Todd H Dow
I'm a writer, geek & CF fundraiser. My family, baseball, infosec & devops are a few of my favourite things.
Home
Family
Links
Infosec
Linux
Karate
Baseball
Games
Privacy Tools
News
- Reddit InfoSec
- Schneier on Security
- Dark Reading
- SC Magazine
- The Register - Security
- Ars Technica - Security
- F-Secure Weblog
- Naked Security (from Sophos)
- Krebs on Security
- Security Affairs
- Google Online Security Blog
Threat Centers
- SANS Internet Storm Center
- ICS-CERT
- Microsoft Security TechCenter
- Alien Vault OTX
- Check Point Threat Center
- McAfee Threat Center
- Symantec Threat Report
- Kaspersky Internet Security Center
- Akamai SotI
- Open Sourced Vulnerability DB
- CVE - Common Vulnerabilities and Exposures
- National Vulnerability DB
- Google's Project Zero
- IPViking Live Attack Map
- VirusTotal
Governance
InfoSec Bounty Programs
- bugcrowd
- HackerOne vulnerability broker
- Google App Security
- Google Online Security Blog
- Microsoft Security
- Microsoft Security Bounty Programs
Interesting Github repos
- Github Security Showcase
- Bro (my fork)
- Moloch - IPv4 full PCAP capturing (my fork)
- OSSEC HIDS (my fork)
- Rapid7 Metasploit Framework (my fork)
- MAC Intrusion Detection Analysis System (my fork)
- OS X Auditor (my fork)
- AlienVault projects (my fork)
- Cuckoo Sandbox malware analysis (my fork)
- Brakeman - static analysis security vulnerability scanner for Ruby on Rails applications (my fork)
- Sleuthkit - command line digital forensics tools that allow you to investigate volume and file system data (my fork)
- DNS network sniffer (my fork)
- Mozilla cloud security investigator (my fork)
- Mozilla Defense Platform (my fork)
- SQL powered operating system instrumentation, monitoring, and analytics. (my fork)
- Netflix Scumblr (my fork)
- The Modern Honeynet (my fork)
- GRR Rapid Response: remote live forensics for incident response (my fork)
- unix-like reverse engineering framework and commandline tools (my fork)
- The Browser Exploitation Framework Project (my fork)
Training
- Coursera - Crypto 101
- OWASP Testing Guide v4
- Penetration Testing Practice Lab - Vulnerable Apps/ Systems
Interesting
Vulnerability Research Sites
- Google App Security
- Microsoft Security
- Symantec
- Fireeye
- National Vulnerability Database
- SecurityTracker
- SecuriTeam
- Secunia
- Hackerstorm Vulnerability Database Tool
- HackerWatch
- SecurityFocus
- Security Magazine
- Exploit Database
- riskDB
- the national vulnerability database
- the web applications security consortium
- the exploit database
- SHODAN
- the metasploit project
- Alienvault
- CyberSquared
- Science of Security in Cyber-Physical Systems Virtual Organization
- PwnWiki (github repo of same site)
- Google PKI - certificates, etc.
- IO wargame (great list of vulnerability nicknames)
Ultimate Pen Test (summary provided by SANS):
Network Pen Testing
- Kali
- Mimikatz - clear text password from memory tool
- Metasploit
- Recon-ng - open source recon tool
- nmap
- Maltego
- Python
- Social Engineering Toolkit
- anonymizer.com
- FOCA (Fingerprinting Organizations with Collected Archives)
- THC-Hydra - remote password guessing tool
- Ettercap - ARP poisoning / MITM
- Cain and Able - ARP poisoning / password cracking
- John the Ripper - password cracking
- Hashcat - password recovery
- ISR-EvilGrade - intercept and hijack software updates
- wireshark
- Netcat
- Scapy - packed crafting tool
Wireless Software
- Kismet - passive wireless discovery
- Aircrack-ng - wireless tools
- Netmon - Windows network monitor tool
Wireless Hardware
- Alfa AWUS051NH v2 802.11n Dual Band 300 mbps Wireless-N USB adapter
