Category: ethernet

Categories
ethernet FREE FTP Grep Linux Networking NGrep Packet Sniffing SSH Utility Windows WinDump WinPCap WireShark

FREE Windows Utilities for Sniffing


WinDump
WinDump is an exceptionally powerful command-line packet sniffer. Ported over from the source of the Tcpdump utility available for UNIX, WinDump carries over the same power and flexibility to the Windows world, all in a lightweight executable.
WinDump is a helpful utility when you need to do some quick and easy packet capturing to diagnose a network problem. It’s flexible, and it can capture and display details about every packet going across the network interface. It can filter the output results based on protocol (e.g., Address Resolution Protocol—ARP, IP, TCP, UDP), source network or host, destination network or host, source port, destination port, and many other criteria.
To use WinDump, you’ll first need to download and install the Windows Packet Capture Library (WinPcap), the Windows port of the open-source packet-capture and network-analysis library libpcap for UNIX. WinPcap runs on all versions of Windows.
After you install WinPcap, you can download the standalone WinDump executable. To launch WinDump, simply run it from the command line with the appropriate options for what you’d like to capture or read. You’ll find the online manual for WinDump here.
The first command you might want to execute is Win-Dump -D, which will display a list of interfaces available on your computer, as well as a corresponding number for each interface, so that you can determine which interface to use for your sniffing activities. After you know which interface to run, you can simply use that number with the -i option (i.e., WinDump -i 3, if number 3 is the interface you’d like to use) to start viewing packet data in real time. (Because these are ports of UNIX utilities, the command-line switches are case-sensitive.)
Ngrep
Although WinDump is a tremendous utility, sometimes it requires a considerable amount of overhead or knowledge to determine what you’re looking for. For example, suppose you’re trying to look up whether a DNS query is making it across your network, but you aren’t familiar with the protocols and that DNS uses by default. Or, suppose a lot of traffic is coming across a network connection, and you’re finding it too cumbersome to work through all the packets just to find the one particular packet you’re looking for. For such situations enter ngrep, the network-aware grep utility.
If you aren’t familiar with grep, it’s probably one of the most widely known and oft-utilized UNIX utilities. Grep finds matching text strings (through a mechanism known as regular expressions) in files on a file system, then outputs the lines to the display. You might compare grep with the Windows command-line Find utility, but grep differs by providing an exceptional amount of power in its search for text strings.
By applying these capabilities to the network layer, ngrep provides the same level of functionality for packet sniffing. As a result, you don’t need to know what protocols, ports, network, or IP addresses that two devices are using to transfer data. You just need to know something about the packet’s payload, and ngrep will find it for you—regardless of how it’s transmitted.
Ngrep is great for troubleshooting DNS query problems. In a large Active Directory (AD) environment, dozens of DNS queries are typically occurring across the network per second. If I’m trying to troubleshoot a specific set of problems, searching each packet to find the one I’m looking for is cumbersome at best. Instead of relying on a straight packet capture of all DNS traffic, I can simply use ngrep to find the text string I’m looking for because DNS queries and responses are performed in plain text.
Ngrep currently recognizes ICMP, IGMP, Raw, TCP, and UDP protocols across 802.11, Ethernet, FDDI, PPP, SLIP, Token Ring, and null interfaces. Like WinDump it requires the WinPcap library to operate properly.
WireShark (formerly Ethereal)
When you face a situation in which you need to roll up your sleeves and dive as deeply as possible into network capture and analysis, one utility needs to come to mind: the world’s most popular network analyzer, WireShark. Network experts around the world use WireShark because it has all the standard features you’ll find in most protocol analyzers, in addition to some you won’t find in any other product. More than 400 developers around the world have made contributions to this open-source application. A decade ago, you would have to pay thousands of dollars for software that had the same capabilities, but WireShark offers it all free.
WireShark can capture data off your network connection, filter the data, dive into the details of each packet, save the packet capture for detailed analysis, send packet captures to other network engineers (or vendors) to help with debugging, and open packet captures from many other leading packet-capture utilities. WireShark can capture data off of various network transports, such as Classical IP over ATM (CIP), Ethernet, Fiber Distributed Data Interface (FDDI), Point-to-Point Protocol (PPP), Token Ring, 802.11, and loopback interfaces (although it doesn’t support all types on every platform). Across all those network transports, WireShark can “dissect” more than 750 protocol types, including FTP, HTTP, NetBIOS, POP3, remote procedure call (RPC), SNMP, SSH, SMTP, and Telnet, just to name a few.
Like the other sniffing utilities I’ve mentioned, WireShark depends on an installation of WinPcap to function properly, so you’ll need to install that first. Then, after you install the latest Ethereal distribution for Windows, simply access the Capture, Interfaces menu and select the interface you want to start using for capture. Then, you’re ready to start analyzing your traffic.
Categories
ethernet FTP Linux Passwords Windows

Linux Commands for (Beginning and Forgetful) Administrators





Command
 Summary Use
arp
Command mostly used for checking existing Ethernet connectivity and IP address
Most common use: arp

This command should be used in conjunction with the ifconfig and route commands. It is mostly useful for me to check a network card and get the IP address quick. Obviously there are many more parameters, but I am trying to share the basics of server administration, not the whole book of commands.
df
Display filesystem information
Most common use: df -h

Great way to keep tabs on how much hard disk space you have on each mounted file system.
du
Display usage
Most common use, under a specific directory: du -a

Easily and quickly identify the size of files/programs in certain directories. A word of caution is that you should not run this command from the / directory. It will actually display size for every file on the entire Linux harddisk.
find
Find locations of files/directories quickly across entire filesystem
Most common use: find / -name appname -type d -xdev

(replace the word appname with the name of a file or application like gimp)This is a very powerful command and is best used when running as root or superuser. The danger is that you will potentially look across every single file on every filesystem, so the syntax is very important. The example shown allows you to search against all directories below / for the appname found in directories but only on the existing filesystem. It may sound complex but the example shown allows you to find a program you may need within seconds!
Other uses and more complex but beneficial functions include using the -exec or execute a command.
You may also try the commands: locate or try slocate
ifconfig
Command line tool to configure or check all network cards/interfaces
Most common uses: ifconfig and also ifconfig eth0 10.1.1.1

Using the plain ifconfig command will show you the details of all the already configured network cards or interfaces. This is a great way to get a check that your network hardware is working properly. You may also benefit from this review of server configuration. Using the many other options of ifconfig such as the one listed allows you to assign a particular interface a static IP address. I only show an example and not a real world command above. Also review some commands for file permissions here.. Your best bet, if you want to configure your network card using this command is to first read the manual pages. You access them by typing: man ifconfig
init
Allows you to change the server bootup on a specific runlevel
Most common use: init 5

This is a useful command, when for instance a servers fails to identify video type, and ends up dropping to the non-graphical boot-up mode (also called runlevel 3).

The server runlevels rely on scripts to basically start up a server with specific processes and tools upon bootup.Runlevel 5 is the default graphical runlevel for Linux servers. But sometimes you get stuck in a different mode and need to force a level. For those rare cases, the init command is a simple way to force the mode without having to edit the inittab file.

Of course, this command does not fix the underlying problem, it just provides a fast way to change levels as needed. For a more permanent correction to the runlevel, edit your /etc/inittab file to state:id:5:initdefault:
joe or nano
Easy to use command line editors that are often included with the major Linux flavors
Most common uses:
joe filename 
nano filename

A real world example for you to get a better sense on how this works:
nano /etc/dhcp3/dhcpd.conf
This allows you to edit using nano the dhcpd.conf configuration file from the command line.
Maybe you are not up to speed on vi, or never learned how to use emacs? On most Linux flavors the text editor named joe or one named nano are available. These basic but easy to use editors are useful for those who need a text editor on the command line but don’t know vi or emacs. Although, I do highly recommend that you learn and use Vi and Emacs editors as well. Regardless, you will need to use a command line editor from time to time. You can also use cat and more commands to list contents of files, but this is basic stuff found under the basic linux commands listing. Try: more filename to list contents of the filename.
netstat
Summary of network connections and status of sockets
Most common uses: netstat and also netstat |head and also netstat -r

Netstat command simply displays all sockets and server connections. The top few lines are usually most helpful regarding webserver administration. Therefore if you are doing basic webserver work, you can quickly read the top lines of the netstat output by including the |head (pipe and head commands). Using the –r option gives you a very good look at the network routing addresses. This is directly linked to the route command.
nslookup
Checks the domain name and IP information of a server
Most common use: nslookup www.hostname.com

You are bound to need this command for one reason or another. When performing server installation and configuration this command gives you the existing root server IP and DNS information and can also provide details from other remote servers. Therefore, it is also a very useful security command where you can lookup DNS information regarding a particular host IP that you may see showing up on your server access logs. Note there are some other commands like file permissions that may also help. There is a lot more to this command and using the man pages will get you the details by typing: man nslookup
ping
Sends test packets to a specified server to check if it is responding properly
Most common use: ping 10.0.0.0 (replace the 10.0.0.0 with a true IP address)
This is an extremely useful command that is necessary to test network connectivity and response of servers. It creates a series of test packets of data that are then bounced to the server and back giving an indication whether the server is operating properly.

It is the first line of testing if a network failure occurs. If ping works but for instance FTP does not, then chances are that the server is configured correctly, but the FTP daemon or service is not. However, if even ping does not work there is a more significant server connectivity issue… like maybe the wires are not connected or the server is turned off! The outcome of this command is pretty much one of two things. Either it works, or you get the message destination host unreachable. It is a very fast way to check even remote servers.
ps
Lists all existing processes on the server
Most common uses: ps and also ps -A |more

The simple command will list every process associated with the specific user running on the server. This is helpful in case you run into problems and need to for instance kill a particular process that is stuck in memory. On the other hand, as a system administrator, I tend to use the -A with the |more option. This will list every process running on the server one screen at a time. Read more of our commands on our reallylinux.com help page. I use ps to quickly check what others are goofing with on my servers and often find that I’m the one doing the dangerous goofing!
rm
Removes/deletes directories and files
Most common use: rm -r name (replace name with your file or directory name)

The –r option forces the command to also apply to each subdirectory within the directory. This will work for even non-empty directories. For instance if you are trying to delete the entire contents of the directory x which includes directories y and z this command will do it in one quick process. That is much more useful than trying to use the rmdir command after deleting files! Instead use the rm -r command and you will save time and effort. You may already have known this but since server administrators end up spending a lot of time making and deleting I included this tip!
route
Lists the routing tables for your server
Most common use: route -v

This is pretty much the exact same output as the command netstat -r. You can suit yourself which you prefer to run. I tend to type netstat commands a lot more than just route and so it applies less to my situation, but who knows, maybe you are going to love and use route the most!
shred
Deletes a file securely by overwriting its contents
Most common use: shred -v filename (replace filename with your specific file)

The -v option is useful since it provides extra view of what exactly the shred tool is doing while you wait. On especially BIG files this could take a bit of time. The result is that your file is so thoroughly deleted it is very unlikely to ever be retrieved again. This is especially useful when trying to zap important server related files that may include confidential information like user names or hidden processes. It is also useful for deleting those hundreds of love notes you get from some of the users on your server, another bonus of being a server administrator. 🙂
sudo
The super-user do command that allows you to run specific commands that require root access.
Most common use: sudo command (replace command with your specific one)

This command is useful when you are logged into a server and attempt a command that requires super-user or root privileges. In most cases, you can simply run the command through sudo, without having to log in as root. In fact, this is a very beneficial way to administer your server without daily use of the root login, which is potentially dangerous.

