WebPwn3r - WebApps Security Scanner

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXPNs4OGI9zbxQ6YUu41YsPeJtZzK6aGxcteoiqTGiRGbEzWI55tC0bK2YQYl9cAlQaCaEjMbvTEy7j3RiZ8DCq1palOiD1stg8Xmn5DyOLrQ-Zg2Ro6TJ38IQ6fuLvs1mGNxpdp3f40k/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="171" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXPNs4OGI9zbxQ6YUu41YsPeJtZzK6aGxcteoiqTGiRGbEzWI55tC0bK2YQYl9cAlQaCaEjMbvTEy7j3RiZ8DCq1palOiD1stg8Xmn5DyOLrQ-Zg2Ro6TJ38IQ6fuLvs1mGNxpdp3f40k/s1600/1.png" width="400" /></a></div><div class="force_dir" len="331" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="318"><span lang="en"><br /></span></span></div><div class="force_dir" len="331" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="318"><span lang="en">Not long ago a group of researchers at computer security reported a RCE (Remote Control Ejecution) vulnerability in a subdomain of Yahoo.com. </span><span lang="en">Good in this occasion I come to present this small tool group use to detect this vulnerability. </span><span lang="en">Well no more to add, comensemos.</span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT_W1I3NajF1tqMRw_v3-cFPPHQlKzkiLxvAs8JldkASEPlEIEACjDYp-FkAOXMpIkrIFUSupAJSejgnp0PgzMwgfaNR2TEFqZytd4wfuWhkGCUVgnli6wa-jsSis0B_-9m3Pjuv5FEYU/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="53" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT_W1I3NajF1tqMRw_v3-cFPPHQlKzkiLxvAs8JldkASEPlEIEACjDYp-FkAOXMpIkrIFUSupAJSejgnp0PgzMwgfaNR2TEFqZytd4wfuWhkGCUVgnli6wa-jsSis0B_-9m3Pjuv5FEYU/s1600/4.png" width="320" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="311" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="298"><span lang="en">WebPwn3r is a scanner of vulnerabilities in web applications. </span><span lang="en">This mentioned tool is written in the Python language, and as I mentioned above help researchers to scan multiple links at the same time, in search of CERs or some typical vulnerabilities XSS vulnerability.</span></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="89" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="76"><span lang="en">WebPwn3r detections. </span><span lang="en">(The public tool only has the options *)</span></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="62" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="49">Scan a URL or a particular list of URL's.</span></div><div class="force_dir" len="85" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="72">* Detect and exploit remote code injection vulnerabilities.</span></div><div class="force_dir" len="72" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="59">To detect remote command execution vulnerabilities.</span></div><div class="force_dir" len="73" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="60">* Detect typical vulnerabilities Cross Site Scripting (XSS)</span></div><div class="force_dir" len="36" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="23">Detect WebKnight WAF.</span></div><div class="force_dir" len="88" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="75">It improves the payload for bypass filters seguridad(WAF 's).</span></div><div class="force_dir" len="55" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="42">Notes and print backend technologies.</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="20" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="7">Notes:</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="209" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="196">1.-This tool can also extract the URL´s of Burp Suite then guardardo in a targets.txt, to finally file that the URL's are finally analyzed by WebPwn3r.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8LFLn0seFoznt-6aGaHR5cQS_ADzywuN0rjRuQV81TCXPkHVlcUbKAPdLXmoG4Xy-X7uONIBWJjeutVlip7eMhkEA_xferwy-eaz-P-qhd-3OfxiYfC0cibJrf3oRTH7clxAgdmmugpI/s1600/proxy_4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8LFLn0seFoznt-6aGaHR5cQS_ADzywuN0rjRuQV81TCXPkHVlcUbKAPdLXmoG4Xy-X7uONIBWJjeutVlip7eMhkEA_xferwy-eaz-P-qhd-3OfxiYfC0cibJrf3oRTH7clxAgdmmugpI/s1600/proxy_4.png" width="400" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="358" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="345">2. This tool has great potential, since the user could optimize it to create a powerful and effective Crowler who would search all subdomains of a given domain or domains, to then classify them and print them in .txt files, to then be analyzed with a variacon of WebPwn3r.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-4Y83XSVDQQuIADPj0Eg29UBHYKswThpV3e7wd_YllH-n9MgCPNOMhsUqGQEOT8LIOxGnzpKUsh72dspwGGS4c9WAIAFwP2WyYWuIRODqdpvi4-Sr6U1itgk7HpYegaIdHsdB0espnaU/s1600/333.