10 Network Security Assessment Tools You Can’t Live Without

In addition to using Netcat as a back-door tool, you can use it for grabbing banners (such as Telnet, SMTP, and FTP banners), "piping" files and data, port scanning, remote service and port enumeration, and many other creative functions. Every time I turn around, someone is showing me new ways that I hadn't thought of to use Netcat. I use it most frequently for port fuzzing (connecting to a TCP port and poking around to see what I can learn) and shell-shoveling (piping a command prompt from a target host back to me—a poor man's reverse shell).

Download the Windows version of Netcat at http://www.vulnwatch.org/netcat, and read http://www.vulnwatch.org/netcat/ readme.html to learn more than you ever wanted to know about the tool. Learn still more at "Netcat," Security Administrator, September 2003, InstantDoc ID 39680.

9. John the Ripper
Most people have heard of the L0phtCrack password-cracking and -audit tool originally developed by The Cult of the Dead Cow (don't ask) and now owned and maintained by @stake (recently acquired by Symantec). I prefer John the Ripper, a simple, high-performance password cracker available for many platforms (including Windows) that grew out of the well-known UNIX Crack tool. John can detect system characteristics and capabilities that allow it to optimize performance. In my experience, John runs circles around other crackers such as L0phtCrack in terms of tries per second (LC5—the current version of L0phtCrack—is supposedly greatly improved over previous versions, but you have to pay for it).

Also, John doesn't crack just Windows (LAN Manager and NT LAN Manager—NTLM) password hashes but out of the box cracks any password hashes that use DES (standard, single, extended), MD5, Blowfish, or Andrew File System (AFS) ciphertext or hash formats. John used in conjunction with a dictionary file (numerous such files are available containing most any language known in the galaxy—even Wookie and Klingon) is a can't-live-without-it tool for password cracking and audit (which every company should be doing regardless of how strong its password policy is). You can get John the Ripper at http://www.openwall.com/john or http://www.securiteam.com/tools/3X5QLPPNFE.html.

10. The Metasploit Framework
Wouldn't it be nice to have an easy-to-use exploit platform that contained the most recent exploits, featured an auto-update capability, and was extensible via a well-known language such as Perl? Yes, but ... . It's scary (and somewhat irresponsible) that someone would provide such a capability to the masses for free—it just calls out to script kiddies everywhere (roughly similar to offering a nuclear suitcase on eBay). However, I'll concede that having a tool such as the Metasploit Framework is beneficial for network security assessors emulating threats (if Pandora's box has been opened, the good guys should have the same tools as the bad guys).

The Metasploit Framework was introduced about 2 years ago as a research project by the well-known security researchers H.D. Moore and spoonm. The project's goals were half noble: to further security research and provide a resource for exploit developers. I use the Metasploit Framework (with care and with prior testing in a lab environment) as an exploitation tool for security assessments.

Metasploit is a Perl script–based engine that allows you to select from a myriad of exploits for a variety of platforms and applications (more than 75 exploits and 75 payloads and growing at the time of this writing). In addition to giving you a selection of exploits for known vulnerabilities, Metasploit lets you select the specific payloads that you'd like to send with the exploits. For example, if you want to exploit a system that has the SQL Slammer vulnerability, as mentioned in the SQLRECON section above, you can choose how you want to manipulate the vulnerable system: by creating a Win32 Bind shell connection, by sending back a Win32 Reverse shell, by simply running a remote command, by injecting a rogue Virtual Network Computing (VNC) server DLL into an exploited running process, or by some other means. Since the Metasploit Framework is also extensible via Perl modules, you can write your own exploits, plug them into the framework and use an existing applicable payload. Figure 2 shows the easy-to-use Metasploit Web interface listing the available exploits.

I recommend that you approach the Metasploit Framework with caution and use it only to demonstrate specific vulnerabilities during your network security assessment. You can download the Metasploit Framework at http://www.metasploit.com. Nessus (http://www.nessus.org) is another popular vulnerability scanner and exploit platform that has been around for years and is worth a look.

I've attempted to do the somewhat impossible—provide a list of the most popular free tools available to aid in network security assessment. It's difficult at best to choose just 10 tools—there are many tools for the job. If what I've recommended doesn't work for you, there are bound to be other, comparable free tools you can try. Or you can look into commercial tools, which are often more fully developed or have better support models than free tools do. I hope you've come away with some new knowledge about tools that you can leverage. Even if you learned about only one new great tool, this article was probably worth the read!

End of Article

   Previous  1  [2]  Next