# data[].attributes.body
thanks !!

# data[].attributes.body
Thank you very much for your packet tracers!!!!!! We love you

# data[].attributes.body
Set your permissions correctly

# data[].attributes.body
November 3, 2017

# data[].attributes.body
October 27, 2017

# data[].attributes.attachment_link.readable_text
One reason companies can't find the cybersecurity professionals they need is that there just aren't many true experts. If you want to be one, here's the kind of skills and personal traits you need.

Pages: 1 2 3 4 5 6

# data[].attributes.attachment_link.title
Six Skills You Need to Succeed in Cybersecurity - Dice Insights

# data[].attributes.attachment_link.description
One reason companies can't find the cybersecurity professionals they need is that there just aren't many true experts. If you want to be one, here's the kind of skills and personal traits you need. Pages: 1 2 3 4 5 6

# data[].attributes.body
October 27. 2017

# data[].attributes.attachment_link.description
In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council (FFIEC) developed the Cybersecurity Assessment Tool (Assessment) to help institutions identify their risks and determine their cybersecurity preparedness. The Assessment provides a repeatable and measurable process for financial institutions to measure their cybersecurity preparedness over time.

# data[].attributes.body
October 27, 2017

# data[].attributes.attachment_link.readable_text
Short Bytes: Fossbytes has prepared a useful list of the best hacking tools of 2017 based upon industry reviews, your feedback, and its own experience. This list will tell you about the best software used for hacking purposes featuring port scanners, web vulnerability scanner, password crackers, forensics tools and social engineering tools.
We have compiled this list of top hacking tools of 2017 with their best features and download links. Read about them, learn how to use them and share your reviews to make this list better.
Disclaimer: Fossbytes is publishing this article just for educational purposes and we don't promote malicious practices.
1. Metasploit | Best Hacking Tools Of 2017

Rather than calling Metasploit a collection of exploit tools, I'll call it an infrastructure that you can utilize to build your own custom tools. This free tool is one of the most popular cybersecurity tool around that allows you to locate vulnerabilities at different platforms. Metasploit is backed by more than 200,000 users and contributors that help you to get insights and uncover the weaknesses in your system.

This top hacking tool package of 2017 lets you simulate real-world attacks to tell you about the weak points and finds them. As a penetration tester, it pin points the vulnerabilities with Nexpose closed-loop integration using Top Remediation reports. Using the open source Metasploit framework, users can build their own tools and take the best out of this multi-purpose hacking tool.

Supported platforms and download:

Metasploit is available for all major platforms including Windows, Linux, and OS X.
Read more here and find download link.
2. Acunetix WVS | Best Hacking Tools Of 2017

Acunetix is a web vulnerability scanner (WVS) that scans and finds out the flaws in a website that could prove fatal. This multi-threaded tool crawls a website and finds out malicious Cross-site Scripting, SQL injection, and other vulnerabilities. This fast and easy to use tool scans WordPress websites from more than 1200 vulnerabilities in WordPress.

Acunetix comes with a Login Sequence Recorder that allows one to access the password protected areas of websites. The new AcuSensor technology used in this tool allows you to reduce the false positive rate. Such features have made Acunetix WVS a preferred hacking tools that you need to check out in 2017.

Supported platforms and download:

Acunetix is available for Windows XP and higher.
Read more here and find download link.
3. Nmap | Best Hacking Tools Of 2017

Nmap - also known as Network Mapper - falls in the category of a port scanner tool. This free and open source hacking tool is the most popular port scanning tool around that allows efficient network discovery and security auditing. Used for a wide range of services, Nmap uses raw IP packets to determine the hosts available on a network, their services along with details, operating systems used by hosts, the type of firewall used, and other information.

Last year, Nmap won multiple security products of the year awards and was featured in multiple movies including The Matrix Reloaded, Die Hard 4, and others. Available in the command line, Nmap executable also comes in an advanced GUI avatar.

Supported platforms and download:

Nmap is available for all major platforms including Windows, Linux, and OS X.

Read more here and find download link.

Also Read: Best Hacking Apps For Android Phones

4. Wireshark | Best Hacking Tools Of 2017

Wireshark is a well-known packet crafting tool that discovers vulnerability within a network and probes firewall rule-sets. Used by thousands of security professionals to analyze networks and live pocket capturing and deep scanning of hundreds of protocols. Wireshark helps you to read live data from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others.

This free and open source tool was originally named Ethereal. Wireshark also comes in a command-line version called TShark.

Supported platforms and download:

This GTK+-based network protocol analyzer runs with ease on Linux, Windows, and OS X.

Read more here and find download link.

5. oclHashcat | Best Hacking Tools Of 2017

If password cracking is something you do on daily basis, you might be aware of the free password cracking tool Hashcat. While Hashcat is a CPU-based password cracking tool, oclHashcat is its advanced version that uses the power of your GPU.

oclHashcat calls itself world's fastest password cracking tool with world's first and only GPGPU based engine. For using the tool, NVIDIA users require ForceWare 346.59 or later and AMD users require Catalyst 15.7 or later.

This tool employs following attack modes for cracking:

Straight

Combination

Brute-force

Hybrid dictionary + mask

Hybrid mask + dictionary

Mentioning another major feature, oclHashcat is an open source tool under MIT license that allows an easy integration or packaging of the common Linux distros.

Supported platforms and download:

This useful password cracking tool can be downloaded in different versions for Linux, OSX, and Windows.
Read more here and find download link
6. Nessus Vulnerability Scanner | Best Hacking Tools Of 2017

This top free security tool of 2017 works with the help of a client-server framework. Developed by Tenable Network Security, the tool is one of the most popular vulnerability scanners we have. Nessus serves different purposes to different types of users - Nessus Home, Nessus Professional, Nessus Manager and Nessus Cloud.

Using Nessus, one can scan multiple types of vulnerabilities that include remote access flaw detection, misconfiguration alert, denial of services against TCP/IP stack, preparation of PCI DSS audits, malware detection, sensitive data searches etc. To launch a dictionary attack, Nessus can also call a popular tool Hydra externally.

Apart from the above mentioned basic functionalities, Nessus could be used to scan multiple networks on IPv4, IPv6, and hybrid networks. You can set scheduled scan to run at your chosen time and re-scan all or a subsection of previously scanned hosts using selective host re-scanning.

Supported platforms and download:

Nessus is supported by a variety of platforms including Windows 7 and 8, Mac OS X, and popular Linux distros like Debian, Ubuntu, Kali Linux etc.
Read more here and find download link
7. Maltego | Best Hacking Tools Of 2017

Maltego is an open source forensics platform that offers rigorous mining and information gathering to paint a picture of cyber threats around you. Maltego excels in showing the complexity and severity of points of failure in your infrastructure and the surrounding environment.

Maltego is a great hacker tool that analyzes the real world links between people, companies, websites, domains, DNS names, IP addresses, documents and whatnot. Based on Java, this tool runs in an easy-to-use graphical interface with lost customization options while scanning.

Supported platforms and download:

Maltego security tool is available for Windows, Mac, and Linux.
Read more here and find download link
8. Social-Engineer Toolkit | Best Hacking Tools Of 2017

Also featured on Mr. Robot, TrustedSec's Social-Engineer Toolkit is an advanced framework for simulating multiple types of social engineering attacks like credential harvestings, phishing attacks, and more. On the show, Elliot is seen using the SMS spoofing tool from the Social-Engineer Toolkit.

This Python-driven tool is the standard tool for social engineering penetration tests with more than two million downloads. It automates the attacks and generates disguising emails, malicious web pages and more.

Supported platforms and download:

To download SET on Linux, type the following command:

Apart from Linux, Social-Engineer Toolkit is partially supported on Mac OS X and Windows.

9. Netsparker | Best Hacking Tools Of 2017

Netsparker is a popular web application scanner that finds flaws like SQL injection and local file induction, suggesting remedial actions in a read-only and safe way. As this hacking tool produces a produces a proof of exploitation, you don't need to verify the vulnerability on your own. Just in case it can't verify a flaw automatically, it'll alert you. This hacking tool is very easy to get started with. Simply enter the URL and let it perform a scan. Netsparker supports JavaScript and AJAX-based applications. So, you don't need to configure the scanner or rely on some complex scanning settings to scan different types of web applications.

