February 2011 | Linux Blog

Tool to Detect SQL Injection - SQLInject-Finder

SQL injection is yet another common vulnerability that is the result of lax input validation. Unlike cross-site scripting vulnerabilities that are ultimately directed at your site’s visitors, SQL injection is an attack on the site itself—in particular its database. The goal of SQL injection is to insert arbitrary data, most often a database query, into a string that’s eventually executed by the database. The insidious query may attempt any number of actions, from retrieving alternate data, to modifying or removing information from the database.

Penetration Testing data management and reporting tool - MagicTree

MagicTree is a penetration tester productivity tool. It is designed to allow easy and straightforward data consolidation, querying, external command execution and report generation. In case you wonder, "Tree" is because all the data is stored in a tree structure, and "Magic" is because it is designed to magically do the most cumbersome and boring part of penetration testing - data management and reporting.

MagicTree stores data in a tree structure. This is a natural way for representing the information that is gathered during a network test: a host has ports, which have services, applications, vulnerabilities, etc. The tree like structure is also flexible in terms of adding new information without disturbing the existing data structure: if you at some point decide that you need the MAC address of the host, you just add another child node to the host node.

Transparent Caching ftp proxy server - frox

Frox is a transparent FTP proxy that runs under Linux and *BSD. It should also work on other UNIX OSes that use ipfilter.

Frox Features:
* active - passive mode conversion for data connections.
* It supports caching of FTP downloads, either through a local cache, or by redirecting connections through another proxy such as squid.
* Downloads may be transparently scanned for viruses (through an external scanner).
* Optional non-transparent proxy support by logging in with user@host:port.
* Options to bind to a specific interface, chroot, and drop priveleges for security.
* Written with security in mind, default setup runs as a non-root user in a chroot jail.

Install Flash 8 or Flash CS3 on Ubuntu Linux - Wine

Wine is an Open Source implementation of the Windows API on top of X and Unix. Wine provides both a development toolkit for porting Windows sources to Unix and a program loader, allowing many unmodified Windows binaries to run on x86-based Unixes.

Install the latest version of wine:
Ubuntu and Ubuntu derivatives (such as Kubuntu) obtain software from packages which are stored in repositories. Ubuntu's default repository includes Wine, however if you want to stay up to date with the latest Wine package you can use WineHQ's by following these instructions, open up the terminal (Applications > Accessories > Terminal) and type following command to install latest version of wine

sudo add-apt-repository ppa:ubuntu-wine/ppa
sudo apt-get update
sudo apt-get install wine

How to Remove old and un-used Kernel from System and Grub Menu - Ubuntu Linux

The kernel is a piece of software that, roughly speaking, provides a layer between the hardware and the application programs running on a computer. In a strict, computer-science sense, the term 'Linux' refers only to the kernel - the software that Linus Torvalds wrote in the early 90s.

All the other pieces you find in a Linux distribution - the Bash shell, the KDE window manager, web browsers, the X server, Tux Racer and everything else - are just applications that happen to run on Linux and are emphatically not part of the operating system itself.

UI Application to take System Backup and Snapshot - TimeVault

Backing up data can be difficult, especially when you only want to copy files that changed since the last backup. It can be even more troublesome when you have to remember to start the process manually,or you have to delete old backups to make room for new ones. Because of these difficulties, some people decide not to back up data at all, and feel the pain when they accidentally delete the wrong file or their system crashes. TimeVault is a backup utility for Ubuntu that addresses these problems.

TimeVault is an UI application that performs a function similar to Apple's TimeMachine. It makes automated snapshots of (selected parts of) the file system. You can roll back to a previous version of a file or directory, or just view it the way it was when the snapshot was taken. Snapshots are protected from accidental deletion or modification since they are read-only by default. The super-user can delete intermediate snapshots to save space, but files and directories that existed before or after the deletion will still be accessible

Get Security Information about your PHP environment - PhpSecInfo

PhpSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement. It is not a replacement for secure development techniques, and does not do any kind of code or app auditing, but can be a useful tool in a multilayered security approach.

* It is not a replacement for secure coding practices
* It does not audit PHP code
* It is not comprehensive test for either your hosting environment or your web application
* It is not the "final word." PHPSecInfo identifies *potential* problems and offers suggestions for improvement.

Protect MySQL Database from SQL injection attacks - GreenSQL

GreenSQL is an Open Source database firewall used to protect databases from SQL injection attacks. GreenSQL works as a proxy and has built in support for MySQL and PostgreSQL. The logic is based on evaluation of SQL commands using a risk scoring matrix as well as blocking known db administrative commands (DROP, CREATE, etc).

GreenSQL works as a reverse proxy for MySQL connections. This means, that instead of connecting TO THE MySQL server, your applications will connect to the GreenSQL server. GreenSQL will analyze SQL queries and then, if they're safe, will forward them to the back-end MySQL server.

Web Application Security Scanner by Google - Skipfish

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

Keep in mind that all types of security testing can be disruptive. Although the skipfish scanner is designed not to carry out malicious attacks, it may accidentally interfere with the operations of the site. You must accept the risk, and plan accordingly. Run the scanner against test instances where feasible, and be prepared to deal with the consequences if things go wrong.

Use skipfish only against services you own, or have a permission to test.

Use skipfish at your own risk.

Framework to Find and Exploit web Application Vulnerabilities - w3af

You may use this tool at your own risk!

w3af is a Web Application Attack and Audit Framework which aims to identify and exploit all web application vulnerabilities.

The framework has been called the "metasploit for the web", but it's actually much more than that, because it also discovers the web application vulnerabilities using black-box scanning techniques!

The w3af core and it's plugins are fully written in Python. The project has more than 130 plugins, which identify and exploit SQL injection, cross site scripting (XSS), remote file inclusion and more.

Detail Memory Reporting Tool for Linux System - smem

smem is a tool that can give numerous reports on memory usage on Linux systems. Unlike existing tools, smem can report proportional set size (PSS), which is a more meaningful representation of the amount of memory used by libraries and applications in a virtual memory system.

Because large portions of physical memory are typically shared among multiple applications, the standard measure of memory usage known as resident set size (RSS) will significantly overestimate memory usage. PSS instead measures each application's "fair share" of each shared area to give a realistic measure.

Ubuntu based Penetration Testing Distribution - Blackbuntu

Blackbuntu is distribution for penetration testing which was specially designed for security training students and practitioners of information security.

Blackbuntu is Ubuntu base distro for Penetration Testing with GNOME Desktop Environment. It's currently being built using the Ubuntu 10.10 and work on reference Back|Track.

Linux Blog