file with whole data stream for deep analysis</li>
<li>Session flows extracted from data stream (Xplico & Chaosreader)</li>
<li>Files extracted from data stream</li>
<li>Hosts enumeration (IP,MAC,OS)</li>
<li>URLs extracted from data stream</li>
<li>Cookies extracted from data stream</li>
<li>Images extracted from data stream</li>
<li>List of HTTP files downloaded extracted from URLs</li>
</ul>
</td> </tr>
<tr><td><b>DEPENDENCIES (aka USED TOOLS):</b><br />
<ul>
<li>Chaosreader (already in bin folder)</li>
<li><a href="http://www.toolwar.com/2013/11/xplico-tools.html" target="_blank">Xplico</a></li>
<li><a href="http://www.toolwar.com/2013/09/ettercap-076-tools.html" target="_blank">Ettercap</a></li>
<li>Arpspoof</li>
<li>Arp-scan</li>
<li>Mitmproxy</li>
<li><a href="http://www.toolwar.com/2014/02/nmap-and-zenmap-network-discovery-and.html" target="_blank">Nmap</a></li>
<li><a href="http://www.toolwar.com/2013/09/tcpdump-is-network-sniffer-we-all-used.html" target="_blank">Tcpdump</a></li>
<li><a href="http://www.toolwar.com/2013/09/beef-browser-exploitation-framework.html" target="_blank">Beef</a></li>
</ul>
</td> <td><ul>
<li><a href="http://www.toolwar.com/2013/10/social-engineering-toolkit-set-tools.html" target="_blank">SET</a></li>
<li><a href="http://www.toolwar.com/2013/09/metasploit-framework.html" target="_blank">Metasploit</a></li>
<li><a href="http://www.toolwar.com/2013/09/dsniff-tools.html" target="_blank">Dsniff</a></li>
<li><a href="http://www.toolwar.com/2013/10/technitium-mac-address-changer-v6-tools.html" target="_blank">Macchanger</a></li>
<li>Hamster</li>
<li>Ferret</li>
<li><a href="http://www.toolwar.com/2013/10/p0f-tools.html" target="_blank">P0f</a></li>
<li><a href="http://www.toolwar.com/2013/11/foremost-tools.html" target="_blank">Foremost</a></li>
<li>SSLStrip</li>
<li><a href="http://www.toolwar.com/2014/02/sslsplit-mitm-attack-against-ssltls.html" target="_blank">SSLSplit</a></li>
</ul>
</td></tr>
</tbody></table>
<br />
<table class="notableborder" style="margin-left: 0px; margin-right: 0px; text-align: left;"><tbody>
<tr><td><h3>
Tutorials ::</h3>
<b>Screenshots ::  </b><a href="http://www.fulgursecurity.com/en/content/fs-nyarl" target="_blank">Click Here</a> <br />
<h3>
Download ::</h3>
<b>Linux ::</b> <a href="http://www.fulgursecurity.com/tools/fs-nyarl/FS-NyarL_v1.0-kali.tar.gz" target="_blank">FS-NyarL v1.0</a> (.tar.gz)<br />
<b>Official Website :: </b><a href="http://www.fulgursecurity.com/en/content/fs-nyarl">http://www.fulgursecurity.com/en/content/fs-nyarl</a></td></tr>
</tbody></table>

FS-NyarL (Pentesting and Forensics) :: Framework

NyarL it's Nyarlathotep, a mitological chaotic deity of the writer HP. Lovecraft's cosmogony. It's represent Crawling Chaos...

FARADAY (Integrated Penetration Testing IDE) :: Framework

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="FARADAY Logo" border="0" height="91" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj03zjrenjfh3-P90KLn_GSw8ONyaQLqXdR6otoyPAiIMj1ETcLzdJpofOdDKILtTGY6U_4FS4zlEyLZEVF0IEjyTWLMkZrm9wa3U-YS1L8K8A1NQO_j0muNmj9wiuSaqph9OyYKddiOc-f/s1600/Faraday-Logo.png" title="FARADAY Logo" width="400" /></div>
<b>Faraday</b> introduces a new concept (IPE) <b>Integrated Penetration-Test  Environment</b> a multiuser <b>Penetration test IDE</b>. Designed for distribution,  indexation and analysis of the generated data during the process of a <a href="http://www.toolwar.com/search/label/Security" target="_blank"> security audit</a>.</div>
<div style="text-align: justify;">
The main purpose of <b>Faraday</b> is to re-use the available tools in the community to take advantage of them in a multiuser way.</div>
<div style="text-align: justify;">
Design for simplicity, users should feel no difference between their  own terminal application and the one included in <b>Faraday</b>. Developed with  a specialized set of functionalities that help users improve their own  work. Do you remember yourself programming without an IDE? Well, <b>Faraday</b>  does the same an IDE does for you when programming, but from the  perspective of a <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">penetration test</a>.</div>
<div style="text-align: justify;">
<br />
<b>Requirement ::  </b></div>
<div style="text-align: justify;">
<a href="http://www.toolwar.com/search/label/Linux" target="_blank">Modern Linux</a> (Tested Debian / Ubuntu  * / <a href="http://www.toolwar.com/2013/09/kali-linux-toolwar.html" target="_blank">Kali</a> / <a href="http://www.toolwar.com/2013/09/backtrack-5-r3-distribution.html" target="_blank">Backtrack</a>)</div>
<ul style="text-align: justify;">
<li>Python 2.6.x and 2.7.x</li>
<li>Qt3</li>
<li>CouchDB >= 1.2.0<br />
</li>
<li>The following python libs:  <ul>
<li>mockito </li>
<li>couchdbkit </li>
<li>whoosh </li>
<li>argparse </li>
<li>psycopg2</li>
<li>IPy</li>
<li>requests</li>
</ul>
<h3>
</h3>
</li>
</ul>
<h3 style="text-align: justify;">
Tutorials :: </h3>
<div style="text-align: justify;">
<b>Installation :: </b> </div>
<div style="text-align: justify;">
Preferably, you can download faraday by cloning the Git repository:</div>
<div style="text-align: justify;">
<pre><code>$ git clone https://github.com/infobyte/faraday.git faraday-dev
$ cd faraday-dev
$ ./install
</code></pre>
</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Usage :: </b></div>
<div style="text-align: justify;">
To get started, simply execute faraday and use the new console to start working in the pentest: </div>
<div style="text-align: justify;">
<pre><code>$ ./faraday</code></pre>
<pre><code> </code></pre>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/EBz0g6ya7Mg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
</div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="https://github.com/infobyte/faraday/archive/master.zip" target="_blank">Faraday</a> (tarball) <b>
</b></div>
<div style="text-align: justify;">
<b>Source Website :: </b><a href="https://github.com/infobyte/faraday">https://github.com/infobyte/faraday</a></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.faradaysec.com/">http://www.faradaysec.com/</a></div>

FARADAY (Integrated Penetration Testing IDE) :: Framework

Faraday introduces a new concept (IPE) Integrated Penetration-Test Environment a multiuser Penetration test IDE . Designed for distrib...

SIPVicious (Auditing SIP Based VoIP System) :: Tools

<div style="text-align: justify;"><div class="separator" style="clear: both; text-align: center;"><img alt="SIP VoIP " border="0" height="324" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs5pKQQ6VdyR7URrQT6nS1VVL0igxhRv5L4g9jfkKRkBLjfBegI6eKZANJ63AqMiWYIf8m2YEb8azNj4j9bwx-gCWo_jYM66n1k2GggJOHg0mLwLS0hJ7h7UWskxn3gWk6PAqEtxcvgABJ/s1600/SIP+VoIP.png" title="SIP VoIP " width="640" /></div><b>SVMAP</b> is a part of a suite of tools called <b>SIPVicious</b> and it’s my  favorite <a href="http://www.toolwar.com/search/label/Scanner" target="_blank">scanner</a> of choice It can be used to scan identify and fingerprint a single IP or a range  of IP addresses. <b>Svmap</b> allows specifying the request method which is being used for  scanning, the default method is OPTIONS, it offers debug and verbosity  options and even allows scanning the SRV records for SIP on the  destination domain. You can use the <b>./svmap –h</b> in order to view all the available arguments </div><div style="text-align: justify;"><b>SIPVicious suite</b> is a set of <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a> that can be used to audit SIP based <a href="http://www.toolwar.com/search/label/VOIP" target="_blank">VoIP systems</a>.  It currently consists of four tools: </div><ul style="text-align: justify;"><li>svmap - this is a sip scanner. Lists SIP devices found on an IP range </li>
<li>svwar - identifies active extensions on a PBX </li>
<li>svcrack - an online password cracker for SIP PBX </li>
<li>svreport - manages sessions and exports reports to various formats </li>
<li>svcrash - attempts to stop unauthorized svwar and svcrack scans </li>
</ul><div style="text-align: justify;">It was tested on the following systems: </div><ul style="text-align: justify;"><li><a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux </a></li>
<li><a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X </a></li>
<li><a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows </a></li>
<li><a href="http://www.toolwar.com/search/label/FreeBSD" target="_blank">FreeBSD 6.2 </a></li>
<li>Jailbroken iPhone with python installed </li>
</ul><div style="text-align: justify;">If you use it on systems that are not mentioned here please let me know goes it goes. </div><h3 style="text-align: justify;">Tutorials ::</h3><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/Zp_gzjV8l4c?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div><div style="text-align: justify;"></div><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/3a7xJeNQfOk?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div><h3 style="text-align: justify;"> </h3><h3 style="text-align: justify;">Download ::</h3><div style="text-align: justify;"><b>Linux | Windows | Mac | FreeBSD :: </b><a href="http://sipvicious.googlecode.com/files/sipvicious-0.2.8.zip" target="_blank">SIPVicious v0.2.8</a> (.zip) | <a href="http://sipvicious.googlecode.com/files/sipvicious-0.2.8.tar.gz" target="_blank">SIPVicious v0.2.8</a> (.tar.gz)<b>
</b></div><div style="text-align: justify;"><b>Official Website :: </b> <a href="http://code.google.com/p/sipvicious/">http://code.google.com/p/sipvicious/</a></div>

