Elvis Wiki - User contributions [en]

Hak5 LAN Turtle

2023-01-08T13:26:17Z

MFriedl:

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide <ref name="own"></ref>]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>elvisLab</code> (default password after factory reset is <code>sh3llz</code>)
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# The LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires internet connection.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]] <ref name="own"></ref>

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. When the LAN-Turtle starts up or if an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>User@Host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>Port</code> - The port number from which the remote server will bind.
*<code>Remote Port</code> - The port number to which the SSH tunnel will bind on the remote machine.
*<code>Local Port</code> - The port number to which the SSH Tunnel will terminate on the LAN Turtle.
[[File:LANTurtleAutoSSH.png|417px||LAN Turtle AutoSSH configuration example]]

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Clomac ====
Clomac clones the Client's MAC address into the WAN interface.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DDNSC - Dynamic Domain Name Service Client ====
This service provides automatic Dynamic Domain Name updates.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== DNSMasq-Spoof ====
The DNSMasq-Spoof works similar to the DNSSpoof module but uses DNSMasq instead of Dsniff tools.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is required in order to properly configure AutoSSH.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle. Even though it is not to be considered as persistent per default, its reliability can be increased with simple bash scripts on the server side.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network. The user is able to specify a target network range to scan, choose from different scan profiles and specify the directory to write the log file to.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== QuickCreds ====
This module is used to retrieve login credentials from locked windows machines. The credentials are saved to <code>/root/loot</code>. The LAN turtle LED blinks while QuickCreds is running and lights solid when its done. Versions of the LAN turtle that do not support an SD card are not able to install it properly as it requires more space.+

==== Iodine ====
Establishes a DNS tunnel outbound to a server and domain name using iodine.

==== Responder ====
Responder is a LLMNR, NBT-NS and MDNS posioner. It answers to specific Name Service queries based on ther name suffix. By default, it only answers to File Server Service requests for SMB. It aims to be stealthier on the network and ensure that legitimate NBT-NS behavior is not broken with.

==== Script2Email ====
This module sends the output of a script as an email to a specified address. To do so, it uses SMTP and requires a mail account.

==== Script2Http ====
Sens the output of a script as HTTP post to a specified URL.

==== SSHFS ====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

==== uPnP-Portfwd ====
This service provides automatic port forwarding when connected to some uPnP enabled routers. This way it is able to provide a persistend direct shell from the outside to the LAN turtle. This won't work in many cases but is useful in cases it does.

==== Uptime ====
Displays the uptime of the LAN Turtle as well as the load average.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today. Even though it is displayed as downloadable via the modulemanager, it is depricated in Turtle Shell 6.2.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into four categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan
* deploy service with via TOR-network

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The third use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a server in the internet controlled by the attacker. The server is using 10.0.0.41 and a user turtle was created on it in order to simplify depictions.

==== Step 1: Generate RSA keypairs with Keymanager ====
[[File:SSH_Key.png |thumb|right|400px||<ref name="own"></ref>]]
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
# A prompt will ask wether or not to confirm the fingerprint
# The password for the user on the host is requestes
# If no error occurs, the exchange was succesful

==== Step 2: Configure AutoSSH ====
[[File:SSH_config.png |thumb|right|400px||<ref name="own"></ref>]]
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>port</code> the port on the Host used to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 3: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, commence the activity you remotely connected to it

=== Remote access attacks with NetCat Reverse Shell ===
[[File:NC_output.png |thumb|right|400px||Servers perspective of the NC reverse shell <ref name="own"></ref>]]
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -l 8080</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Gather credentials of locked machines using QuickCreds ===

==== Step 1: Install an SD Card to an applicable Lan Turtle ====
# Carefully open the Lan Turtle Shell as described above, also mind the two screws hidden under the sticker to open it fully
# Turn the Lan Turtle around and fit an SD Card into the SD Card Slot(This module does not work without an SD card)
# Start the Lan Turtle and select the "Format SD Card" option. This is important to avoid any filesystem incompatibilities

==== Step 2: Install QuickCreds module ====
# Open the Module Manager, select QuickCreds and install it
# Go back to the installed modules and open QuickCreds
# Select configure and wait for a minute while QuickCreds installs all the necessary packages

==== Step 3: Arm QuickCreds ====
# Open QuickCreds and click "ENABLE", this will start QuickCreds when the Lan Turtle is plugged in

==== Step 4: Exploit ====
# Plug the armed Lan Turtle into any locked Windows machine
# The amber LED will flash very quickly while the attack is running, afterwards they will slow down while the files are saved and the attacks finishes. Lastly the amber LED will flash in a slow and steady pattern to signalize everything is finished up
# Remove the Lan Turtle

==== Step 5: Gather hashes ====
# Plug the Lan Turtle into your machine again and connect via SSH
# Navigate to "/root/loot/quickcreds"
# Every folder "Creds1" ... "CredsN" contains the log of QuickCreds attacks, aswell as the gathered NTLM hashes, if the attack was successful
# Windows devices that use a connected Microsoft Account are currently no susceptible for QuickCreds attacks

=== Man-in-the-middle attacks with DNSMasq-Spoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSMasq-Spoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the host IP address and the spoofed DNS name
[[File:LANTurtleDNSMasq.png|497px||LAN Turtle DNSMasq configuration example]]

In this example, DNS queries for google.com will return a local address, where more malicious activity can take place.

==== Step 2: Set up your server ====
#Create an index.html file by using the command <code>nano index.html</code> and fill it with the content you want to display to the target
#Set up http. An easy way to do so is by issuing <code>sudo python3 -m http.server 8080</code> on your server

==== Step 3: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle. When trying to access one of the spoofed DNS names, the target instead opens your pre-configured html file.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

=== Deploy services via TOR with Tortle ===
==== Hidden Service ====
Onion Host sets up a hidden service inside the TOR network. By default it is a TORShell (SSH within TOR).
==== Proxy & Gateway configuration ====
TORGateway, if enabled, automatically and conveniently tunnels ALL eth0 traffic through TOR Transparent Proxy. TOR Proxy is just the regular SOCKS proxy through TOR.
==== Bridge configurtation ====
Bridges can be used to avoid blocking of the standard tor relays.
==== HTTP Proxy configuration ====
HTTP Proxy can be configured to control internet access.
==== HTTPS Proxy configuration ====
HTTPS Proxy can be configured to control internet access.
==== Firewall configuration ====
You can configure a firewall that restricts access to serveral ports.

== Used Hardware ==

[[LAN Turtle]]

== References ==
* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle
<references>
<ref name="own">own creation</ref>
</references>

[[Category:Pentesting]]

Hak5 LAN Turtle

2023-01-07T23:55:20Z

MFriedl:

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide <ref name="own"></ref>]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>elvisLab</code> (default password after factory reset is <code>sh3llz</code>)
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# The LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires internet connection.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]] <ref name="own"></ref>

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. When the LAN-Turtle starts up or if an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>User@Host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>Port</code> - The port number from which the remote server will bind.
*<code>Remote Port</code> - The port number to which the SSH tunnel will bind on the remote machine.
*<code>Local Port</code> - The port number to which the SSH Tunnel will terminate on the LAN Turtle.
[[File:LANTurtleAutoSSH.png|417px||LAN Turtle AutoSSH configuration example]]

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Clomac ====
Clomac clones the Client's MAC address into the WAN interface.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DDNSC - Dynamic Domain Name Service Client ====
This service provides automatic Dynamic Domain Name updates.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== DNSMasq-Spoof ====
The DNSMasq-Spoof works similar to the DNSSpoof module but uses DNSMasq instead of Dsniff tools.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is required in order to properly configure AutoSSH.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle. Even though it is not to be considered as persistent per default, its reliability can be increased with simple bash scripts on the server side.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network. The user is able to specify a target network range to scan, choose from different scan profiles and specify the directory to write the log file to.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== QuickCreds ====
This module is used to retrieve login credentials from locked windows machines. The credentials are saved to <code>/root/loot</code>. The LAN turtle LED blinks while QuickCreds is running and lights solid when its done. Versions of the LAN turtle that do not support an SD card are not able to install it properly as it requires more space.+

==== Iodine ====
Establishes a DNS tunnel outbound to a server and domain name using iodine.

==== Responder ====
Responder is a LLMNR, NBT-NS and MDNS posioner. It answers to specific Name Service queries based on ther name suffix. By default, it only answers to File Server Service requests for SMB. It aims to be stealthier on the network and ensure that legitimate NBT-NS behavior is not broken with.

==== Script2Email ====
This module sends the output of a script as an email to a specified address. To do so, it uses SMTP and requires a mail account.

==== Script2Http ====
Sens the output of a script as HTTP post to a specified URL.

==== SSHFS ====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

==== uPnP-Portfwd ====
This service provides automatic port forwarding when connected to some uPnP enabled routers. This way it is able to provide a persistend direct shell from the outside to the LAN turtle. This won't work in many cases but is useful in cases it does.

==== Uptime ====
Displays the uptime of the LAN Turtle as well as the load average.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today. Even though it is displayed as downloadable via the modulemanager, it is depricated in Turtle Shell 6.2.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into four categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan
* deploy service with via TOR-network

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The third use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a server in the internet controlled by the attacker. The server is using 10.0.0.41 and a user turtle was created on it in order to simplify depictions.

==== Step 1: Generate RSA keypairs with Keymanager ====
[[File:SSH_Key.png |thumb|right|400px||<ref name="own"></ref>]]
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
# A prompt will ask wether or not to confirm the fingerprint
# The password for the user on the host is requestes
# If no error occurs, the exchange was succesful

==== Step 2: Configure AutoSSH ====
[[File:SSH_config.png |thumb|right|400px||<ref name="own"></ref>]]
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>port</code> the port on the Host used to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 3: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, commence the activity you remotely connected to it

=== Remote access attacks with NetCat Reverse Shell ===
[[File:NC_output.png |thumb|right|400px||Servers perspective of the NC reverse shell <ref name="own"></ref>]]
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -l 8080</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Gather credentials of locked machines using QuickCreds ===

==== Step 1: Install an SD Card to an applicable Lan Turtle ====
# Carefully open the Lan Turtle Shell as described above, also mind the two screws hidden under the sticker to open it fully
# Turn the Lan Turtle around and fit an SD Card into the SD Card Slot
# Start the Lan Turtle and select the "Format SD Card" option. This is important to avoid any filesystem incompatibilities

==== Step 2: Install QuickCreds module ====
# Open the Module Manager, select QuickCreds and install it
# Go back to the installed modules and open QuickCreds
# Select configure and wait for a minute while QuickCreds installs all the necessary packages

==== Step 3: Arm QuickCreds ====
# Open QuickCreds and click "ENABLE", this will start QuickCreds when the Lan Turtle is plugged in

==== Step 4: Exploit ====
# Plug the armed Lan Turtle into any locked Windows machine
# The amber LED will flash very quickly while the attack is running, afterwards they will slow down while the files are saved and the attacks finishes. Lastly the amber LED will flash in a slow and steady pattern to signalize everything is finished up
# Remove the Lan Turtle

==== Step 5: Gather hashes ====
# Plug the Lan Turtle into your machine again and connect via SSH
# Navigate to "/root/loot/quickcreds"
# Every folder "Creds1" ... "CredsN" contains the log of QuickCreds attacks, aswell as the gathered NTLM hashes, if the attack was successful
# Windows devices that use a connected Microsoft Account are currently no susceptible for QuickCreds attacks

=== Man-in-the-middle attacks with DNSMasq-Spoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSMasq-Spoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the host IP address and the spoofed DNS name
[[File:LANTurtleDNSMasq.png|497px||LAN Turtle DNSMasq configuration example]]

In this example, DNS queries for google.com will return a local address, where more malicious activity can take place.

==== Step 2: Set up your server ====
#Create an index.html file by using the command <code>nano index.html</code> and fill it with the content you want to display to the target
#Set up http. An easy way to do so is by issuing <code>sudo python3 -m http.server 8080</code> on your server

==== Step 3: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle. When trying to access one of the spoofed DNS names, the target instead opens your pre-configured html file.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

=== Deploy services via TOR with Tortle ===
==== Hidden Service ====
Onion Host sets up a hidden service inside the TOR network. By default it is a TORShell (SSH within TOR).
==== Proxy & Gateway configuration ====
TORGateway, if enabled, automatically and conveniently tunnels ALL eth0 traffic through TOR Transparent Proxy. TOR Proxy is just the regular SOCKS proxy through TOR.
==== Bridge configurtation ====
Bridges can be used to avoid blocking of the standard tor relays.
==== HTTP Proxy configuration ====
HTTP Proxy can be configured to control internet access.
==== HTTPS Proxy configuration ====
HTTPS Proxy can be configured to control internet access.
==== Firewall configuration ====
You can configure a firewall that restricts access to serveral ports.

== Used Hardware ==

[[LAN Turtle]]

== References ==
* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle
<references>
<ref name="own">own creation</ref>
</references>

[[Category:Pentesting]]

Hak5 LAN Turtle

2023-01-07T23:52:03Z

MFriedl:

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide <ref name="own"></ref>]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>elvisLab</code> (default password after factory reset is <code>sh3llz</code>)
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# The LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires internet connection.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]] <ref name="own"></ref>

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. When the LAN-Turtle starts up or if an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>User@Host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>Port</code> - The port number from which the remote server will bind.
*<code>Remote Port</code> - The port number to which the SSH tunnel will bind on the remote machine.
*<code>Local Port</code> - The port number to which the SSH Tunnel will terminate on the LAN Turtle.
[[File:LANTurtleAutoSSH.png|417px||LAN Turtle AutoSSH configuration example]]

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Clomac ====
Clomac clones the Client's MAC address into the WAN interface.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DDNSC - Dynamic Domain Name Service Client ====
This service provides automatic Dynamic Domain Name updates.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== DNSMasq-Spoof ====
The DNSMasq-Spoof works similar to the DNSSpoof module but uses DNSMasq instead of Dsniff tools.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is required in order to properly configure AutoSSH.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle. Even though it is not to be considered as persistent per default, its reliability can be increased with simple bash scripts on the server side.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network. The user is able to specify a target network range to scan, choose from different scan profiles and specify the directory to write the log file to.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== QuickCreds ====
This module is used to retrieve login credentials from locked windows machines. The credentials are saved to <code>/root/loot</code>. The LAN turtle LED blinks while QuickCreds is running and lights solid when its done. Versions of the LAN turtle that do not support an SD card are not able to install it properly as it requires more space.+

==== Iodine ====
Establishes a DNS tunnel outbound to a server and domain name using iodine.

==== Responder ====
Responder is a LLMNR, NBT-NS and MDNS posioner. It answers to specific Name Service queries based on ther name suffix. By default, it only answers to File Server Service requests for SMB. It aims to be stealthier on the network and ensure that legitimate NBT-NS behavior is not broken with.

==== Script2Email ====
This module sends the output of a script as an email to a specified address. To do so, it uses SMTP and requires a mail account.

==== Script2Http ====
Sens the output of a script as HTTP post to a specified URL.

==== SSHFS ====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

==== uPnP-Portfwd ====
This service provides automatic port forwarding when connected to some uPnP enabled routers. This way it is able to provide a persistend direct shell from the outside to the LAN turtle. This won't work in many cases but is useful in cases it does.

==== Uptime ====
Displays the uptime of the LAN Turtle as well as the load average.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today. Even though it is displayed as downloadable via the modulemanager, it is depricated in Turtle Shell 6.2.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into four categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan
* deploy service with via TOR-network

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The third use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a server in the internet controlled by the attacker. The server is using 10.0.0.41 and a user turtle was created on it in order to simplify depictions.

==== Step 1: Generate RSA keypairs with Keymanager ====
[[File:SSH_Key.png |thumb|right|400px||<ref name="own"></ref>]]
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
# A prompt will ask wether or not to confirm the fingerprint
# The password for the user on the host is requestes
# If no error occurs, the exchange was succesful

==== Step 2: Configure AutoSSH ====
[[File:SSH_config.png |thumb|right|400px||<ref name="own"></ref>]]
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>port</code> the port on the Host used to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 2: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, continue with further attacks

=== Remote access attacks with NetCat Reverse Shell ===
[[File:NC_output.png |thumb|right|400px||Servers perspective of the NC reverse shell <ref name="own"></ref>]]
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -l 8080</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Gather credentials of locked machines using QuickCreds ===

==== Step 1: Install an SD Card to an applicable Lan Turtle ====
# Carefully open the Lan Turtle Shell as described above, also mind the two screws hidden under the sticker to open it fully
# Turn the Lan Turtle around and fit an SD Card into the SD Card Slot
# Start the Lan Turtle and select the "Format SD Card" option. This is important to avoid any filesystem incompatibilities

==== Step 2: Install QuickCreds module ====
# Open the Module Manager, select QuickCreds and install it
# Go back to the installed modules and open QuickCreds
# Select configure and wait for a minute while QuickCreds installs all the necessary packages

==== Step 3: Arm QuickCreds ====
# Open QuickCreds and click "ENABLE", this will start QuickCreds when the Lan Turtle is plugged in

==== Step 4: Exploit ====
# Plug the armed Lan Turtle into any locked Windows machine
# The amber LED will flash very quickly while the attack is running, afterwards they will slow down while the files are saved and the attacks finishes. Lastly the amber LED will flash in a slow and steady pattern to signalize everything is finished up
# Remove the Lan Turtle

==== Step 5: Gather hashes ====
# Plug the Lan Turtle into your machine again and connect via SSH
# Navigate to "/root/loot/quickcreds"
# Every folder "Creds1" ... "CredsN" contains the log of QuickCreds attacks, aswell as the gathered NTLM hashes, if the attack was successful
# Windows devices that use a connected Microsoft Account are currently no susceptible for QuickCreds attacks

=== Man-in-the-middle attacks with DNSMasq-Spoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSMasq-Spoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the host IP address and the spoofed DNS name
[[File:LANTurtleDNSMasq.png|497px||LAN Turtle DNSMasq configuration example]]

In this example, DNS queries for google.com will return a local address, where more malicious activity can take place.

==== Step 2: Set up your server ====
#Create an index.html file by using the command <code>nano index.html</code> and fill it with the content you want to display to the target
#Set up http. An easy way to do so is by issuing <code>sudo python3 -m http.server 8080</code> on your server

==== Step 3: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle. When trying to access one of the spoofed DNS names, the target instead opens your pre-configured html file.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

=== Deploy services via TOR with Tortle ===
==== Hidden Service ====
Onion Host sets up a hidden service inside the TOR network. By default it is a TORShell (SSH within TOR).
==== Proxy & Gateway configuration ====
TORGateway, if enabled, automatically and conveniently tunnels ALL eth0 traffic through TOR Transparent Proxy. TOR Proxy is just the regular SOCKS proxy through TOR.
==== Bridge configurtation ====
Bridges can be used to avoid blocking of the standard tor relays.
==== HTTP Proxy configuration ====
HTTP Proxy can be configured to control internet access.
==== HTTPS Proxy configuration ====
HTTPS Proxy can be configured to control internet access.
==== Firewall configuration ====
You can configure a firewall that restricts access to serveral ports.

