markbickford.com   Help For All Your Technology Needs
Home Tips Free Software
Legal Aid
Search Tools
Fire Logo

Forensics workstation/Data Recovery

Instantly deploy a forensics workstation with tct, tctutils, mac-robber, and autopsy
also provides perl 5.6.1 compiled with Large File Support.

Live System Incident Response
Binaries are available for Incident Response on a live machine.

Virus Scanning

Utilizing F-Prot 3.11beta http://www.f-prot.com you can scan for virii, worms, trojans, and all around harmful code.
Just mount the filesystems that you want to scan and execute 'f-prot . '
Any filesystem you can mount, you can scan.  mount and scan fat/ntfs/ext2/ext3/reiserfs partitions
Scan your windows machines offline for virii that may not be detected with an "after the fact" anti-virus
software installation.

Pen-Testing Platform
I should NOT have to explain this portion.

Tools:


Base OS
Forensics/Data Recovery
Incident Response
Pen-Test
Static Linked Binary
Virus Scanning
Note: some packages have multiple uses and will be listed more than once.
Not all packages input yet...


Base OS (38 Packages)

     Name Description License
     bsed binary stream editor

GNU General Public License (GPL)
    
     burneye v1.0 burneye ELF encryption program, x86-linux binary

GNU General Public License (GPL)
    
     cgrep v8.13 shows context of matching patterns found in files cgrep provides all the features of grep, egrep, and fgrep

GNU General Public License (GPL)
    
     cpio GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.

GNU General Public License (GPL)
    
     curl v7.10.4 Curl is a tool for transferring files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. Curl supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading, kerberos, HTTP form based upload, proxies, cookies, user+password authentication, file transfer resume, http proxy tunneling and a busload of other useful tricks.

GNU General Public License (GPL)
    
     di v3.8 (disk info) 'di' is a disk information utility, displaying everything (and more) that your 'df' command does. It features the ability to display your disk usage in whatever format you desire/prefer/are used to.

di License
    
     echoping echoping is a small program to test (approximatively) performances of a remote host by sending it TCP echo (or other protocol) packets.

GNU General Public License (GPL)
    
     expect v5.32.2 Expect is a tool for automating interactive applications such as telnet, ftp, passwd, fsck, rlogin, tip, etc. Expect is also useful for testing these same applications.

GNU General Public License (GPL)
    
     fdisk fdisk - general partion tool

GNU General Public License (GPL)
    
     gentoo v0.11.34 file manager gentoo is a modern, powerful, flexible, and utterly configurable file manager for UNIX systems, written using the GTK+ toolkit. It aims to be 100% graphically configurable; there's no need to edit config files by hand and then restart the application. gentoo is somewhat inspired in its look & feel by the classic Amiga program DirectoryOpus 4, but is not a "clone".

GNU General Public License (GPL)
    
     gpg v.1.2.1 GnuPG stands for GNU Privacy Guard and is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC 2440. As such, it is aimed to be compatible with PGP from NAI Inc.

GNU General Public License (GPL)
    
     Java JRE v1.4 Sun's java run time environment

GNU General Public License (GPL)
    
     lha lha

GNU General Public License (GPL)
    
     links v0.9x Links is a text-based browser with support for HTML tables and frames.

GNU General Public License (GPL)
    
     lsof v4.66 list open files

GNU General Public License (GPL)
    
     lufs v0.8.3 linux user file system support: sshfs, localefs, gvfs, ftpfs, cefs

GNU General Public License (GPL)
    
     macchanger v1.3.0 Change your mac address

GNU General Public License (GPL)
    
     mc Midnight commander interface

GNU General Public License (GPL)
    
     minicom v2.00 a unix telecomm program

GNU General Public License (GPL)
    
     Mozilla v0.9.8 Mozilla is an open-source web browser, designed for standards compliance, performance and portability.

GNU General Public License (GPL)
    
     partimage v0.6.2 Partition Image is a Linux/UNIX utility which saves partitions in many formats to an image file. (Not Forensically sound, but good for system recovery work)

GNU General Public License (GPL)
    
     perl 5.8.0 compiled with support for >2G files, including a bunch o useful perl modules to boot.

GNU General Public License (GPL)
    
     ppp ppp support

GNU General Public License (GPL)
    
     radmind v0.9.2 remote administration daemon

UMich BSD Style License
    
     rlogin rlogin

GNU General Public License (GPL)
    
     rpcinfo ya gotta keep rpc enumerated...

GNU General Public License (GPL)
    
     secure-delete v2.3 secure deletion utilities - sswap, srm, ...

GNU General Public License (GPL)
    
     snmputils gotta be able to snmpwalk dontchya?

GNU General Public License (GPL)
    
     Sonar v1.0BETA4 Sonar is a network reconnaissance utility which runs all its scans from plugins. The currently supported plugins are an ICMP scan and an ACK scan which can see if hosts that don't respond to ICMP are online. Changes: This release fixes a few annoying bugs. The ICMP scan has been made more versatile, allowing you to choose an ICMP type and ICMP code

GNU General Public License (GPL)
    
     sshd v3.1p1 This is RedHat's back patched version. Yes... It IS up to date, and is NOT currently exploitable based on RedHat's rpm. (until the NEXT ssh exploit is found of course!)

GNU General Public License (GPL)
    
     tcpdump v3.7.1 Tcpdump allows you to dump the traffic on a network. It can be used to print out the headers of packets on a network interface that matches a given expression. You can use this tool to track down network problems, to detect "ping attacks" or to monitor the network activities.