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="225" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-4Y83XSVDQQuIADPj0Eg29UBHYKswThpV3e7wd_YllH-n9MgCPNOMhsUqGQEOT8LIOxGnzpKUsh72dspwGGS4c9WAIAFwP2WyYWuIRODqdpvi4-Sr6U1itgk7HpYegaIdHsdB0espnaU/s1600/333.png" width="320" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="202" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="189">Well then I do a little test about WebPwn3r skills, for this I will use Windows 7, since I've previously installed packages of python 3.3.</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="77" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="64">Our goal for the test will be a subdomain of the Nato.</span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><div class="force_dir" len="54" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="41">Aim: https://transnet.act.nato.int/</span></div><div class="force_dir" len="54" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="41"><br /></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJUCXZT9gPhYB-BGS1wo_jFt5eXahsvIEga0vHgUXDIxVMyyljyEq9SEvKmYVDNb4Is_aw0Tx_xoBsq7ZjYhhsrYEmiNONh6WovLtpEKO2bRhQiLMVpSWAnIe6rtZgY8RI7sPYmQ2Gk0k/s1600/4+(1).png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="76" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJUCXZT9gPhYB-BGS1wo_jFt5eXahsvIEga0vHgUXDIxVMyyljyEq9SEvKmYVDNb4Is_aw0Tx_xoBsq7ZjYhhsrYEmiNONh6WovLtpEKO2bRhQiLMVpSWAnIe6rtZgY8RI7sPYmQ2Gk0k/s1600/4+(1).png" width="400" /></a></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="262" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="249"><span lang="en">We entered option 1 since we are going to do tests on a single URL. </span><span lang="en">Option 2 is for multiple objective analysis and rather than enter a URL, we will enter the name of the file that stores all the URLs that will be analyzed.</span></span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeHrWlyIAm81yj7R50aCbdAjY72h1K8AVXd4N7OGOqv-pOGQIe_NV7guySzYxoHwHHoq161DDsR_s2img7nOdWFot7Re-5fhHbBsFqrO_01s3D_0nwJcmCuX6JpMwuWNnjEbLyNLvZmoU/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="203" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeHrWlyIAm81yj7R50aCbdAjY72h1K8AVXd4N7OGOqv-pOGQIe_NV7guySzYxoHwHHoq161DDsR_s2img7nOdWFot7Re-5fhHbBsFqrO_01s3D_0nwJcmCuX6JpMwuWNnjEbLyNLvZmoU/s1600/3.png" width="400" /></a></div><div class="force_dir" len="262" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /></div><div class="force_dir" len="171" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="158">So far, we can see that our goal has no RCE vulnerability, but apparently if you have multiple Cross Site Scripting vulnerabilities.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKKB5_xNE4vDJ-Rfs1pJ-bekcV9haFSSHleYC5chJksKe5s-13MkexDVL11a3-kI1dB3MLSoZWSgxANtXtsK3gdp_X0uF1Yb-dADDroCMwxX4xpCYt9ZYWYspUnoyk2SQt0SDxQelXI-c/s1600/5+(1).png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="87" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKKB5_xNE4vDJ-Rfs1pJ-bekcV9haFSSHleYC5chJksKe5s-13MkexDVL11a3-kI1dB3MLSoZWSgxANtXtsK3gdp_X0uF1Yb-dADDroCMwxX4xpCYt9ZYWYspUnoyk2SQt0SDxQelXI-c/s1600/5+(1).png" width="400" /></a></div><div class="force_dir" len="171" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="158"><br /></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="307" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="294"><span lang="en">Well according to this tool our goal has 94 Cross Site Scripting vulnerabilities. </span><span lang="en">Interesting but apparently this in error. </span><span lang="en">This large number is because the variables were subjected to different types of scripts, some ordinary and others duly obfuscated attacks.</span></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="246" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="233">Note: This vulnerability was one of the many vulnerabilities that I could find in the Nato, all vulnerabilities found them with my tool Minerva v.1.4, I have used this objective to simplify the post.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKb3e_18oPJua08yf89Zqx97Yw3MUSC9Djgcpjtx-jKzLjvd4Iy3TTSn7-GjDhlacMdzGzl_-gVqI4Ra6IUt57zSZUV_Gv_7UVAgW9pumkyJWiBKwCMNms1-sFAnYQagcQBB4tcdtL5-Y/s1600/nato+XSS+en+calendario.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="159" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKb3e_18oPJua08yf89Zqx97Yw3MUSC9Djgcpjtx-jKzLjvd4Iy3TTSn7-GjDhlacMdzGzl_-gVqI4Ra6IUt57zSZUV_Gv_7UVAgW9pumkyJWiBKwCMNms1-sFAnYQagcQBB4tcdtL5-Y/s1600/nato+XSS+en+calendario.png" width="320" /></a></div><div class="force_dir" len="246" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span lang="en" len="233"><br /></span></div><br len="0" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;" /><br /><div class="force_dir" len="177" style="font-family: Arial; font-size: 12px; white-space: pre-wrap;"><span len="164"><span lang="en">Well I think that we have reached the end of the post, I hope that this small tool will be useful and serve them in the future. </span><span lang="en">See you and it will be up to the next.</span></span></div><div><span len="164"><span lang="en"><br /></span></span></div></div>

