See this at: justin.madirish.net| Added on 07/21/08

Submitted by justin on Mon, 07/14/2008 - 16:30. * Security When you start working in computer security, as with many computer related fields, you'll find that there are a lot of expensive tools out there to assist in your work. You may even begin to... See more

Submitted by justin on Mon, 07/14/2008 - 16:30. * Security When you start working in computer security, as with many computer related fields, you'll find that there are a lot of expensive tools out there to assist in your work. You may even begin to believe that exploring the field of computer security will require a significant investment in order to purchase tools. In reality, much of what you need is available for free and available as open source software. In order to save people time and effort in having to track down the tools that I use most commonly in hacking and security research. Most of these tools work well on both Windows and Linux platforms. 1. VirtualBox - Innotech was recently acquired by Sun and they now distribute VirtualBox. VirtualBox is a full featured virtualization platform, comparable to VMWare Workstation. You can create virtual machines, run multiples at a time, take snapshots and roll back machine state. You can also edit virtual machine settings from within... See less

See this at: verot.net| Added on 07/02/08

You do need the following: * HTTPS access through the firewall. Most hotspots will leave HTTPS open, port 443, so that people can browse Internet and go to secure sites * A server somewhere on Internet, even an home machine, with root access * Well,... See more

You do need the following: * HTTPS access through the firewall. Most hotspots will leave HTTPS open, port 443, so that people can browse Internet and go to secure sites * A server somewhere on Internet, even an home machine, with root access * Well, Linux. This howto is using Debian systems. You can probably have it to work on Windows too, using other tools * A little bit of time to try the different solutions See less

See this at: buzzsurf.com| Added on 06/10/08

Introduction | More and more employers and universities are becoming aware of the amount of time their employees or students are spending using the Internet for personal reasons. Obviously employers want to discourage this behavior and may implement... See more

Introduction | More and more employers and universities are becoming aware of the amount of time their employees or students are spending using the Internet for personal reasons. Obviously employers want to discourage this behavior and may implement a number of different ways to do so. These can include; * Restricting people from installing programs on their workstation. This usually won't stop someone from accessing websites, but it may keep people from playing games or using instant messaging software. * Using a firewall or proxy server to restrict access to websites or other Internet protocols. All your Internet communication passes through your network's firewall, so it's a great place to monitor and restrict access. How complex or restrictive it is largely depends how tech savvy your IT department is. * Using a network monitoring system to "spy" on Internet access. This is a form of firewall monitoring, where your employer can intercept and read/save anything flowing through their... See less

See this at: rsync.net| Added on 05/16/08

rsync.net gives you full control over your remote files using the sophisticated Unix functionality of your OSX system. A wide range of access methods are available: - Seamless drag and drop access with the Finder - Powerful, scheduled backups with... See more

rsync.net gives you full control over your remote files using the sophisticated Unix functionality of your OSX system. A wide range of access methods are available: - Seamless drag and drop access with the Finder - Powerful, scheduled backups with the built-in OSX rsync command - Efficient Remote Backup of Encrypted Disk Images - Local filesystem mount with sshFS for OSX - Standard FTP, SFTP and WebDAV access - Powerful Remote Command Execution and Pipelining rsync.net also provides unlimited, free technical support on any topic related to your use of our product. We have a unique philosophy that ensures you will always deal with real OSX engineers and will never be stuck in a phone queue or email ticket system. See less

Highlights: Geo-Redundant Filesystem - $2.80 / GB per month

See this at: netsecurity365.com| Added on 11/03/07

All router and accesspoint have password to login administration interface and modify any configuration settings. But almost password are weak or default password is name of manufacturer. So after setup your wireless devices, first step you have to... See more

All router and accesspoint have password to login administration interface and modify any configuration settings. But almost password are weak or default password is name of manufacturer. So after setup your wireless devices, first step you have to change default password to strong password, keep in mind or should wr... See less

See this at: csu.edu.au| Added on 08/25/07

I run minnie.cs.adfa.oz.au, a FreeBSD 1.1 network server with the following services: * Anonymous ftp to 500M of files, using WU-FTP 2.4; * Web service to 100M of files, using Apache 0.8.8; * Email using a `wrapped' Sendmail 8.6.10; * NTP using Xntpd... See more