Note there are other commands for file permissions here. Below is a simple example of the sudo capabilities:
sudo cd /root
This command allows you to change directories to the /root without having to login as root. Note that you must enter the root password once, when running a sudo command.
top
Displays many system statistics and details regarding active processes
Most common use: top

This is a very useful system administrator tool that basically gives you a summary view of the system including number of users, memory usage, CPU usage, and active processes. Often during the course of a day when running multiple servers, one of my Xwindows workstations just displays the top command from each of the servers as a very quick check of their status and stability.
touch
Allows you to change the timestamp on a file.
Most common use: touch filename

Using the basic touch command, as above, will simply force the current date and time upon the specified file. This is helpful, but not often used.

For instance, to force a specific date and time upon all files in a directory, type:
touch *

You can also force a specific date/time stamp using the -t option like this: touch -t200103041200.00 *
The command above will change all files in the current directory to take on the new date of March 4th, 2001 at noon. The syntax follows this pattern: YYYYMMDDhhmm.ss

YYYY represents the four digit year, then the two digit month, day, hour and minutes. You can even specify seconds as noted above. In any case, this is a useful way to control timestamps on any files on your server.
traceroute
Traces the existing network routing for a remote or local server
Most common use: traceroute hostname
(replace hostname with the name of your server such as reallylinux.com)
This is a very powerful network command that basically gives the exact route between your machine and a server. In some cases you can actually watch the network hops from country to country across an ocean, through data centers, etc. Read more of our commands on our reallylinux.com help page.

This comes in handy when trying to fix a network problem, such as when someone on the network can not get access to your server while others can. This can help identify the break or error along the network line. One strong note to you is not to misuse this command! When you run the traceroute everyone of those systems you see listed also sees YOU doing the traceroute and therefore as a matter of etiquette and respect this command should be used when necessary not for entertainment purposes. A key characteristic of gainfully employed server administrators: knowing when to use commands and when not to use them!
w
An extension of the who command that displays details of all users currently on the server
Most common uses: w
This is a very important system admin tool I use commonly to track who is on the server and what processes they are running. It is obviously most useful when run as a superuser.

The default setting for the w command is to show the long list of process details. You can also run the commandw -s to review a shorter process listing, which is helpful when you have a lot of users on the server doing a lot of things! Remember that this is different than the who command that can only display users not their processes.
who
Tool used to monitor who is on the system and many other server related characteristics
Most common uses: who and also who -q and also who -b

The plain command just lists the names of users currently on the server. Using the -q option allows you to quickly view just the total number of users on the system. Using the -b option reminds you how long it has been since you rebooted that stable Linux server! One of my servers had a -b of almost three years! Yes, that’s why we at reallylinux.com call it really Linux!


Thanks to Mark Rais, senior editor ReallyLinux.com for this guide.

Categories
ethernet Linux Networking

View Ethernet Statistics in Linux



You need to use the following two commands:

  • ifconfig command – Display all interfaces which are currently available.
  • netstat command – Display network connections, routing tables, interface statistics, masquerade connections, and multicast memberships.

ifconfig example

Type the following command:
/sbin/ifconfig eth0

OR
/sbin/ifconfig -a

OR
ifconfig

Sample output:

eth0      Link encap:Ethernet  HWaddr 00:19:d1:2a:ba:a8
          inet addr:192.168.2.2  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::219:d1ff:fe2a:baa8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1948632 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1559234 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2366493974 (2.3 GB)  TX bytes:388339315 (388.3 MB)
          Memory:e3180000-e31a0000 

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:27378 errors:0 dropped:0 overruns:0 frame:0
          TX packets:27378 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:3046452 (3.0 MB)  TX bytes:3046452 (3.0 MB)

netstat Command Example

Ti display a table of all network interface including recived and send packets, enter:

 
netstat -i

Sample outputs:

Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0       1500 0   1955323      0      0 0       1563543      0      0      0 BMRU
lo        16436 0     27472      0      0 0         27472      0      0      0 LRU

Display Summary Statistics For Each Protocol

Type the following command:

 
netstat -s

Sample output:

Ip:
    2025059 total packets received
    21 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    2024996 incoming packets delivered
    1568954 requests sent out
    5 outgoing packets dropped
    60 reassemblies required
    30 packets reassembled ok
    5 fragments failed
Icmp:
    225 ICMP messages received
    13 input ICMP message failed.
    ICMP input histogram:
        destination unreachable: 89
        timeout in transit: 71
        echo replies: 65
    146 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 79
        echo request: 67
IcmpMsg:
        InType0: 65
        InType3: 89
        InType11: 71
        OutType3: 79
        OutType8: 67
Tcp:
    20603 active connections openings
    99 passive connection openings
    1125 failed connection attempts
    352 connection resets received
    17 connections established
    1983950 segments received
    1475010 segments send out
    51436 segments retransmited
    0 bad segments received.
    38462 resets sent
Udp:
    40292 packets received
    62 packets to unknown port received.
    0 packet receive errors
    42369 packets sent
UdpLite:
TcpExt:
    16 invalid SYN cookies received
    2 packets pruned from receive queue because of socket buffer overrun
    4956 TCP sockets finished time wait in fast timer
    128 packets rejects in established connections because of timestamp
    45978 delayed acks sent
    5 delayed acks further delayed because of locked socket
    Quick ack mode was activated 6369 times
    21 packets directly queued to recvmsg prequeue.
    13099 bytes directly received in process context from prequeue
    1435761 packet headers predicted
    9 packets header predicted and directly queued to user
    133229 acknowledgments not containing data payload received
    38661 predicted acknowledgments
    5170 times recovered from packet loss by selective acknowledgements
    2 bad SACK blocks received
    Detected reordering 1 times using FACK
    Detected reordering 2 times using SACK
    Detected reordering 2 times using time stamp
    3 congestion windows fully recovered without slow start
    3 congestion windows partially recovered using Hoe heuristic
    9 congestion windows recovered without slow start by DSACK
    3521 congestion windows recovered without slow start after partial ack
    7455 TCP data loss events
    TCPLostRetransmit: 402
    6 timeouts after reno fast retransmit
    2810 timeouts after SACK recovery
    673 timeouts in loss state
    10164 fast retransmits
    111 forward retransmits
    7138 retransmits in slow start
    15322 other TCP timeouts
    878 SACK retransmits failed
    125 packets collapsed in receive queue due to low socket buffer
    8425 DSACKs sent for old packets
    167 DSACKs sent for out of order packets
    1244 DSACKs received
    13 DSACKs for out of order packets received
    1779 connections reset due to unexpected data
    104 connections reset due to early user close
    247 connections aborted due to timeout
    TCPSACKDiscard: 1
    TCPDSACKIgnoredOld: 650
    TCPDSACKIgnoredNoUndo: 463
    TCPSpuriousRTOs: 31
    TCPSackShifted: 5988
    TCPSackMerged: 14413
    TCPSackShiftFallback: 11127
IpExt:
    InMcastPkts: 556
    OutMcastPkts: 433
    InBcastPkts: 473
    InOctets: -1923455127
    OutOctets: 368984572
    InMcastOctets: 73654
    OutMcastOctets: 50857
    InBcastOctets: 40987

ss command – Display Quick Stats

Type the following command:

 
ss -s

Sample outputs:

ss -s
Total: 767 (kernel 824)
TCP:   123 (estab 15, closed 0, orphaned 0, synrecv 0, timewait 0/0), ports 0

Transport Total     IP        IPv6
*   824       -         -
RAW   1         1         0
UDP   6         5         1
TCP   123       121       2
INET   130       127       3
FRAG   0         0         0
Categories
Cisco ethernet Linux Networking Passwords Windows Windows 2000

Password recovery procedure Cisco catalyst fixed configuration layer 2 and 3 switches

Introduction
This document describes the password recovery procedure for the Cisco Catalyst Layer 2 fixed configuration switches 2900XL/3500XL, 2940, 2950/2955, 2960, and 2970 Series, as well as the Cisco Catalyst Layer 3 fixed configuration switches 3550, 3560, and 3750 Series.

Before You Begin
Conventions
For more information on document conventions, see the Cisco Technical Tips Conventions.

Prerequisites
There are no specific prerequisites for this document.

Step-by-Step Procedure
Follow the password recovery procedure below.

Attach a terminal or PC with terminal emulation (for example, Hyper Terminal) to the console port of the switch.

Use the following terminal settings:

Bits per second (baud): 9600

Data bits: 8

Parity: None

Stop bits: 1

Flow Control: Xon/Xoff

Note: For additional information on cabling and connecting a terminal to the console port, refer to Connecting a Terminal to the Console Port on Catalyst Switches.

Unplug the power cable.

Power the switch and bring it to the switch: prompt:

For 2900XL, 3500XL, 2940, 2950, 2960, 2970, 3550, 3560, and 3750 series switches, do this:

Hold down the mode button located on the left side of the front panel, while you reconnect the power cable to the switch.

Catalyst Switch Series
LED Behavior and Mode Button Release Action

2900XL, 3500XL, 3550
Release the Mode button when the LED above Port1x goes out.

2940, 2950
Release the Mode button after approximately 5 seconds when the Status (STAT) LED goes out. When you release the Mode button, the SYST LED blinks amber.

2960, 2970
Release the Mode button when the SYST LED blinks amber and then turns solid green. When you release the Mode button, the SYST LED blinks green.

3560, 3750
Release the Mode button after approximately 15 seconds when the SYST LED turns solid green. When you release the Mode button, the SYST LED blinks green.

Note: LED position may vary slightly depending on the model.

Catalyst 3524XL

Catalyst 2950-24

For 2955 series switches only:

The Catalyst 2955 series switches do not use an external mode button for password recovery. Instead the switch boot loader uses the break-key detection to stop the automatic boot sequence for the password recovery purposes. The break sequence is determined by the terminal application and operating system used. Hyperterm running on Windows 2000 uses Ctrl + Break. On a workstation running UNIX, Ctrl-C is the break key. For more information, refer to Standard Break Key Sequence Combinations During Password Recovery.

The example below uses Hyperterm to break into switch: mode on a 2955.

C2955 Boot Loader (C2955-HBOOT-M) Version 12.1(0.0.514), CISCO DEVELOPMENT TEST
VERSION
Compiled Fri 13-Dec-02 17:38 by madison
WS-C2955T-12 starting…
Base ethernet MAC Address: 00:0b:be:b6:ee:00
Xmodem file system is available.
Initializing Flash…
flashfs[0]: 19 files, 2 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 7741440
flashfs[0]: Bytes used: 4510720
flashfs[0]: Bytes available: 3230720
flashfs[0]: flashfs fsck took 7 seconds.
…done initializing flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
Parameter Block Filesystem (pb:) installed, fsid: 4

*** The system will autoboot in 15 seconds ***
Send break character to prevent autobooting.

!— Wait until you see this message before
!— you issue the break sequence.
!— Ctrl+Break is entered using Hyperterm.

