inundator v0.5 Released – IDS/IPS/WAF Evasion & Flooding Tool
inundator is a multi-threaded, queue-driven, IDS evasion tool. Its purpose is to anonymously flood intrusion detection systems (specifically Snort) with traffic designed to trigger false positives via a SOCKS proxy in order to obfuscate a real attack.
http://inundator.sourceforge.net/
Safe3 SQL Injector – Automatic Detection & Exploitation Of SQL Injection Flaws
Safe3 SQL Injector is one of the most powerful penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of back-end database servers.
http://code.google.com/p/safe3si/
REMnux: A Linux Distribution For Reverse-Engineering Malware
REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. The distribution is based on Ubuntu and is maintained by Lenny Zeltser.
http://zeltser.com/remnux/
Andiparos – Open Source Web Application Security Assessment Tool
Andiparos is a fork of the famous Paros Proxy. It is an open source web application security assessment tool that gives penetration testers the ability to spider websites, analyze content, intercept and modify requests, etc.
http://code.google.com/p/andiparos/
Metasploit Framework 3.4.1 Released – 16 New Exploits, 22 Modules & 11 Meterpreter Scripts
The Metasploit Project is proud to announce the release of the Metasploit Framework version 3.4.1. This release sees the first official non-Windows Meterpreter payload, in PHP.
http://www.metasploit.com/
thc-ipv6 Toolkit – Attacking the IPV6 Protocol
A complete tool set to attack the inherent protocol weaknesses of IPV6 and ICMP6, and includes an easy to use packet factory library. Please note to get full access to all the available tools you need to develop IPV6 tools yourself or submit patches, tools and feedback to the thc-ipv6 project.
http://thc.org/thc-ipv6/
Sagan – Real-time System & Event Log (syslog) Monitoring System
Sagan is a multi-threaded, real time system- and event-log monitoring system, but with a twist. Sagan uses a “Snort” like rule set for detecting “bad things” happening on your network and/or computer systems. If Sagan detects a “bad thing” happening, that event can be stored to a Snort database (MySQL/PostgreSQL) and Sagan will correlate the event with your Snort Intrusion Detection/Intrusion Prevention (IDS/IPS) system. Sagan is meant to be used in a ‘centralized’ logging environment, but will work fine as part of a standalone Host IDS system for workstations.
http://sagan.softwink.com/
PlainSight – Open Source Computer Forensics LiveCD
PlainSight is a versatile computer forensics environment that allows inexperienced forensic practitioners perform common tasks using powerful open source tools such as RegRipper, Pasco, Mork, Foremost and many more.
http://www.plainsight.info/
WPA2 Vulnerability Discovered – “Hole 196″ – A Flaw In GTK (Group Temporal Key)
Malicious insiders can exploit the vulnerability, named “Hole 196″ by the researcher who discovered it at wireless security company AirTight Networks. The moniker refers to the page of the IEEE 802.11 Standard (Revision, 2007) on which the vulnerability is buried. Hole 196 lends itself to man-in-the-middle-style exploits, whereby an internal, authorized Wi-Fi user can decrypt, over the air, the private data of others, inject malicious traffic into the network and compromise other authorized devices using open source software, according to AirTight.
http://www.networkworld.com/newsletters/wireless/2010/072610wireless1.html
iKAT – Interactive Kiosk Attack Tool v3
iKAT was designed to aid security consultants with the task of auditing the security of a Windows based internet Kiosk terminal. iKAT is designed to provide access to the underlying operating system of a Kiosk terminal by invoking native OS functionality. This tool should be (and is) used by Kiosk vendors/developers/suppliers to test the security of their own Kiosk products.
http://ikat.ha.cked.net/
Knock v1.4.2b – Subdomain Enumeration/Brute-Forcing Tool
Knock is a python script designed to enumerate sub-domains on a target domain through a wordlist.
http://knock.gianniamato.it/download.php
Websecurify 0.7RC1 - powerful web application security testing
Websecurify is a powerful web application security testing environment designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies.
http://code.google.com/p/websecurify/
