kanishka10, Author at Hackercool Magazine

Posted on July 18, 2024July 18, 2024 by kanishka10

Beginners guide to Shodan

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about footprinting or information gathering and the various methods of reconnaissance. In another blogpost, you learnt what is OSINT. In this blogpost, you will learn about a resource that falls into the above categories. Its named Shodan, I prefer to call it the hackers search engine

What is Shodan?

You know about Google search engine and its power. It allows you search for images, videos, news etc. what if there was a search engine to search for various types of devices connected to the internet. These devices can be webcams, routers and different servers like web server, FTP server, Telnet, SSH, SNMP, IMAP, SMTP etc. In fact, everything connected to internet. Well, the answer is Shodan.

Let’s learn more about it. Go to the official website of it here and in the search field, search for Apache.

It will start displaying all the Apache servers connected to internet as shown below.

But as you try to go to the next page to see more entries, you should see the below error.

You can search for anything you want but the results are limited if you are not registered. You can create an account on Shodan by going to the Register page. Registration is free and after you confirm your registration from your email, you are ready to use the power of this awesome search engine.

You can login into your Shodan account and search for whatever you want.

Let’s search for SSH servers running on ports 22 and 3333.

Sometimes, administrators just change the operating port of a server to prevent hacking attacks. We can even search for them. For example, let’s search for SSH servers running on ports other than 22 and 3333.

Let’s search for Redis servers.

In fact, you can search for anything connected to the internet using Shodan. Seeing the use of this tool for pen testers, the makers of Kali Linux have included Shodan-cli, a command line version in their repository.

Before using the command line version of Shodan, you need to add the API key of Shodan. It can be added as shown below.

This key can be seen in the Account section of Shodan. Once the API key is entered, you can use Shodan-cli. This API key can also be used with tools like SpiderFoot used for OSINT. Note that the features are dependent on the types of account you have at Shodan. Free account has limited features. Let’s see how many open SSH and Filezilla servers are exposed to the internet.

After seeing all this, you may wonder how Shodan works or is it legal to use it. Shodan works by using a technique called banner grabbing. It captures banners of all the devices connected to the internet and then stores them in its database. Although it is legal to use Shodan for querying, it is not to do anything on the exposed servers without their permission. It is used by pen testers to see what devices are exposed and what information they are leaking to the internet.

Posted on July 16, 2024July 16, 2024 by kanishka10

John password cracker: Beginners guide

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt about password cracking and different types of password cracking techniques. In this blogpost, you will learn about a password cracking tool called John password cracker. Originally, called John the Ripper, John password cracker is a cross-platform software and a very popular password cracker.

In one of our previous blogposts, you learnt in detail about encryption. Hashing is a method of encryption in which a plain string of text is converted into an encrypted hash. This is a one-way function and hashes cannot easily be converted back to plain string. This technique is often used for storing passwords.

Being one of the most popular password hash cracking tools, John is installed by default in Kali Linux and I will be using the same for this tutorial. To demonstrate the power of John, first we need to create a hash. This can be done using online services like md5encrypt. I copy the generated MD5 hash to a text file named hash.txt as shown below.

Then all we have to do is submit this file to John as shown below.

Then John begins to crack the hash in the file. In most of the real-world cases, this will consume lot of time. So, it is good to specify the format of the hash using the ‘–format’ option as shown below. The format of the hash can be identified using hash identification.

As you can see in the above image, John successfully cracked the password hash. Let’s add a SHA-1 hash now to the same file and try cracking it.

The list of all the hash formats John can crack are many. John can crack a number of password hashes at once. However, they should all be of same format. Let’s add another MD5 hash to the hash.txt file.

Once a hash is cracked by John, it can be viewed using the ‘–show’ option. For example, all the hashes in file “hash.txt” can be viewed as shown below.

Single mode

As already mentioned at the beginning of this article, John can use different techniques to crack password hashes. One of them is single mode. People in some cases use the username as a password (or a variation of username as password). Single mode is mostly useful in these cases. When single mode is specified, it tries all the variations of the username to crack the hash. Let’s try it out. I add a password hash along with the username to the file hash.txt.

Then, specifying single mode does this.

