Tools Update - First week of May 2010

["SD List" <list () security-database com>]

Hello

Here is the site's newsletter "Security Database Tools Watch"
(http://www.security-database.com/toolswatch).
This letter summarizes the articles and news items published since 7 days.


         New articles
         --------------------------


** SAMHAIN v2.7.0 released **
by  ToolsTracker
- 1 May 2010

The samhain open source host-based intrusion detection system (HIDS)
provides file integrity checking and logfile monitoring/analysis, as well
as rootkit detection, port monitoring, detection of rogue SUID executables,
and hidden processes.

Samhain v2.6.4 x; Don't read proc_root_iops in sh_kern.c (Problem report
by H. R.)

Logfile check can check output of shell commands

Use data directory as default for logfile checkpoints

Fix broken checkpoint save/restore for logfiles

MD5: (...)

-> http://www.security-database.com/toolswatch/SAMHAIN-v2-7-released.html


** DAVTest v1.0 - WebDAV Application **
by  ToolsTracker
- 1 May 2010

DAVTest tests WebDAV enabled servers by uploading test executable files,
and then (optionally) uploading files which allow for command execution or
other actions directly on the target. It is meant for penetration testers
to quickly and easily determine if enabled DAV services are exploitable.

DAVTest supports:

Automatically send exploit files

Automatic randomization of directory to help hide files

Send text files and try MOVE to executable name

Basic and Digest authorization (...)

->
http://www.security-database.com/toolswatch/DAVTest-v1-WebDAV-Application.html


** [PDF] Penetration: from Application down to OS. **
by  ToolsTracker
- 1 May 2010

Getting OS Access Using Lotus Domino Application Server Vulnerabilities.

This whitepaper continues a series of publications made by DSecRG
researchers describing various ways of obtaining access to the server
operating system, using vulnerabilities in popular business applications
which meet in the corporate environment.

This whitepaper continues a series of publications made by DSecRG
researchers describing various ways of obtaining access to the server
operating system, using (...)

->
http://www.security-database.com/toolswatch/PDF-Penetration-from-Application.html


** Suricata v0.8.2 released **
by  Tools Tracker Team
- 1 May 2010

The Suricata Engine is an Open Source Next Generation Intrusion Detection
and Prevention Engine. This engine is not intended to just replace or
emulate the existing tools in the industry, but will bring new ideas and
technologies to the field.

New features

Support for the following keywords: detection_filter, http_client_body

The HTTP parser can now set server personalities

threshold.config support

The experimental CUDA code now also works on x86_64

IP address only rules for IPv6 are (...)

->
http://www.security-database.com/toolswatch/Suricata-v0-8-2-released.html


** WhatWeb just updated to v0.4.2 **
by  Tools Tracker Team
- 1 May 2010

WhatWeb is a next generation web scanner that identifies what websites are
running. Flexible plugin architecture with over 80 plugins so far. Passive
plugins use information in the headers, cookies, HTML body and URL.
Aggressive plugins can identify versions of Joomla, phpBB, etc by making
extra requests to the webserver

Version 0.4.2

Added header-hash plugin. Makes a hash of the first 500 characters. This
is useful to identify unknown systems

Added footer-hash plugin. Makes a hash of (...)

->
http://www.security-database.com/toolswatch/WhatWeb-just-updated-to-v0-4-2.html


** Sysinternal AccessChk v5.0 released **
by  Tools Tracker Team
- 1 May 2010

AccessChk, a command-line tool for viewing the effective permissions on
files, registry keys, services, processes, kernel objects, and more.

As a part of ensuring that they've created a secure environment Windows
administrators often need to know what kind of accesses specific users or
groups have to resources including files, directories, Registry keys,
global objects and Windows services. AccessChk quickly answers these
questions with an intuitive interface and output.

Changes :

A a new (...)

->
http://www.security-database.com/toolswatch/Sysinternal-AccessChk-v5-released.html


** Spiceworks v4.7 build 50667 released **
by  Tools Tracker Team
- 1 May 2010

Spiceworks is the complete network management & monitoring, helpdesk, PC
inventory & software reporting solution to manage Everything IT in small
and medium businesses.

Spiceworks Lets You...

Inventory Your Network & PCs

Monitor & Manage Your Network

Manage Your IT Assets

Manage Changes & Configurations

Map Your NetworkBETA

Audit Your Software

Troubleshoot Your Network

Run an IT Help Desk

Be an MSP

Talk to IT Pros Like You

Spiceworks IT Desktop is designed for

IT Pros who have (...)

->
http://www.security-database.com/toolswatch/Spiceworks-v4-7-build-50667.html


** OpenDLP v0.1 released  **
by  Tools Tracker Team
- 1 May 2010

OpenDLP is a free and open source, agent-based, centrally-managed,
massively distributable data loss prevention tool released under the GPL.
Given appropriate Windows domain credentials, OpenDLP can simultaneously
identify sensitive data at rest on hundreds or thousands of Microsoft
Windows systems from a centralized web application. OpenDLP has two
components: a web application and an agent.

Web Application

Automatically deploy and start agents over Netbios

When done, automatically stop, (...)