I run minnie.cs.adfa.oz.au, a FreeBSD 1.1 network server with the following services: * Anonymous ftp to 500M of files, using WU-FTP 2.4; * Web service to 100M of files, using Apache 0.8.8; * Email using a `wrapped' Sendmail 8.6.10; * NTP using Xntpd 3.3g, * Telnet service with Berkeley Telnetd; * Rsh and rlogin services (only on my subnet) using Berkeley Rshd and Rlogind; * Converse service, a talk-like protocol used in amateur radio; and * Domain Name service using Berkeley Named 4.9.3. Minnie runs no other services. I use the wonderful tool called TCP_Wrappers, written by Wietse Venema, to protect services such as rsh, rlogin and converse. TCP_Wrappers allows or denies connections to particular services depending on the IP address from where the request comes. On Minnie, requests to these services from outside my department are rejected, and the requests are logged. TCP_Wrappers is a great utility, and if you're running any Internet connected Unix machine, I'd recommend using... See less

See this at: viruslist.com| Added on 06/06/07

How would you prefer to pay for your antivirus solution? | Using a prepay card | Via your mobile (SMS) | Via the Internet using a debit\ credit card | Using cash\ credit\ debit in a shop | Using an e-payment system (e.g. PayPal)

How would you prefer to pay for your antivirus solution? | Using a prepay card | Via your mobile (SMS) | Via the Internet using a debit\ credit card | Using cash\ credit\ debit in a shop | Using an e-payment system (e.g. PayPal) See less

See this at: itsecurity.com| Added on 06/05/07

Are you ready for the next email virus? Prepare your company today for what might come tomorro...

Are you ready for the next email virus? Prepare your company today for what might come tomorrow. Find out what to look for and how you can fix it. Go to the Email Security Resource Center › See less

See this at: rubygems.org| Added on 05/22/07

The Gem::Specification object controls the data (and metadata) that goes into a GEM package. This reference defines the fields used in a Gem::Specification.

The Gem::Specification object controls the data (and metadata) that goes into a GEM package. This reference defines the fields used in a Gem::Specification. See less

See this at: averageadmins.com| Added on 05/22/07

* Chris Davis on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * lenchy on truebsd - livecd bsd for the end-user. *... See more

* Chris Davis on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * lenchy on truebsd - livecd bsd for the end-user. * wincerely on force flashing the nokia e61. * Chris Davis on how fast do you type?. * Chris "Kester" Smith on jlt @ timothy's - saturday, 2/10 8:00 pm. * Troy James on how fast do you type?. See less

See this at: averageadmins.com| Added on 05/21/07

* Chris Davis on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * lenchy on truebsd - livecd bsd for the end-user. *... See more

* Chris Davis on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * Chris Davis on how fast do you type?. * Troy James on how fast do you type?. * lenchy on truebsd - livecd bsd for the end-user. * wincerely on force flashing the nokia e61. * Chris Davis on how fast do you type?. * Chris "Kester" Smith on jlt @ timothy's - saturday, 2/10 8:00 pm. * Troy James on how fast do you type?. See less

See this at: advosys.ca| Added on 04/19/07

January 16th, 2007 Posted by D Webber The lede of today’s SANS Newsbites claims that the U.S. military is about to start using standardized "secure configurations" of Windows operation systems across all services: "Over the next several weeks, you’ll... See more

January 16th, 2007 Posted by D Webber The lede of today’s SANS Newsbites claims that the U.S. military is about to start using standardized "secure configurations" of Windows operation systems across all services: "Over the next several weeks, you’ll begin to hear about US military services standardizing on secure configurations of common operating systems (VISTA and XP to start) (1) so they can avoid costs and errors of tens of thousands of sites doing their own hardening, (2) so they can get the operating system vendors to test patches on the standard configurations before releasing them - so patches can be installed much more quickly, and (3) so they can ensure application vendors deliver software that doesn’t force configuration changes that conflict with their standard configuration." If true it’ll be interesting to see how successful the initiative is. The article implies that the "secure configurations" used will be the well-known benchmarks published by the SANS-related Center... See less

See this at: advosys.ca| Added on 04/18/07

July 29th, 2006 Posted by D Webber Pretty Good Privacy (PGP) and the open source Gnu Privacy Guard (GPG) are the popular public key encryption tools that don’t require the complexities of a Public Key Infrastructure. They are excellent tools for... See more