Wordlist mode or Dictionary mode

John can also use dictionary mode to crack the hash. I add a new hash to the file hash.txt.

Then all we need to do is specify a wordlist as shown below.

Incremental mode

If all those options fail, John still has incremental mode in which the combination of all the techniques are used. But this may take lot of time and resources.

But password cracking is all about patience. Learn how to crack hashes with hashcat.

Posted on July 15, 2024 by kanishka10

Beginners guide to SpiderFoot

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about what is OSINT, types of OSINT etc. In this blogpost, you will learn about a tool named SpiderFoot. SpiderFoot is an open-source intelligence (OSINT) automation tool.

Spiderfoot is a python script and can be run on any machine with Python installed. Using spiderfoot, we can gather information from almost any open source data source available. For this tutorial, we will be using Kali Linux as spiderfoot is installed by default on it. Spiderfoot has an embedded web server and hence has a web-based interface.

To start spiderfoot on Kali, all you have to do is use the “-l” option and then specify a IP address and port on which you want the web server to listen on. The “-l” option stands for listen. Here we have configured spiderfoot to listen on the port 5500 of localhost.

Now, browse to the above highlighted URL using your favorite browser. You should see this.

Since we have not yet performed any scans yet. There is no scan history. To start a new scan, click on “New scan”.

Spiderfoot can gather information from domain name, IPV4 or IPV6 address, host names, sub-domains, subnet, Bitcoin address, E-mail address, phone number, human names, usernames and networks. Let’s start our search with a domain name first.

After entering the name of the scan and the scan target scroll down a bit.

There are various ways you can search with for any target using SpiderFoot. You can also search based on what you require about the target.

You can also search based on required module (more about modules later).

I select “All” and click on “Run scan now”. The scan starts and may look empty at the beginning.

As the scan progresses, your screen will be filled with bars as shown below.

While the scan is still running, you can view the findings of the scan by going to the “Browse” tab as shown below.

You can view each of the entries to find out what spiderfoot has detected.

For example, in this case, the target website is hosted in USA. Now, let’s search for a “Name” say “kalyan”. The good thing about spiderfoot is that it will automatically detect the type of target based on format of your input.

Here’s the result.

You can see all the scans you performed in the “scans” section.

Another important tab here is the “settings” tab. It consists of settings for this tool. But just not that. Remember, I told you at the beginning of this article that Spiderfoot can collect information from almost all data sources. These data sources are listed here to the left in settings section.

Almost all sources are free, but some need APIs belonging to that particular service (Did you see the lock sign next to some services?).

Posted on July 14, 2024July 15, 2024 by kanishka10

Beginners guide to Wireshark

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail what is packet sniffing, types of sniffing, what are sniffers and types of sniffers? In this article, you will learn about Wireshark, the most popular sniffer used in cybersecurity.

What is Wireshark?

Wireshark is an open-source network packet analyzer that is used for network trouble shooting, network analysis etc. It runs on Linux, macOS, BSD, Solaris and even on Windows. It is installed by default in pen testing distros like Kali Linux and we are going to use the same for this tutorial. On Kali Linux, Wireshark sniffer can be started using the command “wireshark” in the terminal as shown below.

This will open the Wireshark GUI window as shown below.

In the newly opened Wireshark windows, all the network adapters attached to the system (in our case, virtual machine) on which Wireshark is running has are displayed. Select the network interface on which you want to capture packets (ours is eth0) and click on “Start capturing packets”.

Wireshark will start capturing live packets of the network. Here, it is time to learn about the interface of Wireshark. The interface of Wireshark can be divided into 5 primary parts. They are,

1. Menu bar: Common to all GUI applications and doesn’t need explanation.

2. The Main toolbar: The main toolbar consists of items for the operation of Wireshark. For example, like starting capture, stopping capture, restarting capture, saving capture to a file etc.

3. The Filter toolbar: The Filter toolbar is used to apply display filters for the captured packets. More about it later.

4. The “Packet List” name: This pane displays all the packets captured by Wireshark. These are separated by each line. By default, the “packet list” name consist of seven columns. They are,

Number: The number of the packet in the capture file.
Time: Time of capture of the packet.
Source: The source from where the packet originated.
Destination: The destination address where the packet went.
Protocol: The protocol information about the captured packet: ex: ARP, ICMP etc.
Length: Length of the captured packet.
Information: Additional information about the packet.

