Breaking Code

March 23, 2009

Netifera 1.0 released!

Filed under: Tools — Tags: , , , , , , , — Mario Vilas @ 9:23 am

After a long wait, Netifera version 1.0 was released. I talked about this tool in a previous post. The feature list seems to have remained pretty much the same, with some new bruteforcing modules – most notably the remote OS and architecture detection was drastically improved, and as expected contains many bugfixes compared to the previous betas.

Here’s the full feature list:

Tools

  • Full IPv6 support
  • TCP and UDP network scanning
  • Service detection
  • Operating system identification
  • Reverse DNS scanning
  • DNS name brute forcing
  • DNS zone transfer information gathering
  • Geographical information about network addresses
  • Authentication brute force attack (against HTTP, FTP,IMAP and POP3)
  • Web crawler discovers applications, collects email addresses and adds the site structure to the model
  • Integrated terminal for connecting to and interacting with network services

Passive Tools

  • Modular packet capture service
  • Capture packets on multiple interfaces simultaneously
  • Parse ’pcap’ format capture files as input to sniffing modules
  • HTTP traffic analysis
  • DNS information gathering from captured responses
  • Network stack fingerprinting
  • Service detection from captured banners and protocol packets
  • Client application detection
  • Credential sniffing for many protocols

Data Model

All information discovered by the netifera platform is persistently
stored in a workspace database. Our extension design allows for
developers to easily create their own data types and integrate them
into the platform.

User Interface

The platform provides an intuitive and professional quality graphical
user interface for using the tools written for our platform and
navigating the information they produce. Different tasks in our
application such as sniffing information from the network, or actively
collecting information by scanning networks, or exploring the local
environment of a remotely deployed probe (coming soon! ) each have a
specialized configuration of the user interface called a ’perspective’

Programming API

The netifera platform brings together high quality programming APIs
for tasks such as:

  • High performance asynchronous socket connection and communication
  • Link level packet capture and raw socket injection
  • 802.11 monitor mode packet capture and injection (coming soon! )
  • Network protocol header construction and analysis (ethernet, ip, tcp, etc…)
  • Application layer protocol libraries (http, dns, ftp, etc…)

December 13, 2008

Did you check out Netifera already?

Filed under: Tools — Tags: , , , , , — Mario Vilas @ 2:27 am

Netifera is a new open source security tool for network mapping and security auditing for Linux and Mac OS X (Windows will also be supported in the future). It’s a only beta for now, but I think we’ll be hearing much more about it!

There are two kinds of recon you can do with Netifera, active and passive. Today active recon seems a bit rough in the edges, but I’m sure it will evolve soon. There are TCP and UDP port scanners, a very complete DNS tool, a simple web crawler and a rudimentary FTP password bruteforcer.

The passive recon tool is much more remarkable, however. By sniffing the network, Netifera detects active hosts and open ports, maps which host has connected to which (that can help you deduce the function of each host in the network, or the relationships between them), and you can run active recon tools on said hosts while sniffing. Most notably the DNS information gathering tool can use any discovered host with port 53 open as a DNS server.

But there are two reasons for which it draws my attention so much. One is the development framework. Everything is done as Java plugins, pretty much like Eclipse, thus making it very extensible and easier to port to multiple platforms. Here is a tutorial on writing sniffer plugins for Netifera, to add functionality to the passive recon tool. I believe this is a key feature – the possibility of adding plugins for anything can quickly turn this quick-and-dirty recon tool into a much more advanced security audit tool in the future, as more users contribute to the project. It makes me think of Metasploit or nmap, they are what they are today thanks to user contributions, and Netifera may (hopefully) follow the same path. The one drawback I see here is the choice of language -Java- as opposed to scripting languages -Python, Perl, Ruby- which are much less robust but allow for faster development and quick-and-dirty tests scripts or macros.

The second reason I liked this so much is the probe idea they’ll be adding in upcoming versions. What is a probe? In a nutshell, it’s a tiny portable java runtime engine that you can deploy anywhere in the network. This probes can run any code from the Netifera framework (including your custom-made plugins of course), so it’s essentially the same as having the tool installed and running there, but without the hassle. :) By deploying many probes in your network you can map it from several points of view simultaneously, giving you a better perspective on it’s security. The beta you can download from the Netifera web page does not yet have the ability to deploy probes on other hosts, it’s a pity because I really wanted to try that out :( but I’ve been told it will be available soon, so stay tuned.

Well, enough said. Just go grab a copy and toy with it a little, don’t trust my word for it and see for yourselves! :)

The Silver is the New Black Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 2,480 other followers