Security, Penetration Testing, Hacking, and Intrusion Detection Tips for Admins

The focus and goal is to provide information to help Windows NT / W2K / XP administrators protect their networks.

If you have a document or link to a resource which should be added to this site, .

Hits: Failed to execute CGI : Win32 Error Code = 3

Netscape Users Press (CTRL-B)

--- A --- IDS, PT, Hacking Tips

• My PT resource pages :
  • Tips with enough info that I pulled them out the index page and made them a separate tip. Or I had a special interest. Or its a personal tip. Or it was very important.
    
  • Whats New
  • #1: SmbRelay captures NTLM hashes
    
  • #2: Ethereal free network protocol analyzer for Unix and Windows
    
  • #3: Wayne's Security Resources for Administrators
    
  • #4: nslookup and DNS Zone Transfers
    
  • #5: VNC stands for Virtual Network Computing
    
  • #6: SQL Server worm exploits blank sa password
    
  • #7: ssh server vulnerability
    
  • #8: Forensics
    
  • #9: Demarc Security's Opensource IDS PureSecure
    
  • #10: Sample security policies and guidelines
    
  • #11: Stenography Resources
    
  • #12: Password Recovery Resources
    
  • #13: Scanners
    
  • #14: Snort
    
  • #15: Advisories, Alerts, Exploits
    
  • #16: tcpip resources
    
  • #17: Legal Resources
    
  • #18: Backdoors - backorifice, subseven, netbus
    
  • #19: Denial of Service (DoS)
    
  • #20: Change Detection / Integrity Resource /Rootkits
    
  • #21: netcat ( nc ) utility resources
    
  • #22: Keystroke loggers and spy software / hardware
    
  • #23: Wireless security resources
    
  • #24: Perl resources
    
  • #25: dd resources
    
  • #26 : Hacker Training Courses
    
  • #27 : Tutorials / whitepapers
    
    Consider a contribution to help keep my site on the air. The traffic has increased to much more than a non-commerical resource site can support. : $1, $2, $5, $10, ...
    
• ACLs :
  • ACL tools
    ACL tools contains two tools: lsaacl and samacl. They are ACL editors for the LSA and SAM objects. Just like files, registry keys, and most every other object in NT, LSA and SAM objects have security descriptors. Normally, these are invisible, as the standard tools for managing the SAM and LSA don't display them. However, they are there, and lsaacl and samacl let you display and edit them. lsaacl and samacl are demostration programs from the Null Session and MSRPC concepts discussed at BlackHat Windows 2000.
• ActiveX :
  • Script Language Security
    
  • Security Evaluation pdf, free download, CERT document
    
• Advisories :
  • Alerts, Exploits, Advisories
    
• Administrator :
  CheckAdmin : who is a member of the Administrator group NT, free
  
• Anonymity :
  • Anonymity Resources
    
  • Anonymity Tutorial
    
  • Anonymous and Pseudonymous communications and systems Bibliography
    
• ARP :
  • Middleware approach to asynchronous and backward compatible detection and prevention of ARP cache poisoning
    
  • ArpWatch
    tool that monitors ethernet activity and keeps a database of ethernet/ip address pairings. It also reports certain changes via email. Arpwatch uses libpcap, a system-independent interface for user-level packet capture. Platforms: AIX, BSDI, DG-UX, FreeBSD, HP-UX, IRIX, Linux, NetBSD, OpenBSD, SCO, Solaris, SunOS, True64 UNIX, Ultrix, UNIX
• Attack Lab Design & Security Mini How-To
  
• Attack Trees
  article by Bruce Schneier
• Audit :
  • Conducting a Security Audit: An Introductory Overview
    
  • CORE's Remote Auditing
    Audit is a client/server tool that allows remote system logs auditing and centralizing. The server (auditd) runs, commonly, on audited (vulnerable) machines and the client (audit) on the auditors workstations. Multiple auditors are supported and managed by one or more auditors 'chiefs'; each auditor can be configured in a way allowing them to examine specific sets of logs and certify that possible intruders did not modify them. Its modular design allows custom made authentication methods; other log sources and formats can be easily supported. All data transfers between both parties are encrypted.
    freeware, sourcecode
  • GAO and State Auditors Release Security Auditing Guide
    The US Government Accounting Office and twelve state and local auditing agencies jointly published a comprehensive and thoughtful roadmap for security audits.  Among the many important guidelines was an unequivocal requirement that auditors who audit access control (including penetration testing) and system software must have specialized technical skills such as knowledge of security configuration requirements and how to test for them on both servers and applications as well as advanced knowledge of network hardware, software and protocols.
  • SAL : Secure Auditing for Linux
    project funded by the Defense Advanced Research Projects Agency (DARPA). The project will develop a kernel level auditing package for Red Hat Linux that is compliant with the Common Criteria specifications (C2 level equivalency) and provides features to protect logged information from unauthorized modification through the use of encryption techniques.
• Authenication :
  • Linux - HTAccess Authentication
    usernames and encrypted passwords are kept in a webmaster-maintained file
    
  • Linux - PAM ( Pluggable Authenication Modules)
    linux apps can be authenicated by NT
    
  • LM Authentication on Windows NT, How to Disable MS's Q147706
    
  • GINA : NT's Graphical Identification and Authentication DLL fakegina
    
  • Tivoli : Multiphased authentication with Tivoli Access Manager fakegina
    

--- B --- IDS, PT, Hacking Tips

• Backdoors:
  • Backdoors - backorifice, subseven, netbus
    
  • Detecting Backdoors
    
• Biatchux : portable bootable cdrom for forensics purposes Biatchux is a portable bootable cdrom based distribution with the goal of providing an immediate environment to perform forensic analysis, incident response, data recovery, virus scanning and vulnerability assessment. Also capable of providing necessary tools for live forensics/analysis, just mount the cdrom on your choice of OS win32, sparc solaris and x86 linux trusted static binaries are available in /statbins.
  
• Biometrics :
  • Fun with Fingerprint Readers : fooling fingerprint readers
    
  • On the distinction between Biometric and Digital Signatures
    
• Blackberry :
  Forensic Examination of the Blackberry Wireless Device
  
• Black-hat :
  Motives and Psychology
  
• Books:
  Hacking, Intrusion Detection and Penetration Testing
  
• BrowseList:
  • retrieves browse list from Windows systems
    returns computer names, roles they play in the network, and system comments
    NT, free
    
  • X-Ways Trace: Browser Log Files Deciphered
    forensics tool that allows to track and examine the web browsing activity that took place on a certain computer
    
• Bugs:
  • Bug of the day
    
  • Bugnet
    
  • NTBugtraq: security exploits and security bugs in Windows NT mailing list
    
• Buffer overflows:
  • Exploiting Windows NT 4 Buffer Overruns whitepaper
    
  • suidperl exploit Intel Linux buffer overflow example
    
  • UNIX Security: the Buffer Overflow problem
    

--- C --- IDS, PT, Hacking Tips

• carbonite :
  • Linux Kernel Module to aid in RootKit detection
    
• CGI :
  • CGI scanner
    freeware,perl source code, want to experiment?
    
  • cgichk vulnerability scanner
    freeware,searches for a series of interesting directories and files on a given site
    
  • G-Lock: CGI vulnerability scanner
    commercial, trialware, NT, part of AATools
    
  • Whisker : CGI vulnerability scanner
    perl-based, freeware, linux, recommended
    
• Change Detection :
  • Integrity check | rootkit | change detection resources
    
• Checklists :
  Microsoft Security Checklists for Member Server, Workstation, Domain Controller, IIS, ...
  
• Cheops :
  locate, access, diagnose, and manage network resources
  
• Chkrootkit :
  tool to locally check for signs of a rootkit
  
• Chronicle :
  Determine the current service pack/hotfix level of all Windows NT machines on NT domain
  
• CIS:
  Cerberus' Internet Scanner free
  
• Cisco:
  • Password Recovery Procedures requires physical access
    
• CMOS Password Recovery Tool : GNU license
  
• Commands:
  • 
    All major operating systems, including AIX; Solaris; RedHat Linux; Berkeley BSD; NetWare 3.2, 4.11, 5, and 6; DOS 6.22; Windows 95, 98, ME, XP, NT 4 Workstation, NT 4 Server, NT 4 Terminal Server, 2000 Professional, 2000 Server, 2000 Advanced Server; Citrix Mainframe 1.8; and Mac 9.
• Compromise:
  • Steps for Recovering from a UNIX or NT System Compromise
    
• Cookies:
  • Cookie Cop : manage cookies and block popups
    
• Cracking:
  • Anti Cracking FAQ
    
  • Cracking
    
• Cryptography:
  • Cryptographic Filesystems: Design and Implementation
    
  • 
    a good place to start

  • 
    business orientation

    
    

    Handbook of Applied Cryptography
    All the chapters are available for samples.

    
    a good read, not a technical briefing

    
    

• Cyber Attacks:
  Cyber Attacks during the War on Terrorism: A predictive analysis
  
  
• Cygwin:
  • Cygwin
    
  • Cygwin user manual
    

--- D --- IDS, PT, Hacking Tips

• Davory undeletes files and recovers files from logically corrupted or formatted drives
  
• Disaster Recovery:
  • Secure Deletion of Data from Magnetic and Solid-State Memory
    
  • DOE's Operaton Fresh Start
    lots of info on recovering from full disasters
  • The Info-Gathering Tutorial
    
• Discovery :
  • SilentRunner : perform network security analysis create network knowledge base
    

• DLLs:

• Domtools :

• DomTools : Name server query tools
  Allow you to traverse DNS domain hierarchies, list all hosts (or subdomains) within a given domain, convert host name to IP address and vice-versa, convert a normal IP address to the "in-addr.arpa." format and vice-versa, and more. These commands can be used manually, or included as building blocks for higher level DNS tools. They generate output that is easily computer parsable.

• Domain Hijacking :

• DoS / DDos :

• Wayne's Denial of Service Resource
  

• DNS :

• DNS Cache Poisoning - The Next Generation
  
• dns hijacker
  
• DNSwalk DNS debugger
  
• RFC1912: Common DNS Operational and Configuration Errors
  
• Securing an Internet Name Server
  

• Drivers:

• Device Filter Utility
  utility shows you all kernel-mode drivers loaded on your Windows NT4.0/2000/XP system and device objects created by these drivers. It also allows you to hook any of these devices (not more then 10 simultaneously) and monitor all requests to selected devices delivered to their dispatch table. Please, note that it hooks selected device, not that one which can be on top of this device. This approach allows you to see the IRP path down the device stack, an example to check if it was blocked by upper level filter.Jan 2002

• DSniff:

• sniffing networks for passwords penetration testing. unix, freeware
  
• Dsniff : Finding dsniff on Your Network
  

• Dump:

• DumpEvt: dump NT event log in a format suitable for importing into a database
  freeware, must have for NT admins
  updated for W2K (DNS, File Replication, and Directory Service)
• DumpReg: dumps the registry
  freeware, must have for NT admins
  the registry entries can be sorted by reverse order of last modified time
• DumpSEC: dumps NT permissions and audit settings
  freeware, for the file system, registry, printers and shares
  dumps NT user, group and replication information
  must have for NT admins
  

• DUN:

--- E --- IDS, PT, Hacking Tips

• EFS flaw :
  • http://archives.neohapsis.com/archives/bugtraq/2001-01/0324.html
    
  • http://archives.neohapsis.com/archives/bugtraq/2001-01/0358.html
    
  • http://archives.neohapsis.com/archives/bugtraq/2001-01/0365.html
    
  • SANs - The Encrypting File System: How Secure is It?
    
  • Howard Wright's The Encrypting File System: How Secure is It?
  • Roberta Bragg's Hardening EFS
  • Determine whether Syskey has been applied to a system
• Email :
  • E-Mail Bombs and Countermeasures
    
  • ORDB : Test an open relay
    
  • NetWIN : Test an open relay
    
  • Reading Email Headers
    
  • Spam Combat
    
  • Tracking Spam
    
  • Tracking E-mail
    
• Encryption :
  • Encryption Tutorial
    
  • Hard drive encyrption:
    • DriveCrypt: 256Bit Hard Disk Encryption
      
    • Norman: full or partial hard disk encryption
      
    • Pointsec : boot protection, pre-boot authentication and strong encryption
      
    • SafeBoot: encrypt floppy disks, hard disks, network drives CD-ROM's, XP compliant
      
    • SafeGuard: full or partial hard disk encryption, XP compliant
      
    • SafeHouse: "on-the-fly" encryption for your notebook or desktop personal computer
      
  • Rijndael : Advanced Encryption Standard
    
  • RSA Algorithm Javascript Page
    
• Ethernet:
  • Ethernet Bridge
    This is a small utility (driver and console application) for MAC level bridging TCPIP bound network interfaces. It can be used an example for bridging wireless and wired Ethernet when IP address space can't be divided into subnets.Jan 2002
  • Receive-only Ethernet Cable
    
• Ethereal :
  network protocol analyzer for Unix and Windows freeware
  
• Event Logs:
  • NTLast : Free NT Security log analyzer
    Identify and track who has gained access to your system
    
  • NT Security Event Log Descriptions
    
  • Windows NT/2000 Event Logs
    focus on automation
  • Winzapper : Selectively erase event records NT/W2K Security Log.
    