July 29th, 2006 Posted by D Webber Pretty Good Privacy (PGP) and the open source Gnu Privacy Guard (GPG) are the popular public key encryption tools that don’t require the complexities of a Public Key Infrastructure. They are excellent tools for strong encryption and non-repudiation using de facto standards. By default PGP and GPG use public key cryptography which provides a form of two factor authentication: to decrypt, you must know both a passphrase and have the correct private key. If your passphrase is compromised (e.g. by someone shoulder surfing or via a keylogger), the attacker still has to have your private key to decrypt any files. However, once in a while you need to send a sensitive file to someone who doesn’t use PGP or GPG regularly and doesn’t have a public key. Without a public key, you can’t encrypt so that only that person can decrypt. In that situation either you talk the person through the finicky process of creating and publishing a PGP/GPG key pair, or take the... See less

See this at: linuxsecurity.com| Added on 04/17/07

Resources Hits Your ISP probably assigns your computer an IP address dynamically. It means one less thing for the both of you to think about, but it also puts you in a bind if you need to connect to your machine from the outside: you can't locate... See more

Resources Hits Your ISP probably assigns your computer an IP address dynamically. It means one less thing for the both of you to think about, but it also puts you in a bind if you need to connect to your machine from the outside: you can't locate your PC amidst tho 328 The first thing that comes to most sysadmins' minds when they hear about file and print services in mixed Windows and Linux environments is probably Samba, but you can also make a rock-solid system for sharing resources via NFS on the *nix platform a 201 See less

See this at: insecure.org| Added on 04/02/07

The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts to automate a wide variety of networking tasks. Those scripts are then executed in parallel with the speed and... See more

The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts to automate a wide variety of networking tasks. Those scripts are then executed in parallel with the speed and efficiency you expect from Nmap. Users can rely on the growing and diverse set of scripts distributed with Nmap, or write their own to meet custom needs. The tasks we had in mind when creating the system are: Network discovery This is Nmap's bread and butter. Examples include looking up whois data based on the target domain, querying ARIN, RIPE, or APNIC for the target IP to determine ownership, performing identd lookups on open ports, SNMP queries, and listing available NFS/SMB/RPC shares and services. More sophisticated version detection The Nmap version detection system is able to recognize thousands of different services through its probe and regular-expression based matching system, but it cannot recognize everything. For example, we... See less

See this at: project.honeynet.org| Added on 03/25/07

The Honeynet Project is a non-profit (501c3) volunteer, research organization dedicated to improving the security of the Internet at no cost to the public. All of our work is released as and we are firmly committed to the ideals of OpenSource. Our... See more

The Honeynet Project is a non-profit (501c3) volunteer, research organization dedicated to improving the security of the Internet at no cost to the public. All of our work is released as and we are firmly committed to the ideals of OpenSource. Our goal, simply put, is to make a difference. We accomplish this goal in the following three ways. | Awareness We raise awareness of the threats and vulnerabilities that exist in the Internet today. Many individuals and organizations do not realize they are a target, nor understand who is attacking them, how, or why. We provide this information so people can better understand they are a target, and understand the basic measures they can take to mitigate these threats. This information is provided through our Know Your Enemy series of papers. Information For those who are already aware and concerned, we provide details to better secure and defend your resources. Historically, information about attackers has been limited to the tools they use. We... See less

See this at: disaster-recovery-gu...| Added on 02/27/07

Every business and organization can experience a serious incident which can prevent it from continuing normal operations. This this can happen any day at any time. The potential causes are many and varied: flood, explosion, computer malfunction,... See more

Every business and organization can experience a serious incident which can prevent it from continuing normal operations. This this can happen any day at any time. The potential causes are many and varied: flood, explosion, computer malfunction, accident, grievious act... the list is endless. The information below is designed to help you plan for these scenarios. They will help you reduce both the risk and impact should the worst occur. | Disaster Recovery Planning - The Basics | The Right Start To succeed, the planning exercise must have full support.. and be well planned in itself Disaster Recovery Plan Having a disaster recovery plan is a fundamental responsibility of every organization. Developing one need not be a trauma. | Why Bother Planning? There are a number of good reasons why the plan development project is essential. Contingency Health Check How often do you review the adequacy of your contingency? How thorough is the review? | Make It Policy Contingency planning should be... See less

See this at: projecthoneypot.org| Added on 02/27/07

“Now a group of white hats is riding across the prairie to take a bite out of spam.”