== Used Hardware ==

[[LAN Turtle]]

== References ==
* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle
<references>
<ref name="own">own creation</ref>
</references>

[[Category:Pentesting]]

File:LANTurtleDNSMasq.png

2023-01-07T23:49:28Z

MFriedl:

Hak5 LAN Turtle

2023-01-07T23:47:15Z

MFriedl:

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide <ref name="own"></ref>]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>elvisLab</code> (default password after factory reset is <code>sh3llz</code>)
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# The LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires internet connection.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]] <ref name="own"></ref>

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. When the LAN-Turtle starts up or if an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>User@Host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>Port</code> - The port number from which the remote server will bind.
*<code>Remote Port</code> - The port number to which the SSH tunnel will bind on the remote machine.
*<code>Local Port</code> - The port number to which the SSH Tunnel will terminate on the LAN Turtle.
[[File:LANTurtleAutoSSH.png|417px||LAN Turtle AutoSSH configuration example]] <ref name="own"></ref>

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Clomac ====
Clomac clones the Client's MAC address into the WAN interface.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DDNSC - Dynamic Domain Name Service Client ====
This service provides automatic Dynamic Domain Name updates.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== DNSMasq-Spoof ====
The DNSMasq-Spoof works similar to the DNSSpoof module but uses DNSMasq instead of Dsniff tools.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is required in order to properly configure AutoSSH.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle. Even though it is not to be considered as persistent per default, its reliability can be increased with simple bash scripts on the server side.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network. The user is able to specify a target network range to scan, choose from different scan profiles and specify the directory to write the log file to.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== QuickCreds ====
This module is used to retrieve login credentials from locked windows machines. The credentials are saved to <code>/root/loot</code>. The LAN turtle LED blinks while QuickCreds is running and lights solid when its done. Versions of the LAN turtle that do not support an SD card are not able to install it properly as it requires more space.+

==== Iodine ====
Establishes a DNS tunnel outbound to a server and domain name using iodine.

==== Responder ====
Responder is a LLMNR, NBT-NS and MDNS posioner. It answers to specific Name Service queries based on ther name suffix. By default, it only answers to File Server Service requests for SMB. It aims to be stealthier on the network and ensure that legitimate NBT-NS behavior is not broken with.

==== Script2Email ====
This module sends the output of a script as an email to a specified address. To do so, it uses SMTP and requires a mail account.

==== Script2Http ====
Sens the output of a script as HTTP post to a specified URL.

==== SSHFS ====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

==== uPnP-Portfwd ====
This service provides automatic port forwarding when connected to some uPnP enabled routers. This way it is able to provide a persistend direct shell from the outside to the LAN turtle. This won't work in many cases but is useful in cases it does.

==== Uptime ====
Displays the uptime of the LAN Turtle as well as the load average.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today. Even though it is displayed as downloadable via the modulemanager, it is depricated in Turtle Shell 6.2.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into four categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan
* deploy service with via TOR-network

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The third use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a server in the internet controlled by the attacker. The server is using 10.0.0.41 and a user turtle was created on it in order to simplify depictions.

==== Step 1: Generate RSA keypairs with Keymanager ====
[[File:SSH_Key.png |thumb|right|400px||<ref name="own"></ref>]]
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
# A prompt will ask wether or not to confirm the fingerprint
# The password for the user on the host is requestes
# If no error occurs, the exchange was succesful

==== Step 2: Configure AutoSSH ====
[[File:SSH_config.png |thumb|right|400px||<ref name="own"></ref>]]
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>port</code> the port on the Host used to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 2: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, continue with further attacks

=== Remote access attacks with NetCat Reverse Shell ===
[[File:NC_output.png |thumb|right|400px||Servers perspective of the NC reverse shell <ref name="own"></ref>]]
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -l 8080</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Gather credentials of locked machines using QuickCreds ===

==== Step 1: Install an SD Card to an applicable Lan Turtle ====
# Carefully open the Lan Turtle Shell as described above, also mind the two screws hidden under the sticker to open it fully
# Turn the Lan Turtle around and fit an SD Card into the SD Card Slot
# Start the Lan Turtle and select the "Format SD Card" option. This is important to avoid any filesystem incompatibilities

==== Step 2: Install QuickCreds module ====
# Open the Module Manager, select QuickCreds and install it
# Go back to the installed modules and open QuickCreds
# Select configure and wait for a minute while QuickCreds installs all the necessary packages

==== Step 3: Arm QuickCreds ====
# Open QuickCreds and click "ENABLE", this will start QuickCreds when the Lan Turtle is plugged in

==== Step 4: Exploit ====
# Plug the armed Lan Turtle into any locked Windows machine
# The amber LED will flash very quickly while the attack is running, afterwards they will slow down while the files are saved and the attacks finishes. Lastly the amber LED will flash in a slow and steady pattern to signalize everything is finished up
# Remove the Lan Turtle

==== Step 5: Gather hashes ====
# Plug the Lan Turtle into your machine again and connect via SSH
# Navigate to "/root/loot/quickcreds"
# Every folder "Creds1" ... "CredsN" contains the log of QuickCreds attacks, aswell as the gathered NTLM hashes, if the attack was successful
# Windows devices that use a connected Microsoft Account are currently no susceptible for QuickCreds attacks

=== Man-in-the-middle attacks with DNSMasq-Spoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSMasq-Spoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the host IP address and the spoofed DNS name

==== Step 2: Set up your server ====
#Create an index.html file by using the command <code>nano index.html</code> and fill it with the content you want to display to the target
#Set up http. An easy way to do so is by issuing <code>sudo python3 -m http.server 8080</code> on your server

==== Step 3: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle. When trying to access one of the spoofed DNS names, the target instead opens your pre-configured html file.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

=== Deploy services via TOR with Tortle ===
==== Hidden Service ====
Onion Host sets up a hidden service inside the TOR network. By default it is a TORShell (SSH within TOR).
==== Proxy & Gateway configuration ====
TORGateway, if enabled, automatically and conveniently tunnels ALL eth0 traffic through TOR Transparent Proxy. TOR Proxy is just the regular SOCKS proxy through TOR.
==== Bridge configurtation ====
Bridges can be used to avoid blocking of the standard tor relays.
==== HTTP Proxy configuration ====
HTTP Proxy can be configured to control internet access.
==== HTTPS Proxy configuration ====
HTTPS Proxy can be configured to control internet access.
==== Firewall configuration ====
You can configure a firewall that restricts access to serveral ports.

== Used Hardware ==

[[LAN Turtle]]

== References ==
* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle
<references>
<ref name="own">own creation</ref>
</references>

[[Category:Pentesting]]

File:LANTurtleAutoSSH.png

2023-01-07T23:46:11Z

MFriedl:

Hak5 LAN Turtle

2023-01-07T23:41:34Z

MFriedl:

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide <ref name="own"></ref>]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>elvisLab</code> (default password after factory reset is <code>sh3llz</code>)
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# The LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires internet connection.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]] <ref name="own"></ref>

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. When the LAN-Turtle starts up or if an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>User@Host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>Port</code> - The port number from which the remote server will bind.
*<code>Remote Port</code> - The port number to which the SSH tunnel will bind on the remote machine.
*<code>Local Port</code> - The port number to which the SSH Tunnel will terminate on the LAN Turtle.

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Clomac ====
Clomac clones the Client's MAC address into the WAN interface.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DDNSC - Dynamic Domain Name Service Client ====
This service provides automatic Dynamic Domain Name updates.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== DNSMasq-Spoof ====
The DNSMasq-Spoof works similar to the DNSSpoof module but uses DNSMasq instead of Dsniff tools.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is required in order to properly configure AutoSSH.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle. Even though it is not to be considered as persistent per default, its reliability can be increased with simple bash scripts on the server side.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network. The user is able to specify a target network range to scan, choose from different scan profiles and specify the directory to write the log file to.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== QuickCreds ====
This module is used to retrieve login credentials from locked windows machines. The credentials are saved to <code>/root/loot</code>. The LAN turtle LED blinks while QuickCreds is running and lights solid when its done. Versions of the LAN turtle that do not support an SD card are not able to install it properly as it requires more space.+

==== Iodine ====
Establishes a DNS tunnel outbound to a server and domain name using iodine.

==== Responder ====
Responder is a LLMNR, NBT-NS and MDNS posioner. It answers to specific Name Service queries based on ther name suffix. By default, it only answers to File Server Service requests for SMB. It aims to be stealthier on the network and ensure that legitimate NBT-NS behavior is not broken with.

==== Script2Email ====
This module sends the output of a script as an email to a specified address. To do so, it uses SMTP and requires a mail account.

==== Script2Http ====
Sens the output of a script as HTTP post to a specified URL.

==== SSHFS ====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

==== uPnP-Portfwd ====
This service provides automatic port forwarding when connected to some uPnP enabled routers. This way it is able to provide a persistend direct shell from the outside to the LAN turtle. This won't work in many cases but is useful in cases it does.

==== Uptime ====
Displays the uptime of the LAN Turtle as well as the load average.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today. Even though it is displayed as downloadable via the modulemanager, it is depricated in Turtle Shell 6.2.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into four categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan
* deploy service with via TOR-network

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The third use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a server in the internet controlled by the attacker. The server is using 10.0.0.41 and a user turtle was created on it in order to simplify depictions.

==== Step 1: Generate RSA keypairs with Keymanager ====
[[File:SSH_Key.png |thumb|right|400px||<ref name="own"></ref>]]
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
# A prompt will ask wether or not to confirm the fingerprint
# The password for the user on the host is requestes
# If no error occurs, the exchange was succesful

==== Step 2: Configure AutoSSH ====
[[File:SSH_config.png |thumb|right|400px||<ref name="own"></ref>]]
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>port</code> the port on the Host used to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 2: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, continue with further attacks

=== Remote access attacks with NetCat Reverse Shell ===
[[File:NC_output.png |thumb|right|400px||Servers perspective of the NC reverse shell <ref name="own"></ref>]]
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -l 8080</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Gather credentials of locked machines using QuickCreds ===

==== Step 1: Install an SD Card to an applicable Lan Turtle ====
# Carefully open the Lan Turtle Shell as described above, also mind the two screws hidden under the sticker to open it fully
# Turn the Lan Turtle around and fit an SD Card into the SD Card Slot
# Start the Lan Turtle and select the "Format SD Card" option. This is important to avoid any filesystem incompatibilities

==== Step 2: Install QuickCreds module ====
# Open the Module Manager, select QuickCreds and install it
# Go back to the installed modules and open QuickCreds
# Select configure and wait for a minute while QuickCreds installs all the necessary packages

==== Step 3: Arm QuickCreds ====
# Open QuickCreds and click "ENABLE", this will start QuickCreds when the Lan Turtle is plugged in

==== Step 4: Exploit ====
# Plug the armed Lan Turtle into any locked Windows machine
# The amber LED will flash very quickly while the attack is running, afterwards they will slow down while the files are saved and the attacks finishes. Lastly the amber LED will flash in a slow and steady pattern to signalize everything is finished up
# Remove the Lan Turtle

==== Step 5: Gather hashes ====
# Plug the Lan Turtle into your machine again and connect via SSH
# Navigate to "/root/loot/quickcreds"
# Every folder "Creds1" ... "CredsN" contains the log of QuickCreds attacks, aswell as the gathered NTLM hashes, if the attack was successful
# Windows devices that use a connected Microsoft Account are currently no susceptible for QuickCreds attacks

=== Man-in-the-middle attacks with DNSMasq-Spoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSMasq-Spoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the host IP address and the spoofed DNS name

==== Step 2: Set up your server ====
#Create an index.html file by using the command <code>nano index.html</code> and fill it with the content you want to display to the target
#Set up http. An easy way to do so is by issuing <code>sudo python3 -m http.server 8080</code> on your server

==== Step 3: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle. When trying to access one of the spoofed DNS names, the target instead opens your pre-configured html file.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

=== Deploy services via TOR with Tortle ===
==== Hidden Service ====
Onion Host sets up a hidden service inside the TOR network. By default it is a TORShell (SSH within TOR).
==== Proxy & Gateway configuration ====
TORGateway, if enabled, automatically and conveniently tunnels ALL eth0 traffic through TOR Transparent Proxy. TOR Proxy is just the regular SOCKS proxy through TOR.
==== Bridge configurtation ====
Bridges can be used to avoid blocking of the standard tor relays.
==== HTTP Proxy configuration ====
HTTP Proxy can be configured to control internet access.
==== HTTPS Proxy configuration ====
HTTPS Proxy can be configured to control internet access.
==== Firewall configuration ====
You can configure a firewall that restricts access to serveral ports.

== Used Hardware ==

[[LAN Turtle]]

== References ==
* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle
<references>
<ref name="own">own creation</ref>
</references>

[[Category:Pentesting]]

Information Gathering Tools

2021-06-24T08:33:07Z

MFriedl:

== Summary ==

This is a draft. Comparing various available pre-installed information gathering tools in Kali and comparing differences to ParrotOS. This document is NOT a documentation of the tools, it is merely a comparison and practical evaluation of the tools for an average security specialist or a security newbie wanting to start using the tools.

== Requirements ==

* Operating system: Kali Linux 2021.1 amd64, Parrot Security 4.10 amd64
Disclaimer: all possible examples and tests done have been done in VMWare in a Kali Linux 2021.1 and the commands are up-to-date as of 21st June 2021.

== Tools==

=== Nmap ===
Category: Information Gathering - Network & Port Scanners 
Nmap is known to be a very powerful tool for information gathering and vulnerability scanning. It offers loads of options, offering for example for host discovery, scans (TCP, UDP, IP...), service/version detection, OS detection, firewalls/IDS evasion and spoofing, script scanning etc. Since this is not meant to be a [https://nmap.org/book/man.html full documentation] of the tools, but rather an evaluation overview, compared to the other tools in this category, Nmap is the one main tool that most of the other secondary tools are using and it is very powerful. See the following tools for some comparison and Nmap examples.

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: If your goal is to perform a network scan to determine alive hosts, open ports, used systems on ports or used operation systems on the hosts, this would be the way to go. It is fast and efficient (speed depends on the range of hosts and ports scanned though). The other tools that offer these results are using Nmap anyway, for example the way DMitry or Legion use it.</div>
For more information please refer to the full [https://nmap.org/book/man.html tool documentation].

=== Spiderfoot ===
Category: Information Gathering - OSINT 
This is a reconnaissance framework that uses many modules for information gathering, working on the OSINT principle. You can access a GUI by starting the framework on a port on localhost and accessing that address via web browser once it starts:
 <code>$ spiderfoot -l 127.0.0.1:5001</code> 
You can then set up a new scan, where you would give the program a target: this can be a domain/sub-domain name, IPv4 or IPv6 address, hostname, subnet, ASN, e-mail address, phone number, a person's actual name or username. This gives a really wide spectrum on options. The full scan is demonstrated below.
scan www.fh-campuswien.ac.at for a full scan, where you "get anything and everything about the target":
Execution takes many days, depending on the size of the target and the information available on the internet to that target. This specific inquiry took several days to complete and collect all information. Some parts of the information is displayed below, however the results were much more extensive:
<div><ul>
<li style="display: inline-block;"> [[File:Spiderscan.png|thumb|none|800px|Results of Spiderfoot Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is a very good and very powerful reconnaissance framework. It really collects "anything and everything" about a target, as it states. The scans take a very long time, but the amount of information connected is priceless, it really searches through the whole www to provide any and every connection to the target. Based on the very user friendly and well-arranged GUI it is quite good for beginners too, however the amount of data delivered is useful only for professional security analysts who know what to do with the results, how to navigate them and how to interpret them.</div>
For more information please refer to the full [https://www.spiderfoot.net/documentation/ tool documentation].

=== Legion ===
Category: Information Gathering - general 
Legion is a GUI tool, a network penetration testing framework, that offers many options. It automatically detects CVEs and provides nmap, Vulners, whataweb, webslayer, sslyzer, SMBenum, dirbuster, nikto, Hydra and other additional scripts. Its execution takes up to a couple of minutes. A demonstration:
scan www.fh-campuswien.ac.at
<div><ul>
<li style="display: inline-block;"> [[File:Legion scan.png|thumb|none|600px|Results of Legion Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
No CVEs have been found. Below is a comparison with the Metasploitable2 machine that can be found in the same subnet, so that it is clear how the vulnerabilities are shown in an actual weak system:
<div><ul>
<li style="display: inline-block;"> [[File:Meta legion.png|thumb|none|1000px|Results of Legion Scan on Metasploitable2 VM]] </li>
</ul></div>
It is safe to say that it is a very powerful and useful tool, also very user friendly and quite fast. Maybe not the best for domains in the internet because it won't offer much more information than nmap and whois lookup, but when you look at the metasploitable output, so a scan of a server, you can see how much information is shown. The implementation of Hydra also gets you the cracked passwords in the vulnerabilities which is very useful. 
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall definitely a recommended tool, nice GUI, works quickly and efficiently and is very well arranged and easy to navigate.</div>
For more information please refer to the full [https://govanguard.com/legion/#about-legion official Legion Framework website].

=== DMitry===
Category: Information Gathering - general 
DMitry is a CLI tool to gather information about a host - possible subdomains, uptime information, tcp port scan, email addresses, whois lookups etc. It is mostly used to reveal information that exists through search engines about the owner or host of a web page, i.e. for social engineering attacks.
 
