I'll post this information for educational use or for SecAdmins testing their own network.
This first one is IMO the supreme and really cuts down on my list (so after this I'll just list tools I find would be the most common)
The Linux distro Backtrack - A distro derived from Knoppix/Whoppix and SLAX. This is a bootable Live cd that includes a large amount of tools built in. Everything from sniffers to password cracking, wireless (WEP, WPA) cracking, browser exploitation framework. The list goes on and on. The first time I booted this all I could say was "whoa".
Others include:
Nmap - This is a port scanner. Port scanning is not illegal, but it's not legal either. Nmap collects what program is running on that port, what version and build number. With one simple website check, you can find exploits (if there is a known one) for that program. Use this ONLY on your network as ISPs get ticked off when it's used. It's like going through a woman's purse. You shouldn't be getting all the information that's in there, but you're not taking anything either.
Cain & Abel - This is a 'Microsoft Password Recovery' tool. Note the quote I put around it. This program can brute-force, dictionary attack and do cryptanalysis on passwords. It can hack wireless keys, find cached passwords, record VoIP (holy snap, as I typed 'VoIP' there was a commercial playing and it said VoIP...whoa!). It can also analyze protocols.
Ophcrack - I've not used this yet, but I guess it's the same as Cain & Abel but it's bootable from USB. Hence you do not need a user account for it to run. Cain & Abel needs at least Guest.
Telnet - Ya, it's not impressive anymore but hey, some old schooler could be out there. I still use it. I have programs that still use it. You are directly connected to the machine so anything you type is ran on that server.
Batch files - Ya, just as old as Telnet but if you allow users to run batch files, they can do some pretty impressive stuff to circumvent the systems.
VicSpy, Aradanax - Keyloggers. Capture keystrokes, screen shots, etc. These usually get picked up by anti-virus unless they are breaking edge new.
Wireshark - This is a network sniffer. ANY data being communicated over the network is captured by this program. If there is a non-secured connection on the network, this thing will let you see the exact data being transferred. Of course you need to know how to read it but basic networking courses teach that.
RATs - Remote Administration Tool's. Slip a trojan in, you can full access of their PC, basically see what they are doing with a screen shot being fed to you.
There are many, many more tools but basically Backtrack takes care of a huge chunk.
There are other techniques as well. These will get you started;
Websites:
SQL Injection - Basically confusing SQL and having it just hand over access.
Cross-Site Scripting - Usually used for cookie stealing.
RFI/LFI (Remote/Local File Include) - Able to upload a file to the server and have it execute what you want.
Botnets and Zombies - These guys are responsible for the approx 230 billion spam messages PER DAY. Uses command and control servers that generate URL's. Massive amounts of high jacked computers (most people are unaware they have been) send out spam after spam. You can purchase software on the black market to control these boys. The top nets are: Rustock, Mega-D (my fav lol), Festi, Pushdo and Grum.
Phishing - This is clicking on links that mirror the looks of legit sites, usually banking. You go to a site that looks EXACTLY like your banks site. You enter your account number and password and it takes your info and then passes it a long to the legit site. Usually these come in email from saying "There was a problem with your account and you need to sign in". PayPal has been hit like this quite a few times.
Network attacks:
Man in the middle - intercepting communication then forwards fake information
Replay - Same as man in the middle but doesn't touch the info. Just records and and sends it on it's way.
TCP/IP Hijacking - setting up fake network devices, spoofing MAC's.
DoS - Denial of Service attacking. Flooding a server with a massive amount of bogus requests.
DDoS - Using a massive amount of computers to send a massive amount of bogus requests to a server.
Smurf Attacks - Tricks computers into sending false responses
Unfortunately, what I have listed is only the beginning into Security Administration. There is still other problems such as data leakage, social engineering, policies, authentication types, etc.
I hope this helps though as a start.
If anyone would like to correct me or explain something better, please do.
