Ethereal in Windows. |
Network Security Tools
|
by Ritchie |
posted: February 7, 2003 |
 Computer security is constantly changing and relies on
many different factors to be effective. New vulnerabilities are
discovered daily and present a continued risk to your organization. I
have found several tools to be most helpful in identifying security
vulnerabilities; one of the first steps in securing an environment. |
Freeware Security Tools
Nessus
- Web site: http://www.nessus.org
- OS: Linux
Nessus is a powerful network based vulnerability scanner that identifies
open ports and vulnerable systems. This tool is updated frequently and
probes computers and networking devices for open ports, bad passwords, and
vulnerable systems. Nessus tests a wide range of system vulnerabilities and
reports a detailed analysis of its findings. This tool works the same or
better then most commercial vulnerability scanning tools.
NMAP
- Web site:
http://www.insecure.org
- OS: Linux and Windows
NMAP is a quick command line port scanner that can identify open, filtered,
and closed TCP and UDP ports on a system. Additionally, one of the most
frequently used features of this tool is its ability to identify the
operating system of a target.
SuperScan
- Web Site:
http://www.foundstone.com/knowledge/scanning.html
- OS: Windows
SuperScan is an Easy to use port scanner that can identify wide ranges of
active IP address and open ports in you environment. Customizable scanning
allows for detection of selected ports or complete port scans.
Sam Spade
- Web Site:
http://www.samspade.org/ssw/
- OS: Windows
Sam Spade is a security tool kit that includes a variety of tools including:
ping, whois, IP block whois, nslookup, traceroute, DNS zone transfer, mail
relay check, among others.
NBTEnum
- Web Site:
http://ntsleuth.0catch.com/
- OS: Windows
NBTEnum takes advantage of NetBios Null Sessions to enumerate information
from Windows computers. This tool will gather the user accounts, file
shares, lockout threshold, among other pieces of information.
Additionally, this tool can brute force passwords.
Nikto
- Web Site:
http://www.cirt.net/code/nikto.shtml
- OS: Windows, Linux, BSD
Nikto is a PERL based scanner that identifies web server vulnerabilities.
This tool will identify dangerous files, missing patches, and interesting
directories.
Microsoft Security Baseline Analyzer (MSBA)
- Web Site:
http://www.micriosft.com/security
- OS: Windows
This tool has the ability to scan an entire network of Microsoft computers
and performs checks on passwords, registry entries, and patch levels.
Additionally this tool will perform check the settings on Microsoft
operating systems, Internet Explorer, Internet Information Systems (IIS)
Server, and Microsoft SQL server. I have found this tool to be the most
accurate tool to determine what patches have not been applied to systems.
Security Documents
NSA
Hardening Procedures
- Web Site:
http://www.nsa.gov
The NSA has created hardening procedures for Cisco and Microsoft systems.
These procedures remove unnecessary and dangerous services to create systems
that are resilient to attack.
The Twenty Most Critical Internet Security Vulnerabilities
- Web Site:
http://www.sans.org/top20/
The majority of the successful attacks on operating systems come from only a
few software vulnerabilities.
Web Sites
Packet Storm
- Web Site:
http://www.packetstromsecurity.com
Packet Storm's web site includes a large repository of security news,
advisories, tools, exploits, and papers.
SecuriTeam
- Web Site:
http://www.securiteam.com
This web site contains security news including vulnerabilities, exploits,
and papers.
SecurityFocus
- Web Site:
http://www.securityfocus.com
The SecurityFocus web site contains security news and the Bugtraq database.
Bugtraq is a repository of computer vulnerabilities, exploits, and patches.
SANS
- Web Site:
http://www.sans.org
An organization dedicated to computer security education and Information
security training. SANS provides numerous security documents and training
classes.
Microsoft
- Web Site:
http://www.microsoft.com/security
The Microsoft Security web site contains numerous tools and procedures that
can be used to secure Microsoft systems. Additionally, this site contains
the mailing list and archive for their security vulnerability notifications.
Commercial Security Tools
LC4
- Web Site: http://www.atstake.com
- Cost: $350?
LC4 is a tool that can be use to check the strength of passwords in your
environment. This tool will grab the encrypted password hashes and attempt
to brute force crack the passwords by trying all possible combinations.
|
