Category Archives: Tools

WiFiKill v1.7 – WiFi EjeCtOr

~


If you want to disable any ip address which use same router to connect internet. Now you can used your android application, WifiKill use as can disable internet connection for a device on the same network. This is alternate version of NETCUT for Android. Simply allows you to scan your wifi network for devices, see their vendor and cut network connection for specified devices. This way you can get rid of network hoggers. It gives option to redirect HTTP traffic to specific IP, this feature can be used even to do phishing smartly. Changelog: – fixed the counter bug (I hope for the last time) – added an option to redirect HTTP traffic to specific IP (caution! this may lead to significant CPU load) – now successful kills are tagged by green icon on the left of IP (this is not 100% correct) 

Download this application from LINK 1 or LINK 2 – 

Network Security Toolkit v2.16.0-4104 Released

~


The Network Security Toolkit is bootable ISO live CD/DVD (NST Live) is based on Fedora. The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86/x86_64 platforms. 

he main intent of developing this toolkit was to provide the network security administrator with a comprehensive set of Open SourceNetwork Security Tools. An advanced Web User Interface (WUI) is provided for system administration, navigation, automation and configuration of many network and security applications found within the Network Security Toolkit distribution.

In the virtual world, NST can be used as a network security analysis, validation and monitoring tool on enterprise virtual servers hosting virtual machines. Network Security Toolkit also makes an excellent tool to help one with crash recovery troubleshooting scenarios and diagnostics.

Yaptest – Penetration Framework

~

It is a penetration testing framework that helps automate the boring parts of pentests.Yaptest aims to make it easy for a pentester to automate parts of testing on the fly. This is particularly useful when testing very large networks. Below are some examples of tasks which would be easy to automate using yaptest:
  • Run nikto on anything nmap thinks is an HTTP service
  • Run hydra on every host with TCP port 21 open
  • Attempt upload a file to any TFTP servers found
  • Run onesixtyone on all hosts that are up
  • Try metasploit’s solaris_kcms_readfile exploit against any hosts running kcmsd
Yaptest is the glue between your favourite tools and the knowledge base gathered during your pentest. It handles all the mundane stuff that can easily be automated and leaves you free to get on with owning boxes demonstrating risk using techniques that yaptest doesn’t know about yet.

Volatility 2.2 Framework –

~
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

Windows Basic


  • Current date, time, CPU count, CPU speed, service pack
  • Current thread and idle thread
  • Addresses of the KDBG, KPCR, DTB, PsActiveProcessHead, PsLoadedModuleList, etc


Processes


  • List active processes (column or tree view)
  • Scan for hidden or terminated _EPROCESS objects (using pool tags or _DISPATCHER_HEADER)
  • Enumerate DLLs in the PEB LDR lists
  • Rebuild/extract DLLs or EXEs to disk based on name, base address, or physical offset
  • Print open handles to files, registry keys, mutexes, threads, processes, etc
  • List security identifiers (SIDs) for processes
  • Scan for cmd.exe command history and full console input/output buffers
  • List process environment variables
  • Print PE version information from processes or DLLs (file version, company name, etc)
  • Enumerate imported and exported API functions anywhere in process or kernel memory
  • Show a list of virtual and physical mappings of all pages available to a process
  • Dump process address space to disk as a single file
  • Analyze Virtual Address Descriptor (VAD) nodes, show page protection, flags, and mapped files
  • Represent the VAD in tree form or Graphviz .dot graphs
  • Dump each VAD range to disk for inspecting with external tools
  • Parse XP/2003 event log records
Miscellaneous


  • Link strings found at physical offsets to their owning kernel address or process
  • Interactive shell with disassembly, type display, hexdumps, etc
  • And Much More , More Than Your Imagination ~

Server Analyser : Simple Server Malware Scanner

~

Server Analyser  is a service for detecting and analyzing web-based threats. It currently handles shells, obfuscated JavaScript, Executables, Iframes and port scans.