When using the portscan option, the results show less open ports than doing that same TCP scan with nmap.
 DMitry:
HostIP:192.168.0.130
HostName:
Gathered TCP Port information for 192.168.0.130
Port State
23/tcp open
Portscan Finished: Scanned 150 ports, 148 ports were in state closed
Nmap:
Nmap scan report for 192.168.0.130
Host is up (0.20s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
23/tcp open telnet
554/tcp open rtsp
843/tcp open unknown
5001/tcp open commplex-link
MAC Address: 7C:DD:90:AF:4E:7D (Shenzhen Ogemray Technology)
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

To find out information about a domain, you need either the IP or the domain same.
 Whois lookup on the other hand gets you some nice useful results. Below is an example of using <code>dmitry -w www.fh-campuswien.ac.at</code> on the college website of FH Campus Wien www.fh-campuswien.ac.at, and it just goes to show that it is exactly the same output as if you were to type <code>whois fh-campuswien.ac.at</code>
HostIP:91.213.77.62
HostName:www.fh-campuswien.ac.at
Gathered Inic-whois information for fh-campuswien.ac.at
---------------------------------
domain: fh-campuswien.ac.at
registrar:
registrant: FCW1942152-NICAT
admin-c: <data not disclosed>
tech-c: NLTU11579014-NICAT
nserver: ns.nextlayer.at
remarks: 81.16.150.30
nserver: ns2.nextlayer.at
remarks: 81.16.151.30
changed: 20171003 19:16:08
source: AT-DOM
personname:
organization: fh campus wien
street address: Favoritenstrasse 226
postal code: A-1100
city: Vienna
country: Austria
phone: +43160668771000
fax-no: +43160668771009
e-mail: office@fh-campuswien.ac.at
nic-hdl: FCW1942152-NICAT
changed: 20100323 17:12:46
source: AT-DOM
personname: Hostmaster Hostmaster
organization: next layer Telekommunikationsdienstleistungs- und BeratungsGmbH
street address: Mariahilfer Guertel 37- 7
postal code: 1150
city: Vienna
country: Austria
phone: +43517649
e-mail: hostmaster@nextlayer.at
nic-hdl: NLTU11579014-NICAT
changed: 20170929 13:17:54
source: AT-DOM

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall a nice tool, useful for beginners who don't have experience with the basic tools yet. However, to an experienced IT Security specialist, the tools that DMitry is based on, like nmap and whois would be the better choice to use here, since they just offer you the same output and nmap and whois itself offer much more options. One drawback however is that you need to install whois separately, whilst DMitry will be in the preinstalled set of tools. When it comes to portscan, it offers pretty insufficient results in DMitry.
This tool is fairly outdated nowadays, although it used to be very good a few years ago. Now there are better alternatives.</div>
For more information please refer to the full [https://linux.die.net/man/1/dmitry tool documentation].

=== Recon-ng ===
Category: Information Gathering - general 
On the first glance, it looks very similar to Metasploit. You can start it via the command line and enter an environment in the shell. It is a python web reconnaissance framework designed specifically for web-based information gathering, and is, unlike Metasploit, not an exploitation framework. 
To navigate it, always utilize the help flag to view possible options. At first, you won't have any modules enables/installed, which is kind of confusing and one really has to look into the documentation first before using it because the shell environment isn't that intuitive. 
To view available modules, use <code>show modules</code>. When you want to start now, create a workspace first where your retrieved data will be saved:
[recon-ng][default] > workspaces create test
Now install the module you would like to use, we will use hackertarget to get subdomains. You can use <code>marketplace search hackertarget</code> to view the module and install it by:
[recon-ng][test] > marketplace install hackertarget
[*] Module installed: recon/domains-hosts/hackertarget
[*] Reloading modules...
Now we will load the module and set the source of input, which we want to retrieve data from. With the command <code>info</code> or <code>input</code> you can view the current source. Execute the module with <code>run</code>:
[recon-ng][test] > modules load hackertarget
[recon-ng][test][hackertarget] > options set SOURCE tesla.com
[recon-ng][test][hackertarget] > run
This will get you 27 found hosts, after the <code>show hosts</code> command you can review them in an arranged list:
+---------------------------------------------------------------------------------------------------------------------+
| rowid | host | ip_address | region | country | latitude | longitude | notes | module |
+---------------------------------------------------------------------------------------------------------------------+
| 1 | tesla.com | 199.66.11.62 | | | | | | hackertarget |
| 2 | o7.ptr6980.tesla.com | 149.72.144.42 | | | | | | hackertarget |
| 3 | vpn1.tesla.com | 8.45.124.215 | | | | | | hackertarget |
| 4 | model3.tesla.com | 205.234.27.221 | | | | | | hackertarget |
| 5 | o3.ptr1444.tesla.com | 149.72.152.236 | | | | | | hackertarget |
| 6 | o2.ptr556.tesla.com | 149.72.134.64 | | | | | | hackertarget |
| 7 | o5.ptr8466.tesla.com | 149.72.172.170 | | | | | | hackertarget |
| 8 | o6.ptr9437.tesla.com | 168.245.123.10 | | | | | | hackertarget |
| 9 | o4.ptr1867.tesla.com | 149.72.163.58 | | | | | | hackertarget |
| 10 | mobile.tesla.com | 209.133.79.82 | | | | | | hackertarget |
| 11 | marketing.tesla.com | 13.111.47.196 | | | | | | hackertarget |
| 12 | o1.ptr2410.link.tesla.com | 149.72.247.52 | | | | | | hackertarget |
| 13 | referral.tesla.com | 72.10.32.90 | | | | | | hackertarget |
| 14 | mta2.email.tesla.com | 13.111.4.231 | | | | | | hackertarget |
| 15 | mta.email.tesla.com | 13.111.14.190 | | | | | | hackertarget |
| 16 | xmail.tesla.com | 204.74.99.100 | | | | | | hackertarget |
| 17 | comparison.tesla.com | 64.125.183.133 | | | | | | hackertarget |
| 18 | emails.tesla.com | 13.111.18.27 | | | | | | hackertarget |
| 19 | mta2.emails.tesla.com | 13.111.88.1 | | | | | | hackertarget |
| 20 | mta3.emails.tesla.com | 13.111.88.2 | | | | | | hackertarget |
| 21 | mta4.emails.tesla.com | 13.111.88.52 | | | | | | hackertarget |
| 22 | mta5.emails.tesla.com | 13.111.88.53 | | | | | | hackertarget |
| 23 | mta.emails.tesla.com | 13.111.62.118 | | | | | | hackertarget |
| 24 | click.emails.tesla.com | 13.111.48.179 | | | | | | hackertarget |
| 25 | view.emails.tesla.com | 13.111.49.179 | | | | | | hackertarget |
| 26 | events.tesla.com | 13.111.47.195 | | | | | | hackertarget |
| 27 | shop.eu.tesla.com | 205.234.27.221 | | | | | | hackertarget |
+---------------------------------------------------------------------------------------------------------------------+
Disclaimer: the used Recon-ng version here is <code>recon-ng v5.1.1</code>, which is important to note, because countless tutorials on the internet refer to older commands which no longer work, so you kind of really have to play around with it to see which modules work (because some don't) and what commands are available by always utilizing the <code>help</code> flag along the way.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A powerful framework that offers many modules to perform reconnaissance on web-hosts. Personally would not recommend to newbies, simply because it is not that easy and intuitive to navigate, some modules are not working and the documentation is pretty lacking, with internet tutorials often showing old versions of commands.</div>
For more information please refer to the official [https://tools.kali.org/information-gathering/recon-ng documentation] or Github, however the documentation in this case is quite lacking.

=== Maltego ===
Category: Information Gathering - OSINT 
Maltego is a graphical footprinting tool with quite some extensions available. With the preinstalled extensions you can allready footprint any domain and view it as a tree. where this tree is formatted according to the amount discovered and may change to a mesh view, if it would get too crowded.

[[File:Elvis.science.png|thumb|none|700px|Example footprinting of elvis.science]]

There is allready a page in this wiki for Maltego about how to create network trees yourself step by step and without the use of extensions: [[Maltego]]
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: An extensive tool for footprinting that can look intimidating at first glance, but will help a lot gathering and saving information in a graphical way. It's easy to learn, offers quick success on learning and there are countless instuctions online on how to use Maltego for any level.</div>
For more information please refer to the official [https://www.maltego.com/ homepage] or an online instruction of your choice.

=== Netdiscover ===
Category: Information Gathering - Route Analysis 
This is another reconnaissance tool that can be used for host discovery on wireless and switched networks. You can scan your subnet at home or at work, wherever your device is connected. It works through ARP requests and can detect hosts either by actively sending requests, or if you set it to passive mode, only by sniffing. 
If Nmap is too much for a given moment and you just want to see quickly who is in your network, this is the way to go. Below is a comparison of Netdiscover used on a local subnet, a very well-arranged output, and nmap, which in some situations offers too much:
$ netdiscover -r 192.168.0.0/24
20 Captured ARP Req/Rep packets, from 16 hosts. Total size: 1200
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.0.1 00:xx:xx:xx:xx:c2 2 120 Cisco Systems, Inc
192.168.0.9 00:xx:xx:xx:xx:a9 1 60 Weinzierl Engineering GmbH
192.168.0.10 50:xx:xx:xx:xx:c7 1 60 Loxone Electronics GmbH
192.168.0.80 54:xx:xx:xx:xx:a0 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.81 18:xx:xx:xx:xx:50 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.82 54:xx:xx:xx:xx:ff 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.83 28:xx:xx:xx:xx:27 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.84 18:xx:xx:xx:xx:d7 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.101 48:xx:xx:xx:xx:2e 1 60 ZENNIO AVANCE Y TECNOLOGIA, S.L.
192.168.0.102 00:xx:xx:xx:xx:bb 1 60 VMware, Inc.
192.168.0.109 fc:xx:xx:xx:xx:f9 4 240 Ubiquiti Networks Inc.
192.168.0.112 04:xx:xx:xx:xx:a5 1 60 ASUSTek COMPUTER INC.
192.168.0.132 00:xx:xx:xx:xx:d4 1 60 VMware, Inc.
192.168.0.149 c4:xx:xx:xx:xx:48 1 60 Hewlett Packard
192.168.0.172 8c:xx:xx:xx:xx:eb 1 60 Apple, Inc.
192.168.0.195 f2:xx:xx:xx:xx:3a 1 60 Unknown vendor
If you were to do this same information in Nmap, you would need to perform a host discovery scan first:
$ nmap -sP 192.168.0.0/24 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-20 16:34 CEST
Nmap scan report for 192.168.0.1 Host is up (0.0051s latency).
Nmap scan report for 192.168.0.10 Host is up (0.00058s latency).
Nmap scan report for 192.168.0.80 Host is up (0.00034s latency).
Nmap scan report for 192.168.0.81 Host is up (0.0018s latency).
Nmap scan report for 192.168.0.82 Host is up (0.0017s latency).
Nmap scan report for 192.168.0.83 Host is up (0.0037s latency).
Nmap scan report for 192.168.0.84 Host is up (0.0019s latency).
Nmap scan report for 192.168.0.101 Host is up (0.00045s latency).
Nmap scan report for 192.168.0.102 Host is up (0.00018s latency).
Nmap scan report for 192.168.0.107 Host is up (0.00021s latency).
Nmap scan report for 192.168.0.109 Host is up (0.00049s latency).
Nmap scan report for 192.168.0.132 Host is up (0.00033s latency).
Nmap scan report for 192.168.0.172 Host is up (0.089s latency).
Nmap done: 256 IP addresses (13 hosts up) scanned in 2.42 seconds
Only then you can scan each alive host separately for their Hostname/OS/MAC address with <code>sudo nmap -O <IP address></code>. That is unless you want to wait several hours by scanning the whole subnet for their OS which I would not recommend since it takes so long. If you need a quick swipe, Nmap is possibly the inferior option here and could be used once you want to find out more about each host, their ports etc.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Definitely a useful tool for an initial scan, or in a case where you don't know what range to look for exactly, since it is very fast. If you just want to find alive hosts and their IPs in a big range, this would be a good option. Nmap however, offers alive hosts discovery as well, and if you turn portscan off, it will be much faster than Netdiscover. Netdiscover kind of connects the various options of Nmap by showing IPs, MACs and Hostnames and makes it fairly easy to use, without having to read the extensive documentation of Nmap in the hope to find the correct options to perform a simple initial scan.</div>
For more information please refer to the full [https://manpages.debian.org/unstable/netdiscover/netdiscover.8.en.html tool documentation].

=== Ike-scan ===
Category: Information Gathering - general 
Ike-scan is useful for VPN endpoints. To explain this a little, first we should know what IKE is. It is Internet Key Exchange protocol, which is used by IPsec. The majority of IPsec VPNs use IKE for key exchange. The Ike-scan tool is for discovering, testing and fingerprinting IPsec VPN systems. It sends IKE phase 1 packets to the target and displays the received responses. To be able to test this, we now need a target that we are certain uses IKE for key exchange. To achieve this, we will demonstrate this on an IP address found through www.shodan.io, where you need to search for the keyword "IKE" to find targets that satisfy this condition. For demonstration, we chose the IP 110.142.206.85, which should be a VPN in Melbourne, Australia.
$ ike-scan 110.142.206.85
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
110.142.206.85 Main Mode Handshake returned HDR=(CKY-R=49cc50cbfcf85509) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=dbfb81eb5760b0788562067da102d755 VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) VID=12f5f28c457168a9702d9fe274cc0100 (Cisco Unity)
Ending ike-scan 1.9.4: 1 hosts scanned in 0.356 seconds (2.81 hosts/sec). 1 returned handshake; 0 returned notify
This returns the main mode handshake and shows information like security associations (hash, encoding, authentication) and also vendor ID etc.
 The following scan tries to fingerprint the firewall in use and additionally to the previous output it shows the following:
$ ike-scan --showbackoff -v -v 110.142.206.85
DEBUG: pkt len=336 bytes, bandwidth=56000 bps, int=52000 us
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
--- Sending packet #1 to host entry 1 (110.142.206.85) tmo 500000 us
--- Received packet #1 from 110.142.206.85
--- Removing host entry 1 (110.142.206.85) - Received 152 bytes
IKE Backoff Patterns:
IP Address No. Recv time Delta Time
110.142.206.85 1 1624204029.790995 0.000000
110.142.206.85 Implementation guess: Linksys Etherfast
Ending ike-scan 1.9.4: 1 hosts scanned in 60.426 seconds (0.02 hosts/sec). 1 returned handshake; 0 returned notify
There is a possibility to use the so called aggressive mode (default is Main Mode) which uses a 3-way-handshake where the VPN sends an unencrypted message to the client containing the hashed PSK. If you manage to capture the plaintext hash, you could use psk-crack to perform a brute force attack and try to recover the PSK (Pre-shared key).
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is not a very well known tool, however it can offer some valuable insights to experienced security experts and a possibility to use the recovered data in further exploitation/scanning.</div>
For more information please refer to the full [https://linux.die.net/man/1/ike-scan tool documentation].

=== Dnsenum ===
Category: Information Gathering - DNS Analysis 
This is an efficient and well-performing tool for locating all DNS servers and DNS entries for a given organization. A basic demonstration on the example of <code>google.com</code> is shown below (some entries have been replaced with ... to keep it as short as possible):
$ dnsenum google.com 255 ⨯
dnsenum VERSION:1.2.6
----- google.com -----
Host's addresses:
__________________
google.com. 300 IN A 216.58.201.78
Name Servers:
______________

ns2.google.com. 345600 IN A 216.239.34.10
ns4.google.com. 345600 IN A 216.239.38.10
ns1.google.com. 345600 IN A 216.239.32.10
ns3.google.com. 345600 IN A 216.239.36.10

Mail (MX) Servers:
___________________

aspmx.l.google.com. 293 IN A 173.194.69.27
alt1.aspmx.l.google.com. 293 IN A 142.250.150.27
alt2.aspmx.l.google.com. 293 IN A 74.125.200.27
alt3.aspmx.l.google.com. 293 IN A 142.250.157.27
alt4.aspmx.l.google.com. 293 IN A 173.194.202.26

Trying Zone Transfers and getting Bind Versions:
_________________________________________________
Trying Zone Transfer for google.com on ns1.google.com ...
AXFR record query failed: corrupt packet
...
Trying Zone Transfer for google.com on ns4.google.com ...
AXFR record query failed: corrupt packet

Brute forcing with /usr/share/dnsenum/dns.txt:
_______________________________________________

about.google.com. 0 IN CNAME www3.l.google.com.
www3.l.google.com. 300 IN A 172.217.23.238
accounts.google.com. 300 IN A 172.217.23.205
admin.google.com. 300 IN A 172.217.23.206
ads.google.com. 300 IN A 216.58.201.78
america.google.com. 0 IN CNAME www3.l.google.com.
...
www.google.com. 300 IN A 172.217.23.196

google.com class C netranges:
______________________________

8.8.4.0/24
8.8.8.0/24
...
216.239.36.0/24
216.239.38.0/24

Performing reverse lookup on 4096 ip addresses:
________________________________________________

68.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
69.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
70.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
10.32.239.216.in-addr.arpa. 86400 IN PTR ns1.google.com.
11.32.239.216.in-addr.arpa. 86400 IN PTR ns.google.com.
15.32.239.216.in-addr.arpa. 86400 IN PTR time1.google.com.
116.32.239.216.in-addr.arpa. 86400 IN PTR e2a.google.com.
10.34.239.216.in-addr.arpa. 86400 IN PTR ns2.google.com.
10.36.239.216.in-addr.arpa. 86400 IN PTR ns3.google.com.
11.36.239.216.in-addr.arpa. 86400 IN PTR hedns1.google.com.
10.38.239.216.in-addr.arpa. 86400 IN PTR ns4.google.com.

11 results out of 4096 IP addresses.

google.com ip blocks:
______________________

64.9.224.68/31
64.9.224.70/32
216.239.32.10/31
216.239.32.15/32
216.239.32.116/32
216.239.34.10/32
216.239.36.10/31
216.239.38.10/32

done.
You can also use the --enum flag to gather whois information and to dig up subdomains.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A very convenient and useful tool for DNS information gathering on domains/servers etc. Results are also very well arranged and offer a clear overview.</div>
For more information please refer to the full [https://tools.kali.org/information-gathering/dnsenum tool documentation].

=== Swaks ===
Category: Information Gathering - SMTP Scan 
This tool is for sending e-mails of all kinds. Now, compared to a regular e-mail client, here you can change the header, attachments, which server to talk to and more. It handles TLS, authentication, and pipelining.
 Since I don't have my own SMTP server available, for demonstration purposes we will use the Gmail's SMTP server:
$ swaks -t example.receiver@gmail.com -s smtp.gmail.com:587 -tls -a LOGIN
You will then be prompted to enter Gmail credentials of an actual existing account. However, from security reasons, Gmail will probably block this login attempt, that's why using your own SMTP server would be ideal. To have a look at some more examples of changing headers and using different servers, please refer [https://github.com/jetmore/swaks/blob/v20201014.0/doc/base.pod here].

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This tool is known as the Swiss Army Knife for SMTP (=Swaks) and helps you with the complexity of setting up e-mail servers. You have many various possibilities of choosing a mail server and changing headers and other data, that you wouldn't have if you sent an email from a simple public mail server.</div>
For more information please refer to the full [https://linux.die.net/man/1/swaks tool documentation].

