Uncategorized Archives - Page 4 of 13

Posted on October 3, 2024October 3, 2024 by Anamar Taknev

Beginners guide to Ettercap

Hello, aspiring ethical hackers. In our previous blogposts, you learnt what is sniffing and what is Man in the Middle (MITM) attacks etc. In this blogpost, you will learn about a tool named Ettercap. Ettercap is an open-source sniffer and a comprehensive suite for performing man in the middle attacks. With Ettercap we can perform both active and passive protocol analysis, data injection etc.

Let’s see how to use Ettercap for sniffing. For this tutorial, I will be using Kali Linux as my attacker system as ettercap is installed by default on it. As a target system, I am using Metasploitable 2 (see how to create a virtual hacking lab). Ettercap can be started in both command line and GUI. For this tutorial, let’s use the graphical version.

To start ettercap in graphical mode, start ettercap with the “-G” option as shown below.

sudo ettercap -G

The GUI version of Ettercap opens as shown below.

You can also open a network capture file (pcap file) using Ettercap. To start sniffing with ettercap, we have to click on the highlighted part as shown below after selecting the interface we want to sniff on.

As soon as you do this, Ettercap loads all its plugins and engines required for sniffing. By default, ettercap starts sniffing automatically. It can be stopped or started by clicking on the highlighted part as shown below.

Before you perform any attack, you need to know about all the devices on the LAN. Clicking on the tab highlighted in the image below makes this tool scan for all the LIVE hosts on the network.

After the scan is finished, ettercap adds the detected hosts.

The added hosts can be viewed by clicking of the tab highlighted below.

In our case five hosts have been added. I want to sniff the communication taking place between two machines. To do this, I right click on the IP of the client machine with IP 192.168.249.162 and add it as Target 2.

Similarly, I add the server machine with IP 192.168.249.149 as Target 1.

Needless to say, these two machines are the machines I want to perform sniffing on.

Then, I open the MiTM menu of this tool and select ARP poisoning as shown below.

This opens a new window as shown below.

I select “sniff remote connections” option and click on “OK”. This starts the ARP poisoning attack and all the traffic intending to go for 192.168.249.162 (client machine) to192.168.249.149 (server machine) will be sniffed. From the client machine, I make a telnet connection to target system.

Then on ettercap, I open the menu and go to view > connections.

This will show all the connections being made between client and the server.

In the above image, we can see one connection from IP 192.168.244.162 to port 23 of 192.168.249.149. Clicking on it will reveal the connection data exchanged between the two machines.

By default, the data from the client and server machines are shown in different tabs. You can see the credentials being exchanged between client and server. You can even join both the views for clarity.

Here, you can see the clear text credentials used to login into the telnet server.

Posted on September 28, 2024September 28, 2024 by Anamar Taknev

Beginners guide to tcpdump

Hello, aspiring ethical hackers. In our previous blogpost, you learnt in detail about packet sniffing and packet analyzing. A sniffer or a packet analyzer plays a very important role in packet sniffing. In this blogpost, you will learn about a sniffer or packet analyzing tool called tcpdump.

tcpdump is an open-source data-network packet analyzer that runs under a command line interface. It works on almost all Unix-type operating systems like Linux, Solaris, FreeBSD, macOS etc. Tcpdump was written by Van Jacobson, Sally Floyd, Van Paxson and Steven McCanne in 1998 while working in Lawrence Berkely Laboratory Network Research group. Let’s see how to perform packet sniffing with tcpdump. For this tutorial, we will be using Kali Linux as tcpdump is installed by default on it.

The command to start sniffing with tcpdump is given below.

tcpdump

if you are unable to start tcpdump with the above command, run tcpdump as sudo. On many UNIX operating systems, running this command requires SUDO privileges.

sudo tcpdump

As soon as you execute the above command, tcpdump starts sniffing on all the network interfaces connected to the machine. If you want tcpdump to perform sniffing on only a specific interface, you can specify the interface with the ‘-i’ option.

sudo tcpdump -i <network interface>

Depending on the number of devices connected to the interface, the packet analysis output may contain heavy or less traffic. To view traffic belonging to only one machine on the network, you can use the “host” option and specify the IP address. For example, let’s say we want to only see traffic belonging to device with IP 192.160.254.144 on the network. Here’s how to do it.

