Release Notes v-1.3.5: This release fixes a major flow engine memory leak, a case in which unified2 could overwrite its own alert files, and the Windows build.

Suricata is an Intrusion Detection and Prevention (IDS/IPS) engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support, file extraction capabilities, and many more features. It’s capable of loading existing Snort rules and signatures, and supports many frontends through Barnyard2.

Download version |
Linux/Mac/FreeBSD/UNIX/Windows : suricata-1.3.5.tar.gz (2.24 MB)
Windows (win32) installer: Suricata1.3.3-2-32bit.msi (10.05 MB)
Resources : http://suricata-ids.org/
Our post before : http://seclist.us/2012/11/update-suricata-v1-4-rc1.html

Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It’s based on Ubuntu and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico, and many other security tools.

Security Onion

RAM Minimum Requirements

• 512MB – 1GB RAM for the core OS (512MB for Ubuntu Server with no GUI)
• +512MB RAM for the server components (apache, sguild, Snorby, ELSA web, etc.)
• +1GB RAM for EACH network interface that you choose to monitor
• + >=512MB RAM if you choose to enable ELSA

Hardware Recommendations

• 64-bit
• Intel NICs
• as much RAM as your server holds!
• as much Disk as your server holds!

For Installation Procedures :  http://code.google.com/p/security-onion/wiki/Installation

Download version :
securityonion-12.04-20121224.iso (1.3 GB)
MD5 : securityonion-12.04-20121218.iso.md5 (64 Bytes) 
Find Other Version |
Resources : http://securityonion.blogspot.com/ | http://code.google.com/p/security-onion/

Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It’s based on Ubuntu and contains Snort, Suricata, Sguil, Squert, Snorby, Bro, NetworkMiner, Xplico, and many other security tools.

RAM Minimum Requirements

• 512MB – 1GB RAM for the core OS (512MB for Ubuntu Server with no GUI)
• +512MB RAM for the server components (apache, sguild, Snorby, ELSA web, etc.)
• +1GB RAM for EACH network interface that you choose to monitor
• + >=512MB RAM if you choose to enable ELSA

Hardware Recommendations

• 64-bit
• Intel NICs
• as much RAM as your server holds!
• as much Disk as your server holds!

For Installation Procedures : http://code.google.com/p/security-onion/wiki/Installation

Download version :
securityonion-12.04-20121224.iso (1.3 GB)
MD5 : securityonion-12.04-20121218.iso.md5 (64 Bytes) 
Find Other Version |
Resources : http://securityonion.blogspot.com/ | http://code.google.com/p/security-onion/

Our Post Before :  http://seclist.us/2012/12/security-union-v-12-04-rc1-released.html

HoneyDrive is a virtual appliance (OVA) with Xubuntu Desktop 12.04 32-bit edition installed. It contains various honeypot software packages such as Kippo SSH honeypot, Dionaea malware honeypot, Honeyd low-interaction honeypot and more. Additionally it includes useful pre-configured scripts and utilities to analyze, visualize and process the data it can capture, such as Kippo-Graph, Honeyd-Viz, and much more. Lastly, many other helpful security, forensics and malware related tools are also present in the distribution.

Features

• Virtual appliance based on Xubuntu 12.04 Desktop.
• Distributed as a single OVA file, ready to be imported.
• Full LAMP stack installed (Apache 2, MySQL 5), plus tools such as phpMyAdmin.
• Kippo SSH Honeypot, plus Kippo-Graph, Kippo2MySQL and other helpful scripts.
• Dionaea malware honeypot, plus phpLiteAdmin and other helpful scripts.
• Honeyd low-interaction honeypot, plus Honeyd2MySQL, Honeyd-Viz and other helpful scripts.
• LaBrea sticky honeypot, Tiny Honeypot, IIS Emulator, INetSim and SimH.
• A full suite of security, forensics and anti-malware tools for network monitoring, malicious shellcode and PDF analysis, such as ntop, p0f, EtherApe, nmap, DFF, Wireshark, ClamAV, ettercap, Automater, UPX, pdftk, Flasm, pdf-parser, Pyew, dex2jar and more.
• Firefox plugins pre-installed, plus extra helpful software such as GParted, Terminator, VYM, Xpdf and more.

Download : HoneyDrive_0.1_Santa_edition.ova (2.9 GB)
Find Other Version |
Resources : http://bruteforce.gr/honeydrive

change v-0.9.2 : several bug fixes

SSL Diagnos is used to get information about SSL protocols (pct, ssl2, ssl3, tls, dtls) and cipher suites. It can also be used for testing and rating ciphers on SSL clients. It has also specific support for pop3s, sip, smtp and explicit ftps.

Features

• SSL scanner including rating of SSL cipher suite strength for server and clients
• Tests for example https, smtp, sip, pop3s, ftps
• Can be used for OWASP-CM-001
• Uses OpenSSL 1.0 to test ssl2, ssl3, tls, dtls, explicit ftps
• Tests renegotiation and availability of tls renegotiation extension.

———————————————————
Definition: Weak, intermediate, strong
———————————————————
* SSLv2.0 = Weak
* Anonymous, null or export grade ciphers = Weak
* < 56 bits for encryption = Weak
* < 112 bits for encryption = Intermediate
* < 128 bits for encryption with AES = Intermediate
* >= 128 bits for encryption = Strong

Note 1:
Even though some security issues are noted about
RC4 and MD5. Because of SSL design the usage of RC4
encryption and MD5 hash is not regarded critical in
this context. For instance: RC4/128 bit/SSL3 is regarded
as “Strong” even though RC4 is only graded as “MEDIUM”
cipher strength by OpenSSL.