-> http://www.security-database.com/toolswatch/OpenDLP-v0-1-released.html


** [PDF] Hackin9 - May 2010 Released! (NOW FREE!) **
by  ToolsTracker
- 30 April 2010

Hakin9 magazine is now a FREE, ONLINE, MONTHLY magazine! All you need to
do to get a new issue each month is subscribe to the newsletter.

Inside:

Writing WIN32 shellcode with a C-compiler

Flash memory mobile forensic

Threat Modeling Basics

Pwning Embedded ADSL Routers

Firewalls for Beginners

Regulars:

ID Fraud Expert Says by Julian Evans: Identity Theft Protection Services
– a new industry is born

Tool reviews: NTFS Mechanic, Active@ Undelete Professional, KonBoot v1.1

Interview (...)

->
http://www.security-database.com/toolswatch/PDF-Hackin9-May-2010-Released-NOW.html


** Fuzzdb v1.07 released **
by  ToolsTracker
- 29 April 2010

A comprehensive set of fuzzing patterns for discovery and attack during
highly targeted brute force testing of web applications.

Fuzzdb is a comprehensive set of known attack pattern sequences to be
utilized for intelligent brute force testing in order to rapidly identify
exploitable conditions in new applications.

Primary sources used for attack pattern research:

researching old web exploits for repeatable attack strings

scraping scanner patterns from http logs

various books, (...)

-> http://www.security-database.com/toolswatch/Fuzzdb-v1-07-released.html


** WhatWeb v0.4.1 - released **
by  ToolsTracker
- 29 April 2010

Identifying content management systems (CMS), blogging platforms,
stats/analytics packages, javascript libraries, servers and more. Licensed
under GPLv3.

Version 0.4.1

Removed dependency on rubygems and libxslt by modifying and locally
including the Anemone gem. This also simplified installation

Fixed a bug which didn't send URL parameters. eg. would send /index.php
instead of /index.php?q=foo

Improved installation instructions. Henri Salo contacted me to say
ruby-dev is required for (...)

->
http://www.security-database.com/toolswatch/WhatWeb-v0-4-1-released.html


** NSIA (Network System Integrity Analysis) v0.8.99 released **
by  Tools Tracker Team
- 28 April 2010

The ThreatFactor NSIA is a website scanner that monitors websites in
realtime in order to detect defacements, compliance violations, exploits,
sensitive information disclosure and other issues. ThreatFactor detects
issues remotely and therefore requires no software to install, does not
introduce any latency and will not interrupt business operations.

At it's core, ThreatFactor uses an advanced analysis engine that is
capable of detecting a wide variety of issues and can be modified with
(...)

->
http://www.security-database.com/toolswatch/NSIA-Network-System-Integrity.html


** Nessus Parsing Tools v1.3.1 **
by  ToolsTracker
- 28 April 2010

A set of tools to parsing the results of a report.

Code:

nbesql.py

report_auto.py

report_manual_review.py

report_ports.py

report_unsorted.py

sql2html.py

Single use syntax: nbe2sql.py -i

Windows batch for /f %a in ('dir /b *.nbe') do nbe2sql.py -i %a for /f %a
in ('dir /b *.dat') do report_helper_manual_review.py -i %a

More information: here

Thanks to Garrett Gee - Project Leader, from WestCoastHackers.net - for
sharing this tool with (...)

->
http://www.security-database.com/toolswatch/Nessus-Parsing-Tools-v1-3-1.html


** Bruter v1.0 - parallel network login brute-forcer  **
by  ToolsTracker
- 26 April 2010

Bruter is a parallel network login brute-forcer on Win32. This tool is
intended to demonstrate the importance of choosing strong passwords. The
goal of Bruter is to support a variety of services that allow remote
authentication.

Version 1.0

Re-licensed to new-BSD license

Added proxy support (CONNECT, SOCKS4, SOCKS5)

Allowed more delimiter in combo file

Added password length filtered in combo and dictionary mode

Fixed miscellaneous bugs

Updated openssl library to 0.9.8n

SMB: (...)

->
http://www.security-database.com/toolswatch/Bruter-v1-parallel-network-login.html


** Acunetix WVS v6.5 build 20100419 released **
by  ToolsTracker
- 26 April 2010

Acunetix Web Vulnerability Scanner (WVS) is an automated web application
security testing tool that audits your web applications by checking for
exploitable hacking vulnerabilities. Automated scans may be supplemented
and cross-checked with the variety of manual tools to allow for
comprehensive web site and web application penetration testing.

Bug Fix:

Fixed: Access violation when the application exits

How to upgrade: On starting up Acunetix WVS, a pop up window will
automatically notify (...)

->
http://www.security-database.com/toolswatch/Acunetix-WVS-v6-5-build-20100419.html


** (update) Foca v2.0.1: in the wild **
by  Tools Tracker Team
- 26 April 2010

FOCA 2 has a new algorithm which tries to discover as much info related to
network infrastructure as possible. In this alpha version FOCA will add to
the figured out network-map, all servers than can be found using a
recursive algorithm searching in Google, BING, Reverse IP in BING,
Well-known servers and DNS records, using an internal PTR-Scaning, et

To configure this algorithm you can use the new DNS Search panel and the
info extracted will be showed up in three panels:

Domains

IP (...)