Featured added:
+ Logging scans
+ Just paste the results ( option 1 )
+ Added new Exploit methods to option 1
+ Latest infections ( will be updated automaticly )
+ Added PHP Shell detection exec()/system() etc. ( more will be added soon )
+ The code has been changed into a smaller one
+ Added new BlackHole methods
+ Added different javascript methods
+ Added decoded php syntaxes
+ gzinflate
+ var url
+ base64_decode
+ The Beta has been releases and uploaded
+ code improvements
+ fixed the dos2unix issue

Whonix ALPHA 0.4.5 – Anonymous Virtual operating system

~

IP/location.

Whonix consists of two machines, which are connected through an isolated network. One machine acts as the client or Whonix-Workstation, the other as a proxy or Whonix-Gateway, which will route all of the Whonix-Workstation’s traffic through Tor. This setup can be implemented either through virtualization and/or Physical Isolation.

Whonix advantages:
  • All applications, including those, which do not support proxy settings, will automatically be routed through Tor.
  • Installation of any software package possible.
  • Safe hosting of Hidden services possible.
  • Protection against side channel attacks, no IP or DNS leaks possible^3^ To test for leaks, see LeakTests.
  • Advantage over Live CD’s: Tor’s data directory is still available after reboot, due to persistent storage. Tor requires persistent storage to save it’s Entry Guards.
  • Java / JavaScript / flash / Browser Plugins / misconfigured applications cannot leak your real external IP.
  • Whonix does even protect against root exploits (Malware with root rights) on the Workstation.
  • Uses only Free Software.
  • Building Whonix from source is easy.
  • Tor+Vidalia and Tor Browser are not running inside the same machine. That means that for example an exploit in the browser can’t affect the integrity of the Tor process.
  • It is possible to use Whonix setup in conjunction with VPNs, ssh and other proxies. But see Tor plus VPN/proxies Warning. Everything possible, as first chain or last chain, or both.
  • Loads of Optional Configurations (additional features / Add-Ons) available.
  • Best possible Protocol-Leak-Protection and Fingerprinting-Protection.

THC IPv6 Attack Toolkit v2.0

~

The Hacker’s Choice (THC) has release version 2.0 of THC IPv6 Attack Toolkit. New tool added for scanning ipv6 networks. New tools for local network denial of service against Windows and BSD based systems. Made feature 6to4, VLAN-Q/801.1q and PPPoE injection features public. Various updates and fixes.

The THC IPV6 ATTACK TOOLKIT (THC-IPV6) is a complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library.

THC’s IPv6 tools are made available under the GPLv3 and can be downloaded as a compressed source tarball for self compilation.

Arachni version 0.4.1.1

~


Arachni scanner updated to version 0.4.1.1 !! Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications. Arachni is smart, it trains itself by learning from the HTTP responses it receives during the audit process and is able to perform meta-analysis using a number of factors in order to correctly assess the trustworthiness of results and intelligently identify false-positives.

Unlike other scanners, it takes into account the dynamic nature of web applications, can detect changes caused while travelling through the paths of a web application’s cyclomatic complexity and is able to adjust itself accordingly. This way attack/input vectors that would otherwise be undetectable by non-humans are seamlessly handled by Arachni.

Change log:
  • Auditor#log and Auditor#log_remote_file bugfixed to pass a Hash of the response headers instead of a String — also solving another bug causing response bodies not to be logged in the Issues. [Issue #294]
  • Issue — Response headers are now always Hash.
  • Reports
    • HTML — Removed response headers handling code and added the option to not include HTTP response bodies. [Issue #296]
    • XML — Removed response headers handling code and added the option to not include HTTP response bodies. [Issue #296]
  • HTTP debugging output now includes Response data. [Issue #297]
  • Executables
    • arachni_rpcd_monitor — Laxed standards enforced on the Dispatcher URL argument. [Issue #293]
  • Path extractors
    • Added path extractor for the area HTML tag (href attribute). [Issue #300]