ToolWar | Information Security (InfoSec) Tools: Monitoring

Echo Mirage 3.1 :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://1.bp.blogspot.com/-N6zkE496vX8/VxiXtAq6D0I/AAAAAAAAB54/b5agPvNIW2AT3nlsubwIqCqxGI4bH0j6ACLcB/s1600/Echo%2BMirage.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Download Echo Mirage" border="0" height="219" src="https://1.bp.blogspot.com/-N6zkE496vX8/VxiXtAq6D0I/AAAAAAAAB54/b5agPvNIW2AT3nlsubwIqCqxGI4bH0j6ACLcB/s320/Echo%2BMirage.jpg" title="Echo Mirage 3.1 from ToolWar" width="320" /></a></div>
<div style="text-align: justify;">
<b>Echo Mirage</b> is a generic network proxy. It uses DLL injection and 
function hooking techniques to redirect network related function calls 
so that data transmitted and received by local applications can be 
observed and modified.<br /><br />Windows encryption and OpenSSL functions 
are also hooked so that plain text of data being sent and received over 
an encrypted session is also available.<br /><br />Traffic can be intercepted in real-time, or manipulated with regular expressions and action scripts.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Note: Echo Mirage is no longer available from author. Here is the archived copy of it. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>License: </b>Freeware<b> </b></div>
<div style="text-align: justify;">
<b>Download:: </b><a href="http://woodmann.com/collaborative/tools/images/Bin_Echo_Mirage_2014-1-11_17.28_EchoMirage-3.1.rar" rel="nofollow" target="_blank">Echo Mirage 3.1</a> (.exe) </div>
<div style="text-align: justify;">
<br /></div>

Echo Mirage 3.1 :: Tools

Echo Mirage is a generic network proxy. It uses DLL injection and function hooking techniques to redirect network related function call...

File Checksum Integrity Verifier (FCIV) :: Tools

<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-H0ZagAIJfmM/Vimxu4gfJbI/AAAAAAAAB3M/ns2Z6fK7x-0/s1600/File%2BChecksum%2BIntegrity%2BVerifier%2BFCIV.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="File Checksum Integrity Verifier (FCIV)" border="0" height="299" src="http://4.bp.blogspot.com/-H0ZagAIJfmM/Vimxu4gfJbI/AAAAAAAAB3M/ns2Z6fK7x-0/s640/File%2BChecksum%2BIntegrity%2BVerifier%2BFCIV.JPG" title="File Checksum Integrity Verifier (FCIV)" width="640" /></a></div><div style="text-align: justify;">The File Checksum Integrity Verifier (FCIV)  is a command-prompt utility  that computes and verifies cryptographic hash values of files. FCIV   can compute MD5 or SHA-1 cryptographic hash values. These values can be  displayed on the screen or saved in an XML file database for later use  and verification.</div><div style="text-align: justify;">FCIV (File Checksum Integrity Verifier) is a small tool or utility from  Microsoft that allow us to compute (MD5 and SHA1) and verify Integrity  of files. If you are a malware analyst or a researcher or a user who  want secure things then you can done a fabulous things with this small  utility.</div><h3 class="sbody-h3" style="text-align: justify;">Features</h3><div style="text-align: justify;">The FCIV utility has the following features:</div><ul class="sbody-free_list"><li style="text-align: justify;"> Supports MD5  or SHA1 hash algorithms (The default is MD5.)</li>
<li style="text-align: justify;"> Can output hash values to the console or store the hash value and file name in an XML file</li>
<li style="text-align: justify;">Can recursively generate hash values for all files in a directory and in all subdirectories (for example, <span class="text-base">fciv.exe c:\ -r</span>)</li>
<li style="text-align: justify;">Supplies an exception list to specify files or directories to hash</li>
<li style="text-align: justify;">Can store hash values for a file with or without the full path of the file</li>
</ul><h3> Example usage</h3><ul class="sbody-free_list"><li>To display the MD5 hash of a file, type the following command at a command prompt: <div class="indent"><span class="sbody-userinput">fciv.exe <var class="sbody-var">filename</var></span></div><span class="text-base">Note </span><var class="sbody-var"> filename</var> is the name of the file.</li>
<li>To compute a hash of a file, type a command line that is similar to any one of the following command lines:         <div class="indent"><span class="sbody-userinput">fciv.exe c:\mydir\<var class="sbody-var"><var class="sbody-var">myfile.dll</var></var></span><br />
<br />
<span class="sbody-userinput">fciv.exe c:\ -r -exc exceptions.txt -sha1 -xml dbsha.xml</span><br />
<br />
<span class="sbody-userinput">fciv.exe c:\<var class="sbody-var">mydir</var> -type *.exe</span><br />
<br />
<span class="sbody-userinput">fciv.exe c:\<var class="sbody-var">mydir</var> -wp -both -xml db.xml</span></div></li>
<li>To list the  hashes that are stored in a database, type a command line that is similar to the following command line:         <div class="indent"><span class="sbody-userinput">fciv.exe -list -sha1 -xml db.xml</span></div></li>
<li>To verify a hash in a file, type a command line that is similar to any one of the following command lines:         <div class="indent"><span class="sbody-userinput">fciv.exe -v -sha1 -xml db.xml</span><br />
<br />
<span class="sbody-userinput">fciv.exe -v -bp c:\<var class="sbody-var">mydir</var> -sha1 -xml db.xml</span></div></li>
</ul><h3>Video Tutorial::</h3><br />
<div class="separator" style="clear: both; text-align: center;"><br />
<iframe width="100%" height="330" class="YOUTUBE-iframe-video" data-thumbnail-src="https://i.ytimg.com/vi/sOtnut9wM38/0.jpg" src="https://www.youtube.com/embed/sOtnut9wM38?feature=player_embedded" frameborder="0" allowfullscreen></iframe></div><br />
<h3>Download ::</h3><b>Windows:</b> <a href="http://www.microsoft.com/en-in/download/details.aspx?id=11533" rel="nofollow" target="_blank">Microsoft FCIV</a>

File Checksum Integrity Verifier (FCIV) :: Tools

The File Checksum Integrity Verifier (FCIV) is a command-prompt utility that computes and verifies cryptographic hash values of files. FCI...

Suricata (IDS/IPS Engine) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="suricata logo" border="0" height="265" src="http://2.bp.blogspot.com/-tSvbibR_his/UuNUF5dP1nI/AAAAAAAABes/zgFu0tMy84I/s1600/suricata.png" title="suricata logo" width="320" /></div>
<b>The Suricata Engine</b> is an <b>Open Source Next Generation Intrusion Detection and Prevention Engine.</b> This engine is not intended to just replace or emulate the existing <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a> in the industry, but will bring new ideas and technologies to the field.<br />
<br />
<b>OISF</b> is part of and funded by the Department of Homeland Security's Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the the Navy's Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members.<br />
<br />
The <b>Suricata </b>Engine and the HTP Library are available to use under the GPLv2.<br />
<br />
The HTP Library is an HTTP normalizer and parser written by Ivan Ristic of Mod <a href="http://www.toolwar.com/search/label/Security" target="_blank">Security</a> fame for the OISF. This integrates and provides very advanced processing of HTTP streams for <b>Suricata</b>. The HTP library is required by the engine, but may also be used independently in a range of applications and tools.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<h3>
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/A8e3y2DRiWg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
</div>
<div style="text-align: justify;">
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/-CDGwRm2ue8?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
</div>
<div style="text-align: justify;">
<b>Unix, Linux & Mac :: </b><a href="https://redmine.openinfosecfoundation.org/attachments/download/971/Suricata-1.4.7-1-32bit.msi" target="_blank">Suricata v1.4.7</a> (.tar.gz)<b>
</b></div>
<div style="text-align: justify;">
<b>Windows :: </b><a href="https://redmine.openinfosecfoundation.org/attachments/download/971/Suricata-1.4.7-1-32bit.msi" target="_blank">Suricata v1.4.7.1</a> (.msi)</div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.openinfosecfoundation.org/index.php/download-suricata">http://www.openinfosecfoundation.org/index.php/download-suricata</a></div>

Suricata (IDS/IPS Engine) :: Tools

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just re...

