{"id":72,"date":"2008-10-14T12:15:24","date_gmt":"2008-10-14T18:15:24","guid":{"rendered":"http:\/\/www.jedge.com\/wordpress\/?page_id=72"},"modified":"2016-07-01T10:59:30","modified_gmt":"2016-07-01T16:59:30","slug":"security-tools","status":"publish","type":"page","link":"https:\/\/www.jedge.com\/wordpress\/security-tools\/","title":{"rendered":"Security Tools"},"content":{"rendered":"

2015 – This page is so damn old. Back in 2008 I thought I can post some tools that an IS Auditor should know about and could learn to use on an audit. If you are an IS auditor, a penetration tester, or anybody who happened to stumble I apologize.<\/p>\n

These are all tools I\u2019ve used to conduct an audit of an agency or university.\u00a0 I have working knowledge of all of these tools and would be able to offer advice or assistance in their use.\u00a0 I would also suggest getting familiar with all of the tools listed in the Security List Top 100 Tools (http:\/\/sectools.org\/)<\/p>\n

Footprinting<\/span><\/strong><\/p>\n

BiDiBlah <\/strong>(http:\/\/www.sensepost.com<\/a>)
\nSiteDigger <\/strong>(http:\/\/www.foundstone.com<\/a>)<\/p>\n

Network\/Port Scanning<\/span><\/strong><\/p>\n

Nmap <\/strong>(http:\/\/www.nmap.org<\/a>)
\nScapy <\/strong>(http:\/\/www.secdev.org<\/a>)
\nScanline<\/strong> (http:\/\/www.foundstone.com<\/a>) [Stand-Alone]<\/p>\n

Windows Enumeration<\/span><\/strong><\/p>\n

net view<\/strong> (Windows Default)
\nnbtstat <\/strong>(Windows Default)
\nBrowstat <\/strong>(exe<\/a>) [Stand-Alone]
\n– (Windows XP Support Tools<\/a>)
\n– (Windows 2000 Resource Kit<\/a>)
\n– Command Help<\/a>
\nNbtscan <\/strong>(http:\/\/www.unixwiz.net<\/a>) [Stand-Alone]
\nEnum <\/strong>(http:\/\/www.darkridge.com<\/a>) [Stand-Alone]
\nDumpsec <\/strong>(http:\/\/www.somarsoft.com<\/a>) [Stand-Alone]
\n– (needs to be installed by then you can just copy the DumpSec exe file)
\nSolarwinds <\/strong>Tools (http:\/\/www.solarwinds.com<\/a>)<\/p>\n

Sniffing<\/span><\/strong><\/p>\n

Ettercap <\/strong>(http:\/\/ettercap.sourceforge.net<\/a>)
\nCain & Abel<\/strong> (http:\/\/www.oxid.it<\/a>)
\nTcpdump <\/strong>(http:\/\/www.tcpdump.org<\/a>)
\nWireshark <\/strong>(http:\/\/www.wireshark.org<\/a>)<\/p>\n

Password Tools<\/span><\/strong><\/p>\n

Cain & Abel<\/strong> (http:\/\/www.oxid.it<\/a>)
\nJohn the Ripper<\/strong> (http:\/\/www.openwall.com<\/a>)
\nCifspwscan <\/strong>(http:\/\/www.cqure.net<\/a>) [Stand-Alone (Needs Java)]
\nTHC-Hydra<\/strong> (http:\/\/freeworld.thc.org\/thc-hydra\/<\/a>)
\nPwdumpX <\/strong>(http:\/\/www.packetstormsecurity.org<\/a><\/a>)[Stand-Alone]
\nPwdump2 <\/strong>(http:\/\/www.packetstormsecurity.org<\/a>)[Stand-Alone]
\nCachedump <\/strong>(http:\/\/www.packetstormsecurity.org<\/a>)[Stand-Alone]
\nSamInside <\/strong>(http:\/\/www.insidepro.com<\/a>)[Stand-Alone]
\ncreddump <\/strong>(http:\/\/code.google.com\/p\/creddump\/<\/a>) [Needs Python]<\/p>\n

Vulnerability Scanners<\/span><\/strong><\/p>\n

Tenable Nessus<\/strong> (http:\/\/www.nessus.org<\/a>)
\neEye Retina<\/strong> (http:\/\/www.eeye.com<\/a>)
\nHP WebInspect<\/strong> (http:\/\/www.hp.com<\/a>)
\nApplication Security AppDetective<\/strong> (http:\/\/www.appsecinc.com<\/a>)
\nNikto <\/strong>(http:\/\/www.cirt.net<\/a>)<\/p>\n

Wireless<\/span><\/strong><\/p>\n

Kismet <\/strong>(http:\/\/www.kismetwireless.net<\/a>)
\nAircrack-ng<\/strong> (http:\/\/www.aircrack-ng.org<\/a>)
\nKarmasploit <\/strong>(http:\/\/trac.metasploit.com\/wiki\/Karmetasploit<\/a>)<\/p>\n

Database Tools<\/span><\/strong><\/p>\n

Navicat <\/strong>(http:\/\/www.navicat.com<\/a>)
\nSQL Ninja<\/strong> (http:\/\/sqlninja.sourceforge.net<\/a>)
\nSQLat <\/strong>(http:\/\/www.cqure.com<\/a>)[Stand-Alone]
\nAutomagic <\/strong>(http:\/\/packetstormsecurity.org\/UNIX\/scanners\/automagic.zip<\/a>)
\nOracle Audit Tools (OAT)<\/strong> (http:\/\/www.cqure.com<\/a>)[Stand-Alone (Needs Java)]
\nOracle Assessment Kit (OAK)<\/strong> (http:\/\/www.databasesecurity.com<\/a>) [Stand-Alone]<\/p>\n

Exploitation<\/span><\/strong><\/p>\n

Metasploit <\/strong>(http:\/\/www.metasploit.com<\/a>)<\/p>\n","protected":false},"excerpt":{"rendered":"

2015 – This page is so damn old. Back in 2008 I thought I can post some tools that an IS Auditor should know about and could learn to use on an audit. If you are an IS auditor, a penetration tester, or anybody who happened to stumble I apologize. These are all tools I\u2019ve […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"class_list":["post-72","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/pages\/72","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/comments?post=72"}],"version-history":[{"count":12,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/pages\/72\/revisions"}],"predecessor-version":[{"id":1000,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/pages\/72\/revisions\/1000"}],"wp:attachment":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/media?parent=72"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}