Logo

User2sid and Sid2user are two small utilities for Windows NT, created by Evgenii Rudny, that allow the administrator to query the SAM to find out a SID value for a given account name and vice versa. User2sid.exe can retrieve a SID from the SAM (Security Accounts Manager) from the local or a remote machine and Sid2user.exe can then be used to retrieve the names of all the user accounts and more. These utilities do not exploit a bug but call the functions; LookupAccountName and LookupAccountSid respectively. These tools can be called against a remote machine without providing logon credentials except those needed for a null session connection. These tools rely on the ability to create a null session in order to work.

Source: http://www.windowsecurity.com/whitepapers/Windows-Enumeration-USER2SID-SID2USER.html
Download: http://securityoverride.com/infusions/pro_download_panel/download.php?did=24

We all know that by using the Windows delete key and removing them from the trash is not going to be sufficient as I have previously written in one of my posts Recovering Deleted Files and Partitions.  SDelete is a tool that is capable of preventing these tools from recovering them!  Mark Russinovich tells us more about SDelete.

"The only way to ensure that deleted files, as well as files that you encrypt with EFS, are safe from recovery is to use a secure delete application. Secure delete applications overwrite a deleted file's on-disk data using techiques that are shown to make disk data unrecoverable, even using recovery technology that can read patterns in magnetic media that reveal weakly deleted files. SDelete (Secure Delete) is such an application. You can use SDelete both to securely delete existing files, as well as to securely erase any file data that exists in the unallocated portions of a disk (including files that you have already deleted or encrypted). SDelete implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M, to give you confidence that once deleted with SDelete, your file data is gone forever."

Source: http://technet.microsoft.com/en-us/sysinternals/bb897443

Snort® is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Combining the benefits of signature, protocol, and anomaly-based inspection, Snort is the most widely deployed IDS/IPS technology worldwide. With millions of downloads and more than 300,000 registered users, Snort has become the de facto standard for IPS.

Source: http://www.snort.org/

Wireshark is one of the tools that help you identify incoming and outgoing packets be it UDP or TCP level, ICMP or IP level.  Wireshark is a tool that intercepts packets and analyze them.  One of the helpful tool that helped me analyze how website POST GET works for my projects, it is considered user friendly thanks to its Graphical User Interface.  The GUI of Wireshark is one of its strong points.  You are able to look at a list of tens and thousands of packets and filter them according to your need with conditional statements.  Wireshark is capable of running in both Linux and Windows.

hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

Nirsoft is a website where you can find utilities for nearly every possible need in computing!  Doesn't matter whether you're a programmer, network administrator, forensics specialist or a nobody, Nirsoft provide tools that are useful for everyone.  You can find password recovery tools (where hackers usually use them for their malicious intent), or system tools where you can view detailed information of your computer (although you would require certain knowledge to understand them).

Visit NirSoft here.

Do you know what Metasploit is?  Have you ever used it?  Metasploit is one of the most useful penetration testing tool used by security specialists to look for vulnerabilities in a system.  If you are a hacker, this is a must learn tool for you.  If you are a penetration tester, this is a must have tool for you to find weaknesses in your own system and prevent hackers from entering.  Metasploit works in both Windows and Linux, although i believe most of the users would be Windows, professionals often use Linux for this task.  Visit their homepage here.  Speaking of the word hacker, i was enlighten by one of my professors in my university few days back, let me write it out in a new post :).

DBAN or Darik's Boot and Nuke software is a great deal for erasing any hard drive you want the quickest.  As mentioned in one of the previous post and it's homepage if you saw, it is basically installed on a CD or DVD.  However as convenient as it can be, it is possible to install DBAN on a pendrive!  In this post, you will be guided from top to bottom on how to setup your own pendrive DBAN.

Got an emergency?  Have any password or sensitive information stored on your hard drive and you need it erased immediately?  Download DBAN or Darik's Boot and Nuke, the ultimate software for wiping your hard drive!  Burn DBAN's iso file onto a CD and boot it on BIOS and see the magic happen... entire Windows gone!

Unleash your Creativity!

Powerful Set of Free Tools

• Microsoft® Visual Basic® 2010 Express is ideal for the developer learning to program on Microsoft® Windows®.


• Microsoft® Visual C#® 2010 Express offers a great combination of power and productivity for Windows developers building on .NET.


• Microsoft® Visual C++® 2010 Express provides developers the horsepower with a finer degree of control than the other Visual Studio Express productions.

• Visual Studio® 2010 Express supports the new .NET Framework 4.


• Visual Studio® 2010 Express products have a new integrated development environment (IDE) including a new Windows Presentation Framework code editor.


• In this new release, Visual Studio® 2010 Express gains multi-monitor support as well as part of the new IDE.


• Unique to Visual Studio® 2010 Express is a new streamlined user experience that focuses on the most common commands by hiding some of the more advanced menus and toolbars. These are easily accessible by users via the Tools / Settings menu.


• Visual Studio® 2010 Express offers a new Start Page.

