Avoiding the Man In The Middle through ARP Spoofing/Poisoning

ArpON (Arp handler inspectiON) is a portable handler daemon that make ARP secure in order to avoid the Man In The Middle through ARP Spoofing/Poisoning. It detects and blocks also Man In The Middle through ARP Spoofing/Poisoning for DHCP Spoofing, DNS Spoofing, WEB Spoofing, Session Hijacking and SSL/TLS Hijacking & co attacks.

This is possible using two kinds of anti ARP Poisoning tecniques: the first is based on SARPI or "Static Arp Inspection" the second on DARPI or "Dynamic Arp Inspection" approach. SARPI and DARPI protects both unidirectional, bidirectional and distributed attacks.

Into "Unidirectional protection" is required that ArpON is installed and running on one node of the connection attacked. Into "Bidirectional protection" is required that ArpON is installed and running on two nodes of the connection attacked. Into "Distributed protection" is required that ArpON is installed and running on all nodes of the connections attacked. All other nodes whitout ArpON will not be protected from attack.

ArpON is therefore a host-based solution that doesn't modify ARP's standard base protocol, but rather sets precise policies by using SARPI for static networks and DARPI for dynamic networks (DHCP) thus making today's standardized protocol working and secure from any foreign intrusion.

Third party solutions exist, but all of them have some weaknesses, weaknesses which aren't present in ArpON.
Some examples:

1) Arpwatch: detects foreign intrusions but doesn't block them;
2) S-Arp (Secure ARP) slows down the protocol by injecting additional headers, encrypting communication and thus requiring more computational power;
3) DAI (Dynamic ARP inspection) from Cisco, ProCurve, Extreme Networks, Dlink and Allied Telesis slows down the protocol by making multiple DHCP server interrogations (DHCP Snooping) thus requiring more computational power;
4) IEEE 802.1AE, slows down the protocol by making massive use of encryption thus requiring more computational power.

Keep in mind other common tools fighting ARP poisoning usually limit their activity only to point out the problem instead of blocking it, ArpON does it using SARPI and DARPI policies. Finally you can use ArpON to pentest some switched/hubbed LAN with/without DHCP protocol, in fact you can disable the daemon in order to use the tools to poison the ARP cache.

Features:
- It detects and blocks Man In The Middle through ARP Spoofing/Poisoning attacks in statically configured networks;
- It detects and blocks Man In The Middle through ARP Spoofing/Poisoning attacks in dinamically configured (DHCP) networks;
- It detects and blocks Man In The Middle through ARP Spoofing/Poisoning for DHCP Spoofing attack;
- It detects and blocks Man In The Middle through ARP Spoofing/Poisoning for DNS Spoofing attack;
- It detects and blocks Man In The Middle through ARP Spoofing/Poisoning for WEB Spoofing attack;
- It detects and blocks Man In The Middle through ARP Spoofing/Poisoning for Session Hijacking attack;
- It detects and blocks Man In The Middle through ARP Spoofing/Poisoning for SSL/TLS Hijacking attack;
- It detects and blocks unidirectional, bidirectional and distributed attacks;
- Doesn't affect the communication efficiency of Arp protocol;
- Multithreading on all OS supported (Pthread lib);
- It manages the network interface into unplug, boot, hibernation and suspension OS features;
- It works in userspace for OS portability reasons;
- Easily configurable via command line switches, provided that you have root permissions;
- It replaces Arpwatch, DAI (Dynamic ARP Inspection), S-ARP (Secure-ARP), IEEE 802.1AE & co;
- Tested against Ettercap, Cain & Abel, dsniff and other tools.

Download ArpON

Read more...

Wi-fEye - Automated Network penetration testing tool

Wi-fEye is designed to help with network penetration testing, Wi-fEye will allow you to perform a number of powerful attacks Automatically, all you have to do is to lunch Wi-fEye, choose which attack to perform, select your target and let Wi-fEye do the magic !!.

Wi-fEye is divided to four main menus:
1. Cracking menu: This menu will allow you to:

* Enable monitor mode
* View avalale Wireless Networks
* Launch Airodump-ng on a specific AP
* WEP cracking: this will allow you to perform the following attacks automatically:

o Interactive packet replay.
o Fake Authentication Attack.
o Korek Chopchop Attack.
o Fragmentation Attack.
o Hirte Attack (cfrag attack).
o Wesside-ng.
* WPA Cracking: This contains the following attacks:
o Wordlist Attack
o Rouge AP Attack.

