techian.com

wsScanner is a toolkit for Web Services scanning and vulnerability detection.

This tool has the following functions:

Discovery tool

By leveraging search engine this tool helps in discovering Web Services running on any particular domain or with certain name pattern.

Vulnerability detection

It is possible to enumerate and profile Web Services using this tool and one can follow it up by auto auditing (.NET only). .NET proxy gets dynamically created for audit module. One can do vulnerability scan for data type, SQL injections, LDAP/Command injections, Buffer checks, Bruteforing SOAP etc. It is also possible to leverage regex patterns for SOAP analysis.

Fuzzing

This tool helps in fuzzing different Web 2.0 streams like SOAP, XML-RPC, REST, JSON etc. This module helps in assessing various different Web Services.

UDDI scan

It is possible to scan UDDI servers using this tool for footprinting and discovery of Web Services.

This tool is still in beta and they are planning to add some more features and support. Stay tuned for future releases as well.

More information and download details:

You can download wsScanner here:

wsScanner.zip

Or read more here.

It seems a data leakage bug has struck Firefox recently and has been confirmed by Window Snyder the security bod at Mozilla.

It’s basically a Chrome directory traversal bug (It seems a lot of the Firefox issues have had to do with chrome?).

It’s rated as low risk, but it can give away the existence of files (if the attacker knows the name and location).

The bug resides in Firefox’s chrome protocol scheme and allows for a directory traversal when certain types of extensions are installed. Attackers could use it to detect if certain programs or files are present on a machine, gaining information to use in perpetrating another, more malicious exploit.

Normally, Firefox’s chrome package is restricted to a limited number of directories, but a bug in the way it handles escaped sequences (i.e. %2e%2e%2f) allows attackers to escape those confines and access more sensitive parts of a user’s computer. The exploit only works if a user has made use of Firefox extensions that are “flat,” this is, those that don’t package their files in a jar archive. Examples of flat add-ons include Download Statusbar and Greasemonkey.

You can protect yourself by using NoScript, which I would guess most of you guys are using already.

The open bug can be found here.

Source: The Register

Another one that has been a long time coming, but finally here it is! Nikto 2.

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

Nikto is not designed as an overly stealthy tool. It will test a web server in the shortest timespan possible, and it’s fairly obvious in log files. However, there is support for LibWhisker’s anti-IDS methods in case you want to give it a try (or test your IDS system).

Not every check is a security problem, though most are. There are some items that are “info only” type checks that look for items that may not have a security flaw, but the webmaster or security engineer may not know are present on the server. These items are usually marked appropriately in the information printed. There are also some checks for unknown items which have been seen scanned for in log files.

Version 2 adds a ton of enhancements, including:

• Fingerprinting web servers via favicon.ico files
• 404 error checking for each file type
• Enhanced false positive reduction via multiple methods: headers, page content, and content hashing
• Scan tuning to include or exclude entire classes of vulnerability checks
• Uses LibWhisker 2, which has its own long list of enhancements
• A “single” scan mode that allows you to craft an HTTP request manually
• Basic template engine so that HTML reports can be easily customized
• An experimental knowledge base for scans, which will allow regenerated reports and retests (future)
• Optimizations, bug fixes and more…

You can download Nikto 2 here:

nikto-current.tar.gz

Or read more here.

Quite a few people seem to be interested in this tool, so here is the latest revision – Inguma 0.0.6.

For those that don’t know, Inguma is a free penetration testing and vulnerability discovery toolkit entirely written in python. Framework includes modules to discover hosts, gather information about, fuzz targets, brute force usernames and passwords, exploits, and a disassembler.

In this new version various things have been added like new modules and improvements in the existing ones. For example the Oracle modules. The Oracle payloads now uses the Cursor Injection method when possible so CREATE PROCEDURE system privilege is not needed to become DBA.

The support for InlineEgg, added in version 0.0.5.1, have been removed and a new completely free library have been added (PyShellCodeLib).