=== SSLdump ===
Category: Information Gathering - SSL Analysis 
SSLdump is a TLS/SSL network protocol analyzer that identifies TCP streams/connections from a specified port and interface and attempts to interpret them. Once it identifies SSL/TLS traffic, it decodes and displays the content in a readable form as text. If you provide a necessary key as well, it can decrypt the connection fully and display the exchanged application data traffic (<code>ssldump -Ad -k ~/privatekey.pem -p password -i eth0 host user123</code>). Below is a demonstration of a basic command that listens to traffic on port 443 of interface eth0:

$ sudo ssldump -i eth0 port 443
New TCP connection #2: 192.168.0.102(53984) <-> edge-star-mini-shv-01-vie1.facebook.com(443)
2 1 0.0096 (0.0096) C>S Handshake
ClientHello
Version 3.3
resume [32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipher suites
TLS_AES_128_GCM_SHA256
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
compression methods
NULL
extensions
server_name
host_name: www.facebook.com
extended_master_secret
renegotiation_info
supported_groups
ec_point_formats
session_ticket
application_layer_protocol_negotiation
status_request
key_share
supported_versions
signature_algorithms
psk_key_exchange_modes
record_size_limit
padding
ja3 string:
771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-51-43-13-45-28-21,29-23-24-25-256-257,0
ja3 fingerprint: aa7744226c695c0b2e440419848cf700
2 2 0.0146 (0.0049) S>C Handshake
ServerHello
Version 3.3
session_id[32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipherSuite TLS_AES_128_GCM_SHA256
compressionMethod NULL
extensions
supported_versions
key_share
ja3s string: 771,4865,43-51
ja3s fingerprint: f4febc55ea12b31ae17cfb7e614afda8
2 3 0.0146 (0.0000) S>C ChangeCipherSpec
2 4 0.0146 (0.0000) S>C application_data

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This seems to be a very powerful tool with which you can actually sniff SSL encrypted traffic, and even if you don't have the private key, you can see the TLS handshake and the hello's from client and server together with their exchanged cipher suites.</div>
For more information please refer to the full [https://linux.die.net/man/1/ssldump tool documentation].

== What's different in ParrotOS? ==
As we know, you can install any tools from Kali also on ParrotOS, and the other way around, that's why in this context, the preinstalled tools are meant. Overall you can say, that the "main" tools are the same on both operating systems.
<div><ul>
<li style="display: inline-block;"> [[File:ComparisonKaliParr.png|thumb|none|500px|Information Gathering Tools Menu Preview Comparison]] </li>
</ul></div>
On the first glance the tools look very similar, however when you click on the the various sub-categories, you can see that Parrot offers a greater range of tools. Refer to the table below for a detailed overview:

<table class="wikitable" style="width: 50%>
<tr>
<th style="background-color: #ccccff; color: #000000;">Tool Category</th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Kali<<<<< </th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Parrot<<<<< </th>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">DNS Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsenum
 dnsrecon
 fierce 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsdict6
 dnsenum
 dnsmap
 dnsrecon
 dnstracer
 dnswalk
 fierce
 gobuster
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">IDS/IPS Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 wafw00f 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 fragrouter
 ftest 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Live Host Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 fping
 hping3
 masscan
 thcping6 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 cdpsnarf
 detect-new-ip6
 fping
 hping3
 inverse_lookup6
 ncat
 passive_discovery6
 thcping6
 xprobe2 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Network & port scanners</td>
<td style="background-color: #f4f4ff; color: #000000;">
masscan
 nmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
amap
 etherape
 masscan
 nmap
 unicornscan
 wireshark 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">OSINT Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
maltego
 spiderfoot
 spiderfoot-cli
 theharvester 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
casefile
 maltego
 metagoofil
 theharvester
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Route Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
netdiscover
 netmask 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
0trace
 intrace
 irpas-ass
 irpass-cdp
 netmask
 trace6 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMB Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMTP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">swaks</td>
<td style="background-color: #f4f4ff; color: #000000;">
smtp-user-enum
 swaks 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SNMP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
onesixtyone
 snmp-check 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
braa
 onesixtyone
 snmp-check 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SSL Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
</tr>

</table>

== References ==

* https://www.parrotsec.org/docs/
* https://www.kali.org/docs/

[[Category:Pentesting]]

Information Gathering Tools

2021-06-24T08:30:02Z

MFriedl:

== Summary ==

This is a draft. Comparing various available pre-installed information gathering tools in Kali and comparing differences to ParrotOS. This document is NOT a documentation of the tools, it is merely a comparison and practical evaluation of the tools for an average security specialist or a security newbie wanting to start using the tools.

== Requirements ==

* Operating system: Kali Linux 2021.1 amd64, Parrot Security 4.10 amd64
Disclaimer: all possible examples and tests done have been done in VMWare in a Kali Linux 2021.1 and the commands are up-to-date as of 21st June 2021.

== Tools==

=== Nmap ===
Category: Information Gathering - Network & Port Scanners 
Nmap is known to be a very powerful tool for information gathering and vulnerability scanning. It offers loads of options, offering for example for host discovery, scans (TCP, UDP, IP...), service/version detection, OS detection, firewalls/IDS evasion and spoofing, script scanning etc. Since this is not meant to be a [https://nmap.org/book/man.html full documentation] of the tools, but rather an evaluation overview, compared to the other tools in this category, Nmap is the one main tool that most of the other secondary tools are using and it is very powerful. See the following tools for some comparison and Nmap examples.

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: If your goal is to perform a network scan to determine alive hosts, open ports, used systems on ports or used operation systems on the hosts, this would be the way to go. It is fast and efficient (speed depends on the range of hosts and ports scanned though). The other tools that offer these results are using Nmap anyway, for example the way DMitry or Legion use it.</div>
For more information please refer to the full [https://nmap.org/book/man.html tool documentation].

=== Spiderfoot ===
Category: Information Gathering - OSINT 
This is a reconnaissance framework that uses many modules for information gathering, working on the OSINT principle. You can access a GUI by starting the framework on a port on localhost and accessing that address via web browser once it starts:
 <code>$ spiderfoot -l 127.0.0.1:5001</code> 
You can then set up a new scan, where you would give the program a target: this can be a domain/sub-domain name, IPv4 or IPv6 address, hostname, subnet, ASN, e-mail address, phone number, a person's actual name or username. This gives a really wide spectrum on options. The full scan is demonstrated below.
scan www.fh-campuswien.ac.at for a full scan, where you "get anything and everything about the target":
Execution takes many days, depending on the size of the target and the information available on the internet to that target. This specific inquiry took several days to complete and collect all information. Some parts of the information is displayed below, however the results were much more extensive:
<div><ul>
<li style="display: inline-block;"> [[File:Spiderscan.png|thumb|none|800px|Results of Spiderfoot Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is a very good and very powerful reconnaissance framework. It really collects "anything and everything" about a target, as it states. The scans take a very long time, but the amount of information connected is priceless, it really searches through the whole www to provide any and every connection to the target. Based on the very user friendly and well-arranged GUI it is quite good for beginners too, however the amount of data delivered is useful only for professional security analysts who know what to do with the results, how to navigate them and how to interpret them.</div>
For more information please refer to the full [https://www.spiderfoot.net/documentation/ tool documentation].

=== Legion ===
Category: Information Gathering - general 
Legion is a GUI tool, a network penetration testing framework, that offers many options. It automatically detects CVEs and provides nmap, Vulners, whataweb, webslayer, sslyzer, SMBenum, dirbuster, nikto, Hydra and other additional scripts. Its execution takes up to a couple of minutes. A demonstration:
scan www.fh-campuswien.ac.at
<div><ul>
<li style="display: inline-block;"> [[File:Legion scan.png|thumb|none|600px|Results of Legion Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
No CVEs have been found. Below is a comparison with the Metasploitable2 machine that can be found in the same subnet, so that it is clear how the vulnerabilities are shown in an actual weak system:
<div><ul>
<li style="display: inline-block;"> [[File:Meta legion.png|thumb|none|1000px|Results of Legion Scan on Metasploitable2 VM]] </li>
</ul></div>
It is safe to say that it is a very powerful and useful tool, also very user friendly and quite fast. Maybe not the best for domains in the internet because it won't offer much more information than nmap and whois lookup, but when you look at the metasploitable output, so a scan of a server, you can see how much information is shown. The implementation of Hydra also gets you the cracked passwords in the vulnerabilities which is very useful. 
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall definitely a recommended tool, nice GUI, works quickly and efficiently and is very well arranged and easy to navigate.</div>
For more information please refer to the full [https://govanguard.com/legion/#about-legion official Legion Framework website].

=== DMitry===
Category: Information Gathering - general 
DMitry is a CLI tool to gather information about a host - possible subdomains, uptime information, tcp port scan, email addresses, whois lookups etc. It is mostly used to reveal information that exists through search engines about the owner or host of a web page, i.e. for social engineering attacks.
 
When using the portscan option, the results show less open ports than doing that same TCP scan with nmap.
 DMitry:
HostIP:192.168.0.130
HostName:
Gathered TCP Port information for 192.168.0.130
Port State
23/tcp open
Portscan Finished: Scanned 150 ports, 148 ports were in state closed
Nmap:
Nmap scan report for 192.168.0.130
Host is up (0.20s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
23/tcp open telnet
554/tcp open rtsp
843/tcp open unknown
5001/tcp open commplex-link
MAC Address: 7C:DD:90:AF:4E:7D (Shenzhen Ogemray Technology)
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

To find out information about a domain, you need either the IP or the domain same.
 Whois lookup on the other hand gets you some nice useful results. Below is an example of using <code>dmitry -w www.fh-campuswien.ac.at</code> on the college website of FH Campus Wien www.fh-campuswien.ac.at, and it just goes to show that it is exactly the same output as if you were to type <code>whois fh-campuswien.ac.at</code>
HostIP:91.213.77.62
HostName:www.fh-campuswien.ac.at
Gathered Inic-whois information for fh-campuswien.ac.at
---------------------------------
domain: fh-campuswien.ac.at
registrar:
registrant: FCW1942152-NICAT
admin-c: <data not disclosed>
tech-c: NLTU11579014-NICAT
nserver: ns.nextlayer.at
remarks: 81.16.150.30
nserver: ns2.nextlayer.at
remarks: 81.16.151.30
changed: 20171003 19:16:08
source: AT-DOM
personname:
organization: fh campus wien
street address: Favoritenstrasse 226
postal code: A-1100
city: Vienna
country: Austria
phone: +43160668771000
fax-no: +43160668771009
e-mail: office@fh-campuswien.ac.at
nic-hdl: FCW1942152-NICAT
changed: 20100323 17:12:46
source: AT-DOM
personname: Hostmaster Hostmaster
organization: next layer Telekommunikationsdienstleistungs- und BeratungsGmbH
street address: Mariahilfer Guertel 37- 7
postal code: 1150
city: Vienna
country: Austria
phone: +43517649
e-mail: hostmaster@nextlayer.at
nic-hdl: NLTU11579014-NICAT
changed: 20170929 13:17:54
source: AT-DOM

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall a nice tool, useful for beginners who don't have experience with the basic tools yet. However, to an experienced IT Security specialist, the tools that DMitry is based on, like nmap and whois would be the better choice to use here, since they just offer you the same output and nmap and whois itself offer much more options. One drawback however is that you need to install whois separately, whilst DMitry will be in the preinstalled set of tools. When it comes to portscan, it offers pretty insufficient results in DMitry.
This tool is fairly outdated nowadays, although it used to be very good a few years ago. Now there are better alternatives.</div>
For more information please refer to the full [https://linux.die.net/man/1/dmitry tool documentation].

=== Recon-ng ===
Category: Information Gathering - general 
On the first glance, it looks very similar to Metasploit. You can start it via the command line and enter an environment in the shell. It is a python web reconnaissance framework designed specifically for web-based information gathering, and is, unlike Metasploit, not an exploitation framework. 
To navigate it, always utilize the help flag to view possible options. At first, you won't have any modules enables/installed, which is kind of confusing and one really has to look into the documentation first before using it because the shell environment isn't that intuitive. 
To view available modules, use <code>show modules</code>. When you want to start now, create a workspace first where your retrieved data will be saved:
[recon-ng][default] > workspaces create test
Now install the module you would like to use, we will use hackertarget to get subdomains. You can use <code>marketplace search hackertarget</code> to view the module and install it by:
[recon-ng][test] > marketplace install hackertarget
[*] Module installed: recon/domains-hosts/hackertarget
[*] Reloading modules...
Now we will load the module and set the source of input, which we want to retrieve data from. With the command <code>info</code> or <code>input</code> you can view the current source. Execute the module with <code>run</code>:
[recon-ng][test] > modules load hackertarget
[recon-ng][test][hackertarget] > options set SOURCE tesla.com
[recon-ng][test][hackertarget] > run
This will get you 27 found hosts, after the <code>show hosts</code> command you can review them in an arranged list:
+---------------------------------------------------------------------------------------------------------------------+
| rowid | host | ip_address | region | country | latitude | longitude | notes | module |
+---------------------------------------------------------------------------------------------------------------------+
| 1 | tesla.com | 199.66.11.62 | | | | | | hackertarget |
| 2 | o7.ptr6980.tesla.com | 149.72.144.42 | | | | | | hackertarget |
| 3 | vpn1.tesla.com | 8.45.124.215 | | | | | | hackertarget |
| 4 | model3.tesla.com | 205.234.27.221 | | | | | | hackertarget |
| 5 | o3.ptr1444.tesla.com | 149.72.152.236 | | | | | | hackertarget |
| 6 | o2.ptr556.tesla.com | 149.72.134.64 | | | | | | hackertarget |
| 7 | o5.ptr8466.tesla.com | 149.72.172.170 | | | | | | hackertarget |
| 8 | o6.ptr9437.tesla.com | 168.245.123.10 | | | | | | hackertarget |
| 9 | o4.ptr1867.tesla.com | 149.72.163.58 | | | | | | hackertarget |
| 10 | mobile.tesla.com | 209.133.79.82 | | | | | | hackertarget |
| 11 | marketing.tesla.com | 13.111.47.196 | | | | | | hackertarget |
| 12 | o1.ptr2410.link.tesla.com | 149.72.247.52 | | | | | | hackertarget |
| 13 | referral.tesla.com | 72.10.32.90 | | | | | | hackertarget |
| 14 | mta2.email.tesla.com | 13.111.4.231 | | | | | | hackertarget |
| 15 | mta.email.tesla.com | 13.111.14.190 | | | | | | hackertarget |
| 16 | xmail.tesla.com | 204.74.99.100 | | | | | | hackertarget |
| 17 | comparison.tesla.com | 64.125.183.133 | | | | | | hackertarget |
| 18 | emails.tesla.com | 13.111.18.27 | | | | | | hackertarget |
| 19 | mta2.emails.tesla.com | 13.111.88.1 | | | | | | hackertarget |
| 20 | mta3.emails.tesla.com | 13.111.88.2 | | | | | | hackertarget |
| 21 | mta4.emails.tesla.com | 13.111.88.52 | | | | | | hackertarget |
| 22 | mta5.emails.tesla.com | 13.111.88.53 | | | | | | hackertarget |
| 23 | mta.emails.tesla.com | 13.111.62.118 | | | | | | hackertarget |
| 24 | click.emails.tesla.com | 13.111.48.179 | | | | | | hackertarget |
| 25 | view.emails.tesla.com | 13.111.49.179 | | | | | | hackertarget |
| 26 | events.tesla.com | 13.111.47.195 | | | | | | hackertarget |
| 27 | shop.eu.tesla.com | 205.234.27.221 | | | | | | hackertarget |
+---------------------------------------------------------------------------------------------------------------------+
Disclaimer: the used Recon-ng version here is <code>recon-ng v5.1.1</code>, which is important to note, because countless tutorials on the internet refer to older commands which no longer work, so you kind of really have to play around with it to see which modules work (because some don't) and what commands are available by always utilizing the <code>help</code> flag along the way.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A powerful framework that offers many modules to perform reconnaissance on web-hosts. Personally would not recommend to newbies, simply because it is not that easy and intuitive to navigate, some modules are not working and the documentation is pretty lacking, with internet tutorials often showing old versions of commands.</div>
For more information please refer to the official [https://tools.kali.org/information-gathering/recon-ng documentation] or Github, however the documentation in this case is quite lacking.

=== Maltego ===
Category: Information Gathering - OSINT 
Maltego is a graphical footprinting tool with quite some extensions available. With the preinstalled extensions you can allready footprint any domain and view it as a tree. where this tree is formatted according to the amount discovered and may change to a mesh view, if it would get too crowded.

[[File:Elvis.science.png|thumb|none|700px|Example footprinting of elvis.science]]

There is allready a page in this wiki for Maltego about how to create network trees yourself step by step and without the use of extensions: [[Maltego]]
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: An extensive tool for footprinting that can look intimidating at first glance, but will help a lot gathering and saving information in a graphical way. It's easy to learn, offers quick success on learning and there are countless instuctions online on how to use Maltego for any level.</div>

=== Netdiscover ===
Category: Information Gathering - Route Analysis 
This is another reconnaissance tool that can be used for host discovery on wireless and switched networks. You can scan your subnet at home or at work, wherever your device is connected. It works through ARP requests and can detect hosts either by actively sending requests, or if you set it to passive mode, only by sniffing. 
If Nmap is too much for a given moment and you just want to see quickly who is in your network, this is the way to go. Below is a comparison of Netdiscover used on a local subnet, a very well-arranged output, and nmap, which in some situations offers too much:
$ netdiscover -r 192.168.0.0/24
20 Captured ARP Req/Rep packets, from 16 hosts. Total size: 1200
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.0.1 00:xx:xx:xx:xx:c2 2 120 Cisco Systems, Inc
192.168.0.9 00:xx:xx:xx:xx:a9 1 60 Weinzierl Engineering GmbH
192.168.0.10 50:xx:xx:xx:xx:c7 1 60 Loxone Electronics GmbH
192.168.0.80 54:xx:xx:xx:xx:a0 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.81 18:xx:xx:xx:xx:50 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.82 54:xx:xx:xx:xx:ff 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.83 28:xx:xx:xx:xx:27 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.84 18:xx:xx:xx:xx:d7 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.101 48:xx:xx:xx:xx:2e 1 60 ZENNIO AVANCE Y TECNOLOGIA, S.L.
192.168.0.102 00:xx:xx:xx:xx:bb 1 60 VMware, Inc.
192.168.0.109 fc:xx:xx:xx:xx:f9 4 240 Ubiquiti Networks Inc.
192.168.0.112 04:xx:xx:xx:xx:a5 1 60 ASUSTek COMPUTER INC.
192.168.0.132 00:xx:xx:xx:xx:d4 1 60 VMware, Inc.
192.168.0.149 c4:xx:xx:xx:xx:48 1 60 Hewlett Packard
192.168.0.172 8c:xx:xx:xx:xx:eb 1 60 Apple, Inc.
192.168.0.195 f2:xx:xx:xx:xx:3a 1 60 Unknown vendor
If you were to do this same information in Nmap, you would need to perform a host discovery scan first:
$ nmap -sP 192.168.0.0/24 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-20 16:34 CEST
Nmap scan report for 192.168.0.1 Host is up (0.0051s latency).
Nmap scan report for 192.168.0.10 Host is up (0.00058s latency).
Nmap scan report for 192.168.0.80 Host is up (0.00034s latency).
Nmap scan report for 192.168.0.81 Host is up (0.0018s latency).
Nmap scan report for 192.168.0.82 Host is up (0.0017s latency).
Nmap scan report for 192.168.0.83 Host is up (0.0037s latency).
Nmap scan report for 192.168.0.84 Host is up (0.0019s latency).
Nmap scan report for 192.168.0.101 Host is up (0.00045s latency).
Nmap scan report for 192.168.0.102 Host is up (0.00018s latency).
Nmap scan report for 192.168.0.107 Host is up (0.00021s latency).
Nmap scan report for 192.168.0.109 Host is up (0.00049s latency).
Nmap scan report for 192.168.0.132 Host is up (0.00033s latency).
Nmap scan report for 192.168.0.172 Host is up (0.089s latency).
Nmap done: 256 IP addresses (13 hosts up) scanned in 2.42 seconds
Only then you can scan each alive host separately for their Hostname/OS/MAC address with <code>sudo nmap -O <IP address></code>. That is unless you want to wait several hours by scanning the whole subnet for their OS which I would not recommend since it takes so long. If you need a quick swipe, Nmap is possibly the inferior option here and could be used once you want to find out more about each host, their ports etc.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Definitely a useful tool for an initial scan, or in a case where you don't know what range to look for exactly, since it is very fast. If you just want to find alive hosts and their IPs in a big range, this would be a good option. Nmap however, offers alive hosts discovery as well, and if you turn portscan off, it will be much faster than Netdiscover. Netdiscover kind of connects the various options of Nmap by showing IPs, MACs and Hostnames and makes it fairly easy to use, without having to read the extensive documentation of Nmap in the hope to find the correct options to perform a simple initial scan.</div>
For more information please refer to the full [https://manpages.debian.org/unstable/netdiscover/netdiscover.8.en.html tool documentation].

