[John the Ripper v1.8.0] Fast Password Cracker

John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

John the Ripper is free and Open Source software, distributed primarily in source code form. If you would rather use a commercial product tailored for your specific operating system, please consider John the Ripper Pro, which is distributed primarily in the form of "native" packages for the target operating systems and in general is meant to be easier to install and use while delivering optimal performance.

Changelog v1.8.0

• Revised the incremental mode to let the current character counts grow for each character position independently, with the aim to improve efficiency in terms of successful guesses per candidate passwords tested.
• Revised the pre-defined incremental modes, as well as external mode filters that are used to generate .chr files.
• Added makechr, a script to (re-)generate .chr files.
• Enhanced the status reporting to include four distinct speed metrics (g/s, p/s, c/s, and C/s).
• Added the “–fork=N” and “–node=MIN[-MAX]/TOTAL” options for trivial parallel and distributed processing.
• In the external mode compiler, treat character literals as unsigned.
• Renamed many of the formats.
• Updated the documentation.
• Relaxed the license for many source files to cut-down BSD.
• Relaxed the license for John the Ripper as a whole from GPLv2 (exact version) to GPLv2 or newer with optional OpenSSL and unRAR exceptions.
• Assorted other changes have been made.

Download John the Ripper v1.8.0

[PenQ] The Security Testing Browser Bundle

PenQ is an open source Linux based penetration testing browser bundle we built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more. 

PenQ is configured to run on Debian based distributions including Ubuntu and its derivative distros, and penetration testing operating systems such as BackTrack and Kali.With all its integrations, PenQ is a powerful tool. Be mindful of what use you put it to. Responsible use of PenQ can help secure web apps in a zap.

Features

• OWASP ZAP
• OWASP WebScarab
• OWASP WebSlayer
• Nikto Web Server Scanner

• Wfuzz Web Application Fuzzer
• Mozilla Add-ons Collection
• Integrated Tor
• OWASP Penetration Testing Checklist

• PenTesting Report Generator
• Vulnerability Databases Search
• Access to Shell and System Utilities
• Collection of Useful Links

Download PenQ

AndroRat - Remote Administration Tool for Android

Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server.

The name Androrat is a mix of Android and RAT (Remote Access Tool).

It has been developed in a team of 4 for a university project. It has been realised in one month. The goal of the application is to give the control of the android system remotely and retrieve informations from it.

Technical matters

• The android application is the client for the server which receive all the connections.
• The android application run as a service(not an activity) that is started during the boot. So the user does not need to interact with the service (Even though there is a debug activity that allow to configure the IP and the port to connect to).
• The connection to the server can be triggered by a SMS or a call (this can be configured)

All the available functionalities are

• Get contacts (and all theirs informations)
• Get call logs
• Get all messages
• Location by GPS/Network
• Monitoring received messages in live
• Monitoring phone state in live (call received, call sent, call missed..)
• Take a picture from the camera
• Stream sound from microphone (or other sources..)
• Streaming video (for activity based client only)
• Do a toast
• Send a text message
• Give call
• Open an URL in the default browser
• Do vibrate the phone

Folders

The project contains the following folders:

• doc: Will soonly contain all the documentation about the project
• Experiment: Contain an experimental version of the client articulated around an activity wish allow by the way to stream video
• src/Androrat: Contain the source code of the client that should be put on the android plateform
• src/AndroratServer: Contain the sources of the Java/Swing server that can be run on any plateform
• src/api: Contain all the different api used in the project (JMapViewer for the map, forms for swing, and vlcj for video streaming)
• src/InOut: Contain the code of the content common for the client and the server which is basically the protocol implementation

Download AndroRat

[Suricata 1.4.2] Next Generation Intrusion Detection and Prevention Engine

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.

OISF is part of and funded by the Department of Homeland Security's Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the the Navy's Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members. 

 The Suricata Engine and the HTP Library are available to use under the GPLv2. 

The HTP Library is an HTTP normalizer and parser written by Ivan Ristic of Mod Security fame for the OISF. This integrates and provides very advanced processing of HTTP streams for Suricata. The HTP library is required by the engine, but may also be used independently in a range of applications and tools. 

