Truecrypt's Guide

Contents

• Introduction
• What's Truecrypt and what are its advantages
• Things to know before to try
• Using truecrypt
• Common Problems
• Conclusion

Download
http://www.truecrypt.org/downloads

Introduction

This is just a little guide about using truecrypt, I'm writing it because this great tool have been mentioned several times in r00tsec but there's no guide to use it yet. Many sites don't have a truecrypt guide because it use is fairly easy, however, every guide (including the Official Beginner's Manual) is about truecrypt's GUI which work in the interactive mode, this is why this guide is about using truecrypt from the console and will be a Linux based guide.

If you're like me, then you'll find every possible time to use some console command instead of using a GUI, so for you is this guide. Isn't perfect, isn't the greatest, but I'll do my best to cover the things that create more confusion about the tool, also, will be (or try to) easy to follow for those who are using the tool for the first time and those who already know the tool.

For convenience, I will be using several concepts to define different things, by "virtual volumes" I'll be meaning every group of clusters (random space in a hardrive or a hardrive partition), by "real volumes" I'll be meaning hardrives or partitions and by "removable volumes" I'll be referring to every removable device (like usb hardrives).

What's Truecrypt and what are its advantages

Truecrypt its an opensource tool build with privacy on mind. Its also referred as hard-disk encryption software, as of today, portable in most of the mayor systems. It works by encrypting the data 'on-the-fly', this means that, if I open a music file that is saved on a encrypted volume, this file will be decrypted in the RAM memory system while the data is asked by the music player, when saving the data, all the encrypting is done in the RAM as well while truecrypt reads the file(s) that are being saved in the volume.

From paranoids to companies, this is the best tool to use when you want to keep your information private for peeking eyes. If you're looking for a solution to keep your things private this tool will be your best friend for sure!

Truecrypt is loved by many because it has many important features and this is a list of them:

• Portable: Can be used in several of the mayor operating systems around, Windows, Linux and Mac OSX.
• Volume scope: You can encrypt just a portion of disk or disk partition by creating a virtual volume, you can encrypt a partition or hardrive entirely and you can encrypt removable devices.
• Several algorithms: At the time of this writing, Truecrypt support three encryption algorithms, AES, Twofish and Serpent.
• Cascades: Related with the avobe, one of the best things to enforce security is that you can use two or three algorithms at the same time, this is what is called cascades which are: AES-Twofish, AES-Twofish-Serpent, Serpent-AES, Serpent-Twofish-AES and Twofish-Serpent.
• Several hashes: Besides algorithms, truecrypt uses hashes to create random values from password and key files, at the time of this writing there are only three hashes available, SHA-1, RIPEMD-160 and Whirlpool.
• Passwords and key files: Truecrypt is flexible in the way that you can use only passwords to protect the encrypted volume or you can use passwords and key files. The key files are used as random data that is sourced and implemented while creating the hashes, the great thing is that any kind of file and even entire directories can be used as key file, meaing that you can use a mp3 file or a video avi file as key file.
• Interfaces: The tool can be used through a GUI (Graphical User Interface) or from the console which offer wider portability.
• Interactive use: For those who are starting to use the tool, this is the best. The interactive mode is used by truecrypt when there are no parameters passed to the initial command, this means that truecrypt will ask the user for every piece of information neede in order to create an encrypted volume thus avoiding errors that can be created by new users.
• Two kind of volumes: There are normal volumes and hidden volumes. At the beginning, every volume is a normal one, hidden volumes are created inside of normal volumes as a way to improve the privacy of the data.
• Plausible deniability: Related to the previous, this is by far one of the greatest advantage of this tool. Basically, since every truecrypt volume, unless decrypted, is showing as random data, it's almost impossible to know that such truecrypt volume exists, besides that, if the normal volume is expose (someone forces to give the access password), it's impossible to know that there's a hidden volume in it thus the information saved in that hidden volume.

