.:[ packet storm ]:.
                       
preserving full disclosure
preserving full disclosure

 Section:  .. / Last 100 Tool Files /

 ///  File Name:synspam_0.4.0-1.tar.gz
Description:
Synspam uses Netfilter NFQUEUE to catch the source IP address of any machine connecting to your mail server, running multiple tests against it possible, a scoring system is used. If the source IP address is believed to be a spammer IP address, the connection can be dropped. There is a dry run mode if you just want to test it, which is the default.
Author:Julien Reveret
Homepage:http://www.synspam.org/
Changes:This release adds a new feature, matching PTR records with source IP to check spammy DNS settings.
File Size:25194
Last Modified:Feb 8 20:33:58 2010
MD5 Checksum:3d05359f05f5588d3305214462f72444

 ///  File Name:sipwitch-0.7.0.tar.gz
Description:
GNU SIP Witch is a pure SIP-based office telephone call server that supports generic phone system features like call forwarding, hunt groups and call distribution, call coverage and ring groups, holding, and call transfer, as well as offering SIP specific capabilities such as presence and messaging. It supports secure telephone extensions for making calls over the Internet, and intercept/decrypt-free peer-to-peer audio and video extensions. It is not a SIP proxy, a multi-protocol telephone server, or an IP-PBX, and does not try to emulate Asterisk, FreeSWITCH, or Yate.
Author:David Sugar
Homepage:http://www.gnutelephony.org/
Changes:Basic RTP media proxy, preliminary NAT support, and integrated SDP rewrite functionality have been introduced. This will enable stand-alone sipwitch hosts to call each other even when locations are both behind NATs or different subnets. Furthermore, since sipwitch handles NAT functionality in one place and transparently, desktop VoIP clients need not be configured for or aware of NAT functionality. Other changes include consolidation of realm and functional SIP domain.
File Size:488878
Last Modified:Feb 8 20:17:53 2010
MD5 Checksum:11aaa6bf55aff514be0b124619941b46

 ///  File Name:dradis-v2.5.0.tar.gz
Description:
dradis is a tool for sharing information during security testing. While plenty of tools exist to help in the different stages of the test, not so many exist to share interesting information captured. When a team of testers is working on the same set of targets, having a common repository of information is essential to avoid duplication of efforts.
Author:etd
Homepage:http://dradis.nomejortu.com/
Changes:The Note editor (Textile) was improved. An HTML export plugin was added for producing reports in HTML format. A Nikto Upload plugin was added. A Burp Upload plugin was added. The "First Time User Wizard" introduction was improved. You can keep track of all the activity with the built-in RSS feed. A new Rake task was added: dradis:backup. Rake dradis:reset now creates a backup of the project by default. Rake dradis:reset now clears the old log files. The structure of the Nmap Upload plugin data was improved. The ExtJS 3.0 and Rails 2.3.5 libraries were upgraded. Bugs were fixed.
File Size:4739901
Last Modified:Feb 5 20:56:28 2010
MD5 Checksum:1c9020a0991471afad3490ae728587f9

 ///  File Name:netsniff-ng-0.5.4.1.tar.gz
Description:
netsniff-ng is a high performance linux network sniffer for packet inspection. Basically, it is similar to tcpdump, but it doesn't need syscalls for fetching packets. Instead, it uses an memory mapped area within kernelspace for accessing packets without the need of copying them to userspace ('zero-copy' mechanism). Therefore, netsniff-ng is libpcap independent. netsniff-ng can be used for protocol analysis and reverse engineering, network debugging, measurement of performance throughput or network statistics creation of incoming packets on central network nodes like routers or firewalls.
Author:Daniel Borkmann
Homepage:http://code.google.com/p/netsniff-ng/
File Size:142687
Last Modified:Feb 5 20:49:02 2010
MD5 Checksum:5b8f6a3266fad685f75ec694365b6af1

 ///  File Name:stunnel-4.31.tar.gz
Description:
Stunnel is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix and Windows. Stunnel can allow you to secure non-SSL aware daemons and protocols (like POP, IMAP, NNTP, LDAP, etc) by having Stunnel provide the encryption, requiring no changes to the daemon's code.
Author:Michal Trojnara
Homepage:http://www.stunnel.org
Changes:Log file reloading with SIGUSR1 was added. Some regression issues introduced in the experimental version 4.30 were fixed.
File Size:548167
Last Modified:Feb 4 02:16:20 2010
MD5 Checksum:2fc31bc0c940fbe545a88d896b13cacf

 ///  File Name:tinc-1.0.12.tar.gz
Description:
tinc is a Virtual Private Network (VPN) daemon that uses tunneling and encryption to create a secure private network between multiple hosts on the Internet. This tunneling allows VPN sites to share information with each other over the Internet without exposing any information.
Author:Ivo Timmermans
Homepage:http://tinc.nl.linux.org
Changes:This release really allows fast roaming of hosts to other nodes in a switched VPN, fixes potentially missing or incorrect environment variables when calling host-up/down and subnet-up/down scripts, allows the port to be specified in Address statements, clamps MSS of TCP packets to the discovered path MTU, and lets two nodes behind NAT learn each other\'s current UDP address and port via a third node, potentially allowing direct communications in a similar way to STUN.
File Size:504992
Last Modified:Feb 4 02:14:30 2010
MD5 Checksum:51dc4a2e5bcbc0ff7dd1a420635c614e

 ///  File Name:Pound-2.5.tgz
Description:
Pound is a reverse HTTP proxy, load balancer, and SSL wrapper. It proxies client HTTPS requests to HTTP backend servers, distributes the requests among several servers while keeping sessions, supports HTTP/1.1 requests even if the backend server(s) are HTTP/1.0, and sanitizes requests.
Author:roseg
Homepage:http://www.apsis.ch/pound/index.html
Changes:New features include support for HTTPS back-end servers, full support for DH key exchange, an "include" directive in configuration files, support for separate connection time-out, much improved auto-configuration and Make, and flags to enable or disable optional libraries. A bunch of minor bugs were fixed. Performance was improved.
File Size:172085
Last Modified:Feb 2 23:31:19 2010
MD5 Checksum:2693e0f51f025572b3d3875fd0664c04

 ///  File Name:nikto-2.1.1.tar.gz
Description:
Nikto is an Open Source web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers.
Author:Sullo
Homepage:http://cirt.net/nikto2
Changes:Added about 2300 RFI tests from the combined RSnake/OSVDB list. Various fixes and changes.
File Size:316540
Last Modified:Feb 2 23:25:49 2010
MD5 Checksum:aacf88ebdf69e2ccda1f6d611b9f640e

 ///  File Name:Squipy.zip
Description:
Squipy is a proxy server that allows you to capture and modify HTTP traffic.
Author:Pepelux
Homepage:http://www.pepelux.org/
File Size:1005581
Last Modified:Feb 1 20:57:42 2010
MD5 Checksum:03f927d76353641025c95ad73b698ecc

 ///  File Name:zzuf-0.13.tar.gz
Description:
zzuf is a transparent application input fuzzer. It works by intercepting file operations and changing random bits in the program's input. zzuf's behavior is deterministic, making it easy to reproduce bugs.
Author:Sam Hocevar
Homepage:http://sam.zoy.org/zzuf/
Changes:Zzuf now supports OpenSolaris, and support for OS X and BSD was greatly improved. This release also adds network host filtering and a fully programmable debugging tool.
File Size:461499
Last Modified:Feb 1 20:54:29 2010
MD5 Checksum:6bd0b2dedfd2baa819c5ed1082f2f15a

 ///  File Name:scannedonly-0.18.tar.gz
Description:
Scannedonly is a samba VFS module that ensures that only files that have been scanned for viruses are visible and accessible to the end user. Scannedonly was developed because of scalability problems with samba-vscan. Scannedonly comes in two parts: a Samba VFS module and (one or more) daemons. The daemon scans files and marks them when they are known to be clean. The samba module simply filters out files that aren't marked clean.
Author:Olivier Sessink
Homepage:http://olivier.sessink.nl/scannedonly/
Changes:This release is a backport of the code that is now part of Samba 3.5. The Samba code was made compatible with Samba 3.2 and 3.4, and by popular demand, Samba 3.0 support has been reintroduced.
File Size:70948
Last Modified:Feb 1 20:52:54 2010
MD5 Checksum:9e2f9014638361bca9fb55ab5c47616d

