Section: .. / UNIX / audit /
| /// File Name: |
chkrootkit-0.30.tar.gz |
Description:
|
chkrootkit locally checks for signs of a rootkit. Includes detection of LKM rootkits, ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions. Tested on Linux, FreeBSD, Solaris, and OpenBSD.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | Now detects RK17 and the lion worm. New tests - Now checks for patched versions of basename, dirname, traceroute, rpcinfo, rexedcs, date, echo, env, timed, identd, pop2, pop3, write, tar, mail, biff, and grep. | | File Size: | 17235 | | Last Modified: | Mar 26 19:54:41 2001 |
| MD5 Checksum: | 2f1c9ec3c3bf62d50c70e25a52ddc1d7 |
|
| /// File Name: |
chkrootkit-0.33.tar.gz |
Description:
|
chkrootkit locally checks for signs of a rootkit. Includes detection of LKM rootkits, ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions. Tested on Linux, FreeBSD, Solaris, and OpenBSD.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | New tests added - amd, named, egrep, slogin. Detects more works, including ShitC, Omega, Wormkit, dsc-rootkit, and Maniak. A bug in chklastlog was fixed, as were some other misc bugs. | | File Size: | 15372 | | Last Modified: | Jun 8 21:13:39 2001 |
| MD5 Checksum: | 95302616bae6811f5e9eb02afdbdbe13 |
|
| /// File Name: |
chkrootkit-0.35.tar.gz |
Description:
|
chkrootkit locally checks for signs of a rootkit. Includes detection of LKM rootkits, ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions. Tested on Linux, FreeBSD, Solaris, and OpenBSD. Tested on Linux 2.0.x, 2.2.x and 2.4.x (any distribution), FreeBSD 2.2.x, 3.x and 4.x, OpenBSD 2.6, 2.7, 2.8, 2.9 and 3.0, Solaris 2.5.1, 2.6 and 8.0.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | Now includes its own strings command, tests for ldsopreload and lsof, new ports added to the bindshell test, and several new rootkits and trojans added, including the RST.b trojan, duarawkz, knark LKM, HiDrootkit, Monkit, Bobkit, Pizdakit, and t0rn v8.0. | | File Size: | 23571 | | Last Modified: | Jan 19 00:23:37 2002 |
| MD5 Checksum: | edf50a9c8c6bf09b0a9147f2e6168826 |
|
| /// File Name: |
chkrootkit-0.37.tar.gz |
Description:
|
Chkrootkit locally checks for signs of a rootkit. Includes detection of LKM rootkits, ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x and 4.x, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | New rootkits and worms are now detected - Now looks for 41 different ones including OpenBSD rk v1, Illogic rootkit, and SK rootkit, slapper SSL worm, and FreeBSD scalper worm.. Some bugfixes and improvements were made. | | File Size: | 25312 | | Last Modified: | Sep 17 07:19:17 2002 |
| MD5 Checksum: | b0feebea67655daa440da92099dd5187 |
|
| /// File Name: |
chkrootkit-0.38.tar.gz |
Description:
|
Chkrootkit locally checks for signs of a rootkit. Includes detection of LKM rootkits, ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x and 4.x, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | chkdirs.c added. chkproc.c improvements. Now includes slapper B, sebek LKM, LOC, and Romanian rootkit detection. new test added: trojan tcpdump. Minor bug fixes in the chkrootkit script. | | File Size: | 28500 | | Last Modified: | Dec 24 11:52:04 2002 |
| MD5 Checksum: | 53a0d56d8b5bd1300237fc448c0b37eb |
|
| /// File Name: |
chkrootkit-0.39a.tar.gz |
Description:
|
Chkrootkit v0.39a locally checks for signs of a rootkit. Chkrootkit includes ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions, strings.c for quick and dirty strings replacement, check_wtmpx.c to check for wtmpx deletions and the files chkproc.c and chkdirs.c to check for LKM trojans. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x and 4.x, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | Solaris bugs where fixed in chkdirs.c, HP-UX support was added to chkdirs.c, A new Adore version was added to chkproc.c, ps thread error fixed in chkproc.c, a Red Hat 8.0 bug was fixed in chkproc.c and detection for several Slapper variants is added to the package. | | File Size: | 29294 | | Last Modified: | Feb 2 14:29:05 2003 |
| MD5 Checksum: | 95c49aae601d402dac063f157de8fb58 |
|
| /// File Name: |
chkrootkit-0.42b.tar.gz |
Description:
|
Chkrootkit v0.42b locally checks for signs of a rootkit. Chkrootkit includes ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions, strings.c for quick and dirty strings replacement, check_wtmpx.c to check for wtmpx deletions and the files chkproc.c and chkdirs.c to check for LKM trojans. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x, 4.x, and 5.x, BSDI, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0, and HP-UX 11.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | Fixed NPTL threading mechanisms, minor corrections, chkrootkit, a new test (vdir), detection of the worms 55808.A and TC2, and detection of the rootkits Volc, Gold2, Anonoying, Suckit (improved), and ZK (improved). Fixed bugs and added BSDI support. | | File Size: | 31129 | | Last Modified: | Nov 11 00:34:18 2003 |
