sorted by: recent | see :
popular
Content Tagged with analysis + Security
Snort - the de facto standard for intrusion detection/prevention
"SNORT® is an open source network intrusion prevention and detection system utilizingprotocol and anomaly based inspection methods. With millions of downloads to date, Snort is the most w
Security
Software
linux
Administration
network
snort
analysis
Snort - the de facto standard for intrusion detection/prevention
"SNORT® is an open source network intrusion prevention and detection system utilizing a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods. With millions of downloads to date, Snort is the most w
opensource: del.icio.us tag/opensource
Security
Software
linux
Administration
network
snort
analysis
Wireshark: Go deep.
network protocol analyzer developed by an international team of networking experts
opensource: del.icio.us tag/opensource
Security
Software
network
networking
analysis
tools
opensource
JSON vs XML - subbu.org
<sep/>markup-oriented applications - use HTML. For data-oriented applications the choice is between XML and JSON. Until recently I did not pay much attentio
introduction to svmap
Svmap is a network scanner for SIP. Similar to nmap - it will scan for devices on ports specified by passing the right command line options. Once svmap finds a device that supports SIP, it will extract information from the response and identify the type of device. Anyone running this tool will typically end up with a list of IP addresses of SIP devices and the names for those devices.
A penetration tester or security auditor will probably find this tool particularly useful especially during reconnaissance. With the IP address, device name and possibly version at hand, he or she can then target security weaknesses specific to that device. A security administrator or security analyst can also make use of svmap to list different active SIP user-agents on the network. Based on this information, the security administrator then has the ability to identify rogue and vulnerable devices which can cause a security concern.
Svmap is able to scan for SIP devices much faster than generic UDP port scanners. Typical port scanners such as nmap, scan UDP ports by sending a packet to each port and expecting an ICMP packet which indicates that the port is closed. If no ICMP error is received within a reasonable time, the port scanner assumes that the port is either open or else filtered. While this method has worked for years, it can never be considered efficient or neat, (at least) because of two reasons:
- The majority of UDP ports are closed - therefore having to wait for each ICMP error to confirm that the port is closed is not a good idea
- Nowadays a lot of devices are behind firewalls or NAT and will never reply with an ICMP error
For examples on how to use svmap check out the wiki.
Download the whole SIPVicious tool suite from the project page.
its the end of the world as we know it
Here are some apocalyptic scenarios related to VoIP and SIP:
But IMHO, one thing's for sure - with big vendors like Microsoft, entering the market .. VoIP is here to stay.
- SIP's Insecurity Blanket
- Report Finds VOIP Services Susceptible to Major Attacks Through SIP
- VoIP security industry -- guilty as charged
But IMHO, one thing's for sure - with big vendors like Microsoft, entering the market .. VoIP is here to stay.
introduction to svmap
Svmap is a network scanner for SIP. Similar to nmap - it will scan for devices on ports specified by passing the right command line options. Once svmap finds a device that supports SIP, it will extract information from the response and identify the type of device. Anyone running this tool will typically end up with a list of IP addresses of SIP devices and the names for those devices.
A penetration tester or security auditor will probably find this tool particularly useful especially during reconnaissance. With the IP address, device name and possibly version at hand, he or she can then target security weaknesses specific to that device. A security administrator or security analyst can also make use of svmap to list different active SIP user-agents on the network. Based on this information, the security administrator then has the ability to identify rogue and vulnerable devices which can cause a security concern.
Svmap is able to scan for SIP devices much faster than generic UDP port scanners. Typical port scanners such as nmap, scan UDP ports by sending a packet to each port and expecting an ICMP packet which indicates that the port is closed. If no ICMP error is received within a reasonable time, the port scanner assumes that the port is either open or else filtered. While this method has worked for years, it can never be considered efficient or neat, (at least) because of two reasons:
- The majority of UDP ports are closed - therefore having to wait for each ICMP error to confirm that the port is closed is not a good idea
- Nowadays a lot of devices are behind firewalls or NAT and will never reply with an ICMP error
For examples on how to use svmap check out the wiki.
Download the whole SIPVicious tool suite from the project page.
its the end of the world as we know it
Here are some apocalyptic scenarios related to VoIP and SIP:
But IMHO, one thing's for sure - with big vendors like Microsoft, entering the market .. VoIP is here to stay.
- SIP's Insecurity Blanket
- Report Finds VOIP Services Susceptible to Major Attacks Through SIP
- VoIP security industry -- guilty as charged
But IMHO, one thing's for sure - with big vendors like Microsoft, entering the market .. VoIP is here to stay.
Ethereal: A Network Protocol Analyzer
Powerful Multi-Platform Analysis
Page 1 | Next >>