SIPVicious (Auditing SIP Based VoIP System) :: Tools

SVMAP is a part of a suite of tools called SIPVicious and it’s my favorite scanner of choice It can be used to scan identify and fingerp...

VoIPong (VoIP Sniffer and Call Detector) :: Tools

<div class="separator" style="clear: both; text-align: center;"><img alt="VoIP Hacking " border="0" height="337" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBxH793kkyuODvT2YM2SvDUf4q_9lL0i3cTdtxNEAo0qVv-QShCchSo0Ehnp75muGHbqnHldC6K2_wNn69CsW7RtQY-YphAkIyGJe1_VtlepwwSyy73nzn1i4ezE1fZdcy-tCJ8QdLUlCp/s1600/VoIP+Hacking.jpg" title="VoIP Hacking " width="640" /></div><div class="style3" style="text-align: justify;"><b>VoIPong</b> is a utility which detects all <b><a href="http://www.toolwar.com/search/label/VOIP" target="_blank">Voice Over IP</a> calls  on a pipeline</b>, and for those which are G711 encoded, dumps actual  conversation to seperate wave files. It supports SIP, H323, Cisco's  Skinny Client Protocol, RTP and RTCP. </div><div class="style3" style="text-align: justify;">It's been written in C language for performance reasons, proved  to be running on Solaris, <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> and <a href="http://www.toolwar.com/search/label/FreeBSD" target="_blank">FreeBSD</a>; though it's thought to compile  and run on other platforms as well. </div><div class="style3" style="text-align: justify;">On a 45 Mbit/sec network traffic, it's been verified  that <b>VoIPong</b> successfully detected all <a href="http://www.toolwar.com/search/label/VOIP" target="_blank">VoIP </a>gateways and the VoIP calls.   CPU utilization during the run has been found ranging between 66% - 80%  on a 256MB RAM, Celeron 1700 Mhz Toshiba notebook. </div><span class="style1"><b>Features :: </b></span><br />
<ul><li class="style2">Produces real .Wav files for direct audio hearing. </li>
<li class="style2">Simple, optimized, extandable fast code </li>
<li class="style2">The algorithm doesn't depend on signalling but on RTP/RTCP      </li>
<li class="style2">Detailed logging. (Comfortable for 'cut' and 'cat' operations to produce statistics.)      </li>
<li class="style2">Powerful management console interface      </li>
<li class="style2">Easy installation and administration</li>
<li class="style2">Easy debugging.    </li>
</ul><h3 class="style3" style="text-align: justify;">Tutorials ::</h3><b>Users Manual ::</b> <a href="http://www.enderunix.org/voipong/users-manual/" target="_blank">Click Here</a><br />
  <br />
<div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/ow1bRp6E8og?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 class="style3" style="text-align: justify;">Download ::</h3><div class="style3" style="text-align: justify;"><b>Linux :: </b><a href="https://github.com/EnderUNIX/VoIPong/archive/master.zip" target="_blank">VoIPong v2.0</a></div><div class="style3" style="text-align: justify;"><b>Official Website :: </b><a href="http://www.enderunix.org/voipong/">http://www.enderunix.org/voipong/</a></div>

VoIPong (VoIP Sniffer and Call Detector) :: Tools

VoIPong is a utility which detects all Voice Over IP calls on a pipeline , and for those which are G711 encoded, dumps actual conversati...

