Mantra 0.6.1 Security Framework: A Browser Based Hacking Toolbox

Mantra is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers,security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source software.

It's a security framework that can be very helpful in performing all the five phases of attacks including reconnaissance, scanning and enumeration, gaining access, escalation of privileges, maintaining access, and covering tracks. Apart from that it also contains a set of tools targeted for web developers and code debuggers which makes it handy for both offensive security and defensive security related tasks.

Mantra is design to be lite, flexible, portable and user friendly with a nice graphical user interface. You can carry it in memory cards, flash drives, CD/DVDs, etc. It can be run natively on Linux, Windows and Mac platforms. It can also be installed on to your system within minutes. Mantra is absolutely free of cost and takes no time for you to set up.

You can download Mantra 0.6.1 here:

Windows – OWASP Mantra Security Toolkit – Gandiva.exe
Linux 32-bit – Mantra Security Toolkit – Gandiva.tar.bz2

Or read more here.

Google + Cheat Sheet........Check it Out

Am really a big fan of Google+ and for that i've been looking for ways to understand every bit of it. I just discovered some awesome cheats I'll be sharing with you, and for those still clamoring for invite, it's now open to everyone. So lets go straight to G+ and explore some of this tricks.

Before we go on, my big thanks goes to Simon Lausten a Google+ users for sharing it. This sheet includes cheats you need to know to use Google+ like a pro.

Another good thing is that this cheat has translated versions as well for International readers. Check them out and if you've not added me to your circle yet, please do.....

Window Server 8: Preview by Microsoft

Microsoft has given a peek into Windows 8 Server, the successor to Windows Server 2008 R2 and companion to the tablet-tastic Windows 8 client.

The company is reported Tuesday to have boasted Windows 8 Server will pack more than 100 new features.

Speaking at its Worldwide Partner Conference (WPC), however, Microsoft seems to have zeroed in on just one: the new Hyper-V it's positioning as an enabler of cloud computing when used to virtualize server

operating systems and applications in your data center.

Microsoft's teaser came in the shadow of virtualization giant VMware's vSphere 5 launch in San Francisco, California, on the same day.

There, VMware chief executive Paul Maritz – a former Microsoft exec with 14 years at the company – boasted that according to various industry analysts VMware virtual machines are about six months away from running 50 per cent of the world's server workloads.

Microsoft is coming from behind in virtualization, and claimed at WPC in Los Angeles, California, that HyperV is the fastest growing virtualization stack.

Cutting to the features at WPC, Microsoft unveiled Hyper-V Replica that will let you replicate virtual machines either immediately or according to a schedule. This will, Mary-Jo Foley reports, let you do something like replicate a mission-critical database to an offsite data vendor.

Microsoft claimed it will be vendor-agnostic and support different storage, data center and software and service providers. In keeping with Microsoft's goal of getting customers to put more of their data in its cloud by not charging for imports, Microsoft will also give Windows Server 8 users unlimited replication without an additional fee per virtual machine.

Hyper-V, meanwhile, will also support more than 16 virtual processors per machine.

Microsoft called Windows 8 Server "the next step in private cloud computing".

Microsoft backed the cloud play by talking planned software that'll unify management of apps running on virtualized Windows servers and on Microsoft's Windows Azure cloud.

It announced Systems Center 2012, which will feature an account controller that gives single sign-in to all your apps on different servers, and that provides a tiled view of apps. You will be able to deploy apps using a set of best practices. Systems Center 2012 is due to ship this year.

On the apps front, Microsoft dressed an announcement about a third test build for the next version of SQL Server, codenamed Denali, with a demo of the ability to suck in data from the Windows Azure Data Market to the new database. It did this while showing off what it called "PowerPoint for data" that lets you customize and re-size data fields and turn them into charts and graphs by simply clicking and tugging at them using your mouse.

The Data Market is an online data store with pre-built integration for SQL Server, Office and Bing.

Microsoft, meanwhile, said that finished applications are now available for sale on the Windows Azure Marketplace - there are 578 offerings. Announced in November, the Marketplace, which includes the data Market, was originally a place for sharing data.

Source: The Register

.XXX Set to Launch Search Engine Devoted

ICM Registry, the company behind the forthcoming .xxx domain extension, plans to launch a search engine devoted entirely to porn at search.xxx.

