Essential Information Security Tools

November 25, 2019 by anis

Software companies reap the most benefits from the rise of automated ethical hacking tools and penetration testing utilities, giving them more ways to increase system security every day.

Automated tools are changing the way hacking is evolving, making ethical penetration testing easier, faster and more reliable than ever. Penetration testing and reporting activities now play a crucial role in the process of identifying security flaws in remote or local software enabling company owners to quickly prevent vulnerabilities from running wild all over the Internet.

Most infosec forensics investigators walk a fine line. They must adhere to specific institutional processes, which, in many cases, are state and federal requirements. But they must also use a certain amount of pragmatism since no two investigations are exactly alike.

What is InfoSec?!

Information Security, or InfoSec, can be traced back to at least the 1970s when you look at the basis for many of the different security methods used today. Just like its rich history, the current state of INFOSEC is constantly evolving. Specific technologies and practices used in days past do not provide much traction against modern issues, such as injection techniques, man-in-the-middle threats, or wireless network security and go on. However, the basic principles have evolved and become stronger in the latest iteration. These principles are probably already ingrained in your mind, defense in depth, multi-factor authentication, and complete (as well as useful) audit trails. People who work in InfoSec all start off with these same principles, but usually diverge into a specific path as a career.

Information Security Attributes: or qualities, i.e., Confidentiality, Integrity and Availability (CIA).

So what is InfoSec anyway? Lots of different aspects of overall Information Technology come together along with business strategies to form InfoSec. I’ll put forward one definition of it, and everyone is welcome to disagree. InfoSec is the process that you follow to ensure the Confidentiality, Integrity and Availability (CIA) of information. Confidentiality is basically making sure that only the approved person or people have access to the data. Integrity is the assurance that the data stored and retrieved can be verified to be true, that no corruption or unauthorized change has taken place. Availability is defined as the state of the data being accessible when needed. Taken at that level, InfoSec covers a tremendous space. This involves the desktop support technician that makes sure that a new workstation is current on patch levels, the network engineer that keeps exterior network traffic from affecting operations, the systems administrator locking down any and all network resources, the engineers and testers that verify and validate existing technical security controls, as well as the analyst that works to create policies and procedures so that repeatable processes are followed.

No one person is more important than the other, and without a of the parts working together, there is no complete program. Without InfoSec, data is simply not safe. There are many sources, both internal and external, that threaten the CIA of data. Many people go into InfoSec without understanding the organic nature of how it should work. It does not stop at the door to the data center or the telephone at the Help Desk. InfoSec can be broken down into three sets of controls: managerial, operational, and technical. At the highest level, any security control implemented should fall into one of these three sets. Managerial controls focus on the management level and designate individuals who are capable of leading an organization as well as how.

In short. Information security or InfoSec means protecting information (data) and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

In past decades, ethical hacking and penetration testing were performed by only a few security experts. Now almost anyone can report security incidents. Ethical hacking tools allow you to scan, search and find the flaws and vulnerabilities within any company to help make their systems and applications more secure.

Here is a compilation of a few tools that we need to be aware of. The power, the performance and the capabilities of these tools are limited only to the creativity of the attacker. Let’s dig in to the list.

Metasploit

Metasploit is extremely powerful and versatile, from scanning to exploiting, to creating your own payloads it has everything you could possible need for a penetration test or vulnerability analysis of an environment. The pro version of metasploit is more user-friendly to people who do not prefer to use the command-line, which has everything in an easy to find area to execute. The command-line version is just as powerful, it just requires that you are familiar with the various switches and options with metasploit.

• Penetration Testing
• Ethical Hacking
• Security Auditing
• Pre-installed on Kali Linux
• Find, Exploit, and Validate vulnerabilities
• Open source Metasploit Framework
• Commercial support available via Metasploit Pro

Wapiti

Wapiti has the capacity to perform black box scans without studying the source code,it crawls the pages of the deployed webapp and looks for vulnerabilities.This is a very interesting feature and i like this the best about wapiti.