If you don't wish to pay money for the professional version of Netsparker, they've also got a demo version that you can use.

Supported platforms and download:

Netsparker web app scanner is available for Windows
Read more here and find download link
10. w3af | Best Hacking Tools Of 2017

w3af is a free and open source web application security scanner that's widely used by hackers and penetration testers. w3af stands for web application attack and audit f ramework. Using this hacking tool, one can get security vulnerability information that can be further used in penetration testing engagements. w3af claims to identify more than 200 vulnerabilities (including the likes of cross-site scripting, SQL Injection, PHP misconfigurations, guessable credentials, and unhandled application errors) and make a web application (and website) more secure.

w3af comes both in command line and graphical user interface to suit the needs of a hacker. In less than 5 clicks and using the predefined profile for the beginners, one can audit the security of a web application. As it's well documented, the new users can easily find their way. Being an open source hacking tool, an experienced developer can play with the code, add new features, and create something new.

Supported platforms and download:

w3af is available for Linux, BSD, and OS X. On Windows, its older versions are supported.
Read more here and find download link
Other top hacking and security tools of 2017 in multiple categories:

Web Vulnerability Scanners - Burp Suite, Firebug, AppScan, OWASP Zed, Paros Proxy, Nikto, Grendel-Scan

Vulnerability Exploitation Tools - Netsparker, sqlmap, Core Impact, WebGoat, BeEF

Forensic Tools - Helix3 Pro, EnCase, Autopsy

Port Scanners - Unicornscan, NetScanTools, Angry IP Scanner

Traffic Monitoring Tools - Nagios, Ntop, Splunk, Ngrep, Argus

Debuggers - IDA Pro, WinDbg, Immunity Debugger, GDB

Rootkit Detectors - DumpSec, Tripwire, HijackThis

Encryption Tools - KeePass, OpenSSL, OpenSSH/PuTTY/SSH, Tor

Password Crackers - John the Ripper, Aircrack, Hydra, ophcrack

We hope that you found this top hacking and security tools of 2017 list helpful. Share your reviews in the comments below and help us improve this list. On the same note, we also conducted a poll on our Facebook page.

Get the best deals on these hacking certification courses:

Fossbytes co-founder and an aspiring entrepreneur who keeps a close eye on open source, tech giants, and security. Get in touch with him by sending an email - [email protected]

# data[].attributes.attachment_link.title
Best Hacking Tools Of 2017 For Windows, Linux, And OS X

# data[].attributes.attachment_link.description
Short Bytes: Fossbytes has prepared a useful list of the best hacking tools of 2017 based upon industry reviews, your feedback, and its own experience. This list will tell you about the best software used for hacking purposes featuring port scanners, web vulnerability scanner, password crackers, forensics tools and social engineering tools.

# data[].attributes.body
October 27, 2017

# data[].attributes.attachment_link.description
We're very impressed by the collective smarts of the security community and we highly recommend reading the whole list and investigating any tools you are unfamiliar with. Click any tool name for more details on that particular application, including the chance to read (and write) reviews.

# data[].attributes.body
October 4, 2017

# data[].attributes.attachment_link.readable_text
All tools on this list are free and publicly accessible. They are also well known within the professional security community and among malicious actors. This list of tools, software, and utilities should empower anyone interested in protecting themselves and their online assets by making you aware of the capabilities that exist for analysts and malicious actors. By better understanding the tools that your adversary uses, you can better protect yourself.
Information Gathering and Analysis
Google dorks - Using advanced operators in the Google search engine to locate specific strings of text within search results.

Maltego - An interactive data mining tool that renders directed graphs for link analysis.

FOCA - A tool used to find metadata and hidden information in the documents its scans.

http://checkusernames.com/ - Check the use of a brand or username on 160 social networks.

https://haveibeenpwned.com/ - Check if an account has been compromised in a data breach.

https://www.beenverified.com/ - Search people & public records.

Shodan - Search engine for Internet-connected devices.

Censys - A search engine that allows computer scientists to ask questions about the devices and networks that compose the internet.

Gephi - Visualisation and exploration software for all kinds of graphs and networks.

Fierce - A DNS reconnaissance tool for finding target IPs associated with a domain.

BuiltWith - Find out what websites are built with.

Wappalyzer - A cross-platform utility that uncovers the technologies used on websites.

https://aw-snap.info/ - Tools for owners of hacked websites to help find malware and recover their site.

http://themecheck.org/ - A quick service that lets you verify WordPress themes for security and code quality.

theHarvester - Gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers, and SHODAN.

Cymon.io - Tracker of malware, phishing, botnets, spam, and more.

Mnemonic - A passive DNS database.
Vulnerability Scanning and Penetration Testing
WPScan - A black box WordPress vulnerability scanner.

Sqlmap - An open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.

BeEF - A penetration testing tool that focuses on the web browser.

Firefox Hackbar - A simple security audit/penetration test tool.

Burp Suite - Software for web security testing.

OpenVAS - An open source vulnerability scanner and manager.

Fiddler - A free web debugging proxy.

Joomscan - Detect Joomla CMS vulnerabilities and analyse them.

Kum0nga - A simple Joomla scan.

Arachni - A feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications.
Forensics and Log Analysis
Lnav - An advanced log file viewer.

Mandiant Highlighter - A free log file analysis tool.

Wp-file-analyser - Find modified, missing and extra files in a WordPress directory.

Auditd - Access monitoring and accounting for Linux.

Araxis Merge - Advanced 2 and 3-way file comparison (diff), merging and folder synchronisation.

WinMerge - An Open Source differencing and merging tool for Windows.

DiffNow - Compare files online.
Code and Malware Analysis
CyberChef - the Cyber Swiss Army Knife

UnPHP - A free service for analysing obfuscated and malicious PHP code.

UnPacker - JavaScript unpacker.

Jsunpack - A generic JavaScript unpacker.

JSBeautifier - An online JavaScript beautifier.

https://www.base64decode.org/ - Base64 Decode and Encode

https://www.urldecoder.org/ - URL Decode and Encode

http://lombokcyber.com/en/detools/decode-sourcecop - Decode SourceCop v3.x
Other Tools regex101 - Develop and test regular expressions.
regexpal - Another site to develop and test regular expressions.

HashKiller - Online hash cracking service. Useful to reverse engineer hashes into passwords.

Noscript - Noscript is a Firefox extension that allows Javascript, Java and Flash to only be executed by websites that you define and trust.
Other Lists of Tools
Awesome Forensics - A curated list of awesome free (mostly open source) forensic analysis tools and resources.

awesome-incident-response - A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams.

OSINT Framework - OSINT is short for 'open source intelligence'. This site provides a graphical directory of OSINT resources.
Kali Linux
Kali Linux is a linux distribution that is the favourite of penetration testers and security analysts worldwide. It is a linux distribution that comes packed with security analysis tools. If you want to learn about cyber security, Kali should be one of your starting points.

# data[].attributes.attachment_link.title
51 Completely Free Security Analysis Tools To Use Today

# data[].attributes.attachment_link.description
About The Security Tools Available All tools on this list are free and publicly accessible. They are also well known within the professional security community and among malicious actors.

# data[].attributes.body
October 4, 2017

# data[].attributes.attachment_link.readable_text
57 open source app sec tools: A guide to free application security software
Read the updated version of this list: 47 powerful open-source app sec tools you should consider
You don't need to spend a lot of money to introduce high-power security into your application development and delivery agenda. This guide to open-source app sec tools is designed to help teams looking to invest in application security software understand what's out there in the open-source space, and how to think about the choices. A subsequent guide to commercial app sec vendors will follow.

Why do you need a guide to free app sec tools? Generally speaking, information about application security can be confusing, because websites typically present the advantages of products without clearly describing the class of solution being offered. This makes it difficult to compare one product to the next. Websites for open source projects typically provide very granular information about a specific tool, which requires the reader to already understand how and why a specific tool is used.

The value of open source app sec tools

Most open source projects are designed for app sec requirements at a smaller scale than commercial vendors tend to target. We believe this list of highly dedicated open source app sec providers should, nevertheless, become familiar to security enthusiasts seeking new, creative approaches to specific kinds of cyber threats.

Some of these OS projects are quite active and frequently updated with new capabilities; others, well, not so much, but they're worth checking out. Some of the more robust OS tech has been around since the dawn of the web; others are quite new, with growing hordes of followers on Twitter and elsewhere.