Penetration Testing Tools WebPwn3r - WebApps Security Scanner

Not long ago a group of researchers at computer security reported a RCE (Remote Control Ejecution) vulnerability in a subdomain of Yahoo.com...

Read More..

Wireshark Purposes

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjFdXhxONOa4YykaexuOB9aiFacr6LXmGsJNxtHFtzog1HB0vfwnOeA7vlJd8w2Wo0FWRbRoJM6Gd5zOyrH_jlV6JS_tSXVZ685KtpslGVTRXZf3iB5aV8qNMLX3kBDT_SDafI9Nq-KhDc/s1600/wireshark.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjFdXhxONOa4YykaexuOB9aiFacr6LXmGsJNxtHFtzog1HB0vfwnOeA7vlJd8w2Wo0FWRbRoJM6Gd5zOyrH_jlV6JS_tSXVZ685KtpslGVTRXZf3iB5aV8qNMLX3kBDT_SDafI9Nq-KhDc/s1600/wireshark.jpg" width="320" /></a></div><span style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 13px; line-height: 18px;">►Wireshark -has been around for ages and is extremely popular. Wireshark allows the pentester to put a network interface into a promiscuous mode and therefore see all traffic. This tool has many features such as being able to capture data from live network connection or read from a file that saved already-captured packets. Wireshark is able to read data from a wide variety of networks, from Ethernet, IEEE 802.11, PPP, and even loopback. Like most tools in our 2013 Concise Courses Security List the captured network data can be monitored and managed via a GUI – which also allows for plug-ins to be inserted and used. Wireshark can also capture VoIP packets (like Cain & Able ) and raw USB traffic can also be captured.:</span></div>

Penetration Testing Tools Wireshark Purposes

►Wireshark -has been around for ages and is extremely popular. Wireshark allows the pentester to put a network interface into a promiscuous ...

Read More..