You can deny that there are alot of advantages in the tool, and the best of all, is free ;)

Things to know before to try

When it comes to Linux systems, you need to have specifics kernel support in order "to use" truecrypt volumes, not to create them, just to use them. Also, the specific support you'll need depends on truecrypt's version you're using. Right now there are two mayor versions of the tool being used, the 4.3a and the 5.1a, this two have at least one very important difference regarding to linux support, the 4.3a uses device mapper while the 5.1a use FUSE (Userspace driver). Also, no matter what version of truecrypt you are using, you need to have the loop device support in the kernel.

So the first thing you'll need to check before start using truecrypt is that you have kernel support (activate them as modules or built-in accordingly to the truecrypt version you use):

Device Drivers --> Multiple devices drivers support (RAID and LVM) --> Device mapper support

File systems --> Filesystem in Userspace support

Device Drivers --> Block Devices --> Loopback device support



Using truecrypt

If you're starting to use this tool you need to understand at least how to encrypt what you need to encrypt, and to this, you need to understand that there are different scopes and kinds of volumes.

Virtual volumes: Lets say you have a linux partition in /dev/sda4 and this partition have 20GB of space. Now, virtual volumes are just a portion that can be reserved from a partition (or a hardrive if don't have any partitions), basically, is just a file with a fixed lenght that you create on a partition or hardrive. In /dev/sda4 a virtual volume could be one single file called private and be about 5GB of space, in turns, you have /dev/sda4 as a partition of 20GB with a file of 5GB. I call them virtual volumes because every truecrypt volume needs to be mounted and worked as if it was a single disk, so, even when it's actually just a file, it needs to be treated as if it was a real disk on your system.

Real volumes: Remember, as I said in the introduction, I'm using this terms as convenience so you can easily understand the way it all works, in the case of real volumes, I mean every partition or entire hardrive that's going to be encrypted. For instance, lets take the avobe example, you have a partition called /dev/sda4 and is about 20GB of space; You can encrypt the partition entirely, not just create a file on it, in the same way, if you have only one disk with no partitions at all, you can encrypt it completely. Those can be real volumes.

Removable volumes: This are just any kind of removable device where you can save data, like USB Hardrive, flashdrives and such.

Every truecrypt volume needs a path (like /media/sda4/private) which is going to be mapped then to a device in /dev, if it's a virtual volume, it will be mapped to /dev/mapper/truecryptN, this path is where the truecrypt volume is and is importand (demanded) to indicate it in order to create the volume. To use the volume, besides a known path, is need a mount point (like /mnt/something or /media/data), this is only used once the truecrypt volume have been created and mapped to device in /dev, this mount point is where you actually are going to save or access the data that is in the truecrypt volume, no worries if you don't catch this yet, you'll understand it later ;)

As I said before, this guide is about using truecrypt from the console in Linux systems, for a guide about the use with the graphical interface please refer to the Official user's guide:

http://www.truecrypt.org/docs/tutorial.php

From the command line, truecrypt has many parameters that can be used to create your volumes, I won't cover every possible use of those parameters so you can check all the options avialable issuing the command:

root@root [~]# truecrypt --help

However, if you've been following me so far, you should remember that I talked about the interactive mode in the advantages of truecrypt section. The great thing about this mode of operation is that you don't really need to know any other parameter in order to create a truecrypt volume, from the command line, the interactive mode is called like this:

root@root [~]# truecrypt --interactive

In this mode, the program will ask you everything that it needs to know to create a volume, the volume path, a password, a hash, a key file (optional), and other important stuff. This mode however can be called by truecrypt itself if the user issued some parameters but not every required to create the volume, for instance, lets say we create a volume called mystuff with the password uid0R00tS3c, the command could be something like this:

root@root [~]# truecrypt --password uid0R00tS3c --create /media/hda3/private

The thing with the above command is that it lacks of other important information, for example, the hash that should be used for the password, in this case, truecrypt will notice that not all the need parameters have been issued from the beginning so it will start to ask the user for all the missing data.

