New Auditor Live CD Released

http://new.remote-exploit.org/index.php/Auditor_main

Quote:

---

The Auditor security collection is a Live-System based on KNOPPIX. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes. Independent of the hardware in use, the Auditor security collection offers a standardised working environment, so that the build-up of know-how and remote support is made easier. Even during the planning and development stages, our target was to achieve an excellent user-friendliness combined with an optimal toolset. Professional open-source programs offer you a complete toolset to analyse your safety, byte for byte. In order to become quickly proficient within the Auditor security collection, the menu structure is supported by recognised phases of a security check. (Foot-printing, analysis, scanning, wireless, brute-forcing, cracking). By this means, you instinctively find the right tool for the appropriate task. In addition to the approx. 300 tools, the Auditor security collection contains further background information regarding the standard configuration and passwords, as well as word lists from many different areas and languages with approx. 64 million entries. Current productivity tools such as web browser, editors and graphic tools allow you to create or edit texts and pictures for reports, directly within the Auditor security platform. Many tools were adapted, newly developed or converted from other system platforms, in order to make as many current auditing tools available as possible on one CD-ROM. Tools like Wellenreiter and Kismet were equipped with an automatic hardware identification, thus avoiding irritating and annoying configuration of the wireless cards.

---

I've played with an earlier version of this and was quite pleased. Once I get this down we'll see how much they've improved it since the last time I mucked about. ;)

The older one is my favorite live cd, thanks for posting this.

I have a couple small points to quibble over...

Quote:

---

Current productivity tools such as web browser, editors and graphic tools allow you to create or edit texts and pictures for reports, directly within the Auditor security platform. Many tools were adapted, newly developed or converted from other system platforms, in order to make as many current auditing tools available as possible on one CD-ROM. Tools like Wellenreiter and Kismet were equipped with an automatic hardware identification, thus avoiding irritating and annoying configuration of the wireless cards.

---

Why on earth do you need to create graphics and 'looky pretty' images for a report from your live linux auditing tool cd?!?!? I'm sorry, that is completely inappropriate for a strict auditing toolkit. The web browser I can see, if you need to go look up information online. The editors are obvious...you ALWAYS need a text editor if you are worth your salt with a *NIX distro.

Also...do we really need Kismet and Wellenreiter? I supposed, I could see how one would say "It's an auditing live linux distro, so why NOT have wireless auditing tools." I think the word 'audit' is being thrown around too loosely. Sorry, I might be a bit harsh, but it seems like we have a whole slew of live linux tools being developed for all sorts of security uses, and most are incomplete (i.e. beta, never in a finished state), too highly specialized, or so jam full filled with crap that isn't necessary.

I could be off base; this is a knee jerk reaction to this statement. I'll go read some more and see, but my BS-o-meter went off when I read this blurb.

Well... what if you find dirty pics on the host machine? I know with scanned docs a tool like photoshop would be good to pull off signatures with contrasting and such... but I know what you mean. Even with typical distributions I don't need 15 different GUI's for text editing.

And why wouldn't you want wireless auditing tools?

Auditor is a great live distro. So what if they throw in a bunch of extra crap, its making it more versitile. What if you are suing the tool for data recovery rather than auditing security (which I have done) these tools will allow you to idnetify a file easier. also lets you get more specific with chosing what files you need to recover. And it doesnt hurt anyone to have extra stuff on a cd.

Zen youre saying some of the tools are too specialized? I like that. Im nuts over fun tools and have things that do one thing and one thing only, but if they do that one thing better then all the other tools then its ok by me. Look at cwshreadder. its made for removing coolweb searchbars., look at all the tools that are made to remove a single virus. my point is when I know what the problem is Id much rather use a specialized tool that will fix that and only that then wait for a prgram to look for things I know are not broken. It saves me time and in return saves my clients and my company money becasue im not wasting my time removing something stupid when I could be working on a higher paid job.

Quote:

---

Originally posted here by zencoder
Why on earth do you need to create graphics and 'looky pretty' images for a report from your live linux auditing tool cd?!?!?

---

Hi. Because your boss will respond quite well to pretty reports and give you more money to buy fancier and more expensive security tools. (Well, my bosses get very impressed by pretty reports with graphs and diagrams and it works quite well for me).

To OP, thank you for the heads up. I will try the new CD today.

Quote:

---

Originally posted here by Soda_Popinsky
Well... what if you find dirty pics on the host machine? I know with scanned docs a tool like photoshop would be good to pull off signatures with contrasting and such....

And why wouldn't you want wireless auditing tools?

---

hehe speaking of..

recently fired an account manager and when we went over his machine found some nudies of
some of his "net" girlfriends.

you don't want to know what was found in the folder labeled "me"......uuuuuggghhhhh!!!

but we love our work right....:)

Quote:

---

you don't want to know what was found in the folder labeled "me"......uuuuuggghhhhh!!!

---

Oh man. That's just TMI!!! ICK!

Thanks for the post, MsMittens. I now have another tool in the arsenal!

rowdy_yates
I think you missed the emphasis in my statement (since I didn't add it). Yes, you need the graphics prog's for image manipulation, but why the hell do they need to be on the AUDITOR CD?!?!? Are you going to do all your work, analysis, and report generation from the AUDITOR CD on the suspect system? That's asinine, and bad practice.