Improvements

• No longer force "nocase" to be used on http_host
• Invalidate rule if uppercase content is used for http_host w/o nocase
• Warn user if bpf is used in af-packet IPS mode
• Better test for available libjansson version

Fixes

• Fixed accuracy issues with relative pcre matching (#784)
• Improved accuracy of file_data keyword (#788)
• Invalidate negative depth (#770)
• Fix http host parsing for IPv6 addresses (#761)
• Fix fast.log formatting issues (#773)
• Fixed deadlock in flowvar set code for http buffers (#801)
• Various signature ordering improvements
• Minor stream engine fix

Download Suricata 1.4.2

[Veil v1.2] A Payload Generator to Bypass Antivirus

Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions.

Veil was designed to run on Kali Linux, but should function on any system capable of executing python scripts. Simply call Veil from the command line, and follow the menu to generate a payload. Upon creating the payload, veil will ask if you would like the payload file to be converted into an executable by Pyinstaller or Py2Exe.

If using Pyinstaller, Veil will convert your payload into an executable within Kali.

If using Py2Exe, Veil will create three files:

• payload.py - The payload file
• setup.py - Required file for Py2Exe
• runme.bat - Batch script for compiling the payload into a Windows executable

Move all three files onto your Windows machine with Python installed. All three files should be placed in the root of the directory Python was installed to (likely C:\Python27). Run the batch script to convert the Python script into an executable format.

Place the executable file on your target machine through any means necessary and don't get caught!

Download Veil v1.2

[Sandcat Browser 4.0] The fastest web browser with many useful security and developer oriented tools

Sandcat Browser, The fastest web browser with many useful security and developer oriented tools updated to version 4.0 with the fastest scripting language packed with features for pen-testers.

Sandcat 4 adds a large number of enhancements, new features, extensions and bug fixes, and provides a dramatically improved user experience on several fronts.

Sandcat 4 adds several new pen-tester extensions as part of the new incarnation of its Pen-Tester Tools extension pack. This includes: a Request Loader, a XHR Editor, a XHR Fuzzer, a CGI Scanner, a HTTP Brute Force extension, enhanced request editors, enhanced script runners, and more.

New versions comes with a revamped and enhanced Live Headers. You can now view not only the request headers and response headers but the response of HTTP requests and XHR calls. The captured requests can be viewed, exported to and imported from individual files via its Live Headers bar.

It adds the ability to save the full request details of captured requests as part of a Sandcat Live Headers export file. Also Sandcat 4 comes with an enhanced version of the Sandcat Console, and it is now possible not only to add custom commands, but to create custom consoles.

You can read full change log.

Download Sandcat Browser 4.0

[aidSQL] A tool that will aid you when trying to find vulnerable spots in your site

Is a PHP application provided for detecting security holes in your website/s. It's a modular application, meaning that you can develop your very own plugins for SQL injection detection & exploitation.

2013-05-27

---

NEW aidSQL Release which supports MS SQL SERVER 2000 Database injection and reverse enginneering.

2013-05-23

---

SOON, new release with Ms SQL Reverse Engineering support

2012-09-12

---

Hey everyone! I just got back to business and I'm improving aidSQL's code structure plus adding some other functionality to it. I'm currently looking for people who can contribute doing BASH SCRIPTING. I'm now doing a small test site installer for using aidSQL locally and I'm in need of bash scripters, if you are one/known one, send me an email.

Download aidSQL

[SET v5.1] The Social-Engineer Toolkit codename “Name of the Doctor”

The Social-Engineer Toolkit (SET) version 5.1 codename “Name of the Doctor” has been released. This version adds a complete rewrite of the MSSQL Bruter as well as a new attack vector utilizing the PSExec functionality within Metasploit.

The MSSQL Bruter now incorporates UDP port 1434 quick discovery by sending a specially crafted packet to MSSQL servers and returning the port automatically. This technique eliminates the need to port scan and quickly identifies the SQL server as well as what port the SQL server is listening on. In addition, SET has moved away from the _mssql python module and towards impacket from Core Security. Main reason for this is due to some instabilities in later versions of _mssql with execute_query() being broke as well as the functionality built into impacket makes it much easier to use.

In addition to utilizing impacket, originally in SET you had two options for payload delivery, the first being POwerShell and the second the binary 2 hex debug conversion attack vector. This has been changed to automatically detect if PowerShell is installed on the victim machine, if it is – SET will automatically deploy a PowerShell injection technique that has been completely rewritten in the MSSQL module. If it does not detect PowerShell, it will automatically revert back to the debug. Lastly on the MSSQL Bruter portions, performance has been increased significantly on the brute forcing, discovery, and deploying of payloads.

