Tool: Nessus (Best Open Source Risk Assessment Tool)
Website: http://www.nessus.org/
Category: Open source
Platform: Linux/BSD/Unix
Introduction: Nessus is a remote security scanning software that can run on Linux, BSD, Solaris, and other systems. It is a multi-threaded, plug-in-based software with a good GTK interface, capable of completing more than 1200 remote security checks, with powerful report output capabilities, can generate security reports in HTML, XML, LaTeX and ASCII text formats, and will make solutions for each security problem found.
Tool: Ethereal (Network Protocol Detection Tool)
Website: http://www.ethereal.com/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Ethereal is a free network protocol analysis program that supports Unix and Windows. With this program, you can either scrape data directly from the web for analysis or analyze data that is captured by other sniffers and saved on your hard drive. You can interactively browse the crawled packets and see a summary and details of each packet. Ethereal has a variety of powerful features, such as support for almost all protocols, rich filtering languages, and easy to view the reconstructed data flow of TCP sessions.
Tool: Snort (Free Intrusion Detection System)
Website: http://www.snort.org/
Category: Open Source
Platform: Linux/BSD/Unix/Windows
Introduction: Snort is a lightweight network intrusion detection system capable of real-time traffic analysis and packet logging on IP networks. It can not only perform collaborative analysis, content retrieval, content matching, but also be used to detect a large number of attacks or illegal detections such as buffer overflow, hidden port scanning, CGI attack, SMB detection, operating system fingerprinting, etc. Snort uses flexible rules to describe which traffic should be collected or ignored, and provides a modular detection engine.
Tool: Netcat (Cyber Swiss Army Knife)
Website: http://www.atstake.com/research/too...work_utilities/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: A simple and useful tool for reading and writing data through a network connection using TCP or UDP protocols. It is designed to be a stable backdoor tool that can be easily driven directly by other programs and scripts. It's also a powerful network debugging and probing tool that can establish almost any type of network connection you need, as well as several interesting built-in features.
Tool: TCPDump/WinDump (excellent sniffer for network monitoring and data collection)
Website: http://windump.polito.it/]http://www.tcpdump.org/,http://windump.polito.it/[/url]
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Tcpdump is a well-known and popular command-line-based network packet analysis and sniffing tool. It can display the packet header of the packet that matches the rule. You can use this tool to find network problems or monitor network conditions. WinDump is a port of Tcpdump on the Windows platform.
Tool: Hping2 (ping-like network detection tool)
Website: http://www.hping.org/
Category: Open source
Platform: Linux/BSD/Unix
Introduction: hping2 can send custom ICMP/UDP/TCP packets to the destination address and display the response status of the packets. It has a convenient traceroute mode and supports IP sharding. This tool is especially useful for traceroute, ping, and probing hosts behind firewalls.
Tool: DSniff (best-in-class network audit and penetration testing tool)
Website: http://naughty.monkey.org/~dugsong/dsniff/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: DSniff is a software suite developed by Dug Song that includes multiple tools. Among them, dsniff, filesnarf, mailsnarf, msgsnarf, rlsnarf, and webspy can be used to monitor the data we are interested in on the network (such as passwords, e-mails, files, etc.), and arpspoof, dnsspoof, and macof can easily load network information (such as layer 2 switching data) that is usually difficult for attackers to obtain. sshmitm and webmitm can be used to rewrite SSH and HTTPS sessions to achieve monkey-in-the-middle attacks. In http://www.datanerds.net/~mike/dsniff.html you can find a port on the Windows platform.
Tool: GFI LANguard (Commercially Available Cybersecurity Scanning Software)
Website: http://www.gfi.com/lannetscan/
Category: Business
Platform: Windows
Introduction: LANguard scans the network and produces reports of scanned information such as service pack levels for each machine, missing security patches, open shares, open terminals, running services and applications, registry keys, weak passwords, users and groups, etc. The scan results are output as an HTML format report that can be customized.
