Breaking Code

December 13, 2008

Did you check out Netifera already?

Filed under: Tools — Tags: , , , , , — Mario Vilas @ 2:27 am

Netifera is a new open source security tool for network mapping and security auditing for Linux and Mac OS X (Windows will also be supported in the future). It’s a only beta for now, but I think we’ll be hearing much more about it!

There are two kinds of recon you can do with Netifera, active and passive. Today active recon seems a bit rough in the edges, but I’m sure it will evolve soon. There are TCP and UDP port scanners, a very complete DNS tool, a simple web crawler and a rudimentary FTP password bruteforcer.

The passive recon tool is much more remarkable, however. By sniffing the network, Netifera detects active hosts and open ports, maps which host has connected to which (that can help you deduce the function of each host in the network, or the relationships between them), and you can run active recon tools on said hosts while sniffing. Most notably the DNS information gathering tool can use any discovered host with port 53 open as a DNS server.

But there are two reasons for which it draws my attention so much. One is the development framework. Everything is done as Java plugins, pretty much like Eclipse, thus making it very extensible and easier to port to multiple platforms. Here is a tutorial on writing sniffer plugins for Netifera, to add functionality to the passive recon tool. I believe this is a key feature – the possibility of adding plugins for anything can quickly turn this quick-and-dirty recon tool into a much more advanced security audit tool in the future, as more users contribute to the project. It makes me think of Metasploit or nmap, they are what they are today thanks to user contributions, and Netifera may (hopefully) follow the same path. The one drawback I see here is the choice of language -Java- as opposed to scripting languages -Python, Perl, Ruby- which are much less robust but allow for faster development and quick-and-dirty tests scripts or macros.

The second reason I liked this so much is the probe idea they’ll be adding in upcoming versions. What is a probe? In a nutshell, it’s a tiny portable java runtime engine that you can deploy anywhere in the network. This probes can run any code from the Netifera framework (including your custom-made plugins of course), so it’s essentially the same as having the tool installed and running there, but without the hassle. :) By deploying many probes in your network you can map it from several points of view simultaneously, giving you a better perspective on it’s security. The beta you can download from the Netifera web page does not yet have the ability to deploy probes on other hosts, it’s a pity because I really wanted to try that out :( but I’ve been told it will be available soon, so stay tuned.

Well, enough said. Just go grab a copy and toy with it a little, don’t trust my word for it and see for yourselves! :)

About these ads

Leave a Comment »

No comments yet.

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Silver is the New Black Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 2,479 other followers

%d bloggers like this: