Shodan search engine

This is an absolutely phenominal search engine, where you can query for banners of various types of devices. For instance, say you wanted to know which routers on the internet had the HTTP service enabled, one quick query will tell you. A new vulnerability for your favorite mail platform? Again, its' all archived. Check out shodan today!

Here is an example query

144,000+ IOS routers with the web server enabled!

http://shodan.surtri.com/?q=%22cisco-ios%22+port%3A80

How about IIS 4.0 that we use in reference attacks?

7500 and counting!
http://shodan.surtri.com/?q=%22iis+4.0%22

Google for the soul..

Kind-of-sort-of, there is a new search engine that was developed for searching people specifically. Interesting things it finds includes past addresses, social networking sites, traffic citations, arrest records, business records, date of birth,etc. It found a ton of things that google couldn't. Give www.pipl.com a try!

Quick and dirty network sweeps.. Angry IP Now for MAC / Linux

As everyone already knows nmap is the scanner of choice, unless perhaps you are performing simple scans from a Windows environment. In my experience running nmap from Windows is painful if you are used the speed you get while running it from unix. I would often suggest that Windows users move to a real OS (*nix based) or switch to a different scanner. The scanner I enthusiastically recommend is Angry IP, it's lightweight, free, and quick. While discuss scanners with a peer today I became aware that Angry IP has been ported to OS X and Linux. While this will have a smaller audience (due to the fact that nmap does such a great job here) it's still nice to have. My wife is an entry-leven network tech and she's mac based, so while she can use nmap, she does not share my passion for the CLI (understandibly) and while the nmap GUI is really nice, it's more function than she needs. So for a slick easy scanner I can recommend Angry IP for all platforms now.

IKE Scan

When performing audits you can simply sweep for UDP 500, which may indicate that a remote device is listening for IPSec connections, but that's about it. If you were looking for a bit more information you could use ike-scan which will interrogate the remote device and disclose the policy set (aka security parameters). Like most tools I blog about it's free and compact :)

IKE scan can be found:
http://www.nta-monitor.com/tools/ike-scan/

Sample output:
67.78.31.242 Main Mode Handshake returned HDR=(CKY-R=6e69a811525dc72e) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=4048b7d56ebce88525e7de7f00d6c2d3c0000000 (IKE Fragmentation)

DNS mining.. Fierce.pl

Ok, so you know those times when you discover that diamond in the rough, the extremely useful yet previously unheard of tool that makes you want to shout to tell the world about it, only to find out that your friends already know... you wonder to yourself, well why the heck didnt' they tell me?
This post is to save the people I know from the aforementioned scneario. Fierce.pl is a perl script (O rly?) that can be used to discover hosts of a target organization simply by performing DNS resolution against a dictionary file. The dictionary file included isn't bad, however I've extended mine by merging with other world lists and gotten better results.

Long story short, fierce is a super handy tool for discovery resources that is lightweight and easy to use. It's been around for a bit, I'm just making sure that you know about it :)

Fierce can be found here
http://ha.ckers.org/fierce/