———————————————————
USAGE SSLDiagnos
———————————————————
Example 0 – Get parameter-meaning
ssldiagnos.exe –help
Example 1 – Start a server using all ciphers but only SSL3 protocol. Port 888 and the server certificates must also be specified
ssldiagnos.exe –servercipher ALL –serverprotocol SSL3 –servercert C:\src\ssldiagnos\Debug\cacert.pem -p 888 –servermode –servercertkey cakey.pem

Example 2 – Test the host www.hostname.org using port 443 (which is the default). Also test send/receive.
ssldiagnos.exe -t www.hostname.org –testsend -p 443

Example 3 – Test the host www.hostname.org using port 443 (which is the default). Connect-test only.
ssldiagnos.exe www.hostname.org

———————————————————
USAGE SSLPressure
———————————————————

Example 1 – Test all handshakes of SSL2 and SSL3-ciphers on 192.168.1.1
sslpressure.exe -t 192.168.1.1

Example 2 – Add a 500ms delay between tests.
sslpressure.exe -t 192.168.1.1 –delay 500

Download :  ssldiagnos_0.9.2.a_20121202.zip (1.2 MB)
Find Other Version |
Read more in here : http://ssldiagnos.sourceforge.net/

our post before : http://seclist.us/2012/12/ssldiagnos-v-0-9-1-a-released.html

SNĒZ is free software: you can redistribute it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. SNĒZ is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/. Do not allow SNEZ to be accessed from the Internet or an untrusted or insecure network. The catch-phrase, ‘you’ll hack me… when pigs fly’, is just that, a catch-phrase and not a guarantee.

FEATURES : 

• Filter alerts on combination of signature, date, ip addresses, and sensor
• Filters can be used to classify alerts; filters are sortable and comments can be edited
• Can set up alerts on various combinations of alerts, addresses, etc. as ‘warnings’
• Analyis view of source addresses for most signatures, events, destination ports
• All code server side PHP, easy installation with one simple config file
• Uses snort db directly
• Monitor up/down status of snort and barnyard2 processes
• Packet display and the ability to do a short real-time packet dump
• All activity related to filtering and deleting alerts logged
• Dismissed alerts can be retrieived by overriding filters
• DNS lookup with cut/paste to your favorite DNS lookup site (configurable)
• Configurable page performance and security parameters

SECURITY
While SNEZ is tested with web vulnerability scanners, do not allow SNEZ to be accessed from the Internet
or an untrusted or insecure network.

REQUIREMENTS and PRE-REQS
Snort, Apache, MySQL, PHP.
When configuring Snort, output type must be MySQL or barnyard2 to MySQL.

NEW INSTALL (See below for upgrades)

Create SNEZ database and install package-
1. mkdir /opt/SNEZ
2. cd /opt/SNEZ
3. cp [download location]/SNEZ-[ver].[rel].tar.gz ./
4. tar -xzvf SNEZ-[ver].[rel].tar.gz
5. cd SNEZ-[ver].[rel]
6. ./SNEZcreate or bash SNEZcreate (This will create and populate your SNEZ db.
Supply password for root@localhost when prompted;
then supply a password for access to your SNEZ DB when prompted.
You will enter this password in the config file in the next step).
7. vi ./SNEZconfig.php. Add the SNEZ database password selected in the previous step to the line
SNEZ.password=
Modify other parameters as needed, especially your sniffer interface (See CONFIG FILE later in the README)
8. ./SNEZinstall or bash SNEZinstall

Create logins-
1. In a browser- http://[ip address of server]/SNEZ/SNEZlogin.php
2. Login as ‘admin’ using password of ‘admin’
3. Click on the Admin Functions link and add an administrator
that can add users (be sure to check the box)
4. From the browser, log off and log on with the new administrator id from step 3.
5. Go to Admin Functions and delete user admin.

UPGRADES
1. cd /opt/SNEZ
3. cp [download location]/SNEZ-[ver].[rel].tar.gz ./
4. tar -xzvf SNEZ-[ver].[rel].tar.gz
5. cd SNEZ-[ver].[rel]
6. ./SNEZinstall or bash SNEZinstall
If config file SNEZconfig.php exists, it will not be overwritten (ie. upgrade)
(steps 7 and 8 only if config file needs changed)
7. vi ./SNEZconfig.php and add and/or modify the following lines-
php.max.execution.time = 120  overrides php.ini max execution time
sniffer.interface = eth1   sniffer interface for optional use of tcpdump (*Note)
min.user.pwd.len = 8minimum password length for users
encrypt = none                  replace none with an existing, installed PHP hash function
whois = http://network-tools.com/   whois lookup, used for cut and paste; select your personal favorite
8.  ./SNEZconfiginstall

CONFIG FILE
Settings in the SNEZconfig.php file-
[settings]
encrypt = none        none or an existing, installed php hash function for password
NOTE: if you change this on a running system, login first,
run SNEZconfiginstall, and immediately add new users
inactive = 900        page timeout
SNEZ.password        password to the SNEZ database chosen at install time; must be set
gmt= -5            GMT offset; default to USA Eastern
max.rowlimit=10000default maximum db rows read before page displayed
dns.rowlimit=1000default max db rows read before page displayed when DNS resolution used;
(can be lowered for speed)
summary.rowlimit = 10000number of db rows to read before fully collapsed summary view page displayed
php.max.execution.time = 120  overrides php.ini max execution time
sniffer.interface = eth1   sniffer interface for optional use of tcpdump (*Note)
min.user.pwd.len = 8minimum password length for users
whois = http://network-tools.com/   whois lookup, used for cut and paste; select your personal favorite

*Note- Use visudo to make the additions and changes so certain root commands can be executed. (Caution!  Read the sudo and visudo documentation.
Mistakes here can render your system inoperable. Never edit the sudoers file with vi or another editor. You skip this if you don’t
want to use the tcpdump capabilities of SNEZ, or are uncomfortable making the changes, or concerned about security implications of allowing
a non-root user running tcpdump).

hostname (get hostname of your system)
visudo (add the following lines, adjusting for your system appropriately)
apache hostname=NOPASSWD:/usr/sbin/tcpdump  (substitue your host name for hostname)
apache hostname=NOPASSWD:/bin/ps
apache hostname=NOPASSWD:/bin/kill
(comment out the following line)
Defaults requiretty
!wq (or q! if you make mistakes and want to start over)