NBTScan (Scans for Open NETBIOS Name Servers) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdxS-BqEkVq8gRluzMKok1FYN4f43CO1Nnia5lF4ZTvXelpQ-Z0lC0lJaBxzhpiwFLZgrk16y7re7wk-pbt1ZcUl405HynotcqrIyBXTQdkdqkzndKFNmdELfpOXIW8jXlCv-B8F8Geaxp/s1600/nbtscan+screenshot.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nbtscan screenshot windows" border="0" height="333" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdxS-BqEkVq8gRluzMKok1FYN4f43CO1Nnia5lF4ZTvXelpQ-Z0lC0lJaBxzhpiwFLZgrk16y7re7wk-pbt1ZcUl405HynotcqrIyBXTQdkdqkzndKFNmdELfpOXIW8jXlCv-B8F8Geaxp/s1600/nbtscan+screenshot.gif" title="nbtscan screenshot windows" width="400" /></a></div>
<div style="text-align: justify;">
<b>nbtscan</b> is a <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command-line tool</a> that scans for open <b>NETBIOS nameservers</b> on a local or remote TCP/IP <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>, and this is a first step in finding of open shares. It is based on the functionality of the standard <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows tool</a> nbtstat, but it operates on a range of addresses instead of just one. I wrote this <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tool</a> because the existing tools either didn't do what I wanted or ran only on the Windows platforms: mine runs on just about everything.</div>
<div style="text-align: justify;">
<b>Windows</b> - The Win32 version of the tool, which works well on Windows 9x,
NT and 2000, is available below as nbtscan.exe.
It's written in portable C and is less than 40 kbytes, requires no
special libraries or DLLs, and is run in an MS-DOS command window. I
promise that the tools have no viruses, backdoors, or any other kind of
overt bad behavior.  I don't promise that there are no bugs.
</div>
<div style="text-align: justify;">
<b>LINUX</b> - the code works fine on <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, and a version built on Red
Hat Linux 6.2 is available as well. I have reports that this binary works on
Red Hat Linux 6.0 - 8.0, Debian "woody", and Mandrake 8.1 (we don't think
we've found a Red Hat, CentOS, or Fedora system that it didn't run on).
</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<pre class="codeblock">C:\> <b>nbtstat -A 192.168.1.99</b>
       NetBIOS Remote Machine Name Table

Name               Type         Status
---------------------------------------------
XPDEV          <00>  UNIQUE      Registered
UNIXWIX        <00>  GROUP       Registered
XPDEV          <03>  UNIQUE      Registered
XPDEV          <20>  UNIQUE      Registered
UNIXWIX        <1E>  GROUP       Registered

MAC Address = 00-50-04-6D-50-37</pre>
<pre class="codeblock"> </pre>
<pre class="codeblock">C:\> <b>nbtscan 192.168.1.0/24</b>
192.168.1.3     MTNDEW\WINDEV               SHARING DC
192.168.1.5     MTNDEW\TESTING
192.168.1.9     MTNDEW\WIZ                  SHARING U=STEVE
192.168.1.99    MTNDEW\XPDEV                SHARING </pre>
<h3 style="text-align: justify;">
</h3>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows | Linux :: </b><a href="http://www.unixwiz.net/tools/nbtscan-1.0.35.exe" target="_blank">NBTScan</a> (.exe)<b> | </b><a href="http://www.unixwiz.net/tools/nbtscan-source-1.0.35.tgz" target="_blank">NBTScan</a> (.tgz)</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.unixwiz.net/tools/nbtscan.html">http://www.unixwiz.net/tools/nbtscan.html</a></div>

NBTScan (Scans for Open NETBIOS Name Servers) :: Tools

nbtscan is a command-line tool that scans for open NETBIOS nameservers on a local or remote TCP/IP network , and this is a first step ...

URLCrazy (Check for Mistyped Domain Names) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyLyWDBoVsveQYb2dGL_PuWnsuRw1nokIuQKd_361RbcaREom6CLNFECgU-VoE2dThMoAADFfaWbckc79TaK68iLysT77s5PgM_l4a921ztqCrvKcHKXbTMWJbRjSlQJx2KE-BebY_gUjr/s1600/URLCrazy+Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="URLCrazy Screenshot" border="0" height="339" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyLyWDBoVsveQYb2dGL_PuWnsuRw1nokIuQKd_361RbcaREom6CLNFECgU-VoE2dThMoAADFfaWbckc79TaK68iLysT77s5PgM_l4a921ztqCrvKcHKXbTMWJbRjSlQJx2KE-BebY_gUjr/s1600/URLCrazy+Screenshot.png" title="URLCrazy Screenshot" width="640" /></a></div>
<div style="text-align: justify;">
<b>URLCrazy</b> checks for mistyped domain names of websites.  It can detect 
typo domain squatters and help protect your domain <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> by 
identifying domain names to preemptively register.  It generates 15 
types of typos, including bitflipped domains, knows over 8,000 common 
misspellings and over 450 homophones, supports multiple keyboard 
layouts, checks whether a typo is a valid domain, and can test whether 
domain typos are in use and estimate the popularity of a typo.