 ///  File Name:iscanner-0.1.tar.gz
Description:
iScanner is a free open source tool written in Ruby that lets you detect and remove malicious code from webpages.
Author:iSecur1ty.org
Homepage:http://iscanner.isecur1ty.org/
File Size:15068
Last Modified:Feb 1 19:59:47 2010
MD5 Checksum:7a0c59d815cbedcd6fbefb0f058dbb7f

 ///  File Name:efipw_0.2a.py.txt
Description:
EFIPW is a tool that can be used to decode and modify Apple EFI firmware passwords via the command line. It is designed after the non open source OFPW utility and is designed to work on Intel machines running Leopard or newer. Useful for lab deployments (setting the firmware password of machines as a post install item) and pen tests (recovering the EFI firmware password).
Author:Paul Makowski
Homepage:http://code.google.com/p/efipw/
Changes:Complete Python rewrite. Works on Snow Leopard again.
File Size:5150
Last Modified:Jan 31 16:01:01 2010
MD5 Checksum:6030703961e116d32142225363680439

 ///  File Name:sydbox-0.6.4.tar.bz2
Description:
sydbox is a ptrace-based sandbox implementation. It intercepts system calls, checks for allowed filesystem prefixes, and denies them when checks fail. It has basic support for disallowing network connections. It has basic support to sandbox execve calls. It is based in part on catbox and strace.
Author:Ali Polatel
Homepage:http://projects.0x90.dk/wiki/sydbox/
Changes:This release fixes a few annoyances. Sydbox now uses vfork instead of fork to spawn the initial child, which decreases start up time. This also replaces the before_initial_execve hack for execve() sandboxing. Network access violations can now be filtered. Option parsing was fixed.
File Size:189603
Last Modified:Jan 31 15:35:14 2010
MD5 Checksum:a36c88a6abe919db2d138b3ad5b1f110

 ///  File Name:pkd-1.6.tgz
Description:
ipt_pkd is an iptables extension implementing port knock detection. This project provides 3 parts: the kernel module ipt_pkd, the iptables user space module libipt_pkd.so, and a user space client knock program. For the knock packet, it uses a UDP packet sent to a random port that contains a SHA-256 of a timestamp, small header, random bytes, and a shared key. ipt_pkd checks the time window of the packet and does the SHA-256 to verify the packet. The shared key is never sent.
Author:eric
Changes:This version was updated for Linux 2.6.32 and iptables 1.4.6. A new knock client was added, which is written in C# and works on both Linux and Windows and encrypts configuration data. A pre-built kernel module, an iptables library for vyatta community edition 5, and a small install script for vyatta were added.
File Size:95328
Last Modified:Jan 29 19:37:10 2010
MD5 Checksum:4432ad63c3c43746b3ee33aed3aa69c8

 ///  File Name:Encode-max-by-mdh3ll.pl.txt
Description:
This perl script is a simple encoding utility that converts data to Hex, Unicode, etc.
Author:MDH3LL
File Size:1064
Last Modified:Jan 27 09:07:08 2010
MD5 Checksum:4dbb43ebc6e8ae0ee48d232da5ee1fe7

 ///  File Name:sipwitch-0.6.2.tar.gz
Description:
GNU SIP Witch is a pure SIP-based office telephone call server that supports generic phone system features like call forwarding, hunt groups and call distribution, call coverage and ring groups, holding, and call transfer, as well as offering SIP specific capabilities such as presence and messaging. It supports secure telephone extensions for making calls over the Internet, and intercept/decrypt-free peer-to-peer audio and video extensions. It is not a SIP proxy, a multi-protocol telephone server, or an IP-PBX, and does not try to emulate Asterisk, FreeSWITCH, or Yate.
Author:David Sugar
Homepage:http://www.gnutelephony.org/
Changes:Use of default UUID-based SIP authentication realms when none is explicitly set. A new and more practical default config file with saner defaults. No generation of extension numbers for user accounts made into SIP accounts if not configured for extension numbering plans.
File Size:486176
Last Modified:Jan 26 02:38:16 2010
MD5 Checksum:1df46a68fba683d635f8cfef0dd646cb

 ///  File Name:tor.uclibc.i686.20100125.iso
Description:
Tor-ramdisk is an i686 uClibc-based micro Linux distribution whose only purpose is to host a Tor server in an environment that maximizes security and privacy. Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. Security is enhanced by employing a monolithically compiled GRSEC/PAX patched kernel and hardened system tools. Privacy is enhanced by turning off logging at all levels so that even the Tor operator only has access to minimal information. Finally, since everything runs in ephemeral memory, no information survives a reboot, except for the Tor configuration file and the private RSA key which may be exported/imported by FTP.
Author:Anthony G. Basile
Homepage:http://opensource.dyc.edu/tor-ramdisk
Changes:This release incorporates an important security fix from upstream following a breach of some Tor project servers. Only tor was bumped to version 0.2.1.22 while everything else remain the same as the 20100115 release. The change was made to the i686, MIPS, and x86_64 images.
File Size:4319233
Last Modified:Jan 26 02:28:42 2010
MD5 Checksum:f5bfd0482b423689f0db342cd88aaff5

 ///  File Name:scannedonly-0.17.tar.gz
Description:
Scannedonly is a samba VFS module that ensures that only files that have been scanned for viruses are visible and accessible to the end user. Scannedonly was developed because of scalability problems with samba-vscan. Scannedonly comes in two parts: a Samba VFS module and (one or more) daemons. The daemon scans files and marks them when they are known to be clean. The samba module simply filters out files that aren't marked clean.
Author:Olivier Sessink
Homepage:http://olivier.sessink.nl/scannedonly/
Changes:The loop that was fixed in the 0.16 release was not fixed for all cases. This release has a complete rewrite of the loop that should fix the problem in a much better way. This release furthermore fixes AIX compatibility in the VFS module.
File Size:70395
Last Modified:Jan 26 02:26:17 2010
MD5 Checksum:c6de9e490a548083c61e9db335d5ccda

 ///  File Name:complemento-0.7.5.tar.gz
Description:
Complemento is a collection of tools for penetration testing. LetDown is a TCP flooder written after reading the Fyodor article "TCP Resource Exhaustion and Botched Disclosure". Reverse raider is a domain scanner that uses brute force wordlist scanning for finding a target's subdomains or reverse resolution for a range of IPs. Httsquash is an HTTP server scanner, banner grabber, and data retriever. It can be used for scanning large ranges of IPs for finding devices or HTTP servers.
Author:crossbower
Homepage:http://complemento.sourceforge.net/
Changes:Major updates were made in HTTSquash.
File Size:916564
Last Modified:Jan 24 15:14:48 2010
MD5 Checksum:171b00830885c990a4fe541831a60610

 ///  File Name:mobiusft-0.5.1.tar.gz
Description:
Mobius Forensic Toolkit is a forensic framework written in Python/GTK that manages cases and case items, providing an abstract interface for developing extensions. Cases and item categories are defined using XML files for easy integration with other tools.
Homepage:http://savannah.nongnu.org/projects/mobiusft
Changes:The Datasource-EWF extension provides read support for EWF image files.
File Size:1614000
Last Modified:Jan 24 15:08:48 2010
MD5 Checksum:de683c018abbd678dfb3060d7999f90b

 ///  File Name:ncrack-0.01ALPHA.tar.gz
Description:
Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed using a modular approach, a command-line syntax similar to Nmap and a dynamic engine that can adapt its behaviour based on network feedback. It allows for rapid, yet reliable large-scale auditing of multiple hosts. Ncrack's features include a very flexible interface granting the user full control of network operations, allowing for very sophisticated bruteforcing attacks, timing templates for ease of use, runtime interaction similar to Nmap's and many more.
Author:Fyodor,ithilgore
Homepage:http://www.nmap.org/ncrack
File Size:1888165
Last Modified:Jan 22 19:25:54 2010
MD5 Checksum:679c538dbacd1c16800f69e7c3c2720e

 ///  File Name:tor-0.2.1.22.tar.gz
Description:
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).
Author:Roger Dingledine
Homepage:http://tor.eff.org
Changes:This release rotates two of the seven v3 directory authority keys and locations, due to a security breach of some of the Tor project servers. It also fixes a privacy problem in bridge directory authorities in which it would tell you its whole history of bridge descriptors if you made the right directory request.
File Size:2408281
Last Modified:Jan 22 18:04:35 2010
MD5 Checksum:8cc5bd1a4342e0938a31a4c66f62f97b