For a video of the features, check out below:

Vimeo: Video

A new attack vector build into SET is the new psexec attack vector inside the Fast-Track menu. During a penetration test, often times you may have credentials to a server and want Meterpreter on a wide scale level. The psexec traditional module gets picked up by Anti-Virus due to known signatures being used. You can either use the EXE::Custom advanced feature however it still doesn’t give you the ability to select RHOSTS (multiple IP addresses) unless you custom script it or through something like railgun. The newer module “psexec_command” allows you to specify RHOSTS as well as execute a command on the operating system. Inside of SET, the psexec attack vector will automatically created a meterpreter backdoor through PowerShell and deploy it to systems you have permission to (RHOSTS). You can either use a username and password that you’ve decrypted or the hash for the pass the hash attack vector.

In addition to the new attack vectors, a number of other improvements, bug fixes, and enhancements have been made in this release. For more on all of the changes, check out the changelog before:

Changelog v5.1

• when specifying a custom wordlist in SET – added the ability for ports to be specified ipaddr:portnum for example 192.168.5.5:2052 just in case a SQL server is not listening on 1433
• incorporated udp port 1434 enumeration instead of portscanning – much more faster and efficent – also finds ports that are not on port 1433 (thanks Larry Spohn)
• removed the src/core/portscan.py it is no longer needed
• added impacket as a dependacy – will be used for psexec command execution and TDS connections via mssql
• fixed an issue that would cause the import modules to not load properly when relaunching the MSSQL Brute attack
• improved the speed of the MSSQL brute attack on initial brute force
• completely rewrote MSSQL Brute to incorporate impacket – SET no longer uses the _mssql module – highly buggy in the latest versions
• improved udp 1434 detection capability by piping through the printCIDR function which will utilize CIDR notations when scanning
• incorporated new function called capture which will take stdout from function calls and present them as a string – important when doing regex in impacket
• streamlined the MSSQL bruter to automatically profile the system to determine if Powershell is installed, if so it will automatically do powershell injection, if not it will fall back to the Windows debug method for payload delivery
• rewrote the entire powershell deployment module – it now ties in to standard powershell shell payload delivery system
• added dynamic shellcode patching to the MSSQL bruter – now generates shellcode automatically, cast it unicode, then base64 encoding for EncodedCommand powershell bypass technique
• rewrote the hex2binary deployment method to support the new impacket method – it will now automatically deliver a binary based on the attack vector that you want to use
• shrunk the powershell injection code to fit properly within MSSQL xp_cmdshell one call
• added one line for xp_cmdshell disable which works on later versions of Windows
• removed the portscan functionality completely out of the MSSQL payload
• rewrote all portions of the MSSQL bruter to be fully impacket and removed the dependacy for _mssql from fast-track
• added new attack vector within the Fast-Track menu “PSEXEC Powershell Injection” which will allow you to specify psexec_command and compromise via direct memory injection
• added ability to set threads within the new PSEXEC PowerShell Injection technique
• added quick dynamic patching for the powershell injection technique for payloads
• added a new trustedsec intro ascii art that has the TS logo on it
• updated rid_enum to the latest github version inside SET

Download SET v5.1 “Name of the Doctor”

[Aircrack-ng 1.2 Beta 1] 802.11 WEP and WPA-PSK keys cracking tool

Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the attack much faster compared to other WEP cracking tools.

Changelog summary

• Compilation fixes on all supported OSes.
• Makefile improvement and fixes.
• A lot of fixes and improvements on all tools and documentation.
• Fixed licensing issues.
• Added a few new tools and scripts (including distributed cracking tool).
• Fixed endianness and QoS issues.

