Eight tools to improve safety
If the possibility that the digital assets of your company become targets of bullies do not scare you, do not read this article. Now, if you live in the same reality that the rest of us, so here’s your chance to take some advice to perform preventive tests against intrusion. Evan Saez, intelligence analyst in the cyberattacks Lifars, separated those it considers the best tools available. According to the expert, the features exposed by these systems are essential to ensure the safety of your company, they are the same capabilities used by the attackers attacks. Metasploit “The Metasploit is the most popular penetration testing tool,” exalts Saez, signaling that the technology offers both Ruby interface and the CLI, to be chosen based on the use seeks to achieve. “The Ruby interface is more useful for testing an extensive network because run commands on CLI would be very boring,” advocates. Nessus Vulnerability Scanner Nmap Use Nmap to search for hosts, open ports, software versions, operating systems, hardware and weaknesses – generally mapping the network attack surface. It is useful at every stage of penetration testing, identifying the components connected to enter a new network segment. “This tool, with its scripting ability, it is useful to enumerate the user access,” indicates Payer. Burp Suite OWASP ZAP The tool performs a variety of tests, including port scans, brute-force attack and fuzzing, all to identify malicious code. Your user uses intuitive graphical interface, similar to an application from Microsoft or other web design tools (such as Arachnophilia). Once you have navigated and played activities on a site, it uses the ZAP to view the code and other processes performed during these activities. When configured as a proxy server, the OWASP ZAP controls web traffic processing. “This tool is newer than the Burp Suite. It is not so rich, but it is free and open source. It provides a set of features and a graphical interface that are useful for people new in penetration testing, “argues Payer. Sqlmap Use SqlMap to test sites improper codes and URLS linked to databases through the python line commands. If a malicious link to databases of information attract the wrong code, then the URL is subject to attack. “Another tool script-friendly, the sqlmap can determine if a programmer has parameterized entries,” says Payer. “If he did not, an attacker could send a SQL command and run it in the database, gaining control.” Kali Linux According to him, Kali install the Linux and open any one of more than a dozen tools you have. “It comes with a large volume of user documentation,” says. Jawfish You can test it using the graphical user interface (GUI) available. Set an IP address for the server, an unprotected web address that IP, the vulnerability and the desired method and then the completion message. The tool returns the text when the site is successfully hacked. The Jawfish is new and is not ready for enterprise adoption. Full article: http://cio.com.br/
Features exposed by listed intrusion testing systems use the same capabilities exploited by attackers attacks
The Metasploit is a framework with a solid fan base among programmers. It adds custom test tools, looking for weaknesses in operating systems and applications. The customized modules are launched noGitHub and Bitbucket, online repositories for source projects.
Nessus Vulnerability Scanner is also popular in locating vulnerabilities. The technology scans computers and firewalls looking for open doors for the installation of potentially malicious software. “As a test tool, it communicates with the operating system to find vulnerabilities. It is commonly used for compliance, determining whether the patches are up to date, “said Garrett Payer, technology-leading provider of solutions ICF International. “Nessus scans only compares the known weaknesses databases,” added Saez.
The Nmap determines the types of computers, servers and hardware companies have connected to corporate networks. The ability of these machines are identifiable via external scanning is itself a vulnerability exploited by attackers to establish plans of attack.
The Burp Suite is another application penetration testing. It maps and analyzes web applications by finding and exploiting weaknesses. Use it with your browser to map applications on the web. The tools within the suite discover security holes and launch customized attacks. In addition, the Burp Suite automates repetitive functions while retaining the user’s choice when you need to have control of individualized options. “This rich tool investigates cross site scripting and other vulnerabilities using a proxy, providing transparency in relation to the fact that site sends to the server,” explains Payer.
Nonprofit, the OWASP ZAP offers manual and automatic scanning of web applications, both for beginners and for veterans in penetration testing. With open source, it is available on GitHub.
In turn, the Sqlmap automates the discovery of SQL Injection holes, exploiting these weaknesses and taking control of databases and underlying servers. The sqlmap can be installed on Linux Ubuntu within a virtual machine (VM).
The Kali Linux is a suite of pre-installed tools for penetration testing, security and forensics. “It has features for people with zero security knowledge,” says Saez.
Unlike most tools, which are usually signature based, the Jawfish – where Saez is a developer – using genetic algorithms. “It looks for things on the search context,” Saez scores. Based on search criteria, Jawfish looking for vulnerabilities.
About Administrador