EtherApe (Graphical Network Monitor) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://4.bp.blogspot.com/-Nu2WnS9dMiE/UuNfr8oOPLI/AAAAAAAABfI/ALhkgm_G3-Q/s1600/etherape_intro2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="etherape screenshot" border="0" height="246" src="http://4.bp.blogspot.com/-Nu2WnS9dMiE/UuNfr8oOPLI/AAAAAAAABfI/ALhkgm_G3-Q/s1600/etherape_intro2.png" title="etherape screenshot" width="400" /></a></div>
<b>EtherApe</b> is a <b>graphical network monitor for Unix</b> modeled after <i>etherman</i>. Featuring link layer, IP and TCP modes, it displays <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> activity graphically. Hosts and links change in size with traffic. Color coded <a href="http://www.toolwar.com/search/label/Protocol" target="_blank">protocols</a> display.<br />
It supports Ethernet, FDDI, Token Ring, ISDN, PPP, SLIP and WLAN devices, plus several  encapsulation formats.  It can filter traffic to be shown, and can read <a href="http://www.toolwar.com/search/label/Packet" target="_blank">packets</a> from a file as well as live from the network. Node statistics can be exported.</div>
<div style="text-align: justify;">
<b>As of version 0.9.13, EtherApe as these features, in no particular order:
      </b><br />
<ul>
<li><span style="background-color: white;">Network traffic is displayed graphically. The more
"talkative" a node is, the bigger its representation. </span></li>
<li><span style="background-color: white;">Node and link color shows the most used protocol. </span></li>
<li><span style="background-color: white;">User may select what level of the protocol stack to
concentrate on. </span></li>
<li><span style="background-color: white;">You may either look at traffic within your network,
end to end IP, or even port to port TCP. </span></li>
<li><span style="background-color: white;">Data can be captured "off the wire" from a live
network connection, or read from a tcpdump capture file. </span></li>
<li><span style="background-color: white;">Live data can be read from ethernet, FDDI, PPP, SLIP and WLAN interfaces, 
        plus several other incapsulated formats (e.g. Linux cooked, PPI).</span></li>
<li><span style="background-color: white;">The following frame and packet types are currently
supported: ETH_II, 802.2, 803.3, IP, IPv6, ARP, X25L3, REVARP, ATALK,
AARP, IPX, VINES, TRAIN, LOOP, VLAN, ICMP, IGMP, GGP, IPIP, TCP, EGP,
PUP, UDP, IDP, TP, ROUTING, RSVP, GRE, ESP, AH, EON,
VINES, EIGRP, OSPF, ENCAP, PIM, IPCOMP, VRRP; and most TCP and UDP
services, like TELNET, FTP, HTTP, POP3, NNTP, NETBIOS, IRC, DOMAIN,
SNMP, etc. </span></li>
<li><span style="background-color: white;">Data display can be refined using a network filter using pcap syntax.</span></li>
<li><span style="background-color: white;">Display averaging and node persistence times are
fully configurable. </span></li>
<li><span style="background-color: white;">Name resolution is done using standard libc
functions, thus supporting DNS, hosts file, etc. </span></li>
<li><span style="background-color: white;">Clicking on a node/link opens a detail
dialog showing protocol breakdown and other traffic
statistics. </span></li>
<li><span style="background-color: white;">Protocol summary dialog shows global traffic
statistics by protocol.</span></li>
<li><span style="background-color: white;">Node summary dialog shows traffic
statistics by node.</span></li>
<li><span style="background-color: white;">Node statistics export to XML file.</span></li>
<li><span style="background-color: white;">A single node can be centered on the display.</span></li>
<li><span style="background-color: white;">Scrollkeeper/rarian-compatible manual integrated with yelp.</span></li>
</ul>
</div>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/3S95lWky9CU?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://sourceforge.net/projects/etherape/files/latest/download?source=files" target="_blank">Etherape v0.9.11</a> (.tar.gz)</div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://etherape.sourceforge.net/">http://etherape.sourceforge.net/</a></div>

EtherApe (Graphical Network Monitor) :: Tools

EtherApe is a graphical network monitor for Unix modeled after etherman . Featuring link layer, IP and TCP modes, it displays network ...

Microsoft's Network Monitor (Capturing and Protocol Analysis of Network Traffic) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://2.bp.blogspot.com/-1RMX2d0_Eew/UwRrgeLrfDI/AAAAAAAABjI/KOlc9hecO8s/s1600/Microsoft+Network+Monitor+Sceenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Microsoft Network Monitor Screenshot" border="0" height="377" src="https://2.bp.blogspot.com/-1RMX2d0_Eew/UwRrgeLrfDI/AAAAAAAABjI/KOlc9hecO8s/s1600/Microsoft+Network+Monitor+Sceenshot.jpg" title="Microsoft Network Monitor Screenshot" width="640" /></a></div>
<div style="text-align: justify;">
<b>Microsoft's Network Monitor</b> is a tools that allow <b>capturing and protocol analysis of network traffic</b>. Network Monitor 3 is a <a href="http://www.toolwar.com/search/label/Protocol" target="_blank">protocol analyzer</a>.  It enables you to capture, to
 view, and to analyze <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> data. You can use it to help troubleshoot 
problems with applications on the network.    This article 
contains download and support information, installation notes, and 
general usage information about Network Monitor 3. Network Monitor 3.4 
is the latest version.</div>
<div style="text-align: justify;">
<b>Network Monitor 3 </b> is a complete overhaul of the earlier Network Monitor 2.<var>x</var> version. Some key features of Network Monitor 3 include the following:</div>
<ul style="text-align: justify;">
<li>Script-based parser model with frequent updates </li>
<li>Concurrent  live capture sessions</li>
<li>Support for Windows 7</li>
<li>Support for 32-bit platforms and for 64-bit platforms </li>
<li>Support for network conversations and process tracking</li>
<li> API to access capture and parsing engine</li>
<li> <a href="http://www.toolwar.com/search/label/Wireless" target="_blank">Wireless</a> Monitor Mode Capturing</li>
</ul>
<div class="toggle-area" style="display: block; text-align: justify;">
<div class="system-requirements">
<div class="supported-os">
<b>Supported Operating System ::</b></div>
<div itemprop="operatingSystems">
<a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> 7, Windows 8, Windows Server 2003 
Service Pack 2, Windows Server 2003 Service Pack 2 x64 Edition, Windows 
Server 2008, Windows Server 2008 R2, Windows Server 2008 R2 for 
Itanium-based Systems, Windows Server 2012, Windows Vista 64-bit 
Editions Service Pack 1, Windows Vista Service Pack 1, Windows XP 
64-bit, Windows XP Service Pack 3
                        </div>
<ul class="htmldetails other-requirements">
Hardware ::
<ul>
<li>1 GHz or greater CPU</li>
<li>1 GB or greater <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a></li>
<li>60 MB free hard disk space plus extra room for capture files</li>
</ul>
</ul>
</div>
</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>Installation Instruction :: </b> </div>
<div style="text-align: justify;">
The Network <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">Monitor</a> core engine has been decoupled from the parser set.

To install the full <b>Network Monitor 3.4</b> product:
</div>
<ul style="text-align: justify;">
<li>Run the setup.exe for the platform you are installing.</li>
<li>You will be prompted first to install the core engine. Follow the installation
directions. Make sure you close existing instances of netmon.exe, nmcap.exe
and any running NMAPI applications.</li>
<li>Next you will be prompted to install the parser package. Follow the
installation directions:</li>
</ul>
<div style="text-align: justify;">
<b>
To uninstall the full Network Monitor 3.4 product ::</b></div>
<ul style="text-align: justify;">
<li>Go to Add/Remove Programs in Control Panel</li>
<li>Uninstall both <b>Microsoft Network Monitor 3.4</b> and Microsoft Network Monitor: Network Monitor
Parsers 3.4</li>
</ul>
<b>Network Monitor Blog ::</b> <a href="http://go.microsoft.com/fwlink/?LinkID=92890" target="_blank">Click Here</a><br />
<b>Network Monitor Blog ::</b> <a href="http://go.microsoft.com/fwlink/?LinkID=151800" target="_blank">Click Here</a><br />
<br />
<b>Video Tutorial :: </b> <a href="http://www.youtube.com/watch?v=jsShLK5bhoY" target="_blank">Click Here</a><br />
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows :: <a href="https://www.microsoft.com/en-in/download/details.aspx?id=4865" target="_blank">Network Monitor 3.4</a> (x86 & x64)</b><a href="http://www.microsoft.com/en-us/download/details.aspx?id=4865" target="_blank"></a></div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.microsoft.com/en-us/download/details.aspx?id=4865">http://www.microsoft.com/en-us/download/details.aspx?id=4865</a></div>
<div style="text-align: justify;">
<br /></div>
</div>

Microsoft's Network Monitor (Capturing and Protocol Analysis of Network Traffic) :: Tools

Microsoft's Network Monitor is a tools that allow capturing and protocol analysis of network traffic . Network Monitor 3 is a proto...

