Security Toolkit Submitted by SEC335-01 Spring 2008

Submitted by Andrew Dunham

Information Assurance Resources
http://www.astalavista.net – is a hacking and security community. The site contains information about the latest rootkits, viruses, and worms. If you join the site they will provide you with a plethora of tools and viruses that you can pick apart to find out how they work. They also setup servers to host hacker war games amongst their members.

http://www.governmentsecurity.org/ - is a site with the latest stories about information security issues. These sites are helpful because they can provide viewers with information about vulnerabilities that they may have overlooked. In addition, the site seems to offer more information to their members.

http://www.milw0rm.com/# - This site provides up-to-date exploits for all kinds of applications and operating systems. Its helpful to look at to ensure that your not running any software that could compromise your network. New exploits are posted daily. The site also provides video examples of crackers taking advantage of systems.

http://www.hoobie.net/security/exploits/index.html and http://packetstormsecurity.org/ are similar to milworm, but they all have different exploits.

http://insecure.org/ - This is one of the most useful sites I have found for obtaining free network security tools. This site contains links to exploit programs, sniffers, web scanners, vulnerability scanners, port scanners, password crackers, packet crafters, etc… I would highly recommend checking it out if your not familiar with it.

http://www.speakeasy.net/speedtest/speedtest.swf - This is a speed tester that I use a lot. It has a nice flash interface that doesn’t lag like some other speed test sites I have used in the past. Its free and has a number of different locations around the U.S. that can be used.

http://ettercap.sourceforge.net/ and http://www.Wireshark.org – Both of these are decent packet sniffers. The provide realtime passive packet capturing that can be filtered or save to a .cap file and analyzed at a later date. Wireshark was formorly known as Ethereal and has been around for sometime. Ettercap is a neat tool because it is capable of dissecting ciphered protocols.

http://www.angryziber.com – This site hosts a tool called Angry IP scanner which is a useful tool for scanning individual IP addresses or a range of IP addresses. This can be helpful if your curious who is connected to the network. Angry IP Scanned is open-source and is also capable of scanning ports.

http://www.download.com/Advanced-Port-Scanner/3000-2085_4-10127846.html - Advanced Port Scanner is yet another useful free port scanner. It has a number of more advanced properties that can be set for things like scanning speed to pvent it from being blocked by security pcautions.

http://usertools.plus.net/tutorials/id/21 - This is a useful site that explains how to use telnet through a DOS command prompt. It shows how to access CGI Servers, Web Servers, and Mail Servers through the use of telnet. This can be useful for a number of reasons. One example would be the use of telnet to examine email headers of spoofed emails to see where they are coming from. It can also be helpful to keep logs of what you are doing through the use of a telnet client.

http://www.securityfocus.com/infocus/1694 - This site contains step-by-step instructions for securing an Apache server. They have walthroughs for installing the OS, pparing the software, compiling, configuring apache, and getting the service online. This site is useful for anyone who doesn’t want their Apache server to be wide open.

Submitted by Brendan Miles

Bootable Forensic Operating Systems

http://www.e-fense.com/helix/ - Helix Operating System
http://fire.dmzs.com/ - Free Forensic and Incident Response Environment
http://www.knoppix.org/ - Knoppix
http://www.tdisecurity.com/tools.html - Arudius
http://www.nu2.nu/pebuilder/ - Windows PE Builder

WEP Cracking

Window Hardening Guides

Cryptography

Encase Related Items

http://www.guidancesoftware.com/products/ef_index.aspx - Encase homepage

http://www.geocities.com/johnboy_tutorials/encase1.html - free encase tutorials

Firewall Operating Systems

http://www.smoothwall.org/ - Smoothwall
http://ipcop.org/ - IPCop

Free Tools

http://www.lavasoftusa.com/ - Ad-Aware
http://www.personalfirewall.comodo.com/ - Comodo Firewall
http://free.grisoft.com/ - AVG Anti-Virus
http://www.gmgsystemsinc.com/fau/ - Forensic Acquisition Utilities
http://www.foundstone.com/us/resources-free-tools.asp - Large variety of free tools
http://www.fosstools.org/ - Misc Security Tools