Moving on, using truecrypt is incredible easy, mostly thanks to the interactive mode. Starting from here, I'll be issuing several ways about how to use the tool to fit better your needs, feel free to ask or add whatever you think will improve this guide. For convenience, I'll be using two example disks, one is a partition /dev/hda2 that is mounted on /media/data, and the other will be an entire disk /dev/sda1 that will be mounted on /media/mydisk

Create a volume called 'private' on /dev/hda2:

root@root [~]# truecrypt --create /media/data/private

Create a volume called 'private' using the password R00tS3c:

root@root [~]# truecrypt --password R00tS3c --create /media/data/private

Create a volume called 'private' using password and the algorithm Twofish:

root@root [~]# truecrypt --password R00tS3c --encryption Twofish --create /media/data/private

Create a volume called 'private' with a blank password but using a key file:

root@root [~]# truecrypt --password '' --keyfile /home/rootsec/logo.jpg --create /media/data/private

Create a volume called 'private' with password, using cascade encryption and a directory as key file:

root@root [~]# truecrypt --password R00tS3c --keyfile /home/rootsec/documents --encryption AES-Twofish-Serpent --create /media/data/private

Create a volume called 'private' with password, key file, cascade and hash:

root@root [~]# truecrypt --password R00tS3c --keyfile /home/rootsec/mymovie.mpg --encryption Twofish-Serpent --hash SHA-1 --create /media/data/private

Create a key file called 'useme' using RIPEMD-160 hash

root@root [~]# truecrypt --keyfile-create --hash RIPEMD-160 /home/rootsec/useme

Add a key file to an existent volume called 'private':

root@root [~]# truecrypt --keyfile-add --change /home/rootsec/useme /media/data/private

Create a volume with an specific filesystem:

root@root [~]# truecrypt --filesystem ext3 --create /media/data/private

Create a volumen called 'private' with password and using a file as random generator instead of a hash:

root@root [~]# truecrypt --password R00tS3c --random-source /home/rootsec/drums.mp3 --create /media/data/private

Mount a volume called 'private' in /media/mystuff/:

root@root [~]# truecrypt /media/data/private /media/mystuff

Pass specific options to mount:

root@root [~]# truecrypt --mount-options ro /media/data/private /media/mystuff

The above will mount the truecrypt volume 'private' on /media/mystuff as read only

Create a volume with fixed space:

root@root [~]# truecrypt --size 200MB --create /media/data/private

The size can be used in KB, MB or GB, always put any of this, just putting the number will return an error.

Create a hidden volume:

root@root [~]# truecrypt --create /media/mydisk
root@root [~]# truecrypt --type hidden --size 2GB --create /media/mydisk

As I said before, hidden volumes are created inside normal volumes, this is way we need to create a normal value before. In this case (and if you remember) /media/mydisk is where the example /dev/sda1 disk is mounted, suppose that this disk is about 100GB, therefore, what we're doing here is create a hidden volume of 2GB inside that disk of 100GB.

Every truecrypt volume is mapped to /dev/mapper/truecryptN where 'N' is a number starting from 0 and assigned by avialability, lets say that you create one truecrypt volume, then it'll be mapped to /dev/mapper/truecrypt0, then you create another one, this will be mapped to /dev/mapper/truecrypt1, then you create another that will be mapped to /dev/mapper/truecrypt2 and so on. You can change this numbers for other if you like to avoid the automatic mapping. This is usefull when you have several truecrypt volumes and you need to know which is what:

root@root [~]# truecrypt --device-number 10 --create /media/data/private

This will map the truecrypt volume to /dev/mapper/truecrypt10

Change a volume: Imagine that you create the volume private with an space of 10GB but know you see that you don't need it to be so big, so lets change that:

root@root [~]# truecrypt --size 5GB --change /media/data/private

When you're doing this, you don't need to specify the older values, just the new ones, so if we want to change the password will use:

root@root [~]# truecrypt --password R00tS3c2 --change /media/data/private

List all mapped (thus mounted) truecrypt volumes:

root@root [~]# truecrypt --list

Unmount a truecrypt volume:

root@root [~]# truecrypt --dismount /media/data/private

Unmount all truecrypt volumes at once:

root@root [~]# truecrypt --dismount

Check the description of a volume:

root@root [~]# truecrypt --properties /media/data/private

Remove a truecrypt volume: If it's a virtual volume, all you need to do is erase the file, for instance, if I wanted to remove the 'private' volume created from previous examples, I'll use:

root@root [~]# rm /media/data/private

If you encrypted an entire partition or disk and you don't want it encrypted anymore, the only thing you can do is format.

Finally, if you want to save or access data in a truecrypt volume, all you have to do is mount it and save the data to the mount point, for instance, if I created the volume 'private' and mounted it in /media/mystuff, all I need to do in order to save my information in the encrypted volume is to copy (or move) the data to /media/mystuff.


Common problems

There are several common problems while using truecrypt but most of them are related to the lack of kernel support, but for a matter of completeness, this are the most common errors:

- Mount Failed: Yeah, this is all you'll see while trying to mount the volume :P This error is caused because device mapper support or FUSE (depending on truecrypt's version used) isn't active.

-Wrong FS: So, you're going to mount the volume and it shows:

mount: wrong fs type, bad option, bad superblock on /dev/mapper/truecrypt0,
missing codepage or other errorIn some cases useful info is found in syslog - try
dmesg | tail or so

When creating volumes (unless it's used the --filesystem option), truecrypt create those volumes using 'auto' filesystem which, for linux porpuses doesn't work for nothing, so, in order to avoid this error you'll need to create a filesystem in the volume like this:

root@root [~]# truecrypt --device-number 20 /media/data/private /media/mystuff && mkreiserfs /dev/mapper/truecrypt20

To actually create a file system on the truecrypt device, first its need to be mapped, that's why you need to mount it first and instally after create the file system you want, I used reiserfs but you can use whatever you like.
The '--device-number' option is optional, I used becuase is better if you want to control what device you're going to format.

-No free loopback device available: This error is because the lack of loop device support in the kernel (Device Drivers --> Block Devices --> Loopback support).


Conclusion

So we've come to the end of this guide, I hope you liked, I try to be the more specific I could and try to reach those who knows the toold and those who don't, however, this is not an strict guide, meaning that you can discuss, share, provide more examples of use or anything you like :)


Source - r00tsecurity

Read More

l517 - simple wordlist generator for windows.

L517 is a word-list generator for the Windows Operating System.

Overview

I wrote L517 to be the only word-list generator and editor I would ever need. L517 is small (considering what it does), it is fast (considering it's a Windows app), and it is lightweight (when not loading astronomically large lists). A user-friendly GUI requires no memorization of command-line arguments!
L517 contains hundreds of options for generating a large, personalized, and/or generic wordlist. With L517, you can generate phone numbers, dates, or every possible password with only a few clicks of the keyboard; all the while, filtering unwanted passwords.

Download
http://code.google.com/p/l517/downloads/list


Use this command to anonymously check out the latest project source code:

# Non-members may check out a read-only working copy anonymously over HTTP.
svn checkout http://l517.googlecode.com/svn/trunk/ l517-read-only

Features

Collecting

• Gathers words from many different file-types,
1. .txt
2. .mp3
3. .pdf
4. .ppt
5. .srt
6. .rtf
7. .doc / .docx
8. .htm / .html
9. .jpg / .jpeg
10. and many more
• Can handle both unix and windows text file types,
• Collect from every file in a directory (and subdirectories),
• Collect words from a website (strips HTML code), good for personalized wordlists (myspace, facebook, etc),
• Collect from dragged-and-dropped selected text or files,
• Collect words from pasted text (Ctrl+V).