Note that a few of the listings here are free "community editions" of higher-grade commercial products. Also note that you can't identify open source projects by their .org or .net suffixes anymore. As you'll see, many use the .com convention, and lots of other URL conventions these days.

BackTrack

BeEF

Caja

ClamAV

DOM Snitch

Ettercap

GoLismero

Google hacking database (GHDB)

Google application security tools

Grabber

Grendel

Gruyere

Kali

Keyczar

Kismet

Malwarebytes

Metasploit

ModSecurity

Nagios

Native Client (NaCl)

Nikto2

Nmap

NoScript

OpenSSH

OpenVAS

OSSEC

OWASP

Packet Storm

Paros Proxy

Powerfuzzer

Ratproxy

Secunia PSI

Security Onion

Skipfish

Snort

SonarQube

SQLMap

Tcpdump

Vega

W3AF

Wapiti

Watcher

WATOBO

WebScarab

Websecurify

GNUCITIZEN (see the Commercial vendor list)
Web:

Wfuzz

SensePost

Wireshark

Zed Attack Proxy

What did we miss?

Are there open source application security providers that we missed? We think of this as a work in progress, so if you believe there are tools that should be added to this list, please let us know in the comments section below.

# data[].attributes.attachment_link.title
57 open source app sec tools: A guide to free security software

# data[].attributes.attachment_link.description
57 open source app sec tools: A guide to free application security software Read the updated version of this list: 47 powerful open-source app sec tools you should consider You don't need to spend a lot of money to introduce high-power security into your application development and delivery agenda.

# data[].attributes.body
October 4, 2017

# data[].attributes.attachment_link.readable_text
This entry was posted in General Security, Research, WordPress Security on April 20, 2017 by Mark Maunder 17 Replies

Yesterday at Wordfence we had an "all welcome" technology sharing meeting with the entire company - or at least everyone that was available at the time. The meeting became so popular with our team that we had to upgrade the license we use for our real-time collaboration service to accommodate everyone. It is the largest team meeting we have had to date.

The goal of the call was to have an informal chat about some of the external security and investigative tools that our team finds useful. The meeting included most of our security services team, senior dev staff, security analysts including all senior analysts, team members from customer service and even execs.

I think we all learned something new and Brad, one of our senior analysts, was kind enough to compile the list of tools we chatted about in a shared document.

I know that many security analysts, WordPress developers and readers who are interested in security visit this blog. So I thought I'd share the list of tools the Wordfence team came up with so that if you work in security or just want to increase your cyber security literacy, you can benefit from this list too.

I should emphasize that this is by no means an exhaustive list of security tools. This list merely includes a few of the more interesting cyber security tools that came up in a 40 minute conversation with our team yesterday. We also have a suite of internal tools that are not included. If you have a personal favorite, you are most welcome to share it in the comments.

Reading this list may be worrying or intimidating for readers who don't work in the security industry. You should know that all tools on this list are free and publicly accessible. They are also well known within the professional security community and among malicious actors. This list of tools, software and utilities should empower anyone interested in protecting themselves and their online assets by making you aware of the capabilities that exist for analysts and malicious actors. By better understanding the tools that your adversary uses, you can better protect yourself.

Information gathering and analysis

Google dorks - Using advanced operators in the Google search engine to locate specific strings of text within search results.

Using Google for penetration or malicious activity may seem silly or obvious, but Google is incredibly powerful and very popular among analysts and malicious actors alike. "Google dorks", or google-hacks as they're also known, are a search query that attackers use on Google to identify targets. If you visit a site like exploit-db.com or any other database of exploits, you'll find that many of them include Google dorks to help find targets to attack with the exploit.

Maltego - An interactive data mining tool that renders directed graphs for link analysis.

Maltego is one of our favorites. It is an investigator's tool that lets you graphically organize your thoughts and your investigation by creating objects (people, places, devices, events) and link them. It also gives you the ability to run 'transforms' on objects. For example, you can run transforms on an IP address to list its malicious activity using external sources of threat intelligence. You can download a free version from Paterva which has some limitations.

You can see an example of the work we do with Maltego below.

FOCA - A tool used to find metadata and hidden information in the documents its scans.

When you create and publish MS Office, PDF, EPS and PS documents online, you may not realize how much information you are leaking to the general public. FOCA is a security analyst's tool that can be used to extract 'leaked' data from documents that have been made public. Using FOCA, an analyst can find things like an organization's network structure, IP addresses, internal server names, printers, shared folders, access control lists and more. You can watch this video filmed at DefCon 17 for a demo of how FOCA can be used by researchers or malicious actors to perform recon on a target organization or individual.

http://checkusernames.com/ - Check the use of a brand or username on 160 social networks.

If you simply want to find a unique username, checkusernames.com is a useful tool. If you are in the security field, it can be a powerful way to attribute an attack to a specific individual. Malware authors occasionally include usernames or 'hacker names' in their malware. Using this tool you can search 160 online services to see if they have used the same username somewhere else.

https://haveibeenpwned.com/ - Check if an account has been compromised in a data breach.

The term 'pwned' is slang for 'owned' which in the security industry means "to have your data or system compromised". So 'haveibeenpwned.com' is slang for "Have I been owned dot com". This is a well known and respected site run by Troy Hunt which finds and aggregates data from data breaches. You can use the service to find out if an account has been compromised by looking up your email or username.

https://www.beenverified.com/ - Search people & public records.

This is a general "people search" that is useful to find additional meta-data when researching a target during penetration testing or when researching an attacker.

Shodan - Search engine for Internet-connected devices.

This is a very popular service among security researchers. Shodan continually crawls and indexes devices on the internet. We recently used Shodan as part of our research into routers at several ISPs around the world that have been hacked and are now attacking WordPress. You can find a few example searches demonstrating Shodans use on their 'explore' page.

Censys - A search engine that allows computer scientists to ask questions about the devices and networks that compose the internet.

Censys is similar to Shodan in that it indexes devices and websites connected to the internet. The data is also searchable and differs from Shodan in some ways. Shodan is focused on ports and the services running on those ports. Censys is great at indexing web site SSL certificates among other things. Censys is maintained by a team of computer scientists at the University of Michigan and University of Illinois Urbana-Champaign.

Gephi - Visualization and exploration software for all kinds of graphs and networks.

We mentioned Maltego earlier in this post. It uses a 'graph' structure which is a diagram of linked objects to represent relationships. Gephi is a tool to analyze graph data at massive scale. We used Gephi to generate the graphical representations of attack data that we published in our February Attack report, seen below.

Fierce - A DNS reconnaissance tool for finding target IPs associated with a domain.

Fierce is a tool used to find IP addresses that are potential attack targets associated with a specific domain. It is used by penetration testers when evaluating insecure points on a network.

BuiltWith - Find out what websites are built with.

BuiltWith has a search engine-like interface and lets you search for a specific site to find out what tools were used to build it. BuiltWith also aggregates that data so that you can find out what the most popular technologies are on the web or how a specific technology is trending relative to another.

Wappalyzer - A cross-platform utility that uncovers the technologies used on websites.

Wappalyzer is another tool that helps you discover what technologies a specific site is using. Like BuiltWith, they also aggregate data to help you determine how technologies are trending. This is their view of the popularity of blog technologies, with WordPress clearly the market leader.
Wappalyzer Chrome extension
Wappalyzer also has a browser extension for Chrome that lets you immediately see the technologies a specific site is using. There is also a Python driver available on github called python-Wappalyzer.

https://aw-snap.info/ - Tools for owners of hacked websites to help find malware and recover their site.

aw-snap.info includes a suite of tools that may be helpful for site owners who have decided to try to clean their own hacked site. It can help you fetch pages as Google, which sometimes reveals malware. It can also decode base64 obfuscated malware and help find obfuscation in your files that may hide malware.

http://themecheck.org/ - A quick service that lets you verify WordPress themes for security and code quality.

ThemeCheck may help you verify your theme integrity by uploading it. It can also help find malware embedded in themes.

theHarvester - Gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers and SHODAN.

This is a tool that performs a variety of reconnaissance operations on an organization and may be useful in the early stages of a penetration test to determine an organization's overall online footprint.

Cymon.io - Tracker of malware, phishing, botnets, spam, and more.

