The Top 500 Worst Passwords of All Time

Check The Link..
http://www.whatsmypass.com/the-top-500-worst-passwords-of-all-time

The Samurai Web Testing Framework is a LiveCD

The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites. In developing this environment, we have based our tool selection on the tools we use in our security practice. We have included the tools used in all four steps of a web pen-test.

Starting with reconnaissance, we have included tools such as the Fierce domain scanner and Maltego. For mapping, we have included tools such WebScarab and ratproxy. We then chose tools for discovery. These would include w3af and burp. For exploitation, the final stage, we included BeEF, AJAXShell and much more. This CD also includes a pre-configured wiki, set up to be the central information store during your pen-test.

Download :

http://sourceforge.net/projects/samurai/

There has been a lot of discussion in recent weeks about some new variants of the Popureb rootkit that clobber your Master Boot Record (MBR).

Initial reports from Microsoft even suggested the only way to recover was to reinstall Windows, which fortunately is not true. But knowing how this rootkit work will surely increase your knowledge.

SophosLabs published a technical paper that looks at the inner workings of Popureb.

Download
http://www.sophos.com/medialibrary/PDFs/technical%20papers/popureb.pdf?dl=true

Durandal is a distributed GPU/CPU computing software that aims to crack passwords. Mostly written in C++ with the Boost library, it works on many systems, however it is only
built for Windows and GNU/Linux for the moment, on the x86 and x64 platforms.

Durandal is freely available under the GPLv3 license.

Features

Windows (XP, Vista, 7) and GNU/Linux support
32bits and 64bits support
Usual hash functions : MD5, SHA1, SHA256, SHA512, NTLMv1, MySQL (all versions)
SSE2 optimized, Nvidia CUDA support
Server, agent and administration console
Network communications with XML over HTTP (proxy support)

Download
http://durandal-project.org/download.html

Vega is an open source platform to test the security of web applications. Vega can help you find and validate SQL Injections, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.

Download
http://subgraph.com/vega_download.php

Modules

Cross Site Scripting (XSS)
SQL Injection
Directory Traversal
URL Injection
Error Detection
File Uploads
Sensitive Data Discovery

WebSurgery is a suite of tools for security testing of web applications. It was designed for security auditors to help them with the web application planning and exploitation. Currently, it uses an efficient, fast and stable Web Crawler, File/Dir Bruteforcer and Fuzzer for advanced exploitation of known and unusual vulnerabilities such as SQL Injections, Cross site scripting (XSS), brute-force for login forms, identification of firewall-filtered rules etc.

Download Setup
http://www.surgeonix.com/blog/downloads/websurgery/setup.msi
Download Portable
http://www.surgeonix.com/blog/downloads/websurgery/websurgery.zip

XSS-Harvest.
It is multi-threaded pre-forking web server written in Perl, and requires no dependencies other than a couple of common Perl modules; you do not need a web server or database to use this tool. Before going into the detail, I'll list the high level functionality below:

Infection script adds relevant event listeners (keystrokes, onload() and mouse clicks) to the vulnerable page and sets up communication with the XSS-Harvest server.
Any key entered will be sent covertly to the server.
Any mouse click performed will be analysed and the data covertly sent to the server.
Optionally 'redress' the vulnerable page to display a different page on the same subdomain - e.g. a login form.
If redressing the victim's browser, allow subsequently loaded pages to be also 'infected' - assuming they don't break the same-origin policy (i.e. they're on the same subdomain).
Keeps track of victims for the lifetime of the XSS-Harvest cookie (future visits are recognised as a returning victim).
Each victim has a separate history file containing all events, cookies and keystrokes.
Server console displays real time data received (due to multi-threaded nature, keystrokes are displayed as '.' characters to avoid confusion).
Tested in IE6-9 (reflected XSS protection in IE9 will limit exploitation to stored XSS only in most cases), FF5, Chrome and various mobile browsers (Safari and Android). Please let me know your success with other browsers.
Overcomes browser oddities, such as Internet Explorer throttling requests to the same URL when exfiltrating keystrokes.