-> http://www.security-database.com/toolswatch/Foca-v2-in-the-wild.html


** Fuzzdb updated to v1.06 **
by  Tools Tracker Team
- 25 April 2010

A comprehensive set of fuzzing patterns for discovery and attack during
highly targeted brute force testing of web applications.

Fuzzdb is a comprehensive set of known attack pattern sequences to be
utilized for intelligent brute force testing in order to rapidly identify
exploitable conditions in new applications.

Primary sources used for attack pattern research:

researching old web exploits for repeatable attack strings

scraping scanner patterns from http logs

various books, (...)

->
http://www.security-database.com/toolswatch/Fuzzdb-updated-to-v1-06.html


** (Paper) Pentesting Adobe Flex Applications (introducing new tool
Blazentoo) **
by  Tools Tracker Team
- 25 April 2010

Marcin Wielgoszewski from Gotham Digital Science gave a keynote at the
OWASP NY session (http://www.owasp.org/index.php/NYNJMetro) where he
exhibited intrusion techniques on application based on Adobe AIR. Indeed,
with the integration of RIA in the client side, we tend to forget that the
beauty of things can hide a real threat.

This document details the communication methods used by Adobe Air and some
points of failure. The author also shows how with simple security tools,
which we already (...)

->
http://www.security-database.com/toolswatch/Paper-Pentesting-Adobe-Flex.html


** Skipfish v1.33b released **
by  Tools Tracker Team
- 25 April 2010

Skipfish is an active web application security reconnaissance tool. It
prepares an interactive sitemap for the targeted site by carrying out a
recursive crawl and dictionary-based probes. The resulting map is then
annotated with the output from a number of active (but hopefully
non-disruptive) security checks.

Key Features:

High performance: 500+ requests per second against responsive Internet
targets, 2000+ requests per second on LAN / MAN networks, and 7000+
requests against local (...)

->
http://www.security-database.com/toolswatch/Skipfish-v1-33b-released.html


** Testing the systems highload with StressLinux v0.5.111  **
by  Tools Tracker Team
- 25 April 2010

stresslinux is a minimal linux distribution running from a bootable cdrom,
usb, vmware or via PXE (wip). stresslinux makes use of some utitlities
available on the net like: stress, cpuburn, hddtemp, lm_sensors ...
stresslinux is dedicated to users who want to test their system(s) entirely
on high load and monitoring the health.

Stresslinux is for people (system builders, overclockers) who want to test
their hardware under high load and monitor stability and thermal
environment.

You should (...)

->
http://www.security-database.com/toolswatch/Testing-the-systems-highload-with.html


** Process Monitor v2.9 released **
by  Tools Tracker Team
- 25 April 2010

Process Monitor is an advanced monitoring tool for Windows that shows
real-time file system, Registry and process/thread activity. It combines
the features of two legacy Sysinternals utilities, Filemon and Regmon.

Process Monitor adds an extensive list of enhancements including rich and
non-destructive filtering, comprehensive event properties such session IDs
and user names, reliable process information, full thread stacks with
integrated symbol support for each operation, simultaneous (...)

->
http://www.security-database.com/toolswatch/Process-Monitor-v2-9-released.html


** SIP Inspector v1.10 released **
by  Tools Tracker Team
- 25 April 2010

SIP Inspector is a tool written in JAVA to simulate different SIP messages
and scenarios. You can create your own SIP signaling scenarios, customize
SIP messages and monitor incoming and outgoing messages. The tool can play
RTP streams from a pcap file.

Release notes 1.1

Bug fixes:

Call specific variables are lost if multiple concurrent calls created

If Total Calls field set to 0, does not allow infinite number of calls

Outgoing calls with custom value and not generic [call_number] for (...)

->
http://www.security-database.com/toolswatch/SIP-Inspector-v1-10-released.html


** Aircrack-ng v1.1 released **
by  Tools Tracker Team
- 25 April 2010

Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can
recover keys once enough data packets have been captured. It implements the
standard FMS attack along with some optimizations like KoreK attacks, as
well as the all-new PTW attack, thus making the attack much faster compared
to other WEP cracking tools.

«Aircrack-ng is a set of tools for auditing wireless networks.»

A lot of bug fixes (including the buffer overflow in different tools) and
improvements have been (...)

->
http://www.security-database.com/toolswatch/Aircrack-ng-v1-1-released.html


** Security Ninja security tool announcement **
by  Tools Tracker Team
- 24 April 2010

Security Ninja blog : The tool is the result of me thinking about writing
a tool to help people conduct security code reviews for over a year. I had
conference presentations to prepare, certification exams to sit and of
course a lot of conference speaking slots last year which meant the tool
idea had to go on the backburner. The benefit of having this idea going
around in my head for so long is that I knew exactly what I wanted the tool
to look like and how I wanted it to function before I (...)

->
http://www.security-database.com/toolswatch/Security-Ninja-security-tool.html

Regards

Security-Database Team


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------