sécurité
Tor-ramdisk is a uClibc-based micro Linux distribution whose sole purpose is to securely host a Tor server purely in RAM. For those not familiar with Tor, it is a system which allows the user to construct encrypted virtual tunnels which are randomly relayed between Tor servers (nodes) until the connection finally exits to its destination on the internet. The encryption and random relaying resist traffic analysis in that a malicious sniffer cannot easily discover where the traffic is coming from or what data it contains. While not perfect in its efforts to provide users with anonymity, Tor does help protect against unscrupulous companies, individuals or agencies from "watching us". For more information, see the Tor official site.
Wapiti allows you to audit the security of your web applications.
It performs "black-box" scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data.
Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.
Audit Your Website Security with Acunetix Web Vulnerability Scanner
pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution. pfSense is a popular project with more than 1 million downloads since its inception, and proven in countless installations ranging from small home networks protecting a PC and an Xbox to large corporations, universities and other organizations protecting thousands of network devices.
Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.
CrawlProtect, le script qui protège votre site internet.
exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, reverse engineering.
Download Xelenium, Security Testing with Selenium for free. Hello Everyone,
Warm Greetings!!! Xelenium has become part of OWASP and you can find more information about Xelenium here: https://www.owasp.org/index.php/OWASP_Xelenium_Project
I have detailed about the steps to follow in OWASP page of Xelenium.
A perl based tool for misconfiguration, version detection, enumeration, and server information scanning. Web-Sorrow is a "safe to run" program. meaning it is not designed attempt to exploit or preform any kind of injection, DDoS/DoS, CSRF, XSS, or any harmful attacks. It's entirely focused on Enumeration and collecting Info on the target server. It can identify: a CMS and version number, login pages, admin logins, Email webapps, Bruteforce subdomains, Scan for CMS plugins, hosting provider, blogging services, favicon fingerprinting, and more
sqlcake is an automatic SQL injection exploitation kit written in Ruby. It's designed for system administration and penetration testing.
OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
PhpSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement. It is not a replacement for secure development techniques, and does not do any kind of code or app auditing, but can be a useful tool in a multilayered security approach.
Established in 2004, The Shadowserver Foundation gathers intelligence on the darker side of the internet. We are comprised of volunteer security professionals from around the world. Our mission is to understand and help put a stop to high stakes cybercrime in the information age.
WebSploit Is An Open Source Project For Scan And Analysis Remote Syste
Johnny is a GUI for John the Ripper. It was proposed by Shinnok. You could look onto original version on John the Ripper GUI sketches page.
Ce site n’est pas simplement un portail de diffusion, il est un véritable outil communautaire d’information et de pratique dans la sécurité informatique et le hacking. Nous avons besoin de votre aide pour prouver que le développement communautaire est encore possible. Nous souhaitons mettre en place un système d’apprentissage basé sur l’entraide, à chaque niveau de compétences nous pouvons apprendre ou enseigner. Adhérer au concept de ce portail ce n’est pas seulement appartenir à une communauté, c’est avant tout être utile pour les autres internautes :
The Monkeysphere project's goal is to extend OpenPGP's web of trust to new areas of the Internet to help us securely identify servers we connect to, as well as each other while we work online. The suite of Monkeysphere utilities provides a framework to transparently leverage the web of trust for authentication of TLS/SSL communications through the normal use of tools you are familiar with, such as your web browser0 or secure shell.
With CrawlTrack you will get a detail view of the crawler activity on your site. Crawlers visits count for more than 85% of hits on www.Crawltrack.net; some are usefull, other far less and even dangerous (30% are hacking attempts on www.crawltrack.net).
Extract forensic data from computers, quicker and easier than ever. Uncover everything hidden inside a PC.
Pombo peut vous aider à récupérer votre ordinateur en cas de vol.
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
Cross Site "Scripter" is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.
