Security
General
- http://sectools.org/
- http://www.reddit.com/r/netsec/comments/r1603/some_people_asked_for_a_tool_list/
Resources
News
Passwords
Server
See also Distros
Firewalls
csf/lfd
- http://blog.configserver.com/ - software update news
FireHOL
Windows
Logging
Integrity
Hardening
AppArmor
SELinux
Intrusion detection
- http://en.wikipedia.org/wiki/Intrusion_detection_system
- http://en.wikipedia.org/wiki/Intrusion_prevention_system
- http://www.tldp.org/HOWTO/Security-Quickstart-HOWTO/intrusion.html
- http://www.sans.org/security-resources/idfaq/
- http://www.sans.org/security-resources/idfaq/auto_res.php
- http://ieeexplore.ieee.org/xpl/articleDetails.jsp?tp=&arnumber=5588654
Shells
- http://lshell.ghantoos.org/ - limited shell
Honeypot
Cryptography
- https://en.wikipedia.org/wiki/NIST
- https://en.wikipedia.org/wiki/Federal_Information_Processing_Standard
- https://en.wikipedia.org/wiki/Cryptographic_hash_function
- https://en.wikipedia.org/wiki/Provably_secure_cryptographic_hash_function
- https://en.wikipedia.org/wiki/Block_cipher
- https://en.wikipedia.org/wiki/Collision-resistant
- https://en.wikipedia.org/wiki/Collision_attack
There are several methods to use a block cipher to build a cryptographic hash function, specifically a one-way compression function. The methods resemble the block cipher modes of operation usually used for encryption. All well-known hash functions, including MD4, MD5, SHA-1 and SHA-2 are built from block-cipher-like components designed for the purpose, with feedback to ensure that the resulting function is not invertible. SHA-3 finalists included functions with block-cipher-like components (e.g., Skein, BLAKE) though the function finally selected, Keccak, was built on a cryptographic sponge instead.
- https://en.wikipedia.org/wiki/Public_key_cryptography - also known as asymmetric cryptography
- https://en.wikipedia.org/wiki/Digital_signature
- https://developer.mozilla.org/en/docs/Introduction_to_Public-Key_Cryptography
- http://en.wikipedia.org/wiki/Public-key_cryptography
- http://en.wikipedia.org/wiki/Public-key_infrastructure
- https://en.wikipedia.org/wiki/MD4
- https://en.wikipedia.org/wiki/MD5
- https://en.wikipedia.org/wiki/SHA-1
- https://en.wikipedia.org/wiki/SHA-2
- https://en.wikipedia.org/wiki/SHA-3
- The code monkey's guide to cryptographic hashes for content-based addressing
- Lifetimes of cryptographic hash functions
- https://en.wikipedia.org/wiki/Elliptic_curve_cryptography
- https://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman
- https://en.wikipedia.org/wiki/Elliptic_Curve_DSA
RSA
- http://en.wikipedia.org/wiki/RSA_(algorithm) - publicly described in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman at MIT
EC
Suites
Encryption
- https://prism-break.org/ - various levels of advice
PGP / GPG
- http://tools.ietf.org/html/rfc4880 - OpenPGP Message Format
- http://tools.ietf.org/html/rfc5581 - The Camellia Cipher in OpenPGP
Guides
gpg --export --armor <keyid> | awk '{ print " "$0 }'
Tools
- http://gpg4win.org/ - Windows
- https://gpgtools.org/ - Mac
- WebPG - Browser Extensions
- Monkeysphere project's goal is to extend OpenPGP's web of trust to new areas of the Internet to help us securely identify servers we connect to, as well as each other while we work online. The suite of Monkeysphere utilities provides a framework to transparently leverage the web of trust for authentication of TLS/SSL communications through the normal use of tools you are familiar with, such as your web browser0 or secure shell.