UNINSTALL
Can be used to uninstall product permanently or clean for fresh install
./opt/SNEZ/SNEZ-[ver].[rel]/SNEZuninstall

Download Latest Version :

SNEZ-1.7.0.1.tar.gz (11.2 MB) 

Find Other version |
Read more Righht Here : http://geneguinter.com/
Our Post Before :

• http://seclist.us/2012/10/update-snez-bleeding-edge-v-1-6-and-snez-v-1-5-3.html
• http://www.seclist.us/2012/07/update-snez-v-15.html
• http://www.seclist.us/2012/05/update-snez-v-141.html
• http://www.seclist.us/2012/04/update-snez-v-14.html
• http://www.seclist.us/2012/03/snez-v131-intrusion-detection-system.html

Nova is a software application for preventing and detecting hostile network reconnaissance (such as nmap scans). It does this by first creating the Haystack: a large collection of low interaction honeypots using an updated version of Honeyd. Finding real machines on the network becomes like finding a needle in a haystack of fake machines. Second, Nova uses machine learning algorithms to automatically detect and classify attempts at hostile reconnaissance, so there’s no need to go searching manually through your honeypot’s log files. It provides an easy to use Web-based interface powered by Node.js to configure itself and Honeyd instances.

Release Notes v-12.12 : A significantly streamlined and improved Quasar UI.

===============================
The Installation Guide
===============================

- The first thing to note is that Nova is currently only compatible with Linux.
All of our development is done on Ubuntu 12.04, so we suggest using that to
make installation easiest. We provide a helper script which should get all
dependencies and download, build, and install Nova and Honeyd.

wget https://raw.github.com/DataSoft/Nova/master/debian/novaInstallHelper.sh
sudo bash novaInstallHelper.sh

- This script has only been tested on the most recent stable version of Ubuntu.
Any other distributions or versions should manually compile using the
instructions below.

===============================
Getting the newest code
===============================

- Nova and Honeyd are stored as seperate Git repositories on github. Go to the
directory you wish to download the code to and run the following commands,

git clone git://github.com/DataSoft/Honeyd.git
git clone git://github.com/DataSoft/Nova.git Nova

# You also need to get the git submodules where training data is stored
# in it’s own repo

cd Nova
git submodule init
git submodule update

- This will create a “honeyd” and “Nova” folder with the source located inside.
From this point on they will be referred to as $HONEYD_SOURCE and
$NOVA_SOURCE.

- This will default to the “master” branch, which is the latest stable release.
If you want to use the latest unstable version, cd to the $NOVA_SOURCE and
$HONEYD_SOURCE and run the following,

git checkout integration

- Beware that the integration branch changes on a daily basis and may be
unstable.

===============================
Getting Dependencies on Ubuntu
===============================

- Install required dependencies with the following command:

sudo apt-get install git build-essential libcap2-bin libann-dev libpcap0.8-dev libboost-program-options-dev libboost-serialization-dev libnotify-dev sqlite3 libsqlite3-dev libcurl3 libcurl4-gnutls-dev iptables libxml2-dev libboost-system-dev libboost-filesystem-dev

- Now, we’ll have to take a quick detour to get another integral component of
Nova: Honeyd. We will have to download some extra libraries for Honeyd as
well; you can get them using this command:

sudo apt-get install libevent-dev libdumbnet-dev libpcap-dev libpcre3-dev libedit-dev bison flex libtool automake

- For the Honeyd Autoconfiguration tool, we require Nmap 6.00 or higher. The
current version in the apt repository is 5.21, so you’ll have to go to the
Nmap website and get 6.00. It can be found here:

http://nmap.org/download.html

OR

wget http://nmap.org/dist/nmap-6.01.tar.bz2

- To get the dependencies for the Quasar web UI (nodejs 0.8.5, npm’s forever,
and cvv8) you can either install them manually or get them by running the
following script,

sudo bash Quasar/getDependencies.sh

- There are instructions for manual install on the same page (but are just the
standard ./configure, make, and sudo make install commands).
- NOTE: Honeyd requires libevent version 2.x. If you are running Ubuntu 10.10 or
lower, the version of libevent available in the repos is only 1.x. So you will
need to either find a backport or build libevent 2.x from source.

- If you wish to optionally generate Debian packages for Nova, you will also
require dpkg-dev:

sudo apt-get install dpkg-dev
===============================
Building Honeyd
===============================

- Change directories to the $HONEYD_SOURCE folder where all of the Honeyd source
code should be on your machine. When inside the source directory, follow the
next steps to build and install.

Step 1: ./autogen.sh
Step 2: automake
Step 3: ./configure
Step 4: make
Step 5: sudo make install

===============================
Building Nova
===============================

- Change into the $NOVAD_SOURCE folder where the novad source code resides.

To build and install Nova run the commands,

Step 1: autoconf
Step 2: ./configure
Step 3: make
Step 4: sudo make install

- Note: If building fails for some reason, make sure you run ‘make clean’ before
trying again.

- Finally, while logged in as the user you plan to run Novad with, run the
following command to add your user to the ‘nova’ permission group and to set
up database tables for the web interface.

Step 5: sudo nova_init

- Your user will have to be in the “nova” group in order for nova and Honeyd to
run properly. The nova_init script will do this, but you must log in and back
out for the change to take effect.

Step 6: Log out and log back in

Refer to the Nova wiki on github for more information.

===============================
Daemonizing with Upstart
===============================

- If you want to start Quasar, novad, and the haystack when the machine boots
and have them restart if they crash, you can use the upstart service by copying
the files in $NOVAD_SOURCE/Installer/miscFiles/upstart/* to /etc/init. This is
assuming that upstart is already installed and configured on your system (it
comes by default on newer versions of Ubuntu).