The system has been interrupted prior to initializing the flash file system to finish
loading the operating system software:

flash_init
load_helper
boot
switch:Issue the flash_init command.

switch: flash_init
Initializing Flash…
flashfs[0]: 143 files, 4 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 3612672
flashfs[0]: Bytes used: 2729472
flashfs[0]: Bytes available: 883200
flashfs[0]: flashfs fsck took 86 seconds
….done Initializing Flash.
Boot Sector Filesystem (bs:) installed, fsid: 3
Parameter Block Filesystem (pb:) installed, fsid: 4
switch:

!— This output is from a 2900XL switch. Output from
!— other switches will vary slightly.

Issue the load_helper command.

switch: load_helper
switch:Issue the dir flash: command.

Note: Make sure to type a colon “:” after the dir flash.

The switch file system is displayed:

switch: dir flash:
Directory of flash:/
2 -rwx 1803357 c3500xl-c3h2s-mz.120-5.WC7.bin

!— This is the current version of software.

4 -rwx 1131 config.text

!— This is the configuration file.

5 -rwx 109 info
6 -rwx 389 env_vars
7 drwx 640 html
18 -rwx 109 info.ver
403968 bytes available (3208704 bytes used)
switch:

!— This output is from a 3500XL switch. Output from
!— other switches will vary slightly.

Type rename flash:config.text flash:config.old to rename the configuration file.

switch: rename flash:config.text flash:config.old
switch:

!— The config.text file contains the password
!— definition.

Issue the boot command to boot the system.

switch: boot
Loading “flash:c3500xl-c3h2s-mz.120-5.WC7.bin”…###############################
################################################################################
######################################################################
File “flash:c3500xl-c3h2s-mz.120-5.WC7.bin” uncompressed and installed, entry po
int: 0x3000
executing…

!— Output suppressed.
!— This output is from a 3500XL switch. Output from other switches
!— will vary slightly.

Enter “n” at the prompt to abort the initial configuration dialog.

— System Configuration Dialog —
At any point you may enter a question mark ‘?’ for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets ‘[]’.
Continue with configuration dialog? [yes/no]: n

!— Type “n” for no.

Press RETURN to get started.

!— Press Return or Enter.

Switch>

!— The Switch> prompt is displayed.

At the switch prompt, type en to enter enable mode.

Switch>en
Switch#Type rename flash:config.old flash:config.text to rename the configuration file with its original name.

Switch#rename flash:config.old flash:config.text
Destination filename [config.text]

!— Press Return or Enter.

Switch#Copy the configuration file into memory.

Switch#copy flash:config.text system:running-config
Destination filename [running-config]?

!— Press Return or Enter.

1131 bytes copied in 0.760 secs
Sw1#The configuration file is now reloaded.

Overwrite the current passwords that you do not know. Choose a strong password with at least one capital letter, one number, and one special character.

Note: Overwrite the passwords which are necessary. You need not overwrite all of the mentioned passwords.

Sw1# conf t

!— To overwrite existing secret password

Sw1(config)#enable secret

!— To overwrite existing enable password

Sw1(config)#enable password

!— To overwrite existing vty password

Sw1(config)#line vty 0 15
Sw1(config-line)#password

Sw1(config-line)#login

!— To overwrite existing console password

Sw1(config-line)#line con 0
Sw1(config-line)#password

Write the running configuration to the configuration file with the write memory command.

Sw1#write memory
Building configuration…
[OK]
Sw1#

Categories
ethernet Linux Networking Windows

Vendor/Ethernet/Bluetooth MAC Address Lookup and Search

http://coffer.com/mac_find/

Categories
Aircrack-ng aireplay airmon airodump Apple BackTrack Cisco ethernet Grep Linux SSH SSL VPN WEP wifi WPA

BackTrack 3 Final Tools

Information Gathering
0trace 0.01 – http://lcamtuf.coredump.cx/
This tool enables the user to perform hop enumeration (“traceroute”) within an established TCP connection, such as a HTTP or SMTP session. This is opposed to sending stray packets, as traceroute-type tools usually do. The important benefit of using an established connection and matching TCP packets to send a TTL-based probe is that such traffic is happily allowed through by many stateful firewalls and other defenses without further inspection (since it is related to an entry in the connection table).

ASS – http://phenoelit-us.org/irpas/docu.html#ass
ASS is a Autonomous System Scanner. Because routing protocols use autonomous systems to distinguish between various routing “domains” and various ways to communicate, you need something which works like a TCP port scanner but knows more than one protocol.

DIG – http://linux.about.com/od/commands/l/blcmdl1_dig.htm
dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried.

DMitry – http://www.mor-pah.net/
DMitry (Deepmagic Information Gathering Tool) is a UNIX/Linux command line program coded purely in C with the ability to gather as much information as possible about a host.

DNS-Ptr – http://vejeta18.wordpress.com/2006/11/19/dns-ptr/#more-12 [down]
It is a tool that allows you to make a consultation by means of IP ranks to obtain DNS names of this IPs in addition with simplicity and speed.

dnstracer 1.5 – http://www.mavetju.org/unix/dnstracer.php
dnstracer determines where a given Domain Name Server (DNS) gets its information from, and follows the chain of DNS servers back to the servers which know the data.

dnswalk – http://sourceforge.net/projects/dnswalk/
Dnswalk is a DNS debugger. It performs zone transfers of specified domains, and checks the database in numerous ways for internal consistency, as well as accuracy.

dns-bruteforce – http://www.revhosts.net/DNSBruteforce
This tool is used to made a brute force on name resolution.The idea of that tool is to resolve all words dot domain name. To be more useful the tool uses multi threading; one thread for each name server. Classical brute forcers are sequential. With this method we cut the dictionary in n blocs ( n is the number of dns servers) and distribute these blocs to name servers. The tool is now in the project revhosts, new updates are only available in revhosts.

dnsenum – http://www.filip.waeytens.easynet.be/
A tool written in Perl to enumerate information on a domain. It uses the Net::DNS module.

dnsmap – http://unknown.pentester.googlepages.com/ [down]
Dnsmap is a small C based tool that perform brute-forcing of domains. The tool can use an internal wordlist, or work with an external dictionary file.

DNSPredict – http://johnny.ihackstuff.com/downloads/task,cat_view/gid,16/limit,5/limitstart,0/order,name/dir,ASC/
This PERL script, by Jimmy Neutron, is great for determining DNS names with Google. This tool, which is essential for network mapping, accepts two somewhat related words, and a domain name as arguments. The two words are sent through Google sets which expands the words into a list of related words. For example, “earth” and “mars” would expand to Venus, Mercury, Jupiter, Saturn, Neptune, Uranus, Pluto. If fed domain foo.com, dnspredict would then attempt to DNS resolve venus.foo.com, mercury.foo.com, etc. This Windows version is standalone, and requires nothing other than this executable.

Finger Google – http://sourceforge.net/project/showfiles.php?group_id=82076
FingerGoogle is a reduced Net-Twister module that helps to find user account names

Firewalk – http://www.packetfactory.net/projects/firewalk/
Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device will pass. Firewalk works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets on the floor and we will see no response.

Fport 2.0 (Windows Executable) – http://www.foundstone.com/us/resources/proddesc/fport.htm
fport reports all open TCP/IP and UDP ports and maps them to the owning application. This is the same information you would see using the ‘netstat -an’ command, but it also maps those ports to running processes with the PID, process name and path. Fport can be used to quickly identify unknown open ports and their associated applications.

Goog Mail Enum
Enumerate domain emails from google

Google-search
Google search script from the command line.

Googrape
Gives a localized access to the Google Hacking DB by allowing you to look up a domain name. And is excelent for searching through records.

Gooscan – http://johnny.ihackstuff.com/
Gooscan is a tool that automates queries against Google search appliances.

Host – http://www.hmug.org/man/1/host.php
host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, host prints a short summary of its command line arguments and options.  For more information: “man host”

InTrace 1.3 – http://www.swiecki.net
InTrace is the traceroute-like application that enables users to enumerate IP hops using existing TCP connections, both initiated from local network (local system) or from remote hosts. It could be useful for network reconnaissance and firewall bypassing.

Itrace – http://phenoelit-us.org/irpas/docu.html#itrace
Itrace is a program that implements traceroute(1) functionality using ICMP echo request packets. Therefore, it looks like you are just pinging your target while you traceroute there. It often helps tracing behind firewalls.

Maltego 2.0 – http://www.paterva.com/maltego/
Maltego is an open source intelligence and forensics application. It allows for the mining and gathering of information as well as the representation of this information in a meaningful way.

Metagoofil 1.4 – http://www.edge-security.com/metagoofil.php
Metagoofil is an information gathering tool designed for extracting metadata of public documents (pdf,doc,xls,ppt,odp,ods) availables in the target/victim websites.

Mbenum 1.5.0 (Windows Executable) – http://www.cqure.net/wp/mbenum/
MBEnum queries the master browser for whatever information it has registered. Windows servers/workstations store information about what services they run in the MB, eg; Terminal Services, SQL Server, RAS server etc. MBEnum can be useful to get an overall picture of a Windows environment.

Netenum – http://phenoelit-us.org/irpas/docu.html#netenum
netenum can be used to produce lists of hosts for other programs. It’s not as powerful as other ping-sweep tools, but it’s simple. When giving a timeout, it uses ICMP echo request to find available hosts. If you don’t supply a timeout, it just prints an IP address per line, so you can use them in shell scripts.

Netmask – http://phenoelit-us.org/irpas/docu.html#netmask
netmask asks for the netmask by ICMP.

Nmbscan 1.2.4 – http://nmbscan.gbarbier.org/
nmbscan scans the shares of a SMB/NetBIOS network, using the NMB/SMB/NetBIOS protocols. It is useful for acquiring information on a local area network for such purposes as security auditing. It can obtain such information as NMB/SMB/NetBIOS/Windows hostname, IP address, IP hostname, ethernet MAC address, Windows username, NMB/SMB/NetBIOS/Windows domain name, and master browser. It can discover all the NMB/SMB/NetBIOS/Windows hosts on a local area network by using the hosts lists maintained by master browsers.

Protos – http://phenoelit-us.org/irpas/docu.html#protos
Protos is a IP protocol scanner. It goes through all possible IP protocols and uses a negative scan to sort out unsupported protocols which should be reported by the target using ICMP protocol unreachable messages.

PsTools (Windows Executables) – http://technet.microsoft.com/en-us/sysinternals/default.aspx
The Sysinternals web site was created in 1996 by Mark Russinovich and Bryce Cogswell to host their advanced system utilities and technical information. Microsoft acquired Sysinternals in July, 2006. Whether you’re an IT Pro or a developer, you’ll find Sysinternals utilities to help you manage, troubleshoot and diagnose your Windows systems and applications.

PsInfo – http://technet.microsoft.com/en-us/sysinternals/bb897550.aspx
PsInfo is a command-line tool that gathers key information about the local or remote Windows NT/2000 system, including the type of installation, kernel build, registered organization and owner, number of processors and their type, amount of physical memory, the install date of the system, and if its a trial version, the expiration date.

PsFile – http://technet.microsoft.com/en-us/sysinternals/bb897552.aspx
The “net file” command shows you a list of the files that other computers have opened on the system upon which you execute the command, however it truncates long path names and doesn’t let you see that information for remote systems. PsFile is a command-line utility that shows a list of files on a system that are opened remotely, and it also allows you to close opened files either by name or by a file identifier.