Generating

• Generate any string of any length (an exhaustive 26-pattern character set is included),
• New in v0.91: L517 can pause and resume list generation! Simply click 'Cancel' while generating a list, and L517 will prompt to pause.
• Generate dates in different formats over any time period,
1. mm/dd/yy : 12/31/10
2. mm/dd/yy : 12/31/2010
3. dd/mm/yy : 31/12/10
4. dd/mm/yyy : 31/12/2010
5. mmm/dd/yy : december/10/10
6. mmm/dd/yyy : december/10/2010
7. dd/mmm/yy : 10/december/10
8. dd/mmm/yyy : 10/december/2010
• Generate phone numbers based on location (United States only). Input a city and the L517 will look-up all area-codes and prefixes of that city, then generate every possible phone-number based on those prefixes.
• "Analyze" is a new option in v0.2; when "analyzing," L517 discovers and extracts patterns in the list by looking at both prefixes (beginning) and postfixes (end) of items. The analysis results in two lists of commonly used prefixes and postfixes. Great for actual password lists.

Filtering

• Filter by length (minimum/maximum).
• Convert list to lowercase, UPPERCASE.
• Copy words to new formats: First Letter Upper and/or eVeRy OtHeR lEtTeR.
• 13375P34K (leetspeak) case mutator.
• Reads from 'leetspeak.txt' (included at program start-up, can be edited by the user).
• Generates every possible mutation of a word. For example: If the 'leetspeak.txt' file has "a,A,@,4" as different values for 'a', then L517 would generate the following for the item "aa":
• aa
• Aa
• @a
• 4a
• aA
• AA
• @A
• 4A
• a@
• and so on...

• Strip out certain text from items that already exist, and also as they are added.
• Convert special characters to the hex equivalent. i.e. convert !@#$%^& to %20%40%21%22%23.
• Include foreign characters. this gathers words that are beyond the scope of the alphabet and 0-9 number syetem, such as àçéîÿöû.

Mutating

Add mutations to items already on the list -- append [right-side] and/or prepend [left-side]. These are useful when generating a password list:

1. Add each number 0-9 to every item on the list,
2. Add every letter (a-z) to each item on the list,
3. Add every word from L517's default prefix/postfix wordlist to every item in the list,
4. Add every word from your own wordlist to every item in the current list.

List options

• Sort alphabetically (automatic).
• Remove duplicate entries, (slow, but accurate and stable).
• Find item in list, Find Next.
• Remove, Remove by string, and Clear.
• Save list to files in sections (split by number of items in each file).
• i.e. L517 can save any number of items per file, so no wordlist file will grow to be too large (L517 will save to many smaller files).
• Save in Windows/DOS text format, or *nix format.

Installation & Execution

L517 requires MSVBVM60.DLL and MSCOMCTL.OCX in order to run.

• MSVBVM60.DLL has been standard on all Windows machines since Win98SE. Vista and Windows 7 include it.
• MSCOMCTL.OCX is not as common, but it is available as a download in the 'Downloads' section. Save this file to your Windows System32 folder and L517 should execute properly.

These files are required so that the program will run properly.
L517 also uses Xpdf's executable: pdftotext.exe. This file is needed to extract text from .PDF files, and is also included in the L517 executable.

Linux Compatibility

Beta testers have run L517 in Linux under Wine. The Visual Basic 6.0 Runtime Installer needs to be run in Wine before L517 can be executed.

Changes

• v0.8 : Language support for French, German, and Spanish; available in HELP menu.
• v0.7 : Customizable 'leetspeak' case mutations.
• v0.6 : Paste (Ctrl+V) in the EDIT menu; various bug fixes.
• v0.5 : Corrected case bugs.
• v0.4 : Fixed RICHTX32.OCX error; Removed RichTextControl from project -- replaced with built-in Microsoft Word API's for .doc files.
• v0.3 : New 'phone number' generation option; Generate based on charset; Two new cases; Split files every # of items.
• v0.2 : 'Analyzer' option; Fixed bugs; More help documentation.
• v0.1 : First public release.