Cymon can help you research a potentially malicious IP or malware hash. Here's an example of the results for one of our top IPs in the March Wordfence monthly attack report.

Mnemonic - A passive DNS database.

Mnemonic is a useful tool that can find which websites are hosted at a specific IP or which IPs host a website.

Vulnerability scanning and penetration testing

WPScan - A black box WordPress vulnerability scanner.

WPScan is a command line tool that is used to remotely scan WordPress sites for vulnerabilities.

Sqlmap - An open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.

SQLMap is widely used among penetration testers and is highly effective at finding and exploiting SQL injection vulnerabilities in target sites.

BeEF - A penetration testing tool that focuses on the web browser.

BeEF is a powerful tool that lets penetration testers exploit and control a web browser. Using BeEF you can set up a malicious website, exploit a visiting browser and gain access to the workstation running the browser. You can watch this 2014 KiwiCon video for a demo.

Firefox Hackbar - A simple security audit / penetration test tool.

Hackbar is a plugin for Firefox that may help application developers perform security audits on their own web applications. It includes a variety of tools to assist with this task.

Burp Suite - Software for web security testing.

Burp Suite is a very well known and powerful framework used to perform security audits and analysis on web applications. It includes a proxy that can intercept traffic and allow you to modify it on the fly. It includes a huge variety of exploit and penetration testing tools.

OpenVAS - An open source vulnerability scanner and manager.

You have probably heard of the vulnerability scanning tool Nessus. Back in 2005 Tenable Network Security changed the Nessus open source license to a closed source one. The developers forked the project at that time and created OpenVAS.

I've found that OpenVAS can be quite effective, but it is a bit more challenging to set up than Nessus. OpenVAS does have the advantage of being completely free and open source. The project is well known throughout the online security community.

Fiddler - A free web debugging proxy.

Fiddler is a proxy server that lets you intercept requests to a website, view them in different ways, modify the requests and can help debug websites and perform security audits.

Joomscan - Detect Joomla CMS vulnerabilities and analyze them.

Joomscan is the Joomla CMS's equivalent of wpscan.

Kum0nga - A simple Joomla scan.

This is another joomla vulnerability scanner.

Arachni - A feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications.

Arachni is a framework to perform detailed vulnerability scanning on web applications.

Forensics and log analysis

Lnav - An advanced log file viewer.

Lnav is short for log file navigator. It automatically detects your log file formats, provides syntax highlighting and a host of other features to view and analyze log files. It can be invaluable when analyzing a compromised website.

Mandiant Highlighter - A free log file analysis tool.

Mandiant (now owned by Fireeye) produced this useful product that can help analyze log files. It includes the ability to graphically view a histogram of log files and several other powerful log file analysis features.

Wp-file-analyser - Find modified, missing and extra files in a WordPress directory.

This utility can download the original versions of WordPress core and plugin files and can help you compare them against their originals. Wordfence already does this from within WordPress, but this provides a command line tool to perform a similar action.

Auditd - Access monitoring and accounting for Linux.

Access monitoring and logging/accounting is very helpful when monitoring a system to see if it is being attacked or performing an investigation after the attack. Auditd can help you improve logging and provide an audit trail on Linux.

Araxis Merge - Advanced 2 and 3-way file comparison (diff), merging and folder synchronization.

When responding to a hack, the ability to compare files to originals to determine what has changed is important. Araxis Merge is a powerful tool that can assist with this.

WinMerge - An Open Source differencing and merging tool for Windows.

Much like Araxis Merge, WinMerge can help you compare files to examine changes when responding to an incident.

DiffNow - Compare files online.

DiffNow is a web based file 'diff' tool that can also assist when comparing file differences during incident response.

Code and malware analysis

CyberChef - the Cyber Swiss Army Knife

CyberChef is a tool that is developed by GCHQ, the British intelligence agency. It can help de-obfuscate malware and other code.

UnPHP - A free service for analyzing obfuscated and malicious PHP code.

Obfuscating (hiding/garbling) PHP is a favorite tool of hackers, UnPHP can help analyze obfuscated code.

UnPacker - JavaScript unpacker.

Jsunpack - A generic JavaScript unpacker.

'Packing' javascript is a favorite technique of hackers who are dropping malicious javascript on websites. It makes their code more compact and harder to read. Jsunpack can help de-obfuscate JS code to make it more readable so that you can understand how it operates.

JSBeautifier - An online JavaScript beautifier.

Much like Jsunpack, JSBeautifier helps improve the readability of packed javascript code.

https://www.base64decode.org/ - Base64 Decode and Encode

Base64 encoding is a way to encode anything into an encoded string of (what appears to be) random characters. Anyone who is repairing hacked sites or responding to incidents uses base64 decoding several times a day to expose malicious code that has been base64 encoded. This tool can help decode base64 encoding.

https://www.urldecoder.org/ - URL Decode and Encode

URL encoding is also a popular way for hackers to hide their code, through encoding it using this form of encoding. urldecoder.org can help you decode malicious code that has been hidden using urlencoding.

http://lombokcyber.com/en/detools/decode-sourcecop - Decode SourceCop v3.x

This is a tool that decodes a specific type of PHP encoding that may prove useful during a hacked site investigation.

Other tools

regex101 - Develop and test regular expressions.

Regex, or regular expressions, are pattern matching routines to find complex patterns in files and code. We use regex extensively at Wordfence to help fix hacked sites and in our software and products.

regexpal - Another site to develop and test regular expressions.

Both regex101 and regexpal provide online development environments to help you create or analyze regular expressions.

HashKiller - Online hash cracking service. Useful to reverse engineer hashes into passwords.

In most systems, passwords are stored as hashes. Malware authors occasionally use hashing to store their own passwords. In our research we have needed to crack hashes that are used by malware authors in order to read their source code. HashKiller can help reverse a hash into a password if you need to crack a hash as part of your malware analysis.

Noscript - Noscript is a Firefox extension that allows Javascript, Java and Flash to only be executed by websites that you define and trust.

When visiting malicious websites, Noscript can help disable malicious code on that site. Note that you should always visit a malicious site that you are analyzing using a virtual machine that has no important data on it. If the VM gets infected, you can simply destroy it without worrying about important data being leaked. Using Noscript in your browser within your virtual environment can be useful when analyzing the function of a hacked site.

Other lists of tools

Awesome Forensics - A curated list of awesome free (mostly open source) forensic analysis tools and resources.

awesome-incident-response - A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams.

OSINT Framework - OSINT is short for 'open source intelligence'. This site provides a graphical directory of OSINT resources.

Kali Linux

Kali Linux is a linux distribution that is the favorite of penetration testers and security analysts world-wide. It is a linux distribution that comes packed with security analysis tools. If you want to learn about cyber security, Kali should be one of your starting points. If you simply would like to know about some of the more important tools that Kali provides, you can use the list below.

Kali Linux Tools Listing - All the tools in Kali Linux, a Linux variant used by penetration testers and security analysts.

Conclusion

The tools on this page can help you respond to an incident, test the security of your own website and better understand how attackers think and what tools they have available to them. As always I welcome your feedback in the comments and you are most welcome to suggest your own favorite security or analysis tools.

# data[].attributes.attachment_link.description
Yesterday at Wordfence we had an "all welcome" technology sharing meeting with the entire company - or at least everyone that was available at the time. The meeting became so popular with our team that we had to upgrade the license we use for our real-time collaboration service to accommodate everyone.

# data[].attributes.body
October 4, 2017

# data[].attributes.attachment_link.readable_text
There are thousands of open source security tools with both defensive and offensive security capabilities.

The following are 10 15 essential security tools that will help you to secure your systems and networks. These open source security tools have been given the essential rating due to the fact that they are effective, well supported and easy to start getting value from.

- map your network and ports with the number one port scanning tool. Nmap now features powerful NSE scripts that can detect vulnerabilities, misconfiguration and security related information around network services. After you have nmap installed be sure to look at the features of the included ncat - its netcat on steroids.

- open source vulnerability scanning suite that grew from a fork of the Nessus engine when it went commercial. Manage all aspects of a security vulnerability management system from web based dashboards. For a fast and easy external scan with OpenVAS try our online OpenVAS scanner.

was built from the foundation of BackTrack Linux. Kali is a security testing Linux distribution based on Debian. It comes prepackaged with hundreds of powerful security testing tools. From Airodump-ng with wireless injection drivers to Metasploit this bundle saves security testers a great deal of time configuring tools.