Metasploit,Nessus and Nmap Detail

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIYByv37SV6Oz92y1oTqu3WPpIiI5kLe9BB6mFmMZhP4g1_K7__lu00UGaDjWR7JcN9F3KEJuv4FbYnHDMBTUq42p2gsQRpAhNFXxJO1DKYzK_qcQnPKL14Gn0njvjFAtRtfu9ts1k7gQ/s1600/metasploit.gif" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIYByv37SV6Oz92y1oTqu3WPpIiI5kLe9BB6mFmMZhP4g1_K7__lu00UGaDjWR7JcN9F3KEJuv4FbYnHDMBTUq42p2gsQRpAhNFXxJO1DKYzK_qcQnPKL14Gn0njvjFAtRtfu9ts1k7gQ/s1600/metasploit.gif" width="306" /></a></div><br /><span style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 18px;">►Metasploit -The Metasploit Project is a security project which delivers information about security vulnerabilities and helps penetration testing and Intrusion detection. The open source project – known as the Metasploit Framework, is used by security professionals to execute exploit code against a remote target machine – for penetration testing of course.</span><br /><span style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 18px;"><br /></span><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEii_kRupppfOToaSOt81B6CagiTWo5HxN2SpGAWGh3UN42cLtQZnuJhpz9VX9weDZ8Dkqdh_rOspsFN5MLH2UDteH0NQkKRelM1tXvW2W3B0YOas0E07XY1EHQsaOHtj6bPnoaKnJtExlY/s1600/images+(1).jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEii_kRupppfOToaSOt81B6CagiTWo5HxN2SpGAWGh3UN42cLtQZnuJhpz9VX9weDZ8Dkqdh_rOspsFN5MLH2UDteH0NQkKRelM1tXvW2W3B0YOas0E07XY1EHQsaOHtj6bPnoaKnJtExlY/s1600/images+(1).jpg" /></a></div><span style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.800000190734863px; line-height: 18px;">►Nessus -is another giant – a security tool that focuses on vulnerability scanning. There is a free and paid version – free for personal use. Started in 1998 by Renaud Deraison is has evolved into one of the world’s most popular security tools – particularly as a vulnerability scanner. The organization behind Nessus, Tenable Security, estimates that it is used by over 75,000 organizations worldwide.</span><br style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.800000190734863px; line-height: 18px;" /><br style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.800000190734863px; line-height: 18px;" /><span style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.800000190734863px; line-height: 18px;">Essentially Nessus scans for various types of vulnerabilities: ones that check for holes that hackers could exploit to gain control or access a computer system or network. Furthermore, Nessus scans for possible misconfiguration (e.g. open mail relay, missing security patches, etc.). The tools also scans for default passwords and common passwords which is can use execute through Hydra (an external tool) to launch a dictionary attack. Other vulnerability scans include denials of service against the TCP/IP stack.</span><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxS-Q1icDCTNAsrxY-8nHNW4veVet84suPQWwiPO7lqoh2rzoFB84qduPwE5b3ej0AJ4rVLgccGFMOs0YEuKhPIcRujMsbL7OfCOcgdMrqu35wq-kIWl3lKi3zhgYCzid-qhLW5BY6dnc/s1600/NMAP-NETWORK-SCANNING-R129802.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxS-Q1icDCTNAsrxY-8nHNW4veVet84suPQWwiPO7lqoh2rzoFB84qduPwE5b3ej0AJ4rVLgccGFMOs0YEuKhPIcRujMsbL7OfCOcgdMrqu35wq-kIWl3lKi3zhgYCzid-qhLW5BY6dnc/s1600/NMAP-NETWORK-SCANNING-R129802.jpg" width="153" /></a><br /><br style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.800000190734863px; line-height: 18px;" /><span style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.800000190734863px; line-height: 18px;">►Nmap - is another massive giant of a security tool which has been around for forever and is probably the best known. Nmap has featured on many movies including the Matrix – just Google it and you’ll see what we mean. Written in C, C++, Python, Lua by Gordon Lyon (Fyodor) starting from 1997, Nmap (Network Mapper) is the defacto security scanner which is used to discover hosts and services on a computer network. To discover hosts on a network Nmap sends specially built packets to the target host and then analyzes the responses. The program is really sophisticated because unlike other port scanners out there, Nmap sends packets based upon network conditions by taking into account fluctuations, congestion and more.</span></div>

Penetration Testing Tools Metasploit,Nessus and Nmap Detail

►Metasploit -The Metasploit Project is a security project which delivers information about security vulnerabilities and helps penetration te...

Read More..