While it’s not the most popular tool in this field, it does a good job of finding security flaws in many web applications.

Using Wapiti can help you to discover security holes including:

• XSS attacks
• SQL injections
• XPath injections
• XXE injections
• CRLF injections
• Server side request forgery

Other features include:

• Runs in verbose mode
• Ability to pause and resume scans.
• Highlights vulnerabilities found inside the terminal
• Generates reports and export into HTML, XML, JSON and TXT
• Activates and deactivates multiple attack modules
• Removes parameters from certain URLs
• Excludes URLs during an attack
• Bypasses SSL certificate verification
• URL extractor from javascript
• Timeout configuration for large scans
• Sets custom user-agent and HTTP headers

Wireshark

Wireshark is straightforward to use and to capture network traffic. The tool has several characteristics that make the research much faster. Protocol filters can divide the data and cover up the data that is not actually required in a specific moment to assure a straightforward user experience. Moreover, the instrument colours web packets that were captured based on the packet category. All equipment allow you to filter out an uninteresting channel and streamline the process of evaluating traffic and watching possible interference (by following the TCP flow), but it’s not the finest IDS. The excellent technology also incorporates with the virtual machines.

• Protocol Inspection|
• Packets Analyzer
• Live Capture & Offline Analysis
• GUI & Command Line (TShark)
• Rich VolP Analysis
• Coloring rules for packets
• Multi-platform (Windows, Linux, Mac, FreeBSD, NetBSD, etc).
• Multiple capture file formats (tcpdump, Pcap NG, Sniffer® Pro, etc)
• Data source – Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, etc.
• Decryption support for protocols – IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2\

OpenVAS – Open Vulnerability Assessment System Open

OpenVAS is a framework that supports the reporting and scanning of your system vulnerabilities. One can scan his/her system, and OpenVAS gives a varity list of security issues in detail. It organizes the information efficiently and also offer important details on the problems and what to do about it.

• Vulnerability Scanner
• Unauthenticated Testing
• Authenticated Testing
• Detects security issues
• Generates detailed report having possible discovered security vulnerabilities
• Free software, licensed under the GNU General Public License
• Supports plugins written in the Nessus Attack Scripting Language, NAS

OpenSSH

OpenSSH it’s a tool integrated in all Linux operative systems that allows to connect between different Linux computers. With OpenSSH and a terminal you can open ssh tunnel, secure and safe. Throw this tunnel you can copy files and run commands.

One of the best things that you can do with OpenSSH it’s transmit a port of remote computer to your computer.

• Remote Login * File Transfer
• SSH Tunneling
• Developed by developers of the OpenBSD Project using BSD-style license.

OpenSSH is not a single program and it’s a suite of tools. The tools available within the

OpenSSH suite are as listed below.

1. Remote operations using SSH, SCP, and SFTP
2. Key management with ssh-add, ssh-keysign, ssh-keyscan, and ssh-keygen.
3. Service side consists of sshd, sftp-server, and ssh-agent.

SQLmap

SQLmap support for different kind of sql injections such as os injections, command injections and many more. SQLMap is based on the python and it comes free with the Kali or you can download the repository from the internet and able to use in a Linux based environment. most of the vulnerable sql injection vulnerabilities can able to exploit using this tool and this is an essential tool for penetration testing.

• Powerful detection engine
• Penetration Testing
• Database fingerprinting
• Flexible Scan Policy
• Inject malicious code
• Detect and exploit SQL injection flaws
• Access database
• Edit or delete data
• Supported database systems – MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft
• Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, Informix, HSQLDB and H2
• Fully supports all the SQL injection techniques – boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band
• Support to enumerate – users, password hashes, privileges, roles, databases, tables, and columns
• Automatic recognition of password hash formats and support for cracking them using a
• dictionary-based attack.
• Dump entire database or selected tables or selected columns.

