Nokia N810 – Wireless Auditing

 Configuration Tutorials, Installing & Using Tools, Using the Tools  3 Responses »
Sep 082011
 

I created a tutorial on how to setup and configure the Nokia N810 Internet Tablet to conduct a wireless assessment or audit. The tools included in the tutorial include how to setup kismet (oldcore and newcore), aircrack-ng (airbase and aircrack), and btscanner. I’m still working on developing steps to install Metasploit and Karmetasploit for wireless client attacks. The tutorial also details using the internal GPS as well as adding an external wireless adapter. The latest version of the tutorial can be found here.

ISACA Atlanta Chapter – GEEK WEEK 2011

 FYI  No Responses »
Aug 232011
 

Atlanta Chapter of ISACA GEEK WEEK 2011The 4th annual  Atlanta Chapter of ISACA GEEK WEEK conference was held the week of August 22nd – 26th.  GEEK WEEK is a track-oriented, full week Conference focusing on providing training, networking, and roundtable sessions on IT governance, audit & security.

I conducted the presentation Wireless Auditing on a Budget:  Using Low Cost Hardware and Open Source Software.  You can find the presentation slides here.  For links and information on the other presentations you can go here.

 Posted by at 7:42 pm

SNMP Assessment Worksheet

 Configuration Tutorials, Installing & Using Tools, Scripts, Using the Tools  1 Response »
Jun 072011
 

I put together another Technical Assessment Plan for assessing the SNMP protocol.  You will use open source and freely download-able utilities to assess the SNMP protocol.  This is for auditors that do not have access to or cannot afford the Solarwinds toolset.  This is version 0.1 of the document and I plan on making updates and add new tools in the future.

 Posted by at 5:50 pm  Tagged with:

LAMP setup for .nessus v2 custom report generation.

 Installing & Using Tools, Scripts  2 Responses »
May 022011
 

I created Project RF to have a reporting framework that provides  consistent reports for various vulnerability scanning tools.  The  project started with support for Nessus back when I would parse nbe files.   I’ve  since included reporting for eEye Retina, Nmap, HP WebInpect,  AppScan AppDetective,  Kismet, and GFI Languard.  This project is still in its alpha stages as  I’m not a top notch web program developer.  Scan results are exported to  XML which is then uploaded, parsed, and imported into a backend MySQL  database.  I have found this framework very useful in generating reports  for my workpapers.  I still continue to work on this project even though I’m no longer an auditor.  Recently I stripped it down to just Nessus and I rewrote the Nessus portion to support the .nesses v2 xml output.  Installation and setup instructions can be found here.

This framework supports many options for report generation and executive reporting.

Linux Penetration Testing Laptop Setup v3.5

 Configuration Tutorials  No Responses »
Mar 302011
 

I’m now providing an updated Linux Penetration Testing Laptop Setup document to help install popular and useful vulnerability assessment tools for the Linux operating system. You can go and obtain Backtrack but I feel that you will have more understanding of the tools and Linux in general if you install the tools yourself. You will also have the most current version available. See Configuration Tutorials for the latest document.

Update:  The latest version is now v4 on Ubuntu 11.4 Natty Narhwal.

External Fingerprinting Worksheet

 Configuration Tutorials, Installing & Using Tools, Scripts, Using the Tools  No Responses »
Feb 242011
 

I put together a Technical Assessment Plan that can be used to conduct external fingerprinting using the tools and utilities that a penetration tester would use.  The assessment plans are structured in a way to help with the documentation of evidence for inclusion in a work-paper process.  The plan provides helpful information on how to install, configure, and use the tools to obtain the evidence needed for an engagement.  The Technical Assessment Plans that I have created can be found here.

Earning CPE credits in a down economy.

 FYI  No Responses »
Jan 252011
 

Earning CPE credits in a down economy for you Information Security certifications.

As we enter 2011 the financial talking heads say that our economy is recovering.  While this can be debated as vigorously as Vi vs. Emacs you sit in your office with the knowledge that your company’s training budget is still next to nothing.  Trips to information security conferences in Las Vegas, Miami, and Orlando are all out of the question.  With all of the information security certifications that you have obtained to keep competitive in this tough economy you are required to earn Continuing Professional Education (CPE) credits.  Below I will list some simple steps you can take to still keep current on the latest security trends while earning those valuable CPE credits to maintain your certification(s).
Continue reading »

Stand-Alone Tools and Utilities

 Installing & Using Tools  No Responses »
Aug 312010
 

A question was raised today during a presentation about what utilities you can use without installing them. There are engagements that the auditor is not allowed to use their own laptop and must use a laptop provided by the auditee. This severely limits how effective an engagement can be but it is not impossible to obtain the information you need when you connect to the auditee’s network. I’ve made changes to the Security Tools page to highlight which tools are stand-alone and do not require installation.  Also for reference see Penetration Testing Ninjitsu which I pulled from a Core Security webcast.

Web Security Dojo

 FYI, Installing & Using Tools  No Responses »
Apr 172010
 

NA CACS conference hosted by ISACA (18-22 April 2010)

Remote Security Testing for Web Applications
Presented by David Rhoades
Maven Security Consulting

Attending this conference workshop session introduced me to Maven Security’s Web Security Dojo.  This is a virtual image, Ubuntu based, that includes several free and open source tools used for web application auditing.  The image also includes web application environments that are vulnerable to many common vulnerabilities to allow you to test and learn how to use the tools.  This pre-configured environment is perfect for educational purposes.  They also include a BASH script that will setup your own Ubuntu environment.

 Older Entries  Newer Entries