sudo tcpdump -i <network interface> host <host ip>

Let’s say you want to view traffic only that is originating from a particular device, you can use the option “src” for that.

sudo tcpdump -i <network interface> src <device IP>

Similarly you can also view only the traffic that is coming to the particular system using the “dst” option.

sudo tcpdump -i <network interface> dst <device IP>

We can also view traffic belonging to a specific part using the “port” option.

sudo tcpdump -i <network interface> port <port number>

To write the output to a file, we have to use the “-w” option as shown below.

sudo tcpdump -i <network interface> port <port number> -w <file to write to>

To open the saved pcap file, you have to use the ‘-r’ option as shown below.

sudo tcpdump -r <pcap file>

This pcap file can also be opened with Wireshark.

Posted on August 20, 2024August 20, 2024 by Anamar Taknev

Complete guide to MAC changer tool

Hello, aspiring ethical hackers. In this blogpost, you will learn about a tool named MAC changer. In your ethical hacking journey there may be one day a need arise to change your MAC addresses. Although you can change your MAC addresses manually, mac changer is a tool that helps you to change it automatically. In our previous data link layer attacks, you learnt that communication in a LAN takes place with MAC addresses.

In our previous article on Data-link layer attacks, you have learnt what is a MAC address and its uses. Now, let’s see how to change your MAC addresses using MAC changer tool. To be able to change your MAC address first, you need to know your present MAC address. You can find out the MAC address of your machine using the command shown below.

ip a

You can see the current version of mac changes installed using the ‘-V’ option as show below.

You can see that each network adapter (NIC) attached to the system has one unique MAC address. You can also see your the MAC address of your device using MAC changer with the “-s” option.

macchanger -s <network interface>

If you want to see all the vendors that provide MAC addresses, using mac changer, the option is ‘-l’ as shown below.

macchanger -l

Before changing the MAC address of a adapter, make sure you disable that adapter using command as shown below.

sudo ip link set eth0 down

After making changes, you can enable the adapter using command shown below.

sudo ip link set eth0 up

Now, let’s see the different ways in which MAC addresses can be changed using mac changer. To give a random MAC address to a particular network adapter, say to the “eth0” adapter, the option we need to use is “-r”.

macchanger -r <interface>

To assign a random vendor MAC address of the same kind with mac changer, the option to use is “a”.

macchanger -a <interface>

To give a random MAC address of any kind, we can use the “-A” option.

macchanger -A <interface>

Every vendor has a unique MAC address that starts with unique vendor bytes. Using this tool, you can also change the MAC address without changing the vendor bytes using the “-e” option.

macchanger -e <interface>

You already know that MAC address is hardcoded to a hardware NIC card. Using this tool, you can also make your changed MAC addresses pretend as the burned in address of the NIC.

macchanger -b -r <interface>

That’s all about mac changer tool.

Posted on August 13, 2024August 13, 2024 by Anamar Taknev

Beginners guide to ffuf tool

Hello, aspiring ethical hackers. In one of our previous blogposts on website footprinting, you learnt that web directory scanning and fuzzing are some of the techniques used to gather information about a website. In this blogpost, you will learn about a tool named ffuf, which is a fuzzing tool known for its speed.

Written in Go language, it is considered a very fast web fuzzer available on the market. It can be used for web content discovery (director scanning), virtual host discovery, parameter fuzzing, POST data fuzzing, configuration file check etc.

In this blogpost, let’s see how to use ffuf for fuzzing. It is installed by default on Kali and we are going to use the same. Metasploitable 2 is our target as always. See how to create a virtual hacking lab with Kali and Metasploitable 2.

Just like any other directory scanner out there, you need to specify an URL and a wordlist for fuzzing with ffuf. However, unlike other directory scanners, you need to use a word FUZZ while using this tool as shown below.

Here, we are fuzzing Mutillidae installed by default on Metasploitable 2. Here’s the result of the scan.

Colorize output(-c)

It found some interesting directories. However, the output is monotonous. With ffuf however, you can colorize the output using the “-c” option.

Here’s the result.

Silent mode (-s)

If you don’t like this output or want this tool to display output without printing any additional information, you can do it with the “-s” option.