===============================
High Level Nova Components
===============================

Haystack: Active honeypots
- The Haystack is the collection of honeypots which emulate machines on
the network. The haystack is created using the Honeyd daemon and runs
in it’s own executable. Configuration for Honeyd is auto generated at
~/.config/nova/Config/haystack_honeyd.config.

Novad: Classification tool
- The Novad executable is the daemon that monitors and classifies
network traffic to identify hostile looking traffic. Novad will listen
promiscuously on the configured network interfaces and keep track of
various statistics such as IPs contacted, ports contacted, honeypots
contacted, and other details. Novad is can be configured manually via
the configuration file ~/.config/nova/config/NOVAConfig.txt, but it is
recommended that you use the GUI (Quasar) unless you know what you’re
doing.

NovaCLI: Nova Command line Interface
- NovaCLI provides a simple interface for accessing some of the Novad
functionality. Usage for the tool can be gotten by running “novacli
–help”.

Quasar: Nova Web Interface
- Nova’s main GUI, Quasar, is a web interface run with a nodejs web
server.

- To start the web interface, run the command “quasar” and go to
https://localhost:8080 in a web browser.

Default username: nova
Default password: toor

- “quasar –debug” may provide more information if there are problems.
Quasar launches the nodejs server with the “forever” daemon so it will
be restarted if it crashes. The command “forever list” can be useful
for seeing the current status, and it can be stopped with “forever
stop index (usually 0)”. See the forever documentation for more
information.

Haystack Auto Configuration Tool: Generates honeyd configurations based off of
nmap scans

- This tool can scan your network with nmap and then generate honeypot
configurations that are based on the operating systems and ethernet
vendors that it finds.

NovaTest: Unit Tests

- If you’re a developer interested in using the unit tests in NovaTest, you can
find instructions at,

https://github.com/DataSoft/Nova/wiki/Unit-Testing

===============================
TLS Keys
===============================
A set of example TLS keys are provided, but because of their public nature
provide no real security. Paths to the TLS keys are in the Nova configuration
file at ~/.config/nova/config/NOVAConfig.txt

To generate a self signed certificate and key for the Quasar or Pulsar https
interfaces,

# Generate a private key
openssl genrsa -des3 -out ui.key 1024

# Create a request for a certificate
openssl req -new -key ui.key -out ui.csr

# Generate a self signed certificate
openssl x509 -req -days 365 -in ui.csr -signkey ui.key -out ui.crt

# Creating keys for the Pulsar/Quasar connection is a bit more complicated.
# Pulsar authenticates clients by using TLS client certificates signed by a
# certificate authority.

# Create a new certificate athority
openssl genrsa -des3 -out ca.key 1024
openssl req -new -key ca.key -out ca.csr
openssl x509 -req -days 365 -in ca.csr -out ca.crt -signkey ca.key

# Create and sign the Pulsar key
openssl genrsa -des3 -out pulsarTether.key 1024
openssl req -new -key server.key -out pulsarTether.csr
openssl x509 -req -in pulsarTether.csr -out pulsarTether.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 365

# Create and sign the Quasar keys. For each quasar instance,
openssl genrsa -des3 -out quasarTether.key 1024
openssl req -new -key server.key -out quasarTether.csr
openssl x509 -req -in quasarTether.csr -out quasarTether.crt -CA ca.crt -CAkey ca.key -CAcreateserial -days 365

# Transfer this key to the Quasar instance

Remember to make sure that all paths and passphrases are updated correctly in
~/.config/nova/config/NOVAConfig.txt to use the new keys you created.

===============================
Debian Packages
===============================

- To generate a Debian package, simply checkout what version of the software you
like (or make what changes to it that you want) and run the generateDebs
script (as a normal user).

./generateDebs <version number>

===============================
Common Problems and solutions
===============================

==================
Haystack Autoconfig nmap fails on large networks
==================

Nmap will often fail when scanning networks of size greater than 1024
IPs with the error “nexthost: failed to determine route” or “Strange
connect error(105): No buffer space available”. This is usually
caused by the kernel ARP table running out of space and not being
garbaged collected fast enough to handle all of the ARP requests nmap
is doing. The solution is to increase the size by adding the following
lines to /etc/sysctl.conf,

net.ipv4.neigh.default.gc_thresh1 = 1024
net.ipv4.neigh.default.gc_thresh2 = 4096
net.ipv4.neigh.default.gc_thresh3 = 65536

Then run the command,

sysctl -p

And try running the Haystack autoconfig tool again.
===============================
Tips for debugging problems
===============================

==================
General problems
==================

To enable verbose debug log messages, run the command,

novacli writesetting SERVICE_PREFERENCES 0:0+\;1:5+\;2:6+\;

If the above fails for some reason, you can also change the logging
settings manually in the ~/.config/nova/config/NOVAConfig.txt file
under the SERVICE_PREFERENCES setting.

===================
Permission Problems
===================

You should be able to run quasar/novad/honeyd without needing explicit
root permissions. One requirement for this is that the user you’re
running with is in the “nova” group and has run the nova_init script
located in Installer/. This script adds the user to the group and also
configures sudo (via adding a file to /etc/sudoers.d). Logging out and
back in is required for the group addition to work.

If you’re seeing permission related errors, you can try the following
commands,

sudo chmod -R g+rw /usr/share/nova
sudo chgrp -R nova /usr/share/nova

===================
Web interface problems
===================

If you can’t access the web interface, try stopping it if it’s running
in ‘forever’ and manually running it as a foreground process with the
commands,

forever stopall
quasar –debug

This should provide more verbose output and show if it is crashing
rather than running it as a background daemon process.
===================
Novad Problems
===================

If Novad appears to be having problems, try to start it manually
instead of as a background process with the command

novacli start nova debug
===================
Haystack Problems
===================

If the Haystack appears to be having problems, try to start it
manually instead of as a background process with the command,

novacli start haystack debug

===================
Reinstalling
===================

If something gets messed up to the point you want to start over, you
can do so with the commands,

cd $NOVA_SOURCE sudo make reinstall

Note that this will remove any configuration changes that you made.

