Web Application Configuration Analyzer (WACA) - Microsoft

Web Application Configuration Analyzer (WACA) :-

server configuration for security best practices related to General Windows, IIS , ASP.NET and SQL Server settings.

Web Application Configuration Analyzer (WACA) is a tool that scans a server against a set of best practices recommended for pre-production and production servers. The list of best practices is derived from the Microsoft Information Security & Risk Management Deployment Review Standards used internally at Microsoft to harden production and pre-production environments for line of business applications. The Deployment Review standards themselves were derived from content released by Microsoft Patterns & Practices, in particular: Improving Web Application Security: Threats and Countermeasures .


WACA - new features:-

• Suppressions – you can now suppress any rule you feel is not appropriate for your scan.
  
  
• Saving of suppression files – once you set up a suppression list you want to use you can save it off for future uses.
• You can change the suppressions and regenerate the report without needing to re-run the scan.
• Reporting – Updated the reporting section to include suppression information so you know what passed, failed, was not applicable and what was suppressed.
• Multiple reports – you can view multiple scans of the same machine or view a single machine’s scan and compare it to other machines.
• Export to the Microsoft RED format.
• Scan multiple systems and SQL instances in one bulk scan.
• Additional rules – we’ve added in additional SQL rules.
• And of course bug fixes that were missed in the last release.

System requirements

Supported Operating Systems: Windows 7, Windows Server 2003, Windows Server 2003 R2 (32-Bit x86), Windows Server 2003 R2 x64 editions, Windows Server 2008

Supported Operating Systems for installation: Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008 R1/R2

Support Operating Systems for scanning: Windows Server 2003, Windows Server 2008 R1/R2

Sofware Requirements: .NET Framework v4.0, Microsoft Office Excel (Optional)

Download Link : Click Here

Microsoft - Attack Surface Analyzer

Attack Surface Analyzer :-
beta is a Microsoft verification tool now available for ISVs and IT professionals to highlight the changes in system state, runtime parameters and securable objects on the Windows operating system. This analysis helps developers, testers and IT professionals identify increases in the attack surface caused by installing applications on a machine.

The tool takes snapshots of an organization's system and compares ("diffing") these to identify changes. The tool does not analyze a system based on signatures or known vulnerabilities; instead, it looks for classes of security weaknesses as applications are installed on the Windows operating system
I'd encourage people to download the tool, and if you happen to be at Blackhat DC, swing by the Microsoft booth and take a look for yourself.

Download Link : Click Here

OpenDLP - Open source Data Loss Prevention

OpenDLP:-

is a free and open source, agent-based, centrally-managed, massively distributable data loss prevention tool released under the GPL. Given appropriate Windows domain credentials, OpenDLP can simultaneously identify sensitive data at rest on hundreds or thousands of Microsoft Windows systems from a centralized web application. OpenDLP has two components: a web application and an agent.

The speed and simplicity of OpenDLP make it a great choice for Penetration Testers. Unfortunately, it also does the same for an attacker. In one case, SecureState was able to sift through 50 machines to pull out various HIPAA and PCI data in less than an hour. This may result in non-compliance in both areas. With the weaponization of OpenDLP, an attacker no longer has to spend days searching systems or limiting themselves to only large file shares. Attackers can be in and out before they are ever detected.

Data Loss Prevention suite with centralized web frontend to manage Windows agent filesystem scanners, agentless database scanners, and agentless Windows/UNIX filesystem scanners that identify sensitive data at rest.Web Application

• Automatically deploy and start agents over Netbios/SMB
• When done, automatically stop, uninstall, and delete agents over Netbios/SMB
• Pause, resume, and forcefully uninstall agents in an entire scan or on individual systems
• Concurrently and securely receive results from hundreds or thousands of deployed agents over two-way-trusted SSL connection
• Create Perl-compatible regular expressions (PCREs) for finding sensitive data at rest
• Create reusable profiles for scans that include whitelisting or blacklisting directories and file extensions
• Review findings and identify false positives
• Export results as XML
• Written in Perl with MySQL backend

Agent

• Runs on Windows 2000 and later systems
• Written in C with no .NET Framework requirements
• Runs as a Windows Service at low priority so users do not see or feel it
• Resumes automatically upon system reboot with no user interaction
• Securely transmit results to web application at user-defined intervals over two-way-trusted SSL connection
• Uses PCREs to identify sensitive data inside files
• Performs additional checks on potential credit card numbers to reduce false positives
• Can read inside ZIP files, including Office 2007 and OpenOffice files
• Limits itself to a percent of physical memory so there is no thrashing when processing large files

