Sandcat Browser includes the following pen-test oriented features:

Live HTTP Headers
Request Editor extension
Fuzzer extension with multiple modes and support for filters
JavaScript Executor extension -- allows you to load and run external JavaScript files
Lua Executor extension -- allows you to load and run external Lua scripts
Syhunt Gelo
HTTP Brute Force, CGI Scanner scripts and more.

Download
http://www.syhunt.com/?n=Sandcat.Browser

Cross-platform tool to analyze the configuration of SSL servers.
Supports cipher suites scanning, insecure renegotiation verification, session resumption testing, client certificates, and more...
Tested on Python 2.6 & 2.7, and Ubuntu and Windows 7, both 32 and 64 bits. Based on OpenSSL and a custom Python wrapper.
Contact: sslyze /at/ isecpartners \dot\ com


Download
http://code.google.com/p/sslyze/downloads/list

Tool To Recover Cleartext Passwords From Lsass. It was possible to recover the cleartext passwords of logged on windows users.

Download
http://blog.gentilkiwi.com/downloads/mimikatz_trunk.7z
http://blog.gentilkiwi.com/downloads/mimikatz_trunk.zip

Details
libpurple is an Instant Messaging (IM) library developed by the Pidgin project. It is used by a number of IM clients including Pidgin and Adium. libpurple-based clients support the OTR (“Off-the-Record”) protocol either natively or via a plugin. The OTR messaging protocol enables users to communicate securely over any IM network.

pidgin-otr-snooping.py is a proof-of-concept Python script that connects to DBUS and prints all messages received via Pidgin’s “ReceivedImMsg” and “WroteImMsg” signals. The example below shows messages transmitted during an OTR conversation:
user@host:~$ python pidgin-otr-snooping.py
sent 'hey' to user1@example.com
received 'ho' from user1@example.com
sent 'lets go!' to user1@example.com
An exploited application that connects to DBUS (or reuses an already established connection) to listen for private messages provides identical forensic evidence (logs) as any application that connects to DBUS for legitimate purposes. It is thus difficult to identify in-memory eavesdropping of this sort, especially in cases where there is no supportive evidence that might suggest it (offending process image, related traffic logs etc.).

Download pidgin-otr-snooping.py
http://census-labs.com/media/pidgin-otr-snooping.py.txt

by
Dimitris Glynos

The fastest smartphone is here. The Ascend D Quad features a 4.5inch HD screen, 8MP BSI camera, Dolby surround audio, 1800/2500mAh battery with 30% power saving technology and 1.5GHz quad-core processor

Homepage
http://www.rapid7.com/

XSS
URL:
hxxps://www.rapid7.com/register/metasploit-trial-key.jsp?product=Metasploit+Pro&returnPathURL=https:
//localhost:3790/setup/activation' onmouseover=alert(/Black.Spook/) bad='&whence=

by
black.spook

Since last release in October, Metasploit added 54 new exploits, 66 new auxiliary modules, 43 new post-exploitation modules, and 18 new payloads.

Release Note
https://community.rapid7.com/docs/DOC-1701

Download
http://www.rapid7.com/downloads/metasploit.jsp

SIPVicious suite is a set of tools that can be used to audit SIP based VoIP systems. It currently consists of four tools:

svmap - this is a sip scanner. Lists SIP devices found on an IP range
svwar - identifies active extensions on a PBX
svcrack - an online password cracker for SIP PBX
svreport - manages sessions and exports reports to various formats
svcrash - attempts to stop unauthorized svwar and svcrack scans

Download
http://code.google.com/p/sipvicious/downloads/list

Hardanger is an open source web application penetration testing platform for Microsoft Windows operating systems.
Current Features

Native Windows feel via Windows Presentation Foundation
Can run as a Fiddler2 add-on or standalone
ClickOnce installer with automatic updates (standalone version)
Context tab allowing inspection of full HTTP requests
Server fuzzer tab to configure and launch the server fuzzer
Basic random fuzzer generates random strings of UTF8 characters of random lengths
Non HTTP 200 detection engine
Results window keeping track of successful detections
Ability to review requests/responses in the results details window

Download
http://hardanger.codeplex.com/releases/view/81426

The PacketFence development team has published version 3.2.0 of its open source network access control (NAC) system. PacketFence allows organisations to increase control over their network by enforcing authentication and registration for newly connected devices. It also enables abnormal network activity detection and the isolation of troublesome devices.

Download
http://www.packetfence.org/download/releases.html

Things you will need:

1. OllyDbg v1.10
2. Notepad.exe

Info
http://pastebin.com/n0fgJ1YL

by
Huxley