The Network Security. Org

One of the biggest headaches for wireless security auditors is the lack of standardization of the tools they use to perform their tests. You have Windows based tools, such as Netstumbler and Airmagnet, but if you want to run Kismet or coWPAtty, then you have to stick to Linux. To make it more confusing, some tools, like Karma, were written specifically with Fedora Core in mind, where others will only run on Redhat 9 and this doesn't even address hardware issues. While it is getting better, I personally have around ten different wireless network cards because each program requires a specific driver that requires a specific chipset. For example, Airmagnet runs only on my NetgearAG, and Network Chemistry will only work with my LinksysAG.

For programs like Airpwn, I have found that it works best with two Senao cards. And then there is the TrueMobile (Orinoco), which was the only card Netstumbler would originally work with. Oh, and don't forget PDA based stumbling, I have two CF cards just for my collection of handhelds. The point is this: wireless security tools are anything but simple... except for KisMAC.

A complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library.

IPV6 project. This code was inspired when I got into touch with IPv6, learned more and more about it and then found no tools to play (read: "hack") around with. First I tried to implement things with libnet, but then found out that the ipv6 implementation is only partial - and sucks. I tried to add the missing code, but well, it was not so easy, hence I saved my time and quickly wrote my own library.

Over the course of part two in this article series we covered both netcat and ettercap. What we shall now cover in the final part of this series is a packet crafter and an HTTP proxy. Read on to find out more about these very powerful tools of the trade.

So far in this article series based on tools used in the computer security industry we have gone over quite a few of the most commonly used tools. We have so far looked at a packet sniffer, a network scanner, the incredibly useful netcat, and man in the middle suite of tools known as Ettercap.

Kismet detects the presence of wireless networks, including those with hidden SSIDs. It can discover and report the IP range used for a particular wireless network, as well as its signal and noise levels. Kismet can also capture or ?sniff? all network management data packets for an available wireless network. You can use Kismet to locate available wireless networks, troubleshoot wireless networks, optimize signal strength for access points and clients, and detect network intrusions.

For a Swiss Army knife of wireless network diagnostics, "NetStumbler" is saddled with a somewhat unfortunate name. Although it implies a sort of blind luck, NetStumbler is actually most useful for pinpointing details of a wireless network, helping you configure, secure, optimize and discover.

NetStumbler calls itself "beggarware," meaning that it is free (but not open source), although they request a $50 donation from commercial and government users. The latest version (0.4.0 as of this writing) is available for download from netstumbler.com and stumbler dot net.

The USB Wireless Security lock is a simple yet effective means to ensure computer access is limited to an authorized user. Each kit is composed of a USB receiver dongle connected to the computer, and a battery powered access transmitter, which is to be carried by the authorized user. When the user moves more than 2 meters away from the computer, the security dongle will disable access to the computer until the user carrying the transmitter has returned within the vicinity of the computer.

By familiarizing yourself with following software, you will not only have a better understanding of the vulnerabilities inherent in 802.11 networks, but you will also get a glimpse at how a hacker might exploit them. These tools can even be used when auditing your own network as we will see later.

Most serious hackers and network auditors use the open source operating system Linux as the platform from which they launch attacks and perform analysis.

diStorm64 is an AMD64 disassembler, which is the first open source disassembler library for AMD64 out there, licensed under the BSD license.

diStorm is a binary stream disassembler. It's capable of disassembling 80x86 instructions in 64 bits (AMD64, x86-64) and both in 16 and 32 bits. In addition, it disassembles FPU, MMX, SSE, SSE2, SSE3 and 3DNow! (w/ extensions) and new x86-64 instruction sets. diStorm was written to decode quickly every instruction as accurately as possible. Robust decoding, while taking special care for valid or unused prefixes, is what makes this disassembler powerful, especially for research.