===================
Building with debugging symbols
===================

If you’re seeing novad crash, it might be helpful to compile with
debugging symbols and get a stack trace.

cd $NOVA_SOURCE make clean make debug make reinstall

gdb novad run backtrace

===============================
RSyslog Support
===============================

There is an option for designating a target Rsyslog instance electing to receive
messages exposed within the Advanced Options page of the Quasar Web UI. Some
suggestions:

-Make sure that whatever IP is pointed is given in the format IP_ADDRESS:PORT.

-Make sure the designated port is both open and listening on the receiving
machine. The easiest way to do this is to uncomment the InputTCPServer lines in
/etc/rsyslog.conf and change the port number away from 514 (because rsyslog now
drops permissions, using port 514 is no longer an option, as it’s < 1024). To
test that rsyslog is listening, run

netstat -tlnup | grep PORT

as root and check that the PID/Name combination for rsyslogd is listed under
the results. The port may also need to be registered into the /etc/services
file, if changed from the normal port 514.

-Within /etc/rsyslog.d/ lie the configuration files; in one of these files, a
rule MUST be created similar to the following:

:programname,isequal,”Nova” YOUR_ACTION_CHOICE

where YOUR_ACTION_CHOICE represents the action (most likely a write to a
destination) to take upon receipt of messages from a client server that have
those program names. This is to help organize the logs, as Nova can
potentially send many log messages that would otherwise pollute the normal
syslog file. Note that there will be three rules like this total, one each
for the strings “Nova”, “novad” and “honeyd”

Testing that these changes worked is a good idea as well. Simply start and stop
novad on the client with the novacli command line interface and check that the
log messages sent at startup arrived at the right place

===============================
Pulsar
===============================

Pulsar does not install with the standard Nova ./configure, make, make
install process. Instead, the user must change directory into the Nova
directory (most commonly located in the /home/$USER/Code/ directory) and
run make install- pulsar with superuser permissions. This will place the
Pulsar files within the proper directories and allow for the user to
use the alias ‘pulsar’ on the command line to start the forever process
for Pulsar. To access the Pulsar interface, the user must first
have configured Nova such that it has the MASTER_UI_ENABLED
configuration variable set to 1, as well as properly configuring the
MASTER_UI_IP and MASTER_UI_CLIENT_ID variables to match the location and
naming requirements for the user’s network.

Download : nova-12.12.tar.gz.(7.5 MB) https://github.com/DataSoft/Nova/archive/nova-12.12.tar.gz
resources : https://github.com/DataSoft/Nova/

LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach linux,apache,php,mysql security.

Previous Features:

• Using ClamAV to Prevent Malware and Data Loss
• Secure Web Application Penetration Testing
• User Interface is Security
• APT is Real Enough
• SSHatter 1.0
• Drupal Core Color XSS Vulnerabilities
• Hookworm Stealth PHP Backdoor
• FEC Data Ripe for Mining
• When is LFI Really ACE?
• Combating XSS with HTMLPurifier

Purpose
This exercise is intended to be an educational experience. In particular it is designed to demonstrate how vulnerabilities can be “chained” together to lead to a complete compromise. There is no system on the target that is immediately exploitable to become root, but there are problems that can be exploited in tandem to compromise the root account. This exercise can also be used to benchmark automated testing tools. In particular this exercise seeks to expose participants to effective, free, open source security testing tools as well as to demonstrate many of the common weaknesses of such tools. Although the approach to this exercise is scripted, there are a number of unscripted vectors that can be used to exploit the target.

Download : CTF7plusDocs.zip (742.6 MB) 
Find Other version |
Resources : http://www.madirish.net/
Our post before :  http://seclist.us/2012/11/update-lampsecurity-training-ctf4-ctf5.html

– change v1.1.0 –

[*] better XSS detection (UTF-7 encoding, BBcode etc).
[*] improved processing speed.
[+] security ruleset update.
[!] fixed an issue where IP:port in Host header was not detected.
[!] stats page wasn’t showing the right number of banned IPs (Pro edn).
[!] fixed some tiny bugs and typo.

NinjaFirewall is a powerful firewall software designed to protect all PHP applications from custom scripts to shopping cart softwares (osCommerce, Magento, VirtueMart etc) and also CMS applications (Joomla, WordPress etc).

Some of its major features are :

• Specifically designed for shared hosting accounts.
• Easy to setup; your PHP scripts do not require modifications.
• Works with any PHP applications, even those encoded with ionCube or ZendGuard.
• Specific protection for the most popular PHP applications.
• Stand-alone firewall; will not stop working when you upgrade your shopping cart or CMS software.
• Hooks and sanitises all requests before they reach your scripts.
• Protects against remote & local file inclusions, code execution, uploads, MySQL injections, brute-force scanners, XSS and many other threats.
• Fully configurable with high security advanced options.
• Management administration console.
• One-click security rules updates.

Download : ninjafirewall-1.1.0.zip (110.6 kB) 
Find Other Version |
Resoources : http://ninjafirewall.com/
Our post Before : http://seclist.us/2012/06/ninjafirewall-v1-0-6-released.html

Change octopussy (1.0.7) stable
* 4 Services updated
* New Service ‘IBM_Cognos’ created
* Adding no_trans parameter to AAT:Label (1/2)
* Working on Testing Suite
* Now, you can set Contacts fields from LDAP Contacts fields
* Bugfix #3574577: 500 Internal server error because of unknown translation
* Bugfix #3574616: ’500 Internal server error’ because of invalid devicename
in Device::Parse_Status
* Bugfix #3580468: Alert edition broken
* Bugfix #3584230: Alerts are not sent by XMPP anymore
* Bugfix #328 Report can not be deleted
* Bugfix #179: types.xml updated
* Bugfix #267: Name ‘Win32::Locale::Lexicon’ used only once error messages
* Bugfix #332: Dispatcher stopped
* Bugfix #314: Fixing various LDAP problems
* Bugfix #275: Can’t Save Search Templates
* Bugfixing Servicegroup adding in device_services.asp page
* Fixing minor issues in octo_reporter & octo_scheduler
* Fixing ‘white column’ when there wasn’t Service in device_services.asp page
* Feature Request #1831840: Hide unused Services in Services selector
* Feature Request #3513127: Now you can specify timestamp to start from a
specific date in Logs Wizard and also add a new pattern to a service by
copy/pasting it
* Feature Request #3517497: Better NET_INTERFACE type

