arp-scan

NTA-Monitor has released the arp-scan detection and fingerprinting tool under the open source (LGPL license) concept.

It has been tested under various Linux based operating systems and seems to work fine.

This will only compile on Linux systems. You will need a C compiler, the “make” utility and the appropriate system header files to compile arp-scan. It uses autoconf and automake, so compilation and installation is the normal ./configure; make; make install process.

You can download arp-scan here:

http://www.nta-monitor.com/tools/arp-scan/download/arp-scan-1.4.tar.gz

Please read the main pages arp-scan(1), arp-fingerprint(1) and get-oui(1) before using this tool.

sqlninja 0.1.0 alpha – MS-SQL Injection Tool

sqlninja is a little toy that has been coded during a couple of pen-tests done lately and it is aimed to exploit SQL Injection vulnerabilities on web applications that use Microsoft SQL Server as their back-end.

It borrows some ideas from similar tools like bobcat, but it is more targeted in providing a remote shell even with paranoid firewall settings.

It is written in perl and runs on UNIX-like boxes.

Here’s a list of what it does so far:

• Upload of nc.exe (or any other executable) using the good ol’ debug script trick
• TCP/UDP portscan from the target SQL Server to the attacking machine, in order to find a port that is allowed by the firewall of the target network and use it for a reverse shell
• Direct and reverse bindshell, both TCP and UDP
• DNS-tunneled pseudoshell, when no TCP/UDP ports are available for a direct/reverse shell, but the DB server can resolve external hostnames

Being an alpha version and since it was originally supposed to be just a quick&dirty toy for a pentest, there are lots of bugs waiting to be found and fixed so go ahead and download it !

More tunneling options (e.g.: HTTP, SMTP, …) will be added in the future together.

You can read more and download sqlninja here:

http://sqlninja.sourceforge.net/

FireMaster 2.1

FireMaster version 2.1 has been released with its new features and new speed.

Firemaster is the Firefox master password recovery tool. If you have forgotten the master password, then using FireMaster you can find out the master password and get back your lost signon information. It uses various methods such as dictionary, hybrid and brute force techniques to recover the master password from the firefox key database file.

Since its initial release in Jan 1, 2006 its speed has increased exponentially and currently it is operating at a speed of 50,000 passwords/sec to 100,000 passwords/sec depending upon low end or high end machine.

How it Works?

There is no way to recover the master password as it is not stored at all. Firemaster uses the same technique which has been used by firefox to check if the master password is correct, but in more optimized way. The entire operation goes like this.

• Firemaster generates passwords on the fly through various methods.
• Then it computes the hash of the password using known algorithm.
• Next this password hash is used to decrypt the known encrypted string for which plain text ( i.e. “password-check” ) is known.
• Now if the decrypted string matches with known plain text ( i.e. “password-check” ) then the generated password is the master password.

Firefox stores the details about encrypted string, salt, algorithm and version information in key database file key3.db in the user’s profile directory. So you can just copy this key3.db to different directory and specify the corresponding path to Firemaster. You can also copy this key3.db to any other high end machine for faster recovery operation.

More details are available here:

FireMaster

Yersinia 0.7

Yersinia is a network tool designed to take advantage of some weakeness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.

It’s a very useful for any network based penetration testing or vulnerability assessment. There isn’t many tools working on Layer 2 and this is ‘the’ one.

Attacks for the following network protocols are implemented (but of course you are free for implementing new ones):

• Spanning Tree Protocol (STP).
• Cisco Discovery Protocol (CDP).
• Dynamic Trunking Protocol (DTP).
• Dynamic Host Configuration Protocol (DHCP).
• Hot Standby Router Protocol (HSRP).
• 802.1q.
• Inter-Switch Link Protocol (ISL).
• VLAN Trunking Protocol (VTP).

Details of the attacks here.

Yersinia version 0.7 with 802.1x support has just been release, in addition to this lots of bugfixes and a new GTK interface.