=== Ike-scan ===
Category: Information Gathering - general 
Ike-scan is useful for VPN endpoints. To explain this a little, first we should know what IKE is. It is Internet Key Exchange protocol, which is used by IPsec. The majority of IPsec VPNs use IKE for key exchange. The Ike-scan tool is for discovering, testing and fingerprinting IPsec VPN systems. It sends IKE phase 1 packets to the target and displays the received responses. To be able to test this, we now need a target that we are certain uses IKE for key exchange. To achieve this, we will demonstrate this on an IP address found through www.shodan.io, where you need to search for the keyword "IKE" to find targets that satisfy this condition. For demonstration, we chose the IP 110.142.206.85, which should be a VPN in Melbourne, Australia.
$ ike-scan 110.142.206.85
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
110.142.206.85 Main Mode Handshake returned HDR=(CKY-R=49cc50cbfcf85509) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=dbfb81eb5760b0788562067da102d755 VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) VID=12f5f28c457168a9702d9fe274cc0100 (Cisco Unity)
Ending ike-scan 1.9.4: 1 hosts scanned in 0.356 seconds (2.81 hosts/sec). 1 returned handshake; 0 returned notify
This returns the main mode handshake and shows information like security associations (hash, encoding, authentication) and also vendor ID etc.
 The following scan tries to fingerprint the firewall in use and additionally to the previous output it shows the following:
$ ike-scan --showbackoff -v -v 110.142.206.85
DEBUG: pkt len=336 bytes, bandwidth=56000 bps, int=52000 us
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
--- Sending packet #1 to host entry 1 (110.142.206.85) tmo 500000 us
--- Received packet #1 from 110.142.206.85
--- Removing host entry 1 (110.142.206.85) - Received 152 bytes
IKE Backoff Patterns:
IP Address No. Recv time Delta Time
110.142.206.85 1 1624204029.790995 0.000000
110.142.206.85 Implementation guess: Linksys Etherfast
Ending ike-scan 1.9.4: 1 hosts scanned in 60.426 seconds (0.02 hosts/sec). 1 returned handshake; 0 returned notify
There is a possibility to use the so called aggressive mode (default is Main Mode) which uses a 3-way-handshake where the VPN sends an unencrypted message to the client containing the hashed PSK. If you manage to capture the plaintext hash, you could use psk-crack to perform a brute force attack and try to recover the PSK (Pre-shared key).
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is not a very well known tool, however it can offer some valuable insights to experienced security experts and a possibility to use the recovered data in further exploitation/scanning.</div>
For more information please refer to the full [https://linux.die.net/man/1/ike-scan tool documentation].

=== Dnsenum ===
Category: Information Gathering - DNS Analysis 
This is an efficient and well-performing tool for locating all DNS servers and DNS entries for a given organization. A basic demonstration on the example of <code>google.com</code> is shown below (some entries have been replaced with ... to keep it as short as possible):
$ dnsenum google.com 255 ⨯
dnsenum VERSION:1.2.6
----- google.com -----
Host's addresses:
__________________
google.com. 300 IN A 216.58.201.78
Name Servers:
______________

ns2.google.com. 345600 IN A 216.239.34.10
ns4.google.com. 345600 IN A 216.239.38.10
ns1.google.com. 345600 IN A 216.239.32.10
ns3.google.com. 345600 IN A 216.239.36.10

Mail (MX) Servers:
___________________

aspmx.l.google.com. 293 IN A 173.194.69.27
alt1.aspmx.l.google.com. 293 IN A 142.250.150.27
alt2.aspmx.l.google.com. 293 IN A 74.125.200.27
alt3.aspmx.l.google.com. 293 IN A 142.250.157.27
alt4.aspmx.l.google.com. 293 IN A 173.194.202.26

Trying Zone Transfers and getting Bind Versions:
_________________________________________________
Trying Zone Transfer for google.com on ns1.google.com ...
AXFR record query failed: corrupt packet
...
Trying Zone Transfer for google.com on ns4.google.com ...
AXFR record query failed: corrupt packet

Brute forcing with /usr/share/dnsenum/dns.txt:
_______________________________________________

about.google.com. 0 IN CNAME www3.l.google.com.
www3.l.google.com. 300 IN A 172.217.23.238
accounts.google.com. 300 IN A 172.217.23.205
admin.google.com. 300 IN A 172.217.23.206
ads.google.com. 300 IN A 216.58.201.78
america.google.com. 0 IN CNAME www3.l.google.com.
...
www.google.com. 300 IN A 172.217.23.196

google.com class C netranges:
______________________________

8.8.4.0/24
8.8.8.0/24
...
216.239.36.0/24
216.239.38.0/24

Performing reverse lookup on 4096 ip addresses:
________________________________________________

68.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
69.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
70.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
10.32.239.216.in-addr.arpa. 86400 IN PTR ns1.google.com.
11.32.239.216.in-addr.arpa. 86400 IN PTR ns.google.com.
15.32.239.216.in-addr.arpa. 86400 IN PTR time1.google.com.
116.32.239.216.in-addr.arpa. 86400 IN PTR e2a.google.com.
10.34.239.216.in-addr.arpa. 86400 IN PTR ns2.google.com.
10.36.239.216.in-addr.arpa. 86400 IN PTR ns3.google.com.
11.36.239.216.in-addr.arpa. 86400 IN PTR hedns1.google.com.
10.38.239.216.in-addr.arpa. 86400 IN PTR ns4.google.com.

11 results out of 4096 IP addresses.

google.com ip blocks:
______________________

64.9.224.68/31
64.9.224.70/32
216.239.32.10/31
216.239.32.15/32
216.239.32.116/32
216.239.34.10/32
216.239.36.10/31
216.239.38.10/32

done.
You can also use the --enum flag to gather whois information and to dig up subdomains.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A very convenient and useful tool for DNS information gathering on domains/servers etc. Results are also very well arranged and offer a clear overview.</div>
For more information please refer to the full [https://tools.kali.org/information-gathering/dnsenum tool documentation].

=== Swaks ===
Category: Information Gathering - SMTP Scan 
This tool is for sending e-mails of all kinds. Now, compared to a regular e-mail client, here you can change the header, attachments, which server to talk to and more. It handles TLS, authentication, and pipelining.
 Since I don't have my own SMTP server available, for demonstration purposes we will use the Gmail's SMTP server:
$ swaks -t example.receiver@gmail.com -s smtp.gmail.com:587 -tls -a LOGIN
You will then be prompted to enter Gmail credentials of an actual existing account. However, from security reasons, Gmail will probably block this login attempt, that's why using your own SMTP server would be ideal. To have a look at some more examples of changing headers and using different servers, please refer [https://github.com/jetmore/swaks/blob/v20201014.0/doc/base.pod here].

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This tool is known as the Swiss Army Knife for SMTP (=Swaks) and helps you with the complexity of setting up e-mail servers. You have many various possibilities of choosing a mail server and changing headers and other data, that you wouldn't have if you sent an email from a simple public mail server.</div>
For more information please refer to the full [https://linux.die.net/man/1/swaks tool documentation].

=== SSLdump ===
Category: Information Gathering - SSL Analysis 
SSLdump is a TLS/SSL network protocol analyzer that identifies TCP streams/connections from a specified port and interface and attempts to interpret them. Once it identifies SSL/TLS traffic, it decodes and displays the content in a readable form as text. If you provide a necessary key as well, it can decrypt the connection fully and display the exchanged application data traffic (<code>ssldump -Ad -k ~/privatekey.pem -p password -i eth0 host user123</code>). Below is a demonstration of a basic command that listens to traffic on port 443 of interface eth0:

$ sudo ssldump -i eth0 port 443
New TCP connection #2: 192.168.0.102(53984) <-> edge-star-mini-shv-01-vie1.facebook.com(443)
2 1 0.0096 (0.0096) C>S Handshake
ClientHello
Version 3.3
resume [32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipher suites
TLS_AES_128_GCM_SHA256
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
compression methods
NULL
extensions
server_name
host_name: www.facebook.com
extended_master_secret
renegotiation_info
supported_groups
ec_point_formats
session_ticket
application_layer_protocol_negotiation
status_request
key_share
supported_versions
signature_algorithms
psk_key_exchange_modes
record_size_limit
padding
ja3 string:
771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-51-43-13-45-28-21,29-23-24-25-256-257,0
ja3 fingerprint: aa7744226c695c0b2e440419848cf700
2 2 0.0146 (0.0049) S>C Handshake
ServerHello
Version 3.3
session_id[32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipherSuite TLS_AES_128_GCM_SHA256
compressionMethod NULL
extensions
supported_versions
key_share
ja3s string: 771,4865,43-51
ja3s fingerprint: f4febc55ea12b31ae17cfb7e614afda8
2 3 0.0146 (0.0000) S>C ChangeCipherSpec
2 4 0.0146 (0.0000) S>C application_data

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This seems to be a very powerful tool with which you can actually sniff SSL encrypted traffic, and even if you don't have the private key, you can see the TLS handshake and the hello's from client and server together with their exchanged cipher suites.</div>
For more information please refer to the full [https://linux.die.net/man/1/ssldump tool documentation].

== What's different in ParrotOS? ==
As we know, you can install any tools from Kali also on ParrotOS, and the other way around, that's why in this context, the preinstalled tools are meant. Overall you can say, that the "main" tools are the same on both operating systems.
<div><ul>
<li style="display: inline-block;"> [[File:ComparisonKaliParr.png|thumb|none|500px|Information Gathering Tools Menu Preview Comparison]] </li>
</ul></div>
On the first glance the tools look very similar, however when you click on the the various sub-categories, you can see that Parrot offers a greater range of tools. Refer to the table below for a detailed overview:

<table class="wikitable" style="width: 50%>
<tr>
<th style="background-color: #ccccff; color: #000000;">Tool Category</th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Kali<<<<< </th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Parrot<<<<< </th>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">DNS Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsenum
 dnsrecon
 fierce 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsdict6
 dnsenum
 dnsmap
 dnsrecon
 dnstracer
 dnswalk
 fierce
 gobuster
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">IDS/IPS Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 wafw00f 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 fragrouter
 ftest 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Live Host Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 fping
 hping3
 masscan
 thcping6 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 cdpsnarf
 detect-new-ip6
 fping
 hping3
 inverse_lookup6
 ncat
 passive_discovery6
 thcping6
 xprobe2 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Network & port scanners</td>
<td style="background-color: #f4f4ff; color: #000000;">
masscan
 nmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
amap
 etherape
 masscan
 nmap
 unicornscan
 wireshark 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">OSINT Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
maltego
 spiderfoot
 spiderfoot-cli
 theharvester 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
casefile
 maltego
 metagoofil
 theharvester
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Route Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
netdiscover
 netmask 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
0trace
 intrace
 irpas-ass
 irpass-cdp
 netmask
 trace6 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMB Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMTP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">swaks</td>
<td style="background-color: #f4f4ff; color: #000000;">
smtp-user-enum
 swaks 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SNMP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
onesixtyone
 snmp-check 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
braa
 onesixtyone
 snmp-check 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SSL Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
</tr>

</table>

== References ==

* https://www.parrotsec.org/docs/
* https://www.kali.org/docs/

[[Category:Pentesting]]

Information Gathering Tools

2021-06-24T08:22:52Z

MFriedl:

== Summary ==

This is a draft. Comparing various available pre-installed information gathering tools in Kali and comparing differences to ParrotOS. This document is NOT a documentation of the tools, it is merely a comparison and practical evaluation of the tools for an average security specialist or a security newbie wanting to start using the tools.

== Requirements ==

* Operating system: Kali Linux 2021.1 amd64, Parrot Security 4.10 amd64
Disclaimer: all possible examples and tests done have been done in VMWare in a Kali Linux 2021.1 and the commands are up-to-date as of 21st June 2021.

== Tools==

=== Nmap ===
Category: Information Gathering - Network & Port Scanners 
Nmap is known to be a very powerful tool for information gathering and vulnerability scanning. It offers loads of options, offering for example for host discovery, scans (TCP, UDP, IP...), service/version detection, OS detection, firewalls/IDS evasion and spoofing, script scanning etc. Since this is not meant to be a [https://nmap.org/book/man.html full documentation] of the tools, but rather an evaluation overview, compared to the other tools in this category, Nmap is the one main tool that most of the other secondary tools are using and it is very powerful. See the following tools for some comparison and Nmap examples.

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: If your goal is to perform a network scan to determine alive hosts, open ports, used systems on ports or used operation systems on the hosts, this would be the way to go. It is fast and efficient (speed depends on the range of hosts and ports scanned though). The other tools that offer these results are using Nmap anyway, for example the way DMitry or Legion use it.</div>
For more information please refer to the full [https://nmap.org/book/man.html tool documentation].

=== Spiderfoot ===
Category: Information Gathering - OSINT 
This is a reconnaissance framework that uses many modules for information gathering, working on the OSINT principle. You can access a GUI by starting the framework on a port on localhost and accessing that address via web browser once it starts:
 <code>$ spiderfoot -l 127.0.0.1:5001</code> 
You can then set up a new scan, where you would give the program a target: this can be a domain/sub-domain name, IPv4 or IPv6 address, hostname, subnet, ASN, e-mail address, phone number, a person's actual name or username. This gives a really wide spectrum on options. The full scan is demonstrated below.
scan www.fh-campuswien.ac.at for a full scan, where you "get anything and everything about the target":
Execution takes many days, depending on the size of the target and the information available on the internet to that target. This specific inquiry took several days to complete and collect all information. Some parts of the information is displayed below, however the results were much more extensive:
<div><ul>
<li style="display: inline-block;"> [[File:Spiderscan.png|thumb|none|800px|Results of Spiderfoot Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is a very good and very powerful reconnaissance framework. It really collects "anything and everything" about a target, as it states. The scans take a very long time, but the amount of information connected is priceless, it really searches through the whole www to provide any and every connection to the target. Based on the very user friendly and well-arranged GUI it is quite good for beginners too, however the amount of data delivered is useful only for professional security analysts who know what to do with the results, how to navigate them and how to interpret them.</div>
For more information please refer to the full [https://www.spiderfoot.net/documentation/ tool documentation].

=== Legion ===
Category: Information Gathering - general 
Legion is a GUI tool, a network penetration testing framework, that offers many options. It automatically detects CVEs and provides nmap, Vulners, whataweb, webslayer, sslyzer, SMBenum, dirbuster, nikto, Hydra and other additional scripts. Its execution takes up to a couple of minutes. A demonstration:
scan www.fh-campuswien.ac.at
<div><ul>
<li style="display: inline-block;"> [[File:Legion scan.png|thumb|none|600px|Results of Legion Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
No CVEs have been found. Below is a comparison with the Metasploitable2 machine that can be found in the same subnet, so that it is clear how the vulnerabilities are shown in an actual weak system:
<div><ul>
<li style="display: inline-block;"> [[File:Meta legion.png|thumb|none|1000px|Results of Legion Scan on Metasploitable2 VM]] </li>
</ul></div>
It is safe to say that it is a very powerful and useful tool, also very user friendly and quite fast. Maybe not the best for domains in the internet because it won't offer much more information than nmap and whois lookup, but when you look at the metasploitable output, so a scan of a server, you can see how much information is shown. The implementation of Hydra also gets you the cracked passwords in the vulnerabilities which is very useful. 
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall definitely a recommended tool, nice GUI, works quickly and efficiently and is very well arranged and easy to navigate.</div>
For more information please refer to the full [https://govanguard.com/legion/#about-legion official Legion Framework website].

=== DMitry===
Category: Information Gathering - general 
DMitry is a CLI tool to gather information about a host - possible subdomains, uptime information, tcp port scan, email addresses, whois lookups etc. It is mostly used to reveal information that exists through search engines about the owner or host of a web page, i.e. for social engineering attacks.
 
