Security-Database Blog

Normal trojans are a known threat, and we know how to mitigate them. But what about virtual machine trojans? This is a proof-of-concept Virtual Machine Trojan Visit www.infosegura.net/vimtruder.html for details

any (if not most) VoIP devices have available a Web GUI for
their configuration, management, and report generation. These Web GUIs are often on default, meaning that the moment you install the IP phone or IP PBX, the Web GUI is immediately available on the network. And unfortunately it is also common for the username and password to have the default values.

The PTF (pentestration tests framework) enumerates the stages one’s should perform during a test (as described in the OSSTMM manual)

• Network footprinting
• Discovery & Probing
• Enumeration
• Vulnerability assessment
• Penetration (or exploitation)
• Plus other tests as well as physical, wireless assessment....

Designed, tested and used by 500,000 IT pros in 185 countries. Spiceworks has the everyday IT features:

• Inventory and report on your company’s hardware and software assets automatically.
• Monitor and troubleshoot the hardware and software on your network.
• Run an IT Help Desk for your company that’s easy to use.

Since months, we discovered that many security blogs (security-sh3ll.blogspot.com among others) are using our "news and postings" without quoting the source. Please feel free to READ CAREFULLY THE CC Licence !!!!

Webshag (the Free Web Server Audit Tool) is a multi-threaded, multi-platform web server audit tool. Written in Python, it gathers commonly useful functionalities for web server auditing like website crawling, URL scanning or file fuzzing.

Watcher (The Open source Web Security Testing Tool and PCI compliancy auditing utility) is a runtime passive-analysis tool for HTTP-based Web applications. It detects Web-application security issues as well as operational configuration issues.

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3300 potentially dangerous files/CGIs, versions on over 625 servers, and version specific problems on over 230 servers. Scan items and plugins are frequently updated and can be automatically updated

sqlsus is an open source MySQL injection and takeover tool,
written in perl.
Using a command line interface that mimics a mysql console, you can retrieve the databases structure, inject SQL queries, download files from the web server, upload and control a backdoor, clone the databases, and much more...

The aim of creating winAUTOPWN is not to compete with already existing commercial frameworks like Core Impact (Pro), Immunity Canvas, Metasploit Framework (freeware), etc. which offer autohacks, but to create a free, quick, standalone application which is easy to use and doesn’t require a lot of support of other dependencies. Also not forgetting that winAUTOPWN unlike other frameworks maintains the original exploit writer’s source code intact just as it was and uses it. This way the exploit writer’s credit and originality is maintained. The source is modified only when required to enable a missing feature or to remove hard-coded limitations. Under these circumstances also, the exploit writers credits remain intact.

Process Hacker is a feature-packed tool for manipulating processes and services on your computer. It can show you the threads (with symbols), modules, memory regions, handles and token of processes. It has detailed graphs that show CPU usage, memory usage and I/O activity. It can even change the DEP status of some processes and protect/unprotect them!