Detailed changelog

* Airmon-ng: Added chipset information for ar9170usb, wl, rt2800usb, ar9271, wl12xx, RT3070STA, ath9k_htc, r871x_usb_drv, ath5k, carl9170 and various Intel drivers.
* Airmon-ng: Fixed chipset information ipw2200.
* Airmon-ng: Fixed output for r8187 driver.
* Airmon-ng: Improved chipset information for a few drivers.
* Airmon-ng: Support for displaying information about ath9k.
* Airmon-ng: Added 'check kill' to automatically kill services that could interfere.
* Airmon-ng: Fixed issues with Intel chipsets detection.
* Airmon-ng: Updated iw download link.
* Airmon-ng: Better mac80211 handling
* Airmon-ng: Added detection for WiLink TI driver, rtl819xU, iwlwifi.
* Airmon-zc: Improved version of Airmon-ng with more detailled information.
* Airdecap-ng: Fixed decoding QoS frames (Closes: #667 and #858).
* Airgraph-ng: Use Aircrack-ng Makefile instead of its own.
* Airbase-ng: Fixed bug using clients list.
* Airbase-ng: Fixed issue with QoS (ticket #760).
* Airbase-ng: Fixed sending beacons with null SSID.
* Airbase-ng: Allow non ASCII ESSID
* Airodump-ng: Fixed buffer overflow (ticket #728).
* Airodump-ng: Fixed channel parsing.
* Airodump-ng: Fixed FreeBSD battery reading.
* Airodump-ng: Renamed "Packets" column to "Frames" ("Packets" was not correct).
* Airodump-ng: Fixed XML bugs when outputting NetXML: ESSID containing '&' or chinese characters, when multiple encryption are used.
* Airodump-ng: Add alternative paths for Airodump-ng OUI file.
* Airodump-ng: Added GPSd 2.92+ support (JSON).
* Airodump-ng: Add option --manufacturer to display manufacturer column on airodump-ng.
* Airodump-ng: Add feature to show APs uptime (--uptime) based on the timestamp.
* Airodump-ng-OUI-update: Fixed OUI URL and allow CURL redirect (ticket #829).
* Airdrop-ng: removed .py from file names.
* Airdrop-ng: Fixed bug in installer.
* Airdrop-ng: Fixed OUI lookup.
* Airdrop-ng: Fixed bug when several BSSID have the same ESSID.
* Airdrop-ng: Doesn't constantly parse anymore, wait 5 seconds each time it parses.
* Airdrop-ng: Fixed crash when failing to get channel or when rules file didn't exist.
* Airdrop-ng: Fixed to use lorcon.py/lorcon2 libs.
* Airdrop-ng: Updated README.
* Airdrop-ng: Fixed error preventing update to work.
* Versuck-ng: New script to do the same thing as the kismet autowep plugin from the CLI.
* Aircrack-ng: Fixed counter display error when cracking WPA.
* Aircrack-ng: Added output of the WPA handshake to EWSA project file.
* Aircrack-ng: Added output of the WPA handshake to oclhashcat+ project file.
* Aircrack-ng: Added benchmark option, -S.
* Aircrack-ng: Fixed -u option.
* Aircrack-ng: PIC fix for hardened systems from Francisco Blas Izquierdo Riera (klondike)
* Aircrack-ng: Allow dictionaries larger than 2Gb.
* Aircrack-ng: Give a better message when there's an error with the dictionary.
* Aircrack-ng: Prevent a buffer overflow from happening (Wojciech Waga).
* Aireplay-ng: Added migration mode attack from Leandro Meiners and Diego Sor from Core Security (BlackHat Las Vegas 2010)
* Aireplay-ng, Airodump-ng: Added option to ignore issue with -1 channel.
* Airserv-ng: Fixed crash when clients disconnect.
* Besside-ng-crawler: Added EAPOL Crawler.
* Airdecloak-ng: Fixed bug when using pcap files with PPI headers.
* dcrack: Distributed cracking server/client
* wifi-detect.sh: reference script for testing wifi card detection using iwconfig vs ls /sys/class/net
* WPA Clean: Tool to merge and clean WPA capture files.
* Wireless Panda: C# Library to parse Airodump-ng output files (and added example project).
* OSdep (Linux): Setting fixed bitrates on mac80211 2.6.31 and up.
* OSdep (Linux): Added support for nl80211 thanks to impulse32. Use 'make libnl=true' to add netlink support (Ticket #1004).
* Manpages: Improvement and fixes for Airgraph-ng, Airodump-ng, packetforge-ng, Aircrack-ng
* Manpages: Fixed various spelling issues and single quote issues.
* Makefiles: Added tests for the different tools.
* Makefiles: Various fixes and improvements.
* Makefiles: Added support for libgrypt instead of OpenSSL via parameter.
* Patches: Added a few patches.
* Removed useless script: patchchk.
* Finally fixed licensing issues.
* Fixed endianness issues in most of the tools.
* Fixed cppcheck errors (Ticket #957).
* Fixed various compilation issues on Linux and Cygwin, GNU/Hurd, Darwin (OSX) and Sparc.
* Fixed compilation on recent gcc versions on Linux, Cygwin.
* Added instructions for Travis CI: Free Hosted Continuous Integration Platform for the Open Source Community.
* Added Readme.Md for GitHub. Aircrack-ng subversion repository is synced on GitHub: http://github.com/aircrack-ng/aircrack-ng
* Various other small bug fixes.