BSD License
    
     telnetd telnetd, sometimes you just need the basics

GNU General Public License (GPL)
    
     TestDisk v4.4 Tool to check and undelete partition Works with the following partitions: - FAT12 FAT16 FAT32 - Linux - Linux SWAP (version 1 and 2) - NTFS (Windows NT) - BeFS (BeOS) - UFS (BSD) - Netware - ReiserFS

GNU General Public License (GPL)
    
     tftpd tftpd

GNU General Public License (GPL)
    
     upx v1.24 "the Ultimate Packer for eXecutables"

GNU General Public License (GPL)
    
     w3m v0.4.1 a text based web browser and pager

MIT License
    
     webfsd v1.19 nice and lite web server daemon

GNU General Public License (GPL)
    
     wipe v2.0 Wipe is a secure file wiping utility.

GNU General Public License (GPL)

Top

Forensics/Data Recovery (51 Packages)

     Name Description License
     AIDE v0.9 AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire. It does the same things as the semi-free Tripwire and more.

GNU General Public License (GPL)
    
     argus the network Audit Record Generation and utilization System. The Argus Open Project is focused on developing network activity audit strategies that can do real work for the network architect, administrator and network user.

Quosient public license
    
     Autopsy v1.7.1 The Autopsy Forensic Browser is an HTML-based graphical interface to The Sleuth Kit and standard UNIX utilities. Autopsy automates many of the tasks required during a digital forensic analysis using the TASK collection of powerful command line tools as a foundation. Since this graphical interface is separate from the file system tools, an investigator can still use a command line interface if Autopsy cannot accomplish the desired outcome.

GNU General Public License (GPL)
    
     biew v5.3.2 BIEW- is a free, portable, advanced file viewer with built-in editor for binary, hexadecimal and disassembler modes.

GNU General Public License (GPL)
    
     bsed binary stream editor

GNU General Public License (GPL)
    
     bwplot Plot information about packet captures.

GNU General Public License (GPL)
    
     chkrootkit v0.40 chkrootkit is a tool to locally check for signs of a rootkit

chkrootkit license
    
     CmosPwd v4.2 Cmos password recovery tools Works with the following BIOSes - ACER/IBM BIOS - AMI BIOS - AMI WinBIOS 2.5 - Award 4.5x/4.6x - Compaq (1992) - Compaq (New version) - IBM (PS/2, Activa, Thinkpad) - Packard Bell - Phoenix 1.00.09.AC0 (1994), a486 1.03, 1.04, 1.10 A03, 4.05 rev 1.02.943, 4.06 rev 1.13.1107 - Phoenix 4 release 6 (User) - Gateway Solo - Phoenix 4.0 release 6 - Toshiba - Zenith AMI

GNU General Public License (GPL)
    
     cryptcat encryption enabled netcat

GNU General Public License (GPL)
    
     dcfldd - (or edd, enhanced dd) the original dd tool enhanced with MD5 hashing built it. development work completed by DoD Computer Forensics lab.

GNU General Public License (GPL)
    
     Disk Investigator (win32) Disk viewer

GNU General Public License (GPL)
    
     dsniff tools v2.3 dsniff is a collection of tools for network auditing and penetration testing. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI.

GNU General Public License (GPL)
    
     editreg linux command line tool to examine windows registries.

GNU General Public License (GPL)
    
     ethereal v.0.9.11 Ethereal is a free network protocol analyzer for Unix and Windows.

GNU General Public License (GPL)
    
     fatback v1.3 DoD Computer forensics lab developed tool to undelete files from FAT filesystems

GNU General Public License (GPL)
    
     fenris v0.3 fenris is a multipurpose tracer, stateful analyzer and partial decompiler intended to simplify bug tracking, security audits, code, algorithm, protocol analysis and computer forensics by providing a structural program trace, general information about internal constructions, execution path, memory operations, I/O, conditional expression info, and much more.

GNU General Public License (GPL)
    
     foremost v0.64 Digs through an image file to find files within using header information.

GNU General Public License (GPL)
    
     FTimes v3.2.1 FTimes (a.k.a ftimes) is a system baselining and evidence collection tool. The primary purpose of FTimes is to gather and/or develop information about specified directories and files in a manner conducive to intrusion analysis.

GNU General Public License (GPL)
    
     gpart 0.1h Gpart is a tool which tries to guess the primary partition table of a PC-type hard disk in case the primary partition table in sector 0 is damaged, incorrect or deleted. The guessed table can be written to a file or device.

GNU General Public License (GPL)
    
     hbd v0.2.3 The HomeBrew Java decompiler

GNU General Public License (GPL)
    
     hexedit v1.2.1 ncurses based hexeditor

GNU General Public License (GPL)
    
     LDE - Linux Disk Editor v2.5 LDE allows you to view and edit disk blocks as hex and/or ASCII, view/navigate directory entries, and view and edit formatted inodes. Most of the functions can be accessed using the program's curses interface or from the command line so that you can automate things with your own scripts.

GNU General Public License (GPL)
    
     logdump v1.0 Extracts syslog data from tcpdump savefiles.

GNU General Public License (GPL)
    
     MAC Daddy MAC Time collector for forensic incident response. This toolset is a modified version of the two programs tree.pl and mactime from the Coroner's Toolkit by Dan Farmer and Venema Weiste.

GNU General Public License (GPL)
    
     mac-robber v1.0 mac-robber is a forensics and incident response program that collects Modified, Access, and Change (MAC) times from files. Its output can be used as input to the mactime tool in The Coroner's Toolkit (TCT) to make a timeline of file activity. mac-robber is similar to running the grave-robber tool with the '-m' flag, except this is written in C and not Perl. This work was done at @stake

GNU General Public License (GPL)
    
     md5deep v0.16 (linux & win32) md5deep is a cross-platform program to compute MD5 message digests on an arbitrary number of files.

GNU General Public License (GPL)
    
     memfetch v0.04b Linux on-demand process image dumper

GNU General Public License (GPL)
    
     ngrep v1.40 Ngrep is a powerful network sniffing tool which strives to provide most of GNU grep's common features, applying them to all network traffic.

Other/Proprietary License with Source
    
     ol2mbox - libPST v1.0.4 - libDBX v1.0.3 provide libraries and applications for the conversion of Outlook and Outlook Express data files to Linux MBOX format.

GNU General Public License (GPL)
    
     partimage v0.6.2 Partition Image is a Linux/UNIX utility which saves partitions in many formats to an image file. (Not Forensically sound, but good for system recovery work)

GNU General Public License (GPL)
    
     perl 5.8.0 compiled with support for >2G files, including a bunch o useful perl modules to boot.

GNU General Public License (GPL)
    
     photorec v1.0 PhotoRec is a little tool to recover pictures from digital camera memory

GNU General Public License (GPL)
    
     pwl9x v0.07 Windows 9x Password List reader is a program that will allow you to see the passwords contained in your Windows pwl database under Unix. You can check the security of these files/try to recover the main password using the bruteforce mode.

GNU General Public License (GPL)
    
     rda v0.2.1 RDA is a computer forensics tool to remotely acquire data.

GNU General Public License (GPL)
    
     rec (reverse engineering compiler) Reverse Engineering compiler

Other/Proprietary License with Free Trial
    
     ree v1.3 ree (ROM extension extractor) scans your memory (/dev/mem) for ROM extensions, and writes them out to files. ROM extensions are BIOSes which reside on ROM chips in your computer.

GNU General Public License (GPL)
    
     snort v2.0 (inline) snort! need i say more?

GNU General Public License (GPL)
    
     ssldump v0.9b3 ssldump is an SSLv3/TLS network protocol analyzer. It identifies TCP connections on the chosen network interface and attempts to interpret them as SSLv3/TLS traffic. When it identifies SSLv3/TLS traffic, it decodes the records and displays them in a textual form to stdout. If provided with the appropriate keying material, it will also decrypt the connections and display the application data traffic.

GNU General Public License (GPL)
    
     StegDetect v0.5 Stegdetect is an automated tool for detecting steganographic content in images. It is capable of detecting several different steganographic methods to embed hidden information in JPEG images. Currently, the detectable schemes are jsteg, jphide (Unix and Windows), invisible secrets, and outguess 01.3b.

BSD License
    
     tcpdstat get summary information of a tcpdump file. tcpdstat reads a tcpdump file using the pcap library and prints the statistics of a trace. The output includes the number of packets, the average rate and its standard deviation, the number of unique source and destination address pairs, and the breakdown of protocols.

GNU General Public License (GPL)
    
     tcpdump v3.7.1 Tcpdump allows you to dump the traffic on a network. It can be used to print out the headers of packets on a network interface that matches a given expression. You can use this tool to track down network problems, to detect "ping attacks" or to monitor the network activities.

BSD License
    
     tcpflow v0.20 tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.

GNU General Public License (GPL)
    
     tcpreplay v1.4 Tcpreplay is aimed at testing the performance of a NIDS by replaying real background network traffic in which to hide attacks. Tcpreplay allows you to control the speed at which the traffic is replayed, and can replay arbitrary tcpdump traces. Unlike programmatically-generated artificial traffic which doesn't exercise the application/protocol inspection that a NIDS performs, and doesn't reproduce the real-world anomalies that appear on production networks (asymmetric routes, traffic bursts/lulls, fragmentation, retransmissions, etc.), tcpreplay allows for exact replication of real traffic seen on real networks.

GNU General Public License (GPL)
    
     tcpslice v1.2a1 a tool for extracting portions of packet trace files generated using tcpdump's -w flag.

GNU General Public License (GPL)
    
     tcptrace v6.2.0 tcptrace is a tool written by Shawn Ostermann at Ohio University, for analysis of TCP dump files. It can take as input the files produced by several popular packet-capture programs, including tcpdump, snoop, etherpeek, HP Net Metrix, and WinDump. tcptrace can produce several different types of output containing information on each connection seen, such as elapsed time, bytes and segments sent and recieved, retransmissions, round trip times, window advertisements, throughput, and more. It can also produce a number of graphs for further analysis.

GNU General Public License (GPL)
    
     TCT v1.11 TCT is a collection of programs by Dan Farmer and Wietse Venema for a post-mortem analysis of a UNIX system after break-in.

GNU General Public License (GPL)
    
     TestDisk v4.4 Tool to check and undelete partition Works with the following partitions: - FAT12 FAT16 FAT32 - Linux - Linux SWAP (version 1 and 2) - NTFS (Windows NT) - BeFS (BeOS) - UFS (BSD) - Netware - ReiserFS

GNU General Public License (GPL)
    
     The Sleuth Kit v1.61 The Sleuth Kit (previously known as TASK) is a collection of UNIX-based command line file system forensic tools that allow an investigator to examine NTFS, FAT, FFS, EXT2FS, and EXT3FS file systems of a suspect computer in a non-intrusive fashion. The tools have a layer-based design and can extract data from internal file system structures. Because the tools do not rely on the operating system to process the file systems, deleted and hidden content is shown.