Detekt :: Malware Detection Tool against Government Surveillance

<div class="separator" style="clear: both; text-align: justify;">
<img alt="detekt" border="0" height="280" src="http://1.bp.blogspot.com/-HPCf56Ll1UM/VG8UhdmaLPI/AAAAAAAABzM/C7CaWzLg4Yc/s1600/detekt-1d.png" title="Detekt" width="640" /></div>
<div style="text-align: justify;">
<b>Detekt</b> is a <b>free tool</b> that scans your <b>Windows computer for traces of 
known surveillance spyware</b> used to target and monitor human rights 
defenders and journalists around the world. It is important to underline that if <b>Detekt </b>does not find trace of 
spyware on a computer, it does not necessarily mean that none is 
present. Some spyware will likely be updated in response to the release 
of <b>Detekt </b>in order to avoid detection. In addition, there may be 
existing versions of spyware, from these or other providers, which are 
not detected by this tool.</div>
<div style="text-align: justify;">
In recent years we have witnessed a huge growth in the adoption and 
trade in communication surveillance technologies. Such spyware provides 
the ability to read personal emails, listen-in skype conversations or 
even remotely turn on a computers camera and microphone without its 
owner knowing about it.</div>
<div style="text-align: justify;">
Some of this software is widely available on the 
Internet, while some more sophisticated alternatives are made and sold 
by private companies based in industrialized countries to state law 
enforcement and intelligence agencies in countries across the world.</div>
<div style="text-align: justify;">
There is little to no regulation currently in place to 
safeguard against these technologies being sold or used by repressive 
governments or others who are likely to use them for serious human 
rights violations and abuses.</div>
<div style="text-align: justify;">
<strong>How widely do governments use surveillance technology?</strong></div>
<div style="text-align: justify;">
Governments
 are increasingly using surveillance technology, and targeted 
surveillance in particular, to monitor the legitimate activities of 
human rights activists and journalists. <span>Powerful software 
developed by companies allows governments and intelligence agencies to 
read personal emails, listen-in on Skype conversations or even remotely 
turn on a computers camera and microphone without its owner knowing 
about it.</span></div>
<div style="text-align: justify;">
<span>In many cases, the information they gather 
through those means is used to detain, imprison and even torture 
activists into confessing to crimes. It's impossible,
 however, to give an accurate estimate of how many people are affected 
by this surveillance spyware. This is because the companies that build 
and sell such software market themselves on their ability to hide it 
from users. Recent research has shown that known spyware has been found present in dozens of countries, covering all regions of the world. <b>Detekt</b>
 is the first public tool that will assist activists, journalists and 
civil society groups to scan their computers for spyware.</span></div>
<h3 style="text-align: justify;">
<span>Download:  </span></h3>
<div style="text-align: justify;">
<b><span>Windows:: </span></b><span><a href="https://github.com/botherder/detekt/releases/download/v1.2/detekt.exe" target="_blank">Detekt v1.2</a> (.exe)</span></div>
<div style="text-align: justify;">
<span><b>Source Code:: </b>https://github.com/botherder/detekt/archive/v1.2.zip<b> </b></span></div>
<div style="text-align: justify;">
<span><b>Official Website::</b> https://resistsurveillance.org/</span></div>

Detekt :: Malware Detection Tool against Government Surveillance

Detekt is a free tool that scans your Windows computer for traces of known surveillance spyware used to target and monitor human righ...

KillerBee (Exploiting ZigBee and IEEE 802.15.4 Networks) :: Framework

<div class="separator" style="clear: both; text-align: center;">
<img alt="KillerBee Image" border="0" height="329" src="http://1.bp.blogspot.com/-e8kGG9z_hls/U0D8jkXkWyI/AAAAAAAABrg/rNMcWYQ4cPA/s1600/KillerBee+Image.jpg" title="KillerBee Image" width="640" /></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>KillerBee</b> is a Python based <a href="http://www.toolwar.com/search/label/Frameworks" target="_blank">framework</a> and tool set for <b>exploring and 
exploiting the security of ZigBee and IEEE 802.15.4 networks.</b>  Using 
<b>KillerBee</b> tools and a compatible IEEE 802.15.4 radio interface, you can 
eavesdrop on ZigBee networks, replay traffic, attack cryptosystems and 
much more.  Using the <b>KillerBee framework</b>, you can build your own <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a>,
 implement ZigBee fuzzing, emulate and attack end-devices, routers and 
coordinators and much more. </div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>Install on Linux :: </b><a href="https://code.google.com/p/killerbee/wiki/InstallLinuxBackTrack" target="_blank">Click Here</a></div>
<div style="text-align: justify;">
<b>Install on Mac :: </b><a href="https://code.google.com/p/killerbee/wiki/InstallOSX" target="_blank">Click Here</a></div>
<b>Wiki :: </b><a href="https://code.google.com/p/killerbee/w/list" target="_blank">Click Here</a><br />
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux | Mac :: </b><a href="https://killerbee.googlecode.com/files/killerbee_1_0.tar" target="_blank">KillerBee v1.0</a> (.tar.gz)</div>
<div style="text-align: justify;">
<b>Source Website :: </b><a href="https://code.google.com/p/killerbee/">https://code.google.com/p/killerbee/</a></div>

KillerBee (Exploiting ZigBee and IEEE 802.15.4 Networks) :: Framework

KillerBee is a Python based framework and tool set for exploring and exploiting the security of ZigBee and IEEE 802.15.4 networks. ...

AIEngine (Artificial Intelligent Engine) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="AIEngine (Artificial Intelligent Engine)" border="0" src="https://4.bp.blogspot.com/-xvp19YsprqU/UttmoGmQSGI/AAAAAAAABcc/QlKD2t4YhBM/s1600/Artificial+Intelligent+Engine.jpg" title="AIEngine (Artificial Intelligent Engine)" /></div>
<div style="text-align: justify;">
<b>AIEngine</b> is a next generation interactive/programmable packet inspection engine with capabilities of learning without any human intervention, NIDS functionality, DNS domain classification, network collector and many others.  <b><br /></b><br />
<b>AIEngine (Artificial Intelligent Engine)</b> is a <i><a href="http://www.toolwar.com/search/label/Packet" target="_blank">packet</a> inspection engine</i> with capabilities of learning without any human intervention. <b>AIEngine</b> helps <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>/security profesionals to <b>identify traffic</b> and develop signatures for use them on<b> </b><i>NIDS, <a href="http://www.toolwar.com/search/label/Firewalls" target="_blank">Firewalls</a>, Traffic classifiers</i> and so on.</div>
<div style="text-align: justify;">
<b>AIEngine</b> is written in c++11 and Python, so by using the flexibility of 
<a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a>, AIEngine could be integrated easely with other functionalities 
and modules in a easy way.<br />
<h3>
Features ::  </h3>
</div>
<ul>
<li>- Counters for IP fragmentation packets.</li>
<li>- Support for TLS1.2 on the SSLProtocol</li>
<li>- Exposed the FrequencyGroup and the LearnerEngine on python.</li>
<li>- Integrate with NetfilterPython or other packet systems.</li>
<li>- Support for python 3.x versions (check INSTALL).</li>
<li>- Sorts the outputs of the HTTP, SSL and DNS most used domains (aiengine binary).</li>
<li>- Support for HTTP1.1 (URI Cache), all the flows will have all the paths taken by the user.</li>
<li>- Shell support. The system have a interactive shell so the user can interact on realtime with the system.</li>
</ul>
<h3>
Tutorial ::</h3>
<b>Configuration :: </b><a href="https://bitbucket.org/camp0/aiengine/wiki/Configurations" target="_blank">Click Here</a><b> </b><br />
<b>Uses & Examples :: </b><a href="https://bitbucket.org/camp0/aiengine/wiki/Home" target="_blank">Click Here</a><br />
<b>Wiki :: </b><a href="https://bitbucket.org/camp0/aiengine/wiki/Home" target="_blank">Click Here</a><br />
<h3>
Download :: </h3>
<b>Linux :: </b><a href="https://bitbucket.org/camp0/aiengine/downloads/aiengine-1.5.tar.gz" rel="nofollow" target="_blank">AIEngine v1.5</a><b> (.tar.gz)</b><br />
<b>Source ::</b> <a href="https://bitbucket.org/camp0/aiengine/overview">https://bitbucket.org/camp0/aiengine/overview</a><br />
<b>Submitted By :: </b>Luis

AIEngine (Artificial Intelligent Engine) :: Tools

AIEngine is a next generation interactive/programmable packet inspection engine with capabilities of learning without any human interven...

VoIPong (VoIP Sniffer and Call Detector) :: Tools

<div class="separator" style="clear: both; text-align: center;"><img alt="VoIP Hacking " border="0" height="337" src="http://1.bp.blogspot.com/-jmWpwBKomgM/UzQ5tdpCl2I/AAAAAAAABps/8KLf1mZcUao/s1600/VoIP+Hacking.jpg" title="VoIP Hacking " width="640" /></div><div class="style3" style="text-align: justify;"><b>VoIPong</b> is a utility which detects all <b><a href="http://www.toolwar.com/search/label/VOIP" target="_blank">Voice Over IP</a> calls  on a pipeline</b>, and for those which are G711 encoded, dumps actual  conversation to seperate wave files. It supports SIP, H323, Cisco's  Skinny Client Protocol, RTP and RTCP. </div><div class="style3" style="text-align: justify;">It's been written in C language for performance reasons, proved  to be running on Solaris, <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> and <a href="http://www.toolwar.com/search/label/FreeBSD" target="_blank">FreeBSD</a>; though it's thought to compile  and run on other platforms as well. </div><div class="style3" style="text-align: justify;">On a 45 Mbit/sec network traffic, it's been verified  that <b>VoIPong</b> successfully detected all <a href="http://www.toolwar.com/search/label/VOIP" target="_blank">VoIP </a>gateways and the VoIP calls.   CPU utilization during the run has been found ranging between 66% - 80%  on a 256MB RAM, Celeron 1700 Mhz Toshiba notebook. </div><span class="style1"><b>Features :: </b></span><br />
<ul><li class="style2">Produces real .Wav files for direct audio hearing. </li>
<li class="style2">Simple, optimized, extandable fast code </li>
<li class="style2">The algorithm doesn't depend on signalling but on RTP/RTCP      </li>
<li class="style2">Detailed logging. (Comfortable for 'cut' and 'cat' operations to produce statistics.)      </li>
<li class="style2">Powerful management console interface      </li>
<li class="style2">Easy installation and administration</li>
<li class="style2">Easy debugging.    </li>
</ul><h3 class="style3" style="text-align: justify;">Tutorials ::</h3><b>Users Manual ::</b> <a href="http://www.enderunix.org/voipong/users-manual/" target="_blank">Click Here</a><br />
  <br />
<div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/ow1bRp6E8og?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 class="style3" style="text-align: justify;">Download ::</h3><div class="style3" style="text-align: justify;"><b>Linux :: </b><a href="https://github.com/EnderUNIX/VoIPong/archive/master.zip" target="_blank">VoIPong v2.0</a></div><div class="style3" style="text-align: justify;"><b>Official Website :: </b><a href="http://www.enderunix.org/voipong/">http://www.enderunix.org/voipong/</a></div>

VoIPong (VoIP Sniffer and Call Detector) :: Tools

VoIPong is a utility which detects all Voice Over IP calls on a pipeline , and for those which are G711 encoded, dumps actual conversati...

Nagios XI (System and Network Monitoring) :: Tools

<div style="text-align: justify;"><div class="separator" style="clear: both; text-align: center;"><img alt="Nagios Logo" border="0" height="139" src="http://4.bp.blogspot.com/-tKbz4dwYhGk/Uyrakcuk_jI/AAAAAAAABn4/1VxP__Ao0Eo/s1600/xi-logo-large.png" title="Nagios Logo" width="320" /></div><b>Nagios XI </b>is a system and <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">network monitoring</a> application. It watches hosts  and services that you specify, alerting you when things go bad and when  they get better. Some of its many features include monitoring of <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>  services (SMTP, POP3, HTTP, NNTP, ICMP, etc.), monitoring of host  resources (processor load, disk usage, etc.), and contact notifications  when service or host problems occur and get resolved (via email, pager,  or user-defined method).</div><div style="text-align: justify;"><b>With Nagios you can:</b>  </div><ul style="padding-left: 25px;"><li>Monitor your entire IT infrastructure</li>
<li>Spot problems <i>before</i> they occur</li>
<li>Know immediately when problems arise</li>
<li>Share availability data with stakeholders</li>
<li>Detect security breaches</li>
<li>Plan and budget for IT upgrades</li>
<li>Reduce downtime and business losses</li>
</ul><div style="text-align: justify;"><br />
</div><h3 style="text-align: justify;">Tutorials ::</h3><div style="text-align: justify;"><b>Text Tutorials :: </b><a href="http://library.nagios.com/library/products/nagiosxi/tutorials/" target="_blank">Click Here </a> </div><div style="text-align: justify;"><b>Documentation :: </b><a href="http://library.nagios.com/library/products/nagiosxi/documentation" target="_blank">Click Here</a> </div><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/mXUxXV17Nd4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div><div style="text-align: justify;">
</div><h3 style="text-align: justify;">Download ::</h3><div style="text-align: justify;"><b>Windows | Linux  :: </b><a href="http://library.nagios.com/library/products/nagiosxi/downloads/main" target="_blank">Nagios XI</a><b> </b></div><div style="text-align: justify;"><b>Official Website :: </b> <a href="http://www.nagios.org/">http://www.nagios.org/</a></div>

Nagios XI (System and Network Monitoring) :: Tools

Nagios XI is a system and network monitoring application. It watches hosts and services that you specify, alerting you when things go bad ...

Argus (Auditing Network Activity) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Argus Logo" border="0" src="http://4.bp.blogspot.com/-Ch6SrDuxJnk/UyP3HEYAaqI/AAAAAAAABnY/WnD6UnizTLE/s1600/ArgusOptimizationCycle.gif" title="Argus Logo" /></div>
<div style="text-align: justify;">
<b>Argus</b> is a fixed-model Real Time Flow <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">Monitor</a> designed to track and 
report on the status and performance of all network transactions seen in
 a data <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> traffic stream. Argus provides a common data format for 
reporting flow metrics such as connectivity, capacity, demand, loss, 
delay, and jitter on a per transaction basis. The record format that 
Argus uses is flexible and extensible, supporting generic flow 
identifiers and metrics, as well as application/protocol specific 
information.</div>
<div style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
 <b>Argus </b>is composed of an advanced comprehensive 
network flow data generator, the<b> Argus</b> sensor, which processes packets 
(either capture files or live <a href="http://www.toolwar.com/search/label/Packet" target="_blank">packet</a> data) and generates detailed 
network flow status reports of all the flows  in the packet stream.  
Argus  captures much of the packet dynamics and semantics of each
                             flow,  with a great deal of data reduction,
 so you can store, process, inspect and <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyze</a> large amounts of network
 data
                             efficiently. <b>Argus</b> provides reachability, 
availability, connectivity, duration, rate, load, good-put, loss,
                             jitter, retransmission, and delay metrics 
for all network flows, and captures most attributes that are available 
from the
                             packet contents, such as L2 addresses, 
tunnel identifiers (MPLS, GRE, ESP, etc...), <a href="http://www.toolwar.com/search/label/IDS" target="_blank">protocol ids</a>, SAP's, 
hop-count, options,
                             L4 transport identification (RTP, RTCP 
detection), host flow control indications, etc...</div>
<div class="plaintext" style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
Argus is used by many sites to generate 
network activity reports for every network transaction on their  
networks. The network audit data that <b>Argus</b> generates is great for 
<a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a>, operations and performance management. The data is used for 
network forensics, non-repudiation,
                             network asset and service inventory,  
behavioral baselining of server and client relationships, detecting 
covert channels, and analyzing Zero day events.</div>
<div class="plaintext" style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
Argus is an Open Source project, currently 
running on <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X,</a> <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, 
IRIX, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> (under Cygwin) 
                             and OpenWrt, and has been ported to many 
hardware accelerated platforms, such as Bivio, Pluribus, Arista, and 
Tilera. The software should be portable to many other
                             environments  with littleor no 
modifications. Performance is such that auditing an entire enterprise's 
Internet activity
                             can be accomplished using modest computing 
resources.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>How To :: </b><a href="http://www.qosient.com/argus/howto.shtml" target="_blank">Click Here</a><b><br /></b></div>
<b>Wiki :: </b><a href="http://nsmwiki.org/index.php?title=Argus" target="_blank">Click Here</a><br />
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows | Mac | Linux ::  </b><a href="http://qosient.com/argus/src/argus-3.0.6.1.tar.gz" target="_blank">Argus v3.0.6.1</a><b> | </b><a href="http://qosient.com/argus/src/argus-clients-3.0.6.2.tar.gz" target="_blank">Argus v3.0.6.1 Client</a><b> </b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.qosient.com/argus/">http://www.qosient.com/argus/</a><b><br /></b></div>
<div style="text-align: justify;">
<br /></div>