How to Exploit XSS with XSS-Harvest

Identify a page vulnerable to XSS (reflected or persistent will be fine - unless the victim is running IE9 or another plugin such as NoScript).
Understand the markup of the page. You should be looking to insert syntactically correct tags in to the source of the vulnerable page. Most attackers will insert something like 'alert(1)' at this stage to ensure the page is actually vulnerable.
Start the XSS-Harvest server as root if you wish to bind to a TCP port < 1024 (default port is 80), or as a limited user on a port > 1024 using the -p option. To start the server you must instruct it to listen with the -l option.
Insert the following 'injection string' into the vulnerable page:

This will return the client-side JavaScript to the victim, indicated by the 'i' in the URL.
Entice visitors to the infected page (or to follow a link in the case of reflected XSS).
Watch your victims roll in - a new history file will be created for each new victim.

If you wish to make use of the redress function, start the server with the -r parameter:

./xss-harvest.pl -l -r http://vulnerablepage.local/login.html

Download:
https://docs.google.com/leaf?id=0B-yhjV3y1-D2ZmVlMmUxMWUtNjJhYy00Njc5LWI0M2ItZTMwMmIxMTQ0NTNh&hl=en_GB

Pangolin is an automatic SQL injection penetration testing (Pen-testing) tool for Website manager or IT Security analyst. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or users specific DBMS tables/columns, run his own SQL statement, read specific files on the file system and more.


Test many types of databases
Your web applications using Access,DB2,Informix,Microsoft SQL Server 2000,Microsoft SQL Server 2005,Microsoft SQL Server 2008,MySQL,Oracle,PostgreSQL,Sqlite3,Sybase?
Pangolin supports all of them.

Features: Auto-analyzing keyword, HTTPS support, Pre-Login, Bypass firewall setting, Injection Digger, Data dumper, etc.

Download
http://down3.nosec.org/pangolin_free_edition_3.2.3.1105.zip

BackTrack 4 : Assuring Security by Penetration Testing

Written as an interactive tutorial, this book covers the core of BackTrack with real-world examples and step-by-step instructions to provide professional guidelines and recommendations to you. The book is designed in a simple and intuitive manner, which allows you to explore the whole BackTrack testing process or study parts of it individually. If you are an IT security professional or network administrator who has a basic knowledge of Unix/Linux operating systems including awareness of information security factors, and you want to use BackTrack for penetration testing, then this book is for you.




Download :
http://shrta.com/files/0ZYSOJBV/BackTrack-4-Assuring-Security-by-Penetration-Testing.zip

Anonymous Super Secret Security :P Handbook

Master Table of Contents
1) Preface
2) Setting up Tor
3) Firefox Recommended Add-Ons
4) Setting up i2p
4.1) Installation
4.2) Firefox Configuration
4.3) IRC Client Configuration
4.4) I2p IRC on Android via irssi connectbot
5) Advanced IRC
5.1) Commands
5.2) Browsing
6) Advanced Defense Techniques
7) Portable Solutions
8) ADVANCED GUIDE TO HACKING AND SECURITY VULNERABILITY

Download PDF:
http://adf.ly/313683/http://www.ziddu.com/download/15519429/Anonymous-Super-Secret-Security-Handbook.pdf.html

SQL Injection Attacks and Defense

Here is the table of contents…

Chapter 1: What is SQL Injection?
Chapter 2: Testing for SQL Injection
Chapter 3: Reviewing Code for SQL Injection
Chapter 4: Exploiting SQL Injection
Chapter 5: Blind SQL Injection Exploitation
Chapter 6: Exploiting the Operating System
Chapter 7: Advanced Topics
Chapter 8: Code-Level Defenses
Chapter 9: Platform-Level Defenses
Chapter 10: References

The Shellcoder’s Handbook

Part 1: Introduction to Exploitation: Linux on x86.

Chapter 1: Before You Begin.
Chapter 2: Stack Overflows.
Chapter 3: Shellcode.
Chapter 4: Introduction to Format String Bugs.
Chapter 5: Introduction to Heap Overflows.

