Posted on Leave a comment

Complete guide to Goldeneye tool

Hello, aspiring ethical hacker. In our previous blogpost, you learnt about Denial of Service (DoS) attack. In this blogpost, you will learn about goldeneye, a HTTP DoS Test Tool.

This tool helps us to test if a web server is susceptible to DoS and DDoS attacks in real-world. Like any DoS testing tool, it generates a large number of requests in short time. Let’s see how this tool works. For this, we will use Kali Linux as this tool is available by default in its repositories. It can be installed as shown below. To install it on other systems, it can be downloaded from here.

goldeneye_1

The simplest way to use goldeneye tool is to just provide the URL you want to test as shown below.

goldeneye_2

Different modes (-m)

By default, goldeneye uses GET requests to test a website. However, it has two other modes too: POST and RANDOM. You can set this modes using the “-m” option.

Goldeneye_3
Goldeneye_4

Number of workers (-w)

By default, goldeneye uses 10 workers running 500 connections each. However, we can change it using the “-w” option. For example, let’s set it to 20 workers.

Goldeneye_5

Number of connections (-s)

Similarly, we can change the number of connections using the “-s” option. Let’s change the number of connections to 1000.

Goldeneye_6

Debug mode(-d)

We can run goldeneye tool in debug mode using the “-d” option. Debug mode gives detailed information about the tests being performed.

Goldeneye_7

Posted on Leave a comment

Beginners guide to Lynis

Hello, aspiring ethical hackers. In this blogpost, you will learn about a tool called Lynis, the security auditing and hardening tool for UNIX based systems like Linux, macOS, BSD and others. It performs an in-depth security scan to test security defenses and provide suggestions for further system hardening.

This tool audits the following features on the system.

  1. General system information.
  2. System tools.
  3. Operating system.
  4. Boot and other services.
  5. Kernel vulnerabilities.
  6. Memory and processes.
  7. Users, groups and authentication
  8. Kerberos
  9. Shells
  10. File systems
  11. USB devices
  12. Storage
  13. NFS
  14. Name Services
  15. Ports and packages
  16. Networking
  17. Printers and Spool
  18. Email and messaging software
  19. Firewalls
  20. Web servers
  21. SSH and SNMP
  22. Databases
  23. PHP (in web server)
  24. Logging and log files
  25. Insecure services
  26. Banners
  27. Scheduled Tasks
  28. Accounting
  29. Time and synchronization
  30. Cryptography
  31. Virtualization
  32. Containers
  33. Security frameworks
  34. System tools and malware
  35. File permissions etc.

Let’s see how to run Lynis for the first time. For this, we will be using Kali Linux. It can be installed on Kali as shown below.

Lynis 1

After the installation is successful, run the command shown below to run it to audit the entire system.

lynis audit system
Lynis 2

It runs as shown below.

Lynis 3

While auditing, wherever there is scope for hardening, lynis adds a suggestion as shown below.

Lynis 4
Lynis 5
Lynis 6
Lynis 7

After the entire system is audited, Lynis provides summary of the entire audit as shown below.

Lynis 11
Lynis 12
Lynis 13

Below the summary, you can find each suggestion as shown below.

Lynis 8
Lynis 9
Lynis 10

You can harden your system based on these suggestions. You can also find this information in the log reports of Lynis.

Lynis 14
Lynis 15
Lynis 16
Lynis 17

Posted on Leave a comment

Beginners guide to Eyewitness tool

Hello aspiring ethical hackers. In our previous blogpost, you studied about website footprinting. In this blogpost, you will learn about a tool called eyewitness which helps you to decide which website to focus on.

In ethical hacking, before trying to footprint a website, it would be good if we have a general idea about what websites to target first. For example, a company you are going to pen test may have multiple websites and sub domains. Before we jump into password cracking or exploitation or directory busting or perform any other attack, it would be good if we are first able to decide what website and URLs to target first. The role of eyewitness tool comes there. Eyewitness takes the screenshots of the URLs or websites you provide. Apart from taking screenshot of the URL, it will also capture any header info and default passwords.

Let’s see how to use this tool. For this we will be using Kali Linux as this tool is available by default in Kali repositories. As target, we will be using Metasploitable 2 installed in our virtual hacking Lab. It can be installed as shown below.

Eyewitness 1 1

Target a single URL (–single)

You can take screenshot of a single URL as shown below.

Eyewitness 2

As soon as it writes a report for your target, it will ask you if you want to open the report. Click on “Yes”. It will open the report as shown below.

Eyewitness 3 1024x444

You can even view the code of the URL you scanned.

Eyewitness 4 1024x460
Eyewitness 5

But the real power of eyewitness can be seen when we are targeting multiple URLs at once. For doing this, we will first create a file called URLS.txt and add some URLs we want to target as shown below.

Eyewitness 6

Target multiple URLs (-f)

Multiple URLs can be targeted with this tool by specifying the above created file with (-f) option.

Eyewitness 7
Eyewitness 8

Here’s the report.

Eyewitness 9 1024x577
Eyewitness 10 1024x422
Eyewitness 11 1024x363
Eyewitness 12 1024x461

One of our URLs we targeted ended up in a error.

Eyewitness 13 1024x354

Skip DNS resolution(–no-dns)

In some cases, while using eyewitness tool, you may have to go through a VPN. In such cases, it is good to skip DNS resolution when connecting to the website. This option helps you to do it.

Eyewitness 14

Resolve IP / host name for your target (–resolve)

Eyewitness 15

Time to wait while requesting an URL (–timeout)

By default, eyewitness waits for 7 seconds before it goes to take a screenshot of a new webpage. However, this can be changed with this option. For example, let’s change the timeout time to 1 second.

Eyewitness 16

Add jitter (–jitter)

Using this option, we can randomize the URLs specified and add a random delay.

Eyewitness 17
Eyewitness 18

Add delay before taking a screenshot (–delay)

Using the option, we can add delay between opening of the navigator and taking a screenshot. This delay can be specified in seconds. For example, let’s add 10 seconds delay before taking screenshot.

Eyewitness 19
Eyewitness 20

Maximum retries (–max-retries)

This option specifies eyewitness tool how many retries it has to make if it fails to grab a screenshot on the first attempt.

Eyewitness 21

Specify directory name for saving the report (-d)

This option is used to specify a directory name for saving the report.

Eyewitness 22

Number of results to show on one page (–results)

By default, eyewitness shows output for all the URLs given as input on a single page. This option can be used to specify how many results to show per page. For example, let’s set it to show 1 result per page.

Eyewitness 23
Eyewitness 24 1024x574

As you can see, now, all the results are shown on separate pages.

You don’t want to be prompted for viewing the report (–no-prompt)

If you don’t want eyewitness to prompt you to open the report after finishing its work, you can use this option.

Eyewitness 25
Eyewitness 26

Posted on Leave a comment

Beginners guide to ARP scan

Hello, aspiring ethical hackers. In our previous blogpost, you have learnt about network scanning and enumeration. In this blogpost, you will learn about a tool named arp scan, a command line tool used for scanning and fingerprinting on the local network.

ARP scan is available for Linux and BSD systems and uses ARP protocol to scan the network. Let’s see how to use this tool. For this, we will be using Kali Linux as this tool is available for download by default in Kali repositories.

It is good to run arp scan tool as root user in order not to face some errors. You can simply scan a network using arp-scan as shown below.

ARP Scan 1

If you want to scan your local network, you can simply specify the “-r” option to do it as shown below.

ARP Scan 3

If your device is connected to multiple networks and you want to scan a particular network, you can specify the network interface using the “-I” option. By default if the “-I” option is not specified, arp-scan will search the system interface list for the lowest numbered configured up interface, excluding Loopback and scan that network.

ARP Scan 2

Quiet mode (-q)

If you want minimal output to be displayed for each responding host, while scanning with arp-scan, you can use quiet mode. While using this mode, only the target IP address and MAC address are displayed.