• Evidor tool for proving the presence or absence of confidential data on computer media, either to detect a security leak or confirm a lack thereof. With Evidor you often finds remnants (or even intact copies) of classified data that should have been encrypted, securely erased, or should not have existed on a media in the first place.
  
• Exploits:
  • Blackcode site
    
  • Blended attacks, exploits, vulnerabilities, and buffer-overflow techniques in computer viruses
    Symantec
    
  • Buffer Exploits tutorial
    
  • ComputerPS vulnerability index
    
  • Favorite NT Exploits
    
  • Fyodor's Exploit World! Micro$oft Section
    
  • Patchwork Internet Anti-Intrusion Patch Verification and Intrusion Evidence Scanner — for Microsoft Windows NT
    
  • Securiteam's Exploits NT focus
    
  • SecurityFocus's Exploits ****** Recommended Site ******************************
    
  • SecurityTracker
    
  • Windows Security Guide details about the latest vulnerabilities and fixes, articles and technical support
    

--- F --- IDS, PT, Hacking Tips

• FAQ:
  • COM Security FAQ
    
  • Network Intrusion Detection
    
  • NT Hack v2
    
• Fingerprinting :
  • IDing remote hosts, without them knowing Honeynet Project
    
  • Winfingerprint
    
• Firewalk:
  Firewalk - active reconnaissance network security tool
  
• Firewalls:
  • Wayne's Firewall, VPN, Intrusion Detection, and Router Tips
    
  • Firewall Penetration Testing
    
• Forensics:
  • Wayne's Forensics and Incident Response Resources
    
• FPNWCLNT:
  Security Problems of NT's FPNWCLNT.DLL
  
• FreeBSD:
  • 
    
• FTP:
  • ftpcheck scans hosts and networks for FTP and anonymous FTP archives very fast
    
  • Windows NT FTP Server
    

--- G --- IDS, PT, Hacking Tips

• Gauntlet:
  • Gauntlet Support Website
    
• GINA:
  NT's Graphical Identification and Authentication DLL fakegina
  
• Glossary:
  • Microsoft Security Advisor Program: Glossary of Terms
    
• Grinder :
  Scan an IP addresses for webservers with a certain URL
  
• Guest :
  DelGuest: deletes the built-in Guest account in Windows NT free utility
  
• Guides:
  • Corsaire : Penetration Testing Guide
    
  • Corsaire : Application Testing and Code Review Guide
    
  • Knockin' At Your Backdoor : A Guide to Penetration Testing
    
  • Open Source Security Testing Methodology Manual v. 1.5
    
  • Open Source Security Testing Methodology Manual v. 2 Draft
    
  • Vulnerability Testing of Software System Using Fault Injection
    

--- H --- IDS, PT, Hacking Tips

• Hack :
  • Addressing Common Hacker Exploits
    
  • 
    book recommendation
    
  • Downstream Liability for Attack Relay
    
  • a method of cataloging hacks whitepaper
    
  • Attackers and their tools Entercept whitepaper
    
  • Break into Windows NT
    
  • Break into Windows NT : Backdoors netcat
    
  • Hackers' Tricks to Avoid Detection
    
  • 
    book recommendation
    
  • 
    book recommendation
    
  • Hacking Step by Step
    tutorial
    
  • Home computing self-defense
    happyhacker.org(May 2001)
    
  • Improving the Security of Your Site by Breaking Into it
    book recommendation
    
  • Hacking Lexicon - what do the terms mean?
    
    
  • Maximum Security: A Hacker's Guide to Protecting Your Internet Site and Network
    online book
    
  • Modern Hacker's Desk Reference Rhino9 ebook
    
  • Hacker's Handbook 1985 (out of date but interesting)
    
  • NT Hack FAQ v2
    
  • Techniques Adopted By 'System Crackers'
    
  • Try2hack try your skills out
    
• Hardening
  
• Hard drive encyrption:
  • DriveCrypt: 256Bit Hard Disk Encryption
    
  • Norman: full or partial hard disk encryption
    
  • Pointsec : boot protection, pre-boot authentication and strong encryption
    
  • SafeBoot: encrypt floppy disks, hard disks, network drives CD-ROM's, XP compliant
    
  • SafeGuard: full or partial hard disk encryption, XP compliant
    
  • SafeHouse: "on-the-fly" encryption for your notebook or desktop personal computer
    
• HexEditor:
  • Freeware Hex Editor
    
  • WinHex: Hex Editor for Files, Disks & RAM
    
• Hashes :
  Modern password hashing for your software and your servers
  based on the Blowfish block cipher, provided via the crypt(3) and a reentrant interface
  
• Honeypot :
  • 
    
    
  • Distributed Honeypot Project
    
  • Honeypots: Definitions and Value of Honeypots
    
  • The Honeynet Project
    
  • Know your enemy : Honeypots
    
  • LaBrea Tarpit program that creates a tarpit or, as some have called it, a "sticky honeypot". LaBrea takes over unused IP addresses on a network and creates "virtual machines" that answer to connection attempts. LaBrea answers those connection attempts in a way that causes the machine at the other end to get "stuck", sometimes for a very long time.
    
• Hping:
  Create custom ICMP/UDP/TCP packets
  
• HTR:
  eEye IIS webserver exploit
  

--- I --- IDS, PT, Hacking Tips

• IANA:
  • Protocol Numbers and Assignment Services
    
• ICMP:
  • ICMP Usage in Scanning : the complete know-how
    
• Identity:
  • 
    
  
  
• IDS:
  • Wayne's Firewall, VPN, Intrusion Detection, and Router Tips
    
• IE:
  • Internet Explorer Home Page Microsoft
    
  • Internet Explorer Security Issues (1996-2000)
    
  • 
    

  • Guninski's IE Security page
    
• IIS:
  • Breaking IIS, Securing IIS by BREAKING
    
  • Code Red Worm .ida
    
  • Hide IIS Script Code
    
  • htr exploit, eEye IIS webserver exploit .htr
    
  • ODBC, Web Application Disassembly with ODBC Error Messages
    
  • Security implications
    
  • Shadow Enterprise Web Firewall for IIS
    
  • TechRepublic's Securing your IIS 4.0 server
    
  • Unauthorized ODBC Data Access with RDS and IIS
    
• Incident Response:
  • Wayne's Forensics and Incident Response Resources
    
• Identification:
  • HMAP : Technique and Tool for Remote Identification of HTTP Servers
    
