Digital Forensic SIFTing – Mounting EWF or E01 evidence image files

Digital Forensic SIFTing – Mounting EWF or E01 evidence image files.

Introduction :

Over the past few years, many investigators are realizing that having to convert an image from one format to another is sometimes painful and extremely time consuming and fairly unnecessary at this point. Using a tool such as FTK Imager, seen below, is an example of converting an image from E01 to RAW format that could take hours and take up more storage than is necessary. There are many reasons that an investigator would like to examine the raw image. For me, I usually like to have access to the raw system for file carving, direct examination of the files, and utilization of free/open source tools such as log2timeline.

More read here.

Rubik’s for cryptographers

Rubik’s for cryptographers

Abstract: Hard mathematical problems are at the core of security arguments in cryptography. In this paper, study mathematical generalizations of the famous Rubik’s cube puzzle, namely the factorization, representation and balance problems in non-Abelian groups. These problems arise naturally when describing the security of Cayley hash functions, a class of cryptographic hash functions with very interesting properties. The factorization problem is also strongly related to a famous long-standing conjecture of Babai, at the intersection of group theory and graph theory. A constructive proof of Babai’s conjecture would make all Cayley hash functions insecure, but on the other hand it would have many positive applications in graph theory and computer science. In this paper, we classify existing attacks against Cayley hash functions and we review known results on Babai’s conjecture. Despite recent cryptanalytic progress on particular instances, we show that the factorization, representation and balance problems presumably remain good sources of cryptographic hard problems. Our study demonstrates that Cayley hash functions deserve further interest by the cryptography community.

Download : Papers

Visual Forensic Analysis and Reverse Engineering of Binary Data

Visual Forensic Analysis and Reverse Engineering of  Binary Data

Outline
• The Problem – Tiny Windows
• Background and Motivation
• Related Work
• Moving Beyond Hex
• System Design
• Case Studies
• Demosdata

Download : http://www.blackhat.com

WordPress Security Scanner/WPScan 1.1 released

WPScan is a vulnerability scanner which checks the security of WordPress installations using a black box approach. details :

  • Username enumeration (from author querystring and location header)
  • Weak password cracking (multithreaded)
  • Version enumeration (from generator meta tag and from client side files)
  • Vulnerability enumeration (based on version)
  • Plugin enumeration (2220 most popular by default)
  • Plugin vulnerability enumeration (based on plugin name)
  • Plugin enumeration list generation
  • Other misc WordPress checks (theme name, dir listing,

WPScan version 1.1 has been released! With 780 more lines of code the most notable changes are:

  • Detection for 750 more plugins.
  • Detection for 107 new plugin vulnerabilities.
  • Detection for 447 possible timthumb file locations.
  • Advanced version fingerprinting implemented.
  • Full Path Disclosure (FPD) checks.
  • Auto updates.
  • Progress indicators.
  • Improved custom 404 checking.
  • Improved plugin detection.
  • Improved error_log checking.
  • Lots of bugs fixed.
  • Lots of small tweaks.

CHANGE LOG

READ MORE IN here WPScan – WordPress Security Scanner Copyright (C) 2011 Ryan Dewhurst AKA ethicalhack3r. Code license GNU GPL v3

Download : http://wpscan.googlecode.com

VoIP Hopper 2.01 Released – IP Phone VLAN Hopping Tool

VoIP Hopper 2.01 Released – IP Phone VLAN Hopping Tool

VoIP Hopper is a GPLv3 licensed security tool, written in C, that rapidly runs a VLAN Hop into the Voice VLAN on specific ethernet switches. VoIP Hopper does this by mimicking the behavior of an IP Phone, in Cisco, Avaya, and Nortel environments.

This requires two important steps in order for the tool to traverse VLANs for unauthorized access. First, discovery of the correct 12 bit Voice VLAN ID (VVID) used by the IP Phones is required. VoIP Hopper supports multiple protocol discovery methods (CDP, DHCP, LLDP-MED, 802.1q ARP) for this important first step. Second, the tool creates a virtual VoIP ethernet interface on the OS. It then inserts a spoofed 4-byte 802.1q vlan header containing the 12 bit VVID into a spoofed DHCP request.

Once it receives an IP address in the VoIP VLAN subnet, all subsequent ethernet frames are “tagged” with the spoofed 802.1q header.

VoIP Hopper is a VLAN Hop test tool but also a tool to test VoIP infrastructure security.

New Features

  • New “Assessment” mode: Interactive, menu driven command interface, improves ability to VLAN Hop in Pentesting when the security tester is working against an unknown network infrastructure
  • New VLAN Discovery methods (802.1q ARP, LLDP-MED)
  • LLDP-MED spoofing and sniffing support
  • Can bypass VoIP VLAN subnets that have DHCP disabled, and spoof the IP address and MAC address of a phone by setting a static IP

Read More in here.
Download VoIP Hopper 2.01 : voiphopper-2.01.tar.gz

Joomscan Security Scanner – Detect more than 550 Joomla vulnerabilities

Joomscan Security Scanner – Detect more than 550 Joomla vulnerabilities

Joomscan Security Scanner updated recently with new database have 550 vulnerabilities. Detects file inclusion, sql injection, command execution vulnerabilities of a target Joomla web site. Last update for this tool was in August, 2009 with 466 vulnerabilities.

HOW TO USE :

In joomscan you can check for new updates with command: ./joomscan.pl check or ./joomscan.pl update.

Download For Windows : http://web-center.si size (141 kb)

Download For Linux : http://web-center.si size (150 kb)

Resources : http://security.web-center.si/

hwk Beta – hwk is a tool used for wireless lan pentests

hwk is an easy-to-use application used to attack and discover wireless networks. It’s providing various modes such as authentication/deauthentication flood, beacon and probe response fuzzing.

Platform : Unix/linux
Features

  • probe resonse fuzzing
  • authentication flood
  • deauthentication flood
  • antenna alignment
  • deauthentication flood agains all data connections
  • stress testing
  • beacon injection
  • injection testing
  • wlan
  • wireless hacking

Downloadhwk_0.3.2.tar.gz (257.5 kB)

Find Other version | Read more in here