- http://www.biglumber.com/ - signing parties
Key servers
- http://superuser.com/questions/227991/where-to-upload-pgp-public-key-are-keyservers-still-surviving
- http://www.rossde.com/PGP/pgp_keyserv.html
- http://cryptome.org/2013/07/mining-pgp-keyservers.htm
- http://pgp.mit.edu/ (cryptonomicon.mit.edu)
- http://sks-keyservers.net/
- https://keyserver.pgp.com/
DNS
- https://we.riseup.net/dissent+secure_communication/secure-gpg-webmail-service
- http://unix.stackexchange.com/questions/59323/what-is-a-free-open-source-webmail-software-with-pgp-support
- http://pthree.org/2011/09/17/pgpmime-versus-smime/
- http://www.tankmiche.com/tips/x-pgp-key-email-header-format/
- http://beza1e1.tuxen.de/articles/pgp_header.html
Libraries
- Penango is a web browser add-on that allows people to send and receive authenticated and encrypted messages end-to-end on the Internet with standards-based, interoperable protocols.
- gAES - Encrypt your google chats and make the NSA sad
Other
- gnupg-ecc - ECC-enabled GnuPG per RFC6637
File system
- TrueCrypt - Free open-source disk encryption software for Windows 7/Vista/XP, Mac OS X, and Linux
- LUKS is the standard for Linux hard disk encryption. By providing a standard on-disk-format, it does not only facilitate compatibility among distributions, but also provides secure management of multiple user passwords. In contrast to existing solution, LUKS stores all setup necessary setup information in the partition header, enabling the user to transport or migrate his data seamlessly. While LUKS is a standard on-disk format, there is also a reference implementation. LUKS for dm-crypt is implemented in an enhanced version of cryptsetup.
Other
Homomorphic
TLS/SSL
- Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols that provide communication security over the Internet. They use asymmetric cryptography for authentication of key exchange, symmetric encryption for confidentiality and message authentication codes for message integrity. Several versions of the protocols are in widespread use in applications such as web browsing, electronic mail, Internet faxing, instant messaging and voice-over-IP (VoIP).
In the TCP/IP model view, TLS and SSL encrypt the data of network connections at a lower sublayer of its application layer. In OSI model equivalences, TLS/SSL is initialized at layer 5 (the session layer) then works at layer 6 (the presentation layer): first the session layer has a handshake using an asymmetric cipher in order to establish cipher settings and a shared key for that session; then the presentation layer encrypts the rest of the communication using a symmetric cipher and that session key. In both models, TLS and SSL work on behalf of the underlying transport layer, whose segments carry encrypted data.
- https://www.ssllabs.com/projects/best-practices/
- SSL/TLS Deployment Best Practices - tutorial whitepaper
- https://sites.google.com/site/x509certificateusage/
- OWASP Top 10 for .NET developers part 9: Insufficient Transport Layer Protection - Touching on HTTPS, SSL and TLS
- DEFCON 19: SSL And The Future Of Authenticity - Moxie Marlinspike
- https://rx4g.com/2013/09/09/web-server-authentication-is-still-broken/
- https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html [5]
- http://it.slashdot.org/story/13/07/24/1812227/anonymous-source-claims-feds-demand-private-ssl-keys-from-web-services
HTTPS
- https://www.tbray.org/ongoing/When/201x/2012/12/02/HTTPS - basic intro
- Living with HTTPS (19 Jul 2012)
- http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
- Improved HTTPS Performance with Early SSL Termination
- https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
- https://www.scantosecure.com/blog/fencing-your-ssl-errors-with-hsts
See HTTP#SSL
PFS
Software
Gnutils
OpenSSL
openssl ciphers -v
Other
Certificates
- SSL Certificate Types and Purposes
- https://www.globalsign.com/ssl-information-center/types-of-ssl-certificate.html
- http://blogs.msdn.com/b/kaushal/archive/2010/11/05/ssl-certificates.aspx
- http://en.wikipedia.org/wiki/Subject_Alternative_Name - allows multiple domains, but not like a wildcard
- http://en.wikipedia.org/wiki/Server_Name_Indication - allows more than one domain per ip address, not supported by older IE and Android 2
some rfcs..