When using the portscan option, the results show less open ports than doing that same TCP scan with nmap.
 DMitry:
HostIP:192.168.0.130
HostName:
Gathered TCP Port information for 192.168.0.130
Port State
23/tcp open
Portscan Finished: Scanned 150 ports, 148 ports were in state closed
Nmap:
Nmap scan report for 192.168.0.130
Host is up (0.20s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
23/tcp open telnet
554/tcp open rtsp
843/tcp open unknown
5001/tcp open commplex-link
MAC Address: 7C:DD:90:AF:4E:7D (Shenzhen Ogemray Technology)
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

To find out information about a domain, you need either the IP or the domain same.
 Whois lookup on the other hand gets you some nice useful results. Below is an example of using <code>dmitry -w www.fh-campuswien.ac.at</code> on the college website of FH Campus Wien www.fh-campuswien.ac.at, and it just goes to show that it is exactly the same output as if you were to type <code>whois fh-campuswien.ac.at</code>
HostIP:91.213.77.62
HostName:www.fh-campuswien.ac.at
Gathered Inic-whois information for fh-campuswien.ac.at
---------------------------------
domain: fh-campuswien.ac.at
registrar:
registrant: FCW1942152-NICAT
admin-c: <data not disclosed>
tech-c: NLTU11579014-NICAT
nserver: ns.nextlayer.at
remarks: 81.16.150.30
nserver: ns2.nextlayer.at
remarks: 81.16.151.30
changed: 20171003 19:16:08
source: AT-DOM
personname:
organization: fh campus wien
street address: Favoritenstrasse 226
postal code: A-1100
city: Vienna
country: Austria
phone: +43160668771000
fax-no: +43160668771009
e-mail: office@fh-campuswien.ac.at
nic-hdl: FCW1942152-NICAT
changed: 20100323 17:12:46
source: AT-DOM
personname: Hostmaster Hostmaster
organization: next layer Telekommunikationsdienstleistungs- und BeratungsGmbH
street address: Mariahilfer Guertel 37- 7
postal code: 1150
city: Vienna
country: Austria
phone: +43517649
e-mail: hostmaster@nextlayer.at
nic-hdl: NLTU11579014-NICAT
changed: 20170929 13:17:54
source: AT-DOM

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall a nice tool, useful for beginners who don't have experience with the basic tools yet. However, to an experienced IT Security specialist, the tools that DMitry is based on, like nmap and whois would be the better choice to use here, since they just offer you the same output and nmap and whois itself offer much more options. One drawback however is that you need to install whois separately, whilst DMitry will be in the preinstalled set of tools. When it comes to portscan, it offers pretty insufficient results in DMitry.
This tool is fairly outdated nowadays, although it used to be very good a few years ago. Now there are better alternatives.</div>
For more information please refer to the full [https://linux.die.net/man/1/dmitry tool documentation].

=== Recon-ng ===
Category: Information Gathering - general 
On the first glance, it looks very similar to Metasploit. You can start it via the command line and enter an environment in the shell. It is a python web reconnaissance framework designed specifically for web-based information gathering, and is, unlike Metasploit, not an exploitation framework. 
To navigate it, always utilize the help flag to view possible options. At first, you won't have any modules enables/installed, which is kind of confusing and one really has to look into the documentation first before using it because the shell environment isn't that intuitive. 
To view available modules, use <code>show modules</code>. When you want to start now, create a workspace first where your retrieved data will be saved:
[recon-ng][default] > workspaces create test
Now install the module you would like to use, we will use hackertarget to get subdomains. You can use <code>marketplace search hackertarget</code> to view the module and install it by:
[recon-ng][test] > marketplace install hackertarget
[*] Module installed: recon/domains-hosts/hackertarget
[*] Reloading modules...
Now we will load the module and set the source of input, which we want to retrieve data from. With the command <code>info</code> or <code>input</code> you can view the current source. Execute the module with <code>run</code>:
[recon-ng][test] > modules load hackertarget
[recon-ng][test][hackertarget] > options set SOURCE tesla.com
[recon-ng][test][hackertarget] > run
This will get you 27 found hosts, after the <code>show hosts</code> command you can review them in an arranged list:
+---------------------------------------------------------------------------------------------------------------------+
| rowid | host | ip_address | region | country | latitude | longitude | notes | module |
+---------------------------------------------------------------------------------------------------------------------+
| 1 | tesla.com | 199.66.11.62 | | | | | | hackertarget |
| 2 | o7.ptr6980.tesla.com | 149.72.144.42 | | | | | | hackertarget |
| 3 | vpn1.tesla.com | 8.45.124.215 | | | | | | hackertarget |
| 4 | model3.tesla.com | 205.234.27.221 | | | | | | hackertarget |
| 5 | o3.ptr1444.tesla.com | 149.72.152.236 | | | | | | hackertarget |
| 6 | o2.ptr556.tesla.com | 149.72.134.64 | | | | | | hackertarget |
| 7 | o5.ptr8466.tesla.com | 149.72.172.170 | | | | | | hackertarget |
| 8 | o6.ptr9437.tesla.com | 168.245.123.10 | | | | | | hackertarget |
| 9 | o4.ptr1867.tesla.com | 149.72.163.58 | | | | | | hackertarget |
| 10 | mobile.tesla.com | 209.133.79.82 | | | | | | hackertarget |
| 11 | marketing.tesla.com | 13.111.47.196 | | | | | | hackertarget |
| 12 | o1.ptr2410.link.tesla.com | 149.72.247.52 | | | | | | hackertarget |
| 13 | referral.tesla.com | 72.10.32.90 | | | | | | hackertarget |
| 14 | mta2.email.tesla.com | 13.111.4.231 | | | | | | hackertarget |
| 15 | mta.email.tesla.com | 13.111.14.190 | | | | | | hackertarget |
| 16 | xmail.tesla.com | 204.74.99.100 | | | | | | hackertarget |
| 17 | comparison.tesla.com | 64.125.183.133 | | | | | | hackertarget |
| 18 | emails.tesla.com | 13.111.18.27 | | | | | | hackertarget |
| 19 | mta2.emails.tesla.com | 13.111.88.1 | | | | | | hackertarget |
| 20 | mta3.emails.tesla.com | 13.111.88.2 | | | | | | hackertarget |
| 21 | mta4.emails.tesla.com | 13.111.88.52 | | | | | | hackertarget |
| 22 | mta5.emails.tesla.com | 13.111.88.53 | | | | | | hackertarget |
| 23 | mta.emails.tesla.com | 13.111.62.118 | | | | | | hackertarget |
| 24 | click.emails.tesla.com | 13.111.48.179 | | | | | | hackertarget |
| 25 | view.emails.tesla.com | 13.111.49.179 | | | | | | hackertarget |
| 26 | events.tesla.com | 13.111.47.195 | | | | | | hackertarget |
| 27 | shop.eu.tesla.com | 205.234.27.221 | | | | | | hackertarget |
+---------------------------------------------------------------------------------------------------------------------+
Disclaimer: the used Recon-ng version here is <code>recon-ng v5.1.1</code>, which is important to note, because countless tutorials on the internet refer to older commands which no longer work, so you kind of really have to play around with it to see which modules work (because some don't) and what commands are available by always utilizing the <code>help</code> flag along the way.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A powerful framework that offers many modules to perform reconnaissance on web-hosts. Personally would not recommend to newbies, simply because it is not that easy and intuitive to navigate, some modules are not working and the documentation is pretty lacking, with internet tutorials often showing old versions of commands.</div>
For more information please refer to the official [https://tools.kali.org/information-gathering/recon-ng documentation] or Github, however the documentation in this case is quite lacking.

=== Maltego ===
Category: Information Gathering - OSINT 
Maltego is a graphical footprinting tool with quite some extensions available. With the preinstalled extensions you can allready footprint any domain and view it as a tree. where this tree is formatted according to the amount discovered and may change to a mesh view, if it would get too crowded.

[[File:Elvis.science.png|thumb|none|700px|Example footprinting of elvis.science]]

There is allready a page in this wiki for Maltego about how to create networks yourself without the use of extensions: [[Maltego]]

=== Netdiscover ===
Category: Information Gathering - Route Analysis 
This is another reconnaissance tool that can be used for host discovery on wireless and switched networks. You can scan your subnet at home or at work, wherever your device is connected. It works through ARP requests and can detect hosts either by actively sending requests, or if you set it to passive mode, only by sniffing. 
If Nmap is too much for a given moment and you just want to see quickly who is in your network, this is the way to go. Below is a comparison of Netdiscover used on a local subnet, a very well-arranged output, and nmap, which in some situations offers too much:
$ netdiscover -r 192.168.0.0/24
20 Captured ARP Req/Rep packets, from 16 hosts. Total size: 1200
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.0.1 00:xx:xx:xx:xx:c2 2 120 Cisco Systems, Inc
192.168.0.9 00:xx:xx:xx:xx:a9 1 60 Weinzierl Engineering GmbH
192.168.0.10 50:xx:xx:xx:xx:c7 1 60 Loxone Electronics GmbH
192.168.0.80 54:xx:xx:xx:xx:a0 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.81 18:xx:xx:xx:xx:50 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.82 54:xx:xx:xx:xx:ff 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.83 28:xx:xx:xx:xx:27 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.84 18:xx:xx:xx:xx:d7 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.101 48:xx:xx:xx:xx:2e 1 60 ZENNIO AVANCE Y TECNOLOGIA, S.L.
192.168.0.102 00:xx:xx:xx:xx:bb 1 60 VMware, Inc.
192.168.0.109 fc:xx:xx:xx:xx:f9 4 240 Ubiquiti Networks Inc.
192.168.0.112 04:xx:xx:xx:xx:a5 1 60 ASUSTek COMPUTER INC.
192.168.0.132 00:xx:xx:xx:xx:d4 1 60 VMware, Inc.
192.168.0.149 c4:xx:xx:xx:xx:48 1 60 Hewlett Packard
192.168.0.172 8c:xx:xx:xx:xx:eb 1 60 Apple, Inc.
192.168.0.195 f2:xx:xx:xx:xx:3a 1 60 Unknown vendor
If you were to do this same information in Nmap, you would need to perform a host discovery scan first:
$ nmap -sP 192.168.0.0/24 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-20 16:34 CEST
Nmap scan report for 192.168.0.1 Host is up (0.0051s latency).
Nmap scan report for 192.168.0.10 Host is up (0.00058s latency).
Nmap scan report for 192.168.0.80 Host is up (0.00034s latency).
Nmap scan report for 192.168.0.81 Host is up (0.0018s latency).
Nmap scan report for 192.168.0.82 Host is up (0.0017s latency).
Nmap scan report for 192.168.0.83 Host is up (0.0037s latency).
Nmap scan report for 192.168.0.84 Host is up (0.0019s latency).
Nmap scan report for 192.168.0.101 Host is up (0.00045s latency).
Nmap scan report for 192.168.0.102 Host is up (0.00018s latency).
Nmap scan report for 192.168.0.107 Host is up (0.00021s latency).
Nmap scan report for 192.168.0.109 Host is up (0.00049s latency).
Nmap scan report for 192.168.0.132 Host is up (0.00033s latency).
Nmap scan report for 192.168.0.172 Host is up (0.089s latency).
Nmap done: 256 IP addresses (13 hosts up) scanned in 2.42 seconds
Only then you can scan each alive host separately for their Hostname/OS/MAC address with <code>sudo nmap -O <IP address></code>. That is unless you want to wait several hours by scanning the whole subnet for their OS which I would not recommend since it takes so long. If you need a quick swipe, Nmap is possibly the inferior option here and could be used once you want to find out more about each host, their ports etc.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Definitely a useful tool for an initial scan, or in a case where you don't know what range to look for exactly, since it is very fast. If you just want to find alive hosts and their IPs in a big range, this would be a good option. Nmap however, offers alive hosts discovery as well, and if you turn portscan off, it will be much faster than Netdiscover. Netdiscover kind of connects the various options of Nmap by showing IPs, MACs and Hostnames and makes it fairly easy to use, without having to read the extensive documentation of Nmap in the hope to find the correct options to perform a simple initial scan.</div>
For more information please refer to the full [https://manpages.debian.org/unstable/netdiscover/netdiscover.8.en.html tool documentation].

=== Ike-scan ===
Category: Information Gathering - general 
Ike-scan is useful for VPN endpoints. To explain this a little, first we should know what IKE is. It is Internet Key Exchange protocol, which is used by IPsec. The majority of IPsec VPNs use IKE for key exchange. The Ike-scan tool is for discovering, testing and fingerprinting IPsec VPN systems. It sends IKE phase 1 packets to the target and displays the received responses. To be able to test this, we now need a target that we are certain uses IKE for key exchange. To achieve this, we will demonstrate this on an IP address found through www.shodan.io, where you need to search for the keyword "IKE" to find targets that satisfy this condition. For demonstration, we chose the IP 110.142.206.85, which should be a VPN in Melbourne, Australia.
$ ike-scan 110.142.206.85
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
110.142.206.85 Main Mode Handshake returned HDR=(CKY-R=49cc50cbfcf85509) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=dbfb81eb5760b0788562067da102d755 VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) VID=12f5f28c457168a9702d9fe274cc0100 (Cisco Unity)
Ending ike-scan 1.9.4: 1 hosts scanned in 0.356 seconds (2.81 hosts/sec). 1 returned handshake; 0 returned notify
This returns the main mode handshake and shows information like security associations (hash, encoding, authentication) and also vendor ID etc.
 The following scan tries to fingerprint the firewall in use and additionally to the previous output it shows the following:
$ ike-scan --showbackoff -v -v 110.142.206.85
DEBUG: pkt len=336 bytes, bandwidth=56000 bps, int=52000 us
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
--- Sending packet #1 to host entry 1 (110.142.206.85) tmo 500000 us
--- Received packet #1 from 110.142.206.85
--- Removing host entry 1 (110.142.206.85) - Received 152 bytes
IKE Backoff Patterns:
IP Address No. Recv time Delta Time
110.142.206.85 1 1624204029.790995 0.000000
110.142.206.85 Implementation guess: Linksys Etherfast
Ending ike-scan 1.9.4: 1 hosts scanned in 60.426 seconds (0.02 hosts/sec). 1 returned handshake; 0 returned notify
There is a possibility to use the so called aggressive mode (default is Main Mode) which uses a 3-way-handshake where the VPN sends an unencrypted message to the client containing the hashed PSK. If you manage to capture the plaintext hash, you could use psk-crack to perform a brute force attack and try to recover the PSK (Pre-shared key).
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is not a very well known tool, however it can offer some valuable insights to experienced security experts and a possibility to use the recovered data in further exploitation/scanning.</div>
For more information please refer to the full [https://linux.die.net/man/1/ike-scan tool documentation].

=== Dnsenum ===
Category: Information Gathering - DNS Analysis 
This is an efficient and well-performing tool for locating all DNS servers and DNS entries for a given organization. A basic demonstration on the example of <code>google.com</code> is shown below (some entries have been replaced with ... to keep it as short as possible):
$ dnsenum google.com 255 ⨯
dnsenum VERSION:1.2.6
----- google.com -----
Host's addresses:
__________________
google.com. 300 IN A 216.58.201.78
Name Servers:
______________

ns2.google.com. 345600 IN A 216.239.34.10
ns4.google.com. 345600 IN A 216.239.38.10
ns1.google.com. 345600 IN A 216.239.32.10
ns3.google.com. 345600 IN A 216.239.36.10

Mail (MX) Servers:
___________________

aspmx.l.google.com. 293 IN A 173.194.69.27
alt1.aspmx.l.google.com. 293 IN A 142.250.150.27
alt2.aspmx.l.google.com. 293 IN A 74.125.200.27
alt3.aspmx.l.google.com. 293 IN A 142.250.157.27
alt4.aspmx.l.google.com. 293 IN A 173.194.202.26

Trying Zone Transfers and getting Bind Versions:
_________________________________________________
Trying Zone Transfer for google.com on ns1.google.com ...
AXFR record query failed: corrupt packet
...
Trying Zone Transfer for google.com on ns4.google.com ...
AXFR record query failed: corrupt packet

Brute forcing with /usr/share/dnsenum/dns.txt:
_______________________________________________

about.google.com. 0 IN CNAME www3.l.google.com.
www3.l.google.com. 300 IN A 172.217.23.238
accounts.google.com. 300 IN A 172.217.23.205
admin.google.com. 300 IN A 172.217.23.206
ads.google.com. 300 IN A 216.58.201.78
america.google.com. 0 IN CNAME www3.l.google.com.
...
www.google.com. 300 IN A 172.217.23.196

google.com class C netranges:
______________________________

8.8.4.0/24
8.8.8.0/24
...
216.239.36.0/24
216.239.38.0/24

Performing reverse lookup on 4096 ip addresses:
________________________________________________

68.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
69.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
70.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
10.32.239.216.in-addr.arpa. 86400 IN PTR ns1.google.com.
11.32.239.216.in-addr.arpa. 86400 IN PTR ns.google.com.
15.32.239.216.in-addr.arpa. 86400 IN PTR time1.google.com.
116.32.239.216.in-addr.arpa. 86400 IN PTR e2a.google.com.
10.34.239.216.in-addr.arpa. 86400 IN PTR ns2.google.com.
10.36.239.216.in-addr.arpa. 86400 IN PTR ns3.google.com.
11.36.239.216.in-addr.arpa. 86400 IN PTR hedns1.google.com.
10.38.239.216.in-addr.arpa. 86400 IN PTR ns4.google.com.

11 results out of 4096 IP addresses.

google.com ip blocks:
______________________

64.9.224.68/31
64.9.224.70/32
216.239.32.10/31
216.239.32.15/32
216.239.32.116/32
216.239.34.10/32
216.239.36.10/31
216.239.38.10/32

done.
You can also use the --enum flag to gather whois information and to dig up subdomains.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A very convenient and useful tool for DNS information gathering on domains/servers etc. Results are also very well arranged and offer a clear overview.</div>
For more information please refer to the full [https://tools.kali.org/information-gathering/dnsenum tool documentation].

=== Swaks ===
Category: Information Gathering - SMTP Scan 
This tool is for sending e-mails of all kinds. Now, compared to a regular e-mail client, here you can change the header, attachments, which server to talk to and more. It handles TLS, authentication, and pipelining.
 Since I don't have my own SMTP server available, for demonstration purposes we will use the Gmail's SMTP server:
$ swaks -t example.receiver@gmail.com -s smtp.gmail.com:587 -tls -a LOGIN
You will then be prompted to enter Gmail credentials of an actual existing account. However, from security reasons, Gmail will probably block this login attempt, that's why using your own SMTP server would be ideal. To have a look at some more examples of changing headers and using different servers, please refer [https://github.com/jetmore/swaks/blob/v20201014.0/doc/base.pod here].

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This tool is known as the Swiss Army Knife for SMTP (=Swaks) and helps you with the complexity of setting up e-mail servers. You have many various possibilities of choosing a mail server and changing headers and other data, that you wouldn't have if you sent an email from a simple public mail server.</div>
For more information please refer to the full [https://linux.die.net/man/1/swaks tool documentation].