Maltego

Maltego is a visual link analysis tool that, out the box, comes with open source intelligence (OSINT) plugins, called transforms. The tool offers real-time data mining and information gathering as well as the representation of this information on a node based graph making patterns and multiple order connections between said information easily identifiable.

• Real-Time Data Mining
• Information Gathering
• Used by security professionals
• Ships with Kali Linux
• Represents information on node based graph making patterns
• Identify multiple order connections between gathered information
• Community and Commercial editions available

Hashcat

Hashcat is world’s fastest password recovery tool. It’s an advanced password recovery utility, supporting five unique modes of attack for over 200 highly-optimized hashing algorithms. It’s licensed under the MIT license and freely available.

• Password Recovery
• Password Cracking
• Distributed password cracking
• Code adheres to gnu99 standards
• Supports hardware accelerators including CPU, GPU, etc.
• Available on Linux, Windows, and macOS.

NMAP – Network Mapper

Nmap is the best command line network scanner, I like that there is lots of types of scans available that we can do on our network or on a specific computer. Nmap can find the open ports in a network and also find the operating system of that Computer. We can set range limit for the scan so it will only scan systems in that range. Nmap can be used to find some vulnerabilities in the network.

• Device Identification
• Security Scanning
• OS and open ports detection
• Free & Open Source
• Rapidly scan large networks
• Available on Linux, Windows, and macOS.

The Nmap suite includes

1. Zenmap – An advanced GUI and result viewer
2. Ncat – Flexible data transfer, redirection, and debugging tool
3. Ndiff – Utility to compare scan results
4. Nping – Packet generation and response analysis tool

John the Ripper

One of the best security tools which can be used to crack passwords is John the Ripper. It has a high rank among all of its other counterparts in the market, supported by sectools.org which assures such information implying a sort of reliability. In addition, it is a free software which is considered a great characteristic of such program. The same as Metasploit, John the Ripper is a part of the Rapid7 family of penetration testing/ hacking tools. It is a fast password cracker, currently available for many flavors of Unix, macOS, Windows, DOS, BeOS, and OpenVMS.

• Brute Force Attack
• Dictionary Attack
• Common passwords list
• Word lists for 20+ human languages
• Supports password hashes including yescrypt, crypt_blowfish
• Proactive password strength checking with passwdqc
• Free & Open Source * Commercial Pro version
• Available on Linux, Windows, and macOS.

OWASP ZAP – OWASP Zed Attack Proxy

OWASP ZAP (Zed Attack Proxy) is one of the world’s most popular security tool. It’s a part of OWASP community, that means it’s totally free. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.

• AJAX Spidering
• WebSocket Testing
• Fuzzing
• Flexible Scan Policy
• REST APIs Testing
• Official Jenkins Plugin for CI
• Active Scan
• Passive Scan
• Filters
• HTTP Sessions
• Anti CSRF Tokens
• Spider

Nessus – Vulnerability Scanner

Nessus is a one of the best Vulnerability scanner for the External Vulnerability Assessment, Internal Vulnerability assessments and the compliance scanning most of the time internal Vulnerability assessments findings are 100% correct when we verify them manually. Compliance scans also so easy with this we can run scans so easily when we enter the admin credentials of the servers or databases and it perform scan according to CIS benchmark or any other standards available on the nessus.

• Vulnerability Scanning
• Updated database on a daily basis
• Free & Commercial versions
• It can scan operating systems, network devices, hypervisors, databases, and web servers.
• Plugins are written in the Nessus Attack Scripting Language (NASL)
• It can also support configuration and compliance audits, SCADA audits, and PCI compliance

Nikto

The Nikto web server scanner is a security tool that will test a web site for thousands of possible security issues. Including dangerous files, mis-configured services, vulnerable scripts and other issues. It is open source and structured with plugins that extend the capabilities. These plugins are frequently updated with new security checks.