The static analysis framework OpenDis have been enhanced and now you can use the API exposed by OpenDis to write your own binary static analysis tools. As an example of the API, a tool to make binary diffs have been added. Take a look to the file $INGUMA_DIR/dis/asmdiff.py and to the README stored in the same directory.

New 5 exploits for Oracle Databases have been added and the module “sidguess” have been enhanced to retrieve the SID of the database instance from the Enterprise Manager/Database Control banner when possible.

The new modules added to the discover, gather and brute sections are the following:

• brutehttp: A brute forcer for HTTP servers.
• extip : A tool to known your external IP address. Very useful to check anonymous proxies.
• nmbstat : A tool to gather NetBIOS information.
• ipscan : A tool to make IP protocol scans. The tool check what IP protocols are enabled in the target.
• arppoison: A tool to poison target’s ARP cache

You can download Inguma 0.0.6 here:

Inguma 0.0.6

Or read more here

At last a new major release of Nmap!

If for some odd reason you don’t already know what Nmap is, it is a free and open source utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

The changelog shows 320 changes since 4.00 with a lot of great stuff in this release! It has a brand new GUI and results viewer (Zenmap), a scripting engine allowing you to write your own scripts for high-performance network discovery (or use one of the 40 scripts shipped with it), the 2nd generation OS detection system (now with more than a thousand fingerprints), nearly 1,500 more version detection signatures, and a lot more!

Zenmap is the official Nmap Security Scanner GUI. It is a multi-platform (Linux, Windows, Mac OS X, BSD, etc.) free and open source application which aims to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scan results can be compared with one another to see how they differ. The results of recent scans are stored in a searchable database.

More on Zenmap here:

Zenmap – the Nmap GUI

More information and download details:

You can download the new Nmap here:

Nmap 4.50

Or read more here.

CEH Ethical Hacking: Videos.Tools.and.Slax.CD version 5 guide and instruction inside,

VMware recommended!

If you want to stop hackers from invading your network, first you’ve got to invade their minds.
Computers around the world are systematically being victimized by rampant hacking. This hacking is not only widespread, but is being executed so flawlessly that the attackers compromise a system, steal everything of value and completely erase their tracks within 20 minutes.

The goal of the ethical hacker is to help the organization take preemptive measures against malicious attacks by attacking the system himself; all the while staying within legal limits. This philosophy stems from the proven practice of trying to catch a thief, by thinking like a thief. As technology advances and organization depend on technology increasingly, information assets have evolved into critical components of survival.

If hacking involves creativity and thinking ‘out-of-the-box’, then vulnerability testing and security audits will not ensure the security proofing of an organization. To ensure that organizations have adequately protected their information assets, they must adopt the approach of ‘defense in depth’. In other words, they must penetrate their networks and assess the security posture for vulnerabilities and exposure.

The definition of an Ethical Hacker is very similar to a Penetration Tester. The Ethical Hacker is an individual who is usually employed with the organization and who can be trusted to undertake an attempt to penetrate networks and/or computer systems using the same methods as a Hacker. Hacking is a felony in the United States and most other countries. When it is done by request and under a contract between an Ethical Hacker and an organization, it is legal. The most important point is that an Ethical Hacker has authorization to probe the target.

The CEH Program certifies individuals in the specific network security discipline of Ethical Hacking from a vendor-neutral perspective. The Certified Ethical Hacker certification will fortify the application knowledge of security officers, auditors, security professionals, site administrators, and anyone who is concerned about the integrity of the network infrastructure. A Certified Ethical Hacker is a skilled professional who understands and knows how to look for the weaknesses and vulnerabilities in target systems and uses the same knowledge and tools as a malicious hacker.