Read More

Vega Web Security Scanner 1.0 Beta

Vega is a GUI-based, multi-platform, free and open source web security scanner that can be used to find instances of SQL injection, cross-site scripting (XSS), and other vulnerabilities in your web applications. Vega also includes an intercepting proxy for interactive web application debugging. Vega attack modules are written in Javascript, users can easily modify them or write their own.

Downloads

Windows (32-bit) - http://packetstormsecurity.org/files/download/107367/VegaSetup32.exe
Windows (64-bit) - http://packetstormsecurity.org/files/download/107368/VegaSetup64.exe

Linux (32-bit) - http://packetstormsecurity.org/files/download/107369/VegaBuild-linux.gtk.x86.zip
Linux (64-bit) - http://packetstormsecurity.org/files/download/107370/VegaBuild-linux.gtk.x86_64.zip

Mac OS X (32-bit) - http://packetstormsecurity.org/files/download/107365/Vega.dmg
Mac OS X (64-bit) - http://packetstormsecurity.org/files/download/107366/Vega64.dmg

Read More

Stunnel SSL Wrapper 4.48

The stunnel program is designed to work as an SSL encryption wrapper between remote client and local (inetd-startable) or remote server. It can be used to add SSL functionality to commonly used inetd daemons like POP2, POP3, and IMAP servers without any changes in the programs' code. Stunnel uses OpenSSL libraries for cryptography, so it supports whatever cryptographic algorithms you compiled into your library.

Download : http://www.stunnel.org/?page=downloads

Read More

A little guide for linux distros

Hi Security Explorers, Linux is growing really fast now a days and i believe it is the future of OS. Anyway there is still a lot of Linux distros that may confuse a new user in first so i thought to write an article about it.

What is a distro?
distro is short for Linux distribution.
Linux kernel is written by Linus Torvalds. Its open source so anyone can use or edit it.
A distro in short, contain Linux kernel, a set of utilities from GNU project with graphical support.

There is a big number of distros available now a days and i am gonna categories them according to your need.

For new users:

PinguyOS
Pinguy OS an out-of-the-box working operating system for everyone, not just geek. I personally suggest this distro. Its loaded with really nice set of tools, all a normal user needs is already packed with a nice looking UI and also drivers play nice out of the box for all my devices bluetooth dongel, wireless pair of keyboard and mice, lan card etc.

 

 

PClinuxOS is also nice in this category.

For average users:

Linux Mint
Today many refer it as improved Ubuntu, but its much more. Mints UI is enhanced for usability and package selection is really nice. Browser plugins, media codecs, support for DVD playback, Java and other components are included and working out of the box. Its compatible with Ubuntu software repository.

 
If you have a notebook or a low end desktop have a look at the Mint lxd.
Ubuntu is the standard now a days but i personally don't like unity so i prefer to go with the mint.

Fedora
If you wanna have your hands on the latest open source technologies Fedora is the way to go. Its fast, stable, secure and powerful.

For Geeks:

FreeBSD
FreeBSD is an indirect descendant of AT&T UNIX. Its fast, high-performance and extremely stable operating system with a complete command-line package management infrastructure and over 21,000 software applications (or "ports") for installation.

 

For Netbooks:

Jolicloud

For the netbooks Joli OS is perfect OS. Also try it on your slow desktop it gonna turn your pc in a beast.But notice that you can only use it if you have a lan or wifi access to the Internet.

Running Linux:

You can run almost any Linux from usb using Unetbootin or burn it in a cd/dvd using imgburn.

For the people who wanna explore more in the Linux world here is some more nice distros to try.

XBMC Live 

Turn your pc into a media center.

Backtrack

All a security expert/hacker needs!

Macpup

Good looking and fast!

Tinucore

A (really) small linux distro. Come in a 10mb iso.

Find more amazing Linux distros at distrowatch.

Leave comment and suggestions below.

Thanx for reading.