Nikto is by no means a stealthy tool. It will make over 2000 HTTP GET requests to the web server, creating a large number of entries in the web servers log files. This noise is actually an excellent way to test an in place Intrusion Detection System (IDS) that is in place. Any web server log monitoring, host based intrusion detection (HIDS) or network based intrusion detection (NIDS) should detect a Nikto scan.

• Detects default installation files on any OS
• Detects outdated software applications.
• Runs XSS vulnerability tests
• Launches dictionary-based brute force attacks
• Exports results into plain text, CSV or HTML files
• Intrusion detection system evasion with LibWhisker
• Integration with Metasploit Framework

SQLNinja

SQLNinja is another SQL vulnerability scanner bundled with Kali Linux distribution. This tool is dedicated to target and exploit web apps that use MS SQL Server as the backend database server. Written in Perl, SQLNinja is available in multiple Nix* distros where the Perl interpreter is installed.

• Test mode
• Verbose mode
• Fingerprint remote database mode
• Brute force attack with a word list
• Direct shell & reverse shell
• Scanner for outbound ports
• Reverse ICMP Shell
• DNS tunnelled shell

Aircrack-ng

Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the attack much faster compared to other WEP cracking tools.

• WIFI Network Security * WEP/WPA Key Recovery
• Monitors and capture packets for further analysis
• Replay attacks, deauthentication, fake access points via packet injection
• Command line tools
• Works on Linux, Windows, OS X, FreeBSD, OpenBSD, NetBSD

The Aircrack-ng suite includes:

1. aircrack-ng – Cracks WEP keys
2. airdecap-ng – Decrypts WEP or WPA encrypted capture files
3. airodump-ng – Packet sniffer
4. airserv-ng – Access the wireless card from other computers
5. easside-ng – Communicates to an access point, without the WEP key

Ettercap

Ettercap is a network interceptor and packet sniffer for LAN networks. It supports active and passive scans as well as various protocols, including encrypted ones such as SSH and HTTPS.
Other capabilities include network and host analysis (like OS fingerprint), as well as network manipulation over established connections, which makes this tool great for testing man-in-the-middle attacks.

• Active and passive protocol analysis
• Filters based on IP source and destination, Mac and ARP addresses
• Data injection into established connections
• SSH and HTTPS encryption-based protocols
• Sniffs remote traffic over GRE tunnel
• Extensible with plugins
• Protocol supports include Telnet, FTP, Imap, Smb, MySQL, LDAP, NFS, SNMP, HTTP, etc.
• Determines OS name and version
• Able to kill established LAN connections
• DNS Hijacking

Burp Suite Scanner

BurpSuite is Powerful Web Application and mobile application Penetration software, which is very powerful, Burpsuite having powerful scanning ability, also provides very detailed report. perfect software for pen-testers. easily we can identify the web, mobile application vulnerabilities. very light software. installation wont take much time, very user friendly tool,Work with Windows and Linux OS. Very essential tool for security auditing.

• Web Vulnerability Scanner
• Web Proxy
• Detects server-side vulnerabilities
• Web application crawler
• Interactive Application Security Testing (IAST)
• Freely available as Community edition
• Commercially available as Professional and Enterprise editions

Those tools are also constantly evolving. Even though the names remain the same, the ways they operate often change radically as new defences or mechanisms for attacking those defences come into play. So staying current on the top tools in the cyber-security industry is a never-ending challenge.

Some tools are highly specialized, or even custom-made, and you might find yourself working primarily with a single software package that is optimized for your role. But rolling your own is a laborious process and there are plenty of off-the-shelf products that can be extremely effective… if you know how to use them.

The good news is that many of the best tools are free, both as in speech and as in beer. Open source, freely-distributed security tools have always been among the most important in the industry because their collaborative development both outpaces private sector efforts and because the ability to view and understand how the code operates prevents any nefarious purposes from being baked in.