To achieve the Certified Ethical Hacker Certification, you must pass the CEH exam 312-50

* Cisco Corporation
* Novell
* Canon
* Hewlett Packard
* US Air Force Reserve
* US Embassy
* Verizon
* PFIZER
* HDFC Bank
* University of Memphis
* Microsoft Corporation
* Worldcom
* Trusecure
* US Department of Defense
* Fedex
* Dunlop
* British Telecom
* Cisco
* Supreme Court of the Philippines
* United Nations
* Ministry of Defense, UK
* Nortel Networks
* MCI
* Check Point Software
* KPMG
* Fleet International
* Cingular Wireless
* Columbia Daily Tribune
* Johnson & Johnson
* Marriott Hotel
* Tucson Electric Power Company
* Singapore Police Force
* PriceWaterhouseCoopers
* SAP
* Coca-Cola Corporation
* Quantum Research
* US Military
* IBM Global Services
* UPS
* American Express
* FBI
* Citibank Corporation
* Boehringer Ingelheim
* Wipro
* New York City Dept Of IT & Telecom – DoITT
* United States Marine Corps
* Reserve Bank of India
* US Air Force
* EDS
* Bell Canada
* SONY
* Kodak
* Ontario Provincial Police
* Harris Corporation
* Xerox
* Philips Electronics
* U.S. Army
* Schering
* Accenture
* Bank One
* SAIC
* Fujitsu
* Deutsche Bank
* Symantec
* Sun Microsystems
* Google Corporation
* McAfee
* Dell Corporation
* Verizon
* Motorola
* Singapore Airlines
* Infosys
* TATA Consultancy
* Wipro
* Deloitte
* Oracle

More Information and Download Details:

http://rapidshare.com/files/82897471/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part01.rar
http://rapidshare.com/files/82571635/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part02.rar
http://rapidshare.com/files/82529321/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part03.rar
http://rapidshare.com/files/82498437/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part04.rar
http://rapidshare.com/files/82507374/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part05.rar
http://rapidshare.com/files/82663576/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part06.rar
http://rapidshare.com/files/82666332/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part07.rar
http://rapidshare.com/files/82526248/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part08.rar
http://rapidshare.com/files/82897449/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part09.rar
http://rapidshare.com/files/82661093/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part10.rar
http://rapidshare.com/files/82897430/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part11.rar
http://rapidshare.com/files/82718958/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part12.rar
http://rapidshare.com/files/82897448/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part13.rar
http://rapidshare.com/files/82764792/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part14.rar
http://rapidshare.com/files/82897469/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part15.rar
http://rapidshare.com/files/82897444/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part16.rar
http://rapidshare.com/files/82560846/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part17.rar
http://rapidshare.com/files/82720259/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part18.rar
http://rapidshare.com/files/82548160/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part19.rar
http://rapidshare.com/files/82897439/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part20.rar
http://rapidshare.com/files/82897438/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part21.rar
http://rapidshare.com/files/82555618/Ethical.Hacking.Videos.To
ols.and.Slax.CD.5.0.part22.rar
http://rapidshare.com/files/82639580/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part23.rar
http://rapidshare.com/files/82897459/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part24.rar
http://rapidshare.com/files/82501130/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part25.rar
http://rapidshare.com/files/82748237/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part26.rar
http://rapidshare.com/files/82716346/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part27.rar
http://rapidshare.com/files/82677341/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part28.rar
http://rapidshare.com/files/82773160/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part29.rar
http://rapidshare.com/files/82643946/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part30.rar
http://rapidshare.com/files/82669156/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part31.rar
http://rapidshare.com/files/82757335/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part32.rar
http://rapidshare.com/files/82504276/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part33.rar
http://rapidshare.com/files/82745542/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part34.rar
http://rapidshare.com/files/82640835/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part35.rar
http://rapidshare.com/files/82670704/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part36.rar
http://rapidshare.com/files/82538436/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part37.rar
http://rapidshare.com/files/82754081/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part38.rar
http://rapidshare.com/files/82713776/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part39.rar
http://rapidshare.com/files/82662057/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part40.rar
http://rapidshare.com/files/82564140/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part41.rar
http://rapidshare.com/files/82768982/Ethical.Hacking.Videos.Tools.and.Slax.CD.5.0.part42.rar

CEH Ethical Hacking: Videos.Tools.and.Slax.CD version 5
guide and instruction inside, VMware recommended!
size: 4.52 GB after extracting
content: 8 file .iso
42 files on rapidshare

Password : namdatviet