This article, the last in the series about Nessus, will endeavor to explain a Nessus report and how to analyze it. Nessus is a vulnerability scanner, a program that looks for security bugs in software. The first article explained how to install Nessus and a basic overview of features. The second article gave general rules of thumb for various scanning situations. It is suggested that you review the first two articles before reading this one.

This article, the second in the series, will attempt to provide direction through the actual scanning process, general logic and rules of thumbs for parameter choices in different situations. If unfamiliar with Nessus, a reading of the first article will provide needed background information.

These days, when your core main switch starts throwing errors, you can match IPs and MAC addresses from the console of one network tool to another, trace cables in closets, and read switch logs to track down the problem device and its user. Or you can enter the problem IP in your Locate network appliance and go directly to the problem machine and its user to resolve the issue typically a bad network card or an incorrect network protocol.

In part one of this article series we went over some must have tools like a packet sniffer and network scanner. We also covered their installation and basic usage examples. What we shall now do in part two is cover some of the other tools that should definitely be in your arsenal of computer security tools. Please bear in mind again that with XP SP2 a lot of computer security tools were broken. I shall point out on what platform I am installing the tool on, and will also mention if it can be used on XP SP2. Barring that, simply install the tool on either an XP SP1 computer or Windows 2000 Professional one.

Nessus is a great tool designed to automate the testing and discovery of known security problems. Typically someone, a hacker group, a security company, or a researcher discovers a specific way to violate the security of a software product. The discovery may be accidental or through directed research; the vulnerability, in various levels of detail, is then released to the security community. Nessus is designed to help identify and solve these known problems, before a hacker takes advantage of them.

How many times have you been traveling and, hours or even days after plugging your laptop into the broadband connection in your hotel room, you realize you didn't change your PC configuration from your office setup to something more secure?

Discovering that you've exposed your local shares to the world, even if they are read only, is sobering.

INSERT is a complete, bootable linux system. It comes with a graphical user interface running the fluxbox window manager while still being sufficiently small to fit on a credit card sized CDROM.

INSERT contains a multitude of useful tools to be at your hand in a variety of situations

Your network has slowed to a crawl, which has become more than a nuisance it means that you are losing business. Sure, you could pay for a consultant, technician or product, but why bother with an expensive, for-pay solution, when the answer may be as simple as downloading and using free and Open Source software?

Being in the computer security field means that you are always striving to stay current. You are always trying to learn new tools, and understand new exploits. That said there are also some tools that simply aren?t going to go away any time soon and are really necessary to learn. Over the course of this three part series we will look at some of the best known hacking tools. After all, it pays dividends to know just how your enemy works and more specifically with what.

Tomahawk is a command line tool for testing network-based intrusion prevention systems (NIPS). To date, the tools for testing NIPS have been expensive and limited in functionality. They are typically designed for testing other products, such as switches (e.g., SmartBits/ IXIA), server infrastructure (e.g., WebAvalanche), or Firewalls and Intrusion Detection Systems (Firewall Informer or IDS Informer). None of these tools simulate the harsh environment of real networks under attacks.

Here is the list of tools we commonly use in pentesting wireless networks or just wardriving for fun and no profit. All these tools are covered in the book in sufficient details. Some of them may become obsolete at the time the book hits the shelf and so are not possible to find anywhere anymore, so they are located on our site. The reason for it is the dialectic approach we endorse: to understand things as they are now, you are ought to know where did they come from and how did they develop. Besides, you may find the snippets of code from these tools to be useful for your own projects.

TrueCrypt 4.1 is a free and open source encryption tool, for both Windows and Linux, that bridges a lot of the gaps left by conventional encryption applications. It lets you create a password protected encrypted disk either in a standalone file, or on an entire physical partition or volume on a device which is then mounted, read and written to just like a regular drive. Any file and any device that can be mounted as a filesystem can be used, from regular hard disks to USB flash drives.

Network security vulnerabilities are being detected on a daily basis over 10,000 in the last two years alone. At the same time, the window of opportunity to remediate these vulnerabilities is decreasing from months to days. In today's complex network architectures, relying on open source tools or a simple port scanner is no longer sufficient for comprehensive vulnerability assessment.

