Auditing Techniques and Tools

Various tools are used in the auditing process. Site audits may only use generalized network and security scanners while penetration tests may use more invasive tools such as sniffers, password crackers or session hijackers.

• Scanners

  Scanners provide for the automated auditing of a large number of networked hosts. Scanners can detect and identify active hosts on a network. This allows for network mapping and discovery of host based services. Vulnerability scanners can identify potential security or misconfiguration problems.

• Networks Tools

  Network Tools provide for the analysis of a network under audit. Network traffic and protocols can be analyzed for security concerns. Firewall ACLs and router filtering can be probed and tested.

• Sniffers

  Sniffers are employed to capture specific network content. They are often used to collect user names and passwords transfered in the clear or in hash form. Content such as email, printouts, web browsing and file sharing can be captured. Data collected can be used to evaluate the risks associated with various network protocols, applications and user activities.

• Password Crackers

  Password Crackers are used to evaluate weak password selections. These tools can be used proactively by system administrators to identify users with weak passwords. during a penetration test, password crackers are used to attempt privilege escalation.

• Intruder Tools

  Intruder Tools include tools that exploit a specific weakness in an application, protocol or device. They can be used to bypass or confuse security applications. They may be capable of inserting commands in a communications channel or allow the penetration tester to masquerade as a valid user. Other tools may exploit flaws either locally or remotely to gain unauthorized or privileged access to data or services.

The (In)Security Database Best of Breed

The following provides a Best of Breed selection from the (In)Security Database in the major categories. Unless otherwise noted, they are designed to run under Unix-like operating systems.