GNU General Public License (GPL)
    
     TNEF v1.2.0 TNEF provides a way to unpack those pesky Microsoft MS-TNEF MIME attachments. It operates like tar in order to upack any files which may have been put into the MS-TNEF attachment instead of being attached seperately.

GNU General Public License (GPL)
    
     VNC - tightvnc VNC (an abbreviation for Virtual Network Computing) is a great client/server software package allowing remote network access to graphical desktops. Used in biatchux to send remote consoles!

GNU General Public License (GPL)
    
     wipe v2.0 Wipe is a secure file wiping utility.

GNU General Public License (GPL)

Top

Pen-Test (133 Packages)

     Name Description License
     ADMsmb ADMsmb brute force tool

GNU General Public License (GPL)
    
     ADMsnmp snmp scanner

GNU General Public License (GPL)
    
     AINTX A large collection of handy command line tools for NT account, log and security maintenance.

GNU General Public License (GPL)
    
     angst v0.4b Angst is an active sniffer.

angst-license
    
     apachebench (ab) ApacheBench (ab) is a tool for benchmarking your Apache HTTP server. It is designed to give you an idea of the performance that your current Apache installation can give. In particular, it shows you how many requests per second your Apache server is capable of serving. The ab tool comes bundled with the Apache source distribution.

Apache License, Version 1.1
    
     arp-sk v0.0.15 arp tools

GNU General Public License (GPL)
    
     ARP0c ARP connection interceptor

Phenoelit License
    
     arping v1.06 Arping is an ARP level ping utility. It's good for finding out if an IP is taken before you have routing to that subnet. It can also ping MAC addresses directly.

GNU General Public License (GPL)
    
     atstake WebProxy 1.0 WebProxy 1.0 is a cross-platform/browser security tool for use in auditing web sites.

GNU General Public License (GPL)
    
     babelweb v1.0 babelweb is a program which allows to automate tests on a HTTP server. It is able to follow the links and the HTTP redirect but it is programmed to remain on the original server.

GNU General Public License (GPL)
    
     bouncer 1.0rc6 (linux, win32, and sparc solaris) Bouncer is a network tool which allows you to bypass proxy restrictions and obtain outside connections from an internal LAN. It uses SSL tunneling, which allows you to obtain a constant streaming connection out of a proxy. If you are restricted behind a proxy and can access secure online ordering sites, then you can get out to whatever host on whatever port you want. It also supports a lot of other features including socks 5, basic authentication, access control lists, and Web-based administration, and will run on Windows, Linux, and FreeBSD.

GNU General Public License (GPL)
    
     bsed binary stream editor

GNU General Public License (GPL)
    
     bwplot Plot information about packet captures.

GNU General Public License (GPL)
    
     centurion No Description Entered

GNU General Public License (GPL)
    
     cryptcat encryption enabled netcat

GNU General Public License (GPL)
    
     curl v7.10.4 Curl is a tool for transferring files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. Curl supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploading, kerberos, HTTP form based upload, proxies, cookies, user+password authentication, file transfer resume, http proxy tunneling and a busload of other useful tricks.

GNU General Public License (GPL)
    
     darkstat v2.5 traffic analysis tool similar to ntop.

GNU General Public License (GPL)
    
     dcetest v1.0 DCE-RPC tester.

GNU General Public License (GPL)
    
     ddos-scan dds "dds" is a program to scan for a limited set of distributed denial of service (ddos) agents.

GNU General Public License (GPL)
    
     disco v0.1 Disco is a passive IP discovery utility designed to sit on segments distributed throughout a network and discover unique IPs. In addition to IP discovery Disco has the ability to passively fingerprint TCP SYN packets to determine the host operating system.

GNU General Public License (GPL)
    
     DNSSEC Walker v2.0 DNSSEC Walker is a tool to recover DNS zonefiles using the DNS protocol. The server does not have to support zonetransfer, but the zone must contain DNSSEC "NXT" records.

GNU General Public License (GPL)
    
     doc Doc is a program that diagnoses misbehaving domains by sending queries to the appropriate DNS nameservers and performing simple analysis on the responses. Doc verifies a domains proper configuration and it is functioning correctly. The only required parameter is the valid domain name of a domain. Important: Doc requires version 2.0 of the DNS query tool `dig` domain internet groper

GNU General Public License (GPL)
    
     dsniff tools v2.3 dsniff is a collection of tools for network auditing and penetration testing. dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof, and macof facilitate the interception of network traffic normally unavailable to an attacker (e.g, due to layer-2 switching). sshmitm and webmitm implement active monkey-in-the-middle attacks against redirected SSH and HTTPS sessions by exploiting weak bindings in ad-hoc PKI.

GNU General Public License (GPL)
    
     echoping echoping is a small program to test (approximatively) performances of a remote host by sending it TCP echo (or other protocol) packets.

GNU General Public License (GPL)
    
     elza v1.4.7beta The ELZA is a scripting language aimed at automating requests on web pages. Scripts written in ELZA are capable of mimicking browser behavior almost perfectly, making it extremely difficult for remote servers to distinguish their activity from the activity generated by ordinary users and browsers. This gives those scripts the opportunity to act upon servers that will not respond to requests generated using netcat, rebol, telnet or similar tool. As a result, one can hijack heavily protected HTML forms, perform dictionary attacks on login forms, and do sophisticated CGI scanning.