Argus (Auditing Network Activity) :: Tools

Argus is a fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions s...

Fiddler (Web Debugger Proxy) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="http://1.bp.blogspot.com/-spDrR8se2nU/Ux2_ZA9NC3I/AAAAAAAABmw/X60D6ozS3qE/s1600/Fiddler+logo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="251" src="http://1.bp.blogspot.com/-spDrR8se2nU/Ux2_ZA9NC3I/AAAAAAAABmw/X60D6ozS3qE/s1600/Fiddler+logo.png" width="400" /></a></div>
<div style="text-align: justify;">
<b>Fiddler</b> is a <b>Web Debugging Proxy</b> which logs all HTTP(S) traffic between  your computer and the Internet. <b>Fiddler</b> allows you to inspect all  HTTP(S) traffic, set breakpoints, and "fiddle" with incoming or outgoing  data. Fiddler includes a powerful event-based scripting subsystem, and  can be extended using any .NET language.</div>
<ul style="text-align: justify;">
<li><b>HTTP/HTTPS Traffic Recording :: </b>Fiddler is a free <a href="http://www.toolwar.com/search/label/Web" target="_blank">web</a> <a href="http://www.toolwar.com/search/label/Debugger" target="_blank">debugging</a> proxy which logs all HTTP(s) traffic 
between your computer and the Internet. Use it to debug traffic from 
virtually any application that supports a proxy like IE, Chrome, Safari,
 Firefox, Opera and more.</li>
<li><b>Web Session Manipulation ::</b> Easily manipulate and edit web sessions. All you need to do is set a breakpoints to pause the processing of the session and permit alteration 
of the request/response. You can also compose your own HTTP requests to 
run through <b>Fiddler</b>.</li>
<li><b>Web Debugging :: </b>Debug traffic from PC, <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac</a> or <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux systems</a> and <a href="http://www.toolwar.com/search/label/Mobile" target="_blank">mobile devices</a>. Ensure 
the proper cookies, headers and cache directives are transferred between
 the client and server. Supports any framework, including .NET, Java, 
Ruby, etc.</li>
<li><b> Security Testing :: </b>Use <b>Fiddler</b> for <a href="http://www.toolwar.com/search/label/Security" target="_blank">security testing</a> your web applications -- decrypt HTTPS 
traffic, and display and modify requests using a man-in-the-middle 
decryption technique. Configure Fiddler to decrypt all traffic, or only 
specific sessions.</li>
<li><b>Performance Testing :: </b>Fiddler lets you see the “total page weight,” HTTP caching and 
compression at a glance. Isolate performance bottlenecks with rules like
 “Flag any uncompressed responses larger than 25kb.”</li>
<li><b>Customizing Fiddler :: </b>Benefit from a rich extensibility model, ranging from simple 
FiddlerScript to powerful Extensions which can be developed using any 
.NET language.  </li>
<li><div class="sfContentBlock">
<b>Simulate Real User Load Using Fiddler Captures ::</b> Fiddler is an excellent tool for 
understanding the performance of your website, but how does your 
performance change when lots of users are hitting the site? Check out 
Telerik Test Studio powered by Fiddler to get an in-depth understanding 
of how your site performance degrades as the number of users increases.</div>
</li>
</ul>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/gujBKFGwjd4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
 </h3>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows :: </b><a href="http://www.telerik.com/docs/default-source/fiddler/fiddler4setup.exe?sfvrsn=2" target="_blank">Fiddler v4.4.6.2</a> (.exe) 
<b> </b></div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.telerik.com/download/fiddler">http://www.telerik.com/download/fiddler</a></div>

Fiddler (Web Debugger Proxy) :: Tools

Fiddler is a Web Debugging Proxy which logs all HTTP(S) traffic between your computer and the Internet. Fiddler allows you to inspect...

Nmap and Zenmap (Network Discovery and Security Auditing) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="nmap scanner logo" border="0" height="210" src="http://2.bp.blogspot.com/-fNg0DkVjmoc/UwiZl2rD7UI/AAAAAAAABks/-quCXIpLYmo/s1600/nmap.jpg" title="nmap scanner logo" width="400" /></div>
</div>
<div style="text-align: justify;">
<b>Nmap ("Network Mapper")</b> is a free and open source (license) utility for <b>network discovery and security auditing.</b> Many systems and network administrators also find it useful for tasks such as <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> inventory, managing service upgrade schedules, and <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">monitoring</a> host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of <a href="http://www.toolwar.com/search/label/Packet" target="_blank">packet</a> filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>, and <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X</a>. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced <a href="http://www.toolwar.com/search/label/GUI" target="_blank">GUI</a> and results viewer <b>(Zenmap)</b>, a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis tool</a> (Nping).<br />
<br />
<b>Nmap</b> was named “<a href="http://www.toolwar.com/search/label/Security" target="_blank">Security</a> Product of the Year” by Linux Journal, Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in twelve movies, including The Matrix Reloaded, Die Hard 4, Girl With the Dragon Tattoo, and The Bourne Ultimatum.<br />
<br />
<b>Nmap is::</b></div>
<ul style="text-align: justify;">
<li>    Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, <a href="http://www.toolwar.com/search/label/IDS" target="_blank">firewalls</a>, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), <b>OS detection</b>, version detection, ping sweeps, and more. See the documentation page.</li>
<li>    Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.</li>
<li>    Portable: Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more.</li>
<li>    Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -v -A targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.</li>
<li>    Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the license.</li>
<li>    Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, tutorials, and even a whole book! Find them in multiple languages here.</li>
<li>    Supported: While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the Nmap mailing lists. Most bug reports and questions should be sent to the nmap-dev list, but only after you read the guidelines. We recommend that all users subscribe to the low-traffic nmap-hackers announcement list. You can also find Nmap on Facebook and Twitter. For real-time chat, join the #nmap channel on Freenode or EFNet.</li>
<li>    Acclaimed: <b>Nmap</b> has won numerous awards, including "Information Security Product of the Year" by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the press page for further details.</li>
<li>    Popular: Thousands of people download <b>Nmap</b> every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities. </li>
</ul>
<h3>
Tutorials ::</h3>
<b>Tutorial (Max OS X) :: </b><a href="http://nmap.org/book/inst-macosx.html#inst-macosx-source">Click Here</a><br />
<b>Tutorial (Windows) :: </b><a href="http://nmap.org/book/inst-windows.html#inst-win-source">Click Here</a> <b><br />
</b><br />
<b>Tutorial (Linux) ::</b> <a href="http://nmap.org/book/inst-source.html">Click Here</a><br />
<b>Installation :: </b><a href="http://nmap.org/book/install.html" target="_blank">Click Here</a>   <br />
<b>Tutorials From Basics :: </b><a href="http://nmap.org/bennieston-tutorial/">Click Here </a><br />
<b>Video Tutorial :: </b><br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/RJxF7puQFXI?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<b> </b>
<br />
<h3>
Download ::</h3>
<h3>
</h3>
<b>Download ZenMap (GUI of Nmap) :: </b><a href="http://nmap.org/zenmap/">Click Here</a><b> </b><br />
<b>Windows :: </b><a href="http://nmap.org/dist/nmap-6.40-setup.exe">Nmap-Latest</a> (.exe)
<b> </b><br />
<b>Linux :: </b><a href="http://nmap.org/dist/nmap-6.40.tar.bz2">Nmap Latest</a> (.tar.bz2)<b> </b><br />
<b>Mac :: </b><a href="http://nmap.org/dist/nmap-6.40-2.dmg">Nmap Latest</a> (.dmg)<b> </b>
<b>  </b><br />
<b>Official Website ::</b> <a href="http://nmap.org/">http://nmap.org/</a>
<br />
<div style="text-align: justify;">
</div>

Nmap and Zenmap (Network Discovery and Security Auditing) :: Tools

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many syste...