The news emerged during a panel discussion at the YNOT Summit 2011, a porn industry trade show in San Francisco late last month (depressingly SFW video at YouTube.)

ICM president Stuart Lawley confirmed to El Reg that search.xxx will index only porn sites found at .xxx addresses. The company is currently testing potential technology partners.

The site will be fed traffic from about a dozen "premium" .xxx domain names, potentially including the likes of porn.xxx and sex.xxx, and will be monetised with ads and sponsorship, he said.

During the YNOT panel, ICM sales director Vaughn Liley defended the company from adult industry claims that .xxx domains will be too expensive, too risky and offer little value.

Pricing for .xxx names is expected to start at roughly $75 per year, compared to .com rates of around $12, but they will be substantially more expensive during the pre-launch "sunrise" and "landrush" periods, which begin in early September.

Existing porn companies with large portfolios of domains in other extensions are concerned that they will be forced to spend thousands on defensive registrations or risk being cybersquatted.

Search traffic, Liley said, is one way that webmasters may be able to recoup their registration fees and increase revenue. ICM recently also announced a free subscription to McAfee Secure for all of its customers.

"I believe that in 12 or 18 months time that some of the animosity that has been shown to us as a company will evaporate and people will go 'actually, this has been very good for my business,'" he told an audience of pornographers that, while still largely sceptical, was less openly hostile than during previous such debates.

Some porn publishers are also worried that .xxx domains carry the risk that ICM's policy-setting body, IFFOR (International Foundation for Online Responsibility) may create draconian new rules that will damage their businesses in future.

"The longer you're on it, more you invest into it, the more you're potentially trapped," YNOT president Connor Young said during the panel. "[The benefits] would have to be monumental, would have to be something so substantial, for me to put myself in the position where three or four years down the line they have that kind of control over my business."

IFFOR's Policy Council will be loaded with porn industry representatives and free speech advocates, however, which ICM believes should deflect these concerns.

Other search engines, such as Google and Bing, will also index .xxx sites, but some porn webmasters say they're not always particularly porn-friendly. Google Instant, for example, does not auto-complete porn-related search terms. Yes, that's right. It won't finish them off ...

Google + Estimated to Attain 10 Million Users

The new Google Social Network has been the hot discussion of tech bloggers around the world of which majority are taking side with Google+ to be the best alternative to Facebook and just now an analyst estimated Google+ to likely reach 10 million users.

Note: the figures did not come from Google, but from Paul of Ancestry.com, not Microsoft co-founder Paul Allen. He came up with an interesting tactics to calculate the number of Google+ members. Trust me it's fascinating.... just read on.

According to Paul.....,  I project that Google will easily pass 10 million users tomorrow and could reach 20 million user by this coming weekend if they keep the Invite Button available. As one G+ user put it, it is easy to underestimate the power of exponential growth.

My model is simple. I start with US Census Bureau data about surname popularity in the U.S., and compare it to the number of Google+ users with each surname. I split the U.S. users from the non-U.S. users. By using a sample of 100-200 surnames, I am able to accurately estimate the total percentage of the U.S. population that has signed up for Google+. Then I use that number and a calculated ratio of U.S. to non-U.S. users to generate my worldwide estimates. My ratio is 1 US user for every 2.12 non-U.S. users. That ratio was calculated on July 4th through a laborious effort, and I haven't updated it since. That is definitely a weakness in my model that I hope to address soon. The ratio will likely change over time.

Since I have been tracking this same cohort of surnames from my first day, I am able to accurately measure growth over time.

I am not claiming perfect accuracy, but I do think the model is sound. A quant has suggested a mathematical formula that I can use to calculate a range of Google users with a 99% level of accuracy, and one of my employees is working on that math now. I hope to include that in future models.

Here is one way to look at my model. Imagine the U.S. government in 2020 has no money left. I know that's hard to imagine, but stay with me. Imagine they wanted to conduct a 2020 census and subsequent decennial censuses with a degree of accuracy (let's say 95%) and to do it on a shoestring budget.

They had complete data for 2010 - the population and growth rates for every city and town in the country. To do 2020, they could just take a random sampling of 100 cities and towns across the U.S. that were representative and conduct the census JUST for those cities every 10 years. If those 100 cities averaged the same growth rates as the rest of the country, then their decennial censuses would be fairly accurate but very inexpensive. (Obviously the US example won't work and shouldn't be tried, since the purpose of the U.S. census is in part to determine Congressional representation - so a complete census must be done in the entire country.)