Part 2: Exploiting More Platforms: Windows, Solaris, and Tru64.

Chapter 6: The Wild World of Windows.
Chapter 7: Windows Shellcode.
Chapter 8: Windows Overflows.
Chapter 9: Overcoming Filters.
Chapter 10: Introduction to Solaris Exploitation.
Chapter 11: Advanced Solaris Exploitation.
Chapter 12: HP Tru64 Unix Exploitation.

Part 3: Vulnerability Discovery.

Chapter 13: Establishing a Working Environment.
Chapter 14: Fault Injection.
Chapter 15: The Art of Fuzzing.
Chapter 16: Source Code Auditing: Finding Vulnerabilities in C-Based Languages.
Chapter 17: Instrumented Investigation: A Manual Approach.
Chapter 18: Tracing for Vulnerabilities.
Chapter 19: Binary Auditing: Hacking Closed Source Software.

Part 4: Advanced Materials.

Chapter 20: Alternative Payload Strategies.
Chapter 21: Writing Exploits that Work in the Wild.
Chapter 22: Attacking Database Software.
Chapter 23: Kernel Overflows.
Chapter 24: Exploiting Kernel Vulnerabilities.

Title: Malware Analyst’s Cookbook and DVD
Author: Michael Ligh, Steven Adair, Blake Hartstein, Matthew Richard
Publisher: Wiley
Hardcover: 744 pages
Release Date: November 2, 2010

Here is the ‘Table of Contents’

Chapter 1 – Anonymizing Your Activities.
Chapter 2 – Honeypots.
Chapter 3 – Malware Classification.
Chapter 4 – Sandboxes and Multi-AV Scanners.
Chapter 5 – Researching Domains and IP Addresses.
Chapter 6 – Documents, Shellcode, and URLs.
Chapter 7 – Malware Labs.
Chapter 8 – Automation.
Chapter 9 – Dynamic Analysis.
Chapter 10 – Malware Forensics.
Chapter 11 – Debugging Malware.
Chapter 12 – De-Obfuscation.
Chapter 13 – Working with DLLs.
Chapter 14 – Kernel Debugging.
Chapter 15 – Memory Forensics with Volatility.
Chapter 16 – Memory Forensics: Code Injection and Extraction.
Chapter 17 – Memory Forensics: Rootkits.
Chapter 18 – Memory Forensics: Network and Registry.

Social Engineering: The Art of Human Hacking

Title: Social Engineering: The Art of Human Hacking
Author: Christopher Hadnagy, Paul Wilson
Publisher: Wiley
Hardcover: 408 pages
Release Date: December 21, 2010

Table of Contents

A Look into the World of Social Engineering.
Information Gathering.
Elicitation.
Pretexting: How to Become Anyone.
Mind Tricks: Psychological Principles Used in Social Engineering.
Influence: The Power of Persuasion.
The Tools of the Social Engineer.
Case Studies: Dissecting the Social Engineer.
Prevention and Mitigation.

Title: Android in Action
Author: Frank Ableson, Robi Sen
Publisher: Manning Publications
Hardcover: 592 pages
Release Date: Jan 28, 2011 (2nd Edition)

Here’s the table of Contents

Part 1 What is Android?—The Big Picture

Chapter 1 Introducing Android
Chapter 2 Android’s development environment
Part 2 Exercising the Android SDK

Chapter 3 User interfaces
Chapter 4 Intents and Services
Chapter 5 Storing and retrieving data
Chapter 6 Networking and web services
Chapter 7 Telephony
Chapter 8 Notifications and alarms
Chapter 9 Graphics and animation
Chapter 10 Multimedia
Chapter 11 Location, location, location
Part 3 Android applications

Chapter 12 Putting Android to work in a field service application
Chapter 13 Building Android applications in C
Part 4 The maturing platform

Chapter 14 Bluetooth and sensors
Chapter 15 Integration
Chapter 16 Android web development
Chapter 17 AppWidgets
Chapter 18 Localization
Chapter 19 Android Native Development Kit