John The Ripper Tool Uses:

<div dir="ltr" style="text-align: left;" trbidi="on"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4nMv_-f3bxfK2hx_jtOpWKKUpoaHv0G0VAUjunBtlJkgsLIl1sKhBykpHVLTQDj-_GtXklsi2Z56eevQZz0qkPw0dC4yje12GoIoDyJOCATJwT7qT03LjIkqwjRApcQJ2O38aJLOsJeg/s1600/ripper.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4nMv_-f3bxfK2hx_jtOpWKKUpoaHv0G0VAUjunBtlJkgsLIl1sKhBykpHVLTQDj-_GtXklsi2Z56eevQZz0qkPw0dC4yje12GoIoDyJOCATJwT7qT03LjIkqwjRApcQJ2O38aJLOsJeg/s1600/ripper.png" /></a><span style="background-color: white; color: #898f9c; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 18px;">John The Ripper -is a free password cracking software tool. Originally created for the UNIX operating system, it currently works on every major operating system. By far, this tool is one of the most popular password testing and breaking programs used by information security professionals. The pentesting tool combines various password crackers into one concise package which is then able to identify password hash types through its own customizable cracker algorithm.</span></div>

Penetration Testing Tools John The Ripper Tool Uses:

John The Ripper -is a free password cracking software tool. Originally created for the UNIX operating system, it currently works on every ma...

Read More..

Ettercap tool uses:

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHwzAbm9rQlji4wMle4WqmUq21tL1DH6LtK4mnNpY3mFvruQnUolDpxnJDF3TeCTlluUpffwWDGjlOGP74nLGOr9_VOed1L0h03znW0xWyKvyERx2l35HnseVmHYsWpbU2UpexJYInL18/s1600/ettercap_ssh_credentials.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="246" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHwzAbm9rQlji4wMle4WqmUq21tL1DH6LtK4mnNpY3mFvruQnUolDpxnJDF3TeCTlluUpffwWDGjlOGP74nLGOr9_VOed1L0h03znW0xWyKvyERx2l35HnseVmHYsWpbU2UpexJYInL18/s1600/ettercap_ssh_credentials.png" width="320" /></a></div><span style="background-color: white; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 18px;">Ettercap - is a free and open source network security tool for man-in-the-middle attacks (MITM) on LAN. The security tool can be used to analyze computer network protocols within a security auditing context. Ettercap has four methods of functionality:</span><br style="background-color: white; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 18px;" /><span style="background-color: white; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 18px;">Security scanning by filtering IP-based packets, MAC-based: whereby packets are filtered based on MAC address, (this is useful for sniffing connections through a gateway). ARP-based scanning by using ARP poisoning to sniff on a switched LAN between two hosts (known as full-duplex). PublicARP-based functionality: Ettercap uses ARP poisoning to sniff on a switched LAN from a victim host to all other hosts (known as half-duplex).</span></div>

Penetration Testing Tools Ettercap tool uses:

Ettercap - is a free and open source network security tool for man-in-the-middle attacks (MITM) on LAN. The security tool can be used to ana...

Read More..

Cain & Abel Uses:

<div dir="ltr" style="text-align: left;" trbidi="on"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7UN8ODro49alOqzQo70XTWa9jIcHh4JAFiysQG2OBpMUh-z2NN1BIlX6VM7ka18Rw7Nggn3bSiuwfvwCKGBMUYe8iZotTPgwu6YFwP9OI_vAgXwxg35MI_ExVo1Ee5FaboKrz87wlICo/s1600/cain-and-abel-11.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="237" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7UN8ODro49alOqzQo70XTWa9jIcHh4JAFiysQG2OBpMUh-z2NN1BIlX6VM7ka18Rw7Nggn3bSiuwfvwCKGBMUYe8iZotTPgwu6YFwP9OI_vAgXwxg35MI_ExVo1Ee5FaboKrz87wlICo/s1600/cain-and-abel-11.jpg" width="320" /></a><span style="background-color: white; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 18px;">Cain & Abel - has a reputation of being a bit of a script-kiddie tool, but it is still awesome nonetheless. Cain & Abel is defined as being a password recovery tool. This tool allows a penetration tester to recover various types of passwords by sniffing the network, and cracking encrypted passwords using either a dictionary or brute-force attacks. The tool can also record VoIP conversations and has the ability to decode scrambled passwords, discover WiFi network keys and cached passwords. With the correct usage and expertise, a penetration tester can also analyze routing protocols. The security tool does not inherently exploit any software vulnerabilities or holes, rather it identifies security weaknesses in protocol’s standards.</span></div>

Penetration Testing Tools Cain & Abel Uses:

Cain & Abel - has a reputation of being a bit of a script-kiddie tool, but it is still awesome nonetheless. Cain & Abel is defined a...

