CAINE 3.0 - QUASAR Computer forensics Live CD Released

CAINE (Computer Aided INvestigative Environment) is an Italian GNU/Linux live distribution created as a project of Digital Forensics. Caine is a simple Ubuntu 12.04 customized for the computer forensics.

CAINE offers a complete forensic environment that is organized to integrate existing software tools as software modules and to provide a friendly graphical interface.

Objectives that CAINE aims:

• an interoperable environment that supports the digital investigator during the four phases of the digital investigation
• a user friendly graphical interface
• a semi-automated compilation of the final report

CAINE represents fully the spirit of the Open Source philosophy, because the project is completely open, everyone could take the legacy of the previous developer or project manager. The distro is open source, the Windows side (Wintaylor) is open source and, the last but not the least, the distro is install-able.

CHANGELOG CAINE 3.0 "Quasar"

• Kernel 3.2.0-31

ADDED:

• MATE 1.4 + LightDM
• iphonebackupanalyzer
• exiftool phil harvey
• tcpflow
• tshark
• john
• wireshark
• firefox
• vinetto
• mdbtool
• gdisk
• LVM2
• tcpdump
• Mobius
• QuickHash
• SQLiteBrowser
• FRED
• docanalyzer
• nerohistanalyzer
• knowmetanalyzer
• PEFrame
• grokEVT
• zenmap (nmap)
• blackberry tools
• IDevice tools

Download CAINE

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

Volatility 2.2 Released - Introduced Linux support (Intel x86, x64)

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

Windows Basic

• Current date, time, CPU count, CPU speed, service pack
• Current thread and idle thread
• Addresses of the KDBG, KPCR, DTB, PsActiveProcessHead, PsLoadedModuleList, etc

Processes

• List active processes (column or tree view)
• Scan for hidden or terminated _EPROCESS objects (using pool tags or _DISPATCHER_HEADER)
• Enumerate DLLs in the PEB LDR lists
• Rebuild/extract DLLs or EXEs to disk based on name, base address, or physical offset
• Print open handles to files, registry keys, mutexes, threads, processes, etc
• List security identifiers (SIDs) for processes
• Scan for cmd.exe command history and full console input/output buffers
• List process environment variables
• Print PE version information from processes or DLLs (file version, company name, etc)
• Enumerate imported and exported API functions anywhere in process or kernel memory
• Show a list of virtual and physical mappings of all pages available to a process
• Dump process address space to disk as a single file
• Analyze Virtual Address Descriptor (VAD) nodes, show page protection, flags, and mapped files
• Represent the VAD in tree form or Graphviz .dot graphs
• Dump each VAD range to disk for inspecting with external tools
• Parse XP/2003 event log records

Kernel Memory

• List loaded kernel modules and scan for hidden/unloaded module structures
• Extract PE files including drivers from anywhere in kernel memory
• Dump the SSDT for all 32- and 64-bit windows systems
• Scan for driver objects, print IRP major function tables
• Show devices and device tree layout
• Scan for file objects (can show deleted files, closed handles, etc)
• Scan for threads, mutex objects and symbolic links

GUI Memory

• Analyze logon sessions and the processes and mapped images belonging to the session
• Scan for window stations and clipboard artifacts (clipboard snooping malware)
• Scan for desktops, analyze desktop heaps and attached GUI threads
• Locate and parse atom tables (class names, DLL injection paths, etc)
• Extract the contents of the windows clipboard
• Analyze message hooks and event hooks, show the injected DLL and function address
• Dump all USER object types, pool tags, and flags from the gahti
• Print all open USER handles, associated threads or processes, and object offsets
• Display details on all windows, such as coordiates, window title, class, procedure address, etc
• Take screen shots from memory dumps (requires PIL)