 ///  File Name:stunnel-4.30.tar.gz
Description:
Stunnel is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix and Windows. Stunnel can allow you to secure non-SSL aware daemons and protocols (like POP, IMAP, NNTP, LDAP, etc) by having Stunnel provide the encryption, requiring no changes to the daemon's code.
Author:Michal Trojnara
Homepage:http://www.stunnel.org
Changes:Configuration can be gracefully reloaded with a HUP signal on Unix and with the GUI on Windows.
File Size:545834
Last Modified:Jan 22 03:06:26 2010
MD5 Checksum:ff7afeb73dbb179b28b2afb346652142

 ///  File Name:nmap-5.20.tgz
Description:
Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). Nmap supports Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep), TCP Ping scanning, Direct (non portmapper) RPC scanning, Remote OS Identification by TCP/IP Fingerprinting, and Reverse-ident scanning. Nmap also supports a number of performance and reliability features such as dynamic delay time calculations, packet timeout and retransmission, parallel port scanning, detection of down hosts via parallel pings.
Author:Fyodor
Homepage:http://www.insecure.org/nmap
Changes:Dramatically improved the version detection database, integrating 2,596 submissions that users contributed since February 3, 2009! Added a new script, oracle-sid-brute, which queries the Oracle TNS-listener for default instance/sid names. Various other fixes and improvements.
File Size:11089898
Last Modified:Jan 20 23:30:04 2010
MD5 Checksum:f4c6678fb34a66572a1171943e404876

 ///  File Name:sipwitch-0.6.0.tar.gz
Description:
GNU SIP Witch is a pure SIP-based office telephone call server that supports generic phone system features like call forwarding, hunt groups and call distribution, call coverage and ring groups, holding, and call transfer, as well as offering SIP specific capabilities such as presence and messaging. It supports secure telephone extensions for making calls over the Internet, and intercept/decrypt-free peer-to-peer audio and video extensions. It is not a SIP proxy, a multi-protocol telephone server, or an IP-PBX, and does not try to emulate Asterisk, FreeSWITCH, or Yate.
Author:David Sugar
Homepage:http://www.gnutelephony.org/
Changes:This release focuses on development of GNU SIP Witch as a new kind of desktop VoIP service and includes integration of standard user accounts as sip users to enable one to more easily setup and deploy sipwitch with minimal configuration effort.
File Size:485585
Last Modified:Jan 20 19:09:21 2010
MD5 Checksum:0a7c6de3853c62374c9c26a0d077550d

 ///  File Name:john-1.7.4.2.tar.gz
Description:
John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, and BeOS. Its primary purpose is to detect weak Unix passwords, but a number of other hash types are supported as well.
Author:Solar Designer
Homepage:http://www.openwall.com/john/
Changes:Major performance improvements for processing of very large password files or sets of files have been implemented. Some previously missed common Web site passwords found on public lists of "top N passwords" have been added to the bundled common passwords list. Some bugs introduced in 1.7.4 have been fixed.
File Size:823748
Last Modified:Jan 19 22:26:44 2010
MD5 Checksum:0330644382dc91d1e29e23ce4b7eb7ab0

 ///  File Name:malheur-0.4.6.tar.gz
Description:
Malheur is a tool for automatic analysis of program behavior recorded from malicious software (malware). It is designed to support the regular analysis of malicious software and the development of detection and defense measures. It allows for identifying novel classes of malware with similar behavior and assigning unknown malware to discovered classes. It can be applied to recorded program behavior of various formats as long as monitored events are separated by delimiter symbols, e.g. as in reports generated by the popular malware sandboxes CWSandbox, Anubis, Norman Sandbox, and Joebox.
Author:Konrad Rieck
Homepage:http://www.mlsec.org/malheur/
Changes:Minor fixes and general code clean-up were done.
File Size:511025
Last Modified:Jan 18 12:37:21 2010
MD5 Checksum:0533e4d6ac0bae221487c9c140a38664

 ///  File Name:tor.uclibc.i686.20100115.iso
Description:
Tor-ramdisk is an i686 uClibc-based micro Linux distribution whose only purpose is to host a Tor server in an environment that maximizes security and privacy. Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. Security is enhanced by employing a monolithically compiled GRSEC/PAX patched kernel and hardened system tools. Privacy is enhanced by turning off logging at all levels so that even the Tor operator only has access to minimal information. Finally, since everything runs in ephemeral memory, no information survives a reboot, except for the Tor configuration file and the private RSA key which may be exported/imported by FTP.
Author:Anthony G. Basile
Homepage:http://opensource.dyc.edu/tor-ramdisk
Changes:Tor was updated to 0.2.1.21. The setup scripts now include the option of setting your own DNS server when acquiring networking information by DHCP to avoid ISPs that use DNS blocking. These changes have been implemented in the i686, MIPS, and new x86_64 port.
File Size:4319233
Last Modified:Jan 18 12:32:12 2010
MD5 Checksum:8c7c527127895e092c4db5c6eb95a710

 ///  File Name:prism.c
Description:
PRISM is an user space reverse shell backdoor. It offers ICMP mode where it awaits a packet containing a security key and host ip / port destination information. It also offers static mode where it can connect to a hardcoded ip / port.
Author:Andrea Fabrizi
Homepage:http://www.andreafabrizi.it/?prism
File Size:6809
Last Modified:Jan 18 12:04:35 2010
MD5 Checksum:d04896b721a34b8b9a33fd2ae0c5d892

 ///  File Name:bf3.tar.gz
Description:
Browser Fuzzer 3 (bf3) is a comprehensive web browser fuzzer that fuzzes CSS, DOM, HTML and JavaScript.
Author:Jeremy Brown
Homepage:http://www.krakowlabs.com/
File Size:9321572
Last Modified:Jan 17 17:41:32 2010
MD5 Checksum:901fa6e63c9a092053d85b4032b4d8e3

 ///  File Name:kismet-2010-01-R1.tar.gz
Description:
Kismet is an 802.11 layer 2 wireless network sniffer. It can sniff 802.11b, 802.11a, and 802.11g traffic. It is capable of sniffing using almost any wireless card supported in Linux, which currently divide into cards handled by libpcap and the Linux-Wireless extensions (such as Cisco Aironet), and cards supported by the Wlan-NG project which use the Prism/2 chipset (such as Linksys, Dlink, and Zoom). Besides Linux, Kismet also supports FreeBSD, OpenBSD and Mac OS X systems. Features Multiple packet capture sources, Runtime network sorting by AP MAC address (bssid), IP block detection via ARP and DHCP packet dissection, Cisco product detection via CDP, Ethereal and tcpdump compatible file logging, Airsnort-compatible "interesting" (cryptographically weak) logging, Secure SUID behavior, GPS devices and wireless devices fingerprinting. Kismet also includes a tool called gpsmap that can be used to create maps from logged GPS data.
Author:Mike Kershaw
Homepage:http://www.kismetwireless.net/
Changes:A new active Bluetooth scanning plugin, support for new GPSD protocols, UI improvements, and multiple bugfixes including GPS logic, segfaults in plugins, and CPU-eating bugs on reconnecting to servers.
File Size:887326
Last Modified:Jan 12 17:43:40 2010
MD5 Checksum:538b536c95de63b6d9da4e5b53f61453

 ///  File Name:tcpcontrol-fuzzer.txt
Description:
2^6 TCP control bit fuzzer (no ECN or CWR).
Author:ShadowHatesYou
File Size:1823
Last Modified:Jan 11 18:12:31 2010
MD5 Checksum:59d4a04e97147571391b2f2ebfe8d7f8

 ///  File Name:haraldscan-osx-0.41.tar.gz
Description:
Harald Scan is a Bluetooth discovery scanner. It determines Major and Minor device classes according to the Bluetooth SIG specification and attempts to resolve a device's MAC address to the largest known vendor/MAC address list. Written in Python. This is the Mac OS X source code version.
Author:Terence Stenvold
Homepage:http://code.google.com/p/haraldscan/
Changes:The Mac OS X version was updated to the latest code base. A Fancy Blue name was added. Some CLI bugs were fixed. MACLIST now has 310 entries.
File Size:44900
Last Modified:Jan 11 18:09:08 2010
MD5 Checksum:cd7bc8b92bd7f9aa69220a309c0c5d1c