- encrypt all the things. As of 2014, the TrueCrypt product is no longer being maintained. Two new security tools, CipherShed and VeraCrypt were forked and have been through extensive security audits.
Websites: https://ciphershed.org/ and https://veracrypt.codeplex.com

Updated 2017 to include another 5 high quality open source security tools. These additional projects are all very much focused on the defenders side. With in depth traffic analysis, intrusion detection and incident response all covered. Interesting to see sponsors of these projects include Facebook, Cisco and Google.

is a real time traffic analysis and packet logging tool. It can be thought of as a traditional IDS, with detection performed by matching signatures. The project is now managed by Cisco who use the technology in its range of SourceFire appliances. An alternative project is the Suricata system that is a fork of the original Snort source.

15. GRR - Google Rapid Response a tool developed by Google for security incident response. This python agent / server combination allows incident response to be performed against a target system remotely.

# data[].attributes.attachment_link.title
15 Essential Open Source Security Tools | HackerTarget.com

# data[].attributes.attachment_link.description
There are thousands of open source security tools with both defensive and offensive security capabilities. The following are 10 15 essential security tools that will help you to secure your systems and networks. These open source security tools have been given the essential rating due to the fact that they are effective, well supported and easy to start getting value from.

# data[].attributes.body
October 4, 2017

# data[].attributes.attachment_link.readable_text
We asked information and network security pros to name the best free software tools for their daily work. Here are 21 standouts to improve your defenses - without breaking the bank.

Your favorite infosec freebies

Who doesn't love free software?

Recently, we conducted an informal, unscientific poll asking readers to tell us about their favorite free information security tools.&nbsp;And boy, did they ever respond.

Here are&nbsp;more than 20&nbsp;of the most popular answers. Some (Nessus, Nmap, Metasploit) will be very familiar; others may surprise you.

Maltego

open source intelligence and forensics app, designed&nbsp;to deliver a clear threat picture for the user's environment. It will demonstrate the complexity and severity of single points of failure as well as trust relationships that exist within the scope of one's infrastructure.&nbsp; Paterva develops this&nbsp;

It pulls in information posted all over the Internet, whether it's the current configuration of a router on the edge of the company network or the current whereabouts of your company's vice president.&nbsp;

The commercial license does have a price tag, but a "community" version is free with some restrictions.

OWASP Zed Attack Proxy (ZAP)

The Zed Attack Proxy (ZAP) is a user-friendly penetration testing tool that finds vulnerabilities in web apps.

It's designed to be used by practitioners with a wide range of security experience and is ideal for developers and functional testers who are new to pen testing.

It provides automated scanners and a set of tools for those who wish to find vulnerabilities manually.

Samurai Web Testing Framework

The Samurai Web Testing Framework&nbsp;functions as a web pen-testing environment. It's actually a toolbox packed with some of the other items you'll see in this slideshow.

The CD contains a host of free and open source tools to test and attack websites.&nbsp;

Tools include the Fierce domain scanner and Maltego. For mapping it uses WebScarab and ratproxy. Discovery tools include w3af and burp. For exploitation, the final stage, it includes BeEF, AJAXShell and others. The CD also includes a pre-configured wiki, set up to be the central information store during the user's pen-test.

BackTrack

BackTrack is a Linux-based pen-testing toolbox security professionals use to perform assessments in a purely native environment dedicated to hacking.

Users have easy access to a variety of tools ranging from port scanners to password crackers. Users can &nbsp;boot BackTrack directly from portable media without requiring installation, though permanent installation to hard disk is an option.

BackTrack arranges tools into 12 categories:

Information gathering

Vulnerability assessment

Exploitation tools

Privilege escalation

Maintaining access

Reverse engineering

RFID tools

Stress testing

Forensics

Reporting tools

Services

Miscellaneous

Cain & Abel

Cain &amp; Abel is a password recovery tool for Microsoft operating systems.

It allows for easy recovery of various kinds of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols.

It covers some security aspects/weakness present in protocol standards, authentication methods and caching mechanisms. Its main purpose is the simplified recovery of passwords and credentials from various sources. It also ships some "non standard" utilities for Microsoft Windows users.

Fierce Domain Scan

According to the ha.ckers blog, Fierce Domain Scan "was born out of personal frustration after performing a web application security audit. It is traditionally very difficult to discover large swaths of a corporate network that is non-contiguous. It's terribly easy to run a scanner against an IP range, but if the IP ranges are nowhere near one another you can miss huge chunks of networks."

Fierce is designed specifically to pinpoint likely targets inside and outside a corporate network. It is essentially a reconnaissance tool, a PERL script built to scan domains within minutes, using a variety of tactics.

The Harvester

The Harvester is&nbsp;an open source intelligence tool (OSINT) used to attain email addresses and user names from public sources such like Google and LinkedIn.

A favorite among pen testers, it lets the user conduct passive reconnaissance and build target profiles that include a list of user names and email addresses.

The Social Engineering Framework website says, "Emails and user names are similar to your real name. They can be used to identify you in the virtual world or in your workplace. They can lead to identifying your friends, your family, and your social groups."
[Also read about the Social Engineering Toolkit.]

Hping

Hping is a command-line oriented TCP/IP packet assembler/analyzer. It is used for:

Firewall testing

Advanced port scanning

Network testing, using different protocols, TOS, fragmentation

Manual path MTU discovery

Advanced traceroute, under all the supported protocols

Remote OS fingerprinting

Remote uptime guessing

TCP/IP stacks auditing

It runs on&nbsp;Linux, FreeBSD, NetBSD, OpenBSD, Solaris, MacOs X, and Windows.

John the Ripper

John the Ripper is a&nbsp;password cracker available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS.

It's mainly used to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows&nbsp; LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

MobiSec

The MobiSec Live Environment Mobile Testing open source project is good for testing mobile environments, including devices, apps and supporting infrastructure.

It allows users to test their mobile environments to identify design weaknesses and vulnerabilities.

Testers get access to a host of open-source mobile testing tools, as well as the ability to install additional tools and platforms. Using a live environment allows pen testers to boot the MobiSec Live Environment on any Intel-based system from a DVD or USB flash drive, or run the test environment within a virtual machine.

The MobiSec Live Environment is maintained as an open source project on Source Forge, located at&nbsp;http://sourceforge.net/p/mobisec, and can be downloaded as an ISO by clicking on the Download link above.

Nessus

Nessus is one of the world&rsquo;s most popular vulnerability and configuration assessment tools. Though Tenable Network Security changed Nessus 3 to a proprietary license, it&nbsp;is free for personal use in non-enterprise environments.

According to the Tenable website, Nessus features high-speed discovery, configuration auditing, asset profiling, sensitive data discovery, patch management integration and vulnerability analysis.

NMap

Nmap is an open source tool for network exploration and security auditing.

It's built to rapidly scan large networks, though it also works against single hosts. According to the NMap website, the scanner uses raw IP packets to determine what hosts are available on the network, which services those hosts are offering, what operating systems they are running, what types of packet filters/firewalls are in use, and dozens of other characteristics.

"While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules and monitoring host or service uptime," the website says.

OpenVPN

OpenVPN&nbsp;is an open source SSL VPN tool that works in a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls.&nbsp;

According to the OpenVPN website, it's&nbsp;based on SSL, the industry standard for secure communications on the Internet.

"OpenVPN implements OSI layer 2 or 3 secure network extension using the SSL/TLS protocol, supports flexible client authentication methods based on certificates, smart cards, and/or 2-factor authentication, and allows user or group-specific access control policies using firewall rules applied to the VPN virtual interface," the site says. "OpenVPN is not a web application proxy and does not operate through a web browser."

Ophcrack

Ophcrack is&nbsp;a free Windows password cracker based on rainbow tables. It comes with&nbsp;a graphical user interface and runs on multiple platforms, according to the specifications on the website.

Features include the following:

-- Cracks LM and NTLM hashes.

-- Free tables available for Windows XP and Vista/7.

-- Brute-force module for simple passwords.

-- Audit mode and CSV export.

-- Real-time graphs to analyze the passwords.

-- LiveCD available to simplify the cracking.

-- Dumps and loads hashes from encrypted SAM recovered from a Windows partition.