Submitted by Brenton Johnson

The first site I selected is located at http://darknet.org , This is a great site to learn the newest hacks and stay ahead of the script kiddies before your computer and/or network become compromised. One of my personal favorite portions of the site is the Hack Tools section in which you can find software for securing conversations via AIM and also the DDos agents that turn unknowing computers into zombie agents.
The second site I selected is located at http://www.nsa.gov/snac/downloads_switches.cfm?MenuID=scg10.3.1 . The NSA’s site provides an excellent overview of how to secure ports on a Cisco Access Switch and also an overview to the security configuration of a Cisco IOS Switch. In addition to Switch security there is also security configuration guides for many other hardware devices, operating systems, and applications.
The third site I chose for the purposes of this assignment was http://sectools.org/ . This site provides links to what they believe to be the top 100 security tools. There is some great programs on here such as Nessus, the popular UNIX vulnerability sniffing tool, and also Wireshark, formerly known as Ethereal. Another unique thing about the site is that it lists what OS’s the tools will work on and their popularity.
The fourth site I chose is located at http://www.interhack.net/pubs/network-security . This site provides a great basic overview of Network Security. The table of contents contains links to different portions of long basic overview. One of the most interesting portions of this site was the Firewall section which covered what we talked on during our last class.
The fifth site I chose can be located at http://www.windowsecurity.com/ and is a great site all around. The site provides a sound board for recent security flaws for windows. One of the interesting portions of the site that I checked out recently was the “Analyzing a Hack from A to Z”. I would recommend checking it out. This site inspired me to create a honey pot to check out some of the newest techniques hackers are utilizing its just that I don’t have a disposable machine at this time.
The sixth site I selected is located at http://www.networkworld.com/topics/security.html. This site is awesome and provides the newest information and journals in almost every area of network and web security. There is also an email subscription service, which I have signed up for. A few of the more interesting articles I found on the site were the article on Linux and its comparison to the different flavors of Microsoft in relation to security. The other interesting article I found was related to the eight hot technologies for 2008.
The seventh site I selected was located at http://www.networkworld.com/topics/security.html . This site is part of the CERT organization that offers training and certification for network security. The site offers a nice introduction to computer security and a basic section on securing networks. One of the more interesting portions to the site is stanzas related to intentional misuse of computers. The “Chat clients” section is decent however this section only offers a brief outline of how users should not accept links that relate to .exe files.
The eighth site I found is located at http://netsecurity.about.com/ . This is not a traditional network security URL however there is an interesting article on routers and how they are susceptible to a security breach via UPnP that further exploits Adobe Flash. The article recommended disabling the UPnP function of the router to pvent this security flaw.
The ninth website I found was located at http://netsecurity.about.com/ . This is the popular LINKSYS Corporation’s spin on individual computer protection and also networks protection. I scanned around the site for a little bit in particular the section on wireless security. The wireless network security site provided provided a comical diagram on security threats to the residential user which is worth looking at http://www.linksys.com/servlet/Satellite?c=L_Content_C1&childpagename=US%2FLayout&cid=1116519873380&pagename=Linksys%2FCommon%2FVisitorWrapper&lid=7338091212L01
The tenth site I found is located at http://www.securityfocus.com/ . This site has many mailing lists and also provides information on recent security flaws that have been exploited. One of the mailing lists I signed up for on this site was under the Focus on Linux section. Another interesting portion to the site was the Infocus link which I selected for IDS and came across an interesting “honey pot” article.
http://www.juniper.net/
http://www.networkcomputing.com
http://searchsecurity.techtarget.com/topics/0,295493,sid14_tax299807,00.html
http://insecure.org/
http://www.nextel.com/en/solutions/network_security/index.shtml
http://www.nextel.com/en/solutions/network_security/index.shtml
http://www.windowsecurity.com/
http://www.networkworld.com/topics/wireless-security.html
http://www.gfi.com/lannetscan/
http://www.infosecnews.org/hypermail/0510/10851.html
http://articles.techrepublic.com.com/
http://www.microsoft.com/technet/security/guidance/networksecurity/topology.mspx
http://downloads.techrepublic.com.com/search.aspx?kw=Design+the+best+network+security+topology+for+your+firewall+using+these+diagrams
http://bnug.blogspot.com/2005/09/article-configure-it-design-best.html
http://www.juniper.net/products/services/transition/security_design.pdf

