2004-08-29: Latest release: 0.1rc1
MENU# SUMMARY | SCRIPTING | MANUAL | VIEWCVS | TESTING AND RESEARCH
Impost is a network security auditing tool designed to analyze the forensics behind compromised and/or vulnerable daemons. There's two different kinds of operating modes used by Impost; It can either act as a honey pot and take orders from a Perl script controlling how it responds and communicates with connecting clients; or it can operate as a packet sniffer and monitor incoming data to specified destination port supplied by the command-line arguments.
While running, Impost keeps a history of incoming buffers for every connection it has to deal with. These histories are normally dropped when a socket is closed or a TH_FIN|TH_ACK flagged packet is received. However, if at anytime during a live connection a 'suspicious' buffer is detected, Impost will use the history corresponding with the connection to create a log file containing all of the received data including the suspicious buffer.
A side from creating a log file, Impost will also try to analyze the buffer which had been thought of as suspicious. Some of the things which Impost will look for are machine codes, nop sleds, shellcode signatures and a lot of other junk.
Impost is still in early stages of development so there is a lot of work that needs to be done. Even in these early stages, Impost proves to be an extremely powerful multi-purpose network debugging tool. Whether you're a software developer, a security consultant, systems administrator or hacker - you'll find Impost very useful if applied properly to whatever it is you do.
You can download the latest Impost source code and updates via Impost's CVS respository hosted on sourceforge.net. To login in anonymously and check out the latest source, use the following steps:
Note: There's usually a 5 hour delay for the anonymous CVS server to update everytime something is committed. You can also browse the CVS repository with your web-browser thanx to SourceForge and ViewCVS by clicking here.
(Online manual is available here)
All files and releases for Impost
Impost has been tested on the following platforms:
Please submit bugs here: Bugs and Patches
Email: ziplock <ziplock@x86asm.org>
or <sickbeatz@hotmail.com>
Last updated: $Date: Sun Aug 29 19:08:55 PDT 2004