ARP Scan 4

Plain mode (-x)

If you want more less details like just the responding host details, you can use the plain mode. While using this mode, arp scan suppresses the header and footer text in output as shown below.

ARP Scan 5

Ignore duplicates (-g)

By default, arp scan displays duplicate packets by flagging them with (DUP.n) where “n” is the number of times the target host responded. By specifying the option, these duplicate packets can be ignored by arp-scan.

ARP Scan 6

Calculate and display round trip time (-D)

Network Packet round trip time (RTT) is the time it takes for a data packet to travel from a source to a destination and back again. It is a key matric to measure network latency and is usually measured in milliseconds. Setting this option, allows us to measure the round trip time.

ARP Scan 7 1024x640

Retry attempts (-r)

This option can be used to specify the number of retry attempts to make per host. By default arp-scan makes 2 retry attempts. For example let’s set it to 3.

ARP Scan 9

timeout (-t)

By default, 500ms is the timeout for this tool. This option can be used to change it however.

ARP Scan 10

Interval (-i)

If you have limited bandwidth to use for scanning with this tool, you can use this option to control the outgoing bandwidth by limiting the packet rate. For example, let’s set the interval between each packet to 400 milliseconds. It can also be set to micro seconds by appending the “u” option.

ARP Scan 11

Bandwidth (-B)

This option is useful when you want to control the outbound bandwidth to a specific value. By default, bandwidth is 2,46,000 bits per second.

ARP Scan 12

Resolve responding addresses to hostnames (-d)

This option is used to resolve the hostnames for addresses detected by this tool. The default output format will display the hostnames instead of the IPv4 address.

ARP Scan 13

Limit the number of hosts to scan (-M)

By default, arp-scan scans all the hosts on the network that are LIVE. You can limit the number of hosts to scan using this option.

ARP Scan 14
Posted on

JPS Virus maker: Beginners guide

Hello, aspiring ethical hackers. In our previous blogpost, you learnt how to create a virus from scratch. However, not always viruses are created from scratch in real-world. There are many virus makers available to easily create viruses. In this blogpost, you will learn about one such tool named JPS Virus maker.

Why we chose this tool particularly? There are numerous virus makers available on internet and for sale on dark web. We chose this tool because our intention is not to create a virus but just show you how easy it is to create a virus. An also because since its popular and harmless (because it is easily detected by even basic AV’s. Note that this is for education purpose only.

JPS virus maker runs on Windows. Once you download JPS virus maker to the Windows system, clicking on the executable opens a window as shown below. (Note that JPS virus maker is portable and needs to installation. Also note that Antivirus needs to be disabled while creating a virus with JPS virus maker. Otherwise Antivirus will flag it as malicious software.

JPS Virus Maker 1a

Here, you can see all the functions of the virus maker. You can specify any or all functions you want to perform on the targets system. You can select a single function or multiple functions at once.

But first let us click on the “About” button to learn more about its creator.

JPS Virus Maker 2a

You can see that it is written in Delphi. With the “server name” option, you can select the name for the virus you want to create from the given values. Let’s name it “sender.exe”.

JPS Virus Maker 4a

Similarly, you can also set the name for your virus after successful installation on the system.

JPS Virus Maker 3a

Below all the functions given for you to set for your virus, you can select the option to restart, log off, turn off and hibernate the target system. You can find additional functions for your virus by clicking on the button next to “Exit”.

JPS Virus Maker 5a
JPS Virus Maker 6a
JPS Virus Maker 7a

You can even convert your virus into a worm. To understand the difference between virus and a worm, read our guide on malware. You can even select a icon for your virus. Let’s select PDF icon, for example.

JPS Virus Maker 8b

After you select all the functions you want your virus to have, click on “Create Virus” and the virus will be created.

JPS Virus Maker 9
JPS Virus Maker 10

The virus is ready. Now all we need to do is to send it to the target and convince them to execute it. For this, you need to learn social engineering.