Submitted by Charles Nolan

http://www.downloads.com : a collection of free programs that can be downloaded. These programs include useful tools such as Ad Aware SE and Spybot, both anti-spyware applications, as well as anti-virus and different browser programs.
http://iase.disa.mil : a fairly up to date database of information. It covers a wide base of information, not just operating systems, but DNS and other important technology information.
http://www.irt.org : all about CGI. What it is, how it works, the different types, and what kind of problems may affect it. There is also some guides as to how to troubleshoot those problems that may arise as well as pventative measures.
http://ettercap.sourceforge.net/ : a packet sniffing suite that can be used by hackers to sniff packets and be used for MITM attacks (Man in the Middle attacks). Can be used to capture packets on a switched network and be able to crack some ciphered protocols.
http://www.wireshark.org : also known as ethereal, is a passive monitoring application. Wireshark puts network devices into promiscuous mode and allows the user to capture packets. This can be used to diagnose a network.
http://www.linuxjournal.com : a online journal that in the featured article explains how to use wireshark to sniff out possible problems with VoIP (Voice over IP). Essentially an online magazine that posts articles relating to new development in internet security.
http://www.securitypronews.com : an online magazine similar to linuxjournal.com. Anyone is able to post articles that relate to developments or discovered flaws or holes in products. This is useful in determining any existing, or new treats in a network system.
http://www.linuxtopia.org
http://www.centos.org/
http://www.nsa.gov/selinux/
http://www.redhat.com
http://www.nsa.gov/snac/os/win2k/iis_5_v1_4.pdf
http://www.first.org/resources/guides/#bp11
http://www.windowsecurity.com/articles/Locking_Down_IIS_60_with_NET_The_Default_Security_Wizard.html
http://bizsecurity.about.com/od/internetsecurity/ss/secureiissteps_4.htm
http://labmice.techtarget.com/windows2003/IIS/default.htm
http://labmice.techtarget.com/windows2003/IIS/default.htm
http://www.securityfocus.com/infocus/1694
http://usertools.plus.net/tutorials/id/21
http://www.acunetix.com/vulnerability-scanner/vulnerabilityscanner5.exe
http://www.geocities.com/floydian_99/aut3.html
http://www.nullcube.com/software/cubictemp/doc/subs/xss.html

