Important Tools for Security Researchers

Defense against cybercrime is extremely important to security researchers and experts. However, no security defense will work properly without the right tool.

Albuquerque, NM (prHWY.com) December 8, 2011 - When we talk about building defenses against cybercrime like firewalls, pen testing and anti-virus software, security researchers believe that it is not possible without the help of the right tools. Building better defenses is just the same as building a structure - it is impossible or hard to accomplish without using the right tools. Given that important fact, let us see some of the most important tools, security researchers use whenever they are building security defenses.

Wireshark

Wireshark is the ultimate protocol analyzer for networks; we can say that it is an excellent all around tool. This tool will tell security experts, what is the traffic that passes through their networks and at the same time it will find the source of the code that is hogging the database of their server. It can also intercept the passing traffic and check whether the passing data and credentials of applications are encrypted. It also shows the innards of 100 various protocols in networks. Furthermore, this tool can be used to develop your very own protocol and it can be used to test the flow of the said protocol.

Hex Editor

We humans only see words, texts and images when we open PDF files on PDF viewer; however, the computer system will just see these as a bunch of 1s and also 0s. Security researchers will group these binary codes in 16; each of them assigned a number from 0-9 or perhaps letters from A-F as the values 10-15. With the hex editor, it is possible to view the format and translate the code to human texts. This can help you learn a lot by reading the program in that format; you understand all the bits and also bytes that are passing on your network, which Wireshark could not dissect. It can also be used to analyze malicious codes found in malware. In fact, it can even be used to edit that same code.

Packet Editor and TCP Relay

Information superhighway has its own mailman, the person who re-routes messages to their particular destination and it can also modify its packet content. When servers keep crashing when they receive certain message, it would be better if these messages will be re-routed to a different destination so that they can be inspected in a controlled environment. This is the job of TCP relay.

If you prefer to take the inspection process into the next level; or you know the behavior of your server when introduced with that input; or it receives a much different parameter then you may need to follow different steps. You will need to test that behavior on a certain packet that has modified input - then you need packet editor. Packet editor can help you manually craft certain packets which you can use in a session.

HTTP Proxy

One tool that is used to test the Web applications' security is called an HTTP proxy. It is also needed in modifying the HTTP traffic as well as monitoring SSL. It is added in the browser as a sort of pug-in and it will monitor all of the HTTP traffic moving in and out of the desktop. Majority of those proxies have recording capabilities that will save all the traffic and will replay it for an analysis.

Debugger and Decompiler

Sometimes when experts plan pen test, they would like to look on the malware's code beforehand. Other times certain executables will crash after given a particular input and some would want to know the reason behind it. There are two tools that can help them get their results - the debugger and the decompiler.

Before experts introduce a malware in penetration testing, they would like to know how the program works and what it does. Example a certain malware intercepts messages and then copies them into some sort of drop box. When the malware is debugged, analysts and experts can thoroughly understand the malware's flow and they will also know how that malware intercepts the messages.

The decompiler on the other hand will present the code to the researcher. Let us say the same malware for example, the decompiler will provide the technicalities and details on how the malware operates. Of course, it is better to look for decompilers that has "-g" extension because they can provide better debugging information.

The International Council of E-Commerce Consultants (EC-Council) is a member-based organization that certifies individuals in cybersecurity and e-commerce. It is the owner and developer of 20 security certifications. EC-Council has trained over 90,000 security professionals and certified more than 40,000 members. These certifications are recognized worldwide and have received endorsements from various government agencies. They also offer trainings in penetration testing.

More information about EC-Council is available at www.eccouncil.org.

###

Tag Words: antivirus, cybercrime, penetration testing, pen testing, pen test, code, pdf, protocol, traffic, database, wireshark, security defenses, tools

Categories: Internet

Link To This Press Release:

URL HTML Code