Generate and test domain typos and variations to detect and perform 
typo squatting, URL hijacking, phishing, and corporate espionage.</div>
<h3 style="text-align: justify;">
Usage </h3>
<div style="text-align: justify;">
* Detect typo squatters profiting from typos on your domain name<br />
* Protect your brand by registering popular typos<br />
* Identify typo domain names that will receive traffic intended for another domain<br />
* Conduct phishing attacks during a <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">penetration test</a></div>
<h3 style="text-align: justify;">
Features</h3>
<div style="text-align: justify;">
* Generates 15 types of domain variants<br />
* Knows over 8000 common misspellings<br />
* Supports cosmic ray induced bit flipping<br />
* Multiple keyboard layouts (qwerty, azerty, qwertz, dvorak)<br />
* Checks if a domain variant is valid<br />
* Test if domain variants are in use<br />
* Estimate popularity of a domain variant<br />
* URLCrazy requires Linux and the Ruby interpreter.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<b>Installation :: </b><br />

<span style="font-family: "Courier New",Courier,monospace;">If you are using Ubuntu or Debian try:<br />
 $ sudo apt-get install ruby-1.8</span><br />
  <br />
<h3>
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://www.morningstarsecurity.com/downloads/urlcrazy-0.5.tar.gz" target="_blank">URLCrazy v0.5</a> (.tar.gz)</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.morningstarsecurity.com/research/urlcrazy">http://www.morningstarsecurity.com/research/urlcrazy</a></div>

URLCrazy (Check for Mistyped Domain Names) :: Tools

URLCrazy checks for mistyped domain names of websites. It can detect typo domain squatters and help protect your domain security by ...

Vyatta (Vitrual Router, Firewall and VPN) :: Framework

<div class="block-content content" style="text-align: justify;">
<div style="text-align: justify;">
<br />
<article class="article article-type-page clearfix" id="article-6745" role="article">                 <div class="article-content">
<div class="field field-name-body field-type-text-with-summary field-label-hidden">
<div class="field-items">
<div class="field-item even">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Vyatta Logo" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjZ08VeGbo_xXjPTm80en0xpKtHVEsztocx4UkyNj8XcEOklwOsoLpOrOJ9RIi5nqp4y9IlAQ4uUUssHWFzDRGtuowfzaD9ujUFVSNWPnhTLhA8CJf3JethTM45UNfDaSOy-aplzk6SivT/s1600/vyatta+logo.png" title="Vyatta Logo" width="320" /></div>
The  free community <b>Vyatta Core software(VC)</b> is an award-winning open source <a href="http://www.toolwar.com/search/label/Network" target="_blank"> network</a> operating system providing advanced IPv4 and IPv6 routing,  stateful <a href="http://www.toolwar.com/search/label/Firewalls" target="_blank">firewalling</a>, IPSec and SSL OpenVPN, and more. When you add  <b>Vyatta</b> to a standard x86 hardware system, you can create an enterprise  grade network appliance that easily scales from DSL to 10Gbps. <b>Vyatta</b> is  also optimized to run in VMware, Citrix XenServer, Xen, KVM, and Hyper  V, providing networking and <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> services to <a href="http://www.toolwar.com/search/label/Virutal" target="_blank">virtual machines</a> and  cloud computing environments. <b>Vyatta</b> has been downloaded over 1,000,000  times, has a community of hundreds of thousands of registered users and  counts dozens of fortune 500 businesses among its commercial customers.<br />
On this site, you'll find all the downloads, <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a>, documentation,  and community resources to help you get up and running with your own  <b>Vyatta-based</b> system. Ask questions in the Forums. Propose new features  and vote on existing proposals. Participate and have fun. We have been  working together with our community for over five years to continue to  enhance the world's leading software-based network OS.<br />
A commercial version of the <b>Vyatta network OS</b> (Vyatta Subscription  Edition) is also available with enterprise-ready management and security  product extensions and complete engineering support including proactive  notifications of security alerts and software releases as well as  priority access to patches & bug fixes.<br />
<b>Vyatta's </b>open, software-based approach to networking has created a  complete network OS that can connect and secure physical <a href="http://www.toolwar.com/search/label/Network" target="_blank">networks</a> as  well as virtual and cloud computing infrastructures. <b>Vyatta</b> software and  appliances offer users a flexible, affordable alternative to  proprietary, hardware-based routers, firewalls, and VPN devices.<br />
Vyatta can help you: <br />
<ul>
<li>Affordably scale large BGP implementations </li>
<li>Keep your network safe with a stateful-inspection firewall </li>
<li>Securely connect remote offices with <a href="http://www.toolwar.com/search/label/VPN" target="_blank">VPN </a></li>
<li>Scale from DSL to 10-Gbps with a single software package</li>
<li>Avoid costly proprietary networking upgrades </li>
<li>Run virtualized networking environments in Xen, KVM and VMware </li>
<li>Add networking and security to blade servers in your data center </li>
<li>Offer cloud based managed security services </li>
<li>Add network redundancy regardless of vendor equipment </li>
<li>Build your own best-of-breed Branch office solution </li>
</ul>
<br />
The <b>Vyatta Core</b> is an integration of a number of components from a  variety of different sources, much the same way as a standard Linux  distribution. Many of the components are licensed under the GNU GPL.  Others carry a BSD license. Still others carry less-popular licenses.  All components of the <b>Vyatta Core</b> carry licenses defined as open source.<br />
License files are included with every package installed in the system  and can be viewed in the /usr/share/doc/package/copyright file.<br />
<br />
<h3>
Tutorials ::</h3>
<b>Use Tips and Tricks :: </b><a href="http://www.vyatta.org/documentation/tips-tricks" target="_blank">Click Here</a><b><br />
</b><br />
<b>Documentations :: </b><a href="http://www.vyatta.org/documentation/translated-docs" target="_blank">Click Here</a><br />
<b>Vyatta Forum :: </b><a href="http://www.vyatta.org/forum" target="_blank">Click Here</a> <br />
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div style="text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/5JJOE5zeVbM?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<h3>
Download ::</h3>
<b>Live CD :: </b><a href="http://packages.vyatta.com/vyatta/iso/VC6.6/vyatta-livecd_VC6.6R1_i386.iso" target="_blank">Vyatta Live CD v6.6</a> (.iso)<b></b><br />
<b>Visualization ISO :: </b><a href="http://packages.vyatta.com/vyatta/iso/VC6.6/vyatta-livecd_VC6.6R1_i386.iso" target="_blank">Vyatta Visualization v6.6</a> (.iso)<b> </b>
<b> </b><br />
<b>Official Website ::<a href="https://www.blogger.com/goog_2084089245"> </a></b><a href="http://www.vyatta.org/">http://www.vyatta.org/</a>
</div>
</div>
</div>
</div>
</article></div>
</div>