Public Domain
    
     etherape v.0.8.2 network traffic visualization tool

GNU General Public License (GPL)
    
     ethereal v.0.9.11 Ethereal is a free network protocol analyzer for Unix and Windows.

GNU General Public License (GPL)
    
     ettercap v0.6a Ettercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis.

GNU General Public License (GPL)
    
     expect v5.32.2 Expect is a tool for automating interactive applications such as telnet, ftp, passwd, fsck, rlogin, tip, etc. Expect is also useful for testing these same applications.

GNU General Public License (GPL)
    
     Firewalk Firewalking is a technique developed by Mike D. Schiffman and David E. Goldsmith that employs traceroute-like techniques to analyze IP packet responses to determine gateway ACL filters and map networks. Firewalk the tool employs the technique to determine the filter rules in place on a packet forwarding device. The newest version of the tool, firewalk/GTK introduces the option of using a graphical interface and a few bug fixes.

GNU General Public License (GPL)
    
     flood connect v1.5 connection flooder.

GNU General Public License (GPL)
    
     fragroute v1.2 fragroute intercepts, modifies, and rewrites egress traffic destined for a specified host, implementing most of the attacks described in the Secure Networks "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" paper of January 1998.

GNU General Public License (GPL)
    
     fragrouter v1.6 fragrouter - network intrusion detection evasion toolkit

GNU General Public License (GPL)
    
     Hackbot v2.20 - stoerscanner.pl Hackbot is a host exploration tool and bannergrabber. It scans hosts for FTP banners, SSH banners, Open Relays, EXPN and VRFY options, more than 200 common CGI vulnerabilities and common indexable directories, NT unicode vulnerabilities, and NT Nimda infections.

Freely distributable
    
     hammerhead v2.1.3 Hammerhead 2 is a stress testing tool designed to test out your web server and web site. It can initiate multiple connections from IP aliases and simulated numerous (256+) users at any given time. The rate at which Hammerhead 2 attempts to pound your site is fully configurable, there are numerous other options for trying to create problems with a web site (so you can fix them). It can be used to test the behaviour of the port under load, or the ability of the port to service a set of requests.

GNU General Public License (GPL)
    
     hjksuite v0.1b Hjksuite is a collection of programs for hijacking. First of all it contains hjklib, a library for hijacking. It contains also some programs like hjkbnc which allows irc hijackinig directly with your client, hjkhttpd for hijacking HTTP sessions, and hjknetcat, for hijacking text connections.

GNU General Public License (GPL)
    
     hogwash v0.5 Hogwash is an inline packet scrubber that uses Snort's (www.snort.org) detection engine to drop malicious packets before they reach the target machine.

GNU General Public License (GPL)
    
     hping2-rc2 hping2 is a network tool able to send custom ICMP/UDP/TCP packets and to display target replies like ping does with ICMP replies.

GNU General Public License (GPL)
    
     httptunnel v3.3 httptunnel creates a bidirectional virtual data connection tunnelled in HTTP requests. The HTTP requests can be sent via an HTTP proxy if so desired

GNU General Public License (GPL)
    
     httptype v1.2.3 http banner grabber, version identifier

GNU General Public License (GPL)
    
     httPush v.0.9b11 HTTPush aims at providing an easy way to audit HTTP and HTTPS application/server security. It supports on-the-fly request modification, automated decission making and vulnerability detection through the use of plugins and full reporting capabilities.

BSD License
    
     hunt v1.5 The main goal of the HUNT project is to develop tool for exploiting well known weaknesses in the TCP/IP protocol suite.

GNU General Public License (GPL)
    
     icmpshell provides a shell using ICMP packets

GNU General Public License (GPL)
    
     ip sorcery v1.7 IP Sorcery is a TCP/IP packet generator. It has the ability to send TCP, UDP, and ICMP packets with both a command line console and GTK+ interface.

GNU General Public License (GPL)
    
     iptraf v2.4.0 IPTraf is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others.

GNU General Public License (GPL)
    
     irpas v0.10 routing hack suite

Phenoelit License
    
     ISH v0.2 - ICMP shell ICMP Shell is a program written in C for the UNIX environment that allows an administrator to access their computer remotely via ICMP.

GNU General Public License (GPL)
    
     ish_detect v0.1 ICMP Shell Detection

Freeware
    
     isic v0.3 - need to upgrade ISIC is a suite of utilities to exercise the stability of an IP Stack and its component stacks (TCP, UDP, ICMP et. al.) It generates piles of pseudo random packets of the target protocol.

GNU General Public License (GPL)
    
     isnprober v1.02 ISNprober is a tool that samples TCP Initial Sequence Numbers or IP ID's and can use that information to determine if a set of IP addresses belong to the same TCP/IP stack (machine) or not.

GNU General Public License (GPL)
    
     john v1.6 John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, and BeOS. Its primary purpose is to detect weak Unix passwords, but a number of other hash types are supported as well.

GNU General Public License (GPL)
    
     k0ldS LDAP brute forcer

Phenoelit License
    
     lcrzoex v1.02 Lcrzoex is a toolbox for network administrators and network hackers which contains over 400 utilities to test an Ethernet/IP network. Each one can be compiled alone and modified to match your needs. Lcrzoex works on Linux, Windows, FreeBSD, OpenBSD, and Solaris.