Practical Lock Picking

Title: Practical Lock Picking: A Physical Penetration Tester’s Training Guide
Author: Deviant Ollam
Publisher: Syngress
Hardcover: 236 pages
Release Date: July 23, 2010

Here is the table of contents

Chapter 1: Fundamentals of pin tumbler and wafer locks
Chapter 2: The basics of picking: Exploiting weaknesses
Chapter 3: Beginner training: How to get very good, very fast
Chapter 4: Advanced training: Learning some additional skills
Chapter 5: Quick-entry tricks: Shimming, bumping, and bypassing
Chapter 6: They all come tumbling down: Pin tumblers in other configurations
Appendix: Guide to tools and toolkits

The Hacker News June 2011

Content :
- Total Exposure
- Wikileaks : Exposure in true way
- Guide about selecting your Computer Security Consultant
- In the Realm of Cyber Breach
- Exploit Writers : Challenging Cyber Security
- Interview with Team Inj3ct0r
- IT Security Incident Management
- Interview with Core Anonymous Member : Anony_ops
- Exposure of Password secrets of Apple Safari
- Sony Hacked , Again hacked & Again Hacked
- Hacking News Highlights of the Month
- Hackers Toolkits Updates
- Security Tool : Buffer Zone

Download:
http://theevilhackerz.com/THN-june2011.pdf

The Hacker News June 2011

Content :
- Total Exposure
- Wikileaks : Exposure in true way
- Guide about selecting your Computer Security Consultant
- In the Realm of Cyber Breach
- Exploit Writers : Challenging Cyber Security
- Interview with Team Inj3ct0r
- IT Security Incident Management
- Interview with Core Anonymous Member : Anony_ops
- Exposure of Password secrets of Apple Safari
- Sony Hacked , Again hacked & Again Hacked
- Hacking News Highlights of the Month
- Hackers Toolkits Updates
- Security Tool : Buffer Zone

Download:
http://theevilhackerz.com/THN-june2011.pdf

ClubHACK Magazine Issue 17-June 2011

Tech Gyan - Pentesting your own Wireless Network
Tool Gyan - Wi-Fi tools
Mom's Guide - Wireless Security - Best Practices
Legal Gyan - Copyrights and cyber space
Matriux Vibhag - Forensics with Matriux Part - 2
Poster of the month - Can you cage a Wi-Fi signanl ?

Download:
http://chmag.in/issue/jun2011.pdf

ClubHack Magazine

Contents of this Issue:-

Tech Gyan - First ever public disclosure of Password secrets of "Apple Safari".
Tool Gyan - BeEF (Browser Exploitation Framework)
Mom's Guide - User Agent on my Header.
Legal Gyan - New Rules under Information Technology Act.
Matriux Vibhag - Forensics with Matriux Part - 1
Poster of the month - How safe you are while surfing?


Direct Download: http://chmag.in/issue/may2011.pdf

The Web Application Hacker's Handbook 2nd: Discovering and Exploiting Security Flaws

Web Application (In)security
Core Defense Mechanisms
Web Application Technologies
Mapping the Application
Bypassing Client-Side Controls
Attacking Authentication
Attacking Session Management
Attacking Access Controls
Injecting Code
Exploiting Path Traversal
Attacking Application Logic
Attacking Other Users
Automating Bespoke Attacks
Exploiting Information Disclosure
Attacking Compiled Applications
Attacking Application Architecture
Attacking the Web Server
Finding Vulnerabilities in Source Code
A Web Application Hacker's Toolkit
A Web Application Hacker's Methodology

Download the full table of contents (PDF).
http://portswigger.net/wahh/wahh-toc.pdf

ClubHack Magazine. issue is dedicated to Browser security.

Direct Download:
http://chmag.in/issue/may2011.pdf

Tech Gyan - First ever public disclosure of Password secrets of "Apple
Safari".
Tool Gyan - BeEF (Browser Exploitation Framework)
Mom's Guide - User Agent on my Header.
Legal Gyan - New Rules under Information Technology Act.
Matriux Vibhag - Forensics with Matriux Part - 1

The Hacker News' Magazine - Social Engineering Edition - Issue 02 - May,2011 Released !