Vyatta (Vitrual Router, Firewall and VPN) :: Framework

The free community Vyatta Core software(VC) is an award-winning open source network operating system providing...

Nagios XI (System and Network Monitoring) :: Tools

<div style="text-align: justify;"><div class="separator" style="clear: both; text-align: center;"><img alt="Nagios Logo" border="0" height="139" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijPJbT23GqEsND51gYYV9dlritrv4VMN0Y_kXrjsPpMF35HF9jV7QqyVxhKZU5jyF825HFNPBEghQzSXXvo9xLLhE3Hc1ybP9g6HiYYyh2rdXCLL-4OPuEAaCQhLgw9nJ8CBXoG1BT6l5L/s1600/xi-logo-large.png" title="Nagios Logo" width="320" /></div><b>Nagios XI </b>is a system and <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">network monitoring</a> application. It watches hosts  and services that you specify, alerting you when things go bad and when  they get better. Some of its many features include monitoring of <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>  services (SMTP, POP3, HTTP, NNTP, ICMP, etc.), monitoring of host  resources (processor load, disk usage, etc.), and contact notifications  when service or host problems occur and get resolved (via email, pager,  or user-defined method).</div><div style="text-align: justify;"><b>With Nagios you can:</b>  </div><ul style="padding-left: 25px;"><li>Monitor your entire IT infrastructure</li>
<li>Spot problems <i>before</i> they occur</li>
<li>Know immediately when problems arise</li>
<li>Share availability data with stakeholders</li>
<li>Detect security breaches</li>
<li>Plan and budget for IT upgrades</li>
<li>Reduce downtime and business losses</li>
</ul><div style="text-align: justify;"><br />
</div><h3 style="text-align: justify;">Tutorials ::</h3><div style="text-align: justify;"><b>Text Tutorials :: </b><a href="http://library.nagios.com/library/products/nagiosxi/tutorials/" target="_blank">Click Here </a> </div><div style="text-align: justify;"><b>Documentation :: </b><a href="http://library.nagios.com/library/products/nagiosxi/documentation" target="_blank">Click Here</a> </div><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/mXUxXV17Nd4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div><div style="text-align: justify;">
</div><h3 style="text-align: justify;">Download ::</h3><div style="text-align: justify;"><b>Windows | Linux  :: </b><a href="http://library.nagios.com/library/products/nagiosxi/downloads/main" target="_blank">Nagios XI</a><b> </b></div><div style="text-align: justify;"><b>Official Website :: </b> <a href="http://www.nagios.org/">http://www.nagios.org/</a></div>

Nagios XI (System and Network Monitoring) :: Tools

Nagios XI is a system and network monitoring application. It watches hosts and services that you specify, alerting you when things go bad ...

