Thoughts From The Fringe Of The Web

This post will be appreciated by those of you who use Windows.

I've been on the lookout for a good portscanner for those times when I'm using Windows (Nmap doesn't work well off my PPP connection from home using WinPcap). I'd often heard of Foundstone's SuperScan being a very worthy windows scanner and so I checked it out. I must say I'm very impressed and wouldn't recommend any other scanner for the Windows OS. It has all the usual jazz you expect and some more. Some of the features :

Host discovery using multiple methods
Windows NetBIOS enumeration
UDP scanning
SYN stealth (half-connect) scanning
Banner grabbing
Built in tools such as zone transfer, whois, traceroute, bulk resolve, http requests
HTML report generation

I've been going through a whole lot of foundstones free tools and they really do have some interesting stuff, I suggest you check it out. Here's a direct link for SuperScan.

I'll also be adding a whole lot of Ebooks on a range of topics like security, programming and system administration. For all those of you who wanted to learn a programming language or linux or SQL, these will help you out. Its always good to have a book that covers material from the basics up.

Oh yeah you can now get fired for blogging at work ! Isn't this a funny one !

For some reason a lot of people ask me how to find what webserver is running on a machine. To help you work this out and show you some pathetic coding along the way, I dug out an old perl script I'd written when I first started learning perl. Hey the code is far from beautiful.. but it works. If its some use to you, download it -
Webserver identifier script

Though I don't understand why you just dont nc www.fu.fu 80 ? Anyway some people like doing things the complicated way.

If you use windows, you can get perl from Activestate.com. Its free, and will run any perl script you find on the net.

Blah lame post ;)

I'm in a generous mood so I'm handing out a couple of treats. So for taking the time to visit Thoughts From The Fringe Of The Web you're gonna get yourself a tutorial on database hacking (SQL injection). Its not the worlds newest topic, but 9/10 sites that I've visited with SQL backends and login pages are vulnerable. Best of all you can test this stuff using just your browser. Remember you're supposed to use this information to check your own intranet / website security ;)
SQL Injection

And as a little bonus, heres a default password list, no this is not a list of common passwords like a dictionary wordlist, this is a list of vendors and products, with their associated default logins and passwords. Most of the time nobody bothers changing the default password. Someone should do a survey on how many Cisco routers are sitting pretty on the net with the default password 'cisco'. Anway grep the list for all the products you own and make sure you've changed your default passwords.
Default Password List

Credit to Eric Knight for maintaining the default password list.

Found a pretty decent site today. A nice selection of texts and tutorials, a few that I have in the library, but quite a few that I haven't seen before. Also has some good original material. Give it a look
http://angelx.cjb.net

Firewall.cx has added some really neat flash games (check out Max Arcade from the side menu) :) kudos to Chris and the gang for constantly keeping the site among the top, its a real pleasure to be part of the team.
Also check out two of my posts at firewall.cx in the Security / Firewalls forum... one is a pretty basic introduction to security and the other details my pen-testing methodology (yes my kung-fu is better than yours !)

I'm doing my CCNA recertification on the 5th of the month.. will let people know whether they made it harder.. lets hope not !