Submitted by Matt Huwyler

http://www.sans.org/resources/popular.php
I chose this site as one of my 25 as it contains a variety of topics relating to general security and potential issues that an individual could run into securing individual computer systems. This site covers the implementation of firewalls and the implementation of a security policy governing acceptable computer use as well as many other technical issues.
http://www.windowsecurity.com/
http://www.cert.org/homeusers/HomeComputerSecurity/
This site was chosen because it has a wealth of information that can be used in terms of security. The site covers topics such as installing and maintaining a quality anti-virus program and installing and maintaining a firewall for security on a home computer and a home network. Also have good resources and tips at developing a strong password and encryption scheme.
http://www.cert.org/tech_tips/home_networks.html
http://www.cert.org/cert/information/sysadmin.html
http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/security-guide/
This site contains a wealth of various information not only on how to implement various means of securities but also goes into great detail on identifying the various types of attacks that one may encounter. It then goes into great descriptions as to how to defend against the various forms and types of attacks.
http://www.redhat.com/docs/manuals/linux/
http://www.puschitz.com/SecuringLinux.shtml
http://tldp.org/HOWTO/Security-Quickstart-Redhat-HOWTO/index.html
The site that I chose here contains a wealth of knowledge on security dealing with Red Hat and discusses the implementation of firewalls. It also discusses and describes setting access policies for your computer and networks. It also has information on what services you actually need to be running in Red Hat and which you don’t really need. It also has details and information on Intrusion detection and how to correct any security issues that might allow for intrusion.
http://people.redhat.com/jmorris/slides/dw-RedhatSecurity.pdf
http://www.pctools.com/guides/security/
This site is an excellent source of information for individuals regarding security in Windows and various windows/Microsoft based programs. It provides a constantly updated list of the various new security issues and holes that are in windows along with information on how to patch and fix these various security issues
http://www.pctools.com/guides/password/
http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/default.mspx
http://www.microsoft.com/security/default.mspx
http://www.windowsecurity.com/securitytests/
This site provides an individual with several security tests that one can use to test and probe for various security flaws within a windows system. These tests are able to test for a variety of various web attacks that could be used on a computer and networks that are web connected.
http://bignosebird.com/apache/a11.shtml
http://www.oreilly.com/catalog/apache2/chapter/ch13.html
http://www.apachesecurity.net/
This site provides a decent guide for implementing security within an Apache Web Server in order to make it more security. It covers things such as the installation of various security tools and how to make them function properly in order to safeguard your computer.
http://www.linuxplanet.com/linuxplanet/tutorials/1527/1/
http://www.petefreitag.com/item/505.cfm
http://linuxgazette.net/143/pfeiffer.html
This is a site that describes how to secure and safeguard an Apache server with Mod_Security in order to resist and defend against various web attacks. It provides specific installation instructions and also provides instructions on how to configure and maintain it so as that it continues to provide security for Apache Web Servers.
VPN Security
http://www.cites.uiuc.edu/vpn/
http://www.nta-monitor.com/posts/2005/01/vpn-flaws.html
http://artofinfosec.com/
This is more of a site where one can post a question and see if any of the other users on the system are familiar with that particular issue in terms of security. This could prove to be a valuable resource as questions arise throughout the class that I might need answers for. The site also has users that post various articles pertaining to security as in attacks, security defenses, and fraud schemes that are currently going around and this could all prove to be very useful.
http://www.darknet.org.uk/

Submitted by Travis Cook

http://www.sans.org/resources/popular.php
The sans.org website is a good site to find information and resources related to infosec. The page gives several introductory level articles about different information security topics, but then also has a number of summaries and links to more detailed articles. Understanding methods used to violate security is a key part of safeguarding data, and this site is a good educational resource.
http://www.dnsstuff.com
I usednsstuff.com all of the time when working on networks and security. They've recently updated the site and added a few new “features” that I could do without, but this is still a great “one stop” website for looking up who owns a certain IP address, who owns a domain, checking DNS records, and numerous other tasks
http://www.coffer.com/mac_find/
This website, which contains a database of MAC addresses, is a useful resource when troubleshooting networks, and also when attempting to track down security threats. For example, if I was to look at DHCP logs and see that an IP address was being assigned to an unknown device, the only information I may have about this device is its MAC address. By inputing that address into this database, I could easily look up whether it is a computer, or a wireless access point. When trying to track down rogue devices on a network, knowing what you're looking for can be quite helpful.
http://www.grisoft.com/
For Windows users, having a good, up-to-date antivirus program is an important part of desktop security. Antivirus protection can be applied at different levels of a network, but I would never feel comfortable not having it on the client. For home users, I recommend the use of AVG Free Edition, available from this website. It has a good, light weight scanner that does not bog down systems considerably. The fact that it is free attracts many of my customers, who are fed up with paying yearly fees for software that only makes their computer run worse and is always breaking. Updates are released on a daily basis, and the program downloads and applies these updates with the same frequency.
http://www.securityfocus.com/
Security Focus is an information security news website. This site contains general news stories about new exploits and technical activities, as well as information and listings of newly discovered vulnerabilities and bugs. Keeping abreast of this information is important for anyone in infosec, as it allows me to know what exploits to be on the lookout for and what software may need to be patched.
http://neworder.box.sk/
The neworder website is one of my favorite infosec news websites. This is a site I have monitored or some time now. The site isn't updated as frequently as a site like security focus, but many of the stories which appear on it really catch my attention. Putting together this list caused me to have to explore many different infosec sites, but neworder was the only site I visited where I had to stop putting together my list to go read an article... which lead me to reading another article. The site also has a detailed list of links about infosec. Unlike some sites, neworder does not shy away from sites that contain instructions and tools for exploits. The crackers certainly aren't going to have trouble finding things like this, and so it is important that network security people have easy and safe access as well, to be aware how these tools might be used against them and conduct controlled tests
http://www.wireshark.org/
I can't even begin to guess how many times I've used protocol analyzers to identify network issues – many related to security topics. Having wireshark handy is an important thing for anyone in infosec. On many occasions, I have used it to troubleshoot firewall configuration issues. I have also used it to gain a better understanding of network packets used in attacks by monitoring controlled environments and then introducing bad packets and capturing and analyzing them with this tool.
http://ha.ckers.org/
This blog is an excellent source for summeries and links to more detained information about web-based vulnerabilities, including things like javascript, XSS, XML, CGI, and more. They also cover some general information security related stories. The site has an informal feel which makes it easier and more enjoyable to read, while not detracting from the information they present (and you can always read the original articles they link to and form your own opinion – and then debate it with others
http://www.microsoft.com/technet/Security/default.mspx
The Microsoft TechNet security center website is stop #1 if you're looking for information about securing Microsoft products against discovered vulnerabilities. The site allows downloading of tools, and has all of the security bulletins and advisories released by Microsoft. The site also contains rich educational resources about hardening Microsoft products such as Exchange or IIS, not to mention XP, Vista, or Windows Server products.
http://www.grc.com/default.htm
The Gibson Research Corporation website is a site which contains a number of tools and web applications related to information security. While I like to take a large portion of the site and it's products with a grain of salt, the site does contain a number of tools and scanners which can provide information that, to an information security professional who knows how to interpret the results, rather than buying into everything Gibson may be trying to sell, may be helpful in identifying vulnerabilities. These include tools such as ShieldsUp and LeakTest, and a patch detection tool for IIS.
http://www.acunetix.com/websitesecurity/
http://www.cs.technion.ac.il/~itaish/software_security.htm
http://www.deter.com/unix/
http://www1.umn.edu/oit/security/resources/OIT__26762_REGION1.html
http://www.windowsecurity.com/
http://tldp.org/HOWTO/SSL-RedHat-HOWTO.html
http://thinkhole.org/wp/2006/03/28/ipcop-openvpn-howto/
http://www.ranum.com/security/computer_security/index.html
http://www.cert.org/tech_tips/home_networks.html
http://ipcop.org
ftp://ftp.porcupine.org/pub/security/index.html
http://www.cerias.purdue.edu/tools_and_resources/
http://www.zone-h.org/
http://www.dnssec.net/
http://www.xssed.com/

Submitted by Trevor Bryant

http://www.wireshark.org
Wireshark is a packet “sniffing” tool. It works by capturing/identifying all the packets that go across your network. Wireshark is a helpful tool when trying to diagnose a variety of network issues.
http://www.ipcop.org/
Ipcop is a open source firewall application. Ipcop fits onto a single cd and can be installed on an old extra pc that you have lying around. Ipcop is an excellent alternative to expensive name brand firewalls. It can provide the same features as name brand firewalls.
http://nmap.org/
Nmap is a security scanning tool. It can be used to identify and discover open ports on a network. It is useful when trying to figure or verify what ports are open or being blocked on a computer/network. Nmap can also detect what OS is running on a remote machine.
http://snort.org
Snort an open source network intrusion prevention system. It capable of capturing, logging, and analyzing network traffic. It can be used to decect a variety of network attack such as buffer overflows, and port scans.
http://www.openwall.com/john/
John the ripper is a piece of open source software. It's a password cracker. Cracking passwords can be useful in determining if the passwords you are using are secure enough. The longer it takes for the program to crack a password, the more secure you password is.
http://www.kismetwireless.net/
Kismet is a network detector, packet sniffer, and intrusion detection system for wireless networks. It works with any wireless network card that can be put into monitor mode. Kismet can also be used to crack WEP keys if needed.
http://www.networksecuritytoolkit.org/nst/index.html
Network Security Toolkit is a set of network security software that can be installed as a separate OS. It is based on Fedora. It can easily be installed from a single CD. This software is useful because it contains a wide variety of useful network security software.
Metasploit is another piece of open source software. It provides information about security vulnerabilities. Metasploit can be used to exploit code against a machine on your network if you need to test the security of that machine.
http://sourceforge.net/projects/pwgen
Pwgen is a simple piece of software used to create complex passwords. It can be useful when creating a secure password.
http://www.linuxtopia.org/online_books/redhat_linux_security_guide/index.html
http://bizsecurity.about.com/od/internetsecurity/ss/secureiissteps_4.htm
http://www.acunetix.com
http://www.grc.com/securitynow.htm
http://www.ntop.org
http://freeworld.thc.org/home.php
http://cve.mitre.org/
http://metasploit.org/
http://www.chkrootkit.org/
http://www.chiark.greenend.org.uk/~sgtatham/putty/
http://www.openpgp.org/index.shtml
http://www.netfilter.org/
http://www.cert.org/
http://www.nsa.gov/selinux/
http://www.apachesecurity.net/
http://www.securityfocus.com/
http://www.stumbler.net/