Python Security

This is more a community than a tool. Think of it as a human toolbox. Specifically, it's&nbsp;the home of the largest collection of information about security in the&nbsp; Python&nbsp;programming language.

OWASP says of the effort, "Our mission is to make Python&nbsp;the most secure programming language in the world, ensure hackers&nbsp;never&nbsp;break a Python-based application, and make security breaches&nbsp;a thing of the past."

The site is organized into two sections:

--Security topics and how they relate to Python as a whole

--The security of specific software such as frameworks and template engines

Wireshark

Wireshark is a&nbsp;network protocol analyzer that lets users capture and interactively browse traffic running on a computer network.&nbsp;

The long list of features include:

--&nbsp; Deep inspection of hundreds of protocols, with more being added all the time

-- Live capture and offline analysis

-- Standard three-pane packet browser

-- Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others

--Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility

ModSecurity

ModSecurity is a Web app firewall&nbsp;developed by&nbsp; Trustwave's SpiderLabs Team.&nbsp;

According to the website, it&nbsp;makes full HTTP transaction logging possible, allowing complete requests and responses to be logged. "Its logging facilities also allow fine-grained decisions to be made about exactly what is logged and when, ensuring that only the relevant data is recorded," the site says.

ThreadFix

ThreadFix is a software vulnerability aggregation and vulnerability management system that helps organizations aggregate vulnerability data, generate virtual patches, and interact with software defect tracking systems.

ThreadFix aggregates vulnerability test results from disparate static and dynamic scanning tools as well as the results of manual penetration testing, code review and threat modeling to create a single comprehensive view of the security status of all applications within an organization.

The reporting, prioritization and remediation of an organization's application security vulnerabilities are centralized in a single tool, significantly easing communications between the application development and security teams.&nbsp;

It was developed and is maintained by&nbsp;Denim Group.

Burp Suite

Burp Suite is a Web app security testing platform.&nbsp;Its various tools support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.

Tools within the suite include a proxy server, web spider, intruder and a so-called repeater, with which requests can be automated.

Portswigger offers a free edition.

Stormpath

Stormpath provides developers with Identity and Access Management tools to bolster security in any application. There is a free developer's version, as well as these paid versions: pro, premium and enterprise.

The tools do the following:

1. Hosts and Deploys user directories in the Cloud

2. Authenticates users and secures their passwords with one click

3. Manages hierarchies and RBAC with a drag-n-drop interface or API

4. Drops in code for user workflows like password reset, account verification and locking

5. Handles all the user security maintenance, so the user is ahead of attackers

Metasploit

HD Moore created the Metasploit Project in 2003 to provide the security community with a public resource for exploit development. This project resulted in the Metasploit Framework, an open source platform for writing security tools and exploits.

In 2009, Rapid7, a vulnerability management solution company, acquired the Metasploit Project. Prior to the acquisition, all development of the framework occurred in the developer's spare time, eating up most weekends and nights. Rapid7 agreed to the fund a full-time development team and keep the source code under the three-clause BSD license that is still in use today.

# data[].attributes.attachment_link.description
We asked information and network security pros to name the best free software tools for their daily work. Here are 21 standouts to improve your defenses - without breaking the bank.

# data[].attributes.body
October 4, 2017

# data[].attributes.attachment_link.readable_text
The idea that we should create a gargantuan list of cyber security tools started to spring in our minds around the beginning of this year.

We started from a simple idea: It should be useful. We need it. You need it. It will come in handy in the future, to have all those tools in one place.

In our journey into the cyber security and data protection world, we ran into lots of useful tools. Some of them were unmarketed gems that we had no idea that they even existed. We ran into most of them completely by mistake, while searching for something else (usually on Quora or randomly navigating on blogs).

When we finally decided to do it, to work on the list, we had no idea how and where to begin.
What tools should we include? What should we not? How do we tell if one is worthy and the other one is not? Do we mention ultra-known products?
What about antivirus products? We haven't tested them all since there are independent industry experts who do a much better job.
Should we mention the services that are duplicated and basically do the same thing? Or should we stick to the best? Why? Who decides what's best for someone and what's not? Should we stick to what's free or should we also add paid products?
Eventually we came up with what we're about to read. But first here's a quick guideline that you should read before we jump right to the subject:

1. We don't claim that this is the ultimate list. It's not complete and it's definitely not final. It probably never will be. We are aware that we missed lots of essential, important tools - by mistake or just because we can't know them all. So please feel free to jump in with more useful tools that you feel they should be mentioned.

2. We stayed away from recommending antivirus, VPN or firewall products. There are independent industry experts who only do that. Instead, we prefer to list those experts or websites that will help you compare such services, in order to choose what's best for you

3. We tried to test them all before recommending them. And we only included tools that have free versions.

Let's get it started:
Table of contents:
ACCOUNT & AUTHENTICATION MANAGEMENT
- Check if your password is strong
- Password managers
- Activate two-factor authentication
- Was your account hacked?
SOCIAL MEDIA SECURITY
- Geo-tag removal on social accounts
- Revoke access to third party apps
- Do a security check-up
- Other communicating tools
SAFE BROWSING
- Keeping vulnerable software under control
- Extra Encryption, Privacy and Anonymity
- Redirect checkers
- Remote screenshots
- Scan for threats
BACKUP, BACKUP, BACKUP
REPORTING
MISCELLANEOUS
Conclusion

ACCOUNT & AUTHENTICATION MANAGEMENT

Check if your password is strong

A unique, strong password is key to our online security. We keep nagging about it in our articles (and we'll keep on nagging) because most people simply ignore this basic rule.

First of all, here's why it should be unique:
We never use the same key for our house and car, right? Then why would we use the same password for our accounts?
Our online accounts are interconnected. If one of those passwords is breached, the cyber criminal will have access to the rest of your accounts.

And no matter how careful you are not to give out your password, sometimes you might not be responsible for the breach. Companies have plenty of vulnerabilities. Their employees can have poor security habits. Their ex-employees might want to get vengeance this way. Your online connection might not be secure and your traffic unencrypted. There are tons of flaws out there that could expose your credentials.

Second of all, here's why it should be strong (and what does "strong" mean):

Most people have weak passwords. They use family or pets names, favorite songs, birth dates and so on. This type of information nowadays is readily available online - usually posted directly by us, on social networks or blogs or forum comments.

If a cyber criminal really wants to hack your account and you use such a password, all they'll have to do is spend some time finding out more information about you.

They also have the technical skills to test out millions of passwords combinations in a short period of time. So there's that.

These are the 10 worst passwords of 2016:

Source

If you really want to find out more about how to manage your passwords like an expert, you can follow this guide (includes some easy-to-follow steps).

And here are some tools that you can play with to find out how secure a password is considered (don't test using your real passwords!).

Another cool tool can estimate how long it would take for your password to be cracked by a hacker: Estimating Password-Cracking Times

Password managers

Constantly coming up with strong, unique passwords is hard. We get it.

It's hard to remember to change them, and it's even harder to remember them. Especially since it's not recommended to write them down - not in a document on your desktop, not in an email draft, not in your phone or written on a paper that stays under your mouse pad. No, no, no, no.

And since not all of us have an elephant memory, some smart guys created tools that make it easier for us to manage passwords.

Passwords managers are easy to use. You install them as browsers plug-ins and they help us save passwords and keep them encrypted. When we log in to a new account, the password manager will ask us if we want to save the password.

All we have to do is remember the password that we use for the password manager tool account.

Here are some of the most popular apps for password management:

Activate two-factor authentication

Ok, so this is plan B. If passwords fail and a cyber criminal somehow manages to find out your beautiful, strong, unique and completely random password, the second factor authenticator will work as an extra shield.

Two-factor authentication adds an extra layer of protection. This way, the password will not be enough to access your account, you'll also have to prove your identity using a second method. This usually consists of a unique, time sensitive code, that you receive using your mobile phone.

In order not to do this every time you log into your account, you can choose to remember the devices you use and only require the second way of authentication when you want to log in from a new device (laptop, PC, tablet, browser, whatever that may be).

I always wonder why the companies don't enable this option by default. It would help avoid a great deal of accounts that end up compromised because of poor passwords habits.

If you want to check what services offer users the possibility to activate two-factor authentication, use this tool:

Was your account hacked?