=== SSLdump ===
Category: Information Gathering - SSL Analysis 
SSLdump is a TLS/SSL network protocol analyzer that identifies TCP streams/connections from a specified port and interface and attempts to interpret them. Once it identifies SSL/TLS traffic, it decodes and displays the content in a readable form as text. If you provide a necessary key as well, it can decrypt the connection fully and display the exchanged application data traffic (<code>ssldump -Ad -k ~/privatekey.pem -p password -i eth0 host user123</code>). Below is a demonstration of a basic command that listens to traffic on port 443 of interface eth0:

$ sudo ssldump -i eth0 port 443
New TCP connection #2: 192.168.0.102(53984) <-> edge-star-mini-shv-01-vie1.facebook.com(443)
2 1 0.0096 (0.0096) C>S Handshake
ClientHello
Version 3.3
resume [32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipher suites
TLS_AES_128_GCM_SHA256
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
compression methods
NULL
extensions
server_name
host_name: www.facebook.com
extended_master_secret
renegotiation_info
supported_groups
ec_point_formats
session_ticket
application_layer_protocol_negotiation
status_request
key_share
supported_versions
signature_algorithms
psk_key_exchange_modes
record_size_limit
padding
ja3 string:
771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-51-43-13-45-28-21,29-23-24-25-256-257,0
ja3 fingerprint: aa7744226c695c0b2e440419848cf700
2 2 0.0146 (0.0049) S>C Handshake
ServerHello
Version 3.3
session_id[32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipherSuite TLS_AES_128_GCM_SHA256
compressionMethod NULL
extensions
supported_versions
key_share
ja3s string: 771,4865,43-51
ja3s fingerprint: f4febc55ea12b31ae17cfb7e614afda8
2 3 0.0146 (0.0000) S>C ChangeCipherSpec
2 4 0.0146 (0.0000) S>C application_data

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This seems to be a very powerful tool with which you can actually sniff SSL encrypted traffic, and even if you don't have the private key, you can see the TLS handshake and the hello's from client and server together with their exchanged cipher suites.</div>
For more information please refer to the full [https://linux.die.net/man/1/ssldump tool documentation].

== What's different in ParrotOS? ==
As we know, you can install any tools from Kali also on ParrotOS, and the other way around, that's why in this context, the preinstalled tools are meant. Overall you can say, that the "main" tools are the same on both operating systems.
<div><ul>
<li style="display: inline-block;"> [[File:ComparisonKaliParr.png|thumb|none|500px|Information Gathering Tools Menu Preview Comparison]] </li>
</ul></div>
On the first glance the tools look very similar, however when you click on the the various sub-categories, you can see that Parrot offers a greater range of tools. Refer to the table below for a detailed overview:

<table class="wikitable" style="width: 50%>
<tr>
<th style="background-color: #ccccff; color: #000000;">Tool Category</th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Kali<<<<< </th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Parrot<<<<< </th>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">DNS Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsenum
 dnsrecon
 fierce 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsdict6
 dnsenum
 dnsmap
 dnsrecon
 dnstracer
 dnswalk
 fierce
 gobuster
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">IDS/IPS Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 wafw00f 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 fragrouter
 ftest 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Live Host Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 fping
 hping3
 masscan
 thcping6 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 cdpsnarf
 detect-new-ip6
 fping
 hping3
 inverse_lookup6
 ncat
 passive_discovery6
 thcping6
 xprobe2 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Network & port scanners</td>
<td style="background-color: #f4f4ff; color: #000000;">
masscan
 nmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
amap
 etherape
 masscan
 nmap
 unicornscan
 wireshark 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">OSINT Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
maltego
 spiderfoot
 spiderfoot-cli
 theharvester 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
casefile
 maltego
 metagoofil
 theharvester
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Route Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
netdiscover
 netmask 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
0trace
 intrace
 irpas-ass
 irpass-cdp
 netmask
 trace6 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMB Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMTP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">swaks</td>
<td style="background-color: #f4f4ff; color: #000000;">
smtp-user-enum
 swaks 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SNMP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
onesixtyone
 snmp-check 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
braa
 onesixtyone
 snmp-check 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SSL Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
</tr>

</table>

== References ==

* https://www.parrotsec.org/docs/
* https://www.kali.org/docs/

[[Category:Pentesting]]

Information Gathering Tools

2021-06-24T08:21:19Z

MFriedl:

== Summary ==

This is a draft. Comparing various available pre-installed information gathering tools in Kali and comparing differences to ParrotOS. This document is NOT a documentation of the tools, it is merely a comparison and practical evaluation of the tools for an average security specialist or a security newbie wanting to start using the tools.

== Requirements ==

* Operating system: Kali Linux 2021.1 amd64, Parrot Security 4.10 amd64
Disclaimer: all possible examples and tests done have been done in VMWare in a Kali Linux 2021.1 and the commands are up-to-date as of 21st June 2021.

== Tools==

=== Nmap ===
Category: Information Gathering - Network & Port Scanners 
Nmap is known to be a very powerful tool for information gathering and vulnerability scanning. It offers loads of options, offering for example for host discovery, scans (TCP, UDP, IP...), service/version detection, OS detection, firewalls/IDS evasion and spoofing, script scanning etc. Since this is not meant to be a [https://nmap.org/book/man.html full documentation] of the tools, but rather an evaluation overview, compared to the other tools in this category, Nmap is the one main tool that most of the other secondary tools are using and it is very powerful. See the following tools for some comparison and Nmap examples.

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: If your goal is to perform a network scan to determine alive hosts, open ports, used systems on ports or used operation systems on the hosts, this would be the way to go. It is fast and efficient (speed depends on the range of hosts and ports scanned though). The other tools that offer these results are using Nmap anyway, for example the way DMitry or Legion use it.</div>
For more information please refer to the full [https://nmap.org/book/man.html tool documentation].

=== Spiderfoot ===
Category: Information Gathering - OSINT 
This is a reconnaissance framework that uses many modules for information gathering, working on the OSINT principle. You can access a GUI by starting the framework on a port on localhost and accessing that address via web browser once it starts:
 <code>$ spiderfoot -l 127.0.0.1:5001</code> 
You can then set up a new scan, where you would give the program a target: this can be a domain/sub-domain name, IPv4 or IPv6 address, hostname, subnet, ASN, e-mail address, phone number, a person's actual name or username. This gives a really wide spectrum on options. The full scan is demonstrated below.
scan www.fh-campuswien.ac.at for a full scan, where you "get anything and everything about the target":
Execution takes many days, depending on the size of the target and the information available on the internet to that target. This specific inquiry took several days to complete and collect all information. Some parts of the information is displayed below, however the results were much more extensive:
<div><ul>
<li style="display: inline-block;"> [[File:Spiderscan.png|thumb|none|800px|Results of Spiderfoot Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is a very good and very powerful reconnaissance framework. It really collects "anything and everything" about a target, as it states. The scans take a very long time, but the amount of information connected is priceless, it really searches through the whole www to provide any and every connection to the target. Based on the very user friendly and well-arranged GUI it is quite good for beginners too, however the amount of data delivered is useful only for professional security analysts who know what to do with the results, how to navigate them and how to interpret them.</div>
For more information please refer to the full [https://www.spiderfoot.net/documentation/ tool documentation].

=== Legion ===
Category: Information Gathering - general 
Legion is a GUI tool, a network penetration testing framework, that offers many options. It automatically detects CVEs and provides nmap, Vulners, whataweb, webslayer, sslyzer, SMBenum, dirbuster, nikto, Hydra and other additional scripts. Its execution takes up to a couple of minutes. A demonstration:
scan www.fh-campuswien.ac.at
<div><ul>
<li style="display: inline-block;"> [[File:Legion scan.png|thumb|none|600px|Results of Legion Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
No CVEs have been found. Below is a comparison with the Metasploitable2 machine that can be found in the same subnet, so that it is clear how the vulnerabilities are shown in an actual weak system:
<div><ul>
<li style="display: inline-block;"> [[File:Meta legion.png|thumb|none|1000px|Results of Legion Scan on Metasploitable2 VM]] </li>
</ul></div>
It is safe to say that it is a very powerful and useful tool, also very user friendly and quite fast. Maybe not the best for domains in the internet because it won't offer much more information than nmap and whois lookup, but when you look at the metasploitable output, so a scan of a server, you can see how much information is shown. The implementation of Hydra also gets you the cracked passwords in the vulnerabilities which is very useful. 
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall definitely a recommended tool, nice GUI, works quickly and efficiently and is very well arranged and easy to navigate.</div>
For more information please refer to the full [https://govanguard.com/legion/#about-legion official Legion Framework website].

=== DMitry===
Category: Information Gathering - general 
DMitry is a CLI tool to gather information about a host - possible subdomains, uptime information, tcp port scan, email addresses, whois lookups etc. It is mostly used to reveal information that exists through search engines about the owner or host of a web page, i.e. for social engineering attacks.
 
When using the portscan option, the results show less open ports than doing that same TCP scan with nmap.
 DMitry:
HostIP:192.168.0.130
HostName:
Gathered TCP Port information for 192.168.0.130
Port State
23/tcp open
Portscan Finished: Scanned 150 ports, 148 ports were in state closed
Nmap:
Nmap scan report for 192.168.0.130
Host is up (0.20s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
23/tcp open telnet
554/tcp open rtsp
843/tcp open unknown
5001/tcp open commplex-link
MAC Address: 7C:DD:90:AF:4E:7D (Shenzhen Ogemray Technology)
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

To find out information about a domain, you need either the IP or the domain same.
 Whois lookup on the other hand gets you some nice useful results. Below is an example of using <code>dmitry -w www.fh-campuswien.ac.at</code> on the college website of FH Campus Wien www.fh-campuswien.ac.at, and it just goes to show that it is exactly the same output as if you were to type <code>whois fh-campuswien.ac.at</code>
HostIP:91.213.77.62
HostName:www.fh-campuswien.ac.at
Gathered Inic-whois information for fh-campuswien.ac.at
---------------------------------
domain: fh-campuswien.ac.at
registrar:
registrant: FCW1942152-NICAT
admin-c: <data not disclosed>
tech-c: NLTU11579014-NICAT
nserver: ns.nextlayer.at
remarks: 81.16.150.30
nserver: ns2.nextlayer.at
remarks: 81.16.151.30
changed: 20171003 19:16:08
source: AT-DOM
personname:
organization: fh campus wien
street address: Favoritenstrasse 226
postal code: A-1100
city: Vienna
country: Austria
phone: +43160668771000
fax-no: +43160668771009
e-mail: office@fh-campuswien.ac.at
nic-hdl: FCW1942152-NICAT
changed: 20100323 17:12:46
source: AT-DOM
personname: Hostmaster Hostmaster
organization: next layer Telekommunikationsdienstleistungs- und BeratungsGmbH
street address: Mariahilfer Guertel 37- 7
postal code: 1150
city: Vienna
country: Austria
phone: +43517649
e-mail: hostmaster@nextlayer.at
nic-hdl: NLTU11579014-NICAT
changed: 20170929 13:17:54
source: AT-DOM

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall a nice tool, useful for beginners who don't have experience with the basic tools yet. However, to an experienced IT Security specialist, the tools that DMitry is based on, like nmap and whois would be the better choice to use here, since they just offer you the same output and nmap and whois itself offer much more options. One drawback however is that you need to install whois separately, whilst DMitry will be in the preinstalled set of tools. When it comes to portscan, it offers pretty insufficient results in DMitry.
This tool is fairly outdated nowadays, although it used to be very good a few years ago. Now there are better alternatives.</div>
For more information please refer to the full [https://linux.die.net/man/1/dmitry tool documentation].

=== Recon-ng ===
Category: Information Gathering - general 
On the first glance, it looks very similar to Metasploit. You can start it via the command line and enter an environment in the shell. It is a python web reconnaissance framework designed specifically for web-based information gathering, and is, unlike Metasploit, not an exploitation framework. 
To navigate it, always utilize the help flag to view possible options. At first, you won't have any modules enables/installed, which is kind of confusing and one really has to look into the documentation first before using it because the shell environment isn't that intuitive. 
To view available modules, use <code>show modules</code>. When you want to start now, create a workspace first where your retrieved data will be saved:
[recon-ng][default] > workspaces create test
Now install the module you would like to use, we will use hackertarget to get subdomains. You can use <code>marketplace search hackertarget</code> to view the module and install it by:
[recon-ng][test] > marketplace install hackertarget
[*] Module installed: recon/domains-hosts/hackertarget
[*] Reloading modules...
Now we will load the module and set the source of input, which we want to retrieve data from. With the command <code>info</code> or <code>input</code> you can view the current source. Execute the module with <code>run</code>:
[recon-ng][test] > modules load hackertarget
[recon-ng][test][hackertarget] > options set SOURCE tesla.com
[recon-ng][test][hackertarget] > run
This will get you 27 found hosts, after the <code>show hosts</code> command you can review them in an arranged list:
+---------------------------------------------------------------------------------------------------------------------+
| rowid | host | ip_address | region | country | latitude | longitude | notes | module |
+---------------------------------------------------------------------------------------------------------------------+
| 1 | tesla.com | 199.66.11.62 | | | | | | hackertarget |
| 2 | o7.ptr6980.tesla.com | 149.72.144.42 | | | | | | hackertarget |
| 3 | vpn1.tesla.com | 8.45.124.215 | | | | | | hackertarget |
| 4 | model3.tesla.com | 205.234.27.221 | | | | | | hackertarget |
| 5 | o3.ptr1444.tesla.com | 149.72.152.236 | | | | | | hackertarget |
| 6 | o2.ptr556.tesla.com | 149.72.134.64 | | | | | | hackertarget |
| 7 | o5.ptr8466.tesla.com | 149.72.172.170 | | | | | | hackertarget |
| 8 | o6.ptr9437.tesla.com | 168.245.123.10 | | | | | | hackertarget |
| 9 | o4.ptr1867.tesla.com | 149.72.163.58 | | | | | | hackertarget |
| 10 | mobile.tesla.com | 209.133.79.82 | | | | | | hackertarget |
| 11 | marketing.tesla.com | 13.111.47.196 | | | | | | hackertarget |
| 12 | o1.ptr2410.link.tesla.com | 149.72.247.52 | | | | | | hackertarget |
| 13 | referral.tesla.com | 72.10.32.90 | | | | | | hackertarget |
| 14 | mta2.email.tesla.com | 13.111.4.231 | | | | | | hackertarget |
| 15 | mta.email.tesla.com | 13.111.14.190 | | | | | | hackertarget |
| 16 | xmail.tesla.com | 204.74.99.100 | | | | | | hackertarget |
| 17 | comparison.tesla.com | 64.125.183.133 | | | | | | hackertarget |
| 18 | emails.tesla.com | 13.111.18.27 | | | | | | hackertarget |
| 19 | mta2.emails.tesla.com | 13.111.88.1 | | | | | | hackertarget |
| 20 | mta3.emails.tesla.com | 13.111.88.2 | | | | | | hackertarget |
| 21 | mta4.emails.tesla.com | 13.111.88.52 | | | | | | hackertarget |
| 22 | mta5.emails.tesla.com | 13.111.88.53 | | | | | | hackertarget |
| 23 | mta.emails.tesla.com | 13.111.62.118 | | | | | | hackertarget |
| 24 | click.emails.tesla.com | 13.111.48.179 | | | | | | hackertarget |
| 25 | view.emails.tesla.com | 13.111.49.179 | | | | | | hackertarget |
| 26 | events.tesla.com | 13.111.47.195 | | | | | | hackertarget |
| 27 | shop.eu.tesla.com | 205.234.27.221 | | | | | | hackertarget |
+---------------------------------------------------------------------------------------------------------------------+
Disclaimer: the used Recon-ng version here is <code>recon-ng v5.1.1</code>, which is important to note, because countless tutorials on the internet refer to older commands which no longer work, so you kind of really have to play around with it to see which modules work (because some don't) and what commands are available by always utilizing the <code>help</code> flag along the way.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A powerful framework that offers many modules to perform reconnaissance on web-hosts. Personally would not recommend to newbies, simply because it is not that easy and intuitive to navigate, some modules are not working and the documentation is pretty lacking, with internet tutorials often showing old versions of commands.</div>
For more information please refer to the official [https://tools.kali.org/information-gathering/recon-ng documentation] or Github, however the documentation in this case is quite lacking.

=== Maltego ===
Category: Information Gathering - OSINT 
Maltego is a graphical footprinting tool with quite some extensions available. With the preinstalled extensions you can allready footprint any domain and view it as a tree. where this tree is formatted according to the amount discovered and may change to a mesh view, if it would get too crowded.

[[File:Elvis.science.png|thumb|none|700px|Example footprinting of elvis.science]]

There is allready a page in this wiki for Maltego about how to create networks yourself without the use of extensions: [[https://wiki.elvis.science/index.php?title=Maltego|Documetation/Maltego]]

=== Netdiscover ===
Category: Information Gathering - Route Analysis 
This is another reconnaissance tool that can be used for host discovery on wireless and switched networks. You can scan your subnet at home or at work, wherever your device is connected. It works through ARP requests and can detect hosts either by actively sending requests, or if you set it to passive mode, only by sniffing. 
If Nmap is too much for a given moment and you just want to see quickly who is in your network, this is the way to go. Below is a comparison of Netdiscover used on a local subnet, a very well-arranged output, and nmap, which in some situations offers too much:
$ netdiscover -r 192.168.0.0/24
20 Captured ARP Req/Rep packets, from 16 hosts. Total size: 1200
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.0.1 00:xx:xx:xx:xx:c2 2 120 Cisco Systems, Inc
192.168.0.9 00:xx:xx:xx:xx:a9 1 60 Weinzierl Engineering GmbH
192.168.0.10 50:xx:xx:xx:xx:c7 1 60 Loxone Electronics GmbH
192.168.0.80 54:xx:xx:xx:xx:a0 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.81 18:xx:xx:xx:xx:50 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.82 54:xx:xx:xx:xx:ff 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.83 28:xx:xx:xx:xx:27 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.84 18:xx:xx:xx:xx:d7 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.101 48:xx:xx:xx:xx:2e 1 60 ZENNIO AVANCE Y TECNOLOGIA, S.L.
192.168.0.102 00:xx:xx:xx:xx:bb 1 60 VMware, Inc.
192.168.0.109 fc:xx:xx:xx:xx:f9 4 240 Ubiquiti Networks Inc.
192.168.0.112 04:xx:xx:xx:xx:a5 1 60 ASUSTek COMPUTER INC.
192.168.0.132 00:xx:xx:xx:xx:d4 1 60 VMware, Inc.
192.168.0.149 c4:xx:xx:xx:xx:48 1 60 Hewlett Packard
192.168.0.172 8c:xx:xx:xx:xx:eb 1 60 Apple, Inc.
192.168.0.195 f2:xx:xx:xx:xx:3a 1 60 Unknown vendor
If you were to do this same information in Nmap, you would need to perform a host discovery scan first:
$ nmap -sP 192.168.0.0/24 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-20 16:34 CEST
Nmap scan report for 192.168.0.1 Host is up (0.0051s latency).
Nmap scan report for 192.168.0.10 Host is up (0.00058s latency).
Nmap scan report for 192.168.0.80 Host is up (0.00034s latency).
Nmap scan report for 192.168.0.81 Host is up (0.0018s latency).
Nmap scan report for 192.168.0.82 Host is up (0.0017s latency).
Nmap scan report for 192.168.0.83 Host is up (0.0037s latency).
Nmap scan report for 192.168.0.84 Host is up (0.0019s latency).
Nmap scan report for 192.168.0.101 Host is up (0.00045s latency).
Nmap scan report for 192.168.0.102 Host is up (0.00018s latency).
Nmap scan report for 192.168.0.107 Host is up (0.00021s latency).
Nmap scan report for 192.168.0.109 Host is up (0.00049s latency).
Nmap scan report for 192.168.0.132 Host is up (0.00033s latency).
Nmap scan report for 192.168.0.172 Host is up (0.089s latency).
Nmap done: 256 IP addresses (13 hosts up) scanned in 2.42 seconds
Only then you can scan each alive host separately for their Hostname/OS/MAC address with <code>sudo nmap -O <IP address></code>. That is unless you want to wait several hours by scanning the whole subnet for their OS which I would not recommend since it takes so long. If you need a quick swipe, Nmap is possibly the inferior option here and could be used once you want to find out more about each host, their ports etc.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Definitely a useful tool for an initial scan, or in a case where you don't know what range to look for exactly, since it is very fast. If you just want to find alive hosts and their IPs in a big range, this would be a good option. Nmap however, offers alive hosts discovery as well, and if you turn portscan off, it will be much faster than Netdiscover. Netdiscover kind of connects the various options of Nmap by showing IPs, MACs and Hostnames and makes it fairly easy to use, without having to read the extensive documentation of Nmap in the hope to find the correct options to perform a simple initial scan.</div>
For more information please refer to the full [https://manpages.debian.org/unstable/netdiscover/netdiscover.8.en.html tool documentation].