- http://tools.ietf.org/html/rfc2712 - Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)
- http://tools.ietf.org/html/rfc4279 - Pre-Shared Key Ciphersuites for Transport Layer Security (TLS)
- http://tools.ietf.org/html/rfc5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
- http://tools.ietf.org/html/rfc6091 - Using OpenPGP Keys for Transport Layer Security (TLS) Authentication
- http://tools.ietf.org/html/rfc6125 - Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)
Wildcard
Domain Validation
Organisational Validation
involving better/slower background checks for the Organisation Name field
Extended Validation
- http://en.wikipedia.org/wiki/Extended_Validation_Certificate - provides a green address bar, bit of a rip-off though
Self-signed
Vulnerable to MITM as cracker can generate their own, OK if you control both ends.
- How to Create A Self Signed Certificate - sslshopper.com
- How to create a self-signed SSL Certificate which can be used for testing purposes or internal usage
CAs
Services
Comodo
- http://www.comodo.com/ - security history a bit of a joke
- http://ssl.comodo.com/wildcard-ssl-certificates.php - from £224.95
- HN discussion: $50 comodo wildcard SSLs (while they last)
VeriSign
- http://www.verisign.com/ - owned by Symantec
- http://www.rapidssl.com/buy-ssl/ssl-certificate/index.html
- http://www.rapidssl.com/buy-ssl/wildcard-ssl-certificate/index.html
GlobalSign
- http://en.wikipedia.org/wiki/GlobalSign - owned by GMO CLOUD K.K. in Japan
- https://www.ssl2buy.com/alphassl-wildcard.php
- http://www.vpsnodebox.com/ssl-certificates - AlphaSSL - GlobalSign certificate.
StartCom
- https://startssl.com
- http://en.wikipedia.org/wiki/StartCom - based in Israel, provides StartSSL certs.
Free certs, one cert per domain, 1 year. One only pays for acions that require human intervention, i.e., validation.
Cacert.org
Community group providing certs. Web of trust based assurance point system. Not carried by major browsers, just Linux distros.
Other
- http://lolroot.ca/ - lol
Tools
Software
DNSSEC
- http://jpmens.net/2011/02/16/ssl-certificate-validation-and-dnssec/
- http://blog.huque.com/2012/10/dnssec-and-certificates.html
- http://blogs.cisco.com/security/top-of-mind-problems-with-ssl-solved-with-dnssec/
DANE
Future
- TACK, a proposal for a dynamically activated public key pinning framework that provides a layer of indirection away from Certificate Authorities, but is fully backwards compatible with existing CA certificates, and doesn't require sites to modify their existing certificate chains.
HTML
Vulnerabilities
Legal
- http://safeharbor.export.gov/list.aspx - UK DPA safe harbours
UX
Windows
Testing
Metasploit
Web
- w3af is a Web Application Attack and Audit Framework. The project's goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.
DB
Burp
Inception
- Inception is a FireWire physical memory manipulation and hacking tool exploiting IEEE 1394 SBP-2 DMA. The tool can unlock (any password accepted) and escalate privileges to Administrator/root on almost any powered on machine you have physical access to. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe interfaces.
DetecTor.io
to sort
- http://telecomix.org/
- http://en.wikipedia.org/wiki/Telecomix
- http://cryptoanarchy.org - Telecomix Crypto Munitions Bureau is part of Telecomix. Many good and tasty links.
- http://web.archive.org/web/20130310120019/http://www.infoanarchy.org/en/Main_Page
- http://cryptoparty.informatick.net/parties/howto
- http://booki.cc/cryptoparty-handbook/a-cryptoparty-history-party-like-its-1984/
- More Encryption Is Not the Solution [8]
- cryptosphere - Encrypted peer-to-peer web application platform for decentralized, privacy-preserving applications
- http://tobtu.com/decryptocat.php - don't use cryptocat
- Gitian is a secure source-control oriented software distribution method. This means you can download trusted binaries that are verified by multiple builders.
Other
- Pond is forward secure, asynchronous messaging for the discerning. Pond messages are asynchronous, but are not a record; they expire automatically a week after they are received. Pond seeks to prevent leaking traffic information against everyone except a global passive attacker. [10]
- EZCrypt - We provide you with the power to encrypt the data BEFORE it gets stored on our site. All encryption/decryption is done on the client end using AES-CBC 128bit with a hash key generated on each paste. The server will only store the encrypted data without the hash key, so only you have the power to decrypt it.