There are several projects out there that store huge database of leaked, stolen or compromised passwords. Other projects gather all the past data breaches. You can use them to confront with your passwords or accounts and check through their databases. If someone ever used a password that's the same with yours and was leaked in a past breach, you'll have to change it.

You can also check if you have any accounts that were compromised in any of those data breaches.

Use these services:

Here are more projects that you can use to inform yourself about data breaches:

Source

SOCIAL MEDIA SECURITY

Geo-tag removal on social accounts

It's highly recommended that you avoid checking in from your social accounts - especially from your home.

Something so common and apparently innocent as a social media check-in can turn into a nightmare. You can never control who can access your social network posts. You never know who else benefits from the information you shared.

There have been many cases of people who checked in while on vacation, bragged about the wonderful places they visited, only to come back home and find out that they were robbed. Burglars were tipped of thanks to the posts on social media.

However, if it's already too late and you already have plenty of check-ins made online, you can remove your previous ones.

For Facebook you'll have to do that manually for each post you published and then turn off location for future posts. However, for Instagram there's an easier batch solution that you can use.

Instagram is constantly updating its network and has changed the geo-map feature for mobile that let you control geotag location. Now you have the option to save photos you see and like on Instagram, save and add them to your photos collections.

Revoke access to third party apps

You probably logged in with your social accounts to many third party apps - games, other social networks, streaming services and so on.

For privacy matters, it's recommended that you only allow access to trustworthy apps. Those apps have access to your profiles and personal information.

From time to time, make sure you check every single app that you allowed to access your account and remove the ones that you don't use anymore.

Here's how you can remove access to external apps from every major social network:

Do a security check-up

Google and Facebook are among the networks that offer the possibility to do a security check-up. They will take you through the steps you need to check or activate in order to enhance your account's protection.

Other communication tools

Here are other communicating tools that are focused on anonymity and encryption:

SAFE BROWSING

Keeping malicious software under control

There are some major software apps that are buggy and expose you to global cyber attacks. "Software" and "buggy" might just be pleonasms for the moment, as all softwares have bugs and vulnerabilities.

What you should bear in mind is that you can reduce your odds of being infected just by keeping those buggy apps up to date. Or disabled until you really need them and activate them punctually. Or uninstalled, if they aren't vital to your work.

By "apps" we mean browsers, plug-ins, add-ons. Chrome, Firefox, Flash Player, Java and Adobe Reader, just to name a few of them, but you should take a look over the infographic published here to find out more about the top most vulnerable apps.
Here's how you can reduce your odds of getting infected:
1. Keep those vital apps up to date. You can use an automated patching tool that will take care of that for you, silently ( Heimdal FREE does that).

2. Use a tool that will scan your traffic and restrict your access to infected web pages ( our product also does that, and also makes sure that none of your data goes out to the bad guys).

3. No clicking on suspicious links or attachments, short links that you don't know where they'll lead you, nothing that you never requested or sounds fishy (even if it's coming from your online buddies). Staying away from dangerous web locations also is vital (that means no websites that host illegal content, such as torrents).

4. Keep activated a good, trustworthy antivirus. Here's how to choose it.

5. Use an app that will block those plug-ins and apps.

You can see in the infographic below how a global ransomware infects your operating system:
Some tools that will come in handy:

AdBlock - you'll get rid of annoying ads, but you'll also reduce your chances of ending up with spreading ransomware from malvertising.

NoScript - add-on for Firefox that allows plugins to be executed only by trusted web sites of your choice.

Script Safe - same as NoScript, but for Chrome.

Flashblock - Firefox add-on that blocks Flash

Flashcontrol - Chrome add-on that lets you take more control over Flash

Dragon Internet Browser - a free tool based on Chromium technology that will provide higher level of protection

Google Chrome Cleanup Tool - this app will scan and remove software that can cause problems with Chrome browser

Extra Encryption, Privacy and Anonymity

If you want extra anonymity, here is a list of tools that are focused on encryption and privacy:

Tor Project - we're sure you already know about this one. You can use Tor to browse the web while staying anonymous.

Comparison VPN - the name is pretty much self explanatory, right? "VPN" comes from "Virtual Private Network" and it's used to encrypt your outgoing and ingoing traffic. This tool will help you compare between different VPN services.

Duck Duck Go - it's a free search engine but, unlike others, it doesn't track you, doesn't collect or share any of your personal information.

Disconnect - the basic version will block trackers from websites.

uBlock - a lightweight free and open source browser extension that will help you filter our annoying or unwanted content, such as tracking cookies and ads (available for Mozilla, Chrome, Safari and even Microsoft Edge).

Https everywhere - it's an extension for your browser that encrypts your communications with major websites; resulted as a collaboration between The Tor Project and the Electronic Frontier Foundation.

Ghostery - a free browser extension that lets you control trackers from the websites that you visit.

Redirect checkers

If you want to avoid any phishing or malware attacks, it's best that you don't click on any links that you don't know where they'll lead you. They might be links shortened using services such as Bit.ly or Unshorten or links that look similar to perfectly legitimate ones but use a variation in spelling or domain.

Use one of these services to check where a link will redirect you:

Other dedicated and useful tools that you can use to detect links to malware websites:

Remote screenshots

As an alternative to remotely check where a short link will take you, you can also use a service that remotely takes screenshots of a given website.

This kind of services are usually used by developers, to see how a website will look on different resolutions and browsers used by users, but they can also come in handy when it comes to Internet security.

This way, you'll see how a website looks like and where you'll end up if you click on that link, without actually visiting it.

You can use one of these services:

Scan for advanced threats

There are services that will help you check if a website has been reported for phishing, malicious code, unwanted software or has a poor reputation. This way, you'll know to avoid it.

You can check using one of these:

You can also find useful this list of free online anti-malware scanners.

Photo credit

BACKUP, BACKUP, BACKUP
How valuable are the work documents that you keep on your desktop, your email or in the cloud? What about your collection of photos or private conversations? Would you miss them if they were ever deleted or lost? What if they were stolen? Or, even worse, encrypted in a ransomware attack?
Stop telling yourself "it can't happen to me". The odds for ending up with malware attacks are against you.

And most of these attacks are automated, nobody hand picks you as a victim. It's enough for you to have files and outdated browsers, plugins or apps. You don't even have to click or download anything to end up infected - nowadays you can be compromised even on perfectly legit websites.

For example, BBC, The New York Times and AOL were recently hit with a malvertising campaign that delivered notable ransomware to users.

Bad news is that even if you pay the ransom, there's no guarantee that you'll receive the encryption key to gain back access to your files. Or the encryption might have gone wrong and corrupted the files. It's one of the reasons why the FBI advises against paying the ransom.

Let's not forget about the recent cyber attacks ( WannaCry, Petya ransomware) impacting big organizations and institutions (Telefonica, Renault, FedEx, the National Health Service (NHS) in England and Scotland, Maersk, Government of Ukraine, and many more) that saw their computers compromised and lost access to valuable information.

No matter how many Internet security layers you have in place, always have backup. Set in place at least two automatic backups. If everything else fails, at least you'll be covered.

It's not complicated to set them up, you don't need advanced tech skills. Our colleague Andra explained in a separate blog article how you can easily backup your data.

And here are two more tools that will help you out:

Best Backup - helps you choose the backup solutions suited to your needs

Spider Oak - backup solution focused on encryption and Internet security

Although ignored by most people, this step is also important to cyber security. Take your time and file a report if you run into anything that looks fishy.

If you have a hunch that something is wrong and you might have fallen into a trap, immediately contact your bank or credit card institution and close the accounts you believe they may have been compromised.

If this is not the case and you simply ran into spam, scams or phishing attempts, it's best that you report them to government organizations or even cyber security companies.

Here are some of the places where you can do that:

MISCELLANEOUS

A few tools that didn't fit into any other major category, but we also wanted to mention them.

Eraser - Windows tool that allows you to completely remove data from your hard drive, by overwriting it several times.

Cvedetails.com - check how many vulnerabilities your favorite apps have and how severe they are..

Header Analysis - analyse email header. And here's how you can read the header details.

Free Shredder Software Programs - A very useful list of 36 free software tools that will help you delete files on your computer.

Site Safety - A tool that helps you identify whether a site is safe or not

Deseat.me - It help you clean up your online presence

IP Feeds - This tool analyzes all security IP Feeds that are related to online attacks

WhatisMyBrowser - An online service providing data about your browser's capabilities.

