Posted on by

Beginners guide to tcpdump

Hello, aspiring ethical hackers. In our previous blogpost, you learnt in detail about packet sniffing and packet analyzing. A sniffer or a packet analyzer plays a very important role in packet sniffing. In this blogpost, you will learn about a sniffer or packet analyzing tool called tcpdump.

tcpdump is an open-source data-network packet analyzer that runs under a command line interface. It works on almost all Unix-type operating systems like Linux, Solaris, FreeBSD, macOS etc. Tcpdump was written by Van Jacobson, Sally Floyd, Van Paxson and Steven McCanne in 1998 while working in Lawrence Berkely Laboratory Network Research group. Let’s see how to perform packet sniffing with tcpdump. For this tutorial, we will be using Kali Linux as tcpdump is installed by default on it.

The command to start sniffing with tcpdump is given below.

tcpdump

if you are unable to start tcpdump with the above command, run tcpdump as sudo. On many UNIX operating systems, running this command requires SUDO privileges.

sudo tcpdump

As soon as you execute the above command, tcpdump starts sniffing on all the network interfaces connected to the machine. If you want tcpdump to perform sniffing on only a specific interface, you can specify the interface with the ‘-i’ option.

sudo tcpdump -i <network interface>

Depending on the number of devices connected to the interface, the packet analysis output may contain heavy or less traffic. To view traffic belonging to only one machine on the network, you can use the “host” option and specify the IP address. For example, let’s say we want to only see traffic belonging to device with IP 192.160.254.144 on the network. Here’s how to do it.

sudo tcpdump -i <network interface> host <host ip>

Let’s say you want to view traffic only that is originating from a particular device, you can use the option “src” for that.

sudo tcpdump -i <network interface> src <device IP>

Similarly you can also view only the traffic that is coming to the particular system using the “dst” option.

sudo tcpdump -i <network interface> dst <device IP>

We can also view traffic belonging to a specific part using the “port” option.

sudo tcpdump -i <network interface> port <port number>

To write the output to a file, we have to use the “-w” option as shown below.

sudo tcpdump -i <network interface> port <port number> -w <file to write to>

To open the saved pcap file, you have to use the ‘-r’ option as shown below.

sudo tcpdump -r <pcap file>

This pcap file can also be opened with Wireshark.

Posted on by

WhatWeb tool: Beginners guide

Hello, aspiring ethical hackers. In one of our previous blogpost, you learnt about what is website hacking, what are the various website hacking techniques used by hackers etc. In this blogpost, you will learn about WhatWeb tool, a web scanner.

WhatWeb tool is a tool that can be used to identify a website. As its makers say, the goal of WhatWeb tool is to answer the question “What is that website?”.

That’s right because WhatWeb can identify a variety of web technologies used on a website that include web servers, Content Management System (CMS), blogging platforms, statistics and analytic packages, JavaScript libraries, embedded devices, version numbers of the software, email addresses, account in web framework modules, SQL errors etc. WhatWeb too has over 1800 plugins, each to recognize something different.

WhatWeb is installed by default in Kali Linux. Let’s see how to use it for scanning the website. As target, we will be using Multillidae in Metasploitable 2. To scan a website, all you have to do is specify the target website or its IP to WhatWeb as shown below.

WhatWeb has different levels of aggression while scanning its targets. By default it is set to 1 (stealthy) and it makes one HTTP request per target. However, we can set the level of aggression while scanning the target. If we set the aggression level to “3 (aggressive)” as shown below, WhatWeb will send additional requests once it finds a level 1 plugin.

Similarly, setting the aggression level to “4 (Heavy)”, WhatWeb makes a lot of HTTP requests per target. In this level, URLs from all plugins are attempted.

At the beginning of the article, I told you that WhatWeb has lot of plugins each suited for a specific purpose. You can view all the plugins of WhatWeb using the “-l” option.

If you want to view the information about each plugin the “–info-plugins” option will do this for you.

You can also search for a particular plugin from the list of plugins using the “–search- plugins” option. For example, let’s search for webdav plugin in WhatWeb.

To use a particular plugin the option is “-p”. For example, let’s use the “webdav” plugin with the same target.

If you want the result to be in more detailed format while scanning with WhatWeb, you can use the verbose option with WhatWeb.

Whatweb also has a quiet mode scan option that scans a website without showing output to terminal (stdout) as shown below.

Posted on by

Beginners guide to dirbuster

Hello, aspiring ethical hackers. In this blogpost, you will learn about dirbuster, a tool used to scan web directories and file names on web application servers. Dirbuster is written in Java and can be installed on Linux systems. Almost all pentesting distros include this in their tools list. For this tutorial, we are going to use Kali Linux. Dirbuster can be started on Kali by using the command as shown below.

dirbuster

Typing this command will open a GUI window as shown below.

Here, you can configure all the options required to scan the target web server. For this tutorial, we will be using Metasploitable 2 as our target. Any directory scanning and fuzzing tool is as good as the wordlist it uses while scanning for hidden directories and files. Dirbuster provides its own set of wordlists which are located in “usr/share/dirbuster/wordlists” directory in Kali.

Unlike other wordlists, these wordlists are created using a different approach. These lists are created from scratch by crawling the internet and making a collection of the all the files used by all developers. It comes with a total of 9 different lists. If all these lists fail, dirbuster also has brute force option.

The scan starts. Depending on the size of the target web server, finishing time may vary. The progress of the scan will be displayed in the “scan information” tab.

As the scan continues, you can see the results in different views. The “List view” shows all the detected directories and files by dirbuster in the form of a list.

You can also see the results of the scan in the form of “Tree view” that enables us to gain understanding about the target web server directories structure.

You can right click on the detected directories for more options as shown below.

If dirbuster faces any errors while scanning directories, they are displayed in the “errors” tab.

You can wait until the scan finishes or you can even end the scan by hitting “stop” button. Once you do that, dirbuster will prompt you to save the result of the scan as shown below.

You can also use dirbuster by specifying its options through command line. The basic options to set are the URL and the wordlist. These can be set with ‘-U’ and ‘-r’ options respectively.

Then, all you have to do is click on “Start”. If you want to find files with a particular extension with dirbuster the option is ‘-e’. For example, let’s say you want it scan for files with “php” extension here is the command,

To save the output of dirbuster scan, use command line option ‘-r’.

Headless mode (-H)

You can run dirbuster in headless mode without GUI option as shown below.

Posted on by

Aircrack-ng: Complete guide to beginners

Hello, aspiring ethical hackers. In our previous blogpost, you learnt what is Wifi hacking and different techniques to hack wireless networks. In most of these hacking techniques, a tool named aircrack plays a very important role.

In this blogpost, you will learn about this tool. Aircrack-ng or aircrack ng is a complete suite of tools used to test wi-fi network security. The various functions of aircrack include,

  1. Monitoring: It can be used to capture wireless packets and save data in text file which can be processes by third party tools.
  2. Attacking: We can use it too perform various wireless attack like Replay attacks, DE authentication access points and other attacks.
  3. Testing: Checking Wi-Fi cards and capability of the drivers. (capture and injection)
  4. Cracking: For cracking WEF and WPA PSK (WPA 1 and WPA 1) passwords.

Just now, we have learnt that aircrack-ng is a combination of tools. Let’s understand what those tools are and what are they used for.

1. airbase-ng:

It is a multi purpose tool that can be used to attack the Wi Fi client instead of the Wi Fi access point.

2. airdecap-ng:

With this tool, you can decrypt WEP/WPA/WPA2 capture files. It is also used to remove the wireless headers from an unencrypted wireless capture.

3. aircrack-ng:

It is key cracking program.

4. airdecloak-ng:

Some wireless Intrusion Prevention System (WIPS) prevent WEP from being cracked by using fake WEP frames. This tool removes the WEP cloaking frame a captured pcap file.

5. airdrop-ng:

airdrop-ng is a program used to de authenticate users from access points. It uses rule based de authentication techniques that can be MAC address, type of hardware, etc.

4. aireplay-ng:

This tool is used to inject frames. It is used to generate traffic which can be used later by aircrack-ng for WEP and WPA-PSK key cracking.

5. airmon-ng:

It is used to enable monitor mode on wireless interfaces.

6. airodump-ng:

This tool is used to capture raw 802.11 packets. It is used particularly for collecting WEP IVS or WPA handshakes to crack later with aircrack.

7. airolib-ng:

This is a tool designed to store and manage ESSID and password lists. calculate their Pairwise Master Keys (PMK’s) and use them in WPA/WPA2 cracking.

8. airtun-ng:

This tool creates a virtual tunnel interface. It has two basic functions. They are, allowing all encrypted traffic to be monitored for wireless interface detection system (WIDS) and injecting arbitrary traffic into a network.

9. Besside-ng:

It is used to automatically crack WEP and WPA networks . See how to automatically crack WEP and WPA networks with Besside. Learn more about it .