Read More

Packet Fence 3.0.3

PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.
Changes: A minor release focused on important fixes but with some enhancements. There are performance improvements, Cisco 6500 switch support, better support for the HP Procurve 5400, translation improvements, new add-on tools, and better documentation. There are cosmetic changes in the Web Admin, fixes for some network device problems, several inline enforcement improvements, and handling of some captive portal corner cases.
Download - http://www.packetfence.org/download/releases.html

Read More

w3af Web Application Attack and Audit Framework 1.1

w3af, is a Web Application Attack and Audit Framework. The w3af core and it's plugins are fully written in python. The project has more than 130 plugins, which check for SQL injection, cross site scripting (xss), local and remote file inclusion and much more.
Changes: Increased performance using gzip encoding, hundreds of bugs fixed, enhanced embedded bug report system added and more.

Download

There are four different ways of getting your hands w3af:

- Download one of the release packages, which include files for Windows and Linux.

- Get the latest (and unstable) version from the development SVN using this command:

      svn co https://w3af.svn.sourceforge.net/svnroot/w3af/trunk w3af

- Download the Samurai Live CD, which has w3af preinstalled with all the dependencies but at this point the LiveCD does not include 1.0-rc3.

- Or run "apt-get install w3af" in your Debian system and get 1.0-rc2

Read More

Suricata IDPE 1.1

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.
Changes: Performance, accuracy, and stability were improved. Many HTTP rule keywords added. Several SSL keywords have been added. Event suppression support was added. SCTP decoding support was added. IPS mode was improved. An SMTP parser was added. Protocol detection was improved. Extended HTTP output was added. AF_PACKET support was added. PF_RING support was improved. Pcap logging was added. The stream engine was improved.

Download - http://www.openinfosecfoundation.org/index.php/downloads

Read More

John The Ripper 1.7.8 Jumbo 8

John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. It supports several crypt(3) password hash types commonly found on Unix systems, as well as Windows LM hashes. On top of this, many other hash types are added with contributed patches, and some are added in John the Ripper Pro.
Changes: OpenMP support has been added for MD5-based crypt(3) and Apache $apr1$ hashes when building with SSE2 intrinsics, as well as for SAP CODVN B and SAP CODVN G. Raw MD4 has been enhanced with optional SSE2 intrinsics. The SSE2 intrinsics code for MD4, MD5, and SHA-1 has been pre-built with Intel's compiler into an assembly file, used with the new i-suffixed make targets. Support for occasional false positives or multiple correct guesses has been added and made use of for WinZip/AES and CRC-32. md5_gen has been renamed to dynamic. Numerous other fixes and enhancements have been made.

Download one of the latest official free versions (release notes):

• John the Ripper 1.7.8 (stable, Unix - sources, tar.gz, 830 KB) and its signature
• John the Ripper 1.7.8 (stable, Unix - sources, tar.bz2, 680 KB) and its signature
• John the Ripper 1.7.0.1 (stable, Windows - binaries, ZIP, 1360 KB) and its signature
• John the Ripper 1.7.0.1 (stable, DOS - binaries, ZIP, 895 KB) and its signature

Download the latest community-enhanced version (release notes):

• John the Ripper 1.7.8-jumbo-8 (sources, tar.gz, 1371 KB) and its signature
• John the Ripper 1.7.8-jumbo-8 (sources, tar.bz2, 1144 KB) and its signature

Read More

Torsocks 1.2 Released

We are happy to announce the release of Torsocks 1.2.
Torsocks is an application for Linux, BSD and Mac OSX that allows you to use network applications such as ssh and irssi with Tor.
A quick guide to using Torsocks and an overview of its compatibility with a variety of popular applications is available at the project's home page.
The focus for this release was to add a test suite, clean up the source code, simplify the build, compile on more versions of BSD, and add a few new defences that make it harder for users to leak information that might compromise their anonymity.
Full details of the changes are available in the release change log.

Download--http://code.google.com/p/torsocks/downloads/list

Read More

The Volatility Framework: Volatile memory artifact extraction utility framework

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research. 