Malware Analysis

• Find injected code and DLLs, unpacker stubs, and decrypted configurations, etc
• Scan process or kernel memory for any string, regular expression, byte pattern, URL, etc
• Analyze services, their status (running, stopped, etc) and associated process or driver
• Cross-reference memory mapped executable files with PEB lists to find injected code
• Scan for imported functions in process or kernel memory (without using import tables)
• Detect API hooks (Inline, IAT, EAT), hooked winsock tables, syscall hooks, etc
• Analyze the IDT and GDT for each CPU, alert on hooks and disassemble code
• Dump details of threads, such as hardware breakpoints, context registers, etc
• Enumerate kernel callbacks for process creation, thread creation, and image loading
• Display FS registration, registry, shutdown, bugcheck, and debug print callbacks
• Detect hidden processes with alternate process listings (6+ sources)
• Analyze kernel timers and their DPC routine functions

Networking

• Walk the list of connection and socket objects for XP/2003 systems
• Scan physical memory for network information (recover closed/terminated artifacts)
• Determine if listening sockets are IPv4, IPv6, etc and link to their owning processes

Registry

• Scan for registry hives in memory
• Parse and print any value or key cached in kernel memory, with timestamps
• Dump an entire registry hive recursively
• Extract cached domain credentials from the registry
• Locate and decrypt NT/NTLM hashes and LSA secrets
• Analyze user assist keys, the shimcache, and shellbags
• Crash Dumps, Hibernation, Conversion
• Print crash dump and hibernation file header information
• Run any plugin on a crash dump or hibernation file (hiberfil.sys)
• Convert a raw memory dump to a crash dump for opening in !WinDBG
• Convert a crash dump or hibernation file to a raw memory dump

Miscellaneous

• Link strings found at physical offsets to their owning kernel address or process
• Interactive shell with disassembly, type display, hexdumps, etc

Download Volatility 2.2

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

Androguard v1.5 : Reverse engineering & Malware analysis of Android applications

Androguard (Android Guard) is mainly a tool written in python to play with :

• Dex (Dalvik virtual machine) (.dex), and ODex
• APK (Android application) (.apk),
• Android's binary xml (.xml).

Androguard is available for Linux/MacOSX/Windows (python powered).

Change V1.5 :

- Session (save/load)

- Annotation

- Documentation

- Support of ARM

- Support of dex writing

- Disassembler/Decompiler(DAD)

Androguard has the following features :

• Map and manipulate (disassemble/decompile/modify) DEX/ODEX/APK files into full Python objects,
• Access to the static analysis of your code (basic blocks, instructions, permissions (with database from http://www.android-permissions.org/) ...) and create your own static analysis tool,
• Check if an android application is present in a database (malwares, goodwares ?),
• Open source database of android malware (this opensource database is done on my free time, of course my free time is limited, so if you want to help, you are welcome !),
• Diffing of android applications,
• Measure the efficiency of obfuscators (proguard, ...),
• Determine if your application has been pirated (plagiarism/similarities/rip-off indicator),
• Detection of ad/open source librairies (WIP),
• Risk indicator of malicious application,
• Reverse engineering of applications (goodwares, malwares),
• Transform Android's binary xml (like AndroidManifest.xml) into classic xml,
• Visualize your application with gephi (gexf format), or with cytoscape (xgmml format), or PNG/DOT output,
• Integration with external decompilers (JAD/DED/...)
• Dump the jvm process to find classes into memory.

You can find complete Tutorial here about usage.

Download Androguard v1.5

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

OllyDbg 2.01 Beta 2 Released

OllyDbg is a 32-bit assembler level analysing debugger for Microsoft Windows. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.

Changes made to OllyDbg:

• Correct reaction on MOV SS,anything; PUSHF depending on the preceding comparison
• Correct reaction on disassembling of JE vs. JZ depending on the preceding comparison
• Eliminated nasty crashes that happened on some computers while invoking menu, or pressing ALT, or on similar harmless actions.
• Plugin interface is slightly extended. Plugin API includes more than 500 functions, structures and variables.

Download Ollydbg

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

ASEF : Android Security Evaluation Framework

A researcher at Qualys has released a new tool designed to allow users even non-technical ones to evaluate the security and behaviors of the apps installed on their Android devices, Known as the Android Security Evaluation Framework.