 ///  File Name:haraldscan-dist-0.41.tar.gz
Description:
Harald Scan is a Bluetooth discovery scanner. It determines Major and Minor device classes according to the Bluetooth SIG specification and attempts to resolve a device's MAC address to the largest known vendor/MAC address list. Written in Python. This is the Linux binary release.
Author:Terence Stenvold
Homepage:http://code.google.com/p/haraldscan/
Changes:A Fancy Blue name was added. Some CLI bugs were fixed. MACLIST now has 310 entries.
File Size:2432771
Last Modified:Jan 11 18:07:31 2010
MD5 Checksum:db4718010540d2c02e979c69ff02d175

 ///  File Name:nightwing_v0.7.tgz
Description:
Nightwing allows the creation of quickly deployed wireless networks without the need to make complicated configurations. With the implementation of a Mesh technology called B.A.T.M.A.N, Nightwing allows the extension of wireless networks with a simple way of adding devices that works with minimal human intervention. It has public and private connection interfaces, and the ability to filter content using OpenDNS. It is designed with security in mind, and has low hardware requirements.
Author:Gustavo Lindberg,Julio C. Puigpinos,Martin A. Campff,Sebastián D. Criado
Homepage:http://nightwing.lugro-mesh.org.ar/
Changes:This release adds a traffic shapping (TS) function, a Web admin interface with firmware upgrading via MTD and Node info, TS configuration via nw_conf, and an IP check list in the nwnode config file.
File Size:66341
Last Modified:Jan 11 17:42:21 2010
MD5 Checksum:cd6ca54e816e9cfeafb65d9ecda537a0

 ///  File Name:ALPHA3.zip
Description:
ALPHA3 is an alphanumeric shellcode encoder.
Author:SkyLined
Homepage:http://code.google.com/p/alpha3/
File Size:689171
Last Modified:Jan 11 17:15:01 2010
MD5 Checksum:403031de84c35d6a3ef104a5f496aa4f

 ///  File Name:IP-Link.tar.gz
Description:
The goal of IP-Link is to show the relationships between different IP addresses from network traffic capture, thus quickly determining for a given address the IP address with which it communicates the most.
Author:Cedric Bonhomme,Jerome Hussenet
Homepage:http://ip-link.wikidot.com/
File Size:171522
Last Modified:Jan 11 17:06:51 2010
MD5 Checksum:1e4978dcdbd88ce7cb36d23f09a06c5b

 ///  File Name:Exploitsug.rar
Description:
Exploit Suggester version 1.0 banner grabbing written in Python.
Author:FB1H2S
File Size:4120
Last Modified:Jan 8 20:50:40 2010
MD5 Checksum:cc2e0fcf27da905b6b31e63126a93416

 ///  File Name:tor-0.2.1.21.tar.gz
Description:
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).
Author:Roger Dingledine
Homepage:http://tor.eff.org
Changes:This release fixes an incompatibility with the most recent OpenSSL library. If you use Tor on Linux or Unix and you\'re getting SSL renegotiation errors, upgrading should help. An upgrade is also recommended if you\'re an exit relay.
File Size:2408984
Last Modified:Jan 7 14:37:59 2010
MD5 Checksum:c37209b8f055cec03ccac0fb1da3c347

 ///  File Name:packetfence-1.8.7.tar.gz
Description:
PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.
Homepage:http://www.packetfence.org/en/home.html
Changes:This is a security fix release that also includes some bugfixes. A Cross-Site Scripting Vulnerability was fixed (#884), and issues with Aruba Controllers (#871 and #873) were resolved. Also fixed in this release are issues with multiple registration in the same browser session (#761) and issues in some wireless scenarios (#880), among other things.
File Size:1984063
Last Modified:Jan 7 00:19:46 2010
MD5 Checksum:bcd5fd5c55df0ed9affcb3b015861625

 ///  File Name:phpav-1.1.txt
Description:
phpAV is a script designed to work as antivirus for malicious PHP scripts. It will search a given directory and related files for dangerous functions and provide a report.
Author:Milos Zivanovic
File Size:5165
Last Modified:Jan 6 23:48:03 2010
MD5 Checksum:0019c4dadfdf0ad16cce207d5a56bdc4

 ///  File Name:NetCrack-1.0.tar.gz
Description:
NetCrack is cluster software developed to distribute a hashing algorithm's cracking process work using a brute force attack. Currently, it only supports the two most commonly used hashing algorithms: MD5 and SHA-1. Support is included for MySQL, safe mode, and others. It works like a client/server application, where the server is unique for each cluster network and its job is to distribute the cracking process work, coordinate the nodes, and prevent connections and data integrity errors.
Author:Salvatore Fresta
Homepage:http://www.salvatorefresta.net/
File Size:39410
Last Modified:Jan 4 20:05:45 2010
MD5 Checksum:232392a55582085a1f1b7fb8cf233901

 ///  File Name:stkeys.tar.gz
Description:
STKeys is a tool that will recover default WPA keys for Thomson routers using the default SSID. Works on most Thomson routers supplied by multiple ISPs in Europe.
Author:Kevin Devine
File Size:2989
Last Modified:Jan 4 19:53:09 2010
MD5 Checksum:fba5138fb43b8d703da1520b594ea5fd

 ///  File Name:deeptoad-1.1.0.tar.gz
Description:
DeepToad is a tool for computing fuzzy hashes from files. DeepToad can generate signatures, clusterize files and/or directories and compare them. It's inspired in the very good tool ssdeep and, in fact, both projects are very similar. The complete project is written in pure python and is distributed under the LGPL license.
Author:Joxean Koret
Homepage:http://code.google.com/p/deeptoad/
File Size:22989
Last Modified:Jan 3 23:27:47 2010
MD5 Checksum:4334037822d2c341c0f288cbe3ba41ac

 ///  File Name:Hybrid_v.1.0.zip
Description:
The Hybrid Botnet System contains a perl bot and web administration panel. It uses only one perl module and can easily be compiled with perl2exe to run on a Linux host without perl installed.
Author:cross
Homepage:http://x1machine.com/
File Size:1662222
Last Modified:Jan 3 23:12:06 2010
MD5 Checksum:acdeca3dc831a4e2f2e6a1ce41dbbb74

 ///  File Name:malheur-0.4.5.tar.gz
Description:
Malheur is a tool for automatic analysis of program behavior recorded from malicious software (malware). It is designed to support the regular analysis of malicious software and the development of detection and defense measures. It allows for identifying novel classes of malware with similar behavior and assigning unknown malware to discovered classes. It can be applied to recorded program behavior of various formats as long as monitored events are separated by delimiter symbols, e.g. as in reports generated by the popular malware sandboxes CWSandbox, Anubis, Norman Sandbox, and Joebox.
Author:Konrad Rieck
Homepage:http://www.mlsec.org/malheur/
Changes:This release fixes a bug in classification mode when loading prototypes.
File Size:501515
Last Modified:Jan 3 21:17:31 2010
MD5 Checksum:32779e434d801021880138d7270bc7a4

 ///  File Name:peludo-cachicamo-beta-v1.0.0.tgz
Description:
Peludo is a system to create and run platform independent, self-contained and injectable applications written in the C programming language. It provides a cross compiling environment with the tools to generate applications in Peludo's new binary format (PLD). The system also provides the runtime to launch these programs as independent executable files or as position independent code that can be injected into a running process. Peludo makes the Java virtual machine of the netifera probe injectable and easier to port to new platforms.
Author:Claudio Castiglia
Homepage:http://netifera.com/peludo
File Size:319250
Last Modified:Dec 29 19:21:00 2009
MD5 Checksum:ce1a7100824296f58d78bf241f6d8a37

 ///  File Name:wafp-0.01-26c3.tar.gz
Description:
WAFP is an easy to use Web Application Finger Printing tool written in ruby using sqlite3 databases for storing the fingerprints.
Author:Richard Sammet
Homepage:http://mytty.org/wafp/
File Size:8823666
Last Modified:Dec 30 16:15:53 2009
MD5 Checksum:48d7fc09781f21477b648c28feea5b4e

 ///  File Name:wapiti-2.2.0.zip
Description:
Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities.
Author:Nicolas Surribas
Homepage:http://wapiti.sourceforge.net/
Changes:Various options and modules added. Various bug fixes.
File Size:473466
Last Modified:Dec 30 14:52:14 2009
MD5 Checksum:30272cc01f3fbda91f83542be3487a5d

