Requirements

“Turbodiff 1.01 beta release 1″ works with IDA starting from v5.0.

Instructions

For the binaries:
Download the plugin and store it at the directory “..\IDA\plugins”.

If you want to compile it on your own: We have compiled it and tested it using Borland C. For the free version of IDA Pro (4.9) you’ll need to first:

1. Generate the ida_free.lib library. To do this execute: “implib -c ida_free.lib ida_free.def”
2. Next, you must have the linker use this library.
3. Compile.

Comparing two files:

1. Open the first file to be compared with IDA and run /Option 1 (take info from this idb)/ from the plugin. Close.
2. Open the second file to be compared with IDA and run /Option 1 (take info from this idb)/ from the plugin.
   Use /Option 2 (compare with…)/ from the plugin, and when prompted to select a file, select the first file.
3. Chose if you want a log file to be genreated and run. Once finished a functions table will popup (watch Figure 1) describing results. The results are then saved for later usage.

You can download Turbodiff here:

IDA PRO v4.9 Sources and plugin (Free version)
IDA starting with version v5 Sources and plugin

Or read more here.

RATS scanning tool provides a security analyst with a list of potential trouble spots on which to focus, along with describing the problem, and potentially suggest remedies. It also provides a relative assessment of the potential severity of each problem, to better help an auditor prioritize. This tool also performs some basic analysis to try to rule out conditions that are obviously not problems.

As its name implies, the tool performs only a rough analysis of source code. It will not find every error and will also find things that are not errors. Manual inspection of your code is still necessary, but greatly aided with this tool.

Requirements

RATS requires expat to be installed in order to build and run. Expat is often installed in /usr/local/lib and /usr/local/include. On some systems, you will need to specify –with-expat-lib and –with-expat-include options to configure so that it can find your installation of the library and header. Expat can be found here.

You can download RATS here:

Source Code: rats-2.3.tar.gz
Windows Binary: rats-2.3-win32.zip

Or read more here.

4f’s purpose is to find vulnerabilities in code that parses file formats including configuration files.

4f uses specialized modules for fuzzing code that interprets file formats. Several modules are included and more can be written to follow other file formats.

A module system is in place for fuzzing any file format you like as long as you know its specification

Custom debugger gathers crucial debugging information on crash, logs it, then continues fuzzing.

Usage

USAGE DETAILS

USAGE:   ./4f <-T /usr/bin/target> <-M #> [-N fuzz.conf]
         [-A ARGS] [-R /output] [-L log.txt] [-C] [-D]

INFO:    [-O Fuzzing Oracle] [-S Modules Available]

You can download 4f here:

4f.tar.gz

Or read more here.

Usage

Graudit supports several options and tries to follow good shell practices. For a list of the options you can run graudit -h or see below. The simplest way to use graudit is;

graudit /path/to/scan

You can download Graudit v1.1 here:

graudit-1.1.tar.bz2

Or read more here.

Vulnerabilities

• SQL Injection
• XSS (Cross Site Scripting)
• LFI (Local File Inclusion)
• RFI (Remote File Inclusion)
• Command Execution
• Upload Script
• Login Brute Force

Changes

• Added Acunetix scan report.
• All links use http://hiderefer.com to hide referrer header.
• Updated/added ‘more info’ links.
• Moved change log info to CHANGELOG.txt.
• Fixed the exec.php UTF-8 output.
• Moved Help/View source buttons to footer.
• Fixed phpInfo bug.
• Made DVWA IE friendly.
• Fixed html bugs.
• Improved README.txt and fixed typos.
• Made SQL injection possible in sqli_med.php.

WARNING

It should come as no shock..but this application is damn vulnerable! Do not upload it to your hosting provider’s public html folder or any working web server as it will be hacked. It’s recommend that you download and install XAMP onto a local machine inside your LAN which is used solely for testing.

You can download DVWA 1.0.4 here:

dvwa_v1.0.4.zip

Or read more here.

Quick Info

FSF is a plug-in based freakin’ simple fuzzer for fuzzing web applications and scraping data.

It supports some basic stuff and is missing some features however it has got some advanced RegEx capturing features for scraping data out of web applications.

It’s still in early stage of development so don’t expect too much.

Why bring yet another fuzzer into this cruel world?

The author was trying to fuzz something and after spending about 2-3 hours about 3-4 different terribly designed fuzzers he thought knocking up his own would be better.

Don’t use if you….

• Want a fuzzer where you can control the raw HTTP request
• Need some crazy features such as fuzzing multiple locations at a time

Use if you need a fuzzer…

• That allows to take advantage of RegEx with the full power for scraping data (this is quite useful while exploiting SQL Injections, gathering data, looking for some hidden resource or trying to enumerate all valid “user id”s)
• Simple to run and easy to use
• Which makes it easy to write your own fuzzing modules
• With simple and compact .NET code

You can download fm-fsf here:

FSF-7.1.0.0.tar.gz

Or read more here.

Fiddler is a Web Debugging Proxy which logs all HTTP(S) traffic between your computer and the Internet. Fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and “fiddle” with incoming or outgoing data. Fiddler includes a powerful event-based scripting subsystem, and can be extended using any .NET language.

Fiddler is freeware and can debug traffic from virtually any application, including Internet Explorer, Mozilla Firefox, Opera, and thousands more.