5. The “Packet details’ pane: This pane shows the current packet in a more detailed form.

6. The “Packet Bytes” pane: This name shows all the details of the selected packet in style.

By now, you are accustomed to the interface of Wireshark. Let’s move forward. In the “packet list” pane, you can see all the packets. You can select each packet to see information about it. You can right click on each packet, to open a new menu too. For example, you can follow TCP stream of each packets. Well, there is a packet belonging to Telnet protocol going from 192.168.40.169 IP to 192.168.40.162. Following its TCP stream can be interesting. But you will learn about this in password sniffing.

The important concept beginners should learn about Wireshark is the Wireshark filters. If you see the Wireshark packet capture, it will be overwhelming if not confusing. Wireshark filters allow us to bring some clarity to the captured traffic. Filters can be applied to Wireshark from the “Filter” toolbar. Wireshark has some mostly used filters which can be viewed as shown below.

Let’s learn about some common filters useful to beginners. In the filter column, add this filter.

ip.addr==192.168.40.168

ip.addr==192.168.40.168

The default syntax of Wireshark filter is “ip.addr = = value”. For example, if you want to view the traffic of a particular IP address, this filter is used. Let’s say we want to view traffic of only the system whose IP address is “192.168.40.168”.

Let’s make it better. You want to view all the traffic originating from IP address 192.168.40.168 then the below filter will help.

ip.src == 192.168.40.169

Similarly, we can use “ip.dst = = 192.168.40.169” filter to see all the packets coming to machine with IP address 192.168.40.169. We can also combine two filters using ampersand (&&). For example, you want to view the packets originating from IP 192.168.49.169 and coming to IP 192.168.40. 168.using the filter below.

ip.src==192.168.40.169 &amp;&amp; ip.dst==192.168.40.168

You can view even traffic belonging to a specific port in the entire network. For example, let’s view the traffic belonging to TCP port 21. “tcp.port == 21“ using filter as shown below.

tcp.port==21

Those are some helpful filters for beginners. At any time, you can stop the capture from the “stop capture” option of Wireshark as shown below.

You can also save the captured packets in a file. By default, Wireshark saves the captured data in the pcap format.

Ignore the warnings (-w)

By default, while scanning, it avoids going into any directories that are listable. This makes common sense too. It displays the message saying “directories are testable”. If you want it to scan inside such directories, you can use this option (-w).

We can once again open this pcap file using Wireshark again for analysis later. Learn how to use ettercap.

Posted on July 11, 2024July 11, 2024 by kanishka10

Beginners guide to dirb tool

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about website footprinting. In this blogpost, you will learn in detail about dirb tool, a tool often used in website footprinting. DIRB is an open-source web content or directory scanner. It is used to scan for web objects.

DIRB achieves this by using a pre-configured wordlist to perform a dictionary attack on the web server specified as target. The default usage of DIRB is given below.

Here is its output.

Ignore the warnings (-w)

Use case-insensitive search (-i)

Usually, DIRB scans uses case-sensitive searches. Setting this option allows to perform case-insensitive searches.

Saving the output (-o)

You can save the output of this tool to a file using the “-o” option.

Scan using a proxy (-p)

For all its awesome features, it produces a lot of noise which can raise suspicions on the target side. To beat this a bit, DIRB provides a option to use a proxy to perform directory busting.

Don’t perform recursive searches (-r)

Setting this option will stop dirb from performing recursive scan of the directories.

Interactive recursion (-R)

Similarly, this option is used to set Interactive Recursion while scanning.

Show pages that don’t exist (-v)

By default, DIRB scans the web server and shows only pages or directories that are found on it. Setting this option will make it show non-existent objects also.

Search for files with a specific extension (-X)

You can use this option if you want to search for files with a particular extension. For example, to search for text files (.txt) extension, we can use dirb as shown below.

You can also search for multiple file extensions using dirb. Just add all the file extensions you want to search for in a text file and use the (-x) option as shown below. For example, to search for all file extensions specified in a file named “ext_text”.

Author: kanishka10