• Info Security:
  • U.S. Information Security Law
    
• IP:
  • IP Insecurity ComputerWorld article
    
  • IP spoofing Department of Computer Science, Princeton University
    
  • IP spoofing Demystified ==Phrack Magazine==
    
  • IP Spoofing : A Mammoth Description
    
  • IP Subnetter Free Utility
    calculates subnets, subnet mask, binary hosts, binary masks, broadcast address, host range, and more
    
  • WhatIsMyIpAddress : reveals secrets behind your IP address
    
• IPSEC:
  • Using IPSec to Lock Down a Server
    
• IRPAS:
  • Internetwork Routing Protocol Attack Suite
    Supported protocols
    • CDP
    • IRDP
    • IGRP
    • EIGRP (discovery)
    • RIPv1 (discovery)
    • RIPv2 (discovery)
    • OSPF (discovery)
    • HSRP
    • DHCP DORA
    • ICMP redirects

--- J --- IDS, PT, Hacking Tips

--- K --- IDS, PT, Hacking Tips

• Keystroke Loggers / Spy software:
  • Keystroke loggers and spy software links
    

--- L --- IDS, PT, Hacking Tips

• Lance:
  • Lance's Security Papers
    
• Laptops:
  • Laptop Security Guidelines
    
• LAW:
  • Finding fences in cyberspace: privacy and open access on the Internet
    
  • Cyberspace Law: Hacking, cracking, viruses, and security
    
• Layer 2:
  • Layer 2 Attacks and their mitigation
    
• LDAP:
  • RFC1777 : Lightweight Directory Access Protocol
    
• Legal:
  • Hacking Legal Resources
    
• Linux:
  • Bastille-1 Hardening Program
    Security Hardening Program for Red Hat Linux
    
  • Crash Recovery for Linux
    
  • GNU utilities for Win32
    
  • stealth Kernel
    discard packets that OS detection tools use to query the TCP/IP stack.
    (July 2001)
    
  • 
    book recommendation
    
  • LSOF : List Open Files
    
  • NetWare File System (NWFS) for Linux
    
• NTFS Linus Project
  

• RawWrite for Windows
  utility for creating boot and root disks for installing Linux.
• Recommended Linux books
  
• Security Guide, Linux Administrators
  
• SystemImager
  software that automates Linux installs, software distribution, and production deployment.
  
• Trinux : ramdisk-based Linux distribution that boots from a single floppy or CD-ROM
  

• LMscoop : captures LM/NTLM authentication information
  
• Logs:

• Log-based intrusion-detection and -analysis in Windows 2000/NT
  
• Logging / Syslog / Log Analysis Resources
  

• Logon:

• Account lockout messages not in domain controller event logs
  
• Cached Logon Hashes
  
• Credentials: Modifying Windows NT Logon Credential
  
• LastLogon ID Windows NT Hide
  
• LastLogon ID Windows NT Hide
  
• LastLogon ID Windows 2000 Hide
  
• Track Account Lockouts Using the Checked Netlogon.dll
  
• Tell Me Where : show the workstations(s) a user is logged on NT
  

• L0pht Crack:

• LSAdump2:

--- M --- IDS, PT, Hacking Tips

• MAC:
  • Arpwatch - watch for and report duplicate MAC addresses on your network unix
    
  • IEEE's Assigned MAC Address Listing
    
  • IEEE's OUI/MAC FAQ and Company IDs Search
    
  • SMAC : MAC Address Modifying Utility
    SMAC supports Windows 2000 & XP systems in all languages
    
  • Probe for MAC addresses
    
• Messenger:
  • Windows Messenger Delivery options: SMB vs. MS RPC
    
• Mapping:
  • Firewalk
    
• Monitor:
  • AntiSniff : scan ethernet network, detect computers in promiscuous mode NT
    
  • CIAC's Unix Network Monitoring Tools
    
  • EtherApe graphical network monitor for Unix linux
    
  • Ethereal is a free network protocol analyzer NT, linux
    
  • PMD Promiscuous Mode Detector : detect computers in promiscuous mode NT
    
  • TCPDump: Monitor network activities linux
    

--- N --- IDS, PT, Hacking Tips

• NAT:
  NetBIOS Auditing Tool
  
• Nbtstat:
  • Nbtstat reveals who is logged on
    
  • Linux version
    
• Nessus :
  remote security scanner freeware, linux
  
• NetBIOS :
  • NetBIOS Auditing Tool
    
  • NetBIOS Spy
    shareware
    • Watch current open files on your local computer but also on remote computers with Windows NT/2000/XP.
    • Show list of process remotely
    • Show MAC address
    • Keep log files
    • Open files remotely with corresponding applications
    • Deconnect remotely open files
    • Refresh computer list with just one click
    • Filter informations
  • NetBIOS based NT hacking tutorial
    
  • Worms at War Honeynet Project paper
    
• Netcat :
  TCP/IP Swiss Army knife tool
  
• Netware :
  LINUX NetWare File System (NWFS)
  
• Network Traffic Analysis: Understanding a Network Through Passive Monitoring
  
• Network Intrusion Detection:
  • FAQ
    
  • Insertion, Evasion, and Denial of Service
    
  • Packit : network auditing tool
    allows you to monitor, manipulate, and inject customized IP traffic into your network. Supporting the ability to define (spoof) all TCP, UDP, ICMP, IP, ARP, RARP and Ethernet header options, Packit can be valuable for testing firewalls, intrusion detection systems, port scanning, simulating network traffic and general TCP/IP auditing. It has been successfully compiled and tested to run on FreeBSD, NetBSD, OpenBSD, MacOS X and Linux.
• News:
  • Attack on Windows NTE-Banking and E-Commerce Sites
    
  • Cert quarterly summary
    
• Ngrep:
  Grep for the network layer linux
  
• NICs:
  • Diagram to build a read-only Ethernet cable
    
  • PromiScan W2K Pro; searches for promiscuous nodes on the local net
    
• NIST:
  Computer Security Publications
  
• Nmap:
  • defeating Nmap OS-Fingerprinting
    
  • Fastest port scanner linux
    
  • NDiff compares two nmap scans and outputs differences. Automate change analysis.
    