PsList – http://technet.microsoft.com/en-us/sysinternals/bb896682.aspx
Show information about processes and threads.

PsGetSID – http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx
PsGetSid makes reading a computer’s SID easy, and works across the network so that you can query SIDs remotely. PsGetSid also lets you see the SIDs of user accounts and translate a SID into the name that represents it.

PsLoggedOn – http://technet.microsoft.com/en-us/sysinternals/bb897545.aspx
PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer, or a remote one. If you specify a user name instead of a computer, PsLoggedOn searches the computers in the network neighborhood and tells you if the user is currently logged on.

PsLogList – http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx
PsLogList is a clone of elogdump except that PsLogList lets you login to remote systems in situations your current set of security credentials would not permit access to the Event Log, and PsLogList retrieves message strings from the computer on which the event log you view resides.

PStoreView 1.0 (Windows Binary) – http://www.ntsecurity.nu/toolbox/pstoreview/
PStoreView lists the contents of the Protected Storage. It usually contains things like Internet Explorer username and password autocomplete, and Outlook account names and passwords.

QGoogle – http://diveintomark.org/projects/pygoogle/
Make google queries from python. Google licence key required.

Relay Scanner – http://www.cirt.dk/
It can search for SMTP server also locates and identifies open relay SMTP servers. It is an all in one program, you tell it how to scan and it does ALL of the work for you.

SMTP-Vrfy –
An SMTP Protocol Hacker. Vrfy.pl uses the vrfy command to verify users/mail accounts on a network by using a list of common system names like root, admin, etc…

Subdomainer 1.3 – http://www.edge-security.com/subdomainer.php
Subdomainer is an information gathering tool designed for obtaining subdomain names from public sources, like Google, Msn search, Yahoo, PgP servers, etc.

TCPtraceroute 1.5beta7 – http://michael.toren.net/code/tcptraceroute/
tcptraceroute is a traceroute implementation using TCP packets. The more traditional traceroute(8) sends out either UDP or ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets are taking to reach the destination.

TCtrace – http://phenoelit-us.org/irpas/docu.html#tctrace
TCtrace is like itrace a traceroute(1) brother – but it uses TCP SYN packets to trace. This makes it possible for you to trace through firewalls if you know one TCP service that is allowed to pass from the outside.

Whoami (Windows Executable) – http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en
Displays the current user/privilege level you have on windows.

Network Mapping

Amap 5.2 – http://www.thc.org/thc-amap/
Amap is a next-generation tool for assisting network penetration testing. It performs fast and reliable application protocol detection, independent on the TCP/UDP port they are being bound to.

Angry IP Scanner (ipscan) 3.0-beta3 – http://www.angryziber.com/w/Home
Angry IP Scanner (or simply ipscan) is an open-source and cross-platform network scanner designed to be fast and simple to use. It scans IP addresses and ports as well as has many other features.

Autoscan 0.99_R1 – http://autoscan.free.fr/
AutoScan is an application designed to explore and to manage your network. Entire subnets can be scanned simultaneously without human intervention.

Fierce 0.9.9 beta 03/24/07 – http://ha.ckers.org/fierce/
First what Fierce is not. Fierce is not an IP scanner, it is not a DDoS tool, it is not designed to scan the whole internet or perform any un-targeted attacks. It is meant specifically to locate likely targets both inside and outside a corporate network. Only those targets are listed (unless the -nopattern switch is used). No exploitation is performed (unless you do something intentionally malicious with the -connect switch). Fierce is a reconnaissance tool. Fierce is a PERL script that quickly scans domains (usually in just a few minutes, assuming no network lag) using several tactics.

Fping – http://www.fping.com/
Fping is a ping(1) like program which uses the Internet Control Message Protocol (ICMP) echo request to determine if a host is up. fping is different from ping in that you can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping. Instead of trying one host until it timeouts or replies, fping will send out a ping packet and move on to the next host in a round-robin fashion. If a host replies, it is noted and removed from the list of hosts to check. If a host does not respond within a certain time limit and/or retry limit it will be considered unreachable.

Genlist –
Network scanning for hosts responding to ping

Hping – http://www.hping.org/
hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

Hping2 2.0.0-rc3 – http://sourceforge.net/projects/hping2/
hping2 is an interactive packet constructor and response analyzer that uses the same CLI of the ping program (but with a lot of extensions). It can be used to perform a lot of tasks, like testing of firewall rules, (spoofed) port scanning, et cetera.

Hping3 3.0.0-alpha-1 – http://gd.tuwien.ac.at/www.hping.org/hping3.html
hping3 is fully scriptable using the TCL language, and packets can be received and sent via a binary or string rappresentation describing the packets. In pratice this means that a few lines of code can perform things that usually take many lines of C code. Examples are automated security tests with pretty printed report generation, TCP/IP test suites, many kind of attacks, NAT-ting, prototypes of firewalls, implementation of routing protocols, and so on.

IKE-Scan – http://www.nta-monitor.com/tools/ike-scan/
ike-scan is a command-line tool that uses the IKE protocol to discover, fingerprint and test IPsec VPN servers.

IKEProbe –
IKEProbe can be used to determine vulnerabilities in the PSK implementation of the VPN server. It tries out various combinations of ciphers, hashes and Diffie-Helman groups and attempts to force the remote server into aggressive mode.
IKEprobe tutorial: http://www.securityfocus.com/infocus/1821 IKEProbe Download: http://www.ernw.de/download/ikeprobe.zip

Netcat 0.7.1 – http://netcat.sourceforge.net/
Netcat is a featured networking utility which reads and writes data across network connections, using the TCP/IP protocol. It is designed to be a reliable “back-end” tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.

Netdiscover – http://nixgeneration.com/~jaime/netdiscover/
Netdiscover is an active/passive address reconnaissance tool, mainly developed for those wireless networks without dhcp server, when you are wardriving. It can be also used on hub/switched networks.

Nmap – http://www.insecure.org/nmap
Nmap (“Network Mapper”) is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

NmapFE – http://www.nmap-tutorial.com/html/nmap-tutorial-single.html
NmapFE is a GUI X11 front end for nmap

P0f – http://lcamtuf.coredump.cx/p0f.shtml
P0f is a versatile passive OS fingerprinting tool.

PSK-Crack –
psk-crack attempts to crack IKE Aggressive Mode pre-shared keys that have been previously gathered using ike-scan with the –pskcrack option.
psk-crack can operate in two different modes:
1) Dictionary cracking mode: this is the default mode in which psk-crack tries each candidate word from the dictionary file in turn until it finds a match, or all the words in the dictionary have been tried.
2) Brute-force cracking mode: in this mode, psk-crack tries all possible combinations of a specified character set up to a given length.

Ping – http://www.hmug.org/man/8/ping.php
The ping utility uses the ICMP protocol’s mandatory ECHO_REQUEST datagram to elicit an ICMP ECHO_RESPONSE from a host or gateway. ECHO_REQUEST datagrams (“pings) have an IP and ICMP header, followed by a “struct timeval and then an arbitrary number of “pad bytes used to fill out the packet.

Protos – http://phenoelit-us.org/irpas/docu.html#protos
Protos is a IP protocol scanner. It goes through all possible IP protocols and uses a negative scan to sort out unsupported protocols which should be reported by the target using ICMP protocol unreachable messages.

ScanLine 1.01 (Windows Executable) – http://www.foundstone.com/us/resources/proddesc/scanline.htm
ScanLine is a command-line port scanner for all Windows platforms. It can perform traditional ICMP “pinging”, optional additional ICMP TimeStamp scanning, can show host response times and number of hops, do TCP scanning, simple UDP scanning, banner grabbing and hostname resolving. Scanning is performed in a fast highly parallel fashion without resorting to using multiple threads. It can handle huge numbers and ranges of IP addresses without a problem.

Scanrand – http://www.secureworks.com/research/articles/scanrand
Scanrand is a fast network scanner that can scan single hosts to very large networks efficiently. However, several network mapping utilites boast this same claim. So why is scanrand any different? Scanrand can do what is called stateless TCP scanning, which sets it apart from the other network scanners.

SinFP – http://sourceforge.net/projects/sinfp/
SinFP is a new approach to OS fingerprinting, which bypasses limitations that nmap has. This approach brings the era of OS fingerprinting on a per-TCP port basis, not on a per-host basis.

Umit – http://umit.sourceforge.net/
Another Nmap frontend

UnicornScan – http://www.unicornscan.org/
Unicornscan is a new information gathering and correlation engine built for and by members of the security research and testing communities. It was designed to provide an engine that is Scalable, Accurate, Flexible, and Efficient.

UnicornScan pgsql 0.4.6e module version 1.03

Automated UnicornScan startup script.

XProbe2 – http://xprobe.sourceforge.net
xprobe2 is an active operating system fingerprinting tool with a different approach to operating system fingerprinting. xprobe2 relies on fuzzy signature matching, probabilistic guesses, multiple matches simultaneously, and a signature database.

PBNJ 2.04 – http://pbnj.sf.net
PBNJ is a suite of tools to monitor changes on a network over time. It does this by checking for changes on the target machine(s), which includes the details about the services running on them as well as the service state. PBNJ parses the data from a scan and stores it in a database. PBNJ uses Nmap to perform scans.

OutputPBNJ –
a program to query a PBNJ 2.0 database
part of PBNJ 2.0 suite of tools to monitor changes on a network.

ScanPBNJ
a program for running Nmap scans and storing the results in a PBNJ 2.0 database

Zenmap 4.60 – http://nmap.org/zenmap/
Zenmap is the official Nmap Security Scanner GUI. It is a multi-platform (Linux, Windows, Mac OS X, BSD, etc.) free and open source application which aims to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scan results can be compared with one another to see how they differ. The results of recent scans are stored in a searchable database.

Vulnerability Identification

Absinthe
Absinthe is a GUI based tool designed to automate the process of blind sql injection. It works by profiling response pages as true or false from known cases, then moves on to identify unknowns as true or false.

Absinthe does not aid in the discovery of SQL Injection holes. This tool will only speed up the process of data recovery.

Features:

* Automated SQL Injection
* Supports MS SQL Server, MSDE, Oracle, Postgres
* Cookies / Additional HTTP Headers
* Query Termination
* Additional text appended to queries
* Supports Use of Proxies / Proxy Rotation
* Multiple filters for page profiling
* Custom Delimiters

Basic Usage: http://www.0x90.org/releases/absinthe/docs/basicusage.php

Downloading the Schema: http://www.0x90.org/releases/absinthe/docs/schema.php

Pulling Records from the Database: http://www.0x90.org/releases/absinthe/docs/datapull.php

BED – http://snake-basket.de/bed.html
Bruteforce Exploit Detector is a collection of scripts to automatically test implementations of different protocols for buffer overflows and / or format string vulnerabilities, by sending a lot of long strings to a server. It tries a kind of bruteforce, an attack without any plan. Some ppl would call it a fuzzer

CIRT Fuzzer – https://www.buslab.org/index.php/content/view/45743/2/
A simple TCP/UDP protocol Fuzzer Version 1.0

Checkpwd – http://www.red-database-security.com/software/checkpwd.html
Checkpwd is a fast dictionary based password checker for Oracle databases. Checkpwd reads the password hashes from the table sys.user$ and compares the hashkeys with the hashkeys calculated from a dictionary file.

