hBlock alternatives

Privacy Badger provides protection against website visitor trackers. These trackers come in the form of beacons or invisible pixels and have the goal to collect information about the browser. This data is often shared by third parties and used to create a profile of a particular browser. As minor differences for each user may lead to an individual user, these third parties may even link some of the data to the related individual. Tools like Privacy Badger do not provide guarantees that they block everything, yet can decrease the amount of data greatly.

Most websites consist of HTML show the structure of a website. Together with CSS for styling, and JavaScript for interactive functionality, the website can provide value for its visitors. Some of the used JavaScript libraries are heavy on bandwidth, so website owner may use a content delivery network (CDN). The primary goal for a CDN is to get data closer to the end-user, which results in faster downloads and increasing the performance of the website.

Some common JavaScript libraries are used on many websites. As not every single website creator can pay the costs of a CDN, bigger companies might actually sponsor bandwidth on their CDN edge servers. While this is great from a cost perspective, it also introduces a privacy concern. The owner of the CDN can exactly see what websites a user is visiting by looking at the related requests to the CDN and the related referrer. This is where Decentraleyes comes into place, by intercepting requests to content delivery networks (CDN).

Many file forms store sensitive data, like a location, author name, or even the date and time. This toolkit can remove these bits of data while allowing the file to be used as before.

ArpOn protects a system by running as a daemon and guard against a Man in the Middle (MitM) attack due to ARP spoofing, cache poisoning, or an ARP poison routing attack.

The tool works by using three types of inspection to detect a related attack.

• SARPI (Static ARP Inspection), statically configured networks (without DHCP)
• DARPI (Dynamic ARP Inspection), dynamically configured networks (with DHCP)
• HARPI (Hybrid ARP Inspection), statically and dynamically configured networks (with DHCP)

Typically this type of tool would be used as an additional defense layer to prevent injection attacks from reaching the database.

Algo VPN allows you to run your own VPN service using common cloud providers. Most devices do not need client software, as it uses generic VPN components. For security reasons, Algo VPN supports only IKEv2 using strong cryptographic protocols (AES-GCM, SHA2, and P-256) and WireGuard. It can block advertisements, tunnel traffic via SSH, and helps to automate configuration.

BANG is a framework to unpack files recursively and scan them. The files can be firmware, binaries, or malware. The main goal is to scan all files and perform classification and labeling. This way each file can be further analyzed based on the characteristics.

ClamAV is a popular tool to detect malicious software or malware. While it calls itself an antivirus engine, it probably won't encounter many viruses, as they have become rare. It is more likely to find other forms of malware like worms, backdoors, and ransomware. ClamAV can be used in a few ways, from doing an occasional scan up to scanning in batch. ClamAV does not do on-access scanning but can be combined with other tools to obtain similar functionality. ClamAV is often used to support scanning incoming emails for malicious content.

In a matter of seconds, Cuckoo Sandbox provides detailed results on what a file does within an isolated environment. This helps with malware analysis and understanding what it exactly tries to achieve. Further analysis can be done, based on the previous actions that were done.

Cuckoo Sandbox was created by Claudio Guarnieri as part of the Google Summer of Code project in 2010.

Rootkits are typically considered to be malware, or malicious software. With the intent to hide, this type of software is often used after a breach. Learning about how it works can be useful for security researchers and security professionals.

LMD uses MD5 file hashes and HEX pattern matches to define the malware signatures. These are used to detect malware.

Mal Tindex is a tool that performs binary analysis on malware samples. It analyzes the binaries it is provided to learn about the specifics of each malware sample that makes them unique. This way data can be gathered that may provide background information. For example, it could provide the attribution of a particular actor or malware campaign.

Malice is a malware analysis that wants to provide a free and open source version of VirusTotal. The goal of Malice is to make it usable by both independent researchers up to fortune 500 companies.

Malice is useful for those that do malware analysis or deal with user-generated files that may contain malware. The framework allows scanning files and directories to see if they are infected.

Malscan is a tool to scan for malicious software (malware) such as viruses, worms, and backdoors. Its goal is to extend ClamAV with more scanning modes and signatures. It targets web servers running Linux, but can also be used on mail servers and desktops.

MultiScanner helps malware analysts by providing a toolkit to perform both automated and manual analysis. The data extracted from the analysis can be easily stored together, including the relevant metadata and samples. It allows enriching the data further by retrieving information from external resources.

Rootkit Hunter is a small utility to find suspicious rootkit components. Other known backdoors or malicious software can also be discovered, especially if it has the goal to hide.

The tool uses different ways to hunt, like using predefined directory locations and comparing the output of system utilities. Another method is by requesting a specific output and see if this output is altered, therefore tricking rootkits to reveal themselves.

SSMA is short for Simple Static Malware Analyzer. The tool can perform a set of tests against a malware sample and retrieve metadata from it. SSMA can analyze ELF and PE and analyze its structure. For example, it can retrieve the PE file header information and its sections. Other pieces it can analyze is the usage of packers, anti-debugging techniques, cryptographic algorithms, domains, email addresses, and IP addresses. It can also check if the sample is already detected or blocked by using VirusTotal and the blocklist of malwaredomains.com.

Viper organizes the malware samples and exploits you found over time. It calls itself "Metasploit for malware researchers". Viper has a terminal interface to store, search and analyze files. As it is a framework, is also allows you to create your plugins.

YaraGuardian provides a web-based interface that helps to manage Yara rules. It can be used to search, organize, and bulk-edit rules. The tool also prevents creating duplicate entries, which is a nice additional benefit of this management utility.

Searches through binaries and highlights the most important areas with colors.

Supported binary formats:

• ELF 32/64, arm, x86, openrisc
• Mach 32/64, arm, x86
• PE

The chkrootkit tool consists of multiple parts that may detect the presence of rootkit parts of rootkit behavior on a system.

Some areas that are checked include:

• interface in promiscuous mode
• lastlog deletions
• wtmp deletions
• wtmpx deletions
• signs of LKM trojans
• utmp deletions

With the help of BleachBit, the system can be kept clean and increase privacy in the process.

Items that can be cleaned by BleachBit include:

• Browser cache
• Cookies
• Internet history
• Temporary files
• Log files

The tool can 'shred' files to ensure the data can no longer be retrieved, opposed to just deleting it.

This tool is useful for sharing sensitive data, including information to be shared with journalists where you rather stay anonymously. It can also be helpful for sharing bigger amounts of data, without having to use a typical cloud service like Dropbox.