Agentless Database Scans

In addition to performing data discovery on Windows operating systems, OpenDLP also supports performing agentless data discovery against the following databases:

• Microsoft SQL server
• MySQL

Agentless File System and File Share Scans

With OpenDLP 0.4, one can perform the following scans:

• Agentless Windows file system scan (over SMB)
• Agentless Windows share scan (over SMB)
• Agentless UNIX file system scan (over SSH using sshfs)

Screenshots

Agent-based Windows OS scan, summary results view:

Agent-based Windows OS scan, detailed results view:

Agentless Microsoft SQL Server scan, detailed results view:


Download Link : Click Here

**********************************************************************************

SSH Tools for Windows , Mac OS

OpenSSH:
is a FREE version of the SSH connectivity tools that technical users of the Internet rely on. Users of telnet, rlogin, and ftp may not realize that their password is transmitted across the Internet unencrypted, but it is. OpenSSH encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions.

OpenSSH Server for Windows:

An installer for a minimal installation of the Cygwin environment suitable for running an OpenSSH server on the Windows platform.

Download Link : Click Here

SSH Client For Windows:
PuTTY is a free implementation of Telnet and SSH for Win32 platforms.

Download Putty : Click here

TTSSH is a free SSH client for Windows. It is implemented as an extension DLL for Teraterm Pro. Teraterm Pro is a superb free terminal emulator/telnet client for Windows, and its source is available. TTSSH adds SSH capabilities to Teraterm Pro without sacrificing any of Teraterm's existing functionality.

SSH Client For Mac O/S:
NiftyTelnet 1.1 SSH r3 is an enhanced version of Chris Newman's NiftyTelnet 1.1 application which adds support for encrypted terminal sessions using the SSH (Secure Shell) protocol.

Download NiftyTelnet : Click here

MacSSH:
SSH2 client for MacOS before X, based on BetterTelnet, lsh and GUSI.

Download MacSSH: Click Here

Tips for Secure SSH Login

Secure Shell (SSH):
has been constructed with regards to security. Previously, customers often accessed Telnet in order to gain connection to their servers; however, this was the time, when servers were located right across the hall, not widely spread across the infinite internet.

Secure Shell provides an additional layer of encryption to the communication, ensuring that the users can connect with the dedicated server or the virtual private server (VPS) without having to feel wary of any threat from malicious activity, such as the capturing of their password.

Default Port No: 22/Tcp


Restrict Root login's:
In an ordinary situation, you have no motive to permit straight root logins to your server. Although the system administrator can be one of the roots once it has logged in (using su or sudo), it is far too dangerous to make your root account open to the entire Internet.

Jail users in chroot directories:
Servers, belonging to Linux and UNIX, provide the ability of restricting ordinary users from doing something dangerous, such as removing all the documents;, however, nothing can be done about viewing the files.

Install Brute Force Detection software:
Malicious hackers can make use of forcible methods in an attempt to gain knowledge of your password and carry out malevolent activity on your server.

Maintain secure password and periodic rotations:
Being the sysadmin, you have the ability to manage the requirements regarding the strength of the password along with making it compulsory for users to modify their password after a period of time.

Set the Timeout Interval:
An extremely helpful feature, a part of SSH configuration file, is that it allows you to determine a timeout interval, disallowing users from staying logged in, irrespective of whether they have forgotten to logout .

open source security assessment framework

Dradis

is an open source framework to enable effective information sharing, specially during security assessments.

Dradis is a self-contained web application that provides a centralized repository of information to keep track

This application is suited to people in lengthy engagements, it’s very useful to have all the information in one place. It’s also good to have if your team changes (i.e. someone joins half the way through), it will be useful to bring them up to speed.

Download Link : Click Here

************************************************************************************

Open Source Live-CD for Computer Forensic

PlainSight :
is a versatile computer forensics environment that allows inexperienced forensic practitioners perform common tasks using powerful open source tools.

We have taken the best open source forensic/security tools, customised them, and combined them with an intuitive user interface to create an incredibly powerful forensic environment.

Download Link : Click Here

********************************************************************************

DEFT 6 :
is based on Lubuntu with Kernel 2.6.35 (Linux side) and DEFT Extra 3.0 (Windows side) with the best freeware Computer Forensic tools; it is a new concept of Computer Forensic live system, ewflib ready, that use WINE for run Windows Computer Forensics tools under Linux.

DEFT live-cd for incident-response & corporate/gov forensics and a DEFT-based persistent environment for acquisition-analysis within the inhouse forensic lab.

Download Link : Click here

**********************************************************************************