Author Archives: securityresearch

The social engineering toolkit v1.0 release, code-named Devolution, is a suite of custom tools solely focusing on attacking the human element of penetration testing. Social Engineer Toolkit (SET) uses Backtrack as the framework for penetration testing. SET has been written by David Kennedy, who is also known by the nickname ReL1K. Complete details on the Social Engineer Toolkit are available at http://www.social-engineer.org

In a pen-testing scenario, alongside uncovering vulnerabilities in the hardware and software systems and exploiting them, the most effective of all is penetrating the human mind to extract the desired information. Such devious techniques are known as social engineering, and computer-based software tools to facilitate this form the basis of the Social Engineer Toolkit.

This social engineering toolkit tutorial covers backdooring of executables, and also evading antivirus software, which is implicitly handled by a few scripts within this framework. This SET tutorial also touches upon a scenario in pen testing to ascertain whether employees of the organization are aware of the security threats they face via the art of social engineering.

Dig down to the bottom of the page to read the whole article unregistered on Techtarget on this link:

http://searchsecurity.techtarget.in/tutorial/Social-Engineer-Toolkit-SET-tutorial-for-penetration-testers

Cheers

3ps!l0nLaMbDa

In this Metasploit guide series, we have so far covered the basics of the Metasploit Framework (Msf); usage details of the meterpreter post-exploitation tool to create exploits that evade detection; as well as database configuration in Metasploit and post-exploitation phases.

This fourth and final installment of our Metasploit guide takes a look at Armitage, the cyber attack management tool for Metasploit. Armitage provides a GUI for the console-based framework that we covered in the previous three parts of this Metasploit guide. Let us explore exploiting of a vulnerable target using Armitage.

Dig down to the bottom of the page to read the whole article unregistered on Techtarget on this link:

http://searchsecurity.techtarget.in/tutorial/Metasploit-guide-4-Armitage-cyber-attack-management-GUI

Cheers

3ps!l0nLaMbDa

Hi,

Earlier in this Metasploit tutorial series, we covered the basics of the Metasploit Framework (Msf) in Part 1; created a simple exploit on a target system, and used payloads to achieve specific results. In Part 2, we explored usage of details of the meterpreter post-exploitation tool to create exploits that evade detection. 

In this installment of our Metasploit tutorial, we take a detailed look at database configuration in Metasploit, and also touch upon the different post-exploitation phases.

Dig down to the bottom of the page to read the whole article unregistered on Techtarget on this link:

http://searchsecurity.techtarget.in/tip/Metasploit-tutorial-3-Database-configuration-post-exploit-affairs

Cheers

3ps!l0nLaMbDa

In Part I of our Metasploit tutorial, we covered the basics of the Metasploit Framework (MsF), created a simple exploit on a target system, and used payloads to achieve specific results. The disadvantage of using specific payloads is that alarms may be triggered when a new process starts in the target system. Ideally, a payload should avoid creation of a new process, containing all activity within the scope.

Dig down to the bottom of the page to read the whole article unregistered on Techtarget on this link:

http://searchsecurity.techtarget.in/tip/Metasploit-tutorial-part-2-Using-meterpreter

Cheers

3ps!l0nLaMbDa

The Metasploit Framework (Msf) is a free, open source penetration testing solution developed by the open source community and Rapid7. This Metasploit tutorial covers the basic structure of Metasploit and different techniques of information gathering and vulnerability scans using this tool. Metasploit eliminates the need for writing of individual exploits, thus saving considerable time and effort.

The use of Metasploit ranges from defending your own systems by breaking into them, to learning about vulnerabilities that pose a real risk. Download Metasploit from http://www.metasploit.com to maximize the learning from this metasploit tutorial.

Dig down to the bottom of the page to read the whole article unregistered on Techtarget on this link:

http://searchsecurity.techtarget.in/tip/Metasploit-tutorial-part-1-Inside-the-Metasploit-framework

Cheers

3ps!l0nLaMbDa

Recently, my 3rd article got published in a security portal – searchsecurity.techtarget.in.

An overview:

It’s essential to know the difference between a bot and botnet before you can identify suitable botnet detection techniques and tools. While an autonomous program automatically performing tasks in the absence of a real user is known as a bot, a network of autonomous programs capable of acting on instructions is known as botnet. A few examplesof botnets include: Storm, Kraken, Conficker and Zeus, among others.

As botnets continue to gain momentum in the form of spam bots, click fraud, large-scale identity thefts and proxy nets and a large-scale distributed denial of service (DDoS) attacks, it’s proving to be a challenge to defend against these intrusive autonomous programs. Generally, a botnet may display following behavior patterns like signature-based, anomaly-based, DNS-based and mining-based. This tip discusses how to effectively use various botnet detection techniques and tools.

For the full article : Kindly click on the link below

http://searchsecurity.techtarget.in/tip/Four-handy-botnet-detection-techniques-and-tools-A-tutorial

Thank You

3ps!l0nlAmBdA