Cisco Auditing Tool
Usage:

* -h hostname (for scanning single hosts)
* -f hostfile (for scanning multiple hosts)
* -p port # (default port is 23)
* -w wordlist (wordlist for community name guessing)
* -a passlist (wordlist for password guessing)
* -i [ioshist] (Check for IOS History bug)
* -l logfile (file to log to, default screen)
* -q quiet mode (no screen output)

Cisco Enable Bruteforcer

Cisco internal bruteforcer
Usage: enabler <ip> [-u user] <pass> <passlist> [port]

Cisco Global Exploiter
Cisco Global Exploiter is a script that targets vulnerabilities in the Cisco Internetwork Operating System (IOS) and Catalyst products. Cisco is ugently advising users to upgrade the networks software to close the holes that this script is exploiting. When the script is run against the host it gives menu choices for the user to perform.

Vulnerabilities list :

[1] – Cisco 677/678 Telnet Buffer Overflow Vulnerability

[2] – Cisco IOS Router Denial of Service Vulnerability

[3] – Cisco IOS HTTP Auth Vulnerability

[4] – Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability

[5] – Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability

[6] – Cisco 675 Web Administration Denial of Service Vulnerability

[7] – Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability

[8] – Cisco IOS Software HTTP Request Denial of Service Vulnerability

[9] – Cisco 514 UDP Flood Denial of Service Vulnerability

[10] – CiscoSecure ACS for Windows NT Server Denial of Service Vulnerability

[11] – Cisco Catalyst Memory Leak Vulnerability

[12] – Cisco CatOS CiscoView HTTP Server Buffer Overflow Vulnerability

[13] – 0 Encoding IDS Bypass Vulnerability (UTF)

[14] – Cisco IOS HTTP Denial of Service Vulnerability

Cisco OCS Mass Scanner – http://www.hacklab.tk
Cisco Scanning Tool
usage:

./ocs xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy

xxx.xxx.xxx.xxx = range start IP

yyy.yyy.yyy.yyy = range end IP

Cisco Scanner
Output stored in cisco.txt
Usage: ciscos <ip> <class> [option]
Class A scan: ciscos 127 1
Class B scan: ciscos 127.0 2
Class C scan: ciscos 127.0.0 3
[-C <threads>] maximum threads
[-t <timeout>] seconds before connection timeout

Cisco Torch – http://www.arhont.com/ViewPage7422.html?siteNodeId=3&languageId=1&contentId=-1
Cisco Torch mass scanning, application layer fingerprinting, and exploitation tool to discover and attack remote Cisco hosts running Telnet, SSH, Web, TFTP, NTP and SNMP services. Useful in auditing large networks for misconfigured/un-updated Ciscos.

Curl – http://curl.haxx.se/
curl is a command line tool for transferring files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, FILE and LDAP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos…), file transfer resume, proxy tunneling and a busload of other useful tricks.

Fuzzer 1.2 – http://www.securiteam.com/tools/5TP012AHFU.html
What this tool does: “Fuzzing” is an automated software testing technique that generates and submits random or sequential data to various areas of an application in an attempt to uncover security vulnerabilities. For example, when searching for buffer overflows, a tester can simply generate data of various sizes and send it to one of the application entry points to observe how the application handles it.

GFI LanGuard 2.0 – http://www.gfi.com/lannetscan/
GFI LANguard Network Security Scanner (N.S.S.) checks your network for all potential methods that a hacker might use to attack it. By analyzing the operating system and the applications running on your network, GFI LANguard N.S.S. identifies possible security holes. In other words, it plays the devil’s advocate and alerts you to weaknesses before a hacker can find them, enabling you to deal with these issues before a hacker can exploit them.

GetSids –
Getsids tries to enumerate Oracle Sids by sending the services command to the Oracle TNS listener. Like doing ‘lsnrctl service’.
HTTP PUT

Usage: /pentest/web/put.pl -h <host> -l <file>

-h <host> = host you want to attack
-r <remote> = remote file name
-f <local> = local file name
-p <port> = web server port

Other Options:

-x = ssl mode
-v = verbose

Example:

/pentest/web/put.pl -h target -r /cmdasp.asp -f cmdasp.asp

Halberd – http://halberd.superadditive.com/
Halberd discovers HTTP load balancers. It is useful for web application security auditing and for load balancer configuration testing.

Httprint – http://net-square.com/httprint/
httprint is a web server fingerprinting tool. It relies on web server characteristics to accurately identify web servers. Normally by changing server signatures and banner strings or enabling specific plug-ins, various web fingerprinting tools may be confused and provide false positive results. This is not the case with httprint. httprint can also be used to detect web enabled devices which do not have a server banner string, such as: Wireless AP, Routers, Switches, Cable modems, etc. httprint uses text based signature strings to identify targeted web servers.

Httprint GUI – http://net-square.com/httprint
httprint is a web server fingerprinting tool.

ISR-Form – http://www.infobyte.com.ar/
Gets the form data from a webpage

Jbrofuzz – http://www.owasp.org/index.php/Category:OWASP_JBroFuzz
JBroFuzz is a stateless network protocol fuzzer that emerged from the needs of penetration testing. Written in Java, it allows for the identification of certain classess of security vulnerabilities, by means of creating malformed data and having the network protocol in question consume the data.

List-Urls
List URLS comes in two forms, the original which will parse out urls from a webpage and list them on STDOUT. The Second form is version 2.0. This will parse out urls from a webpage online or a stored page offline. It then gives you the option to resolve hostnames and will output the information in a file or to STDOUT in a grep able format.

Lynx – http://lynx.isc.org/
Lynx is the text web browser.

Merge Router Config
Metacoretex –
MetaCoretex security scanner is an extremely modular plugin based security scanner written entirely in JAVA to allow the use of JDBC Type IV drivers when scanning databases. Initially, most plugins will likely be for DBs.

Metoscan – http://www.securiteam.com/tools/5CP0O20IAK.html
Metoscan is a tiny tool for scanning the HTTP methods supported by a web server. It works testing a URL and checking the responses for the different probes.

Mezcal HTTP/S – http://0x90.org/releases/mezcal/
Mezcal is an HTTP/HTTPS bruteforcing tool allowing the crafting of requests and insertion of dynamic variables on-the-fly.

Mibble MIB Browser – http://www.mibble.org/
Mibble is an open-source SNMP MIB parser (or SMI parser) written in Java. It can be used to read SNMP MIB files as well as simple ASN.1 files.

Mistress
Mistress in an ‘Application Sadism Environment’ and can also be called a fuzzer. It is written in Python and was created for probing file formats on the fly and protocols with malformed data, based on pre-defined patterns. It is recommended that the project site be visited for further documentation and use cases.

Nikto – http://www.cirt.net/code/nikto.shtml
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3300 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

OAT
OAT (Oracle Auditing Tools) – is a set of tools which can be used to audit Oracle databases running on the Microsoft Windows platform. The Tools are Java based and were tested on both Windows and Linux. They should hopefully also run on any other Java platform. http://www.cqure.net/wp/?page_id=2

Onesixtyone – http://www.phreedom.org/solar/onesixtyone/
an efficient SNMP scanner

OpenSSL-Scanner
OpenSSL vulnerability scanner scans for a remote exploit for the KEY_ARG overflow in OpenSSL 0.9.6d and older. Tested against most major Linux distributions. Gives a remote nobody shell on Apache and remote root on other servers. Includes an OpenSSL vulnerability scanner and a detailed vulnerability analysis. Only Linux/x86 targets are supported.
Exploit Details (CVE-2002-0656): http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0656
OpenSSL Exploit Homepage: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0656

Paros Proxy – http://www.parosproxy.org/
Web Proxy, written in Java. Supports http and https

Peach – http://peachfuzz.sourceforge.net/
Peach is a cross-platform fuzzing framework written in Python. Peaches main goals include: short development time, code reuse, ease of use, and flexability. Peach can fuzz just about anything from .NET, COM/ActiveX, SQL, shared libraries/DLL’s, network applications, web, you name it.
Peach Tutorial: http://peachfuzz.sourceforge.net/docs/tutorial/peach-tutorial.htm

RPCDump – http://www.cultdeadcow.com/tools/rpcdump.php
RPCDUMP is a program which provides console access to the RPC APIs in Windows.

RevHosts – http://www.revhosts.net/
Tool written in Python that is design to accelerate PIG (Passive information gathering).

We have several modules for that.

* vhh : We use search engine that return host that are on an IP (Virtual Host hacking)
* Findsubdomains : module that returns subdomains of a domains.
* Dnsbruteforce : dnsbruteforce is now a module of revhosts. It use multithread (1 thread for each dns server) and made dns resolution of hostnames of a domain.
* Getdirectories : look on search engine for directories that are on a host (no connection to the host).
* subnet : look for IP that have the same tech contact.
* getmail : module that search on internet for mail adress

SMB Bruteforcer
A SMB bruteforcer which tries approx. 1200 logins/sec on Windows 2000 because of the timeout bug. On NT4 it’s very much slower making a couple logins a sec.

SMB Client
A LanManager-like simple client for Unix The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or NetBIOS protocol.

SMB Serverscan
Scans for machines running Samba servers.

SMB-NAT
Netbios Auditing Tool This tool can perform various security checks on remote servers running NetBIOS file sharing services. It is capable of enumerating shares and make break-in attempts using a (user-provided) list of users and passwords.

SMBdumpusers
SMBgetserverinfo

usage:

smbgetserverinfo -i [options]
-i* IP address
-s Name of the server
-t timeout for connect (default 300ms)
-v Be verbose
-vv Be even more verbose

Output example(smbgetserverinfo -i 192.168.0.100):

Server Info for 192.168.0.100
—————————–
Server Name : BOB
Server OS : Unix
Workgroup/Domain : WORKGROUP

SNMP Scanner

SNMP Walk – http://www.net-snmp.org/docs/man/snmpwalk.html
snmpwalk is an SNMP application that uses SNMP GETNEXT requests to query a network entity for a tree of information.

SQL Inject
SQL Scanner
SQLLibf

SQLbrute – http://www.justinclarke.com/archives/2006/03/sqlbrute.html
SQLBrute is a tool for brute forcing data out of databases using blind SQL injection vulnerabilities. It supports time based and error based exploit types on Microsoft SQL Server, and error based exploit on Oracle.

Sidguess – http://www.red-database-security.com/whitepaper/oracle_guess_sid.html
Sidguess is a brute force tool to guess Oracle SIDs. This tool can be used to get the SID of an Oracle 10g database which is no longer available with the listener status command.

Smb4K – http://smb4k.berlios.de/
Smb4K is a SMB/CIFS share browser for KDE. It uses the Samba software suite to access the SMB/CIFS shares of the local network neighborhood.

Snmpcheck – http://www.nothink.org/perl/snmpcheck/
snmpcheck is a free open source utility to get information via SNMP protocols. It works fine against Windows, Linux, Cisco, HP-UX, SunOS systems and any devices with SNMP protocol support. It could be useful for penetration testing or systems monitoring. snmpcheck has been tested on GNU/Linux, *BSD and Windows (Cygwin) systems.

Snmp Enum – http://www.filip.waeytens.easynet.be/
Simple Perl script to enumerate information on machines that are running SNMP.