 ///  File Name:hostmap-0.2.1.tar.gz
Description:
Hostmap is a free, automatic, hostnames and virtual hosts discovery tool written in Ruby and licensed under GNU General Public License version 3 (GPLv3). It's goal is to enumerate all hostnames and configured virtual hosts on an IP address. The primary users of hostmap are professionals performing vulnerability assessments and penetration tests.
Author:Alessandro Tanasi
Homepage:http://hostmap.sourceforge.net/
Changes:Various bug fixes and some new features.
File Size:400757
Last Modified:Dec 30 01:54:54 2009
MD5 Checksum:df4aa874a1bf6db6d4e9eaf8dfa26027

 ///  File Name:xplico-0.5.4.tgz
Description:
Xplico is an open source Network Forensic Analysis Tool (NFAT) that allows for data extraction from traffic captures. It supports extraction of mail from POP, IMAP, and SMTP, can extract VoIP streams, etc. This is the version that has a GUI allowing you to view photos, texts and videos contained in MMS messages.
Author:Andrea de Franceschi,Gianluca Costa
Homepage:http://www.xplico.org/
Changes:A Facebook Web chat dissector and WLAN and LLC basic dissectors were added. A new XI based on CakePHP 1.2.5 was added. A new representation of images was implemented. For each image, you can see (with the proxy enabled) the page where the image is contained. There were also HTTP dissector improvements and bugfixes.
File Size:2090804
Last Modified:Dec 30 01:08:50 2009
MD5 Checksum:602d44840d9e48c3b08b902cdf8a6be0

 ///  File Name:GNUnet-0.8.1.tar.gz
Description:
GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP (IPv4 and IPv6), TCP (IPv4 and IPv6), HTTP, or SMTP messages. GNUnet supports accounting to provide contributing nodes with better service. The primary service build on top of the framework is anonymous file sharing.
Author:Christian Grothoff
Homepage:http://www.ovmj.org/GNUnet/
Changes:This version includes an improved routing algorithm for non-anonymous searching and downloading as well as improved neighbor selection for anonymous routing. Command line tools can now be used in ways that do not leak activity to local users. Various other minor features and bugfixes are also included.
File Size:2339085
Last Modified:Dec 30 01:04:54 2009
MD5 Checksum:906a65f70f403f70798bb7c89b45b3b6

 ///  File Name:john-1.7.4.tar.gz
Description:
John the Ripper is a fast password cracker, currently available for many flavors of Unix (11 are officially supported, not counting different architectures), DOS, Win32, and BeOS. Its primary purpose is to detect weak Unix passwords, but a number of other hash types are supported as well.
Author:Solar Designer
Homepage:http://www.openwall.com/john/
Changes:The word mangling rules engine has been enhanced in many ways, including addition of support for back-references and "parallel" ranges to the preprocessor, the notion of numeric variables, more rule commands and reject flags, as well as performance improvements. The default rulesets have been revised to make use of the new features, for speed, to produce fewer duplicates, and to generate additional kinds of candidate passwords. The idle priority emulation code has been optimized for lower overhead, and the Idle setting has been enabled by default.
File Size:822748
Last Modified:Dec 30 01:00:36 2009
MD5 Checksum:f4d6a95f98b6ab05f12aa899430c1642

 ///  File Name:framework-3.3.3.tar.bz2
Description:
The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. Metasploit is used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide. The framework is written in the Ruby programming language and includes components written in C and assembler.
Author:H D Moore
Homepage:http://metasploit.com/
Changes:All exploits now contain a ranking that indicates how dangerous the default settings are to the target host. The search command now takes a -r option to specify a minimum ranking of modules to return. Various other improvements and additions.
File Size:23438382
Last Modified:Dec 23 11:50:46 2009
MD5 Checksum:aee22d8cfa2c081051434ad893cd3533

 ///  File Name:samhain-2.6.1b.tar.gz
Description:
Samhain is a file system integrity checker that can be used as a client/server application for centralized monitoring of networked hosts. Databases and configuration files can be stored on the server. Databases, logs, and config files can be signed for tamper resistance. In addition to forwarding reports to the log server via authenticated TCP/IP connections, several other logging facilities (e-mail, console, and syslog) are available. Tested on Linux, AIX, HP-UX, Unixware, Sun and Solaris.
Author:Rainer Wichmann
Homepage:http://samhain.sourceforge.net
Changes:On Linux, login/logout tracking now uses inotify. Log file monitoring has been enhanced to support checking for missing heartbeat messages, reporting bursts of repeated messages, and checking for correlated events. UID/GID caching has been improved to reduce the number of lookups, and a compile problem on Cygwin has been fixed.
File Size:1904857
Last Modified:Dec 23 09:41:34 2009
MD5 Checksum:226f775243535456bf852b406ffc4fe1

 ///  File Name:WinScanX_Basic.zip
Description:
WinScanX is a Windows enumeration utility featuring over 20 options including the ability to identify easy-to-guess Windows passwords, the ability to identify easy-to-guess SNMP community strings, and the ability to locate and decrypt WinVNC passwords. Includes an optional GUI front-end.
Author:Reed Arvin
Homepage:http://windowsaudit.com/
File Size:100810
Last Modified:Dec 22 16:27:30 2009
MD5 Checksum:46f9d4769513714550c3368066a2122d

 ///  File Name:gnupg-2.0.14.tar.bz2
Description:
GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.
Homepage:http://www.gnupg.org
Changes:The default for "--include-cert" is now to include all certificates in the chain except for the root certificate. Numerical values may now be used as an alternative to the debug-level keywords. The GPGSM "--audit-log" feature is now more complete. A new GPGSM option "--ignore-cert-extension" was added. New and changed passphrases are now created with an iteration count requiring about 100ms of CPU work.
File Size:3982080
Last Modified:Dec 22 15:35:23 2009
MD5 Checksum:54732a0a76d59646b7e0b682fb357c22

 ///  File Name:sipwitch-0.5.12.tar.gz
Description:
GNU SIP Witch is a pure SIP-based office telephone call server that supports generic phone system features like call forwarding, hunt groups and call distribution, call coverage and ring groups, holding, and call transfer, as well as offering SIP specific capabilities such as presence and messaging. It supports secure telephone extensions for making calls over the Internet, and intercept/decrypt-free peer-to-peer audio and video extensions. It is not a SIP proxy, a multi-protocol telephone server, or an IP-PBX, and does not try to emulate Asterisk, FreeSWITCH, or Yate.
Author:David Sugar
Homepage:http://www.gnutelephony.org/
Changes:This release includes a rewrite of the user profile and SIP account system to help converge with system users. Man pages have been added to document all binaries. Support has been added for for user agents (such as telepathy) that communicate from ephemeral ports. Fully automatic subnet detection is supported. A fix was added for receiving inbound anonymous callers.
File Size:483832
Last Modified:Dec 21 18:38:36 2009
MD5 Checksum:d4fbc1b931bc469453c85e3293afabd9

 ///  File Name:hostmap-0.2.tar.gz
Description:
Hostmap is a free, automatic, hostnames and virtual hosts discovery tool written in Ruby and licensed under GNU General Public License version 3 (GPLv3). It's goal is to enumerate all hostnames and configured virtual hosts on an IP address. The primary users of hostmap are professionals performing vulnerability assessments and penetration tests.
Author:Alessandro Tanasi
Homepage:http://hostmap.sourceforge.net/
Changes:Fully refactored and rewritten in Ruby. User requested interrupt (CTRL+C) now is handled. Various other changes and many additions.
File Size:387689
Last Modified:Dec 17 17:10:11 2009
MD5 Checksum:7dc5ac5b092665b8006227b55fd1d490

 ///  File Name:lynis-1.2.9.tar.gz
Description:
Lynis is an auditing tool for Unix (specialists). It scans the system and available software to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes. This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems.
Author:Michael Boelen
Homepage:http://www.rootkit.nl/projects/lynis.html
Changes:This release adds several fixes and improvements for Squid, a few new tests, and improved logging and reporting.
File Size:117107
Last Modified:Dec 16 18:20:00 2009
MD5 Checksum:69b369173ffc0f10f021035f73857e1f

 ///  File Name:maketh-0.2.0.tar.gz
Description:
Maketh is a packet generator that supports forging ARP, IP, TCP, UDP, ICMP and the ethernet header as well.
Author:Simpp
Homepage:http://simpp-kode.tuxfamily.org/maketh/index.html
File Size:96102
Last Modified:Dec 15 17:15:07 2009
MD5 Checksum:f9d78cf3ca7446e600b309d134b1d738