“Now a group of white hats is riding across the prairie to take a bite out of spam.” See less

See this at: vtc.com| Added on 02/22/07

* Never has it been so easy to learn CompTIA Security+ Certification. * No expensive classroom training courses. * No boring hard to follow books to read. * Learn from your own desk at a pace that suits you. * High quality affordable training that is... See more

* Never has it been so easy to learn CompTIA Security+ Certification. * No expensive classroom training courses. * No boring hard to follow books to read. * Learn from your own desk at a pace that suits you. * High quality affordable training that is easy to use and follow. * Use our unique training method, it makes learning easy no matter what your learning style. See less

Highlights: Single User: US$ 99.95 - Purchase/Add to Cart

See this at: searchsecurity.bitpi...| Added on 02/15/07

Library Home | White Papers | Products | Webcasts | IT Downloads | Partner with Us | Bitpipe Definitions: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Other | What's Popular at Bitpipe? Daily Top 50 Reports | Daily Top 100 Topics | Popular... See more

Library Home | White Papers | Products | Webcasts | IT Downloads | Partner with Us | Bitpipe Definitions: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Other | What's Popular at Bitpipe? Daily Top 50 Reports | Daily Top 100 Topics | Popular Report Topics | Popular Product Topics | SearchSecurity Research Library Copyright © 1998-2007 Bitpipe, Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. Use of this web site constitutes acceptance of the Bitpipe Terms and Conditions and Privacy Policy. webmaster@techtarget.com See less

See this at: gemal.dk| Added on 01/19/07

BrowserSpy can tell you all kinds of detailed information about you and your browser. Stuff like the version of your browser. What kind of things it supports and what it doesn't support. Furthermore it can provide you detailed information about... See more

BrowserSpy can tell you all kinds of detailed information about you and your browser. Stuff like the version of your browser. What kind of things it supports and what it doesn't support. Furthermore it can provide you detailed information about JavaScript, Java, Plug-ins, Components, Bandwidth, Language, Screen, Hardware, IP, Cookies, Web Server, and much more.... See less

See this at: linuxjournal.com| Added on 01/19/07

Who needs NFS or Samba when you can mount filesystems with SSHFS? like scp, sftp and rsync allow us to copy files easily and securely between these accounts. But, what if we don't want to copy the files to our local system before using them?... See more

Who needs NFS or Samba when you can mount filesystems with SSHFS? like scp, sftp and rsync allow us to copy files easily and securely between these accounts. But, what if we don't want to copy the files to our local system before using them? Normally, this would be a good place for a traditional network filesystem, such as NFS, OpenAFS or Samba. Unfortunately, setting up these network filesystems requires administrator access on both systems. Enter SSHFS and FUSE Luckily, as long as you have SSH access, you can use SSHFS to mount and use remote directory trees as if they were local. SSHFS requires no special software on the remote side, just a modern SSH server with support for the SFTP extension. All modern Linux distributions support this extension, which was added to OpenSSH in version 2.3.0, released in November 2000. is built upon the FUSE user-space filesystem framework project. FUSE allows user-space software, SSH in this case, to present a virtual filesystem interface to the... See less

Highlights: $1.88 an issue!* | Start your risk-free subscription today!

See this at: cirt.net| Added on 01/19/07

Download Version 1.35 | Plugins & DBs | Nikto Loot Update Submit updates for Nikto databases. Description Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200... See more

Download Version 1.35 | Plugins & DBs | Nikto Loot Update Submit updates for Nikto databases. Description Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3200 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired). Nikto is not designed as an overly stealthy tool. It will test a web server in the shortest timespan possible, and it's fairly obvious in log files. However, there is support for LibWhisker's anti-IDS methods in case you want to give it a try (or test your IDS system). Not every check is a security problem, though most are. There are some items that are "info only" type checks that look for items that may not have a security flaw, but the webmaster or security engineer may not know are present on the server. These items are usually... See less

See this at: claws-and-paws.com| Added on 01/19/07

Telnet is the name of both a program and a part of the TCP/IP protocol suite which allows you to remotely access a computer. In the case of services such as mail, which run on port 25, you can telnet into that port and interact with the service... See more

Telnet is the name of both a program and a part of the TCP/IP protocol suite which allows you to remotely access a computer. In the case of services such as mail, which run on port 25, you can telnet into that port and interact with the service manually. You can also do this to webservers on port 80 or finger daemons on port 79. It's kinda neat. :-) Anyway, to access telnet if you are on a UNIX system, just type telnet hostname , where the port number is optional. If you are on Windows 95/98/NT, choose "Run" from the start menu and type telnet hostname from there. Otherwise, searching Tucows for a Telnet program would be a good thing (NiftyTelnet for Macintosh is pretty good). Back to Top is the "point of injection"? In a typical spam, there are two different kinds of systems involved: * The sending system. This is the actual machine that the spammer is on, assuming that they are using a SLIP/PPP connection. Its name usually has "dialup" or "ppp" somewhere in the name. * The mailing... See less