Tool: Ettercap (more security for your exchange environment)
Website: http://ettercap.sourceforge.net/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Ettercap is a network monitoring, blocking and recording tool in the Ethernet environment, supporting a variety of active or passive protocol analysis (even SSH, HTTPS, etc. related to encryption), with data insertion, filtering, keeping the connection synchronized and other functions, and also has a powerful and complete sniffing suite that can support multiple sniffing modes, supports plug-ins, and can check whether the network environment is a switched LAN. And it can use active or passive operating system fingerprinting technology to let you know what is going on with your current LAN.
Tool: Whisker/Libwhisker (CGI defect scanning software and library)
Website: http://www.wiretrip.net/rfp/p/doc.asp/d21.htm
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Whisker is a very good HTTP server defect scanner that can scan a large number of known security vulnerabilities, especially dangerous CGI vulnerabilities. Libwhisker is a library written in perl and used by Whiskerr, through which you can create your own HTTP scanner.
Tool: John the Ripper (extra powerful, flexible, fast multi-platform hash cracker)
Website: http://www.openwall.com/john/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: John the Ripper is a fast password cracker that supports multiple operating systems, such as Unix, DOS, Win32, BeOS, and OpenVMS. It is designed to check for weak passwords in Unix systems, supports password hash types encrypted by crypt functions on almost all Unix platforms, and also supports Kerberos AFS and Windows NT/2000/XP LM hashes.
Tools: OpenSSH/SSH (a secure method of accessing remote computers)
Website: http://www.openssh.com/,http://www.ssh.com/commerce/index.html
Category: Open Source/Commercial
Platform: Linux/BSD/Unix/Windows
Introduction: SSH (Secure Shell) is a program used to log in to a remote server and execute commands on the remote server, which can provide safe and reliable encrypted communication between two untrusted hosts on a network without security protection. X11 connections and any other TCP/IP port connections can be SSH to encapsulate data and forward it to a secure channel. SSH was developed to replace insecure programs such as rlogin, rsh, and rcp, as well as to provide a secure channel for rdist and rsync. It should be noted that OpenSSH is an alternative to SSH, and SSH is charged for some uses, but OpenSSH is always free.
Tool: Sam Spade (Free web lookup tool on Windows)
Website: http://www.samspade.org/ssw/
Category: Free software
Platform: Windows
Introduction: SamSpade provides a friendly GUI interface that can easily complete a variety of network query tasks, it is developed to track down spammers, but it can also be used for a wide range of other network probing, network management, and security-related tasks, including ping, nslookup, whois, dig, traceroute, finger, raw HTTP web browser, DNS zone transfer, SMTP relay check, website search, etc., and there is also an online version of most query tools on its website (
http://www.samspade.org/t/）。
Tool: ISS Internet Scanner (Application Layer Risk Assessment Tool)
Website: http://www.iss.net/products_service...er_internet.php
Category: Business
Platform: Windows
Introduction: Internet Scanner started in 1992 as a small open source scanner, it is quite good, but expensive, and it is a good option to use the open source software Nessus instead.
Tool: Tripwire (powerful data integrity checking tool)
Website: http://www.tripwire.com/
Category: Commercial
Platform: Linux/BSD/Unix/Windows
Introduction: Tripwire is a file and directory integrity checker tool that helps system administrators and users monitor any changes to some important files and directories. By developing some basic system policies, Tripwire notifies system administrators when files are corrupted or tampered with, so that they can be dealt with in a timely manner. The commercial version of Tripwire is very expensive, there is a free and open source Linux version on Tripwire.Org website, and UNIX users may also want to consider AIDE (http: //www.cs.tut.fi/~rammer/aide.html), which is a free alternative to Tripwire.