Android Security Evaluation Framework - A S E F is designed and developed to simulate the entire lifecycle of an Android application in an automated virtual environment to collect behavioral data and perform security evaluations automatically over ‘n’ number of apps.

Android Security Evaluation Framework (ASEF) performs this analysis while alerting you about other possible issues. It will make you aware of unusual activities of your apps, will expose vulnerable components and help narrow down suspicious apps for further manual research.

ASEF is an Open Source tool for scanning Android Devices for security evaluation. Users will gain access to security aspects of android apps by using this tool with its default settings. An advanced user can fine-tune this, expand upon this idea by easily integrating more test scenarios, or even find patterns out of the data it already collects. ASEF will provide automated application testing and facilitate a plug and play kind of environment to keep up with the dynamic field of Android Security.

Download Android Security Evaluation Framework

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

PacketPig : Big Data Security Analytics Platform

PacketPig is an open source “big data” platform for analyzing full packet captures. "The idea of full packet capture has been likened to network TiVo, and largely discounted," said Michael Baker, CTO at Packetloop.

This open source tool was presented at this years BlackHat EU held in March. PacketPig is called so, because it has been created by a company called PacketLoop and Pig is the primary language used. It can be considered as a one stop shop for network security monitoring.

Baker said one challenge with analyzing large sets of data traditionally has been that as pcaps age, tools tend to aggregate the data, meaning that a minute-by-minute look at packets becomes averaged into an hour, and hours later rolled up into days or even months. "The key point is to not lose fidelity," he said.

Packetpig is built on Pig, which is a platform--programmed in a language called Pig Latin--for creating MapReduce jobs, a concept Google outlined in a 2004 research paper. The jobs spread problems involving large amounts of data across multiple nodes. In particular, Packetpig is a series of data-analysis jobs that run on Hadoop, an open-source implementation of MapReduce, to handle the replication of data across multiple nodes. These nodes could be anything from spare servers or compute time scrounged by the information security group to Amazon Simple Storage Service (Amazon S3).

List of PacketPig Pig Loaders:

1. PacketLoader() – opens packet captures and provides access to TCP, UDP and IP headers e.g. Source IP Address, Source Port, Destination IP Address, Destination Port.
2. SnortLoader() – wraps the Snort Intrusion Detection application allowing packet captures to be analysed across a Hadoop Cluster. The loader analyses packets and returns signature, priority, message, protocol and Source IP/Port, Destination IP/Port. It also produces a record for each alert triggered.
3. ConversationLoader() – links packets to their conversations or flows. The conversation start and end, the way the conversation ended, the number of packets, their size and delay can all be extracted through this loader.
4. DNSConversationLoader() – provides additional functionality for the deep packet inspection of DNS conversations.
5. HTTPConversationLoader() – provides additional functionality for the deep packet inspection of HTTP conversations.
6. ConversationFileLoader() – allows file metadata and files themselves to be extracted from conversations. The file name, extension, libmagic information as well as MD5, SHA1 and SHA256 hashes are returned through this loader. In addition the actual files themselves can be extracted and dumped.
7. FingerprintLoader() – a wrapper for p0f that allows it to operate across a Hadoop Cluster, giving you an operating system for each packet in a pcap.
8. PacketNgramLoader() – extracts data from each packet in a conversation and breaks it into an N-Gram. Unigram, Bigram and Trigrams are most commonly used however any integer can be passed to the loader.

These loaders are called Pig files and are written in PigLatin. Multiple loaders can be used to analyse data. The Packetpig Loaders are the building blocks for analysing full packet captures.

Download PacketPig

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

Andrubis - Analyze Unknown Android Applications

Andrubis is designed to analyze unknown apps for the Android platform (APKs). It has been brought to us by the guys at Iseclabs, who already have an awesome Windows executable scanner Anubis. Infact, it can be considered as an extension for Anubis.

Andrubis gives us an insight into various behavioral aspects and properties of a submitted app by employing both static and dynamic analysis approaches. During the dynamic analysis part an app is installed and run in an emulator – the Dalvik VM. In addition to the normal tracking of open, read and write events, network traffic operations and detection of dynamically registered broadcast receivers , taint analysis is also carried out to report on leakage of important data such as the IMEI. Not only that, cellphone specific events, such as phone calls and short messages sent are also captured by the Andrubis service.