 ///  File Name:SSHatter-1.0.tar.gz
Description:
SSHatter is a remote brute force utility that attempts every password from a given list against a target.
Author:Tim Brown
Homepage:http://www.nth-dimension.org.uk/
Changes:This release adds dumb mode, where SSHatter will check password equals password, username, and blank. It adds sudo mode, where SSHatter will echo the password to STDIN. It adds rudimentry file transfer modes, which also work interactively via "put" and "get". It improves the usage message. There is a new command line interface based on Getops. There is a modular design to allow more code reuse, a new threading model, support for SSH private keys, mass mode for post brute force command execution, and interactive mode for post brute force command execution. Timing attack based username enumeration has been removed for now.
File Size:8131
Last Modified:Dec 15 17:12:16 2009
MD5 Checksum:74fbc2170fad60bd868f08bcd41bf4c9

 ///  File Name:scapy-2.1.0.tar.gz
Description:
Scapy is a powerful interactive packet manipulation tool, packet generator, network scanner, network discovery tool, and packet sniffer. It provides classes to interactively create packets or sets of packets, manipulate them, send them over the wire, sniff other packets from the wire, match answers and replies, and more. Interaction is provided by the Python interpreter, so Python programming structures can be used (such as variables, loops, and functions). Report modules are possible and easy to make. It is intended to do the same things as ttlscan, nmap, hping, queso, p0f, xprobe, arping, arp-sk, arpspoof, firewalk, irpas, tethereal, tcpdump, etc.
Author:Philippe Biondi
Homepage:http://www.secdev.org/projects/scapy
Changes:The Windows branch has been merged. Many bugs have been fixed. Network automata gained new features like the ability to add breakpoints or tracepoints. Many new small features have been added. Last but not least, this release comes with documentation.
File Size:956785
Last Modified:Dec 14 19:37:38 2009
MD5 Checksum:357b5b21ea3b4f289a326c0905b715c1

 ///  File Name:mobiusft-0.5.tar.gz
Description:
Mobius Forensic Toolkit is a forensic framework written in Python/GTK that manages cases and case items, providing an abstract interface for developing extensions. Cases and item categories are defined using XML files for easy integration with other tools.
Homepage:http://savannah.nongnu.org/projects/mobiusft
Changes:Case items may have an associated datasource, which represents a stream of bytes. This release also introduces Data Sourcerer, Datasource Model, Datasource Raw, and Datasource Talon extensions. Extensions now have callbacks.
File Size:1600696
Last Modified:Dec 10 20:04:23 2009
MD5 Checksum:e54ab1c81f8562799ff83ba89ab25b73

 ///  File Name:sam_web_edition_0_6_0.tar.gz
Description:
SAM is a Real-Time Snort alert monitor. SAM provides many ways to indicate that you may be experiencing an intrusion attempt on your network including audio/visual warnings, email warnings, etc. SAM is written in Java for maximum portability.
Author:Sam Freiberg
Homepage:http://freesoftware.lookandfeel.com/sam/
Changes:IP addresses are now tagged with their country of origin. Application-level authentication has been added. A heat map that shows the distribution of high priority alerts by country has been added.
File Size:2032903
Last Modified:Dec 10 20:02:26 2009
MD5 Checksum:464352ab5bebbe3818e11041d082db94

 ///  File Name:framework-3.3.2.tar.bz2
Description:
The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. Metasploit is used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide. The framework is written in the Ruby programming language and includes components written in C and assembler.
Author:H D Moore
Homepage:http://metasploit.com/
Changes:Metasploit now has 463 exploit modules and 219 auxiliary modules (from 453 and 218 respectively in v3.3.1). Tons of fixes and improvements have been made.
File Size:23083744
Last Modified:Dec 10 17:21:16 2009
MD5 Checksum:8d68dd7060f5cd94e592fee7daadd5fb

 ///  File Name:iptables-1.4.6.tar.bz2
Description:
iptables is built on top of netfilter, the packet alteration framework for Linux 2.4.x and 2.6.x. It is a major rewrite of its predecessor ipchains, and is used to control packet filtering, Network Address Translation (masquerading, portforwarding, transparent proxying), and special effects such as packet mangling.
Homepage:http://www.iptables.org
Changes:This release supports all new features of the 2.6.32 kernel, contains manpage updates, and fixes multiple smaller bugs.
File Size:463758
Last Modified:Dec 10 10:34:17 2009
MD5 Checksum:c67cf30e281a924def6426be0973df56

 ///  File Name:packetfence-1.8.6.tar.gz
Description:
PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.
Homepage:http://www.packetfence.org/en/home.html
Changes:This is a maintenance release that focuses on stability and includes many bugfixes and several small enhancements. Noteworthy changes are new iPod UserAgent blocking string examples, Snort 2.8.5 compatibility, expire mode deadline now working in VLAN isolation, and updates to the installation guide. Various other important fixes.
File Size:1981258
Last Modified:Dec 8 18:57:47 2009
MD5 Checksum:b90115fca3f67d4e082821cc2a6b9913

 ///  File Name:lynis-1.2.8.tar.gz
Description:
Lynis is an auditing tool for Unix (specialists). It scans the system and available software to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes. This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems.
Author:Michael Boelen
Homepage:http://www.rootkit.nl/projects/lynis.html
Changes:This release adds initial support for Squid and several tests related to user authentication. Several improvements have been made, including some small bugfixes.
File Size:115174
Last Modified:Dec 8 18:54:36 2009
MD5 Checksum:cc4ac2462252e580bc23ef81ba1fc7cc

 ///  File Name:sshutout-1.0.6.tar.gz
Description:
sshutout is a daemon that periodically monitors log files, looking for multiple failed login attempts via the Secure Shell daemon. The daemon is meant to mitigate what are commonly known as "dictionary attacks," i.e. scripted brute force attacks that use lists of user IDs and passwords to effect unauthorized intrusions. The sshutout daemon blunts such attacks by creating firewall rules to block individual offenders from accessing the system. These rules are created when an attack signature is detected, and after a configurable expiry interval has elapsed, the rules are deleted.
Author:Bil DuPree
Homepage:http://www.techfinesse.com/sshutout/sshutout.html
Changes:This release fixes improper calls to open(). It increases the size of the line buffer used to read the configuration file. This allows for longer whitelists. It detects "UNKNOWN USER" signatures.
File Size:32479
Last Modified:Dec 7 17:38:33 2009
MD5 Checksum:0d699bef09cf16a9c921181c19028abe

 ///  File Name:ninja-0.1.3.tar.bz2
Description:
Ninja is a privilege escalation detection and prevention system for GNU/Linux hosts. While running, it will monitor process activity on the local host, and keep track of all processes running as root. If a process is spawned with UID or GID zero (root), ninja will log necessary information about this process, and optionally kill the process if it was spawned by an unauthorized user.
Author:Tom Rune Flo
Homepage:http://forkbomb.org/ninja/
Changes:A bugfix for x86-64 platforms when using a log file.
File Size:10884
Last Modified:Dec 4 23:11:03 2009
MD5 Checksum:4ff6738dd84897a70d16997f6dcae06a

 ///  File Name:pkd-1.5.tgz
Description:
ipt_pkd is an iptables extension implementing port knock detection. This project provides 3 parts: the kernel module ipt_pkd, the iptables user space module libipt_pkd.so, and a user space client knock program. For the knock packet, it uses a UDP packet sent to a random port that contains a SHA-256 of a timestamp, small header, random bytes, and a shared key. ipt_pkd checks the time window of the packet and does the SHA-256 to verify the packet. The shared key is never sent.
Author:eric
Changes:This release adds support for iptables 1.4.4 and 1.4.5 and kernels 2.6.30 and 2.6.31.
File Size:73870
Last Modified:Dec 4 23:09:14 2009
MD5 Checksum:4218bd5790110e326b8e61508a54b6fa

 ///  File Name:whatweb-0.3.tar.gz
Description:
WhatWeb next generation web scanner identifies what websites are running. Released at the Kiwicon conference (kiwicon.org) in Wellington, New Zealand. Written in Ruby for Linux. Flexible plugin architecture with over 60 plugins so far. Passive plugins use information in the headers, cookies, HTML body and URL. Aggressive plugins can identify versions of Joomla, phpBB, etc by making extra requests to the webserver. Screenshots on the homepage.
Author:Andrew Horton (urbanadventurer)
Homepage:http://www.morningstarsecurity.com/research/whatweb
File Size:1020435
Last Modified:Dec 1 17:42:35 2009
MD5 Checksum:c46b1945dcd5539244f36eaea1e3940d