• Novell:
  • Object Enumeration in Novell Environments
    Due to a combination of legacy support and default settings, Novell Netware servers using native IP will leak system information via TCP port 524 when properly queried. In mixed Novell/Microsoft environments, information regarding Microsoft devices is leaked via the Service Advertising Protocol (SAP) table. Third party products, such as those used to synchronize directory services between environments can further the problem. Essentially, a remote attacker can gather the equivalent information provided by the console command "display servers" and the DOS client command "cx /t /a /r" without authentication.
• NT:
  • HardenNT : tool created to automate the task of securing Windows NT
    
  • LMscoop : captures LM/NTLM authentication information
    
  • SecureNT : implement strict security policies by controlling (enabling/disabling) end-user access to I/O devices
    
  • System Security Administration for NT using Perl
    
• NTBrute:
  • NTBrute : auditing utility
    Information gathering and account security auditing utility for breaking into Windows NT/2000 boxes via anonymous connections. Checks the machine's Account Security Policy and attacks admin users it finds.
• NTop:
  • Display network usage
    
• Null sessions:
  Enum: Enumerate NT info using null and user sessions utility
  Null.pl : Enumerate NT info using null and user sessions
  

--- O --- IDS, PT, Hacking Tips

--- P --- IDS, PT, Hacking Tips

• Packet :
  • hping command-line oriented TCP/IP packet assembler/analyzer
    Using hping one can
    • Firewall testing
    • Advanced port scanning
    • Network testing, using different protocols, TOS, fragmentation
    • Advanced traceroute, under all the supported protocols
    • Remote OS fingerprinting
    • Remote uptime guessing
    • TCP/IP stacks auditing
  • PacketCrafter
    
    • Build custom TCP/IP/UDP packets
    • Control the source address (IP spoofing)
    • Control IP flags (checksums, IDs and more)
    • Control TCP flags (state flags, sequence numbers, ack number and more)
  • Packet Excalibur
    
• PassPort:
  • Risks of the Passport Single Signon Protocol research paper Mar 2002
    
• Passwords:
  • Password Recovery Resources
    
• PBXs:
  • PBX Vulnerability Analysis (NIST)
    
• Penetration Testing:
  • MTE Internal & External PT
    
  • Overview of Network Security and Penetration Testing
    
  • Password Crackers Inc PT
    
  • Red Hat Professional services
    
  • What to demand from penetration testers
    
  • Whitehat Security Penetration Testing site
    
• Perl:
  • Perl Resources
    
• PGP:
  • GNUpgp a complete and free replacement for PGP
    
  • GNUpgp FAQ
    
  • PGP Security
    
  • PGP International
    
  • OpenPGP Consortium
    
  • RFC 2440 OpenPGP Message Format
    
  • PGP Newslist
    
• PKI:
  • Ten Risks of PKI: What You're Not Being Told About Public Key Infrastructure
    
  • Public Key Infrastructure NSS Group white paper
    
• Policies:
  • Sample security policies and guidelines
    
    
• Ports:
  • Active Ports : monitor all open TCP/IP and UDP ports on the local computer Windows, freeware
    
  • Attacker : TCP/UDP port listener/attack warning program NT, freeware
    
  • Commonly Probed Ports
    
  • Fpipe : Command line port redirector for Windows NT NT, freeware
    
  • FPort : Reports open TCP/IP and UDP ports and maps them to the owning application NT, freeware
    
  • Fscan : fastest command line port scanner for Windows NT NT, freeware
    
  • Port Knowledgebase List of frequently seen TCP and UDP ports and what they mean.
    
  • Ports used by Trojans SANS
    
  • SuperScan : Powerful TCP port scanner, pinger, resolver NT, perl, recommended
    
• PPTP:
  • Cryptanalysis of Microsoft's PPTP Authentication Extensions (MS-CHAPv2)
    
    
• Promiscuous:
  • AntiSniff : scan ethernet network, detect computers in promiscuous mode NT
    
  • PromiScan W2K Pro; searches for promiscuous nodes on the local net
    
  • PMD Promiscuous Mode Detector : detect computers in promiscuous mode NT
    
• PWdump:
  • PWdump2 :Dump password hashes from NT's SAM even if syskey enabled only locally
    
  • PWdump3 :Dump password hashes from NT's SAM even if syskey enabled works remotely(May 2001)
    

--- Q --- IDS, PT, Hacking Tips

--- R --- IDS, PT, Hacking Tips

• risk :
  • How to do a complete automated risk assessment: methodology review
    
  • Risk Management & Security
    
• rootkit :
  • Change Detection / Integrity Resource /Rootkits
    
• routers :
  • Latest Hacker Target: Routers
    
  • Link Logger
    Link Logger is the premier Windows logging tool for the Linksys BEF and ZyXEL ZyWALL routers and gateways. Link Logger allows you to know what is happening at your Linksys for both incoming and outgoing traffic. Link Logger features alerts for suspicious traffic both coming into your network and leaving. You can even custom configure alarms to let you know the instant that traffic occurs involving an IP address or Port number. With Link Logger's analysis tools, reports and charts, your in control of your internet traffic. The history of all your internet traffic is at your finger tips, so if its a quick lookup of all traffic involving some IP address, or a generating a report or graph, Link Logger can let you do it, quickly and easily.
    
  • Routers, the forgotten element
    
• RPC :
  • Windows Messenger Delivery options: SMB vs. MS RPC
    
  • Razor RPC Tools The RPC tools package contains three separate tools for obtaining information from a system that is running RPC services. rpcdump allows you to dump the contents of the endpoint mapper database. ifids is similar to rpcdump but allows you to query a single RPC server and can even allow you to query an RPC server which is not listed in the endpoint map obtained with rpcdump above. walksam is a tool which allows you to dump the information of each user found within the SAM database via Named Pipes or using the additional protocol sequences used by Windows 2000 domain controllers. rpcdump, ifids, and walksam are demostration programs from the Null Session and MSRPC concepts discussed at BlackHat Windows 2000.
• RPCDump:
  equivalent to rcpinfo -p remote_host from a *NIX shell prompt NT, free
  

--- S --- IDS, PT, Hacking Tips

• SAM:
  • Dump accounts and hashes
    
• SANS:
  • VLAD the Scanner: check for SANS Top Ten security vulnerabilities linux
    
• Sara:
  • Security Auditor's Research Assistant GNU SATAN-like scanner
• scanners:
  • Scanner Resources
    
• Script Kiddie :
  • The Tools and Methodologies of the Script Kiddie Honeynet Project
    