Read More..

Aircrack-ng Tool Info

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWzdoSS97L1cflgz55Cf735ke3mLcWXPpTUtVb-hLViNGdVC15_qSS7GAGAKnsVdS16ifLN4M7dzOGbaa23pNpjkaMKg-vp1j267gS1jJonMOIQelPALu0E4o72Gt9ZI2M_tuIZkRWyCo/s1600/Aircrack-ng-logo.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="191" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWzdoSS97L1cflgz55Cf735ke3mLcWXPpTUtVb-hLViNGdVC15_qSS7GAGAKnsVdS16ifLN4M7dzOGbaa23pNpjkaMKg-vp1j267gS1jJonMOIQelPALu0E4o72Gt9ZI2M_tuIZkRWyCo/s1600/Aircrack-ng-logo.png" width="320" /></a></div><span style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 16.309091567993164px;">Aircrack-ng -is a comprehensive set of network security tools that includes, aircrack-ng (which can cracks WEP and WPA Dictionary attacks), airdecap-ng (which can decrypts WEP or WPA encrypted capture files), airmon-ng (which places network cards into monitor mode, for example when using the Alfa Security Scanner with rtl8187), aireplay-ng (which is a packet injector), airodump-ng (which is a packet sniffer), airtun-ng (which allows for virtual tunnel interfaces), airolib-ng (which stores and manages ESSID and password lists), packetforge-ng (which can create encrypted packets for injection), airbase-ng (which incorporates techniques for attacking clients) and airdecloak-ng (which removes WEP cloaking). Other tools include airdriver-ng (to manage wireless drivers), airolib-ng (to store and manages ESSID and password lists and compute Pairwise Master Keys), airserv-ng (which allows the penetration tester to access the wireless card from other computers). Airolib-ng is similiar to easside-ng which allows the user to run tools on a remote computer, easside-ng (permits a means to communicate to an access point, without the WEP key), tkiptun-ng (for WPA/TKIP attacks) and wesside-ng (which an an automatic tool for recovering wep keys). Aircrack has a GUI interface – called Gerix Wifi Cracker</span></div>

Penetration Testing Tools Wifi Hacking Aircrack-ng Tool Info

Aircrack-ng -is a comprehensive set of network security tools that includes, aircrack-ng (which can cracks WEP and WPA Dictionary attacks), ...

Read More..

Acunetix Tool Info

<div dir="ltr" style="text-align: left;" trbidi="on"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg8jONX3B9o6RyEHyPk-xWHOnPeHQNlAjPgyB58OgISNizsFXNRRpgF-2Uv77kGD23XHLXeFs90iSjz1FG4WpN1ga_NWhvUoUU8G_SmlQFJJb63BJxVICrxo6EknvwIotSEwPnuBRbzTg/s1600/Acunetix+Web+Vulnerability+Scanner+.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="227" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhg8jONX3B9o6RyEHyPk-xWHOnPeHQNlAjPgyB58OgISNizsFXNRRpgF-2Uv77kGD23XHLXeFs90iSjz1FG4WpN1ga_NWhvUoUU8G_SmlQFJJb63BJxVICrxo6EknvwIotSEwPnuBRbzTg/s1600/Acunetix+Web+Vulnerability+Scanner+.jpg" style="cursor: move;" width="320" /></a><span style="background-color: white; color: #333333; font-family: 'lucida grande', tahoma, verdana, arial, sans-serif; font-size: 12.727272033691406px; line-height: 16.309091567993164px;">Acunetix -has a free and paid version. This hacking tool has many uses but in essence it tests and reports on SQL injection and Cross Site scripting testing. It has a state of the art crawler technology which includes a client script analyzer engine. This security tool generates detailed reports that identify security issues and vulnerabilities. The latest version, Acunetix WVS version 8, includes several security features such as a new module that tests slow HTTP Denial of Service.This is useful for penetration testers and developers both.</span></div>

Penetration Testing Tools Acunetix Tool Info

Acunetix -has a free and paid version. This hacking tool has many uses but in essence it tests and reports on SQL injection and Cross Site s...

Read More..