 ///  File Name:basedomainname-0.1.tar.gz
Description:
This tool can extract TLD (Top Level Domain), domain extensions (Second Level Domain + TLD), domain name, and hostname from fully qualified domain names. Written in Ruby for Unix. Recognizes all countries, top level domains and second level domains.
Author:Andrew Horton (urbanadventurer)
Homepage:http://www.morningstarsecurity.com/research
File Size:8547
Last Modified:Dec 1 17:40:37 2009
MD5 Checksum:39866a94872ae4c8ca2613704b6731c9

 ///  File Name:gggooglescan-0.1.tar.gz
Description:
This tool enumerates hostnames and URLs from Google. It features antibot avoidance, search within a country, custom search appliance, output either hostnames or URLs, and custom search depth. Written in Bash for Linux.
Author:Andrew Horton (urbanadventurer)
Homepage:http://www.morningstarsecurity.com/research
File Size:1340
Last Modified:Dec 1 17:38:09 2009
MD5 Checksum:e53dab2a6f19c40c475aedb99e3d6166

 ///  File Name:bing-ip2hosts-0.1.tar.gz
Description:
This tool enumerates hostnames from Bing.com for an IP address. Bing.com is Microsoft's search engine which has an IP: search parameter. Written in Bash for Linux. Requires wget.
Author:Andrew Horton (urbanadventurer)
Homepage:http://www.morningstarsecurity.com/research
File Size:869
Last Modified:Dec 1 16:59:40 2009
MD5 Checksum:95a86caabda6489b1620a72b85f4fc8f

 ///  File Name:winappdbg-1.3.tar.bz2
Description:
The WinAppDbg python module allows developers to quickly add Windows application debugging facilities to your Python scripts.
Homepage:http://sourceforge.net/apps/trac/winappdbg/
Changes:64 bit support. Windows Vista and 7 support. Various other support.
File Size:174560
Last Modified:Dec 1 15:50:39 2009
MD5 Checksum:4c07d425bd8e8d4d48168cb1e6fa5dbd

 ///  File Name:kismet-2009-11-R1.tar.gz
Description:
Kismet is an 802.11 layer 2 wireless network sniffer. It can sniff 802.11b, 802.11a, and 802.11g traffic. It is capable of sniffing using almost any wireless card supported in Linux, which currently divide into cards handled by libpcap and the Linux-Wireless extensions (such as Cisco Aironet), and cards supported by the Wlan-NG project which use the Prism/2 chipset (such as Linksys, Dlink, and Zoom). Besides Linux, Kismet also supports FreeBSD, OpenBSD and Mac OS X systems. Features Multiple packet capture sources, Runtime network sorting by AP MAC address (bssid), IP block detection via ARP and DHCP packet dissection, Cisco product detection via CDP, Ethereal and tcpdump compatible file logging, Airsnort-compatible "interesting" (cryptographically weak) logging, Secure SUID behavior, GPS devices and wireless devices fingerprinting. Kismet also includes a tool called gpsmap that can be used to create maps from logged GPS data.
Author:Mike Kershaw
Homepage:http://www.kismetwireless.net/
Changes:Many bugs were fixed, including logfile and XML corruption fixes, problems with support for wireless API changes in Snow Leopard, terminal resizing bugs, bugs with the autowep key guessing plugin, and bugs in plugin support on Mac OS X. This release also includes enhancements to the plugin API and an improved kismet-ptw plugin.
File Size:859854
Last Modified:Nov 30 21:01:16 2009
MD5 Checksum:6987fb1dd8574a6b85ca3af3c068568e

 ///  File Name:sudosh3-3.2.0.tar.gz
Description:
sudosh3 is an auditing shell and filter based on sudosh2. It aims to improve file management and terminal emulation. Passwords are not recorded.
Homepage:http://sourceforge.net/projects/sudosh3/
File Size:244867
Last Modified:Nov 30 20:43:41 2009
MD5 Checksum:73c097d7eec6400a25f10bd121c8e07c

 ///  File Name:RFIDIOt-Windows-1.0a.zip
Description:
RFIDIOt is a python library for exploring RFID devices. It currently drives a couple of RFID readers made by ACG, called the HF Dual ISO and the LFX. Includes sample programs to read/write tags and the beginnings of library routines to handle the data structures of specific tags like MIFARE(r). This is the Windows version.
Author:Adam Laurie
Homepage:http://rfidiot.org/
Changes:Integration of libnfc has begun. Mifare key handling code has been cleaned up. Various other improvements.
File Size:449211
Last Modified:Nov 30 20:31:59 2009
MD5 Checksum:dd6dc00858de44e1210004d7b3d4fc50

 ///  File Name:RFIDIOt-1.0a.tgz
Description:
RFIDIOt is a python library for exploring RFID devices. It currently drives a couple of RFID readers made by ACG, called the HF Dual ISO and the LFX. Includes sample programs to read/write tags and the beginnings of library routines to handle the data structures of specific tags like MIFARE(r).
Author:Adam Laurie
Homepage:http://rfidiot.org/
Changes:Integration of libnfc has begun. Mifare key handling code has been cleaned up. Various other improvements.
File Size:417860
Last Modified:Nov 30 20:31:57 2009
MD5 Checksum:d2f9696bcc3dc9c601ea961fa65f9ac1

 ///  File Name:sambascan2-0.4.2.tar.gz
Description:
Sambascan2 allows you to search an entire network or a number of hosts for SMB shares. It will also list the contents of all public shares that it finds. The difference between sambascan2 and other SMB viewers and scanners is that it will search everything using TCP/IP, and it will not send a lot of broadcast messages, so it can be used over LAN boundaries. It only uses SMB to list the shares and their contents.
Author:Claudio Clemens
Homepage:http://asturio.gmxhome.de/sambascan.html
Changes:Scanning shares with spaces now works.
File Size:68654
Last Modified:Nov 30 20:13:38 2009
MD5 Checksum:b002d4096e9129c8ee56a27e9f8dccc5

 ///  File Name:rkhunter-1.3.6.tar.gz
Description:
Rootkit Hunter scans files and systems for known and unknown rootkits, backdoors, and sniffers. The package contains one shell script, a few text-based databases, and optional Perl modules. It should run on almost every Unix variety except Solaris and NetBSD.
Author:Michael Boelen
Homepage:http://www.rootkit.nl/
Changes:This release offers more ease of use and improved checks. The changelog lists 29 additions including 9 configuration options and details for 12 rootkits, 29 changes including improvements for 15 rootkit checks, and 22 bugfixes.
File Size:217691
Last Modified:Nov 30 17:01:27 2009
MD5 Checksum:41bd92b1ea0803401c4a45215c8293a2

 ///  File Name:haraldscan-src-0.401.tar.gz
Description:
Harald Scan is a Bluetooth discovery scanner. It determines Major and Minor device classes according to the Bluetooth SIG specification and attempts to resolve a device's MAC address to the largest known vendor/MAC address list. Written in Python.
Author:Terence Stenvold
Homepage:http://code.google.com/p/haraldscan/
Changes:CLI has added a Number of devices discovered by duration (default is 15 mins). The duration for the above is configurable through -t TIME. You can choose either an in-memory database or a file database. The option was added to disable services scans entirely even if MAC is "Unknown". The option to disable writing devices to a text file was added. The ability to check Harald Scan version with --version was added.
File Size:23950
Last Modified:Nov 30 16:59:29 2009
MD5 Checksum:126646d1ce340db1909fdfefece5bcfc

 ///  File Name:graudit-1.4.tar.gz
Description:
Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility, grep. It's comparable to other static analysis applications like RATS, SWAAT, and flaw-finder while keeping the technical requirements to a minimum and being very flexible.
Author:Wireghoul
Homepage:http://www.justanotherhacker.com/
Changes:New and improved signatures were added. Grep versions earlier than 2.5.3 are now gracefully detected. Preparations were done for version 1.5.
File Size:16170
Last Modified:Nov 25 17:54:03 2009
MD5 Checksum:291545462e89943aed26637047e78dc8

 ///  File Name:ppscan-0.3.tar.gz
Description:
ppscan is yet another portscanner. However, it can scan an entire Class C subnet for a range of ports not only using tcp-syn/tcp-connect but also by tunneling through HTTP proxies (either HTTP GET or HTTP CONNECT), or using FTP servers which allow arbitrary connections via PORT bounce method. It is multi-threaded, so it can blaze through connection attempts.
Author:Aaron Conole
File Size:8046
Last Modified:Nov 24 16:36:29 2009
MD5 Checksum:ce2fb363ef67bc1a2240e482b7e12d3f