Octopussy : Open Source Log Management Solution

Features

• LDAP supported for Octopussy Users & Contacts
• Send Alerts by Email, IM(Jabber), NSCA(Nagios) & Zabbix_sender
• Export Reports by Email, FTP & SCP
• Create Map to show your architecture
• Input & Output Plugins for Reports
• Reports Scheduling
• ‘RRDTool’ to graph syslog activity
• Lot of Services already supported: Bind, Cisco Router, Cisco Switch, DenyAll Reverse Proxy, Drbd, F5 BigIP, Fortinet FW, Ironport MailServer, Linux Kernel/System, Linux IPTables, Monit, MySQL, Nagios, NetApp NetCache, Juniper Netscreen FW, Juniper Netscreen NSM, Postfix, PostgreSQL, Samhain, Snmpd, Squid, Sshd, Syslog-ng, Windows Snare Agent, Xen…
• Wizard to easily create new Message/Service for Unrecognized logs
• Online Updates for Services, Tables & Multilanguage
• Multilanguage support

Download version:
octopussy-1.0.7.tar.gz (4.2 MB)
octopussy_1.0.7_all.deb (4.1 MB)
Find Other Version |
Resources : http://www.8pussy.org/
our post before : http://seclist.us/2012/04/octopussy-v-1-0-3-perlxml-logs-analyzer.html

ESSPEE is a derivetive of Back | Track 5, based on Ubuntu 12.04. Designed for users who wish to use only free software. It is packed with featured security tools with stable configurations. This version consolidates the Unity desktop interface; a brand new way to find and manage your applications.

Features

• A Perfect Forensics Mode – Read-Only Mount
• A Perfect Stealth Mode – Networking Disabled
• Latest kernel with aufs support (Kernel 3.7.4)
• Metasploit Framework v4.6.0-dev [core:4.6 api:1.0]
• OSSEC – Open Source Host-based Intrusion Detection System
• Gnome-fallback Desktop Environment.
• Gnome-Pie – All your favourite applications at single click
• Suricata – Open Source Next Generation IDS/ IPS.
• Snorby – Suricata IDS/IPS Monitoring Web Interface.
• Meld – A visual diff and merge tool for compare files and directories.
• MySQL Workbench – A visual MySQL database designing tool.
• ESSPEE Personal Firewall – Realtime Pop-up Notification.
• Net Activity Viewer – A graphical network connections viewer.
• LOIQ – Open source network stress testing application.
• Guymager – Forensics imaging tool (GUI)
• Ostinato – Open-source network packet crafter/traffic generator.
• FSlint – Find and clean various unwanted extraneous files.
• Ruby 1.9.3p327 (2012-11-10 revision 37606)
• Fern Wi-Fi Cracker
• Virtualbox – Create your own virtual lab
• Nemiver – A standalone graphical C and C++ debugger
• Open Audit – Network inventory, audit and management tool
• Mobile Phone Forensics tools
• Anonymity – Tor network and many more

Download : ESSPEE-R3-x86.iso (3.35 GB) 

md5 : 61aa7c877568d8c109fb407b0540f0f4

firewall : ESSPEE-Personal-Firewall-Ubuntu.7z (248.1 kB) 
Forensics : ESSPEE-initrd-Forensics-Stealth.7z (60.9 MB) 
our post before : http://seclist.us/2012/07/update-esspee-r1-x86-penetration-testing-forensics.html

resources : http://sourceforge.net/projects/esspee

RIPS 0.54
———-
- fixed Javascript errors
- fixed bug with false negatives in non-OOP code after OOP code (thanks to Gareth Heyes)
- improved handling of parse_str() function
- added new taintable $_SERVER parameters to sources (thanks to Mike Brooks)
- added new sinks

RIPS is a tool written in PHP to find vulnerabilities in PHP applications using static code analysis. By tokenizing and parsing all source code files RIPS is able to transform PHP source code into a program model and to detect sensitive sinks (potentially vulnerable functions) that can be tainted by userinput (influenced by a malicious user) during the program flow. Besides the structured output of found vulnerabilities RIPS also offers an integrated code audit framework for further manual analysis.

Features

• vulnerabilities
• Code Execution
• Command Execution
• Cross-Site Scripting
• Header Injection
• File Disclosure
• File Inclusion
• File Manipulation
• LDAP Injection
• SQL Injection
• Unserialize with POP
• XPath Injection
• … other

code audit interface

• scan and vulnerability statistics
• grouped vulnerable code lines (bottom up or top down)
• vulnerability description with example code, PoC, patch
• exploit creator
• file list and graph (connected by includes)
• function list and graph (connected by calls)
• userinput list (application parameters)
• source code viewer with highlighting
• active jumping between function calls
• search through code by regular expression
• 8 syntax highlighting designs
• … much more

static code analysis

• fast
• tokenizing with PHP tokenizer extension
• taint analysis for 232 sensitive sinks
• inter- and intraprocedural analysis
• handles very PHP-specific behaviour
• handles user-defined securing
• reconstruct file inclusions
• detect blind/non-blind exploitation
• detect backdoors
• 5 verbosity levels
• over 100 testcases

Download : rips-0.54.zip (137.8 kB)
Find Other version |
Resources : http://www.php-security.org/
Our Post before : http://seclist.us/2012/03/rips-beta.html

This is extremely handy for Android Phones, as now most third-party Apps from mobile market is now close-sourced and it’s hard to promise its security, but some of this functions may be tempting, so we have to install it and give it permissions what it want at installation stage, and then it may do something we don’t like in the background, now with Lavender we can at least prevent from accessing network if we don’t trust it.