  • Tracking the blackhat's moves Honeynet Project
    
  • They Gain Root Honeynet Project
    
  • The Study of an Attack : A Forensic Analysis Honeynet Project
    
• Security Resource :
  • All-Internet-Security.com
  • Security Associations / Security Portals / Hacking Portals
  • Security Books
  • Security Checklists / Guidelines / Reports
    • Hardening NT
  • Security Policies / Practices
  • Security Vendors
  • Starting from Scratch: Formatting and Reinstalling after a Security Incident
• Service:
  • LocalSystem account context
    
• Service Packs :
  • Determine the current service pack/hotfix level of all Windows NT machines on NT domain
    
• Shares :
  • Shed : Robin Keir's very fast Windows shared resource scanner
    
• Shutdown :
  • Remotely Shutdown Windows NT Workstation or Windows NT Server
    
• Sidestep :
  • SideStep: IDS evasion tool
    demonstrate some IDS evasion techniques
• SMB:
  • CIFS : Common Insecurities Fail Scrutiny tutorial
    
  • SMB Auditing Tool (cquire.net) (Jan 2002)
    
    • Scan hosts for active SMB servers (ie. not only if port is open)
    • Automatic enumeration of users
    • Support for full automatic mode
    • Fast analysis of Windows 2000/XP servers
    • Support for SMB over Netbios
    • Support for native SMB over port 445
    • Compiles on Linux/BSD
    • Win32 support with Cygwin
  • SMB Downgrade Attacker NT, free,grab passwords
    
  • SMBProxy Tool (cquire.net)

    
            Got SAM ? Don't want to spend more time cracking it ?
    
            SMBProxy is a "Passing The Hash" tool that works as a proxy.It makes it possible to authenticate to a Windows NT4/2000server by only knowing the md4 hash. It also makes itpossible to mount shares, access the registry and anythingelse you could do with that particular users privileges.The theory behind this is pretty old, and I don't take any 
            credit for it. The tools for doing this though, have been 
            quite limited. That's why I decided to release this proxy,
            to really demonstrate the magic of "Passing The Hash".
    
            It succesfully intercepts communication with Windows NT 4.0
            and Windows 2000. It looks for the username trying to connect
            and does a lookup in the pwdump file for the users hash.
            Currently it only intercepts the NTLM hash.
            

    
    
  • SmbRelay captures NTLM hashes man in the middle attack
    
  • Windows Messenger Delivery options: SMB vs. MS RPC
    
• SMTP:
  • relaycheck scans for SMTP hosts that permit "relaying" of email
    
• Sniffers:
  • Packet Sniffers
    
• Snort:
  • Snort Resources
    Snort; Hogwash, RazorBack; Snot; SnortSnarf; Linux and Windows versions;
• Social Engineering:
  • Case study of industrial espionage through social engineering
    
  • Social Engineering Fundamentals by by Sarah Granger
    
• Spoofing:
  • Spoof Bounce
    
  • RFC2827: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
    
• SQL:
  • Dictionary attack tool against SQL Server
    to test if the accounts are strong enough to resist an attack
  • SQL Injection
    SPI Labs
  • Direct SQL Command Injection
    technique where an attacker creates or alters existing SQL commands to gain access to unintended data or even the ability to execute system level commands on the host(Dec 2001)
  • Manipulating Microsoft SQL Server Using SQL Injection
    advanced techniques that can be used in an attack on an application utilizing Microsoft SQL Server as a backend. These techniques demonstrate how an attacker could use a SQL Injection vulnerability to retrieve the database content from behind a firewall and penetrate the internal network.
  • take control of a targeted SQL 7 or SQL 2000 server
    bug
  • Worm exploits blank sa password
    
• Ssh Secure Shell
  
• SSL:
  • Stunnel
    work as an SSL encryption wrapper between remote client and local (inetd-startable) or remote server
  • SSL Handshake
    
• Steganography :
  • Information Hiding Resources for Steganography
    
• Stick:
  • DOS attack against human processes that support intrusion detection.
    By Coretez Giovanni
• Streams:
  • Merge Streams Utility
    It can hide MS Excel document inside MS Word document or vice versa. If you wish to transparently hide some important documents inside old financial reports this is for you.Jan 2002
• Syskey (NT):
  • Determine whether Syskey has been applied to a system
    
  • What happens when syskey is installed, and how to get rid of it
    

--- T --- IDS, PT, Hacking Tips

• Tarpit :
  • LaBrea Tarpit program that creates a tarpit or, as some have called it, a "sticky honeypot". LaBrea takes over unused IP addresses on a network and creates "virtual machines" that answer to connection attempts. LaBrea answers those connection attempts in a way that causes the machine at the other end to get "stuck", sometimes for a very long time.
    
• TScrack : Terminal Services Cracker
  TScrack is a dictionary based (rather than bruteforce) password cracker for Microsoft Windows Terminal Services (RDP).

• TCP:
  • Wayne's tcpip resource
    
  • tcpflow : A TCP Flow Recorder
    captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging
    
  • tcpdump : tools of the trade
    
• Testing NT:
  • An Empirical Study of the Robustness of Windows NT Applications Using Random Testing
    
• Tini:
  • Very small (3kb) backdoor for Windows
    NT, Win9x, W2K, free
    
• Toolkits: If you have a document or link to a toolkit which should be added, .
  • GNU utilities for Win32 ports of common GNU utilities to native Win32
    
  • Lcrzoex, network testing toolbox Lcrzo is described by its author as a "Swiss knife for network developpers[sic]". It is primarily a network library dependent on libpcap, that includes modules for packet sniffing and traffic generation, including various sorts of spoofing and network attacks. Lcrzoex is a companion set of example programs that includes a very simple but quite useful front end for various features.
    