Download Aircrack-ng 1.2 beta 1

[jSQL Injection v0.4] Java tool for automatic database injection

jSQL Injection is a lightweight application used to find database information from a distant server.

jSQL is free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).

Version 0.4 features:

• GET, POST, header, cookie methods
• Normal, error based, blind, time based algorithms
• Automatic best algorithm selection
• Multi-thread control (start/pause/resume/stop)
• Progression bars
• Shows URL calls
• Simple evasion
• Proxy setting
• Distant file reading
• Webshell deposit
• Terminal for webshell commands
• Configuration backup
• Update checker
• Admin page checker
• Brute forcer (md5 mysql...)
• Coder (encode decode base64 hex md5...)
• Supports MySQL 

Download jSQL Injection v0.4

[Wireshark v1.10.0 RC2] The world’s foremost network protocol analyzer

Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto (and often de jure) standard across many industries and educational institutions.

Wireshark development thrives thanks to the contributions of networking experts across the globe. It is the continuation of a project that started in 1998.

Changelog v1.10.0 RC 2

Wireshark 1.10.0rc2 has been released. Installers for Windows, OS X, and source code are now available. This is the first release candidate for Wireshark 1.10.0.

New and Updated Features

The following features are new (or have been significantly updated) since version 1.8:

• Wireshark on 32- and 64-bit Windows supports automatic updates.
• The packet bytes view is faster.
• You can now display a list of resolved host names in “hosts” format within Wireshark.
• The wireless toolbar has been updated.
• Wireshark on Linux does a better job of detecting interface addition and removal.
• It is now possible to compare two fields in a display filter (for example: udp.srcport != udp.dstport). The two fields must be of the same type for this to work.
• The Windows installers ship with WinPcap 4.1.3, which supports Windows 8.
• USB type and product name support has been improved.
• All Bluetooth profiles and protocols are now supported.
• Wireshark now calculates HTTP response times and presents the result in a new field in the HTTP response. Links from the request’s frame to the response’s frame and vice-versa are also added.
• The main welcome screen and status bar now display file sizes using strict SI prefixes instead of old-style binary prefixes.
• Capinfos now prints human-readable statistics with SI suffixes by default.
• It is now possible to open a referenced packet (such as the matched request or response packet) in a new window.
• Tshark can now display only the hex/ascii packet data without requiring that the packet summary and/or packet details are also displayed. If you want the old behavior, use -Px instead of just -x.
• Wireshark can be compiled using GTK+ 3.
• The Wireshark application icon, capture toolbar icons, and other icons have been updated.
• Tshark’s filtering and multi-pass analysis have been reworked for consistency and in order to support dependent frame calculations during reassembly. See the man page descriptions for -2, -R, and -Y.
• Tshark’s -G fields2 and -G fields3 options have been eliminated. The -G fields option now includes the 2 extra fields that -G fields3 previously provided, and the blurb information has been relegated to the last column since in many cases it is blank anyway.
• Wireshark dropped the left-handed settings from the preferences. This is still configurable via the GTK settings (add “gtk-scrolled-window-placement = top-right” in the config file, which might be called /.gtkrc-2.0 or /.config/gtk-3.0/settings.ini).
• Wireshark now ships with two global configuration files: Bluetooth, which contains coloring rules for Bluetooth and Classic, which contains the old-style coloring rules.

Full changelog: here

Download Wireshark v1.10.0 RC2

[DroidSQLi] MySQL Injection tool for Android

DroidSQLi is the first automated MySQL Injection tool for Android. It allows you to test your MySQL-based web application against SQL injection attacks.  

DroidSQLi supports the following injection techniques:
- Time based injection
- Blind injection
- Error based injection
- Normal injection

Download DroidSQLi

[Wireshark v1.8.7] The world’s foremost network protocol analyzer

Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto (and often de jure) standard across many industries and educational institutions.

Wireshark development thrives thanks to the contributions of networking experts across the globe. It is the continuation of a project that started in 1998.

Changelog v1.8.7

What’s New

Bug Fixes

The following vulnerabilities have been fixed.