Spike – http://www.immunitysec.com/resources-freesoftware.shtml
When you need to analyze a new network protocol for buffer overflows or similar weaknesses, the SPIKE is the tool of choice for professionals. While it requires a strong knowledge of C to use, it produces results second to none in the field. SPIKE is available for the Linux platform only.

SPIKE Whitepapers: http://www.immunitysec.com/resources-papers.shtml

Stompy
A free tool to perform a fairly detailed black-box assessment of WWW session identifier generation algorithms. Session IDs are commonly used to track authenticated users, and as such, whenever they’re predictable or simply vulnerable to brute-force attacks, we do have a problem.

The tool has already revealed several problems in proprietary software platforms such as BEA WebLogic and Sun Java System Web Server (both have problems with their JSESSIONIDs).

SuperScan – http://www.foundstone.com/us/resources/proddesc/superscan.htm
Powerful TCP port scanner, pinger, resolver. SuperScan is a powerful connect-based TCP port scanner, pinger and hostname resolver. Multithreaded and asynchronous techniques make this program extremely fast and versatile.

TNScmd – http://sourceforge.net/projects/taof
tnscmd can be used to speak, on a very simple level, with Oracle’s TNS listener. The TNS listener (aka tnslsnr) is the network interface between a database client and the database server. tnslsnr listens on port 1521/tcp, but the DBA can change this (I’ve seen listeners on port 1541/tcp as well.) fwiw, nmap-services lists these as ncube-lm and rds2, respectively.

The tnslnsr keeps a spartan log of activity — spartan in that it doesn’t log a whole lot of useful information. For instance, it does not log the IP address of TNS sessions.

If you initiate a TCP session to the tnslsnr port, you won’t make much headway; it won’t provide a banner and will probably disconnect if you type something. Don’t worry; this is what tnscmd is for.
Taof

Taof is a GUI cross-platform Python generic network protocol fuzzer. It has been designed for minimizing set-up time during fuzzing sessions and it is especially useful for fast testing of proprietary or undocumented protocols.

VNC_bypauth
RealVNC 4.1.1 Bypass Authentication Scanner multi-threaded for Linux and Windows

[+] Usage: VNC_bypauth <target> <scantype>

[-] <target>:

___________________
|___-p____|___-i____|

[-] <scantype>:

____________________
|___-cT___|___-vnc___|

[-] :

________________________________________________________
|___-v____|___-vv____|___-T___|__-tc___|__-tr___|__-tt___|

[+] Type VNC_bypauth <target>,<scantype> or for more informations [+] To increase the speed under linux, try ulimit -s unlimited

Wapiti – http://wapiti.sourceforge.net/
Wapiti allows you to audit the security of your web applications. It performs “black-box” scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets this list, Wapiti acts like a fuzzer, injecting payloads to see if a script is vulnerable.

Yersinia – http://www.yersinia.net/
Yersinia is a network tool designed to take advantage of some weakeness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.

sqlanlz – http://www.vulnerabilityassessment.co.uk/sqlat.htm
Enumerates information about databases, users, extended stored procedures etc. outputting into an HTML report.

sqldict – http://www.vulnerabilityassessment.co.uk/sqlat.htm
Carries out a dictionary based attack on the user(s) specified.

sqldumplogins – http://www.vulnerabilityassessment.co.uk/sqlat.htm
Dump all user accounts from the MS SQL Server.

sqlquery – http://www.vulnerabilityassessment.co.uk/sqlat.htm
Interactive query tool.

sqlupload – http://www.vulnerabilityassessment.co.uk/sqlat.htm
Attempts to upload files to a MS SQL Server.

Penetration
Framework3-MsfC – http://en.wikibooks.org/wiki/Metasploit/Contents
The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code.

Framework3-MsfUpdate
Uses SVN to update Metasploit code and exploits.

Framework3-Msfcli
Command line interface for MetaSploit.

Framework3-Msfweb
Init Pgsql (autopwn)

Milw0rm Archive – http://www.milw0rm.com/
Milw0rm is a site for obtaining Proof of concept exploit code.

MsfCli
Command line interface for MetaSploit.

MsfConsole
The msfconsole interactive command-line interface provides a command set that allows the user to manipulate the framework environment, set exploit options, and ultimately deploy the exploit. Unrecognized commands are passed to the underlying operating system; in this way, a user can run reconnaissance tools without having to leave the console.
MsfUpdate

Uses SVN to update Metasploit code and exploits.

OpenSSL-To-Open
openssl-too-open is a remote exploit for the KEY_ARG overflow in OpenSSL 0.9.6d and older. Tested against most major Linux distributions. Gives a remote nobody shell on Apache and remote root on other servers. Includes an OpenSSL vulnerability scanner and a detailed vulnerability analysis. Only Linux/x86 targets are supported.

Pirana – http://www.guay-leroux.com/projects/SMTP%20content%20filters.pdf
PIRANA is a penetration testing framework to help in checking a SMTP content filter’s security. It works by attaching an exploit to an email, optionally disguising it from content filters. PIRANA also lets you choose from different type of shellcodes to use and has various options to be stealthy.

Notes: The manual page incorrectly shows an EXAMPLES entry using the -l (ell) option as a -1 (one). The -l (ell) option is correct. You’ll need to specify a fully qualified email address (user@example.com) instead of just the user name. Run make in the /pentest/fuzzers/pirana directory before using PIRANA.

“I wrote a paper that explains what are the vulnerabilities of a SMTP content filter. It also presents what techniques were used in PIRANA to improve reliability and stealthness.” Jean-Sébastien Guay-Leroux, Author of Pirana tool

Update Milw0rm

Downloads the latest archive of exploits from http://www.milw0rm.com.

Privilege Escalation

Ascend attacker

CDP Spoofer

Cisco Enable Bruteforcer

Crunch Dictgen

DHCPX Flooder

DNSspoof

Driftnet – http://www.ex-parrot.com/~chris/driftnet/
Driftnet is a program which listens to network traffic and picks out images from TCP streams it observes.

Dsniff – http://monkey.org/~dugsong/dsniff/
dsniff is a collection of tools for network auditing and penetration testing. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI.

Etherape – http://etherape.sourceforge.net/
EtherApe is a graphical network monitor for Unix modeled after etherman. Featuring link layer, ip and TCP modes, it displays network activity graphically. Hosts and links change in size with traffic. Color coded protocols display. It supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices. It can filter traffic to be shown, and can read traffic from a file as well as live from the network.

EtterCap – http://ettercap.sourceforge.net/
Ettercap was born as a sniffer for switched LAN (and obviously even “hubbed” ones), but during the development process it has gained more and more features that have changed it to a powerful and flexible tool for man-in-the-middle attacks. It supports active and passive dissection of many protocols (even ciphered ones) and includes many features for network and host analysis (such as OS fingerprinting).

File2Cable – http://phenoelit-us.org/irpas/docu.html#file2cable
This tool is perfect to find new vulnerabilities and test concepts. It sends out any binary file as Ethernet frame – AS IT IS. So make sure you know what you do. Hint: use xxd from the vim package to produce the binary file from hex dumps.

HSRP Spoofer

Hash Collision

Httpcapture

Hydra – http://www.thc.org
Hydra is a software project developed by “The Hacker’s Choice” (THC) that uses a dictionary attack to test for weak or simple passwords on one or many remote hosts running a variety of different services. It was designed as a proof-of-concept utility to demonstrate the ease of cracking poorly chosen passwords.

Hydra GTK – http://www.thc.org
Hydra GTK is a gui front end to Hydra. Which is a online tool to guess/crack valid login/password pairs.

ICMP Redirect

ICMPush

IGRP Spoofer

IRDP Responder – http://phenoelit-us.org/irpas/docu.html#irdpresponder
Sniffer, which listens to IRDP requests (solicitation) and answers. Sends out periodic updates.

IRDP Spoofer

John – http://www.openwall.com/john/
John the Ripper is used for offline password attacks.

Lodowep – http://www.cqure.net/wp/?page_id=17
Lodowep is a tool for analyzing password strength of accounts on a Lotus Domino webserver system. The tool supports both session- and basic-authentication. It runs 20 simultaneous connection guessing passwords specified in a dictionaryfile against the supplied userfile.

Mailsnarf
Mailsnarf Passively monitor a network for interesting data being sent across a network/interface. [ E-Mails Only ]

Medusa – http://www.darknet.org.uk/2006/05/medusa-password-cracker-version-11-now-available-for-download/
Medusa is a speedy, massively parallel, modular, login brute-forcer for network services, created by the geeks at Foofus.net. It currently has modules for the following services: CVS, FTP, HTTP, IMAP, MS-SQL, MySQL, NCP (NetWare), PcAnywhere, POP3, PostgreSQL, rexec, rlogin, rsh, SMB, SMTP (VRFY), SNMP, SSHv2, SVN, Telnet, VmAuthd, VNC, and a generic wrapper module.

Msgsnarf
Passively monitors a network for interesting data being sent across the network. Msgsnarf shall capture messages on a network/interface.

Nemesis Spoofer
Nemesis is a packet-crafting program that can forge raw packets up from the Ethernet layer up and put them on the wire. It’s handy for when you just want to sit down and specify exactly what packets you want to craft. It supports crafting ARP, DNS, Ethernet, ICP, IGMP, IP, RIP, TCP, and UDP packets. Similar in concept to the “hping” program.

NetSed

Netenum

Netmask

Ntop – http://www.ntop.org/
ntop is a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntop is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform and on Win32 as well. ntop users can use a a web browser (e.g. netscape) to navigate through ntop (that acts as a web server) traffic information and get a dump of the network status. In the latter case, ntop can be seen as a simple RMON-like agent with an embedded web interface.

PHoss – http://phenoelit-us.org/phoss/docu.html
PHoss is a sniffer designed to find HTTP, FTP, LDAP, Telnet, IMAP4 and POP3 logins/passwords on your network. It also sniffs the VNC challenge/response handshake.

PackETH – http://packeth.sourceforge.net/
packETH is a Linux GUI packet generator tool for ethernet. It allows you to create and send any possible packet or sequence of packets on the ethernet.

Rcrack – http://www.antsight.com/zsl/rainbowcrack/
RainbowCrack tool is a hash cracker.

SIPdump – http://www.remote-exploit.org/codes_sipcrack.html
SIPcrack is a SIP login sniffer/cracker that contains 2 programs: sipdump to capture the digest authentication and sipcrack to bruteforce the hash using a wordlist or standard input.

SMB Sniffer

Sing
Description: A fully programmable ping replacement

Sing is a little tool that sends ICMP packets fully customized from command
line. The main purpose is to replace/complement the nice ping command
with certain enhancements as:
– Send fragmented packets (Linux and BSD).
– Send monster packets > 65534 (Linux and BSD).
– Send/read spoofed packets.(Libpcap included in distribution).
– Send many ICMP Information types in addition to the ECHO REQUEST type
sent by default as Address Mask Request, Timestamp, Information Request,
– Router Solicitation and Router Advertisement.
– Send many ICMP error types: Redirect, Source Quench, Time Exceeded,
Destination Unreach and Parameter Problem.
– Send to host with Loose or Strict Source Routing.
– Use little fingerprinting techniques to discover Windows or Solaris
boxes.
– Send ICMP packets emulating certain OS: Cisco, Solaris, Linux, Shiva,
Unix and Windows at the moment.

