Hi i have one question that i need suggestion from you all
I am studying computer security and i need to make the presentation one security tool
any interesting tools about security...
migrated from stackoverflow.com Aug 1 '09 at 13:00
This question came from our site for professional and enthusiast programmers.
I would use Scapy for your presentation. Scapy is python, so people in the audience are likely to know the language, and if they don't, they can probably read it if they know other languages.
More importantly, Scapy would be particularity good because you can craft packets layer by layer (OSI layers) so it will be easy to tie your examples conceptually to the explanations. See the first link in the slides section of Scapy link above for an example of how well this tool can fit with presentations.
Also, since it is a multipurpose tool, you can demonstrate both sniffing ( like wireshark ) and packet crafting.
insecure.org has held a couple of polls on network security tools. The results are maintained at http://sectools.org/ and give details and locations of a range of popular, widely-used tools. Rather than just listing names it gives some background as to why the tools are used.
Do bear in mind that the use (or even the downloading or possession?) of such tools may be illegal or contrary to the AUP (acceptable usage policy) of hosts or networks over which the tools are used.
In addition to mas' comment about insecure.org, you might try out securityfocus.com - they've got a list of tools, too.
But, more than that, what are you really trying to do? There are many, many security tools, and each does something different. Do you want tools to benchmark the security of a system, or to meet a benchmark? If so, you might try NIST's FDCC ( http://nvd.nist.gov/fdcc/index.cfm ). Are you trying to check the security of Unix passwords? Jack The Ripper is an oldie. What about Windows passwords? Then you'd want l0phtcrack. Or if you are testing the security of a web application, you would want a scanner like WebInspect or Cenzic Hailstrom - or you might use a proxy like Google's Ratproxy or OWASP's WebScarapb or Burp Proxy (not sure who offers that one). Are you trying to scan a whole machine - or a whole network - and see what's on, and what's got vulnerabilities? Nessus and NMap are good for that.
If you can narrow down your question a bit, people in the know can offer better suggestions.
Here are three open source security related software.
nessus: General purpose vulnerability scanner, taking basically an antivirus approach to security vulnerabilities
mod_security: Web application firewall, very flexible and performant
mod_evasive: Allows to configure Apache to provide evasive action in the event of an HTTP DoS or DDoS attack or brute force attack. It is also designed to be a detection and network management tool
I've liked Nessus, used in conjunction with tools like Wireshark and Nmap to find unusual behavior on the network.
tools like GLTail can give some nice visualizations of your network; that way, you can become familiar enough with "expected" behavior that if something is amiss you may spot it.
Checksums on Unix systems can be handy using tools like Tripwire and Samhain to maintain file integrity, but you do have to maintain them since updates will trigger alerts.
Another name that likes popping up for exploit checking is the metasploit framework.
Hope these help you in your presentation...