GNU General Public License (GPL)
    
     ldistfp 0.1.4 remote linux fingerprinter by teso, slight modification to read config file from /etc

GNU General Public License (GPL)
    
     ldistfp v0.0.1 remote ident fingerprinting tool

GNU General Public License (GPL)
    
     links v0.9x Links is a text-based browser with support for HTML tables and frames.

GNU General Public License (GPL)
    
     lumberjack v0.2.7 check LDAP Data Interchange Format files (ldif files) for weak passwords

Phenoelit License
    
     mieliekoek.pl Mieliekoek.pl is a SQL insertion crawler which tests all forms on a web site for possible SQL insertion problems. This script takes the output of a web mirroring tool as input, inspecting every file to determine if there is a form in the file. This tool is at the forefront of a new breed of auditing tools and builds on our earlier work in the field of SQL-Insertion attacks.

GNU General Public License (GPL)
    
     mtools Mtools is a public domain collection of tools to allow UNIX systems to manipulate MS-DOS files: read, write, and move around files on an MS-DOS filesystem

GNU General Public License (GPL)
    
     NAT - NetBIOS Auditing Tool v2.0 NAT - NetBIOS Auditing Tool v2.0

GNU General Public License (GPL)
    
     NBTscan v1.0.2 smb netbios scanning tool

GNU General Public License (GPL)
    
     nbtstat smb enumerator utility

GNU General Public License (GPL)
    
     nemesis v1.4beta1 The NEMESIS Project provides packet injection utilities

GNU General Public License (GPL)
    
     nessus v2.0.5 NESSUS!!!

GNU General Public License (GPL)
    
     netcat v1.10 Netcat has been dubbed the network swiss army knife. It is a simple Unix utility which reads and writes data across network connections, using TCP or UDP protocol. It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts.

GNU General Public License (GPL)
    
     netsed v.01b perform regular expressions on network traffic

GNU General Public License (GPL)
    
     ngrep v1.40 Ngrep is a powerful network sniffing tool which strives to provide most of GNU grep's common features, applying them to all network traffic.

Other/Proprietary License with Source
    
     Nikto v1.23 Nikto is a web server scanner. It is based on and inspired by Whisker 1.4 scanner

GNU General Public License (GPL)
    
     nmap v3.27 best all around portscanner

GNU General Public License (GPL)
    
     nsat v1.5 NSAT (Network Security Analysis Tool) is a fast, stable bulk security scanner designed to audit remote network services and check for versions, security problems, gather information about the servers and the machine and much more.

GNU General Public License (GPL)
    
     ntop v2.0 ntop is a Unix tool that shows the network usage, similar to what the popular top Unix command does. ntop is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform and on Win32 as well. I have developed libpcap for Win32 (port of libpcap to Win32) in order to have a single ntop source tree.

GNU General Public License (GPL)
    
     numby v0.2 proxy tool

GNU General Public License (GPL)
    
     ObiWan 0.6a HTTP brute forcer

Phenoelit License
    
     onesixtyone v0.3 SNMP scanner

GNU General Public License (GPL)
    
     openssl v0.9.6g openssl

GNU General Public License (GPL)
    
     p0f v1.8.3 - Passive OS detection p0f performs passive OS detection based on SYN packets. Unlike nmap, p0f does recognition without sending any data. Additionally, it is able to determine distance to remote host, and can be used to determine the structure of a foreign or local network. When running on the gateway of a network it is able to gather huge amounts of data and provide useful statistics. On a user-end computer it could be used as powerful IDS add-on. p0f supports full tcpdump-style filtering expressions, and has an extensible and detailed fingerprinting database. It runs on Linux 2.0/2.2, FreeBSD, OpenBSD, NetBSD, SunOS, and Solaris.

GNU General Public License (GPL)
    
     packit 0.5.0 Packit is a network auditing tool that allows you to monitor, manipulate, and inject customized IP traffic into your network. Supporting the ability to define (spoof) all TCP, UDP, ICMP, IP, ARP, RARP and Ethernet header options, Packit can be valuable for testing firewalls, intrusion detection systems, port scanning, simulating network traffic and general TCP/IP auditing.

GNU General Public License (GPL)
    
     Paketto kieretsu v1.10 The Paketto Keiretsu is a collection of tools that use new and unusual strategies for manipulating TCP/IP networks. They tap functionality within existing infrastructure and stretch protocols beyond what they were originally intended for. It includes Scanrand, an unusually fast network service and topology discovery system, Minewt, a user space NAT/MAT router, Linkcat, which presents a Ethernet link to stdio, Paratrace, which traces network paths without spawning new connections, and Phentropy, which uses OpenQVIS to render arbitrary amounts of entropy from data sources in three dimensional phase space.

BSD License
    
     Pandora - v4.0 Pandora is a set of tools for hacking, intruding, and testing the security and insecurity of Novell Netware. It works on versions 4 and 5. Pandora consists of two distinct sets of programs -- an "online" version and an"offline" version. Pandora Online is intended to be used for direct attack against a live Netware 4 or 5 server. Pandora Offline is intended to be used for password cracking after you have obtained copies of NDS.

GNU General Public License (GPL)
    
     parasite v1.1 An arp reply spoofer for ethernet networks.

GNU General Public License (GPL)
    
     perl 5.8.0 compiled with support for >2G files, including a bunch o useful perl modules to boot.