10. dcrack-ng:

dcrack is used to distribute WPA2 / PSK cracking process across multiple servers.

11. easside-ng:

This tool is a magic tool that allows you to communicate with a WEP access point without knowing its WEP key.

12. packetforge-ng:

This tool is used to create encrypted packets to be used for packet injection. Using this tool, we can create various types of packets like ARP requests, UDP, ICMP and custom packets.

13. tkiptun-ng:

This tool is used to inject a few frames into a WPA TKIP network.

14. wesside-ng:

Wesside-ng is another auto-magic tool that uses a variety of techniques to get the WEP key.

    Cracking WEP passwords with aircrack

    Let’s see how to crack WEP passwords with aircrack. All wifi hacking attacks require a wireless adapter that supports packet injection. For this tutorial, I am using ALFA Wireless USB adapter. My attacker machine is Kali Linux which is installed on VMware. So I first connected the ALFA wireless adapter to my laptop and make sure it is connected to the Kali Linux virtual machine. Now, I open a terminal in Kali Linux and type command shown below that shows all the wireless interfaces connected to the machine. 

    iwconfig

    Then I start monitor mode on the wireless interface. Monitor mode is just like promiscuous mode on wired interfaces. When in monitor mode, the wireless adapter sniffs on all the wireless traffic around.

    I once again run the “iwconfig” command to have a look at the wireless interfaces to confirm monitor mode started on the Wireless interface.

    As you can see the name of the wireless interface changed from waln0 to wlan0mon. The monitor mode is on. To see all the traffic being observed by the wireless interface, I run the command airodump-ng on the wireless interface.

    how to crack wep with aircarck

    As you can see, this shows all the wireless traffic around us. There are many wireless networks available but my target is the Wi-Fi Access point I named “Hack_Me_If_You_Can”. I use the same airodump-ng to target the MAC address of target’s Access point and route all the traffic it has to a file named wep_hc_crack.

    In the above image, you can see the clients connected to the targeted Wi-Fi Access point. All the traffic belonging to the Wi-Fi access point “Hack_Me_If_You_Can” will be saved in the file “wep_hc_crack.cap”. What I am looking for is the initialization vectors that are useful in cracking WEP. This initialization vectors play a key role in cracking the password of any WEP enabled Wi-Fi access point.

    Just remember the more IV’s we have, the more the chances of cracking the WEP password. Since I need more traffic to crack the WEP password fast, I can use some tricks to create more traffic. A feature of aircrack-ng, aireplay-ng helps us to create more traffic. It has various methods of creating additional traffic. One such method is ARP request replay attack.

    The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably. The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a ne- w IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key. This attack can be started as shown below.

    where “-h” option is used to specify the MAC address of any client we want to use. Here is another way in which you can start the ARP replay attack.

    As initialization vectors start collecting in the wep_hc_crack file, I can use aircrack to try cracking the password. The command is “aircrack-ng wep_hc_crack.cap“.

    If the initialization vectors are too less (in this case I have a new 20) aircrack wait for enough initialization vectors. I continue the ARP request replay attack until traffic increases.

    You can see the traffic increasing. All have to do is play the game of patience now .

    After collecting almost 25000 IV’s aircrack finally cracked the WEP password. The password of the Wi-Fi access point is 1234567899. It’s a 64bit hexadecimal key. As you can see, it took me around one hour thirty five minutes for me to crack the password.

    Cracking WPA / WPA2 passwords with aircrack

    Now, let’s see how to crack WPA / WPA2 with aircrack. WPA stands for Wifi Protected Access. It is an encryption system to secure WLAN networks. It eliminates all known vulnerabilities in WEP(Wired Equivalent Privacy). WPA uses 128 bit key and 48 bit initialization vector while WEP uses 108 bit key with 24 bit initialization vector. WPA2 is the successor of WPA. Both WPA and WPA2 use temporal key integrity protocol(TKIP) for encryption and pre-shared key(PSK) authentication. The only difference between WPA and WPA2 is that they use Rivest Cipher(RC4) and Advanced Encryption Standard(AES) encryption algorithms respectively. Both can be configured to use counter cipher block chaining mode(CCM) though. They are by far considered most secure for Wifi networks.

    I am using the same arrangement I used for cracking WEP above. So let’s start. Once you have booted into Kali Linux, open terminal and type command “iwconfig”. It lists your wireless interfaces just like ifconfig shows wired interfaces.

    We can see that we have a wireless interface wlan0. Now we are going to start monitor mode on our wireless interface. Monitor mode is same as promiscuous mode in wired sniffing. Type command shown below. We can see below that monitor mode has been enabled on “mon0″.

    airmon-ng start wlan0

    Now let’s see all the traffic collected by our wireless interface. Type command airodump-ng mon0.

    Hit Enter. We can see all the wireless networks available as shown below.

    crack wpa

    We can see that all the wifi networks are configured with WPA2 or WPA. We are going to hack the network “shunya”. We will collect the shunya’s network traffic into a file. Open a terminal and type command “airodump-ng –bssid <Mac address of wifi access point> -c 13 –write wpacrack mon0″.

    where

    • –bssid stands for base station security identifier
    • <MAC address> is the Mac address of access point.
    • -c is used to specify the channel the wifi network is operating on.
    • –write to write to a file.
    • “wpacrack” is the file name we are writing into.
    • mon0 is the interface.

    Hit Enter. We will see the result as below.

    We can only hack a WPA/WPA2 protected Wifi network by capturing its handshake process or association( when the client is trying to connect to the wifi network.). So let’s try to disconnect all the clients connected to the wireless network “shunya” first. Open a new terminal and type the command 

    aireplay-ng –deauth 100 -a <MAC> –ignore-negative-one mon0

    where

    –deauth are the de authentication packets,

    100 are the number of de authentication packets we want to send.

    -a stands for access point.

    <MAC> is the MAC address of the wireless access point.

    This command will send 100 de authentication packets to the broadcast address of the wireless access point. This will make all the clients connected to the “shunya” get disconnected. As soon as this happens, all the clients will try to connect back to the wireless network once again. We can see that a WPA handshake has happened in the previous terminal.

    Now let’s see where our capture file is located. Type “ls”. We will do dictionary password cracking here. So let’s find out where the dictionaries are. Type command“locate wordlists”. This will show us a number of wordlists available by default in Kali Linux.

    Our captured traffic is stored in .cap file. We will use the wordlist big.txt for cracking the password. Open a new terminal and type command 

    aircrack-ng wpacrack-01.cap -w /usr/share/dirb/wordlists/big.txt

    Hit Enter. If our dictionary or wordlist has this password, the result will be as below. If our dictionary doesn’t have the password, we have to use another dictionary or wordlist.

    Remember that the choice of dictionary or wordlist will play a key role in WPA/WPA2 password cracking. So that is one way in which we crack wpa wpa2 password with aircrack for you. Hope this was helpful. Learn how to crack WPA WPA2 with Fern Wifi cracker.

    Posted on by

    Complete guide to MAC changer tool

    Hello, aspiring ethical hackers. In this blogpost, you will learn about a tool named MAC changer. In your ethical hacking journey there may be one day a need arise to change your MAC addresses. Although you can change your MAC addresses manually, mac changer is a tool that helps you to change it automatically. In our previous data link layer attacks, you learnt that communication in a LAN takes place with MAC addresses.

    In our previous article on Data-link layer attacks, you have learnt what is a MAC address and its uses. Now, let’s see how to change your MAC addresses using MAC changer tool. To be able to change your MAC address first, you need to know your present MAC address. You can find out the MAC address of your machine using the command shown below.

    ip a

    You can see the current version of mac changes installed using the ‘-V’ option as show below.

    You can see that each network adapter (NIC) attached to the system has one unique MAC address. You can also see your the MAC address of your device using MAC changer with the “-s” option. 

    macchanger -s <network interface>

    If you want to see all the vendors that provide MAC addresses, using mac changer, the option is ‘-l’ as shown below.

    macchanger -l

    Before changing the MAC address of a adapter, make sure you disable that adapter using command as shown below.

    sudo ip link set eth0 down

    After making changes, you can enable the adapter using command shown below.

    sudo ip link set eth0 up

    Now, let’s see the different ways in which MAC addresses can be changed using mac changer. To give a random MAC address to a particular network adapter, say to the “eth0” adapter, the option we need to use is “-r”.

    macchanger -r <interface>

    To assign a random vendor MAC address of the same kind with mac changer, the option to use is “a”.

    macchanger -a <interface>

    To give a random MAC address of any kind, we can use the “-A” option.

    macchanger -A <interface>

    Every vendor has a unique MAC address that starts with unique vendor bytes. Using this tool, you can also change the MAC address without changing the vendor bytes using the “-e” option.

    macchanger -e <interface>

    You already know that MAC address is hardcoded to a hardware NIC card. Using this tool, you can also make your changed MAC addresses pretend as the burned in address of the NIC.

    macchanger -b -r <interface>

    That’s all about mac changer tool.