Lightbeam for Firefox :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://2.bp.blogspot.com/-0ir87NEVZvs/UvXoyxXo1II/AAAAAAAABho/NaAyxiUrSJU/s1600/lightbeam+addon.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Lightbeam Addon" border="0" height="249" src="http://2.bp.blogspot.com/-0ir87NEVZvs/UvXoyxXo1II/AAAAAAAABho/NaAyxiUrSJU/s1600/lightbeam+addon.png" title="Lightbeam Addon" width="400" /></a></div>
<b>Lightbeam is a Firefox</b> add-on that enables you to see the <b>first and  third party sites you interact with on the <a href="http://www.toolwar.com/search/label/Web" target="_blank">Web</a></b>. Using interactive  visualizations, <b>Lightbeam</b> shows you the relationships between these  third parties and the sites you visit.</div>
<div style="text-align: justify;">
 Using interactive visualizations, <b>Lightbeam</b> enables you to see the first  and third party sites you interact with on the Web. As you browse,  Lightbeam reveals the full depth of the Web today, including parts that  are not transparent to the average user. Using three distinct  interactive graphic representations — Graph, Clock and List — <b>Lightbeam</b>  enables you to examine individual third parties over time and space,  identify where they connect to your online activity and provides ways  for you to engage with this unique view of the Web.<br />
<br />
<b>How Lightbeam Works ::</b><br />
When  you activate Lightbeam and visit a website, sometimes called the first  party, the add-on creates a real time visualization of all the third  parties that are active on that page. The default visualization is  called the Graph view. As you then browse to a second site, the add-on  highlights the third parties that are also active there and shows which  third parties have seen you at both sites. The visualization grows with  every site you visit and every request made from your browser. In  addition to the Graph view, you can also see your data in a Clock view  to examine connections over a 24-hour period or in a List view to drill  down into individual sites.<br />
<br />
<b>How You Can Use Lightbeam to Help Us Illuminate the Inner Workings of the Web ::</b> <br />
As  a part of Lightbeam, we're creating a big-picture view of how tracking  works on the Internet, and how third-party sites are connected to  multiple other sites. You may contribute your data to our crowdsourced  directory by simply turning on the share switch within the add-on. To  disable crowdsourcing, you can turn it off at any time. You can view  your local data stored within Lightbeam at any time, or save your data  by clicking the "Save" button under the data section on the left side of  the add-on.<br />
<br />
<b>How is my information stored? ::</b><br />
As a  default, all info generated and used for Lightbeam’s visualizations and  features are only stored locally on your computer. You can save a copy  of your connection history at any time, which is also where you can see  the specific data collected by the add-on. You may also reset Lightbeam  to erase your locally stored connection history, disable it to stop data  collection or uninstall it to instantly remove all locally stored data  related to <b>Lightbeam.</b><br />
<h3>
Tutorial :: </h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/Axhz4vChpL4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
</h3>
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<br />
<b>Download ::</b> <a href="https://addons.mozilla.org/en-US/firefox/addon/lightbeam/?src=search" target="_blank">Click Here</a> (Firefox Add-on)
<b> </b><br />
<b>Official Developer ::</b> Mozilla  </div>

Lightbeam for Firefox :: Tools

Lightbeam is a Firefox add-on that enables you to see the first and third party sites you interact with on the Web . Using interactive ...

FruityWiFi (Wireless Auditing) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="FruityWiFi Screenshot" border="0" height="311" src="http://1.bp.blogspot.com/-fq1n4n1J71U/UrSBgL-j1xI/AAAAAAAABSM/jXPd4T9pASY/s320/FruityWiFi+Screenshot.JPG" title="FruityWiFi Screenshot" width="320" /></div>
<div style="text-align: justify;">
<b>FruityWifi</b> is a <i>wireless network auditing tool</i> based in the <a href="http://www.toolwar.com/search/label/WiFi" target="_blank">wifi</a> 
Pineapple. The application can be installed in any Debian based system 
adding the extra packages. Tested in Debian, <a href="http://www.toolwar.com/2013/09/kali-linux-toolwar.html" target="_blank">Kali Linux</a>, Kali Linux ARM 
(Raspberry Pi), Raspbian (Raspberry Pi), Pwnpi (Raspberry Pi).</div>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div style="text-align: justify;">
<b> Wiki :: </b><a href="https://github.com/xtr4nge/FruityWifi/wiki" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="https://github.com/xtr4nge/FruityWifi/archive/master.zip" target="_blank">FruityWiFi</a></div>

FruityWiFi (Wireless Auditing) :: Tools

FruityWifi is a wireless network auditing tool based in the wifi Pineapple. The application can be installed in any Debian based syst...

WormTrack (Network IDS) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="wormtrack " border="0" height="300" src="http://1.bp.blogspot.com/-ZLIBCkZ5VCo/UuNX1QURR4I/AAAAAAAABe8/w6dGpX9CDCM/s1600/WormTrack.jpg" title="wormtrack " width="400" /></div>
<b>WormTrack</b> is a <b>Network based intrusion detection system (NIDS)</b> designed 
to identify scanning activity on the <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>, in particular of <a href="http://www.toolwar.com/search/label/Scanner" target="_blank">scanning</a> 
worms (horizontal scanning of the network). It attempts to do that 
WITHOUT having any type of privileged access to the network equipment, 
for example a MONITOR port on a switch. It also doesn't require a 
constant updating of its signature engine, as new threats are released, 
since it is based on <a href="http://www.toolwar.com/search/label/Detect" target="_blank">detection</a> of anomalous  activity - which all Worms,
 that propagate through the network, would exhibit in order to survive 
and spread efficiently. A <b>Network IDS </b>which allows detection of scanning worms on a Local Area 
Network by <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">monitoring</a> of anomalous ARP traffic. This allows detection of
 scanning threats on the network, without having a privileged access on a
 Switch to set up a dedicated Monitor PORT, nor does it require a 
constant updating of the rules engine to address new threats. </div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>General Info & Configuration :: </b><a href="http://code.google.com/p/wormtrack/wiki/GeneralInfo" target="_blank">Click Here</a> </div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://wormtrack.googlecode.com/files/wormtrack-0.1.tar.gz" target="_blank">WormTrackv0.1</a> (.tar.gz)<b><br /></b></div>
<div style="text-align: justify;">
<b>Source Website ::</b><a href="http://code.google.com/p/wormtrack/" target="_blank"> http://code.google.com/p/wormtrack/</a></div>

WormTrack (Network IDS) :: Tools

WormTrack is a Network based intrusion detection system (NIDS) designed to identify scanning activity on the network , in particular o...