2. Mapping: this menu will allow you to do the following:

* Scan the network and view the connected hosts.
* Use Nmap Automatically.

3. MITM: this menu will allow you to do the following Automatically:

* Enable IP forwarding.
* ARP Spoof.
* Launch ettercap (Text mode).
* Sniff SSL/HTTPS traffic.
* Sniff URLs and send them to browser.
* Sniff messengers from instant messengers.
* Sniff images.
* DNS Spoof.
* HTTP Session Hijacking (using Hamster).

4. Others: this menu will allow you to o the following automatically:

* Change MAC Address.
* Hijack software updates (using Evilgrade).

Download Wi-fEye tool
Documentation for Wi-fEye tool

Read more...

Rename file extension of multiple files at once

Sometimes, you might need to rename the file extension of multiple files and this can be simply accomplished from command line without the use of any tools.

In the command prompt, move to the proper directory containing the files whose extension is to be renamed. Then type as following in the command prompt.

ren *.jpg *.exe

The above command will rename all the jpg files in that folder to exe. Similar command rename exists in the linux to achieve the same effect. Hope this comes to be handy for you.

Read more...

Fix Alt+PrintScreen Shortcut for Current Window Screenshot not working

Today, I was trying to get the screenshot of the current window and found that the Alt+PrintScreen was not working. The solution for this problem is as below:

To solve this problem, you need to do as following:

$ sudo gedit /etc/sysctl.conf

Just add the following line in this file.

kernel.sysrq = 0

This should solve the problem. Hope this helps. :)

Read more...

RIPS - PHP Static Source Code Analyzer

RIPS is a static source code analyser for vulnerabilities in PHP webapplications. It was released during the Month of PHP Security (www.php-security.org).

In this submission a tool named RIPS is introduced which automates the process of identifying potential security flaws in PHP source code by using static source code analysis. RIPS is open source and freely available at http://www.sourceforge.net/projects/rips-scanner/. The result of the analysis can easily be reviewed by the penetration tester in its context without reviewing the whole source code again. Given the limitations of static source code analysis, a vulnerability needs to be confirmed by the code reviewer.

Read more...

Cracking password protected ZIP archives with fcrackzip under linux

If you are looking for password protected zip archive cracker for linux, fcrackzip is the tool that can be used for the purpose.

fcrackzip is a fast password cracker partly written in assembler. It is able to crack password protected zip files with brute force or dictionary based attacks, optionally testing with unzip its results. It can also crack cpmask'ed images.

To install it, type the following in terminal

$ sudo apt-get install fcrackzip

Read more...

Antivirus Softwares for Linux

The myth of Linux being insecure is not true but it is said so due to the fact that it is not that widely used and not much used in the enterprises and homes but still they are not full proof so some antivirus protection for you Linux system might be obtained with any of the following softwares.

1) ClamAV: Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, designed especially for e-mail scanning on mail gateways. It provides a number of utilities including a flexible and scalable multi-threaded daemon, a command line scanner and advanced tool for automatic database updates. The core of the package is an anti-virus engine available in a form of shared library.
ClamAV Home

2) Bitdefender AV Scanner: BitDefender Antivirus Scanner for Unices is a versatile on-demand scanner for Linux and FreeBSD systems. The stand-alone scanner protects both UNIX-based and Windows-based disk partitions by scanning for viruses and spyware. Easy to use graphical user interface complements a powerful command line interface that fully supports operating system’s scripting tools.
Bitdefender AV Scanner for Unices

3) AVG: Basic antivirus protection for Linux/FreeBSD available to download for free. Free virus protection for your PC. For private and non-commercial use only.
AVG

4) avast! Linux Home Edition: avast! Linux Home Edition represents an antivirus solution for the increasingly popular Linux platform. The Home Edition is offered free of charge but only for home, non-commercial use.
Avast! Linux Home Edition

5) F-Prot AV: F-PROT Antivirus for Linux was especially developed to effectively eradicate viruses threatening workstations running Linux. It provides full protection against macro viruses and other forms of malicious software - including Trojans.
F-Prot AV

Any other additions, feel free to comment here.

Read more...

Online typing speed test

I remembered this site which I used to try in my old days when computers were new to me. The speed testing feature from this site seems to be reliable and today I was just seeing how fast my fingers go in this freezing cold weather.

http://speedtest.10-fast-fingers.com/

67 words

Lol I lost my speed due to freezing cold weather out here in Nepal :P

Read more...