Toolwiz Time Freeze is a free instant system protection tool to keep your system safe and always like new. It protects your system from any unwanted changes and malicious activity in low disk level.With a simple click, it puts your actual system under virtual protection on the fly and creates a virtual environment as a copy of the real system, on which you can evaluate applications, watch movies, and perform online activities. It provides higher-level security to computer protection, and greatly improves the efficiency of virtual system.
What is HOIC? The high orbit ion cannon has the following features: - High-speed multi-threaded HTTP Flood - Simultaenously flood up to 256 websites at once - Built in scripting system to allow the deployment of 'boosters', scripts designed to thwart DDoS counter measures and increase DoS output. - Easy to use interface - Can be ported over to Linux/Mac with a few bug fixes (I do not have either systems so I do - Ability to select the number of threads in an ongoing attack - Ability to throttle attacks individually with three settings: LOW, MEDIUM, and HIGH and its written in a language where you can do a bunch of really nifty things just read the RealBasic manual, ;] also no Dependencies (single executable)
The checksecurity command runs a small collection of simple system checks which are designed to catch a few common security issues.
WPScan est un scanner de vulnérabilité pour WordPress, écrit en ruby et diffusé sous la licence GPL. Il est capable de lister les plugins utilisés par un site web et de vous donner les failles de sécurité associées. Vous pouvez également faire de la brute force sur l'interface d'administration.
OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.
Security has become a foremost concern on the Web in the past few years. Hackers have always been around, but with the increase in computer literacy and the ease of access to virtually any data, the problem has increased exponentially. It is now rare for a new website to not get comment spam within days of its release, even if it is not promoted at all.
After the tremendously successful 2000 and 2003 security tools surveys, Insecure.Org is delighted to release this 2006 survey. I (Fyodor) asked users from the nmap-hackers mailing list to share their favorite tools, and 3,243 people responded. This allowed me to expand the list to 100 tools, and even subdivide them into categories. This is the category page for web vulnerability scanners -- the full network security list is available here. Anyone in the security field would be well advised to go over the list and investigate tools they are unfamiliar with. I discovered several powerful new tools this way. I also point newbies to this site whenever they write me saying “I don't know where to start”.
Hackers exploit security vulnerabilities in popular web software such as blogs, forums, CMS, image galleries and wikis to insert hidden illicit content into web pages of innocent third-party web sites.
A fully automated, active web application security reconnaissance tool. Key features:
Dans un précédent article, j’avais parlé de corkscrew. Le but était de pouvoir se connecter en SSH sur son serveur en étant derrière un proxy, en utilisant le port 443 (réservé au HTTPS).
The Exploit Database (EDB) – an ultimate archive of exploits and vulnerable software. A great resource for penetration testers, vulnerability researchers, and security addicts alike. Our aim is to collect exploits from submittals and mailing lists and concentrate them in one, easy to navigate database.
Generating an RSA key pair & public key string
Le but de ce billet et de présenter l'authentification en deux étapes telle qu'elle est implémentée par Google.
Il est temps d’aller un peu plus en profondeur et se prémunir des attaques par DOS (Deny Of Service), des injections SQL, du flood de spam et bien plus encore. Deux modules d’Apache permettent de faire cela très rapidement: mod_security et mod_evasive
HackerTarget.com is the worlds leading provider of open source security scans that are available online.
The Metasploit® Framework is a free, open source penetration testing solution developed by the open source community & Rapid7.
Mantra is a dream that came true. It is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers, security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source software. Mantra is a security framework which can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access, and covering tracks. Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks.
Surveiller ses fichiers de log est une activité nécessaire[1] mais bien souvent rébarbative.
WordPress est un moteur de blog Open Source qui permet à tout un chacun de créer son blog en moins de temps qu’il ne faut pour le dire ^^. Cependant, tout blogueur consciencieux sécurise un maximum son blog afin d’élever au maximum la sécurité de celui-ci. Un blog se sécurise à la création mais sa sécurité doit toujours être maintenue pendant sa durée de vie. Ci-dessous, vous trouverez quelques conseils « de base » afin de bien sécuriser votre blog WordPress.
The OWASP CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.
OWASP Foundation, the Open Source Foundation for Application Security on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.