Scanners, sniffers, anayzers, penetration testing, traffic monitors:
If there is a site that should be listed here or if a link goes dead, please let me know.
- Aldebaran sniffer: a Linux-based sniffer/network analyser
- Analyzer: a public domain protocol analyzer
win32, freeware
- Argus: auditing network activity
can be used to analyze and report on the contents of packet capture files or it can run as a continuous monitor, examining data from a live interface; generating an audit log of all the network activity seen in the packet stream. Argus can be deployed to monitor individual end- systems, or an entire enterprises network activity. As a continuous monitor, Argus provides both push and pull data handling models, to allow flexible strategies for collecting network audit data. Argus data clients support a range of operations, such as sorting, aggregation, archival and reporting. There is XML support for Argus data, which makes handling Argus data a bit easier, see ArgusRecord.xsd.
- BSDAirtools : toolset for wireless 802.11b auditing
- BOping : scanner for Back Orifice program
NT, freeware
- Cerberus’ Internet Scanner
NetBIOS auditing tool
- Core-SDI Remote Auditing Utility
- DDoSPing : detect the most common DDoS programs.
NT, freeware
- Dsniff : tools for network auditing and penetration testing
- Ettercap : multipurpose sniffer/interceptor/logger for switched LANs
- eEye : Digital Security
- FTPCheck : scans hosts and networks for FTP and anonymous FTP archives
perl
- Heat : Hydra Expert Assesment Technology
- Hping : network probe, ping on steroids
- Hunt : tool for exploiting well known weaknesses in the TCP/IP protocol suite
- IPAudit : Monitor network activity on a network by host, protocol and port
Ipaudit listens to a network device in promiscuous mode, and records of every ‘connection’, each conversation between two ip addresses. A unique connection is determined by the ip addresses of the two machines, the protocol used between them and the port numbers (if they are communicating via udp or tcp).
- IPtraf : IP traffic monitor for linux
- ISScanner : Application-level vulnerability assessment
- Kismet : 802.11 wireless network sniffer
- LanGuard : Network Scanner freeware security scanner to audit your network security. It scans entire networks and provides NETBIOS information for each computer such as hostname, shares, logged on user name. It does OS detection, tests password strength, detects registry issues and much more. Reports are outputted in HTML.
- LanGuard : Port Scanner freeware tool that allows you to scan your network for active ports and identify unused applications such as web servers that could be a security hole. You can also identify trojans. A unique port scan compare feature will alert you for new ports,which could possibly be trojans or unauthorised applications. It runs as a service in the background.
- LSRScan : checks the behaviour of remote hosts to loose source routed packets
- LSRtunnel : spoofs connections using source routed packets
- Microsoft Security Scanners
- MingSweeper : windows-based network reconnaissance tool capable of performing Ping sweeps, Reverse DNS sweeps, TCP & UDP port scans, OS identification and application identification.
- NBTScan : NetBIOS Name Network Scanner scanning IP networks for NetBIOS name info
- Nemesis : packet injection tool-suite
- Nessus : security scanner best, freeware. Linuxbased
- NetView : scan for available Windows File & Print Sharing resources NT, freeware
- Ngrep : network grep
pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. It currently recognizes TCP, UDP and ICMP across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands bpf filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
- Nikto : web server scanner
- Nmap : port scanner freeware
- N-Stealth : vulnerability-assessment product that scans web servers
- Ntop : network traffic probe that shows the network usage unix, win32, freeware
- Oracle
- NGSSQuirreL for Oracle
security audit available of an Oracle database server.
- OraScan for Oracle
assess an Oracle web front end and its custom online applications
- NGSSQuirreL for Oracle
- packet analyzers
- Phenoelit sniffer designed to find HTTP, FTP, LDAP, Telnet, IMAP4 and POP3 logins on the wire. It also sniffs the VNC challange/response handshake.
- Portscan NT,freeware
- ProbeTS : find Terminal servers when not using port 3389
- proDETECT : open source promiscious mode scanner with a GUI It uses ARP packet analyzing technique to detect adapters in promiscious mode.This tool can be used by security administrators to detect sniffers in a LAN.It can be scheduled for regular scanning over periods.It also has some advanced reporting capabilities such as SMTP reporting.Full source code is included.
- Promiscuous:
- AntiSniff : scan ethernet network, detect computers in promiscuous mode NT
- PromiScan W2K Pro; searches for promiscuous nodes on the local net
- AntiSniff : scan ethernet network, detect computers in promiscuous mode NT
- RelayCheck : scans a network for SMTP hosts that permit “relaying” of email
perl
- Retina network scanner NT,W2K,commercial, recommended
- Saint : commercial version
free trial
- Saint : vulnerability scanner
- Sam Spade : freeware network query tool Windows
- Sara : Security Auditor’s Research Assistant
third generation Unix-based security analysis tool
- Scanlogd : portscan detecting tool unix
- ScanRand : extremely fast and efficient port, host, and network trace scanning
- ScoopLM: captures LM/NTLM authentication info
freeware, supports microsoft-ds (Direct SMB hosting service; 445 NTLMSSP), ActiveDirectory, NTLMv2 on NetBIOS over TCP/IP, Telnet, IIS (HTTP) and DCOM over TCP/IP.
- SelfScan : check your own PC
- Sentinel : fast file/drive scanning utility similar to the Tripwire and Viper.pl unix
- Shadow Security Scanner Russian
- Shed : Robin Keir’s very fast Windows shared resource scanner (Oct 2001)
- Sniffit : LINUX, SunOS, Solaris, FreeBSD and IRIX scanner
- snmp scanners
- Snmp : Windows snmp scanner freeware, also discover interface information, routing and ARP tables, as well as port scans, Traceroutes, NSLookups, and IP Scans
- SnmpSniff
- SolarWinds
- Snmp : Windows snmp scanner freeware, also discover interface information, routing and ARP tables, as well as port scans, Traceroutes, NSLookups, and IP Scans
- SolarWinds : Network Analysis and Diagnostic Tools
- SSS : Shadow Security Scanner
- STAT Scanner
vulnerability assessment tool for Windows NT and Windows 2000
- Strobe
very small, fast scanner which operates over class B networks and a perl script which uses it to scan for open e-mail relays
- SuperScan : Foundstone’s fast TCP port scanner, pinger, resolver multithreaded and asynchronous techniques making it extremely fast and versatile. You can fingerprint responding ports by viewing connect strings, and use helper apps to maintain connections. Port scans can be driven from a text file, and output from SuperScan can be directed into a text file.
- THC-Amap: next-generation scanning tool
- THC-Hydra: parallized login hacker for FTP, POP3, IMAP, Telnet, HTTP Auth, NNTP, VNC, ICQ, Socks5, PCNFS
- THC-Parasite
sniff on switched networks by performing ARP man-in-the-middle spoofing. Selective targets, DOS and various other features present. Changes: Now running on Solaris and OpenBSD as well
- WinDump: tcpdump for Windows
win32, freeware
- Winfingerprint : Win32 Host/Network Enumeration Scanner
capable of performing SMB, TCP, UDP, ICMP, RPC, and SNMP scans
- Wireshark : free network protocol analyzer for Unix and Windows
- WUPS : UDP port scanner for Windows
NT,W2K,W9x,free
- Xprobe : operating system fingerprinting tool