  • www.tamos.com :
    • EssentialNetworkTools : set of network tools useful in diagnosing networks and monitoring your computer's network connections
      • NetStat: displays the list of your computer's inbound and outbound network connections, including the information on open TCP and UDP ports, IP address, and connection states. What makes it different from other NetStat utilities is the ability to map open ports to the owning application. (This feature is available under Windows NT/2000/XP.)
      • NBScan: a powerful and fast NetBIOS scanner. NBScan can scan a network within a given range of IP addresses and list computers offering NetBIOS resource-sharing service, as well as their name tables and MAC addresses. Unlike the standard nbtstat utility supplied with Windows, this tool provides a graphical user interface and easy management of the lmhosts file and features parallel scanning, which allows checking a class C network in less than one minute. NBScan can facilitate routine tasks often carried out by system integrators, administrators, and analysts.
      • PortScan: an advanced TCP port scanner that allows you to scan your network for active ports. This tool features both conventional (full connect) and stealth (half-open) scanning modes.
      • Shares: monitors and logs external connections to your computer's shared resources, as well as provides a quick and easy way to connect to remote resources that gives Windows 98/Me users NT user-level connectivity features. Unlike Windows NT, Windows 98/Me has no user-level connectivity after the boot: you can specify a password, but not a username. This tool allows you to set both a username and a password.
      • LMHosts: a convenient editor of the lmhosts file integrated with NBScan.
      • NetAudit (NetBIOS Auditing Tool): allows you to perform various security checks on your network and/or individual computers offering the NetBIOS file sharing service. This tool can help you identify potential security flaws.
      • RawTCP: provides you with the ability to establish low-level TCP connections to troubleshoot different networking services. Multi-color output and a convenient interface make it a great tool for every network administrator or computer programmer.
      • TraceRoute and Ping: these familiar utilities featuring customizable options and a convenient results presentation allow you to explore the Internet and troubleshoot connectivity problems.
      • NSLookup: allows you to convert IP addresses to hostnames and vice versa, obtain aliases, and perform advanced DNS queries, such as MX or CNAME.
      • ProcMon: displays the list of running processes with full information on the program location, manufacturer, process ID, and the loaded modules. With this tool, you can identify hidden applications, kill running processes, and manage the usage of your PC's resources more effectively.
    • CommView : packet analyzer
      run on any Windows 95/98/Me/NT/2000/XP system
  • Mark Russinovich's freeware PsTools suite
    All of the utilities in the PsTools suite work on both Windows NT and Windows 2000.
    PsExec : execute processes remotely
    PsFile : shows files opened remotely
    PsGetSid : display the SID of a computer or a user
    PsKill : kill processes by name or process ID
    PsList : list detailed information about processes
    PsLoggedOn : see who's logged on locally and via resource sharing (full source is included)
    PsLogList : dump event log records
    PsService : view and control services
    PsShutdown : shuts down and optionally reboots a computer
    PsUptime : shows you how long a system has been running since its last reboot
  • SmartLine Freeware
    Active Ports : tool for Windows NT/2000/XP that enables you to monitor all open TCP/IP and UDP ports on the local computer.
    Active ShutDown : tool for Windows 95/98/ME/NT/2000 that allows you to shutdown or reboot your Windows session with the one mouse click.
    Active Server Watcher : tool for Windows 95/98/ME/NT/2000 that periodically checks given Internet resources and notifies you when they become unavailable. or perform any right-click operation. Its a hack, and its a little finnicky, but it seems to work great 99% of the time in 99% of the apps I use. Sometimes you might have to try twice.
    Active CPU : tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity. When ACPU is running, an accurate miniature CPU usage gauge appears on the taskbar on the end opposite the "Start" button. When you touch it with the cursor, it displays the percentage of processor use in text format.
    CPU Indicator Screen Saver : screen saver for Windows 95/98/ME/NT/2000. It enables you to watch a graphical representation of your CPU's activity. CPU Indicator SS draws two diagrams. The first shows you the CPU's usage history; the second shows you the CPU's current state.
    Active Favorites : tool for Windows 95/98/ME/NT/2000 that allows you to very quickly access Internet Explorer Favorites (bookmarks). When AFAVOR is running, an accurate miniature icon appears on the taskbar on the end opposite the "Start" button. When you click it with the left mouse button, it displays the full list of your bookmarks.
    Self-Extrtactor Archive Recovery : lets you repair self-extracting ZIP files created by Winzip. It rebuilds a file's header if it were damaged by a virus or download corruption.
    SmartSchedule : Interface for Windows NT/2000 schedule service (AT command). You can add, delete or change tasks on remote and local computers.
    SmartClock : Give your desktop a wrist watch
    TOT-RECODE II : The best convertor of Russian texts from one codepage to another. Supports the automatic recognition of incorrect charsets and lets you read unreadable e-mail. Russian and English interfaces, install and uninstall. Supports all well-known codepages (Windows 1251, KOI8-r, DOS 866, ISO 8859-5, MAC 10007, Quoted-printable, Translit, etc.).
    
• Traceroute:
  • Tracing the Traceroute: A White Paper by Ankit Fadia
    
• Training:
  • Security, Hacker, and Penetration Testing Training Courses
    
• Trinux:
  • Trinux : ramdisk-based Linux distribution that boots from a single floppy or CD-ROM
    boots from a single floppy or CD-ROM, loads it packages from an HTTP/FTP server, a FAT/NTFS/ISO filesystem, or additional floppies. Trinux contains the latest versions of popular Open Source network security tools for port scanning, packet sniffing, vulnerability scanning, sniffer detection, packet construction, active/passive OS fingerprinting, network monitoring, session-hijacking, backup/recovery, computer forensics, intrusion detection, and more. Trinux also provides support for Perl, PHP, and Python scripting languages. Remote Trinux boxes can be managed securely with OpenSSH. Trinux gives you the power of Linux security tools without requiring a full-blown Linux install or the need to download, compile, install, and update a complete suite of security tools that are typically not found in mainstream distributions.
• Tripwire:
  • File and directory integrity checker
    
  • Tripwire Policy Resource Center
    tools, tips, user forum
  • A poor-man Tripwire-like system on Windows 9x/NT
    
• Trojans:
  • The complete Windows Trojan paper
    
  • Trojan Papers extensive resource list
    
  • HackFix : stay informed about trojan horse programs
    
  • ACK Tunneling Trojans
    
  • Threats to your security on the Internet
    
• Tunneling:
  • Reverse WWW Tunnel Backdoor
    proof-of-concept Perl program allows communicating with a shell through firewalls and proxy servers by imitating web traffic. The master/slave relation is reversed; therefore no listening ports are used on the target machine.
    
  • Zebedee: Secure IP tunnel
    establish an encrypted, compressed “tunnel” for TCP/IP or UDP data transfer between two systems
    
• Tutorials/whitepapers

--- U --- IDS, PT, Hacking Tips

• UDPFlood :
  UDP packet sender utility free
  
• Unix :
  UNIX IP Stack Tuning Guide
  
• URLs:
  • rfc1738.txt
    
• Users:
  • UserInfo / UserDump
    UserInfo : little functiod that retrieves all available information about any know user from any NT/Win2k system that you can hit 139 on. Specifically calling the NetUserGetInfo api call at Level 3, UserInfo returns standard info like SID, Primary group, logon restrictions, etc., but it also dumps special group information, pw expiration info, pw age, smartcard requirements, and lots of other stuff. This guy works as a null user, even if the system has RA set to 1 to specifically deny anonymous enumeration.
    UserDump : UserInfo with a twist. It combines LookupAccountSID and LookupAccountName with UserInfo's NetGetUserInfo calls, resulting in a SID Walker that can dump every user in a domain in a single command line. It gives you all the information that UserInfo does, but it lets you specify the number of users you want to walk. Pretty cool. Also runs as a null user, even with RA set to 1.