• wnpa-sec-2013-23The RELOAD dissector could go into an infinite loop. Discovered by Evan Jensen. (Bug 8364, (Bug 8546) Versions affected: 1.8.0 to 1.8.6.
  CVE-2013-2486
  CVE-2013-2487
• wnpa-sec-2013-24The GTPv2 dissector could crash. (Bug 8493) Versions affected: 1.8.0 to 1.8.6.
• wnpa-sec-2013-25The ASN.1 BER dissector could crash. (Bug 8599) Versions affected: 1.8.0 to 1.8.6, 1.6.0 to 1.6.14.
• wnpa-sec-2013-26The PPP CCP dissector could crash. (Bug 8638) Versions affected: 1.8.0 to 1.8.6.
• wnpa-sec-2013-27The DCP ETSI dissector could crash. Discovered by Evan Jensen. (Bug 8231, bug 8540, bug 8541) Versions affected: 1.8.0 to 1.8.6.
• wnpa-sec-2013-28The MPEG DSM-CC dissector could crash. (Bug 8481) Versions affected: 1.8.0 to 1.8.6.
• wnpa-sec-2013-29The Websocket dissector could crash. Discovered by Moshe Kaplan. (Bug 8448, Bug 8499) Versions affected: 1.8.0 to 1.8.6.
• wnpa-sec-2013-30The MySQL dissector could go into an infinite loop. Discovered by Moshe Kaplan. (Bug 8458) Versions affected: 1.8.0 to 1.8.6.
• wnpa-sec-2013-31The ETCH dissector could go into a large loop. Discovered by Moshe Kaplan. (Bug 8464) Versions affected: 1.8.0 to 1.8.6.

The following bugs have been fixed:

• The Windows installer and uninstaller does a better job of detecting running executables.
• Library mismatch when compiling on a system with an older Wireshark version. (Bug 6011)
• SNMP dissector bug: STATUS_INTEGER_DIVIDE_BY_ZERO. (Bug 7359)
• A console window is never opened. (Bug 7755)
• GSM_MAP show malformed Packets when two IMSI. (Bug 7882)
• Fix include and libs search path when cross compiling. (Bug 7926)
• PER dissector crash. (Bug 8197)
• pcap-ng: name resolution block is not written to file on save. (Bug 8317)
• Incorrect RTP statistics (Lost Packets indication not ok). (Bug 8321)
• Decoding of GSM MAP E164 Digits. (Bug 8450)
• Silent installer and uninstaller not silent. (Bug 8451)
• Replace use of INCLUDES with AM_CPPFLAGS in all Makefiles to placate recent autotools. (Bug 8452)
• Wifi details are not stored in the Decryption Key Management dialog (post 1.8.x). (Bug 8446)
• IO Graph should not be limited to 100k points (NUM_IO_ITEMS). (Bug 8460)
• geographical_description: hf_gsm_a_geo_loc_deg_of_long 24 bit field truncated to 23 bits. (Bug 8532)
• IRC message with multiple params causes malformed packet exception. (Bug 8548)
• Part of Ping Reply Message in ICMPv6 Reply Message is marked as “Malformed Packet”. (Bug 8554)
• MP2T wiretap heuristic overriding ERF. (Bug 8556)
• Cannot read content of Ran Information Application Error Rim Container. (Bug 8559)
• Endian error and IP:Port error when decoding BT-DHT response message. (Bug 8572)
• “ACE4_ADD_FILE/ACE4_ADD_SUBDIRECTORY” should be “ACE4_APPEND_DATA / ACE4_ADD_SUBDIRECTORY”. (Bug 8575)
• wireshark crashes while displaying I/O Graph. (Bug 8583)
• GTPv2 MM Context (UMTS Key, Quad, and Quint Decoded) incorrectly. (Bug 8596)
• DTLS 1.2 uses wrong PRF. (Bug 8608)
• RTP DTMF digits are no longer displayed in VoIP graph analysis. (Bug 8610)
• Universal port not accepted in RSA Keys List window. (Bug 8618)
• Wireshark Dissector bug with HSRP Version 2. (Bug 8622)
• LISP control packet incorrectly identified as LISP data based when UDP source port is 4341. (Bug 8627)
• Bad tcp checksum not detected. (Bug 8629)
• AMR Frame Type uses wrong Value String. (Bug 8681)

New and Updated Features

There are no new features in this release.

New Protocol Support

There are no new protocols in this release.

Updated Protocol Support

AMR, ASN.1 BER, BAT, Bluetooth DHT, BSSGP, DTLS, E.164, Ericsson A-bis OML, GSM A, GSM MAP, HDFSDATA, ICMP, ICMPv6, ixveriwave, IRC, KDSP, LISP Data, MMS, NFS, OpenWire, PPP, RELOAD, RTP, SASP, SIP, SSL/TLS, TCP, UA3G

New and Updated Capture File Support

Endace ERF, NetScreen snoop.