See this at: freewarelist.net| Added on 01/19/07

WinPatrol with Scotty the Windows Watch Dog will sniff out worms, adware, spyware, cookies, Trojan horses, and other nasty programs that may attack your computer. This program puts you back in control of your computer with no need for constant... See more

WinPatrol with Scotty the Windows Watch Dog will sniff out worms, adware, spyware, cookies, Trojan horses, and other nasty programs that may attack your computer. This program puts you back in control of your computer with no need for constant updates. WinPatrol´s goal is to help you better understand what programs are running on your computer and to alert you to any new programs added without your permission. Scotty lets you confirm any new programs or add-ons set up to run on your computer. traditional security programs, WinPatrol doesn´t scan your hard drive searching for previously identified threats. Instead using a heuristic approach, a snapshot is taken of your critical system resources and WinPatrol alerts you to any changes that occur without your knowledge. You´ll be warned immediately by Scotty and will be removing dangerous new threats while others wait to hear about them on the news. WinPatrol 8.1 includes enhanced reports and checks for a number of new Internet Explorer... See less

See this at: paginas.terra.com.br| Added on 01/07/07

The goal of this site is to give an overview of hash functions intended for cryptographic applications. It has been motivated by The Block Cipher Lounge maintained by Lars Knudsen and Vincent Rijmen. Whenever a hash function can produce several hash... See more

The goal of this site is to give an overview of hash functions intended for cryptographic applications. It has been motivated by The Block Cipher Lounge maintained by Lars Knudsen and Vincent Rijmen. Whenever a hash function can produce several hash sizes, separate versions are listed only if the distinct sizes are obtained by means other than mere truncation. In the FIPS 180-2 standard, NIST defined companions to the SHA-1 hash function that provide a level of collision resistance equivalent to the security of 3DES and each AES key sizes. The new hash functions are SHA-224, SHA-256, SHA-384, and SHA-512, collectively called the SHA-2 family. It is perhaps a pity that NIST has not established a hash function quest as it had for AES. In this regard, I used to say here that not all is lost because of the NESSIE project. However, the only hash function submitted to NESSIE was WHIRLPOOL. It may therefore be no wonder -- but I'm nevertheless delighted, of course -- that WHIRLPOOL has been... See less

See this at: snort.org| Added on 01/07/07

BASE: Basic Analysis and Security Engine BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the... See more

BASE: Basic Analysis and Security Engine BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT sensor. The latest BASE 1.2.6 (christine) release is available for download. Check out the project here. See less

See this at: insecure.org| Added on 01/05/07

Fyodor has co-authored a novel on hacking, along with FX, Joe Grand, Kevin Mitnick, Ryan Russell, Jay Beale, and several others. Their individual stories combine to describe a massive electronic financial heist. While the work is fiction, hacks are... See more

Fyodor has co-authored a novel on hacking, along with FX, Joe Grand, Kevin Mitnick, Ryan Russell, Jay Beale, and several others. Their individual stories combine to describe a massive electronic financial heist. While the work is fiction, hacks are described in depth using real technology such as Nmap, Hping2, OpenSSL, etc. Stealing the Network: How to Own a Continent can be purchased at Amazon (save $17), and your can read Fyodor's chapter online for free. STC was a best-seller, ranking for a while as the second-highest selling computer book on Amazon. | Update: Syngress has released a sequel: Stealing the Network: How to Own an Identity. They have generously allowed Fyodor to post his favorite chapter for free. So enjoy Bl@ckTo\/\/3r, by Nmap contributor Brian Hatch. It is full of wry humor and creative security conundrums to keep the experts entertained, while it also offers security lessons on the finer points of SSH, SSL, and X Windows authentication and encryption. See less

See this at: splunk.com| Added on 01/02/07

Splunk is software that indexes and securely manages all your logs and IT data. It's easy to download, install and use and it's very powerful. System administrators, developers and even business users can search, navigate, alert and report on logs... See more

Splunk is software that indexes and securely manages all your logs and IT data. It's easy to download, install and use and it's very powerful. System administrators, developers and even business users can search, navigate, alert and report on logs and IT data from any application, server or network device in real time. See less