- Parani SENA UD-100 Bluetooth USB Adapter
- Ubertooth One
- Wifi-Pineapple
- TripNav BU-353 GPS receiver
- Antennas
- ZigBee Atmel RZUSB
- ZigBee Atmel RZUSB manufacturer
- RTLSDR - software defined radio site
Mobile Software
- Android Emulator and SDK
- Plist editor for windows
- SQLLiteSpy
- Elcomsoft Phone Password Breaker
- iPhone Data Protection Tools
- Redsn0w - all-purpose iOS jailbreaking tools for iOS 5
- Satori - passive OS LAN fingerprinting tool
- Drozer - Android sectest platform (formerly Mercury)
- Apple Corporate Management docs
Web App Tools
- Burp Suite
- DirBuster
- Zed Attack Proxy
- SQLMap
- Nikto
- SamuraiWTF - pre-built testing system
- Firefox add-ons incl HackBar, User Agent Switcher, Web Developer, Tamper Data, Firebug
- Laudanum - injectible web scripts
- BeEF - Browser Exploitation Framework
Exploit Development
- IDA disassembler and debugger
- WinDbg
- Immunity Debugger
- mona.py - exploit dev plugin for Immunity Debugger and WinDbg
- BinDiff - works with IDA
- Sulley fuzzing framework
- DDB: GNU Debugger
- VMWare VM
- VirtualBox
Summary & Collaboration Tools
Footprinting Tools
Website Research Tools
DNS and WHOIS Tools
- network-tools.com
- NSlookup
- Sam Spade
- WebFerret
- ARIN
- DomainTools
- Network Solutions
- WhereIsIP
- DNSstuff
- BetterWhois
- DNS-Digger
- SpyFu
- Dig
Traceroute Tools and Links
- VisualRoute Trace
- 3d Visual Route
- VisualIPTrace
- Trout / McAfee Foundstone
- PingPlotter
- Path Analyzer Pro
Website Mirroring Tools and Sites
E-mail Tracking
Google Hacking
Scanning and Enumeration Tools
Ping Sweep
Scanning Tools
- SuperScan
- Nmap (ZenMap)
- NetScan Tools Pro
- Hping
- LAN Surveyor
- MegaPing
- NScan
- Infiltrator
- Netcat
- IPEye
- THC-Amap
War Dialing
Banner Grabbing
Vulnerability Scanning
Proxy, Anonymizer, and Tunneling
Enumeration
- PSTools
- P0f
- SuperScan c/o Foundstone
- User2Sid/Sid2User
- SNMP Scanner
- NSauditor
- SolarWinds
- LDAP Admin
- LEX
- Ldp.exe
- User2Sid/Sid2User
- SNMPUTIL
- IP Network Browser
- Xprobe
System Hacking Tools
Password Hacking Tools
- Cain
- John the Ripper
- LCP
- THC-Hydra
- ElcomSoft
- Lastbit
- Ophcrack
- Aircrack
- Rainbow crack
- Brutus
- Windows Password Recovery
- KerbCrack
Sniffing
Keyloggers and Screen Capture
- KeyProwler
- Handy Key Logger
- Actual Keylogger
- Actual Spy
- Ghost
- Hidden Recorder
- IcyScreen
- DesktopSpy
- USB Grabber
Covering Tracks
Packet Crafting/Spoofing
Session Hijacking
Cryptography and Encryption
Encryption Tools
Hash Tools
Steganography
- ImageHide
- gifShuffle
- QuickStego
- EZStego
- Open Stego
- S Tools
- JPHIDE
- wbStego
- MP3Stegz
- OurSecret
- OmniHidePro
- AudioStega
- StegHide
- XPTools
Cryptanalysis
Sniffing
Packet Capture
Wireless
MAC Flooding/Spoofing
ARP Poisoning
Trojans and Malware
Wrappers
Monitoring Tools
Attack Tools
IDS
Evasion Tools
Wireless
- WIGLE
- AirPcap
- Madwifi
- Kismet
- NetStumbler
- AirMagnet WiFi Analyzer
- Airodump
- Aircrack
- AirSnort
- BT Browser
- BlueScanner
- Bluediving
- SuperBlueTooth Hack
- KisMAC
- NetSurveyor
- inSSIDer
- WiFi Pilot
- OmniPeek
Web Attacks
SQL Injection
Miscellaneous
Pen Test Suites
- Core Impact
- CANVAS
- Metasploit
- Armitage
- Codenomicon
- SANS SIFT Kit (SANS Investigative Forensics Toolkit)
- Kali
- Alien Vault’s OSSIM consists of the following:
- Server/Framework:
- Nagios
- OCSInventory
- NFSen
- Ntop (interface)
- Sensors:
- Snort
- Nfcap/Fprobe
- P0f
- Pads
- Arpwatch
- Ntop
- Nmap
- OpenVAS
- OSSEC
- Kismet
Extras
Linux Distributions
Sources for the above list include:
- Google App Security
- CEH Certified Ethical Hacker All-in-One Exam Guide
- Risk.io