Tool: Nikto (a very comprehensive web scanner)
Website: http://www.cirt.net/code/nikto.shtml
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Nikto is a scanning software that can test a variety of security items on web servers, and can scan more than 2000 potentially dangerous files, CGI and other problems on more than 200 servers. It also uses the LibWhiske library, but is usually updated more frequently than Whisker's.
Tool: Kismet (powerful wireless sniffer)
Website: http://www.kismetwireless.net/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Kismet is an 802.11b network sniffing and analysis program, with the following functions: support most wireless network cards, can automatically realize network IP blocking detection through UDP, ARP, DHCP packets, list Cisco devices through Cisco Discovery protocol, weakly encrypted packet records, and Ethereal, tcpdump compatible packet dump files, draw detected network maps and estimate network ranges.
Tool: SuperScan (TCP port scanner on Windows platform)
Website: http://www.foundstone.com/index.htm...c/superscan.htm
Category: Free
Platform: Windows
Introduction: SuperScan is a tool with TCP connect port scanning, ping, and domain name resolution functions, which can easily ping and port scanning IP addresses within a specified range. The source code is not publicly available.
Tool: L0phtCrack 4 (Windows Password Audit and Recovery Program)
Website: http://www.atstake.com/research/lc/
Category: Business
Platform: Linux/BSD/Unix/Windows
Introduction: L0phtCrack attempts to crack Windows passwords based on encrypted hashes legitimately obtained from independent Windows NT/2000 workstations, network servers, master domain controllers, or active directory or sniffed out from the line, including dictionary attacks, combination attacks, forced attacks and other password guessing methods.
Tool: Retina (eEye's risk assessment scanning tool)
Website: http://www.eeye.com/html/Products/Retina/index.html
Category: Business
Platform: Windows
Introduction: Like the Nessus and ISS Internet Scanner mentioned above, Retina functions to scan all hosts in the network and report every defect found.
Tool: Netfilter (the current package filtering firewall used by the Linux kernel)
Website: http://www.netfilter.org/
Category: Open Source
Platform: Linux
Introduction: Netfilter is a powerful packet filtering firewall implemented within the standard Linux kernel, and iptables is a firewall configuration tool. It now supports packaged filtering with stateful or stateless detection, supporting all kinds of NAT and packet sharding. Correspondingly, for firewalls on non-Linux platforms, there is pf on OpenBSD platforms, ipfilter on UNIX platforms, and Zone Alarm personal firewalls on Windows platforms.
Tools: traceroute/ping/telnet /whois (basic command)
Website:
Category: Free
Platform: Linux/BSD/Unix/Windows
Introduction: When we use a large number of high-level tools to assist in security audit work, don't forget these most basic tools. Each of us should be very familiar with the use of these tools, which are included on almost all operating systems, but there is no whois tool on the Windows platform, and traceroute is renamed tracert.
Tool: Fport (enhanced netstat)
Website: http://www.foundstone.com/index.htm...ddesc/fport.htm
Category: Free
Platform: Windows
Introduction: Fport can display all the currently open TCP/IP, UDP ports on the host and the processes to which the port belongs, so by using it, you can immediately find unknown open ports and applications to which the port belongs, which is a good tool to find Trojans. However, Fport only supports Windows systems, and on many UNIX systems there is a netstat command to implement similar functions, and on Linux systems use the "netstat -pan" command. The source code is not publicly available.
Tool: SAINT (Comprehensive Networking Tool for Security Administrators)
Website: http://www.saintcorporation.com/saint/
Category: Commercial
Platform: Linux/BSD/Unix
Introduction: Saint is a commercial risk assessment tool, but unlike those that only support the Windows platform, SAINT runs on UNIX-like platforms, which used to be free and open source, but now it is a commercial product.
Tool: Network Stumbler (Free Windows Platform 802.11 Sniffer)
Website: http://www.stumbler.net/
Category: Free
Platform: Windows
Introduction: Netstumbler is the most well-known tool for finding wireless access points, and another version of the WinCE platform that supports PDAs is called Ministumbler. This tool is now free, only supports Windows systems, and the source code is not publicly available, and the developer of the software also reserves the right to modify the license agreement where appropriate. Users on UNIX systems can use Kismet instead.