Pytbull (IDS/IPS Testing) :: Framework

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
 <img alt="pytbull ids mode" border="0" height="291" src="http://1.bp.blogspot.com/-OAtFTfuOfPI/UuNQXnPipaI/AAAAAAAABeg/gFRMAqk6Tug/s1600/pytbull-ids-mode.png" title="pytbull ids mode" width="400" /></div>
<b>Pytbull</b> is an <b>Intrusion Detection/Prevention System (IDS/IPS) testing framework</b> for <i><a href="http://www.toolwar.com/2013/09/snort-tools_7.html" target="_blank">Snort</a> and Suricata.</i> We all know the greatness of these two projects. Even though it concentrates on Snort and Suricata, it can possibly be used to test the <a href="http://www.toolwar.com/search/label/Detect" target="_blank">detection</a> and blocking capabilities of other <b><a href="http://www.toolwar.com/search/label/IDS" target="_blank">IDS</a>/<a href="http://www.toolwar.com/search/label/IPS" target="_blank">IPS</a></b> also. You can also use it to compare IDS/IPS, or compare their configuration modifications or to simply check/validate configurations. The <a href="http://www.toolwar.com/search/label/Frameworks" target="_blank">framework</a> is well equipped with about 300 tests grouped in 8 testing modules, such as:You've just set up your Intrusion Detection/Prevention System  (IDS/IPS) and feel "Now I'm secure". But how can you be so sure? And how  much do you trust your IDS/IPS?</div>
<div style="text-align: justify;">
The only way to ensure your <b>IDS/IPS</b> detects and blocks unwanted  traffic is to test it with specific payloads and <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a>, but this job can  take hours or even days...</div>
<div style="text-align: justify;">
Why all this pain? Here is where pytbull comes in!</div>
<div style="text-align: justify;">
<b>Pytbull</b> is a <a href="http://www.toolwar.com/search/label/Python" target="_blank">python</a> based flexible IDS/IPS <a href="http://www.toolwar.com/search/label/Testing" target="_blank">testing</a> framework  shipped with more than 300 tests, grouped in 9 modules, covering a large  scope of attacks (clientSideAttacks, testRules, badTraffic,  fragmentedPackets, multipleFailedLogins, evasionTechniques, shellCodes,  denialOfService, pcapReplay)</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/_zS1f-F9niw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="https://downloads.sourceforge.net/project/pytbull/pytbull-2.0.tar.bz2" target="_blank">Pytbull v2.0</a> (.tar.bz2)</div>
<div style="text-align: justify;">
<b>Official Website :: </b>http://pytbull.sourceforge.net/ </div>

Pytbull (IDS/IPS Testing) :: Framework

Pytbull is an Intrusion Detection/Prevention System (IDS/IPS) testing framework for Snort and Suricata. We all know the greatness o...

TCPXtract (Network Traffic Extracting) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="tcpxtract" border="0" height="266" src="http://2.bp.blogspot.com/-wNZdoVDtI4k/Ut4f0eDeAuI/AAAAAAAABc8/doMEV5FeF2c/s1600/tcpxtract.jpg" title="tcpxtract" width="400" /></div>
<b>tcpxtract</b> is a tool for <b>extracting files from network traffic</b> based on file signatures. Extracting files based on file type headers and footers (sometimes called <i>"carving"</i>) is an age old data <a href="http://www.toolwar.com/search/label/Recovery" target="_blank">recovery</a> technique. Tools like <a href="http://www.toolwar.com/2013/11/foremost-tools.html" target="_blank">Foremost</a> employ this technique to recover files from arbitrary data streams. <b>Tcpxtract</b> uses this technique specifically for the application of intercepting files transmitted across a <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>. Other <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tools</a> that fill a similar need are driftnet and EtherPEG. driftnet and <b>EtherPEG</b> are tools for <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">monitoring</a> and extracting graphic files on a network and is commonly used by network administrators to police the internet activity of their users. The major limitations of driftnet and EtherPEG is that they only support three filetypes with no easy way of adding more. The search technique they use is also not scalable and does not search across <a href="http://www.toolwar.com/search/label/Packet" target="_blank">packet</a> boundries. <b>tcpxtract</b> features the following:<br />
<ul>
<li>Supports 26 popular file formats out-of-the-box. New formats can be added by simply editing its config file.</li>
<li>With a quick conversion, you can use your old Foremost config file with tcpxtract.</li>
<li>Custom written search algorithm is lightning fast and very scalable.</li>
<li>Search algorithm searches across packet boundries for total coverage and forensic quality.</li>
<li>Uses libpcap, a popular, portable and stable library for network data capture.</li>
<li>Can be used against a live network or a tcpdump formatted capture file. </li>
</ul>
<br />
<h3>
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/uLQokDjcivU?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<h3>
Download :: </h3>
<b>Linux :: </b><a href="http://prdownloads.sourceforge.net/tcpxtract/tcpxtract-1.0.1.tar.gz?download" target="_blank">tcpxtract v1.01</a> (.tar.gz)<b> </b><br />
<b>Official Website ::</b> <a href="http://tcpxtract.sourceforge.net/">http://tcpxtract.sourceforge.net/</a></div>

TCPXtract (Network Traffic Extracting) :: Tools

tcpxtract is a tool for extracting files from network traffic based on file signatures. Extracting files based on file type headers and...

Ardamax Keylogger :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="http://4.bp.blogspot.com/-BaK9eWYpLVc/Uq3PJA6zp8I/AAAAAAAABQY/Z_3gNjzBg9A/s1600/ardamax+keylogger+screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ardamax keylogger " border="0" height="267" src="http://4.bp.blogspot.com/-BaK9eWYpLVc/Uq3PJA6zp8I/AAAAAAAABQY/Z_3gNjzBg9A/s400/ardamax+keylogger+screenshot.png" title="ardamax keylogger " width="400" /></a></div>
<b>Ardamax Keylogger </b>is a <b><i>keystroke recorder</i></b> that captures user's  activity and saves it to an encrypted log file. The log file can be  viewed with the powerful Log Viewer. Use this <a href="http://www.toolwar.com/search/label/Tools" target="_blank">tool</a> to find out what is  happening on your computer while you are away, maintain a backup of your  typed data automatically or use it to <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">monitor</a> your kids. Also you can  use it as a monitoring device for detecting unauthorised access. Logs  can be automatically sent to your e-mail address, access to the  keylogger is <a href="http://www.toolwar.com/search/label/Password" target="_blank">password</a> protected. Besides, <b>Ardamax Keylogger</b> logs  information about the Internet addresses the user has visited. This invisible spy application is designed for 2000, XP, 2003, Vista, 7 and <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> 8.</div>
<h3>
<b>Keylogger Features:</b></h3>
<ul>
<li><b>Email log delivery</b> - keylogger can send you recorded logs through e-mail delivery at set times - perfect for remote monitoring!</li>
<li><b>FTP delivery</b> - Ardamax Keylogger can upload recorded logs through FTP delivery.</li>
<li><b>Network delivery</b> - sends recorded logs through via LAN.</li>
<li><b>Clipboard logging</b> - capture all text copied to the Windows Clipboard. </li>
<li><b>Invisible mode</b> makes it absolutely  invisible to anyone. <b>Ardamax Keylogger</b> is not visible in the task bar,  system tray, Windows 2000/XP/2003/Vista/Windows 7 Task Manager, process  viewers (Process Explorer, WinTasks etc.), Start Menu and Windows  Startup list.</li>
<li><b>Visual surveillance</b> - periodically makes screenshots and stores the compressed images to log.</li>
<li><b>Chat monitoring</b> - Ardamax Keylogger is designed to record and monitor both sides of a conversation in following chats:             <ul>
<li>AIM</li>
<li>Windows Live Messenger 2011</li>
<li>ICQ 7</li>
<li>Skype 4</li>
<li>Yahoo Messenger 10</li>
<li>Google Talk</li>
<li>Miranda</li>
<li>QiP 2010</li>
</ul>
</li>
<li><b>Security</b> - allows you to protect program settings, Hidden Mode and Log file.</li>
<li><b>Application monitoring</b> - keylogger will record the application that was in use that received the keystroke!</li>
<li><b>Time/Date tracking</b> - it allows you to pinpoint the exact time a window received a keystroke!</li>
<li><b>Powerful Log Viewer</b> - you can view and save the log as a HTML page or plain text with keylogger Log Viewer.</li>
<li><b>Small size </b>– Ardamax Keylogger is several  times smaller than other programs with the same features. It has no  additional modules and libraries, so its size is smaller and the  performance is higher.</li>
<li>Ardamax Keylogger fully supports <b>Unicode</b>  characters which makes it possible to record keystrokes that include  characters from Japanese, Chinese, Arabic and many other character sets.</li>
<li>It records every keystroke. Captures passwords and all other invisible text.</li>
</ul>
<b>Other Features:</b><br />
<ul>
<li>Windows 2000/2003/XP/Vista/Windows 7/Windows 8 support</li>
<li>Monitors multi-user machines</li>
<li>Automatic startup</li>
<li>Friendly interface</li>
<li>Easy to install</li>
</ul>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/iJ2udtA48hg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
 </h3>
Screenshots :: <a href="http://www.ardamax.com/keylogger/screenshots.html" target="_blank">Click Here</a>
<br />
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows :: </b><a href="http://www.snapfiles.com/php/sfdwnld.php?id=107631&a=7115070&loc=x" target="_blank">Ardamax Keylogger (Trial Version)</a><b>
</b></div>
<div style="text-align: justify;">
<b>Buy $ ::</b> <a href="https://sites.fastspring.com/ardamax/instant/keylogger" target="_blank">Ardamax Keylogger (Buy Here)</a></div>

Ardamax Keylogger :: Tools

Ardamax Keylogger is a keystroke recorder that captures user's activity and saves it to an encrypted log file. The log file can be ...