TFTP-Brute

THC PPTP

TcPick – http://tcpick.sourceforge.net/
tcpick is a textmode sniffer libpcap-based that can track, reassemble and reorder tcp streams. Tcpick is able to save the captured flows in different files or displays them in the terminal, and so it is useful to sniff files that are transmitted via ftp or http. It can display all the stream on the terminal, when the connection is closed in different display modes like hexdump, hexdump + ascii, only printable charachters, raw mode and so on.

URLsnarf

VNCrack – http://phenoelit-us.org/vncrack/docu.html
Brute force the hell out of a server. Additional, you may pass a Registry key with the encrypted password or the UNIX password file to VNCrack and it does this simple fixed key decryption for you.

WebCrack

Wireshark – http://wireshark.org/
Wireshark is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. Wireshark’s native capture file format is libpcap format, which is also the format used by tcp- dump and various other tools.

* Due to trademark issues the Ethereal software project has changed its name to Wireshark!

Wireshark Wifi

Wireshark with Wifi Injection Patch allows the user to select a packet opened with wireshark and edit it and reinject throught LORCON injection library.

WyD – http://www.remote-exploit.org/codes_wyd.html
wyd is a password profiling tool that extracts words/strings from supplied files and directories. It supports different filetypes: plain, html, php (partially), doc, ppt, mp3, pdf, jpeg, odp/ods/odp and extracting raw strings.

XSpy – http://www.acm.vt.edu/~jmaxwell/programs/xspy/xspy.html
Xspy takes advantage of an oversight in X Windows (R5 & R6) to find out about keypresses even in “secure mode”. It works by polling the keyboard, by default every hundredth of a second. Polling the keyboard is not affected by any secure modes, which “grab” the keyboard to shut off events being sent out.

chntpw –
Chntpw is my memory works good is a Windows NT 2K XP user pasword tool for delete passwords and restrictions from SAM database on installed system theirs not crack like brute force passwords just only delete passwords and restrictions for Administrators and simple user in SAM database .

To erase password use a script that a make almost for you like search ntfs drivers from your XP to mount your partition with your drivers if doesn’t find ask you to download all needed data from internet .

Note: Deleting the password will enable you to login to the system without a password, but it will not give you access to any encrypted data on the system. All it lets you do is log in.

http://pwet.fr/man/linux/administration_systeme/chntpw
http://home.eunet.no/~pnordahl/ntpasswd/

Maintaining Access

3proxy

Backdoors

Matahari – http://matahari.sourceforge.net
Python script to maintain a basic shell remotely on systems behind firewalls. Client gets commands by periodically polling the server and sends the output back after executing them. Traffic traverses firewall as standard outgoing HTTP GET/POST requests. HTTP requests/responses carry payload b64 encoded. Optional encryption is supported (and highly recommended)

CryptCat – http://cryptcat.sourceforge.net/
Cryptcat is the standard netcat enhanced with twofish encryption with ports for WIndows NT, BSD and Linux. Twofish is courtesy of counterpane, and cryptix.

HttpTunnel Client

HttpTunnel Server

ICMPTX – http://thomer.com/icmptx/

Iodine – http://code.kryo.se/iodine/
This is a piece of software that lets you tunnel IPv4 data through a DNS server. This can be usable in different situations where internet access is firewalled, but DNS queries are allowed.

NSTX – http://savannah.nongnu.org/projects/nstx/
Nstx is a tunneling tool that allows IP over DNS

Privoxy – http://www.privoxy.org/
Privoxy is a web proxy with advanced filtering capabilities for protecting privacy, modifying web page data, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a very flexible configuration and can be customized to suit individual needs and tastes. Privoxy has application for both stand-alone systems and multi-user networks.

ProxyTunnel – http://proxytunnel.sourceforge.net/
ProxyTunnel is a program that connects stdin and stdout to a server somewhere on the network, through a standard HTTPS proxy. We mostly use it to tunnel SSH sessions through HTTP(S) proxies, allowing us to do many things that wouldn’t be possible without ProxyTunnel.

Rinetd

TinyProxy – http://tinyproxy.sourceforge.net/
tinyproxy is a lightweight HTTP proxy. Designed from the ground up to be fast and yet small, it is an ideal solution for sites where a full-featured HTTP proxy is required, but the system resources required to run a more demanding HTTP proxy are unavailable.

sbd – http://tigerteam.se/dl/sbd/ [down]
sbd is a Netcat-clone, designed to be portable and offer strong encryption. It runs on Unix-like operating systems and on Microsoft Win32. sbd features AES-CBC-128 + HMAC-SHA1 encryption (by Christophe Devine), program execution (-e option), choosing source port, continuous reconnection with delay, and some other nice features. Only TCP/IP communication is supported.

socat – http://www.dest-unreach.org/socat/
socat is a relay for bidirectional data transfer between two independent data channels. Each of these data channels may be a file, pipe, device (serial line etc. or a pseudo terminal), a socket (UNIX, IP4, IP6 – raw, UDP, TCP), an SSL socket, proxy CONNECT connection, a file descriptor (stdin etc.), the GNU line editor (readline), a program, or a combination of two of these. These modes include generation of “listening” sockets, named pipes, and pseudo terminals.

Covering Tracks

Housekeeping
Radio Network Analysis
802.11 WIFI
AFrag – http://homepages.tu-darmstadt.de/~p_larbig/wlan/
First implementation of the Fragmentation Attack on Linux.

ASLeap – http://asleap.sourceforge.net/
This tool is released as a proof-of-concept to demonstrate weaknesses in the LEAP and PPTP protocols.

aircrack-ng – http://www.aircrack-ng.org/
Aircrack is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, thus making the attack much faster compared to other WEP cracking tools. In fact, aircrack is a set of tools for auditing wireless networks.

airdecap-ng – http://www.aircrack-ng.org/doku.php?id=airdecap-ng
decrypts WEP/WPA capture files. Part of the aircrack suite.

aireplay-ng – http://www.aircrack-ng.org/doku.php?id=aireplay-ng
802.11 packet injection program. Part of the aircrack suite.

airmon-ng – http://www.aircrack-ng.org/doku.php?id=airmon-ng
a utility to check an wifi interfaces status and placing the interface into monitor mode. Part of the aircrack suite.

Airpwn – http://airpwn.sourceforge.net/
Airpwn requires two 802.11 interfaces in the case where driver can’t inject in monitor mode (lots of chipsets do nowadays, see HCL:Wireless for a list). It uses a config file with multiple config sections to respond to specific data packets with arbitrary content. For example, in the HTML goatse example, we look for any TCP data packets starting with “GET” or “POST” and respond with a valid server response including a reference to the canonical goatse image.

* Note : Needs to be reinstalled to work properly here.

AirSnarf – http://airsnarf.shmoo.com/
Airsnarf is a simple rogue wireless access point setup utility designed to demonstrate how a rogue AP can steal usernames and passwords from public wireless hotspots. Airsnarf was developed and released to demonstrate an inherent vulnerability of public 802.11b hotspots–snarfing usernames and passwords by confusing users with DNS and HTTP redirects from a competing AP.

airbase-ng – http://www.aircrack-ng.org/doku.php?id=airbase-ng
Airbase is a SoftAP acting much like karma it will respond to any request probe allowing may client side attacks to be preformed. This works by using monitor mode and injection allowing a simulated master mode.

airodump-ng – http://www.aircrack-ng.org/doku.php?id=airodump-ng
802.11 packet capture program. Part of the aircrack suite.

Airoscript –
aircrack-ng based wireless cracking script.
must mkdir /home/root to function out of the box.

Airsnort – http://airsnort.shmoo.com/
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

CowPatty – http://www.churchofwifi.org/default.asp?PageLink=Project_Display.asp?PID=95
Cowpatty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol. A while back, Robert Moskowitz published a paper titled “Weakness in Passphrase Choice in WPA Interface” that described a dictionary attack against wireless networks using the TKIP protocol with a pre-shared key (PSK). Supply a libpcap file that includes the TKIP four-way handshake, a dictionary file of passphrases to guess with and the SSID for the network:

additional info (v4.2): http://www.renderlab.net/projects/WPA-tables/
old http://sourceforge.net/projects/cowpatty

FakeAP – http://www.blackalchemy.to/project/fakeap/
Black Alchemy’s Fake AP generates thousands of counterfeit 802.11b access points. Hide in plain sight amongst Fake AP’s cacophony of beacon frames. As part of a honeypot or as an instrument of your site security plan, Fake AP confuses Wardrivers, NetStumblers, Script Kiddies, and other undesirables.

perl fakeap.pl --interface wlan0 --words lists/stefan-wordlist.txt --vendors lists/stefan-maclist.txt

Hotspotter – http://www.remote-exploit.org/codes_hotspotter.html
Hotspotter passively monitors the network for probe request frames to identify the preferred networks of Windows XP clients, and will compare it to a supplied list of common hotspot network names. If the probed network name matches a common hotspot name, Hotspotter will act as an access point to allow the client to authenticate and associate. Once associated, Hotspotter can be configured to run a command, possibly a script to kick off a DHCP daemon and other scanning against the new victim.

Karma – http://theta44.org/karma/index.html http://www.offensive-security.com/madwifi-r3406-hdm-032608.tar.gz
KARMA is a set of tools for assessing the security of wireless clients at multiple layers. Wireless sniffing tools discover clients and their preferred/trusted networks by passively listening for 802.11 Probe Request frames. From there, individual clients can be targetted by creating a Rogue AP for one of their probed networks (which they may join automatically) or using a custom driver that responds to probes and association requests for any SSID. Higher-level fake services can then capture credentials or exploit client-side vulnerabilities on the host.

Kismet – http://www.kismetwireless.net/
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic. Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.

./configure –disable-setuid
make dep && make && make install

MDK3 – http://homepages.tu-darmstadt.de/~p_larbig/wlan/

MacChanger – http://alobbs.com/macchanger/
A GNU/Linux utility for viewing/manipulating the MAC address of network interfaces

WifiTap – http://sid.rstack.org/index.php/Wifitap_EN
Wifitap is a proof of concept for communication over WLAN networks using traffic injection. Wifitap allows direct communication with an associated station to a given access point directly, whilst not being being associated ourselves or being handled by access point.

Wicrawl – http://midnightresearch.com/projects/wicrawl
wicrawl is an automated wifi scanner and auditor. It implements common tools to perform checks (association, dhcp, wep cracking, bruteforcing wpa-psk, etc) against the discovered access point list based on profile settings. It can use multiple cards to run checks against multiple APs at the same time.

WifiZoo
Wifizoo is a proof of concept wireless sidejacker. It works on the idea that most companies force you to log in authenticated how ever pass your authentication cookie back unencrypted. Wifizoo allows you to then use that cookie and proxy in as the user.

Wlassistant
Wireless Assistant scans for wireless access points and displays link quality, encryption and other useful information. When user wants to connect to a network, Wireless Assistant opens up its wizards and guides the user through Wi-Fi settings. After a successful connection is made the settings are remembered so next time the user won’t have to enter them again.

SpoonDRV
SpoonDRV is a java based wireless driver manager. Offering a gui it easily allows the users to load or unload drivers quick and easily.

SpoonWEP
SpoonWep is a java based wireless wep cracker with gui. It is designed to be very easy to use and work on top of the aircrack suite of tools.

