Is it metasploitable?

Good news to those of you who were looking for a "punching-bag" without the labors of building your own, the Metasploit crew has released Metasploitable which is a purpose-built virtual machine chock-full of vulnerabilities that can be exploited by MSF. It's built on Ubuntu 8.04 which is good news for those of you that have only been working against Windows servers this whole time, you can try out some different payloads.

Grab the torrent!

Web-app punching bag

Chuck Willis over at Mandiant released a web application penetration testing Virtual Machine. This can be handy for learning the ropes, also an alternative to WebGoat (WebApp testing suite).

VIPER VAST

There is another linux STD (Security Tools Distro) that targets VoIP, which is interesting because recently I've emerged myself in voice technologies so for me this is the perfect mix. It has some of the most common tools from backtrack, such as nmap, metasploit, hping, hydra but also UCsniff, video snarf, SIPvicious and more!

http://vipervast.sourceforge.net/

Google for the soul..

Kind-of-sort-of, there is a new search engine that was developed for searching people specifically. Interesting things it finds includes past addresses, social networking sites, traffic citations, arrest records, business records, date of birth,etc. It found a ton of things that google couldn't. Give www.pipl.com a try!

Quick and dirty network sweeps.. Angry IP Now for MAC / Linux

As everyone already knows nmap is the scanner of choice, unless perhaps you are performing simple scans from a Windows environment. In my experience running nmap from Windows is painful if you are used the speed you get while running it from unix. I would often suggest that Windows users move to a real OS (*nix based) or switch to a different scanner. The scanner I enthusiastically recommend is Angry IP, it's lightweight, free, and quick. While discuss scanners with a peer today I became aware that Angry IP has been ported to OS X and Linux. While this will have a smaller audience (due to the fact that nmap does such a great job here) it's still nice to have. My wife is an entry-leven network tech and she's mac based, so while she can use nmap, she does not share my passion for the CLI (understandibly) and while the nmap GUI is really nice, it's more function than she needs. So for a slick easy scanner I can recommend Angry IP for all platforms now.

IKE Scan

When performing audits you can simply sweep for UDP 500, which may indicate that a remote device is listening for IPSec connections, but that's about it. If you were looking for a bit more information you could use ike-scan which will interrogate the remote device and disclose the policy set (aka security parameters). Like most tools I blog about it's free and compact :)

IKE scan can be found:
http://www.nta-monitor.com/tools/ike-scan/

Sample output:
67.78.31.242 Main Mode Handshake returned HDR=(CKY-R=6e69a811525dc72e) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)