Submitted by Zachary Gauthier

http://insecure.org/
Insecure.org is a website containing links to many security related news lists. It is also the homepage of the Nmap security scanning software. Nmap is basically a command line based port scanner that can be very useful for network security auditing.
http://freshmeat.net/
Fresmeat.net, though not specifically a security-based website. Hosts the files for many open source projects. It is a valuable resource when one needs to get software in a timely fashion.
http://ettercap.sourceforge.net/
Ettercap is a suite of software designed for packet sniffing and man in the middle attacks. MITM attacks allow a hacker to capture packets even on a switched network. Ettercap can even crack some ciphered protocols and present the information within.
http://www.iptablesrocks.org/
Iptables is the part of the linux kernel that deals with filtering and routing packets. It's the firewall at its lowest level. This website has valuable information about iptables and instructions on implementing it from the command line.
http://www.snort.org/
Snort is a very popular intrusion detection application. Their websites hosts downloads, tutorials, and a forum for snort users to discuss the software. Snort is highly customizable by the use of "rules."
http://www.chiark.greenend.org.uk/~sgtatham/putty/
Putty is a very simple, yet powerful telnet/ssh client. Putty can be very useful in the act of circumventing firewall rules by the use of its built in ssh tunneling capabilities. Their website also has frequently asked questions and documentation on the software.
http://netcat.sourceforge.net/
Netcat is a powerful networking utility designed to create network connections. It can be used as everything from a port scanner to an FTP server. Netcat can be made to run under about every operating system under the sun.
http://www.nessus.org/nessus/
Nessusa is a very thorough network security scanner. Nessus can scan entire networks, individual hosts, and specific applications. It comes programmed with thousands of different vulnerabilities for many different services and actually attempts to exploit those vulnerabilities to test security.
http://www.wireshark.org/
Wireshark, formerly known as ethereal, is a passive network monitoring application. It puts a network device into promiscuous mode allowing for the capture of any packets on the wire(or air). Wireshark is very useful for gathering information about a network.
http://www.kismetwireless.net/
Kismet is a toolkit for wireless network auditing. It has the ability to detect networks that don't send beacons by listening for their traffic. It is highly customizable and suitable for many applications.
http://usertools.plus.net/tutorials/id/21
http://www.geocities.com/floydian_99/aut3.html
http://thinkhole.org/wp/2006/03/28/ipcop-openvpn-howto/
http://www.zerina.de/?q=documentation/howto-roadwarrior
http://labmice.techtarget.com/windows2003/IIS/default.htm
http://tldp.org/HOWTO/SSL-RedHat-HOWTO.html
http://www.linuxtopia.org/online_books/centos_linux_guides/centos_linux_security_guide/index.html
http://www.nsa.gov/selinux/
http://www.linuxjournal.com/article/9398
http://www.redhat.com/docs/manuals/linux/
http://www.first.org/resources/guides/#bp11
http://labmice.techtarget.com/windows2003/IIS/default.htm
http://www.securityfocus.com/infocus/1694
http://www.apachesecurity.net/
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx
http://www.theiia.org/certification/certified-internal-auditor/