The Windows NT and Windows 2000 Resource Kits come with a number of command-line tools that help you administer your Windows NT/2K systems. Over time, I've grown a collection of similar tools, including some not included in the Resource Kits. What sets these tools apart is that they all allow you to manage remote systems as well as the local one. The first tool in the suite was PsList, a tool that lets you view detailed information about processes, and the suite is continually growing. The "Ps" prefix in PsList relates to the fact that the standard UNIX process listing command-line tool is named "ps", so I've adopted this prefix for all the tools in order to tie them together into a suite of tools named PsTools.

Always wondered which tool is best as a USB Stealer?  Try out USB Hacksaw, one of the commonly known utility for this task!  If you're trying this out, find a U3 pendrive for top performance (instant plug and steal).

Source: USB Hacksaw - Hak5 Wiki

Nmap ("Network Mapper") is a free and open source (license) utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are avalable for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), and a utility for comparing scan results (Ndiff).

Nmap was named “Security Product of the Year” by Linux Journal, Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in eight movies, including The Matrix Reloaded, Die Hard 4, and The Bourne Ultimatum.

Nmap is ...

• Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), OS detection, version detection, ping sweeps, and more. See the documentation page.


• Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.


• Portable: Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more.


• Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -v -A targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.


• Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the license.


• Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, tutorials, and even a whole book! Find them in multiple languages here.


• Supported: While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the Nmap mailing lists. Most bug reports and questions should be sent to the nmap-dev list, but only after you read the guidelines. We recommend that all users subscribe to the low-traffic nmap-hackers announcement list. You can also find Nmap on Facebook and Twitter. For real-time chat, join the #nmap channel on Freenode or EFNet.


• Acclaimed: Nmap has won numerous awards, including "Information Security Product of the Year" by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the press page for further details.


• Popular: Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities.

There was once where i was stucked looking for a site which contains all the encryption and decryption process for most of the common available encryption algorithm.  I recently found it from a tutorial on HackForums and thought of sharing it here as well as keeping it close to myself.  Although it is common on HackForums i don't hang around there much though so i kind of forgot the site.

http://www.crypo.com/ is the website to all your cryptography needs.

This source code below converts a text file with binaries into a text file with hexadecimals. Imagine we have a file of binaries called "hello.bin", we are going to convert it into hexadecimals and write it into a file called "hello.com".

hello.bin

[code]
10110100 00001001
10111010 00001001 00000001
11001101 00100001
11001101 00100000
01101000 01100101 01101100 01101100 01101111 00100100
[/code]

Concept (in terms of ASM)

[code]
mov ah,09
mov dx,0109
int 21
int 20
db "hello$"
[/code]

hello.com

[code]
B4 09 BA 09 01 CD 21 CD 20 68 65 6C 6C 6F 24
[/code]

where you can see how the binaries, hexadecimals and ASM are linked.

[code]
10110100 = B4 = mov ah
00001001 = 09 = 09
[/code]

What "hello.com" does when ran is it prints the word "hello" and exits. Generally this code is a converter but it has given me a further insight of what assembly would look like and how the machine language works now. The source code is as below and it is done in C language (but you would need to write the filename as .cpp instead of .c since the program was not programmed according the C proper structure whereby it should be defining variables before statements).

Source code

[code]
#include <stdio.h>
#include <stdlib.h>

void help(char* fname) {
printf(
"Code programs in binary - by Jakash3\n"
"Usage: %s outfile infile"
"Notes:\n"
" infile = Text file containing ascii 1's and 0's.\n"
" 8 bits per byte, all other characters\n"
" and whitespace ignored.\n"
" outfile = Name of program to create and write to.\n",
fname
);
exit(1);
}

int main(int argc, char** argv) {
if (argc!=3) help(argv[0]);
FILE *dst, *src;
dst = fopen(argv[1],"wb");
if (!dst) { printf("Could not create or truncate %s\nQuitting...",argv[1]); return 1;}
src = fopen(argv[2],"r");
if (!src) { printf("Could not open %s\nQuitting...",argv[2]); return 1;}
char c, byte=0;
int i=0, count=0;
while (!feof(src)) {
if (i==8) { fwrite(&byte,1,1,dst); byte=0; i=0; count++; }
fread(&c,1,1,src);
switch (c) {
case '1':
byte |= ((c=='1') << (7-i));
case '0':
i++;
}
}
fclose(src);
if (!fclose(dst))
printf("Wrote %d bytes to %s\n",count,argv[1]);
return 0;
}
[/code]

Download binary (.exe).

This code was written by jakash3 from Leetcoders.org
* Original link here.

Well i was working on something which requires this so i guess this would come in handy for anyone that needs it, it accepts text to be encrypted as well as files.

Download

It does not belong to me however it was found on the internet so credits belongs to the owner.

Originally released here - HackForums

Download link - MediaFire

This application is not free forever, for purchase please go here.

Please provide feedback or any bugs found to genesisdatabase@gmail.com

Functions

Download