Nipper Studio (Network Security Audit for Firewall, Switches and Router) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjog3YqJ3FIoxb_rLEWgJPXiIWYhWS7Ihd2IOrLYGhAqOaRm7ioEB6gatr6PgzNw7OJf7ol2pC-Z9-TVfpQewGb_ryDyAt_h2uNqzrlhRtW194rN4xFfH7jYM3ivYb0TPmgsj7rIChoKIYR/s1600/Nipper+Home+Report+2.2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nipper tutorial" border="0" height="333" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjog3YqJ3FIoxb_rLEWgJPXiIWYhWS7Ihd2IOrLYGhAqOaRm7ioEB6gatr6PgzNw7OJf7ol2pC-Z9-TVfpQewGb_ryDyAt_h2uNqzrlhRtW194rN4xFfH7jYM3ivYb0TPmgsj7rIChoKIYR/s1600/Nipper+Home+Report+2.2.jpg" title="nipper tutorial" width="400" /></a></div>
<div style="text-align: justify;">
<b>Nipper (short for Network Infrastructure Parser, previously known as 
CiscoParse)</b> audits the security of network devices such as switches, 
routers, and firewalls.  It works by parsing and analyzing device 
configuration file which the <b>Nipper</b> user must supply.  This was an open 
source tool until its developer (Titania) released a commercial version 
and tried to hide their old GPL releases. During a <b>network audit Nipper Studio</b> processes the devices’ native configurations and enables you to create a variety of different audit reports. By using traditional methodology for your <a href="http://www.toolwar.com/search/label/Network" target="_blank">network audit</a>, such as manual <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">Penetration Testing</a>, Agent-based software and <a href="http://www.toolwar.com/search/label/Scanner" target="_blank">Network Scanners</a>, you could experience various drawbacks, which does not affect Nipper Studio <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> audit software:<br />
<ul>
<li>Network scanners send huge numbers of network probes to a device and can impact performance. Only exposed vulnerabilities are identified, potentially missing many issues.</li>
<li>Agent-based audit software requires software to be installed on the devices during the network audit. This is not possible for all devices and can introduce additional security vulnerabilities.</li>
<li>Manual Penetration Tests examine individual <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> devices in detail. However this is slow, expensive and results in point in time audits of only a sample of devices.</li>
<li>Flatten the <a href="http://www.toolwar.com/search/label/Vulnerability" target="_blank">vulnerability assessment</a> process and reduce human error by automatically producing an instant, device specific configuration report, readable by non-technical experts.  </li>
<li>Achieve significant cost savings by automating a detailed configuration vulnerability analysis, typically provided by costly external Penetration Testing. </li>
<li>Improve the productivity and scope of the network audit by quickly performing a thorough vulnerability assessment of multiple complex network devices, providing a detailed security audit report, unachievable with vulnerability scanning technologies. </li>
<li>Stay secure as our security audit software requires no additional services on the device or agents to be installed and can audit the network devices without connecting or scanning them</li>
</ul>
<h3>
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/wUtAmowwVD8?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
 </h3>
<h3>
Download ::</h3>
<b>Windows | Linux | Mac :: </b>
<b> </b><br />
<b>Buy :: </b><a href="https://www.titania.com/shop" target="_blank">Click Here</a><b> </b>
<b> </b><br />
<b>Evaluate Copy :: </b><a href="https://www.titania.com/evaluate" target="_blank">Click Here</a><b>  </b>
<b> </b><br />
<b>Official Website :: </b><a href="https://www.titania.com/nipperstudio" target="_blank">https://www.titania.com/nipperstudio </a></div>

Nipper Studio (Network Security Audit for Firewall, Switches and Router) :: Tools

Nipper (short for Network Infrastructure Parser, previously known as CiscoParse) audits the security of network devices such as switche...