| MD5 Checksum: | b708c13663b784db1b1e675279707f7e |
|
| /// File Name: |
chkrootkit-0.44.tar.gz |
Description:
|
Chkrootkit checks locally for signs of a rootkit. Chkrootkit includes ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions, strings.c for quick and dirty strings replacement, check_wtmpx.c to check for wtmpx deletions and the files chkproc.c and chkdirs.c to check for LKM trojans. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x, 4.x, and 5.x, BSDI, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0, and HP-UX 11.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | del counter fixed, better support for Linux threads, Madalin now detected, lots of minor bug fixes. | | File Size: | 34101 | | Last Modified: | Nov 10 03:18:08 2004 |
| MD5 Checksum: | d1ea2951dfaa76aed3ce8554c0769626 |
|
| /// File Name: |
chkrootkit-0.45.tar.gz |
Description:
|
Chkrootkit checks locally for signs of a rootkit. Chkrootkit includes ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions, strings.c for quick and dirty strings replacement, check_wtmpx.c to check for wtmpx deletions and the files chkproc.c and chkdirs.c to check for LKM trojans. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x, 4.x, and 5.x, BSDI, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0, and HP-UX 11.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | Various improvements, minor bug fixes. | | File Size: | 36359 | | Last Modified: | Apr 18 02:53:28 2005 |
| MD5 Checksum: | 57493e24ca81750a200d8bcb4049e858 |
|
| /// File Name: |
chkrootkit-0.48.tar.gz |
Description:
|
Chkrootkit checks locally for signs of a rootkit. Chkrootkit includes ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions, strings.c for quick and dirty strings replacement, check_wtmpx.c to check for wtmpx deletions and the files chkproc.c and chkdirs.c to check for LKM trojans. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x, 4.x, and 5.x, BSDI, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0, and HP-UX 11.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | New and enhanced tests, minor bug fixes. | | File Size: | 38323 | | Last Modified: | Jan 3 17:58:17 2008 |
| MD5 Checksum: | de8b8b5013e7faa2b66c0e33c59677e8 |
|
| /// File Name: |
chkrootkit-043.tar.gz |
Description:
|
Chkrootkit v0.43 locally checks for signs of a rootkit. Chkrootkit includes ifpromisc.c to check and see if the interface is in promisc mode, chklastlog.c to check lastlog for deletions, and chkwtmp.c to check wtmp for deletions, strings.c for quick and dirty strings replacement, check_wtmpx.c to check for wtmpx deletions and the files chkproc.c and chkdirs.c to check for LKM trojans. Tested on Linux 2.0.x, 2.2.x and 2.4.x, FreeBSD 2.2.x, 3.x, 4.x, and 5.x, BSDI, OpenBSD 2.6, 2.7, 2.8, 2.9, 3.0 and 3.1, NetBSD 1.5.2 and Solaris 2.5.1, 2.6 and 8.0, and HP-UX 11.
| | Author: | Nelson Murilo | | Homepage: | http://www.chkrootkit.org | | Changes: | Better PROMISC mode detection on newer Linux kernels, new CGI backdoors detected, new rootkits added, and minor bug fixes. | | File Size: | 33355 | | Last Modified: | Jan 6 17:05:22 2004 |
| MD5 Checksum: | 08646b9bf3a9dc45c25a40946962a839 |
|
| /// File Name: |
chkwtmp-1.0.tgz |
Description:
|
Chkwtmp checks /var/log/wtmp for signs of deletion, such as use of zap or z2 or similar log wiping programs. See also chklastlog.c
| | File Size: | 2467 | | Last Modified: | Aug 16 20:04:42 1999 |
| MD5 Checksum: | cb8ea99a1a133dd728a609a6c06bbff1 |
|
| /// File Name: |
chkwtmp.c |
Description:
|
Chkwtmp v1.1 checks /var/log/wtmp for signs of deletion, such as use of zap or z2 or similar log wiping programs. See also chklastlog.c
| | Changes: | Linux/FreeBSD port by Nelson Murilo. | | File Size: | 1565 | | Last Modified: | Jul 4 02:15:39 2000 |
| MD5 Checksum: | fce4743b75085d417016f7dc81d8bad7 |
|
| /// File Name: |
clfuzz.tar.gz |
Description:
|
clfuzz is a command line argument fuzzer written in Python. It is very useful for auditing setuid binaries for command line overflows.
| | Author: | Pranay Kanwar | | Homepage: | http://www.metaeye.org/warl0ck/ | | File Size: | 8550 | | Last Modified: | Apr 12 00:18:46 2006 |
| MD5 Checksum: | 299ca5891acce1aab09e284802c0e9ea |
|
| /// File Name: |
confcollect-0.1.tar.gz |
Description:
|
confcollect 0.1 - confcollect gathers information about the system on which it is installed and sends that information to an administrator via e-mail. The entire /etc directory tree is sent along with, optionally, the network interface configuration, routing tables and ipfwadm rules present when the script was run. It can also create and send a list of all installed packages on the system (RPMs only). First release.