Scrim - This tool helps you convert your email address into a short and safe link

We also recommend checking these quizzes to help you test and update your Internet security knowledge:

For the ones with advanced technical skills, here are some tools that show vulnerabilities in software:

Conclusion

In the cyber security game, the good guys and the bad ones constantly try to outrun each other. That's why you should always remember that no tool is bulletproof. Don't rely exclusively on a software or an app to keep you safe, as they all have flaws and vulnerabilities.

Instead, try to think and act like a journalist. Question everything that you receive or run into in the digital world, even if it only looks slightly suspicious. Triple check it before you act on it, be sure that you don't throw yourself into anything fishy.

Continue to improve your cyber education. In time, you'll train your intuition and it will become increasingly easier to spot potential compromises.

It's essential that you never give up on healthy Internet security habits. Add as many security layers as possible - onion style - in order to decrease the impact of a potential attack.
Hope for the best and prepare for the worst, right? This article was initially published by Cristina Chipurici in May 2016 and it was republished in July 2017.

# data[].attributes.attachment_link.title
We Tested More than 50 Free Security Tools so You can Use Them for Your Online Protection

# data[].attributes.attachment_link.description
The idea that we should create a gargantuan list of cyber security tools started to spring in our minds around the beginning of this year. We started from a simple idea: It should be useful. We need it. You need it. It will come in handy in the future, to have all those tools in one place.

# data[].attributes.body
September 25, 2017

# data[].attributes.attachment_link.readable_text
Download CSET using the link at the bottom of this page or by clicking here. After clicking the link, you will be asked to identify yourself and will then be given the opportunity to download the file CSET_x.x.iso (where x.x represents the download version).

The CSET download is in a file format known as "ISO." This file is an "image" of the equivalent installation files included on the CSET CD. Because of this format, it is necessary to process the download using one of the following methods:

1. Decompressing the File - Open the file using any one of the newer compression utility software programs.

2. Mounting the File - this method loads the ISO file using utility software to make the file appear like a virtual drive with the original CD loaded.

3. Burning the file to CD - this method uses CD-burn software and the ISO file to burn the files onto your own CD to create a physical disk identical to the CSET original.

These methods require separate software utilities. There are a variety of both free and purchased utility programs available through the Internet that will work with the ISO file format. As DHS does not recommend any specific application or vendor, it will be necessary for you to find a product that provides the necessary functionality. Step by step instructions for each method are provided below:

Decompressing the File

1. CLICK the "Download CSET" link at the bottom of this page and complete the requested information to download the ISO file.

2. SAVE the file to your hard drive of choice (i.e., your computer hard drive or USB drive) maintaining the file name and extension (.iso).

3. OPEN the ISO file with a compression utility program and SAVE the files to your hard drive of choice maintaining the original names and file extensions.

4. COMPLETE the Installing the CSET Program instructions below.

Mounting the File

1. CLICK the "Download CSET" link at the bottom of this page and complete the requested information to download the ISO file.

2. SAVE the file to your hard drive of choice (i.e., your computer hard drive or USB drive) maintaining the file name and extension (.iso).

3. RUN your ISO-specific utility program that is capable of mounting the file. COMPLETE the instructions within the utility software to create a virtual drive using the ISO file. If you do not have an ISO utility application you will need to find and install one before continuing with these instructions.

4. COMPLETE the Installing the CSET Program instructions below.

Burning the file to CD

1. CLICK the "Download CSET" link at the bottom of this page and complete the requested information to download the ISO file.

2. SAVE the file to the hard drive on your computer maintaining the filename and extension (.iso).

3. INSERT a blank, writable CD into the computer's CD drive.

4. RUN your CD-burn utility program. COMPLETE the instructions on your utility program to burn the ISO image to your DVD. (If you do not have an application that can do this, then you will need to find and install one before continuing with these instructions.)

5. COMPLETE the Installing CSET Program instructions below.

Installing the CSET Program

1. FIND the CSET_Setup.exe file in the folder, virtual drive, or CD containing the CSET files.

2. DOUBLE-CLICK the CSET_Setup.exe file to execute. This will initiate the installer program.

3. COMPLETE the instructions in the installation wizard to install the CSET program.

4. READ the material within the ReadMe document for a summary explanation of how to use the tool. Help is also available through the User Guide, screen guidance text, and video tutorials.

Video Tutorials

A number of video tutorials are available to help you better understand how to use this tool. They are designed to play within YouTube. Therefore, you must have an active internet connection to view them. You can access these videos by navigating to the CSET YouTube channel ( https://www.youtube.com/c/CSETCyberSecurityEvaluationTool).

To view close captioning in YouTube, click on the "cc" icon on the video window.

System Requirements

In order to execute CSET, the following minimum system hardware and software is required:

Pentium dual core 2.2 GHz processor (Intel x86 compatible)

CD-ROM drive if creating a physical CD

5 GB free disk space

3 GB of RAM

Microsoft Windows 7* or higher

A Microsoft Office compatible (.docx) document reader is required to view reports in .docx format

A Portable Document Format (PDF) reader such as Adobe Reader is required to view supporting documentation. The latest free version of Adobe Reader may be downloaded from http://get.adobe.com/reader/

Microsoft .NET Framework 4.6 Runtime (included in CSET installation)

SQL Server 2012 Express LocalDB (included in CSET installation)

NOTE: For all platforms, we recommend that you upgrade to the latest Windows Service Pack and install critical updates available from the Windows Update website to ensure the best compatibility and security.

CSET Hash Values

SHA-256: DAE59D7DCFAD7FA02D70F0C4F74A4BA9FE9A4E70BE85BDEFDD07F3DC40DB3791

MD5: 867224a9e7c2b84eedb11f214fcd0e97

SHA-1: 3609f4c5b6ed5042b4da5da3a868a211b797ee95

To download CSET 8.0, select the following link:
Download CSET
If you are unable to download or install CSET from the link, you may request a copy be shipped. To request a copy, please send an email to: cset@hq.dhs.gov. Please insert "CSET" in the subject line and include the following in your email request:

Your name

Organization name

Complete street address (no P.O. boxes)

Telephone number

The error or installation issue you encountered when attempting the download

# data[].attributes.attachment_link.description
Download CSET using the link at the bottom of this page or by clicking here. After clicking the link, you will be asked to identify yourself and will then be given the opportunity to download the file CSET_x.x.iso (where x.x represents the download version).

# data[].attributes.headline
CSET Cyber Security Evaluation Tools Videos

# data[].attributes.subject
CSET Cyber Security Evaluation Tools Videos

# data[].attributes.body
September 25, 2017

# data[].attributes.attachment_link.keywords[]
"cyber security" "computer security" "cyber security evaluation tool" dhs inl "idaho national laboratory"

# data[].attributes.attachment_link.description
CSET is a desktop software tool that guides users through a step-by-step process to assess their control system and information technology network security p...

# data[].attributes.body
http://www.hirensbootcd.org/

# data[].attributes.body
Person Locator

# data[].attributes.body
http://my.nps.edu/web/cisr/latestv
grostolis

# data[].attributes.attachment_link.title
6.2.3.8 Packet Tracer - Router and Switch Redundancy

# data[].attributes.attachment_link.title
7.4.2.4 Packet Tracer - Server Firewalls and Router ACLs

# data[].attributes.attachment_link.title
2.5.2.6 Packet Tracer - Exploring File and Data Encryption

# data[].attributes.attachment_link.title
8.3.1.3 Packet Tracer - Skills Integrated Challenge

# data[].attributes.attachment_link.title
6.2.4.4 Packet Tracer - Router and Switch Resilience

# data[].attributes.attachment_link.title
3.3.2.7 Packet Tracer - WEP WPA2 PSK WPA2 RADIUS

# data[].attributes.attachment_link.title
4.3.3.3 Packet Tracer - Configuring VPN Transport Mode

# data[].attributes.attachment_link.title
2.5.2.7 Packet Tracer - Using File and Data Integrity Checks

# data[].attributes.attachment_link.title
4.3.3.4 Packet Tracer - Configuring VPN Tunnel Mode

# data[].attributes.attachment_link.title
1.5.3.6 Packet Tracer - Communicating in a Cyber World

# data[].attributes.attachment_link.title
1.5.3.5 Packet Tracer - Creating a Cyber World