Tool: SARA (Security Administrator's Aid)
Website: http://www-arc.com/sara/
Category: Open source
Platform: Linux/BSD/Unix
Introduction: SARA is a risk assessment tool developed based on the SATAN security scanning tool, which is updated twice a month.
Tool: N-Stealth (web server scanning tool)
Website: http://www.nstalker.com/nstealth/
Category: Business
Platform: Windows
Introduction: N-Stealth is a commercial web server security scanning software, usually it is upgraded more frequently than free web scanners such as whisker, nikto, etc. The N-Stealth developers' claims of "over 20,000 bug and exploit data" and "a large number of new bug checks every day" are very suspicious. It's also important to note that web scanning components are already included in all common risk assessment tools such as nessus, ISS, Retina, SAINT, and SARA, but they may not be as user-friendly and updated as N-Stealth. n-stealth does not disclose the source code.
Tool: AirSnort (802.11 WEP Password Cracker)
Website: http://airsnort.shmoo.com/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: AirSnort is a wireless LAN key recovery tool developed by the Shmoo team. It monitors transmitted data in wireless networks and calculates keys when enough packets are collected.
Tool: NBTScan (Collects NetBIOS Information from Windows Network)
Website: http://www.inetcat.org/software/nbtscan.html
Category: Open source code
Platform: Linux/BSD/Unix/Windows
Introduction: NBTscan is a program used to scan the name information of NetBIOS on the network. The program sends a NetBIOS status query for each address in the given range and lists the information received in an easy-to-read table, and for each responding host it lists its IP address, NetBIOS computer name, login username, and MAC address.
Tool: GnuPG/PGP (Advanced Encryption Program to Protect Your Files and Communication Data)
Website: http://www.gnupg.org/
Category: Open Source / Commercial
Platform: Linux/BSD/Unix/Windows
Introduction: PGP is a well-known encryption program developed by Phil Zimmerman, which uses a combination of public key encryption algorithms and conventional encryption techniques to securely transmit encrypted files from one place to another, thereby protecting users' data from eavesdropping or other security risks. GnuPG is an open source program developed according to the PGP standard, except that GnuPG is free forever, and PGP charges for some uses.
Tool: Firewalk (advanced traceroute)
Website: http://www.packetfactory.net/projects/firewalk/
Category: Open source
Platform: Linux/BSD/Unix
Introduction: Firewalk uses traceroute-like technology to analyze the response of IP packets to determine the access control list of the gateway and draw a network map. In October 2002, this best-in-class tool was redeveloped from the original. It is important to note that most of the features in Firewalk can also be implemented by Hping2's traceroute option.
Tools: Cain & Abel (L0phtcrack for the Poor)
Website: http://www.oxid.it/cain.html
Category: Free
Platform: Windows
Introduction: Cain & Abel is a free password recovery tool for Microsoft operating systems. It easily enables password recovery in a variety of ways: network sniffing, cracking encrypted passwords (using dictionaries or brute force), decoding scrambled passwords, displaying password boxes, displaying cached passwords, and analyzing routing protocols. The source code is not publicly available.
Tool: XProbe2 (Active OS Fingerprint Recognition Tool)
Website: http://www.sys-security.com/html/projects/X.html
Category: Open source
Platform: Linux/BSD/Unix
Introduction: XProbe is a tool for determining the type of remote host operating system. It relies on ambiguous matching with a signature database and reasonable speculation to determine the type of remote operating system, and its uniqueness is that it uses the ICMP protocol for operating system fingerprinting.
Tools: SolarWinds Toolsets (a large number of network discovery, monitoring, attack tools)
Website: http://www.solarwinds.net/
Category: Commercial
Platform: Windows
Description: SolarWinds includes a number of tools for system administrators to use for special purposes, including a number of network discovery scanners and an SNMP cracker.
