Anamar Taknev, Author at Hackercool Magazine

Posted on September 28, 2024September 28, 2024 by Anamar Taknev

Beginners guide to tcpdump

Hello, aspiring ethical hackers. In our previous blogpost, you learnt in detail about packet sniffing and packet analyzing. A sniffer or a packet analyzer plays a very important role in packet sniffing. In this blogpost, you will learn about a sniffer or packet analyzing tool called tcpdump.

tcpdump is an open-source data-network packet analyzer that runs under a command line interface. It works on almost all Unix-type operating systems like Linux, Solaris, FreeBSD, macOS etc. Tcpdump was written by Van Jacobson, Sally Floyd, Van Paxson and Steven McCanne in 1998 while working in Lawrence Berkely Laboratory Network Research group. Let’s see how to perform packet sniffing with tcpdump. For this tutorial, we will be using Kali Linux as tcpdump is installed by default on it.

The command to start sniffing with tcpdump is given below.

tcpdump

if you are unable to start tcpdump with the above command, run tcpdump as sudo. On many UNIX operating systems, running this command requires SUDO privileges.

sudo tcpdump

As soon as you execute the above command, tcpdump starts sniffing on all the network interfaces connected to the machine. If you want tcpdump to perform sniffing on only a specific interface, you can specify the interface with the ‘-i’ option.

sudo tcpdump -i <network interface>

Depending on the number of devices connected to the interface, the packet analysis output may contain heavy or less traffic. To view traffic belonging to only one machine on the network, you can use the “host” option and specify the IP address. For example, let’s say we want to only see traffic belonging to device with IP 192.160.254.144 on the network. Here’s how to do it.

sudo tcpdump -i <network interface> host <host ip>

Let’s say you want to view traffic only that is originating from a particular device, you can use the option “src” for that.

sudo tcpdump -i <network interface> src <device IP>

Similarly you can also view only the traffic that is coming to the particular system using the “dst” option.

sudo tcpdump -i <network interface> dst <device IP>

We can also view traffic belonging to a specific part using the “port” option.

sudo tcpdump -i <network interface> port <port number>

To write the output to a file, we have to use the “-w” option as shown below.

sudo tcpdump -i <network interface> port <port number> -w <file to write to>

To open the saved pcap file, you have to use the ‘-r’ option as shown below.

sudo tcpdump -r <pcap file>

This pcap file can also be opened with Wireshark.

Posted on September 3, 2024September 3, 2024 by Anamar Taknev

WhatWeb tool: Beginners guide

Hello, aspiring ethical hackers. In one of our previous blogpost, you learnt about what is website hacking, what are the various website hacking techniques used by hackers etc. In this blogpost, you will learn about WhatWeb tool, a web scanner.

WhatWeb tool is a tool that can be used to identify a website. As its makers say, the goal of WhatWeb tool is to answer the question “What is that website?”.

That’s right because WhatWeb can identify a variety of web technologies used on a website that include web servers, Content Management System (CMS), blogging platforms, statistics and analytic packages, JavaScript libraries, embedded devices, version numbers of the software, email addresses, account in web framework modules, SQL errors etc. WhatWeb too has over 1800 plugins, each to recognize something different.

WhatWeb is installed by default in Kali Linux. Let’s see how to use it for scanning the website. As target, we will be using Multillidae in Metasploitable 2. To scan a website, all you have to do is specify the target website or its IP to WhatWeb as shown below.

WhatWeb has different levels of aggression while scanning its targets. By default it is set to 1 (stealthy) and it makes one HTTP request per target. However, we can set the level of aggression while scanning the target. If we set the aggression level to “3 (aggressive)” as shown below, WhatWeb will send additional requests once it finds a level 1 plugin.

Similarly, setting the aggression level to “4 (Heavy)”, WhatWeb makes a lot of HTTP requests per target. In this level, URLs from all plugins are attempted.

At the beginning of the article, I told you that WhatWeb has lot of plugins each suited for a specific purpose. You can view all the plugins of WhatWeb using the “-l” option.

If you want to view the information about each plugin the “–info-plugins” option will do this for you.

You can also search for a particular plugin from the list of plugins using the “–search- plugins” option. For example, let’s search for webdav plugin in WhatWeb.

To use a particular plugin the option is “-p”. For example, let’s use the “webdav” plugin with the same target.

If you want the result to be in more detailed format while scanning with WhatWeb, you can use the verbose option with WhatWeb.

Whatweb also has a quiet mode scan option that scans a website without showing output to terminal (stdout) as shown below.

Posted on August 20, 2024August 20, 2024 by Anamar Taknev

Complete guide to MAC changer tool

Hello, aspiring ethical hackers. In this blogpost, you will learn about a tool named MAC changer. In your ethical hacking journey there may be one day a need arise to change your MAC addresses. Although you can change your MAC addresses manually, mac changer is a tool that helps you to change it automatically. In our previous data link layer attacks, you learnt that communication in a LAN takes place with MAC addresses.