Argus (Auditing Network Activity) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Argus Logo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB9EePKFj7bOOAmUlulpXxUps3bKmylywSIIPNjOKR95TlmXfzBpotmDPvTpombemgv5gs8g-qGAFLcjAB8y7S0iSCjatcaY9LTAFt-OoP0EOMiONWPCNZ_119wIkga4ZTRn1ILz9jhpfa/s1600/ArgusOptimizationCycle.gif" title="Argus Logo" /></div>
<div style="text-align: justify;">
<b>Argus</b> is a fixed-model Real Time Flow <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">Monitor</a> designed to track and 
report on the status and performance of all network transactions seen in
 a data <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> traffic stream. Argus provides a common data format for 
reporting flow metrics such as connectivity, capacity, demand, loss, 
delay, and jitter on a per transaction basis. The record format that 
Argus uses is flexible and extensible, supporting generic flow 
identifiers and metrics, as well as application/protocol specific 
information.</div>
<div style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
 <b>Argus </b>is composed of an advanced comprehensive 
network flow data generator, the<b> Argus</b> sensor, which processes packets 
(either capture files or live <a href="http://www.toolwar.com/search/label/Packet" target="_blank">packet</a> data) and generates detailed 
network flow status reports of all the flows  in the packet stream.  
Argus  captures much of the packet dynamics and semantics of each
                             flow,  with a great deal of data reduction,
 so you can store, process, inspect and <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyze</a> large amounts of network
 data
                             efficiently. <b>Argus</b> provides reachability, 
availability, connectivity, duration, rate, load, good-put, loss,
                             jitter, retransmission, and delay metrics 
for all network flows, and captures most attributes that are available 
from the
                             packet contents, such as L2 addresses, 
tunnel identifiers (MPLS, GRE, ESP, etc...), <a href="http://www.toolwar.com/search/label/IDS" target="_blank">protocol ids</a>, SAP's, 
hop-count, options,
                             L4 transport identification (RTP, RTCP 
detection), host flow control indications, etc...</div>
<div class="plaintext" style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
Argus is used by many sites to generate 
network activity reports for every network transaction on their  
networks. The network audit data that <b>Argus</b> generates is great for 
<a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a>, operations and performance management. The data is used for 
network forensics, non-repudiation,
                             network asset and service inventory,  
behavioral baselining of server and client relationships, detecting 
covert channels, and analyzing Zero day events.</div>
<div class="plaintext" style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
Argus is an Open Source project, currently 
running on <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X,</a> <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, 
IRIX, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> (under Cygwin) 
                             and OpenWrt, and has been ported to many 
hardware accelerated platforms, such as Bivio, Pluribus, Arista, and 
Tilera. The software should be portable to many other
                             environments  with littleor no 
modifications. Performance is such that auditing an entire enterprise's 
Internet activity
                             can be accomplished using modest computing 
resources.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>How To :: </b><a href="http://www.qosient.com/argus/howto.shtml" target="_blank">Click Here</a><b><br /></b></div>
<b>Wiki :: </b><a href="http://nsmwiki.org/index.php?title=Argus" target="_blank">Click Here</a><br />
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows | Mac | Linux ::  </b><a href="http://qosient.com/argus/src/argus-3.0.6.1.tar.gz" target="_blank">Argus v3.0.6.1</a><b> | </b><a href="http://qosient.com/argus/src/argus-clients-3.0.6.2.tar.gz" target="_blank">Argus v3.0.6.1 Client</a><b> </b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.qosient.com/argus/">http://www.qosient.com/argus/</a><b><br /></b></div>
<div style="text-align: justify;">
<br /></div>

Argus (Auditing Network Activity) :: Tools

Argus is a fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions s...

Foremost (File Carving) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdkN2Ugs8yPIpW9bdhSCRtfTQisB-mmEgSeRyCTN_07YHLjIom3zkuOAPeUS8z8s7WHAT-qFoxrqYH6hrVHV9q-40PTsRzLLn9SMc0DbYBMNR944nbfhqU8fPWiPYTWV_PcywGGNhbEMS8/s1600/foremost+screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="foremost screenshot" border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdkN2Ugs8yPIpW9bdhSCRtfTQisB-mmEgSeRyCTN_07YHLjIom3zkuOAPeUS8z8s7WHAT-qFoxrqYH6hrVHV9q-40PTsRzLLn9SMc0DbYBMNR944nbfhqU8fPWiPYTWV_PcywGGNhbEMS8/s400/foremost+screenshot.jpg" title="foremost screenshot" width="400" /></a></div>
<br />
<b>Foremost</b> is a <b><i>console program to recover files</i></b> based on their headers, footers, and internal data  structures.  This process is commonly referred to as data carving. <b> Foremost</b> can work on image files,  such as those generated by dd, Safeback, <a href="http://www.toolwar.com/2013/09/encase-forensics-v7-tools.html" target="_blank">Encase</a>, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command line</a> switches to specify built-in file types.  These built-in types look at the data structures of a given  file format allowing for a more reliable and faster recovery. </div>
<div style="text-align: justify;">
<br />
<h3>
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/9AkY-IefI4Q?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
</h3>
</div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="http://foremost.sourceforge.net/pkg/foremost-1.5.7.tar.gz" target="_blank">Foremost 1.5.7 (.tar.gz)</a><br />
<b>Official Website :: </b><a href="http://foremost.sourceforge.net/" target="_blank">http://foremost.sourceforge.net/ </a></div>

Foremost (File Carving) :: Tools

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is common...

Subscribe to: Posts ( Atom )