Full Changelog: here

Download Wireshark v1.8.7

[PacketFence v4.0] Open Source network access control (NAC)

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices, integration with the Snort IDS and the Nessus vulnerability scanner; PacketFence can be used to effectively secure networks – from small to very large heterogeneous networks.


Packet Fence 4.0 introduces a brand new modern, fast and responsive web administrative interface. It also simplifies the definition of authentication sources in one place and allows dynamic computation of roles. The portal profiles can now be entirely managed from the web interface, simplifying their definitions and eliminating possible configuration mistakes. Using a centralized caching system, configuration is now propagated instantaneously – absolutely no downtime required!

Changelog v4.0

New Features

• Brand new Perl-based Web administrative interface using the Catalyst framework
• New violation actions to set the node’s role and deregister it
• Support for scanning dot1x connections for auto-registration by EAP-Type
• Support for auto registering dot1x node based of the EAP-Type
• New searchable MAC Addresses module to query all existing OUI prefixes
• New advanced search capabilities for nodes and users
• New memory object caching subsystem for configuration files
• Ubuntu packages

Enhancements

• Authentication sources can now be managed directly from the GUI
• Roles (previously called categories) are now computed dynamically using authentication sources
• Portal profiles and portal pages are now managed from the GUI
• Fingerprints and User Agents modules are now searchable
• Translated all remediation pages to French
• Updated Brazilian Portuguese and Spanish translations

Full Changelog: here

Download PacketFence v4.0

[DEP Process Scanner] Tool to scan and show all the DEP enabled Processes

DEP Process Scanner is the free command-line tool to scan and show all the DEP enabled Processes.

Data Execution Prevention (DEP) is a security feature introduced since Windows XP SP2 onwards and designed to prevent an application executing code from a non-executable memory regions such as Stack or Data region. It is primarily intended to mitigate the successful execution of buffer overflow based exploits.

DEP runs in two modes: hardware-enforced DEP for CPUs that can mark memory pages as nonexecutable, and software-enforced DEP with limited protection for CPUs that do not have hardware support.

DEP Process Scanner currently detects only Software-enforced DEP and helps you to find Processes which have (Software based) DEP enabled/disabled.

Here is the list of things you can do with this tool,

• Show all DEP enabled Processes
• Show all Non-DEP or DEP disabled Processes
• Check the DEP status of Process with the ID
• Check the DEP status of Process with the name

Being a command-line tool makes it easy for automation. Also it can be handy tool for developers and researchers.

It is available in both 32-bit & 64-bit versions and works on all platforms starting from Windows XP to Windows 8.

Download DEP Process Scanner v1.0

[Hook Analyser 2.5] Application (and Malware) Analysis tool

Application (and Malware) Analysis tool. Hook Analyser is a hook tool which could be potentially helpful in reversing application and analysing malwares.

Changelog v2.5

This has now five (5) key functionalities:

1. Spawn and Hook to Application – This feature allows analyst to spawn an application, and hook into it. The module flow is as following -
1. PE validation (with XOR bruteforce)
2. Static malware analysis.
3. Other options (such as pattern search or dump all)
4. Type of hooking (Automatic, Smart or manual)
5. Spawn and hook

Currently, there are three types of hooking being supported –

• Automatic – The tool will parse the application import tables, and based upon that will hook into specified APIs
• Manual – On this, the tool will ask end-user for each API, if it needs to be hooked.
• Smart – This is essentially a subset of automatic hooking however, excludes uninteresting APIs.

2. Hook to a specific running process-The option allows analyst to hook to a running (active) process. The program flow is –

1. List all running process
2. Identify the running process executable path.
3. Perform static malware analysis on executable (fetched from process executable path)
4. Other options (such as pattern search or dump all)
5. Type of hooking (Automatic, Smart or manual)
6. Hook to a specific running process
7. Hook and continue the process

3. Static Malware Analysis – This module is one of the most interesting and useful module of Hook Analyser, which performs scanning on PE or Widows executables to identify potential malware traces. The sub-components have been mentioned below (and this is not the full list) -

1. PE file validation (with XOR bruteforce)
2. CRC and timestamps validation
3. PE properties such as Image Base, Entry point, sections, subsystem
4. TLS entry detection.
5. Entry point verification (if falls in suspicious section)
6. Suspicious entry point detection
7. Packer detection
8. Signature trace (extended from malware analyser project), such as Anti VM aware, debug aware, keyboard hook aware etc. This particular function searches for more than 20 unique malware behaviours (using 100’s of signature).
9. Import intel scanning.
10. Deep search (module)
    Online search of MD5 (of executable) on Threat Expert.
11. String dump (ASCII)
12. Executable file information
13. Hexdump
14. PEfile info dumping
15. …and more.

