Open Source PHP System Software for BSD

bWAPP, or a buggy web application, is a free and open source deliberately insecure web application. bWAPP helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities. bWAPP prepares one to conduct successful penetration testing and ethical hacking projects. What makes bWAPP so unique? Well, it has over 100 web bugs! It covers all major known web vulnerabilities, including all risks from the OWASP Top 10 project. The focus is not just on one specific issue... bWAPP is covering a wide range of vulnerabilities! bWAPP is a PHP application that uses a MySQL database. It can be hosted on Linux/Windows with Apache/IIS and MySQL. It is supported on WAMP or XAMPP. Another possibility is to download bee-box, a custom VM pre-installed with bWAPP. This project is part of the ITSEC GAMES project. You can find more about the ITSEC GAMES and bWAPP projects on our blog. For security-testing and educational purposes only! Cheers Malik Mesellem

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

The WiKID Strong Authentication System is a public-key based two-factor authentication system. It is a flexible, extensible, and secure alternative to tokens, certs and passwords. Application & API support exists for Java, ASP, PHP, Ruby, OpenVPN, TACACS+, etc. Read our eGuide on how to setup your network with two-factor authentication: http://www.wikidsystems.com/learn-more/two-factor-authentication-white-papers

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

phpLDAPadmin is a web-based LDAP administration tool for managing your LDAP server. With it you can browse your LDAP tree, view LDAP schema, perform searches, create, delete, copy and edit LDAP entries. You can even copy entries between servers.

multiOTP is a PHP class, a powerful command line utility and a web interface developed by SysCo systèmes de communication sa in order to provide a completely free and easy operating system independent server side implementation for strong two factors authentication solution. multiOTP supports hardware and software tokens with different One-Time Password algorithms like OATH/HOTP, OATH/TOTP and mOTP (Mobile-OTP). QRcode generation is also embedded in order to support provisioning of Google Authenticator software tokens. SMS code sending is currently implemented for several providers (ASPSMS, Clickatell and IntelliSMS). The data storage of the command line utility is by default flat files based in order to simplify deployment in a few minutes, but MySQL backend is supported too. multiOTP can be easily integrated in RADIUS servers like FreeRADIUS under Linux/Windows or TekRADIUS LT under Windows. multiOTP is also the engine of the credential provider multiOTP Credential Provider.

Free TACACS+ (tac_plus) engine (written in C++) and webui (PHP) allows network administrators to limit access to network devices. This project (tacplus/webui) use to be on www.networkforums.net. New and improved features been added since the last release on old website. ** New Release of WebUI ** Improved useability More searching capabilities in reports

This module provides attack surface reduction enhancements against the HTTP Flood Attacks at the web application level. Massive crawling/scanning tools, HTTP Flood tools can be detected and blocked by this module via htaccess, firewall or iptables, etc. (like mod_evasive) You can use this module by including "iosec.php" to any PHP file which wants to be protected. You can test module here: http://www.iosec.org/test.php (demo) Watch the Proof of Concept video: http://goo.gl/dSiAL Hakin9 IT Security Magazine Article about IOSEC http://goo.gl/aQM4Di (different format -> http://goo.gl/JKMUPN) IJNSA Article at http://goo.gl/LLxRdX WP Plugin Page http://goo.gl/nF5nD CHANGES v.1.8.2 - Iptables Auto Ban Bash Script Included - Token Access via Implicit Deny - Reverse Proxy Support - reCAPTCHA Support Do you want more features? Check for third party addons http://sf.net/projects/iosecaddons Gökhan Muharremoğlu

Atricore’s JOSSO is an open source and commercially supported Internet Single Sign-On (FSSO) solution for point-and-click and standards-based (SAML2) Internet-scale SSO implementations. For more information contact us at : http://www.josso.org

Automated Security Tools (autosec) aims to provide automatic tools which network administrators may use to help check and test the security of their network.

You could be doing a better job of website security... If only there was a simple way to implement SSL with signed keys? PHP-CA is an easy to use and easy to administer Certificate Authority that runs in PHP.

Collection of open source security tools that enhance the ability of people and companies to secure their environment. These tools will build upon the foundation laid by the security community.

The BRST - Border Router Security Tool is a web based utility for generating secure configuration files for Cisco routers in a border configuration. The administrator fills out a web form, clicks submit, and receives a router config file.

NetDash is a network dashboard and intrusion detection system. NetDash passively collects network traffic and then stores key information to be analyzed for unwanted network activity. NetDash captures all traffic passed over the network and stores that traffic in a PCAP file that can be downloaded and analyzed with other tools such as Wireshark. NetDash processes each PCAP file and stores relevant information about each packet captured in a MySQL database. Loaded NetDash plugins display statistical and intrusion detection information on the dashboard and provide email and system notification of identified events.

phpKeyMgr is a PHP based SSH key managing software. You can create multiple keys, define servers, and choose valid keys for each servers. After this you can export the authorized_keys file with ease.

phpRADmin is a web tool written in PHP to allow configuration, administration and provisioning of RADIUS server (FreeRADIUS), clients (NAS, AP, etc) and users (PPP, PPPoE, EAP, etc) with MySQL as backend.

A PHP-GTK based GUI for truecrypt on linux. Requires PHP cli with PHP-GTK2 installed to run.

w3pw is a web based password management console written in PHP and using a MySQL Database as storage for the encrypted (using MCrypt) password information.

A Web Based Self Service Active Directory Password Reset Tool

AIM Sniff is a network sniffer specifically designed to pick up messages transmitted using the AIM or MSN clients and their derivatives. All information can be sent to STDOUT or a MySQL DB.

A.I. security app. Development ceased.

ANDURAS SurfProtect is a PHP application that can be used for virus-scanning withing the application-layer (ISO/OSI) Either http and ftp protocols are already supported within the beta version.

AVirCAP is a system for manual and / or automated detection of CodeRed and Nimda type of hack attempts and virtually all other kinds of "logable" intrusion attempts. It can work stand alone or together with other additional AVirCAP machines in the LAN/W

Admin Secure is an add-on script for PHP-Nuke web portal system. This add-on gives you additional protection schemes from common hacking activities. Admin Secure is an alternate protection for your PHP-Nuke based website.

ACID is a PHP-based analysis engine to search and process a database of security incidents generated by security-related software such as IDSes and firewalls (e.g. Snort, ipchains).