Bluetooth
BTcrack – http://www.nruns.com/_en/security_tools_btcrack.php
BTCrack is the worlds first Bluetooth Pass phrase (PIN) bruteforce tool, BTCrack will bruteforce the Passkey and the Link key from captured Pairing* exchanges.

Bluebugger – http://www.remote-exploit.org/codes_bluebugger.html
bluebugger is an implementation of the bluebug technique which was discovered by Martin Herfurt from the Trifinite Group. It was tested with Nokia 6310i, Nokia N72 and Sony Ericsson T68i.

Blueprint – http://trifinite.org/trifinite_stuff_blueprinting.html
Blueprinting is a method to remotely find out details about bluetooth-enabled devices. Blueprinting can be used for generating statistics about manufacturers and models and to find out whether there are devices in range that have issues with Bluetooth security.

Bluesmash – http://sourceforge.net/projects/bluesmash/
Blue|Smash is a python based tool for pentesting bluetooth enabled devices. Blue|Smash version 1.* is mainly based on bluetooth enabled phones and was build for the backtrack live CD but version 2.0

Bluesnarfer – http://www.alighieri.org/project.html
Bluesnarfer will download the phonebook of any mobile device vulnerable to bluesnarfing.

Btscanner – http://www.pentest.co.uk/
btscanner is a tool designed specifically to extract as much information as possible from a Bluetooth device without the requirement to pair.

Carwhisperer – http://trifinite.org/trifinite_stuff_carwhisperer.html
The carwhisperer project intends to bring sensibility manufacturers of carkits and other Bluetooth appliances without display and keyboard for the possible security threat evolving from the use of standard passkeys.

Frontline

Minicom
Minicom is a text based terminal emulator useful in many situations. http://alioth.debian.org/projects/minicom/

ObexFTP
The ObexFTP application enables you to store and retrieve documents to your mobile phones memory – that way you can access your phonebook, logo, ringtone, mp3, picture and general storage directly now. http://triq.net/obexftp.html

HCIDump – http://www.linuxcommand.org/man_pages/hcidump8.html
Hcidump reads raw HCI data coming from and going to a Bluetooth device and prints to screen commands, events and data in a human-readable form. Optionally, the dump can be written to a file rather than parsed, and the dump file can be parsed in a subsequent moment.

Redfang – http://www.net-security.org/software.php?id=519
RedFang is a small proof-of-concept application to find non discoverable Bluetooth devices. This is done by brute forcing the last six (6) bytes of the Bluetooth address of the device and doing a read_remote_name().

Ussp-Push – http://www.xmailserver.org/ussp-push.html
ussp-push is a OBEX object pusher for Linux, using the BlueZ BlueTooth stack. The original ussp-push implementation required explicit binding to RFCOMM channels before the usage, that made it quite cumbersome to use. Now it has BlueTooth name resolution, SDP service resolution, and direct access to remote BlueTooth listening channels.

atshell

attest

bdaddr
Utility for changing the Bluetooth device address

BSS
BSS (Bluetooth Stack Smasher) is a L2CAP layer Fuzzer for Linux, distributed under GPL licence. BSS requires the standard bluetooth library.

BTFTP 
BTFTP transfer files over Bluetooth connection. FTP uses a client-server connection. To use FTP over Bluetooth run btsrv (see instruction below) in server host and btftp in client host.

hcidump-crash
A tool for looking into HCIdumps after a crash

hidattack
Bluetooth keyboards and mice take a large percentage of sold Bluetooth devices, most of the high quality wireless desktops now use Bluetooth. All the keyboards, mice, joysticks and drawing tablets use the HID protocol (HID = Human Interface Device). HID is independent from Bluetooth and is also used for USB devices, of course it was used for USB long before Bluetooth even existed. The Bluetooth SIG just specified a small wrapper protocol to transport HID over Bluetooth.

hstest
HSTEST allows you to recorded and playback items over your bluetooth headset

rfcomm
Connect to a remote bluetooth device on an RFCOMM channel,read data from it and send data to it like using telnet to connect to a TCP port.
VOIP & Telephony Analysis

PcapSipDump – http://sourceforge.net/projects/psipdump
Pcapsipdump is a tool for dumping (recording) SIP sessions (and RTP traffic, if available) to disk in a fashion similar to “tcpdump -w” (the format is exactly the same). The difference is that the data is saved with one file per SIP session. Even if there are thousands of concurrect SIP sessions, each goes to separate file.

PcapToSip_RTP – http://wiki.cdyne.com/wiki/index.php?title=PCAP_To_SIP_and_RTP
This program with full C# source code allows you to dump the calls captured from Tetheral, Ethereal, Wireshark, and TCPDUMP. You will have the sound files to play Incoming, Outgoing, and Combined audio.

SIPSak – http://sipsak.org
Sipsak is a small command line tool for developers and administrators of Session Initiation Protocol (SIP) applications. It can be used for some simple tests on SIP applications and devices.

SIPcrack – http://www.remote-exploit.org/codes_sipcrack.html
SIPcrack is a SIP login sniffer/cracker that contains 2 programs: sipdump to capture the digest authentication and sipcrack to bruteforce the hash using a wordlist or standard input.

SIPdump – http://www.remote-exploit.org/codes_sipcrack.html
SIPcrack is a SIP login sniffer/cracker that contains 2 programs: sipdump to capture the digest authentication and sipcrack to bruteforce the hash using a wordlist or standard input.

SIPp – http://freshmeat.net/redir/sipp/49242/url_homepage/sipp.sourceforge.net
Sipp is a performance testing tool for the SIP protocol. It includes a few basic SipStone user agent scenarios (UAC & UAS) and establishes and releases multiple calls with the INVITE and BYE methods. It also reads XML scenario files describing any performance testing configuration. It features the dynamic display of statistics about running tests, periodic CSV statistics dumps, TCP, UDP, or TLS over IPv4 or IPv6 over multiple sockets or multiplexed with retransmission management, regular expressions and variables in scenario files, conditional branching, and dynamically-adjustable call rates. RTP play (voice, video, and RFC2833 DTMFs) is also supported.

Smap – http://www.wormulon.net/smap/
smap is a mashup of nmap and sipsak. To sum up functionality in one sentence it aides in both locating and fingerprinting remote SIP devices.

Digital Forensics
Allin1 – http://www.netmon.ch/forensic/allin1.html
This tool should help you to make several time consuming tasks in Sleuthkit/autopsy in one row:

  • Extract unallocted space
  • Extract strings (ASCII and Unicode) from allocated and unallocated
  • Sort by file types
  • Sort by images and create thumbnails
  • Make foremost run on images
  • Scheduling

All this steps are also saved in the host.aut-file so Autopsy will know about what happened.

Autopsy – http://www.sleuthkit.org/autopsy/index.php
The Autopsy Forensic Browser is a graphical interface to the command line digital investigation tools in The Sleuth Kit. Together, they allow you to investigate the file system and volumes of a computer.

DCFLDD – http://dcfldd.sourceforge.net/
dcfldd is an enhanced version of GNU dd with features useful for forensics and security.

DD_Rescue – http://freshmeat.net/projects/ddrescue/
dd_rescue copies data from one file or block device to another. It is intended for error recovery, so, by default, it doesn’t abort on errors, and doesn’t truncate the output file. It uses large block sizes to quicken the copying, but falls back to small blocks upon encountering errors. It produces reports that allow you to keep track of bad blocks.

Foremost – http://foremost.sourceforge.net/
Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.

Magicrescue – http://jbj.rapanden.dk/magicrescue/
Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them. It looks at “magic bytes” in file contents, so it can be used both as an undelete utility and for recovering a corrupted drive or partition. As long as the file data is there, it will find it.

It works on any file system, but on very fragmented file systems it can only recover the first chunk of each file. Practical experience (this program was not written for fun) shows, however, that chunks of 30-50MB are not uncommon.

Mboxgrep – http://www.mboxgrep.org/
mboxgrep is a small utility that scans a mailbox for messages matching a regular expression. Found messages can be either displayed on standard output, counted, deleted, piped to a shell command or written to another mailbox.

Memfetch – http://lcamtuf.coredump.cx/
Memfetch is a yet another small but useful security tool that allows instant and non-intrusive dumping of ALL process memory, including the information absent from core files. This is a neat way to see what, exactly, is running at a particular PID.

Memfetch Find
Custom perl script that can be used to find strings (regular expression matches) in memfetch dump files in a more useful way then grep could – that is, finding exact memory locations.

Pasco
Index.dat (Internet Explorer history file) reader. Output is comma delimited for analysis in favorite spreadsheet.

Rootkithunter – http://directory.fsf.org/RootkitHunter.html
Rootkit Hunter scans files and systems for known and unknown rootkits, backdoors, and sniffers. The package contains one shell script, a few text-based databases, and optional Perl modules.

Sleuthkit – http://www.sleuthkit.org/sleuthkit/
The Sleuth Kit (TSK) is a collection of UNIX-based command line tools that allow you to investigate a computer. The current focus of the tools is the file and volume systems and TSK supports FAT, Ext2/3, NTFS, UFS, and ISO 9660 file systems.

Vinetto
Vinetto is a forensics tool to examine Thumbs.db files

Reverse Engineering
GDB GNU Debugger – http://sourceware.org/gdb/documentation/
GDB, the GNU Project debugger, allows you to see what is going on `inside’ another program while it executes — or what another program was doing at the moment it crashed. The program being debugged can be written in Ada, C, C++, Objective-C, Pascal (and many other languages). Those programs might be executing on the same machine as GDB (native) or on another machine (remote). GDB can run on most popular UNIX and Microsoft Windows variants.

GDB can do four main kinds of things (plus other things in support of these) to help you catch bugs in the act:

  1. Start your program, specifying anything that might affect its behavior.
  2. Make your program stop on specified conditions.
  3. Examine what has happened, when your program has stopped.
  4. Change things in your program, so you can experiment with correcting the effects of one bug and go on to learn about another.

GDB User Manual: http://sourceware.org/gdb/current/onlinedocs/gdb_toc.html
GDB Internals Manual: http://sourceware.org/gdb/current/onlinedocs/gdbint_toc.html

GDB Console GUI
Same as GDB GNU Debugger with a GUI frontend.

GDB Server – http://sourceware.org/gdb/current/onlinedocs/gdb_18.html#SEC162
gdbserver is a control program for Unix-like systems, which allows you to connect your program with a remote GDB via target remote—but without linking in the usual debugging stub.

GNU DDD – http://www.gnu.org/manual/ddd/
GNU DDD is a graphical front-end for command-line debuggers such as GDB, DBX, WDB, Ladebug, JDB, XDB, the Perl debugger, the bash debugger, or the Python debugger. Besides “usual front-end features such as viewing source texts, DDD has become famous through its interactive graphical data display, where data structures are displayed as graphs.

Hexdump – http://miller.emu.id.au/pmiller/software/hexdump/
Hexdmup is a simple program for dumping binary files in hexadecimal format. It provides both hexadecimal and ascii columns.

Hexedit
View and edit files in hexadecimal or in ASCII. The file can be a device as the file is read a piece at a time. You can modify the file and search through it.

OllyDBG – http://www.ollydbg.de
OllyDbg is a 32-bit assembler level analysing debugger for Microsoft® Windows®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.

Services
SNORT – http://www.snort.org
SNORT is an Open Source Intrusion Detection System.