4. Application crash analysis – This module enables exploit researcher and/or application developer to analyse memory content when an application crashes.This module essentially displays data in different memory register (such as EIP).

• Application crash analysis video demonstration – http://www.youtube.com/watch?v=msYo7pPsu6A

5. Exe extractor – This module essentially extracts executables from running process/s, which could then be further analysed using Hook Analyser , Malware Analyser or other solutions. This module is potentially useful for incident responders

More Information:

• http://hookanalyser.blogspot.com

Download Hook Analyser v2.5

[AttackVector Linux] Linux distro for anonymized penetration based on Kali and TAILS

AttackVector Linux is a new distribution for anonymized penetration and security. It is based on Kali and TAILS, which are both based on Debian. While Kali requires a modified kernel for network drivers to use injection and so forth, the Tor Project's TAILS is designed from the bottom up for encryption, and anonymity. Nmap can't UDP via Tor. The intention of AttackVector Linux is to provide the capability to anonymize attacks while warning the user when he or she takes actions that may compromize anonymity. The two projects have different design philosophies that can directly conflict with one another. In spite of this, the goal of AttackVector Linux is to integrate them complementarily into one OS.

More Info: https://github.com/ksoona/attackvector

Download AttackVector Linux

[TOPERA v0.0.2] Security tools for IPv6

Topera is a new security tools for IPv6, with the particularity that their attacks can’t be detected by Snort.

Snort is the most known IDS/IPS and is widely used in many different critical environments. Some commercial tools (Juniper or Checkpoint ones) use it as detection engine also.

Mocking snort detection capabilities could suppose a high risk in some cases.

Changelog v0.0.2

• Slow HTTP attacks (Slowloris over IPv6).
• Improved TCP port scanner.

Download TOPERA v0.0.2

[Cain & Abel v4.9.44] Password recovery tool for Microsoft Operating Systems

Cain & Abel is a password recovery tool for Microsoft Operating Systems.

It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols.

The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort.

It covers some security aspects/weakness present in protocol’s standards, authentication methods and caching mechanisms; its main purpose is the simplified recovery of passwords and credentials from various sources, however it also ships some “non standard” utilities for Microsoft Windows users.

The latest version is faster and contains a lot of new features like APR (Arp Poison Routing) which enables sniffing on switched LANs and Man-in-the-Middle attacks.

The sniffer in this version can also analyze encrypted protocols such as SSH-1 and HTTPS, and contains filters to capture credentials from a wide range of authentication mechanisms.

The new version also ships routing protocols authentication monitors and routes extractors, dictionary and brute-force crackers for all common hashing algorithms and for several specific authentications, password/hash calculators, cryptanalysis attacks, password decoders and some not so common utilities related to network and system security.

03/05/2013

Cain & Abel v4.9.44 released

• Added Windows 8 support in LSA Secret Dumper.
• Added Windows 8 support in Credential Manager Password Decoder.
• Added Windows 8 support in EditBox Revealer.
• Added ability to keep original extensions in fake certificates.
• Winpcap library upgrade to version 4.1.3 (Windows8 supported).
• OUI List updated.

Download Cain & Abel v4.9.44

[SpiderFoot v2.0] The Open Source Footprinting tool

SpiderFoot is a free, open-source footprinting tool, enabling you to perform various scans against a given domain name in order to obtain information such as sub-domains, e-mail addresses, owned netblocks, web server versions and so on. The main objective of SpiderFoot is to automate the footprinting process to the greatest extent possible, freeing up a penetration tester’s time to focus their efforts on the security testing itself.

Main features

• Fast, Easy to Use
• Highly Configurable
• For Windows & Linux
• Create your own modules in Python

New in this release, which is actually a complete re-write of the version from 2005(!):

• Now runs on Windows as well as Linux, Solaris, *BSD (basically anything with Python should be fine)
• Scans are even more configurable than before
• All scan data stored locally in an SQLite database for querying, reporting and analysis
• Many more scans/tests included (GeoIP, URL linkage, web technology, port scans…)
• You can now easily extend functionality by writing your own modules in Python
• Completely new user interface, which is now entirely web-based
• Configuration state is stored between runs
• Scanning can be remotely controlled

Full Changelog: here

More Information: http://www.spiderfoot.net/

Download SpiderFoot v2.0