Tool: NGrep (Convenient Package Matching and Display Tool)
Website: http://www.packetfactory.net/projects/ngrep/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: NGrep implements most of the features of GNU grep at the network layer, based on pcap, which allows you to match data traffic on the network by specifying extended regular expressions or hexadecimal expressions. It is currently capable of identifying TCP, UDP, and ICMP packets flowing through Ethernet, PPP, SLIP, FDDI, token net, and loopback devices, and understands BPF filtering mechanisms like other common sniffing tools such as tcpdump and snoop.
Tools: Perl/Python (scripting language)
Website: http://www.perl.org,http://www.python.org/
Category: Open Source
Platform: Linux/BSD/Unix/Windows
Introduction: When we use security tools that have already been developed to handle tasks, it is also important to remember that it is also important to be able to write (or modify) security programs ourselves. Using Perl and Python makes it very easy to write scripts for system testing, exploitation, and patching, and using CPAN (Comprehensive Perl Archive Network: http://www.cpan.org/) or similar archives that contain modules such as Net::RawIP and protocol implementation can help us develop more easily.
Tool: THC-Amap (Application Fingerprint Scanner)
Website: http://www.thc.org/releases.php
Category: Open Source
Platform: Linux/BSD/Unix
Introduction: Amap, developed by THC, is a powerful scanner that identifies applications and services by probing application fingerprint data in response to ports, far more than the default port number to judge applications and services.
Tool: OpenSSL (the most important SSL/TLS encryption library)
Website: http://www.openssl.org/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: The OpenSSL project is a robust, commercial-grade, fully open and open-source toolkit developed by joint efforts to implement Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) and form a complete universal encryption library. The project is managed by a group of volunteers from around the world who use the Internet to communicate, design, and develop the OpenSSL tool and related documentation.
Tool: NTop (Network Usage Monitoring Software)
Website: http://www.ntop.org/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Ntop is a traffic monitoring software that displays network usage, similar to the top command to monitor system processes on the UNIX platform. In interactive mode, ntop will display the network usage status on the user's terminal. In web mode, ntop acts as a web server and creates an HTML web page containing the network status and returns it to the user.
Tool: Nemesis (command-line UNIX Network Information Package Insertion Kit)
Website: http://www.packetfactory.net/projects/nemesis/
Category: Open source
Platform: Linux/BSD/Unix
Introduction: The Nemesis project is to develop a command-line-based, user-friendly IP stack on UNIX/Linux systems, which can customize data packets, insert data packets, perform protocol attacks, etc., and is a good tool for testing firewalls, intrusion detection systems, routers, and other network equipment. If you're interested in Nemesis, then you might want to check out hping2 as well.
Tool: LSOF (List open files)
Website: ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/
Category: Open source
Platform: Linux/BSD/Unix
Introduction: LSOF is a diagnostic and analysis tool for Unix, which can display the files opened by the running processes in the system, and can also show the communication sockets of each process.
Tool: Hunt (advanced packet sniffing and session hijacking tool on Linux)
Website: http://lin.fsid.cvut.cz/~kra/index.html#HUNT
Category: Open source
Platform: Linux
Introduction: Hunt can monitor, hijack, and reset TCP connections on the network, which is only useful when used on Ethernet, and includes an active mechanism to monitor switching connections, as well as advanced features such as optional ARP replay and connection synchronization after successful hijacking.
Tool: Honeyd (your personal honeynet, http://www.honeynet.org/)
Website: http://www.citi.umich.edu/u/provos/honeyd/
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Honeyd is a small background program that can create virtual hosts on the network, and the virtual hosts can be configured to run any service, and the TCP characteristics of the service are so appropriate that they look like they are running on a specific version of the operating system. Honeyd can have a host with multiple addresses in a simulated LAN environment, and can ping and traceroute virtual hosts. Any type of service on a web host can be simulated according to a simple configuration file. Honeyd can also proxy a host instead of simulating it.