Retina? Network Security Scanner, recognized as the industry standard for vulnerability assessment, identifies known security vulnerabilities and assists in prioritizing threats for remediation.

Hopefully, you have heard of some of these or maybe even all, but if not then let me introduce you to ten tools that every admin should have. In no particular order?

1. VMWare / Virtual PC / Virtual Server

Virtualization products are great because they allow you to test everything you want/need without having to destroy your machine or sit with a half dozen computers around you all day long. They may keep you warm, but you could go deaf while you slowly go bankrupt paying for all the electricity.....

Net Tools contains a whole variaty of network tools. Here are some key features of "Net Tools": 1) IP Address Scanner 2) IP Calculator 3) IP Converter 4) Port Listener 5) Port Scanner 6) Ping 7) NetStat (2 ways) 8) Trace Route (2 ways) 9) TCP/IP Configuration 10) Online - Offline Checker 11) Resolve Host &\1 IP 12) Time Sync 13) Whois

.....After some searching, I found TightVNC that is a free remote desktop application available for Windows. Install and setup was a breeze, and I was up and running in under 5 minutes. This is a great little program. So, if you can?t get remote desktop to work, then try this out. And I really hope that Microsoft is going to change how remote desktop works in Vista Media Center. If people are going to be hooking their home theater up to their PC, then they will need another way to conveniently run maintenance and upgrades on their home theater PC.

IP Sniffer is a suite of IP Tools built around a packet sniffer. The packet sniffer can work on all Windows versions using either the new raw socket implementation of Windows2000 (driverless) or WinPcap (needs to be installed) or a NDIS protocol (needs to be installed , no reboot). The sniffer has basic features like filter, decode, replay, parse?

ArpCacheWatch monitors Windows ARP cache and allows to send an ARP request to obtain the physical address that corresponds to the specified destination IP address. The ARP cache contains IP/MAC translations so that every time an IP packet are to be sent, the MAC address doesn?t have to queried through a broadcast, instead it can use the cached address.

VNCPush pushes the VNC Server application onto any remote host running a Windows NT/2000/XP operating system. The VNCPush framework is very portable and lightweight, requiring very low disk space and system resources. In addition to pushing the VNC Server application to remote hosts, VNCPush includes the ability to remove or 'pull' VNC when it is no longer needed.

The development of VNCPush focused on the needs of consultants who face a variety of support issues. VNCPush has since proven to be an effective tool in managing enterprise environments as well. From solving problems at remote offices to interactively assisting users with desktop applications, the VNC platform provides flexability that Terminal Services cannot.

The free version of NetTools - a great solution for host monitoring, measuring your network performance, and quickly diagnosing network problems. It consists of the four most powerful tools from the Professional version: NetWatch (host monitoring) with graphical multiping, a history of response time and percentage of packets lost for monitoring host availability, ping, fast trace (full trace in 1 second), and lookup. What makes NetTools unique, according to our customers, is the fact that it has the most highly intuitive user interface.

Anyone who needs to support local or remote Windows users will find UltraVNC a must-have tool. UltraVNC is an easy to use, fast and free sotware that can display the screen of another computer (via internet or network) on your own screen. The program allows you to use your mouse and keyboard to control the other PC remotely. It means that you can work on a remote computer, as if you were sitting in front of it, right from your current location.

If you provide computer support, you can easy access your customer's computers from anywhere in the world and resolve helpdesk issues remotely ! Your customers don't have to pre-install software or execute complex procedures to get remote helpdesk support. UltraVNC allows you to remotely control a computer over any TCP/IP connection.

Ethereal is used by network professionals around the world for troubleshooting, analysis, software and protocol development, and education. It has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product. Its open source license allows talented experts in the networking community to add enhancements. It runs on all popular computing platforms, including Unix, Linux, and Windows.