Information is also obtained statically, without actually executing the Android application. Information related to the intent-filters declared by these components is also included.

In short, like the core-Anubis does for Windows PE executable’s, Andrubis executes Android apps in a sandbox and provides a detailed report on their behavior, including file access, network access, cryptographic operations, dynamic code loading and information leaks. An Andrubis static analysis yields information on e.g. the app’s activities, services, required external libraries and actually required permissions.

In order not to reinvent the wheel, Andrubis leverages several existing open source projects in addition to the Android SDK, such as:

1. DroidBox
2. TaintDroid
3. apktool
4. Androguard

To see how effective it is, an example report of the DroidKongFu.A Android malware, scanned via the Andrubis can be found here.

Get Andrubis here

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

Volatility Framework 2.1 RC1 Released

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

Changes in new version:

• Catch InvalidOffsetErrors gracefully. Fixes issue 280.
• Pylint the pyinstaller spec file.
• Move to the development version of pyinstaller (> 1.5.1)
• Remove unnecessary imports now we’re using the dev pyinstaller.
• Apply (maybe temporary) fixes to two UnicodeEncodeError exceptions in vadinfo and hivelist. fixes issue #295.
• Remove link to testsuite plugin, it doesn’t seem to be in the codebase any more
• Make better use of Plugin.is_valid_profile for blacklisting commands on unsupported profiles.
• Fix some typos in the connections.Connections class pydoc
• Convert connscan output to table_header/table_row. this should be done prior to 2.1 since table renders are a major new feature in 2.1
• Updated kdbgscan.
• Added tests for kdbgscan.
• Updated the scanning framework to not use the buffer address space.
• Added a caching address space for slow io systems such as windows. Various bug fixes and updates.
• Added a new plugin to concisely print the vad information (like windbg’s !vad).
• Convert dlldump, procexedump, and moddump to table_header/row output. Increases code sharing between the plugins. Adds more descriptive error messages when PE files cannot be dumped.
• Added 64 bit support to vtop/ptov/pfn plugins.
• Converted ldrmodules plugin. Added a 32bit pae implementation for vtop and pfn modules.
• Adding a new dtbscan module which detects hidden processes using their dtb.
• Added a RegDump module to dump registry hives for further processing by other tools (e.g. RegRipper). Update vad modules to use renderer.format().
• Initial support for windows 8 – currently only pslist works :-). See Issue 142.
• Prevent impscan from raising an IndexError when no imports are found. Fixes issue #300
• Fix a minor error in netscan, and pylint the rest of the recently changed code.
• Add in distorm3 support and unbuffered output for pyinstaller. Also minor pylint for setup.py.
• Fix the pyinstaller distorm3 hook documentation to be pyinstaller specific.

Download Volatility Framework

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

Peepdf : PDF analysis and creation and modification tool

Peepdf is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher could need in a PDF analysis without using 3 or 4 tools to make all the tasks. With peepdf it's possible to see all the objects in the document showing the suspicious elements, supports all the most used filters and encodings, it can parse different versions of a file, object streams and encrypted files. With the installation of Spidermonkey and Libemu it provides Javascript and shellcode analysis wrappers too. Apart of this it's able to create new PDF files and to modify existent ones.

Analysis:

• Decodings: hexadecimal, octal, name objects
• More used filters
• References in objects and where an object is referenced
• Strings search (including streams)
• Physical structure (offsets)
• Logical tree structure
• Metadata
• Modifications between versions (changelog)
• Compressed objects (object streams)
• Analysis and modification of Javascript (Spidermonkey): unescape, replace, join
• Shellcode analysis (sctest wrapper, Libemu)
• Variables (set command)
• Extraction of old versions of the document

Creation/Modification:

• Basic PDF creation
• Creation of PDF with Javascript executed wen the document is opened
• Creation of object streams to compress objects
• Embedded PDFs
• Strings and names obfuscation
• Malformed PDF output: without endobj, garbage in the header, bad header...
• Filters modification
• Objects modification

Download Peepdf

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

The Volatility Framework 2.0 : An advanced memory forensics framework

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

What's new in 2.0

• Restructured and depolluted namespace
• Usage and Development Documentation
• New Configuration Subsystem
• New Caching Subsystem
• New Pluggable address spaces with automated election
• New Address Spaces (i.e. EWF, Firewire)
• Updated Object Model and Profile Subsystems (VolatilityMagic)
• Support for Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7
• Updated Scanning Framework
• Volshell integration
• Over 40 new plugins!