Tool: Achilles (agent that can modify http session packages)
Website: http://packetstormsecurity.nl/filed...s-0-27.zip.html
Category: Open source
Platform: Windows
Introduction: Achilles is a tool designed to test web application security. It is a proxy server that acts as a "man-in-the-middle" in an HTTP session. A typical HTTP proxy server forwards packets between the client's browser and the web server, but Achilles carries HTTP session data sent to either party and allows the user to modify the data before forwarding it.
Tool: Brutus (Cracking Tool for Network Authentication)
Website: http://www.hoobie.net/brutus/
Category: Free
Platform: Windows
Introduction: Brutus is a password guessing tool for remote server network services, supporting dictionary attacks and combination attacks, and supporting network applications including HTTP, POP3, FTP, SMB, TELNET, IMAP, NTP, etc. The source code is not publicly available. THC-Hydra on UNIX systems has a similar function.
Tool: Stunnel (a multi-purpose SSL encryption shell)
Website: http://www.stunnel.org/
Category: Open Source
Platform: Linux/BSD/Unix/Windows
Introduction: The Stunnel program is designed to act as an SSL encryption shell between the local client and the remote server. It adds SSL functionality to servers that use inetd background processes such as POP2, POP3, IMAP, etc., and does not affect the source code of the program. It uses OpenSSL or SSLeay libraries to establish SSL session connections.
Tool: Paketto Keiretsu (Extreme TCP/IP)
Website: http://www.doxpara.com/paketto
Category: Open source
Platform: Linux/BSD/Unix
Introduction: Paketto Keiretsu is a collection of tools for operating TCP/IP networks using modern and uncommon policies, originally intended to implement some functionality in the existing TCP/IP architecture, but now far beyond its original intention. Tools included: Scanrand, a rare fast network service and topology discovery system; Minewt, a NAT/MAT router; linkcat, which uses the Ethernet link as the standard input and output; Paratrace, which traces network paths without generating new connections; Phentropy, which uses OpenQVIS to draw any total amount of data source graphs in 3D topological space.
Tool: Fragroute (the most powerful tool for breaking intrusion detection systems)
Website: http://www.monkey.org/~dugsong/fragroute/
Category: Open Source
Platform: Linux/BSD/Unix/Windows
Introduction: Fragroute can intercept, modify, and rewrite outbound packets, and realizes most IDS attack functions. Fragroute is a simple rule-setting language that enables delays, replication, drops, fragmentation, overlapping, printing, reflowing, splitting, source routing, or other attacks that send packets to the target host. This tool was developed to test the behavior of intrusion detection systems, firewalls, and basic TCP/IP stacks. Like Dsniff and Libdnet, this excellent tool was also developed by Dug Song.
Tool: SPIKE Proxy
Website: http://www.immunitysec.com/spikeproxy.html
Category: Open source
Platform: Linux/BSD/Unix/Windows
Introduction: Spike Proxy is an open-source HTTP proxy program used to find security flaws in websites. It is part of the Spike Application Test Suite (http: //www.immunitysec.com/spike.html) and supports SQL insertion detection, website detection, login form brute force, overflow detection, and dictionary exhaustion attack detection.
Tool: THC-Hydra (cracking tool for network authentication)
Website: http://www.thc.org/releases.php
Category: Open source
Platform: Linux/BSD/Unix
Introduction: This tool can perform fast dictionary attacks on systems that require network login, including FTP, POP3, IMAP, Netbios, Telnet, HTTP Auth, LDAP NNTP, VNC, ICQ, Socks5, PCNFS, etc., supports SSL, and is now part of the Nessus risk assessment tool. |
Posted on 4/13/2015 10:52:42 AM
|
|
|