--- V --- IDS, PT, Hacking Tips

• Viruses :
  • Blended attacks, exploits, vulnerabilities, and buffer-overflow techniques in computer viruses
    Symantec
    
• VNC :
  • Virtual Network Computing
    
• VPN :
  • Cisco Top Issues : IOS VPN tech assistance center
    
  • Microsoft VPN White Papers
  • VPN Clients and Split Tunneling newsletters.cramsession.com
    
• Vulnerabilities:
  • Exploits:
    • Blackcode site
      
    • Favorite NT Exploits
      
    • Fyodor's Exploit World! Micro$oft Section
      
    • ICAT Vulnerability Index Online
      
    • ICAT Vulnerability Database Available for Download
      
    • IIS and NT4 Microsoft
      
    • IIS and NT5 Microsoft
      
    • NIPC : vulnerabilities found in 2001 (Jan 2001)
      
    • SecuritySearch (July 2001)
      
    • Securiteam's Exploits NT focus
      
    • SecurityTracker
      
    • Security Space
      
    • Windows Security Guide details about the latest vulnerabilities and fixes, articles and technical support
      
  • scanners :
    • Cisco Secure Scanner evaluation copy available
      
    • CIS Cerberus' Internet Scanner NT/W2K, freeware
      
    • CyberCop Scanner NT/W2K/Linux,commerical recommended
      
    • Impurity Spot Buster : security scanner tool written in Perl
      
    • ISS's Internet Scanner NT, commercial, highly recommended
      
    • Messala scans for 97 CGI Vulns,
      9 FTP Vulns, All known QPOP vulns, 7 Named vulns ...
      
    • Nessus linux, freeware, recommended
      
    • NSS free, open-sourced remote security scanner linux
      
    • Retina - its AI engine has uncovered major new vulnerabilities NT, commercial
      
    • QualysGuard - analyzes networks from the outside-in, as a potential intruder would do subscription service
      
    • SWARM commercial
      
    • Symantec Expert Scanner
      
    • VLAD: Check for SANS Top Ten security vulnerabilities linux
      
    • twwwscan fast windows based command line WWW Vulnerability scanner
      
    • Whisker CGI vulnerability scanner linux, freeware, perl, recommended
      add your own vulnerability scan scripts
      

--- W --- IDS, PT, Hacking Tips

• W2K Windows 2000:
  Smart Card Security in Windows 2000 whitepaper zipped PDF file, 917 KB
• WAN:
  WAN-Killer Traffic Generator for Wide Area Networks component in Solarwinds suite
  
• warscan:
  • vehicle for automating any test exploit linux
    
• Web Security:
  • Improving Web Application Security: Threats and Countermeasures
    Microsoft's 900+pg free paper
  • Tivoli : Understanding your Web site's health
    
  • Penetration Testing for Web Applications
    
  • Top-10 Most Critical Web Application Security Vulnerabilities Open Web Application Security Project
    
  • WebGoat : Learn & Practice Web application security Open Web Application Security Project
    
  • How Web Spoofing Works
    
• Webservers :
  • Elza : mimic HTTP clients allowing launch of dictionary and other attacks script language
    
  • HTAccess Authentication
    usernames and encrypted passwords are kept in a webmaster-maintained file
    
  • twwwscan fast windows based command line WWW Vulnerability scanner
    
  • How to Obscure Any URL
    
  • Logging Web Server Attacks
    
  • Paros : evaluate security of web applications
    
  • WebBrute : scan web directories protected with HTTP authentication
    test security strength of users' passwords; NT, W2K; freeware
    
  • Web Bug Report Webbugs are objects (images, iframes, etc.) that are imbedded on a web site that cause part of the web page to be retrieved from a completely different web site.
    
  • Web Bugs : Bugnosis FAQs download detection tool, read FAQs, documentation
    
  • WebSleuth black-box testing toolkit
    
  • Whisker CGI vulnerability scanner linux, freeware, perl, recommended
    add your own vulnerability scan scripts
    
  • NeXpose vulnerability tester
    
• Whitehats :
  • Max Vision's Site
    
• Whitepapers :
  • Packetstorm site has many valuable whitepapers
    
  • Overview of Network Security and Penetration Testing
    
• Whisker :
  CGI vulnerability scanner free, recommended
  
• Winfo :
  Uses Null Sessions to retrieve account and share information from Windows NT
  NT,free
  
• Windows 2000:
  Hardening Windows 2000
  
• Winzapper :
  Selectively erase event records NT/W2K Security Log.
  
• Wireless :
  • Wireless WLAN security resources : tools, whitepapers, books
    
• Worms :
  • Early Bird : realtime http worm intrustion
    
  • Introduction to Database and Application Worms worms that propagate through vulnerabilities in databases rather than through more traditional operating system or web server holes. Despite their lack of sophistication, these worms have been somewhat successful because of the poor state of database security. Security in databases has generally been ignored, and the threat management of these applications has been non-existent.
    
  • Future of Internet Worms
    
• WUPS :
  UDP port scanner for Windows
  NT,W2K,W9x,free
  

--- X --- IDS, PT, Hacking Tips

• XST :
  Cross-Site Tracing
  
• Xwindows :
  Crash Course in X Windows Security
  

--- Y --- IDS, PT, Hacking Tips

--- Z --- IDS, PT, Hacking Tips

• Zombie Zapper
  works against Trinoo, TFN, Stacheldraht, Troj_Trinoo (Windows port of Trinoo), and Shaft. Assuming that the default passwords have not been changed, you can simply use the same commands that an attacker would use to stop the flood. On Trinoo and Troj_Trinoo, it does stop the daemon entirely (although Trinoo is typically set to be restarted by cron, and Troj_Trinoo will restart after the Zombie Windows computer has been restarted), but on TFN, Stacheldraht, and Shaft the flooding just stops. This gives you the advantage of telling the daemon to stop flooding without stopping the daemon, allowing you to take a little more time in tracking down where they are, and more importantly, how they got there in the first place.

Consider making a direct contribution to help keep is-it-true.org on the Net by clicking on my Amazon honr system contribution paybox.

FYI if you click on any of my Amazon book, movie, or music links and purchase anything from Amazon, is-it-true.org will get a small percentage. Consider coming back to my site and getting into Amazon from one of my Amazon links, if you are going to purchase an item. It will help keep my site on the Net.