Download The Volatility Framework 2.0

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

HexDive 0.2 Released - Now detects lots of new strings

New version of HexDive released. Author Added really lots of new strings so it should be picking up more juice from malicious samples.

New strings include:

• pcap
• libraries
• mime types
• charset encodings
• formatted strings patterns
• OS file names
• protocols
• IPs
• User agents
• information-stealing related keywords
• and more

Note, at this stage HexDive doesn’t search for any regexes (e.g. URLs/emails/etc ), but it is in the making, so stay tuned.

Download HexDive 0.2

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

Netzob 0.3.3 Released - Reverse Engineering Tool

Netzob is an opensource tool which supports the expert in its operations of reverse engineering, evaluation and simulation of communication protocols. Its main goals are to help security evaluators to:

• Assess the robustness of proprietary or unknown protocols implementation.
• Simulate realistic communications to test third-party products (IDS, firewalls, etc.).
• Create an open source implementation of a proprietary or unknown protocol.

Netzob supports the expert in a semi-automatic inferring process of any communication protocol. Hence, it includes the necessaries to passively learn the vocabulary of a protocol and to actively infer its grammar. The learnt protocol can afterward be simulated.

Official change log for Netzob 0.3.3:

• Graphical interface
• Visualization and encoding filters
• Mathematical filters (Base64, GZIP, BZ2)
• Dedicated Search View
• Preview of data rendering in contextual menu
• Support format visualization at the symbol level
• Partitioning
• Alignment and sequencing by field
• Execute alignment on specified symbols
• Split field by the right
• Allow the partitioning of messages with specified boundaries
• Allow partitioning at the project and symbol level
• Similarity score based on number of common dynamic elements
• Optimization of Needleman : don’t repeat the same computation twice
• Implement native UPGMA algorithm
• Grammar inference
• Infer the grammar of a network client
• Project/trace management
• Export / Import projects
• Importer for XML formated traces

In addition to the recently released Debian and Gentoo packages, a Windows installer has also been released! There sure are a lot of improvements going on with this project. Get documentation here
.

Download Netzob 0.3.3

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email

Revelo - The Javascript Deobfuscator

Revelo is not as full fledged as MalZilla. But I guess, doing what the now defunct MalZilla does is it’s purpose any way. Revelo automates some of the manual changes that are needed to de-obfuscate the script code. It is not a script debugger, just more like a set of tools to de-obfuscate scripts.

Revelo by writing the JavaScript with some user-based modifcations to an HTML file, opening the file inside of the tool, and extracting the de-obfuscated elements using the Internet Explorer engine. All this is done, while allowing the user to make choices based on his/her understanding of the obfuscated script.

Features of Revelo:

• Analyze a script quickly by loading a file or pasting in JavaScript code
• Includes several methods to de-obfuscate JavaScript
• Includes a built-in browser proxy which displays the URL of outgoing requests
• Displays the Document Object Model (DOM) elements
• Includes a packet sniffer which logs incoming and outgoing requests
• Includes a software firewall to prevent the program from accessing Internet content accidentally
• Ability to act as a web proxy to catch and block redirects
• Beautifies JavaScript code to make it more readable
• Ability to clear the browser cookies
• Ability to spoof the user-agent string

Download Revelo v0.3

Subscribe to our Daily Newsletter via email - Be First to know about Security and Penetration testing tools. or Join our Huge Hackers Community on Facebook , Google+ and Twitter .

Subscribe Top Hacker Stories via email