If you want some info on how to use Fiddler for debugging you can check here:

Fiddler Can Make Debugging Easy

You can download Fiddler here:

Fiddler2Setup.exe

Or read more here.

Charles can act as a man-in-the-middle for HTTP/SSL communication, enabling you to debug the content of your HTTPS sessions.

Charles simulates modem speeds by effectively throttling your bandwidth and introducing latency, so that you can experience an entire website as a modem user might (bandwidth simulator).

Charles is especially useful for Adobe Flash developers as you can view the contents of LoadVariables, LoadMovie and XML loads. Charles also has native support for Flash Remoting (AMF0 and AMF3).

Charles is also useful for XML development in web browsers, such as AJAX (Asynchronous Javascript and XML) and XMLHTTP, as it enables you to see the actual XML that is flowing between the client and the server. Charles natively supports JSON, JSON-RPC and SOAP; displaying each in a simplified tree format for easy viewing and debugging.

You can download Charles Proxy here:

Windows – charles_setup.exe
Linux / Unix – charles.tar.gz
Mac OS X – charles_macosx.zip

Or read more here.

They have released a new AND open-source tool to make debugging easier, it gives developers a lot of help during the release cycle to build more secure software. Mostly because it takes the legwork and labour intensive tasks and semi-automates them leaving the developer to concentrate on more important stuff.

At least something from Microsoft we can applaud!

Microsoft on Friday released an open-source program designed to streamline the labor-intensive process of identifying security vulnerabilities in software while it’s still under development.

As its name suggests, !exploitable Crash Analyzer (pronounced “bang exploitable crash analyzer”) combs through bugs that cause a program to seize up, and assesses the likelihood of them being exploited by attackers. Dan Kaminsky, a well-known security expert who also provides consulting services to Microsoft, hailed the release a “game changer” because it provides a reliable way for developers to sort through thousands of bugs to identify the several dozen that pose the greatest risk.

“Microsoft has taken years of difficulties with security vulnerabilities and really condensed that experience down to a repeatable tool that takes a look at a crash and says ‘You better take a look at this,’” Kaminsky told The Reg. “What makes !exploitable so fascinating is that it takes at least the first level of this knowledge and packages it up into something that can be in the workflow.”

It’s a great idea, as surely there are a lot of conditions that cause an application to hang – but the majority of them will pose no security risk other than a denial of service locally (which is quite pointless). The tool will point out those bugs that are exploitable and therefore can be considered critical issues.

I hope developers harness this app and really start to produce more secure code.

Over the past five years, Microsoft has made a fair amount of progress hardening its operating systems and applications against the most-common security threats. Protections such as Address Space Layout Randomization and cross-site scripting defenses have been added to later versions of Windows and Internet Explorer, respectively. And the company has generally managed to exorcise its programs of dangerous vulnerabilities before they can be exploited by attackers.

Now, Microsoft wants to help secure third-party applications that run on top of Windows. Last year, the company released a threat-modeling tool and other resources designed to help software developers kick-start secure development lifecycle programs in their organizations. The idea was to package the security experience Microsoft has attained so it can serve as a sort of template for other companies.

The release of !exploitable, which was announced at the CanSecWest security conference in Vancouver, British Columbia, is a continuation of that effort. It’s a Windows debugger extension that’s used during fuzz testing, when testers test the stability and security of an application by throwing unexpected data at it.

The tool creates hashes to ensure each crash is unique then rates them according to how exploitable it is – Exploitable, Probably Exploitable, Probably Not Exploitable or Unknown.

There is currently an x86 and an x64 version availalble.

As wisely said, it’s about the signal to noise ratio and this tool can really help you weed out the noise and get to the important issues.

You can download the application here:

!exploitable Crash Analyzer – MSEC Debugger Extensions

Source: The Register

Native Client is an open-source research technology for running x86 native code in web applications, with the goal of maintaining the browser neutrality, OS portability, and safety that people expect from web apps. We’ve released this project at an early, research stage to get feedback from the security and broader open-source communities. We believe that Native Client technology will someday help web developers to create richer and more dynamic browser-based applications.

About the contest

Do you think it is impossible to safely run untrusted x86 code on the web? Do you want a chance to impress a panel of some of the top security experts in the world? Then submit an exploit to the Native Client Security Contest and you could also win cash prizes, not to mention bragging rights.

What is the contest

This is a contest with the goal to test the security of Native Client.

To participate, you will need to:

• Register yourself (or your team)
• Download our latest build
• Join the NaCl discussion group
• Report the exploits you find to our team

When

You can register for the contest on Wednesday, February 25th 2009. The contest will end on Tuesday, May 5th 2009 at 11:59:59 Pacific time. Sign up early to start reporting exploits as soon as possible.

What’s in it for you

Participating in the contest means that you will engage with early stage research technology. In addition, your work will be reviewed by a panel of security experts from some of the world’s most renowned universities, chaired by Edward Felten of Princeton University. Finally, by submitting high impact bug(s), you will also have the chance to compete to win one of our five cash prizes, as well as the recognition of your peers.

Eligible participants that are ranked in the top 5 positions of the competition by Judges will receive the following awards in U.S. Dollars based on their rank:

1st prize: $8,192.00
2nd prize: $4,096.00
3rd prize: $2,048.00
4th prize: $1,024.00
5th prize: $1,024.00

Winning Entries will be announced on or about December 7th.

Details at:

http://code.google.com/contests/nativeclient-security/