The entire core has been redeveloped to support easy addition of new protocols and attacks, and with the new GTK interface the tool is ready for the masses.

You can download it directly here:

Yersinia 0.7

SinFP v2.00 Released

OS Fingerprinting is an important part of any penetration test or hack as it allows you focus your efforts a lot more effeciently when point testing, rather than throwing everything at a machine like a script kiddy would. So let’s introduce a new option, other than p0f and xprobe2.

SinFP uses the aforementioned limitations as a basis for tests to be obsolutely avoided in used frames to identify accurately the remote operating system. That is, it only requires one open TCP port, sends only fully standard TCP packets, and limits the number of tests to 2 or 3 (with only 1 test giving the OS reliably in most cases).

New for 2.00:

• complete rewrite
• sinfp.db completely reworked
• new tests based on comparison between probe and response (TCP seq/ack comparison, IP ID value comparison)
• new matching algorithm, works like a search engine (a problem of finding intersection, by applying a deformation mask on keywords) much more efficient than in 1.xx branch
• possibility to manually pass a matching mask to change at will the matching algorithm
• passive fingerprinting much more acurate thanks to new matching algorithm
• possibility to launch P1P2P3 probes, or only P1P2 probes, or only P2 probe
• match IPv6 signatures against IPv4 ones
• API changes, not compatible with 1.xx version anymore
• DB schema changes, not compatible with 1.xx version anymore
• many bugfixes

To read more you can check out the SinFP Homepage.

You can download SinFP directly here.

SQL Power Injector v1.1

SQL Power Injector is a graphical application created in .Net 1.1 that helps the penetrating tester to inject SQL commands on a web page.

For now it is SQL Server, Oracle and MySQL compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal Mode).

Moreover this application will get all the parameters you need to test the SQL injection, either by GET or POST method, avoiding thus the need to use several applications or a proxy to intercept the data.

Features

• Supported on Windows, Unix and Linux operating systems
• SQL Server, Oracle, MySQL and Sybase/Adaptive Server compliant
• SSL support
• Load automatically the parameters from a form or a IFrame on a web
  page (GET or POST)
• Detect and browse the framesets
• Option that auto detects the language of the web site
• Find automatically the submit page(s) with its method (GET or POST)
  displayed in a different color
• Single SQL injection
• Blind SQL injection
• Comparison of true and false response of the page or results in
  the cookie
• Time delay
• Response of the SQL injection in a customized browser
• Fine tuning parameters injection
• Can parameterize the size of the length and count of the expected
  result to optimize the time taken by the application to execute the SQL
  injection
• Multithreading
• Option to replace space by empty comments /**/ against IDS or filter
  detection
• Automatically encode special characters before sending them
• Automatically detect predefined SQL errors in the response page
• Automatically detect a predefined word or sentence in the response page
• Real time result
• Possibility to inject an authentication cookie
• Can view the HTML code source of the returned page
• Save and load sessions in a XML file

You can find out more here:

SQL Power Injector

Download the latest version now.

Oedipus

Oedipus is an open source web application security analysis and testing suite written in Ruby by Penetration Testers for Penetration Testers. It is capable of parsing different types of log files off-line and identifying security vulnerabilities. Using the analyzed information, Oedipus can dynamically test web sites for application and web server vulnerabilities.

Oedipus can be broken down into 4 main components:

1. Analyzer

Capable of parsing several different types of log files, such as Burp, Paros, etc, identifying potential security vulnerabilities using pattern matching – An Oedipus input file is also produced.

2. Scanner

Parsers the Oedipus or IEnterceptor file, feeding each request to a dynamically loaded predefined security plug-in on the fly.

3. Reporter

Using the results from the Analyzer and the Scanner, Oedipus produces several well formatted reports designed for the Penetration Tester. The Scanner report can be interactively used to verify the results of the potential vulnerabilities discovered.

4. Tools

Using the above identified security vulnerabilities, a number of tools are provided to analyze and potentially exploit the vulnerability.

You can read more at:

Oedipus or Download Oedipus Now