---

I can see the points some of you are making, and I *do* like the specialization of tools...but that's the point...if this is a specialized auditing tool, then it should be an AUDITING tool.

Anyway, it's just me $0.02 worth. After checking the site it looks intriguing enough that I'm downloading the ISO to give it a shot.

The whole thing just kind of struck my like the flower vase in the new VW Bettle. People were talking about that like it was a selling point. What a ****ing joke. It's a nice edition IF YOU LIKE THAT SORT OF THING, but it has absolutely nothing to do with whether VW has made a good automobile.

Quote:

---

It's a nice edition IF YOU LIKE THAT SORT OF THING, but it has absolutely nothing to do with whether VW has made a good automobile.

---

Ya but people like shiny new pennies and such. ;)

Too bad they don't have a torrent. They could save themselves a lot of money by using other people's bandwith...

Thanks for the link. I downloaded it at work the other day but forgot to burn it so I have to download again before I can play. :(

The auditor and whoppix CDs are my favorite live distros.

For those who have used both, would you say Auditor Live is better than Phlak ( http://www.phlak.org/modules/news/ ) or Knoppix-STD ( Security Tool Distribution http://www.knoppix-std.org/ )?


PuRe

In my opinion...I like Auditor than phlak or knoppix-std. You don't need two pcmcia cards to do wireless penetration testing (cracking wep using aircrack,etc), check out articles on securiyfocus about "wep dead again part 2".

One thing I don't like from Auditor..I have to run that live cd as "root" and I couldn't use internet connection using adsl/broadband ( I think they removed rp-pppoe for internet connection) but I still can get online using my wireless connection.

Thanks for the post Ms.Mittens - anymore like that would be appreciated by us auditors, we need all the help we can get - and especially for the wireless lans. We are now auditing those as well.

Oh - we also picked up cell phones that our company pays for - so anything for checking those out would be cool - we are just starting to look for some decent tools.

Thanks again - good stuff!

I agree about the image manipulation, if you are going to spend time compiling a shiny report for a higher up, you would more than likely invest that amount of time at another machine. Roger that.

Auditor seems way better than phlak IMHO and I now run it now sits right next to my knoppix-std cd.

Bravo MsM for the update.

OK, I'm a convert. I like it. I've used it. Good stuff.

I still stand by me thoughts about the image software. I can even see why it's added, but do we really need to make a big deal about it being included? It's like advertising that you have ashtrays in your new top-of-the-line safety conscious car. Whoop-dee-doo.

For those of you interested, this is becoming the standard tool for <company-name-withheld-to-protect-the-guilty> consultants to run Kismet for site assesments. I still like my custom built on-the-hard-disk linux install, but for a live-linux tool, this one is pretty solid.

Ola:

This looks like an awesome tool for forensics and investigations, but how would you save anything off that you find through scanning and the like? Would you configure up your NIC and then connect to a share or flash drive? Or could you still access your local harddrives?

Gracias.

First off, you would *never* save anything you found off to local harddrives. Doing so would compromise the drive by altering the state you fond it in, quite unecessarily. This violates the first rule you should be observing when conducting any type of forensics work.

Sure, you may know that nothing you did affected the evidence in any way, but you're not going to be able to prove that in court, whether that should be either a civil lawsuit or a criminal trial.

You could instead use netcat to pipe the results out to a computer elsewhere on the network, or mount a USB stick or flash drive as you suggested. It's not at all difficult, and the methods used to do this would be no different than on any other hard drive based system.

Or the drive could be mounted in a forensics workstation and all data saved to a separate drive.

So yes, you could still access your local harddrives. A forensics CD would be rather pointless if you couldn't. What would there be to investigate? But, to actually do so would be a *bad* idea, unless you had another local hard drive to save it to.

You can access local drives and/or mount a USB drive. man mount should help you with this endeavour. :)

Quote:

---

From: Striek

First off, you would *never* save anything you found off to local harddrives. Doing so would compromise the drive by altering the state you fond it in, quite unecessarily. This violates the first rule you should be observing when conducting any type of forensics work.

Sure, you may know that nothing you did affected the evidence in any way, but you're not going to be able to prove that in court, whether that should be either a civil lawsuit or a criminal trial.

You could instead use netcat to pipe the results out to a computer elsewhere on the network, or mount a USB stick or flash drive as you suggested. It's not at all difficult, and the methods used to do this would be no different than on any other hard drive based system.

Or the drive could be mounted in a forensics workstation and all data saved to a separate drive.

So yes, you could still access your local harddrives. A forensics CD would be rather pointless if you couldn't. What would there be to investigate? But, to actually do so would be a *bad* idea, unless you had another local hard drive to save it to.

---

Ahh - excellent point about the local drives. Thanks for suggesting netcat and where to pipe the information. Good ideas to try out. Thanks!

Quote:

---

From: MsMittens

You can access local drives and/or mount a USB drive. man mount should help you with this endeavour.

---

Awesome - thanks for that as well!

Gracias.