sectool – Security Audit Tool & IDS


sectool is a security tool that can be used both as a security audit as well as a part of an intrusion detection system. It consists of set of tests, library and textual/graphical frontend. Tests are sorted into groups and security levels. Administrators can run selected tests, groups or whole security levels.

Security Levels

  1. Naive – pretty basic and short set of tests
  2. Desktop – set of tests prepared to run on box not connected to internet
  3. Network – standard client machine connected to internet
  4. Server – network server
  5. Paranoid – bunch of tests for paranoid admins

The tests print several type of messages during their execution. “Warning” and “Error” messages are used to inform about discovered security risks.

  • warning – something that admin should know about
  • error – issues that should be fixed

Then there are another two messages: “Hint” and “Info”. These two are not print by default, so they need to be turned on.

  • hint – helps to find a way how to resolve discovered issue
  • info – provides information what does the test do at the moment

Test Results

Every test run is finished with one of these results:

  • PASS – Everything went OK, no security risks were discovered
  • WARNING – only warning messages were print
  • ERROR – at least one security issue was discovered
  • FAIL – internal test problem appears, test can’t be run

You can download sectool here:

sectool-0.9.4.tar.bz2

Or read more here.

Posted in: Countermeasures, Security Software

, , , ,


Latest Posts:


GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.


Comments are closed.