GNU General Public License (GPL)
    
     PHoss v0.1.13 PHoss is a sniffer that picks out clear text passwords from common protocols. http, ftp, pop3, imap4, telnet and obtains VNC challenge for cracking.

GNU General Public License (GPL)
    
     probe v4.1 Extended stealth host scanner

GNU General Public License (GPL)
    
     pwl9x v0.07 Windows 9x Password List reader is a program that will allow you to see the passwords contained in your Windows pwl database under Unix. You can check the security of these files/try to recover the main password using the bruteforce mode.

GNU General Public License (GPL)
    
     radmind v0.9.2 remote administration daemon

UMich BSD Style License
    
     redir v2.2.1 port redirector

GNU General Public License (GPL)
    
     reverb v0.1.0 connection adapter - tool to access firewalled, dynamic-dialin and otherwise protected hosts from the outside, once backdoored. includes some nice new options

GNU General Public License (GPL)
    
     revinetd v0.7 Revinetd is a GNU implementation of the TCP gender changer. It operates in two modes, listen-listen and connect-connect. It can be used to forward traffic through firewalls where outbound rule sets are more liberal than inbound rules.

GNU General Public License (GPL)
    
     rlogin rlogin

GNU General Public License (GPL)
    
     rpa (Remote Password Assassin) Brute force password tool

GNU General Public License (GPL)
    
     rpcinfo ya gotta keep rpc enumerated...

GNU General Public License (GPL)
    
     SambaTNG Provides basic samba connectivity, PLUS the awesome ability to remotely manage windows services, remote registry edits, at process scheduling, and more!

GNU General Public License (GPL)
    
     sara v3.5.4 The Security Auditor's Research Assistant (SARA) is a third generation Unix-based security analysis tool.

GNU General Public License (GPL)
    
     screamingCobra.pl v1.04 screamingCobra is an application that does automated vulnerability scanning in remote CGIs by using techniques that are able to spot very common bugs in many CGIs, usually when dealing with templates or any other files or applications

GNU General Public License (GPL)
    
     sdi-brutus.pl sdi-brutus brute forces ftp´and http, and enumerates users via smtp

GNU General Public License (GPL)
    
     sendip v2.3 send completely arbitrary packets out over the network

GNU General Public License (GPL)
    
     Sentinel v0.91beta Libnet-based remote promiscuous detection

GNU General Public License (GPL)
    
     shiva v.0.95 Shiva is a tool to encrypt ELF executables under Linux. Shiva can be used to wrap an executable in such a way that though it continues to run as it did before it is very difficult to debug or reverse engineer. Shiva can be used to password protect critical programs, including setuid programs, or simply to obfuscate sensitive data stored within programs.

GNU General Public License (GPL)
    
     sing v1.1 SING stands for 'Send ICMP Nasty Garbage'. It is a tool that sends ICMP packets fully customized from command line. Its main purpose is to replace the ping command but adding certain enhancements (Fragmentation, spoofing,...)

GNU General Public License (GPL)
    
     smbbf v1.0.4 my favorite smb brute force tool

GNU General Public License (GPL)
    
     SMBDumpUsers V1.0.4 very nice win32 user dump tool

GNU General Public License (GPL)
    
     smbgetserverinfo v1.0.4 very nice win32 host enumeration tool

GNU General Public License (GPL)
    
     smbserverscan V1.0.4 win32 server scanner

GNU General Public License (GPL)
    
     smtpmap v0.8 smtp daemon version analyzer

GNU General Public License (GPL)
    
     smtpscan v0.5 SMTPScan is a tool to guess which MTA is used, by sending several "special" STMP requests and by comparing error codes returned with those in the fingerprint database. It does not take into account banners and other text information, that cannot be trusted, only error code.

GNU General Public License (GPL)
    
     Sniffit v0.3.5p1 sniffer

GNU General Public License (GPL)
    
     snmputils gotta be able to snmpwalk dontchya?

GNU General Public License (GPL)
    
     snort v2.0 (inline) snort! need i say more?

GNU General Public License (GPL)
    
     socat v1.3.1 socat is a relay for bidirectional data transfer between two independent data channels. Each of these data channels may be a file, pipe, device (terminal or modem), socket (UNIX, TCP, UDP, IP6, raw), a file descriptor, a program etc. combination of two of the above.

GNU General Public License (GPL)
    
     sqlping Oracle sqlping utility

GNU General Public License (GPL)
    
     ssldump v0.9b3 ssldump is an SSLv3/TLS network protocol analyzer. It identifies TCP connections on the chosen network interface and attempts to interpret them as SSLv3/TLS traffic. When it identifies SSLv3/TLS traffic, it decodes the records and displays them in a textual form to stdout. If provided with the appropriate keying material, it will also decrypt the connections and display the application data traffic.

GNU General Public License (GPL)
    
     ssl_proxy v1.0 symbion sslproxy

GNU General Public License (GPL)
    
     stunnel v4.03 stunnel!

GNU General Public License (GPL)
    
     tcpdump v3.7.1 Tcpdump allows you to dump the traffic on a network. It can be used to print out the headers of packets on a network interface that matches a given expression. You can use this tool to track down network problems, to detect "ping attacks" or to monitor the network activities.