| | Author: | Eddie Olsson | | File Size: | 8281 | | Last Modified: | Aug 16 20:04:52 1999 |
| MD5 Checksum: | d31204c94a97964a01246779be192d5f |
|
| /// File Name: |
confcollect-0.1d.tar.gz |
Description:
|
confcollect 0.1d - confcollect gathers information about the system on which it is installed and sends that information to an administrator via e-mail. The entire /etc directory tree is sent along with, optionally, the network interface configuration, routing tables and ipfwadm rules present when the script was run. It can also create and send a list of all installed packages on the system (RPMs only).
| | Author: | Eddie Olsson | | Changes: | Added support for ipchains. | | File Size: | 8425 | | Last Modified: | Aug 16 20:04:54 1999 |
| MD5 Checksum: | e3aeb2d0b91db9fa74980b4b7cbc96bf |
|
| /// Directory: |
/ cops / |
Description:
|
Computer Oracle and Password System. UNIX Security Auditing Tool.
| | Total Files: | 5 | | Last Modified: | Sep 5 21:21:21 2007 |
|
| /// File Name: |
cops_dan_farmer.txt |
Description:
|
Cops and Robbers.
| | Author: | Dan Farmer | | File Size: | 36020 | | Last Modified: | Aug 16 20:05:00 1999 |
| MD5 Checksum: | eb12b6db7883146ec698e5aefc2c816a |
|
| /// File Name: |
courtney-1.2.tar.Z |
Description:
|
Courtney is a tcpdump based portscan threshold detector written in perl as a response to SATAN. It operates by counting the number of new services a machine originates within a time window. If the threshold is exceeded by a host, it is flagged as a potential "SATAN" host. Results depend on your configuation of tcpdump, so this could potentially be used to detect any type of traffic that exceeds a certain threashold of events per unit of time (such as SYNs per minute).
| | File Size: | 9737 | | Last Modified: | Aug 16 20:04:42 1999 |
| MD5 Checksum: | 3257009164eaf10d1e3ae4a7de102f03 |
|
| /// File Name: |
courtney-1.3.tar.Z |
Description:
|
Courtney is a tcpdump based portscan threshold detector written in perl as a response to SATAN. It operates by counting the number of new services a machine originates within a time window. If the threshold is exceeded by a host, it is flagged as a potential "SATAN" host. Results depend on your configuation of tcpdump, so this could potentially be used to detect any type of traffic that exceeds a certain threashold of events per unit of time (such as SYNs per minute).
| | File Size: | 12627 | | Last Modified: | Aug 16 20:04:42 1999 |
| MD5 Checksum: | 0855e4df62582576aa30872720c75e9b |
|
| /// File Name: |
courtney.tar.Z |
Description:
|
Courtney is a tcpdump based portscan threshold detector written in perl as a response to SATAN. It operates by counting the number of new services a machine originates within a time window. If the threshold is exceeded by a host, it is flagged as a potential "SATAN" host. Results depend on your configuation of tcpdump, so this could potentially be used to detect any type of traffic that exceeds a certain threashold of events per unit of time (such as SYNs per minute).
| | File Size: | 12627 | | Last Modified: | Aug 16 20:04:42 1999 |
| MD5 Checksum: | 0855e4df62582576aa30872720c75e9b |
|
| /// File Name: |
cpm.1.0.tar.gz |
Description:
|
Checks for network interfaces in promiscious mode.
| | File Size: | 2623 | | Last Modified: | Aug 16 20:04:42 1999 |
| MD5 Checksum: | 14aa7215d7798ef270780b59a93cd65c |
|
| /// File Name: |
cracklib.tar.Z |
Description:
|
Cracklib is a proactive password security library.
| | File Size: | 21792 | | Last Modified: | Aug 16 20:04:41 1999 |
| MD5 Checksum: | bd4cb87179ba5dba4f17e1116e6dca31 |
|
| /// File Name: |
cracklib26_small.tgz |
Description:
|
Cracklib is a proactive password security library.
| | File Size: | 20912 | | Last Modified: | Aug 16 20:04:42 1999 |
| MD5 Checksum: | 7181205d70afcf75bb2240678b6be855 |
|
| /// File Name: |
DumpSIS-0.8.zip |
Description:
|
Symbian SIS file dumping utility that allows for analysis of potential malware without actual installation of files. It provides information on file headers (UIDs, Version, Number of Languages, Number of files), file list (Destination name by default, Source filename and file type).
| | Author: | Jimmy Shah | | Changes: | Fixes decompress bug and compatibility with Perl on Unix. | | File Size: | 15224 | | Last Modified: | Jun 18 01:21:02 2004 |
| MD5 Checksum: | fb42865d6b83fbc513796adabeedf9d1 |
|
|
|
|
|
![.:[ packet storm ]:.](/images/ps-ani.gif)