In our previous article on Data-link layer attacks, you have learnt what is a MAC address and its uses. Now, let’s see how to change your MAC addresses using MAC changer tool. To be able to change your MAC address first, you need to know your present MAC address. You can find out the MAC address of your machine using the command shown below.

ip a

You can see the current version of mac changes installed using the ‘-V’ option as show below.

You can see that each network adapter (NIC) attached to the system has one unique MAC address. You can also see your the MAC address of your device using MAC changer with the “-s” option.

macchanger -s <network interface>

If you want to see all the vendors that provide MAC addresses, using mac changer, the option is ‘-l’ as shown below.

macchanger -l

Before changing the MAC address of a adapter, make sure you disable that adapter using command as shown below.

sudo ip link set eth0 down

After making changes, you can enable the adapter using command shown below.

sudo ip link set eth0 up

Now, let’s see the different ways in which MAC addresses can be changed using mac changer. To give a random MAC address to a particular network adapter, say to the “eth0” adapter, the option we need to use is “-r”.

macchanger -r <interface>

To assign a random vendor MAC address of the same kind with mac changer, the option to use is “a”.

macchanger -a <interface>

To give a random MAC address of any kind, we can use the “-A” option.

macchanger -A <interface>

Every vendor has a unique MAC address that starts with unique vendor bytes. Using this tool, you can also change the MAC address without changing the vendor bytes using the “-e” option.

macchanger -e <interface>

You already know that MAC address is hardcoded to a hardware NIC card. Using this tool, you can also make your changed MAC addresses pretend as the burned in address of the NIC.

macchanger -b -r <interface>

That’s all about mac changer tool.

Posted on August 13, 2024August 13, 2024 by Anamar Taknev

Beginners guide to ffuf tool

Hello, aspiring ethical hackers. In one of our previous blogposts on website footprinting, you learnt that web directory scanning and fuzzing are some of the techniques used to gather information about a website. In this blogpost, you will learn about a tool named ffuf, which is a fuzzing tool known for its speed.

Written in Go language, it is considered a very fast web fuzzer available on the market. It can be used for web content discovery (director scanning), virtual host discovery, parameter fuzzing, POST data fuzzing, configuration file check etc.

In this blogpost, let’s see how to use ffuf for fuzzing. It is installed by default on Kali and we are going to use the same. Metasploitable 2 is our target as always. See how to create a virtual hacking lab with Kali and Metasploitable 2.

Just like any other directory scanner out there, you need to specify an URL and a wordlist for fuzzing with ffuf. However, unlike other directory scanners, you need to use a word FUZZ while using this tool as shown below.

Here, we are fuzzing Mutillidae installed by default on Metasploitable 2. Here’s the result of the scan.

Colorize output(-c)

It found some interesting directories. However, the output is monotonous. With ffuf however, you can colorize the output using the “-c” option.

Here’s the result.

Silent mode (-s)

If you don’t like this output or want this tool to display output without printing any additional information, you can do it with the “-s” option.

Changing HTTP method (-X)

By default, Ffuf uses HTTP GET method. We can change this using the option (-X). For example, let’s change it to use POST parameter as shown below.

Follow redirected URL’s (-r)

Many websites have URLs redirected to other URLs. By using this option, you can ask it to follow the redirected URL if it finds a redirection.

Ffuf has many filters available. Using this option, we can specify ffuf to automatically calibrate those filter options.

Delay (-D)

What is a fuzzer without the option for adding delay between requests. Ffuf too has this option to add delay between each request. For example, let’s add 3 seconds delay between each request.

Stop ffuf on getting error (-se)

If Ffuf faces an error while fuzzing, it continues scanning. By setting this option, you can ask ffuf to stop when it faces any spurious error.

Search for files with specified extension (-e)

This option is used to search for files with specified extensions.

Save output (-o)

Finally if you want to save output of ffuf to a file, this is the option to use.

Posted on August 7, 2024August 2, 2024 by Anamar Taknev

Beginners guide to theHarvester tool

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about OSINT. In this blogpost, you will learn about a tool called theharvester that is used to gather open source intelligence (OSINT) on a company or domain.

Using theHavester tool, we can gather information like subdomain names, email addresses, virtual hosts, open ports, banners and employee names of an organization from different public sources like search engines, pgp key servers, IP addresses and URLs.

theHarvester is installed by default on almost all pen testing distros. For this tutorial, we will be using Kali Linux. theHarvester is very simple to use but very powerful during footprinting stage of a red team assessment or a penetration test. It can take a domain or an organization as target as shown below.

theHarvester can list a lot of entries as part of performing OSINT. You can specify the limit to the number of entries you want to be displayed.

You can even start querying from particular entry form list of entries displayed. For example, you want to start querying from the 10th entry.

–shodan

theHarvester also has a option called “–shodan” that queries the Shodan search engine for any open ports or banners from discovered hosts. However, this requires api keys.

–screenshot

This command allows theHarvester to take screenshots of subdomains that are found.

–dns-brute

As the command explains, you can brute force DNS servers using this option.

–source

theHarvester uses many public sources to collect information. Some of them are anubis, baidu, bing, brave, censys, etc. We can even ask it to use a specific source using the “–source” command.

Learn how to perform OSINT using amass or Maltego or Spiderfoot.

Author: Anamar Taknev