Yersinia

"Yersinia is a network tool designed to take advantage of some weakeness in different network protocols, It is useful for penetration testing. It pretends to be a solid framework for analyzing and testing the deployed networks and systems. Currently, attacks for the following network protocols are implemented; Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), Dynamic Host Configuration Protocol (DHCP), Hot Standby Router Protocol (HSRP), 802.1q,802.1x, Inter-Switch Link Protocol (ISL) and VLAN Trunking Protocol (VTP)." read more...

Website: http://www.yersinia.net

Read More

LaBrea: "Sticky" Honeypot and IDS

"LaBrea takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet. The program answers connection attempts in such a way that the machine at the other end gets "stuck", sometimes for a very long time." read more...

Website: http://labrea.sourceforge.net

Read More

The Metasploit Framework

"The Metasploit Framework is a development platform for creating security tools and exploits. The framework is used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide. The framework is written in the Ruby programming language and includes components written in C and assembler." read more...

Website: http://www.metasploit.com

Read More

Kismet: Wireless Packet Analyzer

"Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic. Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic." read more...

Website: http://www.kismetwireless.net

Read More

Tor: anonymity online

"Tor is a software project that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security. Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Tor works with many of your existing applications, including web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol." read more...

Website: http://www.torproject.org

Read More

Privoxy

"Privoxy is a non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data, managing HTTP cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a flexible configuration and can be customized to suit individual needs and tastes. Privoxy has application for both stand-alone systems and multi-user networks." read more...

Website: http://www.privoxy.org

Read More

Winpooch

"Winpooch is a Windows watchdog, free and open source. Anti spyware and anti trojan, it gives a full protection against local or external attacks by scanning the activity of programs in real time. Associated with ClamWin antivirus, Winpooch keeps safe your computer against virus." read more...

Download: http://sourceforge.net/project/showfiles.php?group_id=122629

Read More

SpamAssassin: An Open Source E-mail Filter

"No list of open-source security tools would be complete without SpamAssassin. A two-time Datamation Product of the Year winner, this anti-spam tool is the "secret sauce" behind a number of commercial products, as well as being put to good use by a number of e-mail hosting vendors and spam filtering vendors. Experts often recognize SpamAssassin as the best open-source anti-spam tool available." read more...

Website: http://spamassassin.apache.org

Read More

PKIF: The PKI Framework

"PKIF is a full-featured, standards compliant PKI enablement library. Its goal is to make it easy for your applications to take advantage of your PKI. PKIF runs on Windows and UNIX systems and is written in C++ with bindings for C# (and COM/.Net) and java. PKIF can validate certificates, create and verify signatures, encrypt and decrypt data, and much more." read more...

Website: http://pkif.sourceforge.net/index.html

Read More

OTPW: A One-time Password Login Package

"The OTPW package consists of the one-time-password generator otpw-gen plus two verification routines otpw_prepare() and otpw_verify() that can easily be added to programs such as login or ftpd on POSIX systems. For platforms that support the Pluggable Authentication Method (PAM) interface, a suitable wrapper is included as well. Login software extended this way will allow reasonably secure user authentication over insecure network lines. The user carries a password list on paper. The scheme is designed to be robust against theft of the paper list and race-for-the-last-letter attacks. Cryptographic hash values of the one-time passwords are stored for verification in the user’s home directory." read more...

Website: http://www.cl.cam.ac.uk/~mgk25/otpw.html

Read More

The ASN.1 Compiler

"The asn1c is a free, open source compiler of ASN.1 specifications into C source code. It supports a range of ASN.1 syntaxes, including ISO/IEC/ITU ASN.1 1988, '94, '97, 2002 and later amendments. The supported sets of encoding rules are a) BER: ITU-T Rec. X.690 | ISO/IEC 8825-1 (2002) (BER/DER/CER), b) PER: X.691|8825-2 (2002) (PER), c) XER: X.693|8825-3 (2001) (BASIC-XER/CXER)." read more...

Download: http://lionet.info/asn1c/download.html

Read More

FxCop: A Free Static Code Analysis Tool that Checks .NET managed code

"FxCop is an application that analyzes managed code assemblies (code that targets the .NET Framework common language runtime) and reports information about the assemblies, such as possible design, localization, performance, and security improvements. Many of the issues concern violations of the programming and design rules set forth in the Design Guidelines for Class Library Developers, which are the Microsoft guidelines for writing robust and easily maintainable code by using the .NET Framework. FxCop is intended for class library developers. However, anyone creating applications that should comply with the .NET Framework best practices will benefit. FxCop is also useful as an educational tool for people who are new to the .NET Framework or who are unfamiliar with the .NET Framework Design Guidelines. FxCop is designed to be fully integrated into the software development cycle and is distributed as both a fully featured application that has a graphical user interface (FxCop.exe) for interactive work, and a command-line tool (FxCopCmd.exe) suited for use as part of automated build processes or integrated with Microsoft Visual Studio® .NET as an external tool." read more...

Website1: http://msdn.microsoft.com/en-us/library/bb429476(VS.80).aspx

Website2: FxCop and Code Analysis: Writing Your Own Custom Rules

Read More

OSSEC: An Open Source Host-based Intrusion Detection System

"OSSEC is a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS). It has a powerful correlation and analysis engine, integrating log analysis, file integrity checking, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows. A list with all supported platforms is available here." read more...

Website: http://www.ossec.net/

Read More

httprecon: An Advanced Web Server Fingerprinting Tool

"The httprecon project is doing some research in the field of web server fingerprinting, also known as http fingerprinting. The goal is the highly accurate identification of given httpd implementations. This is very important within professional vulnerability analysis. Besides the discussion of different approaches and the documentation of gathered results also an implementation for automated analysis is provided. This software shall improve the easyness and efficiency of this kind of enumeration. Traditional approaches as like banner-grabbing, status code enumeration and header ordering analysis are used. However, many other analysis techniques were introduced to increase the possibilities of accurate web server fingerprinting." read more...

Website: http://www.computec.ch/projekte/httprecon

Read More

ATK: An Open-Source Exploiting Framework

"This tool checks for leaks and vulnerabilities on any system with an easy interface ... and nice documentation - worth checking for sure!" - Prof. Dr. Urs E. Gattiker, Author of the books "Virus Revealed", "The Information Security Dictionary" and "Technology Management in Organizations" read more...

Website: http://www.computec.ch/projekte/atk

Read More

Burp Suite: An Integrated Platform for Penetration Test of Web Applications

"Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, authentication, downstream proxies, logging, alerting and extensibility." read more...

Download: http://portswigger.net/suite/download.html

Read More

SysAnalyzer: An Automated Malcode Analyzer

"SysAnalyzer is an automated malcode run time analysis application that monitors various aspects of system and process states. SysAnalyzer was designed to enable analysts to quickly build a comprehensive report as to the actions a binary takes on a system. SysAnalyzer can automatically monitor and compare: Running Processes, Open Ports, Loaded Drivers, Injected Libraries, Key Registry Changes, APIs called by a target process, File Modifications, HTTP, IRC, and DNS traffic. SysAnalyzer also comes with a ProcessAnalyzer tool which can perform the following tasks: Create a memory dump of target process, parse memory dump for strings, parse strings output for exe, reg, and url references and scan memory dump for known exploit signatures." read more...

Website: http://labs.idefense.com/software/malcode.php

Read More

Honeywall CDROM

"The Honeywall CDROM is a bootable CD that copies all the functionality of a Honeywall onto a hard drive. It comes with all the tools and functionality for you to implement data capture, data control, and data analysis. It creates an architecture that allows you to deploy both low-interaction and high-interaction honeypots within it. The purpose of the Honeywall CDROM is to make it easier to deploy, manage, and derive value from honeynet technologies. The CDROM supports several configuration methods, including an interactive menu and .iso customization scripts. The CDROM is an appliance, based on a minimized and secured Linux OS." read more...

Website: https://projects.honeynet.org/honeywall

Read More

BackTrack: Penetration Testing Live CD

"BackTrack is the most Top rated Linux live distribution focused on penetration testing. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes. It’s evolved from the merge of the two wide spread distributions Whax and Auditor Security Collection. BackTrack has a long history and was based on many different linux distribution until it is now based on a Slackware linux distribution and the corresponding live-CD scripts. Every packet, kernel configuration and scripts are optimized to be used by security penetration testers. Patches and automatism have been added, applied or developed to provide a neat and ready-to-go environment." read more...

Website: http://www.remote-exploit.org/backtrack.html

Read More

NST: Network Security Toolkit

"NST is a bootable ISO live CD is based on Fedora. The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86 platforms. The main intent of developing this toolkit was to provide the network security administrator with a comprehensive set of Open Source Network Security Tools. The majority of tools published in the article: Top 100 Security Tools by insecure.org are available in the toolkit." read more...

Download: http://sourceforge.net/projects/nst

Read More

STD: Security Tools Distribution

"STD is a Linux-based Security Tool. Actually, it is a collection of hundreds if not thousands of open source security tools. It's a Live Linux Distro, which means it runs from a bootable CD in memory without changing the native operating system of the host computer. Its sole purpose in life is to put as many security tools at your disposal with as slick an interface as it can." read more...

Website: http://www.knoppix-std.org

Read More

Ratproxy: A Web Application Security Audit Tool

"A semi-automated, largely passive web application security audit tool, optimized for an accurate and sensitive detection, and automatic annotation, of potential problems and security-relevant design patterns based on the observation of existing, user-initiated traffic in complex web 2.0 environments. Detects and prioritizes broad classes of security problems, such as dynamic cross-site trust model considerations, script inclusion issues, content serving problems, insufficient XSRF and XSS defenses, and much more." read more...

Website: http://code.google.com/p/ratproxy

Read More

msramdmp: McGrew Security RAM Dumper

"Creating bootable USB drives for capturing the contents of memory: A short while back, a paper was published by researchers at Princeton University, in which they talk about the process of recovering encryption keys out of memory after a cold boot. This was surprising to many people, as most just assume that, since RAM is volatile storage, it is erased when power is removed. This is an incorrect assumption." read more...

Website: http://mcgrewsecurity.com/projects/msramdmp

Read More

Hping: TCP/IP Packet Assembler/Analyzer

"Hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features." read more...

Download: http://www.hping.org/download.php

Read More

Nmap - Free Security Scanner

"Nmap is a free and open source utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and both console and graphical versions are available." read more...

Website: http://nmap.org

Read More

Scapy: A Powerful Packet Manipulation Tool

" Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can't handle, like sending invalid frames, injecting your own 802.11 frames, combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, ...), etc." read more...

Website: http://www.secdev.org/projects/scapy

Read More

SSL Man in the Middle Proxy

"mitm-proxy is an Java-based SSL proxy that acts as a "man in the middle". In other words, proxied HTTPS requests are terminated by the proxy and resent to the remote webserver. The server certificates presented to the client (i.e. a web browser) are dynamically generated/signed by the proxy and contain most of the same fields as the original webserver certificate. The subject DN, serial number, validity dates, and extensions are preserved. However, the issuer DN is now set to the name of the proxy's self-signed certificate and the public/private keys of the proxy are used in creating the forged certificate. These forged certificates are cached (in memory) by the proxy, for better performance." read more...

Download: http://crypto.stanford.edu/ssl-mitm/#download

Read More

PacketStormSecurity.org

"Packet Storm offers an abundant resource of up-to-date and historical security tools, exploits, and advisories. We are a non-profit organization comprised of security professionals that are dedicated to providing the information necessary to secure networks on a global scale. We accomplish this goal by publishing new security information on a global network of websites. " read more...

Website: http://packetstormsecurity.org

Read More

Crypto++ Library

Crypto++ Library is a free C++ class library of cryptographic schemes. This library supports following algorithms: Panama, Salsa20, Sosemanuk,ES (Rijndael), RC6, MARS, Twofish, Serpent, CAST-256, IDEA, Triple-DES (DES-EDE2 and DES-EDE3), Camellia, RC5, Blowfish, TEA, XTEA, Skipjack, SHACAL-2, VMAC, HMAC, CBC-MAC, DMAC, Two-Track-MAC, SHA-1, SHA-2 (SHA-224, SHA-256, SHA-384, and SHA-512), Tiger, WHIRLPOOL, RIPEMD-128, RIPEMD-256, RIPEMD-160, RIPEMD-320, RSA, DSA, ElGamal, Nyberg-Rueppel (NR), Rabin, Rabin-Williams (RW), LUC, LUCELG, DLIES (variants of DHAES), ESIGN, Diffie-Hellman (DH), Unified Diffie-Hellman (DH2), Menezes-Qu-Vanstone (MQV), LUCDIF, XTR-DH, ECDSA, ECNR, ECIES, ECDH, ECMQV.

Website: http://www.cryptopp.com

Read More

Honeyd - Network Rhapsody for You

"Honeyd is a small daemon that creates virtual hosts on a network. The hosts can be configured to run arbitrary services, and their personality can be adapted so that they appear to be running certain operating systems. Honeyd enables a single host to claim multiple addresses - I have tested up to 65536 - on a LAN for network simulation. Honeyd improves cyber security by providing mechanisms for threat detection and assessment. It also deters adversaries by hiding real systems in the middle of virtual systems." read more...

Website: http://www.honeyd.org

Read More

Helix - Incident Response & Computer Forensics Live CD

"Helix is a customized distribution of the Knoppix Live Linux CD. Helix is more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics.

Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix wil not auto mount swap space, or auto mount any attached devices. Helix also has a special Windows autorun side for Incident Response and Forensics." read more...

Download: http://www.e-fense.com/helix/downloads.php

Read More

Clam AntiVirus

"Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library." read more...

Website: http://www.clamav.net

Read More

Nikto: A Web Server Scanner

"Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

Nikto is not designed as an overly stealthy tool. It will test a web server in the shortest timespan possible, and it's fairly obvious in log files. However, there is support for LibWhisker's anti-IDS methods in case you want to give it a try (or test your IDS system)." read more...

Website: http://www.cirt.net/nikto2

Read More

WinPcap: The Windows Packet Capture Library

"WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.

WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. This library also contains the Windows version of the well known libpcap Unix API." read more...

Website: http://www.winpcap.org

Read More

Open Reverse Code Engineering Community

"OpenRCE.org founded in June of 2005 as the brainchild of Pedram Amini, the Open Reverse Code Engineering community was created to foster a shared learning environment among researchers interested in the field of reverse engineering. Heavily modeled on the architecture of Greg Hoglund's rootkit.com, OpenRCE aims to serve as a centralized r esource for reverse engineers (currently heavilywin32/security/malcode biased) by hosting files, blogs, forums articles and more." read more...

Website: http://www.openrce.org

Read More

Portable Executable File Viewer/Disassembler

"PEBrowse Professional is a static-analysis tool and disassembler for Win32/Win64 executables and Microsoft .NET assemblies produced according to the Portable Executable specifications published by Microsoft. For Microsoft Windows Vista, Windows XP, Windows 2000, and others.

With the PEBrowse disassembler, one can open and examine any executable without the need to have it loaded as part of an active process with a debugger. Applications, system DLLs, device-drivers and Microsoft .NET assemblies are all candidates for offline analysis using PEBrowse." read more...

Download:
http://www.smidgeonsoft.com/download/PEBrowse.zip

Read More

OpenSSL: The Open Source toolkit for SSL/TLS

" The OpenSSL Project is a collaborative effort to develop a robust, commercial grade, full featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLSv1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation. " read more...

Website: http://www.openssl.org

Read More

Snort - An Intrusion Detection/Prevention System

"SNORT^® is an open source network intrusion prevention and detection system utilizing a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods. With millions of downloads to date, Snort is the most widely deployed intrusion detection and prevention technology worldwide and has become the de facto standard for the industry." read more...

Download: http://www.snort.org/dl/

Read More

Sysinternals utilities

"One of my favorite set of free developer utilities on Windows is the sysinternals.com collection. Whether it's filemon to see what's writing to a file, regmon for the registry or process explorer to see what DLLs are in action (and much more), I find myself reaching for one or more utilities several times a year. Of course Microsoft bought the site a couple of years ago and the domain now redirects into Microsoft's site which thankfully is a bit quicker than it used to be." read more...

Website: http://sysinternals.com

Read More

Wireshark - A Network Protocol Analyzer

"Wireshark is the world's foremost network protocol analyzer, and is the de facto (and often de jure) standard across many industries and educational institutions.

Wireshark development thrives thanks to the contributions of networking experts across the globe. It is the continuation of a project that started in 1998." read more...

Website: http://www.wireshark.org

Read More

OllyDbg - A Powerful Debugger

"OllyDbg is a 32-bit assembler level analyzing debugger for Microsoft Windows. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. It predicts contents of registers, recognizes procedures, API calls, switches, tables, constants and strings, locates routines from object files and libraries, allows custom labels and comments in disassembled code, writes patches back to executable file and more." read more...

Website: http://www.OllyDbg.de

Read More