Changing HTTP method (-X)

By default, Ffuf uses HTTP GET method. We can change this using the option (-X). For example, let’s change it to use POST parameter as shown below.

Follow redirected URL’s (-r)

Many websites have URLs redirected to other URLs. By using this option, you can ask it to follow the redirected URL if it finds a redirection.

Ffuf has many filters available. Using this option, we can specify ffuf to automatically calibrate those filter options.

Delay (-D)

What is a fuzzer without the option for adding delay between requests. Ffuf too has this option to add delay between each request. For example, let’s add 3 seconds delay between each request.

Stop ffuf on getting error (-se)

If Ffuf faces an error while fuzzing, it continues scanning. By setting this option, you can ask ffuf to stop when it faces any spurious error.

Search for files with specified extension (-e)

This option is used to search for files with specified extensions.

Save output (-o)

Finally if you want to save output of ffuf to a file, this is the option to use.

Posted on August 10, 2024August 9, 2024 by kanishka10

BeEF Browser exploitation tool: Beginners guide

Hello, aspiring ethical hackers. In our previous blogposts, you learnt about Windows hacking techniques, Linux hacking techniques etc. In this blogpost, you will learn about BeEF tool that focuses on exploiting a software or program extensively used in both Linux and Windows operating systems. We are talking about web browser. BeEF is short for “The Browser Exploitation Framework”. It is a penetration testing tool focusing on the web browser.

In the noise of ever increasing cases of web server hacking and web application hacking, one that is often ignored is the exploitation of web clients, aka browser. Browsers once compromised, provide a easy way of gaining access to hackers. No doubt, attacks targeting web clients are on the rise. BeEF helps pen testers to understand the security posture of web browsers in an organization.

Let’s see how to use it. BeEF is present in the repositories of Kali Linux. We will be using the same for this tutorial. It can be installed on Kali as shown below.

After BeEF is successfully installed, don’t forget to run it with root privileges. Otherwise, it will not start.

After running for the first time, BeEF will ask you to setup a new password. Set it. Once you set it, it will start a web interface by default. Before that, it will display a hook as shown below.

Before you use BeEF further, you need to understand two terms related to it. They are,

Hook: A hook is something used to trap a browser.
Zombie: A trapped browser is known as a Zombie.

Once the web interface of BeEF opens, login with username “beef” and the password you set earlier.

Once you login, you will be greeted with the dashboard of BeEF. The interface can be divided into two parts. On the left, you will see hooked browsers section. All those browsers that are compromised by BeEF are shown here. On the right, you can see the general interface of BeEF.

It has three tabs. The “Logs” tab show all the activity happening with BeEF.

The “Zombies” tab, as you expected will display all the compromised browsers.

BeEF also has “Getting started” tab. Now, let’s see how to hook a browser. Browsers can be hooked by using the hooks shown at the beginning. You have to somehow make users click on this hook script. Of course, this requires social engineering.

For demonstration purpose, BeEF has two demo pages that work as hooks. One is basic and advanced. They can be found in “Getting Started” tab as highlighted in the above image. Here is the basic demo page and advanced demo page.

All we have to do is copy the links of the pages and make target users click on these links. As soon as they do it, the browser gets hooked as shown below.

When you click on the IP, the “current browser” tab opens, displaying general information about the target OS on which that browser is installed.

The “Current browser” tab opens a few sub-tabs of itself. You have seen about the “details” tab above. The “Logs” sub-tab shows all the logs belonging to the current browser.

The most powerful part of BeEF in its command section.

This section includes all the commands that can be executed on the target system.

For example, let’s execute a command “Detect Antivirus” as shown below. This command as its name suggests tries to detect if Antivirus is installed on target system or not. We can execute this module by clicking on “Execute” as shown below.

To see the result of the executed command, click on the command in history. It will display the result in command results window to the right.

In our case, it’s true that Antivirus is not installed on the target system. If you click on the “Zombies” tab you have learnt above earlier, your hooked browser can be seen, as shown below.

Category: Uncategorized

Beginners guide to Ettercap

Beginners guide to tcpdump

Complete guide to MAC changer tool

Beginners guide to ffuf tool

BeEF Browser exploitation tool: Beginners guide

Categories