Both linux desktop and Android Phones are now supported(Front-end library and UI support)

Note: root permissions required to install on Android Phones(A native daemon needs to be installed and run as root),and this program heavily depends on some kernel network features which are not quite common during normal use, service daemon will dynamically check available kernel features, and won’t start if it doesn’t meet the basic requrement, check REAME in the source for th detailed requirement of the kernel

Features

• Dynamical network access behavior verdict support
• Self running info and behavior logging support
• Full NFCT log support, by which full network subsystem changes will be logged up
• Full CONNTRACK log support, by which all application’s network connections will be logged up
• Full UEVENT log support, by which all system events and changes will be logged up

TODO:
Android client lacking verdict DB operations support, need to manually clear lavender db to reset lavender networking access rule

Download :
Android : Android platform tgz package (201.7 kB)
Debian : lavender_0.1.3_amd64.deb (893.0 kB) 
Sources : https://code.google.com/p/lavender-firewall/

—————- VERSION 3.0.6 ————–

New features:
- Logical files and folders support
- New file views in directory tree to view: deleted, executable, archive files and files by size
- ext4 and yaffs2 support (via TSK 4.1.0)

Improvements:
- Improvements to tagging of files and keyword search results
- Any file and folder can be selectively ingested using the directory tree view

Bugfixes:
- Keyword Search: fix when Solr does not cleanly shutdown
- fix for “Process Unallocated Space” option doesn’t do anything
- fixed result viewer for “File Search by MD5 Hash”
- fix Solr, Timeline and RecentActivity issues with java 7.0.21
- Views->Recent Files showing inconsistent results when clicked many times

Autopsy™ is a digital forensics platform and graphical interface to The Sleuth Kit™ and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera’s memory card

Download version :
windows : autopsy-3.0.6-installer.msi (251.2 MB) 
dev : autopsy-3.0.6-devplatform.zip (250.4 MB) 
Find Other version |
Sources : http://www.sleuthkit.org/autopsy/index.php
Our Post before : http://seclist.us/2013/05/update-the-autopsy-forensic-browser-v-nsrl-240m.html

Changelog v-4.0.2:

• Fix pfdetect_remote to use fifo file
• Improve layout of switches configuration list
• Added the ability to clone a switch
• Rename the copy role to clone and made the clone similar to create action
• Refactored the create post action for reusability
• update debian control file for libconfig-inifiles-perl minimum version
• Fix pfdetect_remote and pfarp_remote (certificate issue and uri issue)
• Cleanup coding style
• Remove references to the [passthroughs] section
• Add notes field to node editor
• Fix sort of routed networks
• Remove duplicate sources field in default profile
• Added function getIfIndexiByNasPortId in MockedSwitch.pm to pass test
• Remove snort dep in packetfence remotre snort sensor since we can use it with suricata too

PacketFence is a fully supported, trusted network access control (NAC) system. It includes a captive portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices, and integration with the Snort IDS and the Nessus vulnerability scanner. It can be used to effectively secure networks, from small to very large heterogeneous networks.

Download :
PacketFence-ZEN-4.0.2.zip (735.0 MB)

read more in here : http://www.packetfence.org/

Our post before :

http://seclist.us/2013/05/update-packetfence-version-3-6-0.html

http://www.seclist.us/2012/06/update-packetfence-version-341.html
http://www.seclist.us/2012/06/update-packetfence-v-340.html
http://www.seclist.us/2012/04/packetfence-v330-released.html

HexaFind v1.3 fixed bugs and added features:

1. Fixed line processing arguments for multiple tools
2. Decreased processing sleep times
3. Increased and revised accuracy

The continued and growing trend of the frequency and severity of network attacks against corporations, private individuals in
addition to countries has prompted the development of network attack detection tools. In order to defend against threats – security
is not only required in a pre-emptive scenario, but also ex post facto; whereby the criminal/ civil act has been detected and the
acquisition of evidence has begun in order to provide a conviction. This project and its scripted application have been created in
response to these escalating movements towards network vulnerability enumeration and distributed denial of service attacks
(DDoS).

There is a clear lack of network attack tool detection products for the Linux/ UNIX operating system, and therefore this project should
also address this imbalance. Within society, the UNIX / Linux operating system makes up an extremely minute fraction of
operating systems that are in use within the world of today

Download : hexafind.rar (15.8 kB)
Find Other tool |
source : http://www.hexafind.com/

The Cyberprobe project is a distrbuted architecture for real-time monitoring of networks against attack. The software consists of two components:
a probe, which collects data packets and forwards it over a network in standard streaming protocols.
a monitor, which receives the streamed packets, decodes the protocols, and interprets the information.
These components can be used together or separately. For a simple configuration, they can be run on the same host, for more complex environments, a number of probes can feed a single monitor.

Changelog v-0.20 :
0.20 HTTP and DNS protocol capability. TCP reset and DNS packet forgery added. Major overhaul of the LUA language interface

The probe, cyberprobe has the following features:

• The probe can be tasked to collect packets from an interface and forward any which match a configurable address list.
• The probe can be configured to receive Snort alerts. In this configuration, when an alert is received from Snort, the IP source address associated with the alert is dynamically targeted for a period of time. In such a configuration, the system will collect data from any network actor who triggers a snort rule and is thus identified as a potential attacker.
• The probe can optionally run a management interface which allows remote interrogation of the state, and alteration of the configuration. This allows dynamic alteration of the targeting map, and integration with other systems.
• The probe can be configured to deliver on one of two standard stream protocols.