But my project is like that - a low-budget sampling. I have randomly selected 100 uncommon U.S. surnames and I am tracking the number of Google+ users with those names - updating my counts every 2-3 days. I am assuming that the growth in G+ users with those surnames is similar to the growth in G+ users with the other 150,000 or so surnames in the U.S. If I had resources to include 500 or 1,000 surnames in my sample, then I believe my model would be more accurate. But my time and budget available for this project are small, so it is what it is. And then I take the 2.12 - 1 non-US to US ratio to complete the calculations.

Honestly I can't remember any social network site climbing to such height at a very short period of time although we can't rule out the fact that they already have existing products which has solid user base and they will be leveraging from those angle as well.

Although there have been no response from Google to confirm this estimates, but if perchance they are true, then its only the creator that know the future of Facebook.

Vega: An Open Source Platform to Test the Security of Web Application

Vega is an open source platform to test the security of web applications. Vega can help you find and validate SQL Injections, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.

It includes an automated scanner for quick tests and an intercepting proxy for tactical inspection. Vega can be extended using a powerful API in the language of the web: Javascript.

Vega was developed by Subgraph in Montreal.

Core Features:

• Website Crawler
• Content Analysis
• Intercepting Proxy
• SSL MITM
• Automated Crawler and Vulnerability Scanner
• Consistent UI
• Extensibility through a Powerful Javascript Module API
• Customizable alerts
• Database and Shared Data Model

Modules Available:

• Cross Site Scripting (XSS)
• SQL Injection
• Directory Traversal
• URL Injection
• Error Detection
• File Uploads
• Sensitive Data Discovery

Download Vega

Links for binary packages built for various platforms are listed below:

Mac OS X 32-bit Intel
Mac OS X 64-bit Intel

Linux GTK 32-bit Intel
Linux GTK 64-bit Intel

Microsoft Windows 32-bit Intel
Microsoft Windows 64-bit Intel

Read More About Vega

3 Best Social Network Sites Manager

Not until yesterday, I discovered few of my social network sites were half dead.... I know you might be surprised by what i said "half dead". I have received some friend request and few people have sent me messages which i have not replied for long. It was really annoying because i almost lost some vital stuff if i had not checked it yesterday.

So i had to search for an effective manager that i can use to access all my social network sites all at once, instead of signing into their individual accounts. Fortunately there were so many of them, i then decided to try 5 known ones and i came to conclusion that three out of the five were perfect at least for me and i'll be sharing them here with you so you wont have the hassle of searching for them.

Note: This list are randomly selected, so you can choose the last if you feel like.

Seesmic (Windows/Mac/Linux/Android/BlackBerry/iOS/Web, Free)

Seesmic started life as a social video aggregator and transformed into a social media management powerhouse. Available for nearly every operating system and mobile device under the sun, Seesmic makes it easy to keep tabs on your favorite services. All the versions of Seesmic support a core of social networking sites like Facebook, Twitter, and LinkedIn, but the desktop versions really shine with support for plugins that expand the support to over 50 services. Check out the plugin marketplace to see all the different add-on services.

Digsby (Windows/Mac/Linux, Free)

Originally a multi-protocol chat client, Digsby has expanded to include additional features such as email and social network support. You can now check status updates and send your own status updates on popular social networks like Twitter, Facebook, MySpace and LinkedIn. The InfoBox gives you updates on your friends as well as access to any invitations or announcements they send out. It's not quite the expansive dashboard provided by some of the other options in this week's Hive Five but it's more than powerful enough for many readers and it helps wrap up instant messaging, email, and social networking in one application.

TweetDeck (Windows/Mac/Linux/Android/iOS/Chrome, Free)

TweetDeck is another social media application that makes good use of a multi-column layout. You can easily customize TweetDeck to display just what you want to see including wall updates, Twitter mentions, and more. If you sign up for a free TweetDeck account you can also synchronize your settings and layout across computers. TweetDeck supports Facebook, Twitter, LinkedIn, MySpace, Google Buzz, and more. In addition to easy cross-network updates and monitoring, TweetDeck also supports schedules updates.

Do you have your own list? share with us through the comment box below.