Video Demontration-http://secxplrd.blogspot.com/2011/10/windows-password-retrieval-and-cracking.html

The Volatility Framework demonstrates our committment to and belief in the importance of open source digital investigation tools . Volatile Systems is committed to the belief that the technical procedures used to extract digital evidence should be open to peer analysis and review. We also believe this is in the best interest of the digital investigation community, as it helps increase the communal knowledge about systems we are forced to investigate. Similarly, we do not believe the availability of these tools should be restricted and therefore encourage people to modify, extend, and make derivative works, as permitted by the GPL.

Capabilities

The Volatility Framework currently provides the following extraction capabilities for memory samples

• Image date and time
• Running processes
• Open network sockets
• Open network connections
• DLLs loaded for each process
• Open files for each process
• Open registry handles for each process
• A process' addressable memory
• OS kernel modules
• Mapping physical offsets to virtual addresses (strings to process)
• Virtual Address Descriptor information
• Scanning examples: processes, threads, sockets, connections,modules
• Extract executables from memory samples
• Transparently supports a variety of sample formats (ie, Crash dump, Hibernation, DD)
• Automated conversion between formats

Supported Samples

The Volatility Framework can extract digital artifacts from volatile memory samples captured from:

• 32bit Windows XP Service Pack 2 and 3
• 32bit Windows 2003 Server Service Pack 0, 1, 2
• 32bit Windows Vista Service Pack 0, 1, 2
• 32bit Windows 2008 Server Service Pack 1, 2 (there is no SP0)
• 32bit Windows 7 Service Pack 0, 1

Example Data

If you want to give Volatility a try, you can download one of the samples listed within the Volatility FAQ.

Download

Volatility-2.0: tar.gz / zip / standalone EXE / EXE (python installed) / md5 / sha1
Volatility-1.3_Beta: tar.gz zip md5 sha1 gpg tar.gz gpg zip gpg_key
Volatility-1.1.2: tar.gz zip md5 sha1 gpg tar.gz gpg zip gpg_key
Volatility-1.1.1: tar.gz md5 sha1 gpg gpg_key

Read More

Download:Metasploit 4.1 and Armitage: What's New?

Metasploit 4.1.0 is the first release that includes Metasploit Community Edition, a free, optional extension to the Metasploit Framework, which enables comprehensive network discovery, a module browser, directed exploitation, and third party vulnerability information import, all via a graphical user interface. In addition, this release also includes:

For all versions, a complete overhaul and expansion of the Hosts tab, now called the Analysis Tab, with signficant improvements to the searching and sorting of hosts, vulnerabilities, credentials, collected evidence, and notes.
For Metasploit Express and Metasploit Pro, a redesigned Reports section, where all reports are now first-class generated reports. Generated reports also support a portable HTML format for easy in-browser viewing.
For Metasploit Pro, automatic tagging of new host records from discovery scans, Nexpose scans, or third party imports.

Download
Select your prefered OS

• Windows Download
• Linux 32-Bit Download
• Linux 64-Bit Download

Metasploit Edition -After Installation
Metasploit Pro Request- 7-day trial or enter purchased license.
Metasploit Express- Enter purchased license.
Metasploit Community -Request free product key.
Metasploit Framework -No registration required.

 

This video shows some of the new features in Armitage for Metasploit 4.1. You'll see improved tab management features, more exploit feedback, VNC, brute forcing, token stealing, and an export data feature to aid reporting. This video also offers a quick glimpse of the Metasploit Community Edition. You can learn more about Armitage at http://www.fastandeasyhacking.com/

Read More

PacketFence 3.0.2

PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.
Changes: This minor release focused on small improvements and fixes, including some security fixes. Enhancements included Trapeze hardware support, support for wireless devices in bridge mode, and guest management options put behind configurable values. There were several inline enforcement and guest management fixes, changes to default firewall rules, fixes for long-standing issues with the pie charts in the Web admin, and several other minor bugfixes.

Download Here

Read More