We are happy to Announce that 'The Hacker News' [THN] Magazine Issue 02 (May 2011) is Out . This time we cover "Social Engineering Edition" . The Index of Content is as Given Below :

Social Engineering
Opsony By Anonymous
Anna Hazare - The Revolution in India
Message By Pattie Galle
Hacking News of Month
Hackers Toolkit updates & Downloads
Defacement News
Security and Hacking Events of Month
Cyber Crime News
Linux News
Security Updates
Vulnerability Exposure

Download:
http://theevilhackerz.com/may-2011.pdf

The Hacker’s Underground Handbook
Ebook

The Hacker’s Underground Handbook
Learn What it Takes to Crack Even the Most Secure Systems
By: David Melnichuk

The Hacker’s Underground Handbook will guide you through password hacking, windows hacking, malware, phising, web hacking, network hacking and Linux (intro, installation, etc). All this material fully packed with images, thus being a top step-by-step guide, on the course of which you cannot fail.

A great starting book which will guide you in the right direction, helping you understand the basic concepts of computer security and matters that you should take in consideration.

Download PDF
http://3xploit.com/file/The_Hackers_Underground_Handbook.pdf

XSS Attacks
Ebook

PUBLISHED BY- Syngress Publishing, Inc. ISBN-10: 1-59749-154-3
ISBN-13: 978-1-59749-154-9
This book is all about XSS. It will cover these topics on XSS.

Cross-site Scripting Fundamentals.
The XSS Discovery Toolkit
XSS Theory
XSS Attack Methods
Advanced XSS Attack Vectors
XSS Exploited
Exploit Frameworks
XSS Worms
Preventing XSS Attacks

Download PDF
http://3xploit.com/file/Cross_Site_Scripting_Attacks_XSS_Exploits_and_Defense_tqw_darksiderg.rar

Title: The Art of Computer Virus Research and Defense
Author: Peter Szor
Publisher: Addison-Wesley Professional
Hardcover: 744 pages



Part: I Strategies of the Attacker

Chapter 1. Introduction to the Games of Nature
Chapter 2. The Fascination of Malicious Code Analysis
Chapter 3. Malicious Code Environments
Chapter 4. Classification of Infection Strategies
Chapter 5. Classification of In-Memory Strategies
Chapter 6. Basic Self-Protection Strategies
Chapter 7. Advanced Code Evolution Techniques and Computer Virus Generator Kits
Chapter 8. Classification According to Payload
Chapter 9. Strategies of Computer Worms
Chapter 10. Exploits, Vulnerabilities, and Buffer Overflow Attacks

Part: II Strategies of the Defender

Chapter 11. Antivirus Defense Techniques
Chapter 12. Memory Scanning and Disinfection
Chapter 13. Worm-Blocking Techniques and Host-Based Intrusion Prevention
Chapter 14. Network-Level Defense Strategies
Chapter 15. Malicious Code Analysis Techniques

Title: Kingpin – How One Hacker Took Over the Billion-Dollar Cybercrime Underground
Author: Kevin Poulsen
Publisher: Crown
Hardcover: 288 pages
Release Date: February 22, 2011

In KINGPIN, Kevin tells the story of Max Vision, a white hat computer hacker who turned to the dark side. Among other things, Max stole credit card data — “dumps” — on millions of consumers, which he sold in bulk to a card counterfeiter named Chris Aragon. In this excerpt, a new discovery gives him a chance to expand his operation.
Book exposes scary story of how online hackers stocked credit card numbers, fake checks, hacked bank accounts to make millions overnight through well structured ring of criminals operating from dark corners of world. It showcases how attackers used advanced techniques such as remote execution exploits, smart phishing sites, Trojans, advanced keyloggers to sweep the innocent victims around the world and transferred bounties under the nose of security guards from top banks. A good case study for Howard folks to ponder into.

This site uses a number of databases that have been released to the public. No passwords are stored in the ShouldIChangeMyPassword.com database.

https://shouldichangemypassword.com/

Source
https://shouldichangemypassword.com/sources.php