ModSecurity (Web Application Firewall) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="modsecurity logo" border="0" height="212" src="http://3.bp.blogspot.com/-9zzXy65oit4/UqhzCp9d89I/AAAAAAAABOY/S7ZlF1x1TlE/s640/mod-security+logo.jpg" title="modsecurity logo" width="640" /></div>
</div>
<div style="text-align: justify;">
<b>ModSecurity</b> is a <i>web application firewall</i> that can work either embedded  or as a <b>reverse proxy</b>. It provides protection from a range of <a href="http://www.toolwar.com/search/label/Attack" target="_blank">attacks</a>  against web applications and allows for HTTP traffic monitoring, logging  and real-time analysis. </div>
<h2 style="text-align: justify;">
ModSecurity: Overview</h2>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
With over 70% of all attacks now carried out over the web application  level, organisations need every help they can get in making their  systems secure. <b>Web application firewalls</b> are deployed to establish an  external <a href="http://security/" target="_blank">security</a> layer that increases security, detects, and prevents  attacks before they reach web applications. </div>
<h3 style="text-align: justify;">
HTTP Traffic Logging</h3>
<div style="text-align: justify;">
<a href="http://www.toolwar.com/search/label/Web" target="_blank">Web</a> servers are typically well-equipped to log traffic in a form useful  for marketing analyses, but fall short when it comes to logging of  traffic to web applications. In particular, most are not capable of  logging the request bodies. Your adversaries know this, and that is why  most attacks are now carried out via POST requests, rendering your  systems blind. </div>
<div style="text-align: justify;">
ModSecurity makes full HTTP transaction logging possible, allowing  complete requests and responses to be logged. Its logging facilities  also allow fine-grained decisions to be made about exactly what is  logged and when, ensure only the relevant data is recorded. </div>
<h3 style="text-align: justify;">
Real-Time Monitoring and Attack Detection</h3>
<div style="text-align: justify;">
In addition to providing logging facilities, <b>ModSecurity</b> can <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">monitor</a> the  HTTP traffic in real time in order to detect attacks. In this case <b> ModSecurity</b> operates as a web intrusion detection tool, allowing you to  react to suspicious events that take place at your web systems. </div>
<h3 style="text-align: justify;">
Attack Prevention and Just-in-time Patching</h3>
<div style="text-align: justify;">
<b>ModSecurity</b> can also act immediately to prevent attacks from reaching  your web applications. There are three commonly used approaches: </div>
<ol style="text-align: justify;">
<li><b>Negative security model.</b> Negative security model monitors  requests for anomalies, unusual behaviour, and common web application  attacks. It keeps anomaly scores for each request, IP addresses,  application sessions, and user accounts. Requests with high anomaly  scores are either logged or rejected altogether. </li>
<li><b>Known weaknesses and vulnerabilities.</b> Its rule language  makes ModSecurity an ideal external patching tool. External patching is  all about reducing the window of opportunity. Time needed to patch  application vulnerabilities often runs to weeks in many organisations.  With ModSecurity, applications can be patched from the outside, without  touching the application source code (and even without any access to  it), making your systems secure until a proper patch is produced. </li>
<li><b>Positive security model.</b> When positive security model is  deployed, only requests that are known to be valid are accepted, with  everything else rejected. This approach works best with applications  that are heavily used but rarely updated. </li>
</ol>
<h3 style="text-align: justify;">
Flexible Rule Engine</h3>
<div style="text-align: justify;">
A flexible rule engine sits in the heart of ModSecurity. It  implements the ModSecurity Rule <a href="http://www.toolwar.com/search/label/Language" target="_blank">Language</a>, which is a specialised  programming language designed to work with HTTP transaction data. The  <b>ModSecurity</b> Rule Language was designed to be easy to use, yet flexible:  common operations are simple while complex operations are possible.</div>
<div style="text-align: justify;">
Certified ModSecurity Rules, included with subscription to  <b>ModSecurity</b>, contain a comprehensive set of rules that implement  general-purpose hardening, common web application security issues.  Heavily commented, these rules can be used as a learning tool.</div>
<h3 style="text-align: justify;">
Embedded Deployment</h3>
<div style="text-align: justify;">
ModSecurity is an embeddable web application firewall, which means it  can be deployed as part of your existing web server infrastructure  (Apache, IIS7 and Nginx).</div>
<div style="text-align: justify;">
This deployment method has certain advantages:</div>
<ol style="text-align: justify;">
<li>No changes to existing network. It only takes a few minutes to add  ModSecurity to your existing web servers. And because it was designed to  be completely passive by default, you are free to deploy it  incrementally and only use the features you need. It is equally easy to  remove or deactivate it should decide you don't want it any more. </li>
<li>No single point of failure. Unlike with network-based  deployments, you will not be introducing a new point of failure to your  system. </li>
<li>Implicit load balancing and scaling. Because it works embedded  in web servers, <b>ModSecurity</b> will automatically take advantage of the  additional load balancing and scalability features. You will not need to  think of load balancing and scaling unless your existing system needs  them. </li>
<li>Minimal overhead. Because it works from inside the web server  process there is no overhead for network communication and minimal  overhead in parsing and data exchange. </li>
<li>No problem with encrypted or compressed content. Many <a href="http://www.toolwar.com/search/label/IDS" target="_blank">IDS</a>  systems have difficulties analysing SSL traffic. This is not a problem  for ModSecurity because it is positioned to work when the traffic is  decrypted and decompressed.  </li>
</ol>
<div style="text-align: justify;">
ModSecurity is known to work well on a wide range of operating systems.  Our customers are successfully running it on <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>, Solaris,  FreeBSD, OpenBSD, NetBSD, AIX, Mac OS X, and HP-UX. </div>
<h3 style="text-align: justify;">
Network-Based Deployment</h3>
<div style="text-align: justify;">
<b>ModSecurity</b> works equally well when deployed as part of a reverse proxy  server, and many of our customers choose to do so. In this scenario, one  installation of <b>ModSecurity </b>can protect any number or type of back-end  web servers. </div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/7w9aHEx-BmE?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/P-KJU785CKg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/nMGtIgrVv8s?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux :: </b></div>
<div style="text-align: justify;">
<b>Installation - Ubuntu/Debian</b>

<span style="font-family: "Courier New",Courier,monospace;"> </span><br />
<span style="font-family: "Courier New",Courier,monospace;">$ sudo apt-get install libapache2-mod-security </span><br />
<span style="font-family: "Courier New",Courier,monospace;">$ sudo a2enmod mod-security </span><br />
<span style="font-family: "Courier New",Courier,monospace;">$ sudo /etc/init.d/apache2 force-reload</span><br />
<br />
 <b>Installation - Fedora/CentOS</b><span style="font-family: "Courier New",Courier,monospace;"> </span><br />
<span style="font-family: "Courier New",Courier,monospace;">$ sudo yum install mod_security </span><br />
<span style="font-family: "Courier New",Courier,monospace;">$ sudo /etc/init.d/httpd restart</span>

<b> </b><br />
<br />
<b>Windows ::</b></div>
<ul>
<li><a href="https://www.modsecurity.org/tarball/2.7.5/ModSecurityIIS_2.7.5.msi">ModSecurity for IIS MSI Installer</a> </li>
<li><a href="https://www.modsecurity.org/tarball/2.7.5/ModSecurityIIS_2.7.5.msi.sha256">ModSecurity for IIS MSI Installer SHA25</a></li>
</ul>
<b>Official Website :: </b><a href="http://www.modsecurity.org/">http://www.modsecurity.org/</a><br />
<ul>
</ul>
<div style="text-align: justify;">
</div>

ModSecurity (Web Application Firewall) :: Tools

ModSecurity is a web application firewall that can work either embedded or as a reverse proxy . It provides protection from a range ...

Subscribe to: Posts ( Atom )