 ///  File Name:tor.uclibc.i686.20091123.iso
Description:
Tor-ramdisk is an i686 uClibc-based micro Linux distribution whose only purpose is to host a Tor server in an environment that maximizes security and privacy. Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. Security is enhanced by employing a monolithically compiled GRSEC/PAX patched kernel and hardened system tools. Privacy is enhanced by turning off logging at all levels so that even the Tor operator only has access to minimal information. Finally, since everything runs in ephemeral memory, no information survives a reboot, except for the Tor configuration file and the private RSA key which may be exported/imported by FTP.
Author:Anthony G. Basile
Homepage:http://opensource.dyc.edu/tor-ramdisk
Changes:This is a maintenance release to incorporate changes from upstream. Tor was updated to 0.2.1.20 and busybox was updated to 1.15.2. Users are encouraged to upgrade since the upstream releases fix address issues that may have a serious impact on the tor-ramdisk environment.
File Size:4272128
Last Modified:Nov 24 15:47:39 2009
MD5 Checksum:929b8d0c4e0687746349829348f2158b

 ///  File Name:icmpv5ip-fuzzer.txt
Description:
This is the ICMPv4/IP fuzzer prototype code.
Author:laurent gaffie
Homepage:http://g-laurent.blogspot.com/2009/11/releasing-icmpv4ip-fuzzer-prototype.html
File Size:5892
Last Modified:Nov 23 18:06:30 2009
MD5 Checksum:c38b3ad6980012a934bcede7cf360374

 ///  File Name:connect-back.php.txt
Description:
This is the ZoRBaCK Connect php script that allows for a remote shell on a compromised host.
Author:ZoRLu
File Size:1460
Last Modified:Nov 23 17:52:36 2009
MD5 Checksum:b860aa3459439b6f1f0deafbe8336aab

 ///  File Name:gtkhash-0.3.0.tar.gz
Description:
GtkHash is a utility for computing message digests or checksums using the mhash library. Currently supported hash functions include MD5, SHA1, SHA256, SHA512, RIPEMD, HAVAL, TIGER, and WHIRLPOOL.
Homepage:http://gtkhash.sourceforge.net/
Changes:An optional Nautilus (GNOME file manager) extension was added.
File Size:340443
Last Modified:Nov 23 17:48:24 2009
MD5 Checksum:657e5278f5f0b83a4954d09353f92294

 ///  File Name:tor-0.2.1.20.tar.gz
Description:
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).
Author:Roger Dingledine
Homepage:http://tor.eff.org
Changes:This release fixes a crash bug when you\'re accessing many hidden services at once, prepares for more performance improvements, and fixes a bunch of smaller bugs.
File Size:2412059
Last Modified:Nov 18 09:13:25 2009
MD5 Checksum:0d62ee2332fdd95de43debac7435df19

 ///  File Name:iwatch-0.2.2.tgz
Description:
iWatch is a real-time filesystem monitoring program. It is a tool for detecting any changes on your filesystem and reporting it to the system administrator immediately. It uses a simple configuration file in XML format and is based on inotify, a file change notification system in the Linux kernel.
Author:Cahya Wirawan
Homepage:http://iwatch.sourceforge.net/index.html
Changes:The bug where the file being watched contains one of the formats available for substitution was fixed. A directory that is renamed or moved is now watched properly. Unnecessary watching of create events was fixed. A feature was added to reload the configuration file when the SIGHUP signal is received. A feature to specify the charset was added.
File Size:16819
Last Modified:Nov 18 09:01:05 2009
MD5 Checksum:b32155e844b0d58871dc72041160938d

 ///  File Name:framework-3.3.tar.bz2
Description:
The Metasploit Framework is an advanced open-source platform for developing, testing, and using exploit code. Metasploit is used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide. The framework is written in the Ruby programming language and includes components written in C and assembler.
Author:H D Moore
Homepage:http://metasploit.com/
Changes:446 exploits, 216 auxiliary modules, and hundreds of payloads, including an in-memory VNC service and the Meterpreter. In addition, the Windows payloads now support NX, DEP, IPv6, and the Windows 7 platform. More than 180 bugs were fixed.
File Size:22614595
Last Modified:Nov 18 08:30:47 2009
MD5 Checksum:e9fe29c30f70de311333be509babf720

 ///  File Name:xplico-0.5.3.tgz
Description:
Xplico is an open source Network Forensic Analysis Tool (NFAT) that allows for data extraction from traffic captures. It supports extraction of mail from POP, IMAP, and SMTP, can extract VoIP streams, etc. This is the version that has a GUI allowing you to view photos, texts and videos contained in MMS messages.
Author:Andrea de Franceschi,Gianluca Costa
Homepage:http://www.xplico.org/
Changes:This version introduced PPPoE, NNTP, DNS, and SNOOP dissectors. In CLI mode, the decoder now generates a directory tree organized by IP source and protocols decoded.
File Size:0
Last Modified:Nov 18 08:25:38 2009
MD5 Checksum:d41d8cd98f00b204e9800998ecf8427e

 ///  File Name:pdfresurrect-v0_9.tar.gz
Description:
PDFResurrect is a tool aimed at analyzing PDF documents. The PDF format allows for previous document changes to be retained in a more recent version of the document, thereby creating a running history of changes for the document. This tool attempts to extract all previous versions while also producing a summary of changes between versions. It can also "scrub" or write data over the original instances of PDF objects that have been modified or deleted, in an effort to disguise information from previous versions that might not be intended for anyone else to read.
Author:enferex
Homepage:http://www.757labs.com/projects/pdfresurrect
Changes:This is a bugfix release and addresses the gathering of data (within limit) for the Creator MetaData at the end of a PDF. The previous version would stop prematurely, or possibly get too much information (in certain cases).
File Size:60121
Last Modified:Nov 16 22:40:07 2009
MD5 Checksum:2948fd6a5dfca3f56d8b3aa783db0276

 ///  File Name:wtmpclean-0.6.7.tar.bz2
Description:
wtmpClean is a tool for Unix which clears a given user from the wtmp database.
Author:Davide Madrisan
Homepage:http://davide.madrisan.googlepages.com/opensource
Changes:When a login is terminated by a system halt or reboot, this release prints \'down\' as the logout time. It will correctly display login times with negative values.
File Size:114741
Last Modified:Nov 16 22:38:53 2009
MD5 Checksum:02baf95002a416d961e69316706b4092

 ///  File Name:stunnel-4.28.tar.gz
Description:
Stunnel is a program that allows you to encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer) available on both Unix and Windows. Stunnel can allow you to secure non-SSL aware daemons and protocols (like POP, IMAP, NNTP, LDAP, etc) by having Stunnel provide the encryption, requiring no changes to the daemon's code.
Author:Michal Trojnara
Homepage:http://www.stunnel.org
Changes:A serious bug in asynchronous shutdown code was fixed. Win32 DLLs have been added for OpenSSL 0.9.8l. Transparent proxy support was added for Linux kernels versions 2.6.28 and above.
File Size:543008
Last Modified:Nov 16 22:36:36 2009
MD5 Checksum:5bf753a042047f40a938e82ec7ece569

 ///  File Name:htrosbif-alpha-3.tar.gz
Description:
htrosbif is a tool that actively probes an HTTP server. It prods the Web server in all sorts of old, new, basic, fancy, spec-compliant, and spec-breaking ways. It tries to characterize both the well-spoken educated responses and the seriously deviant babble it receives in return. Signatures contain no user data, only header names and HTTP-level quirks. As a useful side effect, this might detect reverse proxies, HTTP load balancers, intrusion prevention systems, and Web application firewalls.
Author:Erik Inge Bolso
File Size:29425
Last Modified:Nov 16 22:34:01 2009
MD5 Checksum:3e310d3937537472f3ea5aa6b8592dc1

 ///  File Name:openssl-0.9.8l.tar.gz
Description:
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.
Homepage:http://www.openssl.org/
Changes:Fixes to stateless session resumption handling were made. Error return checking was improved for several function calls. Leading 0x80 in OIDs are no longer tolerated. The server certificate chain building code now correctly uses X509_verify_cert(). A potential denial of service attack in dtls1_process_out_of_seq_message() was resolved. Several other bugs were fixed.
File Size:4179422
Related CVE(s):CVE-2009-3555
Last Modified:Nov 6 17:04:09 2009
MD5 Checksum:05a0ece1372392a2cf310ebb96333025