The monitor tool, cybermon has the following features:

• Collects packets delivered in stream protocols.
• Decodes packet protocols in and raises events in near-real-time.
• Decoded information is made available to user-configurable logic to define how the decoded data is handled. A simple configuration language is used (LUA) and example configurations are provided to monitor data volumes, display data hexdumps, or stash the data in files.
• Packet forgery techniques are included, which allow resetting TCP connections, and forging DNS responses. This can be invoked from your LUA in order to fight back against attacks on your network.
• Supports IP, TCP, UDP, ICMP, HTTP and DNS protocols, currently.

The cybermon software is a bit of a work-in-progress at the moment, and needs more protocols added, but there’s enough capability to be useful, and to demonstrate the value of this architecture.

Installation and Configure

Download : cyberprobe-0.20.tgz (179.8 kB) 
Find Other Version |
Sources : Cyberprobe 

The following software was recently released:
PF_RING 5.6.1
http://sourceforge.net/projects/ntop/files/PF_RING/

Snort 2.9.5.3
http://blog.snort.org/2013/07/snort-2953-is-now-available.html

Suricata 1.4.5
http://suricata-ids.org/2013/07/26/suricata-1-4-5-released/

Upgrading
The new packages are now available in our stable repo. Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

These updates will do the following:

• stop all NSM sensor processes
• terminate any remaining processes using PF_RING
• remove the existing PF_RING module
• build the new PF_RING module
• start all NSM sensor processes
• back up each of your existing snort.conf files to snort.conf.bak
• update Snort
• back up each of your existing suricata.yaml files to suricata.yaml.bak
• update Suricata

“sudo soup” upgrade process

Security Onion is a Linux distro for IDS (Intrusion Detection) and NSM (Network Security Monitoring). It’s based on Ubuntu and contains Snort, Suricata, Bro, Sguil, Squert, Snorby, ELSA, Xplico, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!

PF_RING 5.6.1, Snort 2.9.5.3, and Suricata 1.4.5

Security Onion 10.04 Update Procedure :
sudo -i “curl -L http://sourceforge.net/projects/security-onion/files/security-onion-upgrade.sh > ~/security-onion-upgrade.sh && bash ~/security-onion-upgrade.sh”
Download :  securityonion-12.04.2-20130717.iso (1.3 GB) 
MD5 : ca39624aaa81e24c1886a099a38933e5
Find Other version |
Sources : https://code.google.com/p/security-onion/
Our Post before : http://seclist.us/2012/12/update-security-union-v-12-04-20121224.html

Proxyp is a small multithreaded Perl script written to enumerate latency, port numbers, server names, & geolocations of proxy IP addresses.

This script started as a way to speed up use of proxychains, which is why I’ve added an append option for resulting live IP addresses to be placed at the end of a file if need be.

Features

• multithreaded
• crawl websites or files
• sorted response time
• port & server enumeration
• output truncate/append
• geolocation
• under 210 lines
• ~6kb
• Features
• Muli-platform support (by Java VM)
• Several hashing algorithms supported
• Flexible chained hashes decryption (like MD5(SHA1(MD5())))
• Both brute force and dictionary decryption methods supported
• Build-In rule pre-processor for dictionary decryption
• Multi-threading support

By default ‘Proxyp’ will list out every IP in a file or website with only a target specified with -f or -i. To evaluate each address use -e. live addresses are sorted by response time from ICMP echo pings to gauge latency, the -d or duration switch can be used to alter results. To see responses in real time use verbosity with -v or -x switches. furthermore you can output live addresses to file or append, to say, /etc/proxychains.conf

There are some sites, for instance, like hidemyass.com that bury their displayed ip addresses in Javascript. For sites like these, just highlight the entire page and copy paste to a txt file on your desktop, you can then crawl that file like any other with ‘-f path’

*=IMPORTANT=*
‘-z’ flag feature is somewhat of a hack, syn scanning of a pool of ip/ports as well as banner grabbing is involved
this may be against certian laws of certian countries, if you want to play it safe just exclude ‘-z’

There is only one dependancy, that is IP::Country, this Perl module must be installed for geolocation by country.

install methods

* perl -MCPAN -e ‘install IP::Country’

* cpanm -i IP::Country

* cpan
install IP::Country

for users new to linux, remember to ‘sudo chmod +x proxyp.pl’ and execute ‘sudo ./proxyp.pl’ to run

EXAMPLES

*crawl and output all ip’s in a file*
sudo ./proxyp.pl -f Desktop/file.txt

*crawl and output all ip’s on a website, return only proxies that are faster than 0.1 seconds*
sudo ./proxyp.pl -i http://spys.ru/en/ -d 0.1

——-

*enumerate all ip’s in a file and watch only live addresses in real time from russia only*
sudo ./proxyp.pl -f Desktop/file.txt -evc RU

*enumerate all ip’s on a website and watch real time*
sudo ./proxyp.pl -i http://spys.ru/en/ -ex

——-

*enumerate all ip’s in a file, watch only live addresses in real time, append to proxychains.conf*
sudo ./proxyp.pl -f Desktop/file.txt -eva /etc/proxychains.conf

*deep enumeration on all ip’s on a website, watch real time, speed things up with 20 threads*
sudo ./proxyp.pl -i http://spys.ru/en/ -ezxt 20

Download : proxyp.pl (6.3 kB) 
Find Other Version |
sources : Proxyp 

Androick will help you in your forensics analysis on android. put the package name in argument of the application, and the program will download automatically all datas and apk file stored in your android device.

furthermore, after downloading datas, the application will search and extract (in CSV format) all databases.
HOW TO USE
1) show help message
./androick.py -h

2) show informations
./androick.py -a

3) find package name
./androick.py [-v] -f <Part of package name>

4) download all related things of application
./androick.py [-v] PACKAGE_NAME_1 PACKAGE_NAME_2 ETC…

Download : Androick-2.0.zip (14.3 kB) 
Sources : https://www.owasp.org/index.php/Projects/OWASP_Androick_Project