BSD License
    
     tcpreplay v1.4 Tcpreplay is aimed at testing the performance of a NIDS by replaying real background network traffic in which to hide attacks. Tcpreplay allows you to control the speed at which the traffic is replayed, and can replay arbitrary tcpdump traces. Unlike programmatically-generated artificial traffic which doesn't exercise the application/protocol inspection that a NIDS performs, and doesn't reproduce the real-world anomalies that appear on production networks (asymmetric routes, traffic bursts/lulls, fragmentation, retransmissions, etc.), tcpreplay allows for exact replication of real traffic seen on real networks.

GNU General Public License (GPL)
    
     tcpslice v1.2a1 a tool for extracting portions of packet trace files generated using tcpdump's -w flag.

GNU General Public License (GPL)
    
     tcptraceroute v1.4 tcptraceroute is a traceroute implementation using TCP SYN packets, instead of the more traditional UDP or ICMP ECHO packets. In doing so, it is able to trace through many common firewall filters.

GNU General Public License (GPL)
    
     teenet telnet brute force tool

GNU General Public License (GPL)
    
     teenet telnet brute force tool

GNU General Public License (GPL)
    
     TeeNet v0.1.2 Telnet brute force

Phenoelit License
    
     THC-Amap v2.1 Amap is a next-generation scanning tool, it identifies applications and services even if they are not listening on the default port by creating a bogus-communication. Amap has a growing database of known applications also including non-ASCII based applications and even enterprise services. Utilizes nmap machine readable output.

GNU General Public License (GPL)
    
     THC-Hydra v2.2 THC-Hydra is the world's first parallized login hacker. With this tool you are able to attack several services at once (FTP, POP3, IMAP, Telnet, HTTP Auth, NNTP, VNC, ICQ, PCNFS). Also included Socks5 and SSL support

GNU General Public License (GPL)
    
     tnscmd Oracle tnscmd utility

GNU General Public License (GPL)
    
     trafshow v3.1 TrafShow continuously display the information regarding packet traffic on the configured network interface that match the boolean expression

GNU General Public License (GPL)
    
     vippr v1.2 Router attack tool

Phenoelit License
    
     VNC - tightvnc VNC (an abbreviation for Virtual Network Computing) is a great client/server software package allowing remote network access to graphical desktops. Used in biatchux to send remote consoles!

GNU General Public License (GPL)
    
     VNCrack v0.1.17 BETA 3 VNCrack is what it looks like: crack VNC

GNU General Public License (GPL)
    
     vomit v0.2 The vomit utility converts a Cisco IP phone conversation into a wave file that can be played with ordinary sound players.

GNU General Public License (GPL)
    
     w3m v0.4.1 a text based web browser and pager

MIT License
    
     whisker v2.1 whisker is a 'next generation' CGI scanner. It is Scriptable. It's a programming-ish language that is tailored to do lots of flexible web scanning. Very stealthy. I've implemented anti-IDS checks into the scan. Includes over 200 checks. Lots of options. Reads in nmap output, files full of domains, or single host. Virtual host support. Proxy support. Can be used as a CGI. Changes: Includes 10 anti-IDS tactics, brute force user names, brute force basic authentication guessing, now uses perl modules if available for extra speed, HTTP return values can be redefined, can now be used as a CGI, html output, SSL support, more vulnerabilities in the scan.db

GNU General Public License (GPL)
    
     wmap v1.2 Wmap is a "simple less stupid web scanner" for *nix

GNU General Public License (GPL)
    
     xprobe v0.0.2 xprobe

GNU General Public License (GPL)
    
     zodiac v0.4.9 Zodiac is a DNS protocol analyzation and exploitation program. It is a robust tool to explore the DNS protocol. Internally it contains advanced DNS routines for DNS packet construction and disassembling and is the optimal tool if you just want to try something out without undergoing the hassle to rewrite DNS packet routines or packet filtering.

GNU General Public License (GPL)

Top

Static Linked Binary (5 Packages)

     Name Description License
     AIDE v0.9 AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire. It does the same things as the semi-free Tripwire and more.

GNU General Public License (GPL)
    
     lsof v4.66 list open files

GNU General Public License (GPL)
    
     mac-robber v1.0 mac-robber is a forensics and incident response program that collects Modified, Access, and Change (MAC) times from files. Its output can be used as input to the mactime tool in The Coroner's Toolkit (TCT) to make a timeline of file activity. mac-robber is similar to running the grave-robber tool with the '-m' flag, except this is written in C and not Perl. This work was done at @stake

GNU General Public License (GPL)
    
     memfetch v0.04b Linux on-demand process image dumper

GNU General Public License (GPL)
    
     The Sleuth Kit v1.61 The Sleuth Kit (previously known as TASK) is a collection of UNIX-based command line file system forensic tools that allow an investigator to examine NTFS, FAT, FFS, EXT2FS, and EXT3FS file systems of a suspect computer in a non-intrusive fashion. The tools have a layer-based design and can extract data from internal file system structures. Because the tools do not rely on the operating system to process the file systems, deleted and hidden content is shown.

GNU General Public License (GPL)

Top

Virus Scanning (1 Packages)
     Name Description License
     F-Prot Virus Scanner F-Prot Virus Scanner

Other/Proprietary License with Free Trial

Top

http://biatchux.dmzs.com/
Main Menu

Free Software

TIPS

Search Tools

Legal Aid

Hacking

Hardware

Commercial Software

rants.html
News
Altenative Energy
my blog
The bus/backhoe page
Plans for a hand operated press brake
Plans for a cheap oil burner
My bartpe plugin for xplorer2
Electronics calculator
Squirrel

 


Copyright 2005 markbickford.com All Rights Reserved.