=== Ike-scan ===
Category: Information Gathering - general 
Ike-scan is useful for VPN endpoints. To explain this a little, first we should know what IKE is. It is Internet Key Exchange protocol, which is used by IPsec. The majority of IPsec VPNs use IKE for key exchange. The Ike-scan tool is for discovering, testing and fingerprinting IPsec VPN systems. It sends IKE phase 1 packets to the target and displays the received responses. To be able to test this, we now need a target that we are certain uses IKE for key exchange. To achieve this, we will demonstrate this on an IP address found through www.shodan.io, where you need to search for the keyword "IKE" to find targets that satisfy this condition. For demonstration, we chose the IP 110.142.206.85, which should be a VPN in Melbourne, Australia.
$ ike-scan 110.142.206.85
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
110.142.206.85 Main Mode Handshake returned HDR=(CKY-R=49cc50cbfcf85509) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=dbfb81eb5760b0788562067da102d755 VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) VID=12f5f28c457168a9702d9fe274cc0100 (Cisco Unity)
Ending ike-scan 1.9.4: 1 hosts scanned in 0.356 seconds (2.81 hosts/sec). 1 returned handshake; 0 returned notify
This returns the main mode handshake and shows information like security associations (hash, encoding, authentication) and also vendor ID etc.
 The following scan tries to fingerprint the firewall in use and additionally to the previous output it shows the following:
$ ike-scan --showbackoff -v -v 110.142.206.85
DEBUG: pkt len=336 bytes, bandwidth=56000 bps, int=52000 us
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
--- Sending packet #1 to host entry 1 (110.142.206.85) tmo 500000 us
--- Received packet #1 from 110.142.206.85
--- Removing host entry 1 (110.142.206.85) - Received 152 bytes
IKE Backoff Patterns:
IP Address No. Recv time Delta Time
110.142.206.85 1 1624204029.790995 0.000000
110.142.206.85 Implementation guess: Linksys Etherfast
Ending ike-scan 1.9.4: 1 hosts scanned in 60.426 seconds (0.02 hosts/sec). 1 returned handshake; 0 returned notify
There is a possibility to use the so called aggressive mode (default is Main Mode) which uses a 3-way-handshake where the VPN sends an unencrypted message to the client containing the hashed PSK. If you manage to capture the plaintext hash, you could use psk-crack to perform a brute force attack and try to recover the PSK (Pre-shared key).
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is not a very well known tool, however it can offer some valuable insights to experienced security experts and a possibility to use the recovered data in further exploitation/scanning.</div>
For more information please refer to the full [https://linux.die.net/man/1/ike-scan tool documentation].

=== Dnsenum ===
Category: Information Gathering - DNS Analysis 
This is an efficient and well-performing tool for locating all DNS servers and DNS entries for a given organization. A basic demonstration on the example of <code>google.com</code> is shown below (some entries have been replaced with ... to keep it as short as possible):
$ dnsenum google.com 255 ⨯
dnsenum VERSION:1.2.6
----- google.com -----
Host's addresses:
__________________
google.com. 300 IN A 216.58.201.78
Name Servers:
______________

ns2.google.com. 345600 IN A 216.239.34.10
ns4.google.com. 345600 IN A 216.239.38.10
ns1.google.com. 345600 IN A 216.239.32.10
ns3.google.com. 345600 IN A 216.239.36.10

Mail (MX) Servers:
___________________

aspmx.l.google.com. 293 IN A 173.194.69.27
alt1.aspmx.l.google.com. 293 IN A 142.250.150.27
alt2.aspmx.l.google.com. 293 IN A 74.125.200.27
alt3.aspmx.l.google.com. 293 IN A 142.250.157.27
alt4.aspmx.l.google.com. 293 IN A 173.194.202.26

Trying Zone Transfers and getting Bind Versions:
_________________________________________________
Trying Zone Transfer for google.com on ns1.google.com ...
AXFR record query failed: corrupt packet
...
Trying Zone Transfer for google.com on ns4.google.com ...
AXFR record query failed: corrupt packet

Brute forcing with /usr/share/dnsenum/dns.txt:
_______________________________________________

about.google.com. 0 IN CNAME www3.l.google.com.
www3.l.google.com. 300 IN A 172.217.23.238
accounts.google.com. 300 IN A 172.217.23.205
admin.google.com. 300 IN A 172.217.23.206
ads.google.com. 300 IN A 216.58.201.78
america.google.com. 0 IN CNAME www3.l.google.com.
...
www.google.com. 300 IN A 172.217.23.196

google.com class C netranges:
______________________________

8.8.4.0/24
8.8.8.0/24
...
216.239.36.0/24
216.239.38.0/24

Performing reverse lookup on 4096 ip addresses:
________________________________________________

68.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
69.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
70.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
10.32.239.216.in-addr.arpa. 86400 IN PTR ns1.google.com.
11.32.239.216.in-addr.arpa. 86400 IN PTR ns.google.com.
15.32.239.216.in-addr.arpa. 86400 IN PTR time1.google.com.
116.32.239.216.in-addr.arpa. 86400 IN PTR e2a.google.com.
10.34.239.216.in-addr.arpa. 86400 IN PTR ns2.google.com.
10.36.239.216.in-addr.arpa. 86400 IN PTR ns3.google.com.
11.36.239.216.in-addr.arpa. 86400 IN PTR hedns1.google.com.
10.38.239.216.in-addr.arpa. 86400 IN PTR ns4.google.com.

11 results out of 4096 IP addresses.

google.com ip blocks:
______________________

64.9.224.68/31
64.9.224.70/32
216.239.32.10/31
216.239.32.15/32
216.239.32.116/32
216.239.34.10/32
216.239.36.10/31
216.239.38.10/32

done.
You can also use the --enum flag to gather whois information and to dig up subdomains.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A very convenient and useful tool for DNS information gathering on domains/servers etc. Results are also very well arranged and offer a clear overview.</div>
For more information please refer to the full [https://tools.kali.org/information-gathering/dnsenum tool documentation].

=== Swaks ===
Category: Information Gathering - SMTP Scan 
This tool is for sending e-mails of all kinds. Now, compared to a regular e-mail client, here you can change the header, attachments, which server to talk to and more. It handles TLS, authentication, and pipelining.
 Since I don't have my own SMTP server available, for demonstration purposes we will use the Gmail's SMTP server:
$ swaks -t example.receiver@gmail.com -s smtp.gmail.com:587 -tls -a LOGIN
You will then be prompted to enter Gmail credentials of an actual existing account. However, from security reasons, Gmail will probably block this login attempt, that's why using your own SMTP server would be ideal. To have a look at some more examples of changing headers and using different servers, please refer [https://github.com/jetmore/swaks/blob/v20201014.0/doc/base.pod here].

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This tool is known as the Swiss Army Knife for SMTP (=Swaks) and helps you with the complexity of setting up e-mail servers. You have many various possibilities of choosing a mail server and changing headers and other data, that you wouldn't have if you sent an email from a simple public mail server.</div>
For more information please refer to the full [https://linux.die.net/man/1/swaks tool documentation].

=== SSLdump ===
Category: Information Gathering - SSL Analysis 
SSLdump is a TLS/SSL network protocol analyzer that identifies TCP streams/connections from a specified port and interface and attempts to interpret them. Once it identifies SSL/TLS traffic, it decodes and displays the content in a readable form as text. If you provide a necessary key as well, it can decrypt the connection fully and display the exchanged application data traffic (<code>ssldump -Ad -k ~/privatekey.pem -p password -i eth0 host user123</code>). Below is a demonstration of a basic command that listens to traffic on port 443 of interface eth0:

$ sudo ssldump -i eth0 port 443
New TCP connection #2: 192.168.0.102(53984) <-> edge-star-mini-shv-01-vie1.facebook.com(443)
2 1 0.0096 (0.0096) C>S Handshake
ClientHello
Version 3.3
resume [32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipher suites
TLS_AES_128_GCM_SHA256
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
compression methods
NULL
extensions
server_name
host_name: www.facebook.com
extended_master_secret
renegotiation_info
supported_groups
ec_point_formats
session_ticket
application_layer_protocol_negotiation
status_request
key_share
supported_versions
signature_algorithms
psk_key_exchange_modes
record_size_limit
padding
ja3 string:
771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-51-43-13-45-28-21,29-23-24-25-256-257,0
ja3 fingerprint: aa7744226c695c0b2e440419848cf700
2 2 0.0146 (0.0049) S>C Handshake
ServerHello
Version 3.3
session_id[32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipherSuite TLS_AES_128_GCM_SHA256
compressionMethod NULL
extensions
supported_versions
key_share
ja3s string: 771,4865,43-51
ja3s fingerprint: f4febc55ea12b31ae17cfb7e614afda8
2 3 0.0146 (0.0000) S>C ChangeCipherSpec
2 4 0.0146 (0.0000) S>C application_data

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This seems to be a very powerful tool with which you can actually sniff SSL encrypted traffic, and even if you don't have the private key, you can see the TLS handshake and the hello's from client and server together with their exchanged cipher suites.</div>
For more information please refer to the full [https://linux.die.net/man/1/ssldump tool documentation].

== What's different in ParrotOS? ==
As we know, you can install any tools from Kali also on ParrotOS, and the other way around, that's why in this context, the preinstalled tools are meant. Overall you can say, that the "main" tools are the same on both operating systems.
<div><ul>
<li style="display: inline-block;"> [[File:ComparisonKaliParr.png|thumb|none|500px|Information Gathering Tools Menu Preview Comparison]] </li>
</ul></div>
On the first glance the tools look very similar, however when you click on the the various sub-categories, you can see that Parrot offers a greater range of tools. Refer to the table below for a detailed overview:

<table class="wikitable" style="width: 50%>
<tr>
<th style="background-color: #ccccff; color: #000000;">Tool Category</th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Kali<<<<< </th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Parrot<<<<< </th>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">DNS Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsenum
 dnsrecon
 fierce 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsdict6
 dnsenum
 dnsmap
 dnsrecon
 dnstracer
 dnswalk
 fierce
 gobuster
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">IDS/IPS Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 wafw00f 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 fragrouter
 ftest 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Live Host Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 fping
 hping3
 masscan
 thcping6 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 cdpsnarf
 detect-new-ip6
 fping
 hping3
 inverse_lookup6
 ncat
 passive_discovery6
 thcping6
 xprobe2 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Network & port scanners</td>
<td style="background-color: #f4f4ff; color: #000000;">
masscan
 nmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
amap
 etherape
 masscan
 nmap
 unicornscan
 wireshark 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">OSINT Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
maltego
 spiderfoot
 spiderfoot-cli
 theharvester 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
casefile
 maltego
 metagoofil
 theharvester
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Route Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
netdiscover
 netmask 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
0trace
 intrace
 irpas-ass
 irpass-cdp
 netmask
 trace6 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMB Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMTP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">swaks</td>
<td style="background-color: #f4f4ff; color: #000000;">
smtp-user-enum
 swaks 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SNMP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
onesixtyone
 snmp-check 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
braa
 onesixtyone
 snmp-check 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SSL Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
</tr>

</table>

== References ==

* https://www.parrotsec.org/docs/
* https://www.kali.org/docs/

[[Category:Pentesting]]

Information Gathering Tools

2021-06-24T08:18:33Z

MFriedl:

== Summary ==

This is a draft. Comparing various available pre-installed information gathering tools in Kali and comparing differences to ParrotOS. This document is NOT a documentation of the tools, it is merely a comparison and practical evaluation of the tools for an average security specialist or a security newbie wanting to start using the tools.

== Requirements ==

* Operating system: Kali Linux 2021.1 amd64, Parrot Security 4.10 amd64
Disclaimer: all possible examples and tests done have been done in VMWare in a Kali Linux 2021.1 and the commands are up-to-date as of 21st June 2021.

== Tools==

=== Nmap ===
Category: Information Gathering - Network & Port Scanners 
Nmap is known to be a very powerful tool for information gathering and vulnerability scanning. It offers loads of options, offering for example for host discovery, scans (TCP, UDP, IP...), service/version detection, OS detection, firewalls/IDS evasion and spoofing, script scanning etc. Since this is not meant to be a [https://nmap.org/book/man.html full documentation] of the tools, but rather an evaluation overview, compared to the other tools in this category, Nmap is the one main tool that most of the other secondary tools are using and it is very powerful. See the following tools for some comparison and Nmap examples.

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: If your goal is to perform a network scan to determine alive hosts, open ports, used systems on ports or used operation systems on the hosts, this would be the way to go. It is fast and efficient (speed depends on the range of hosts and ports scanned though). The other tools that offer these results are using Nmap anyway, for example the way DMitry or Legion use it.</div>
For more information please refer to the full [https://nmap.org/book/man.html tool documentation].

=== Spiderfoot ===
Category: Information Gathering - OSINT 
This is a reconnaissance framework that uses many modules for information gathering, working on the OSINT principle. You can access a GUI by starting the framework on a port on localhost and accessing that address via web browser once it starts:
 <code>$ spiderfoot -l 127.0.0.1:5001</code> 
You can then set up a new scan, where you would give the program a target: this can be a domain/sub-domain name, IPv4 or IPv6 address, hostname, subnet, ASN, e-mail address, phone number, a person's actual name or username. This gives a really wide spectrum on options. The full scan is demonstrated below.
scan www.fh-campuswien.ac.at for a full scan, where you "get anything and everything about the target":
Execution takes many days, depending on the size of the target and the information available on the internet to that target. This specific inquiry took several days to complete and collect all information. Some parts of the information is displayed below, however the results were much more extensive:
<div><ul>
<li style="display: inline-block;"> [[File:Spiderscan.png|thumb|none|800px|Results of Spiderfoot Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is a very good and very powerful reconnaissance framework. It really collects "anything and everything" about a target, as it states. The scans take a very long time, but the amount of information connected is priceless, it really searches through the whole www to provide any and every connection to the target. Based on the very user friendly and well-arranged GUI it is quite good for beginners too, however the amount of data delivered is useful only for professional security analysts who know what to do with the results, how to navigate them and how to interpret them.</div>
For more information please refer to the full [https://www.spiderfoot.net/documentation/ tool documentation].

=== Legion ===
Category: Information Gathering - general 
Legion is a GUI tool, a network penetration testing framework, that offers many options. It automatically detects CVEs and provides nmap, Vulners, whataweb, webslayer, sslyzer, SMBenum, dirbuster, nikto, Hydra and other additional scripts. Its execution takes up to a couple of minutes. A demonstration:
scan www.fh-campuswien.ac.at
<div><ul>
<li style="display: inline-block;"> [[File:Legion scan.png|thumb|none|600px|Results of Legion Scan on www.fh-campuswien.ac.at]] </li>
</ul></div>
No CVEs have been found. Below is a comparison with the Metasploitable2 machine that can be found in the same subnet, so that it is clear how the vulnerabilities are shown in an actual weak system:
<div><ul>
<li style="display: inline-block;"> [[File:Meta legion.png|thumb|none|1000px|Results of Legion Scan on Metasploitable2 VM]] </li>
</ul></div>
It is safe to say that it is a very powerful and useful tool, also very user friendly and quite fast. Maybe not the best for domains in the internet because it won't offer much more information than nmap and whois lookup, but when you look at the metasploitable output, so a scan of a server, you can see how much information is shown. The implementation of Hydra also gets you the cracked passwords in the vulnerabilities which is very useful. 
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall definitely a recommended tool, nice GUI, works quickly and efficiently and is very well arranged and easy to navigate.</div>
For more information please refer to the full [https://govanguard.com/legion/#about-legion official Legion Framework website].

=== DMitry===
Category: Information Gathering - general 
DMitry is a CLI tool to gather information about a host - possible subdomains, uptime information, tcp port scan, email addresses, whois lookups etc. It is mostly used to reveal information that exists through search engines about the owner or host of a web page, i.e. for social engineering attacks.
 
When using the portscan option, the results show less open ports than doing that same TCP scan with nmap.
 DMitry:
HostIP:192.168.0.130
HostName:
Gathered TCP Port information for 192.168.0.130
Port State
23/tcp open
Portscan Finished: Scanned 150 ports, 148 ports were in state closed
Nmap:
Nmap scan report for 192.168.0.130
Host is up (0.20s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
23/tcp open telnet
554/tcp open rtsp
843/tcp open unknown
5001/tcp open commplex-link
MAC Address: 7C:DD:90:AF:4E:7D (Shenzhen Ogemray Technology)
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

To find out information about a domain, you need either the IP or the domain same.
 Whois lookup on the other hand gets you some nice useful results. Below is an example of using <code>dmitry -w www.fh-campuswien.ac.at</code> on the college website of FH Campus Wien www.fh-campuswien.ac.at, and it just goes to show that it is exactly the same output as if you were to type <code>whois fh-campuswien.ac.at</code>
HostIP:91.213.77.62
HostName:www.fh-campuswien.ac.at
Gathered Inic-whois information for fh-campuswien.ac.at
---------------------------------
domain: fh-campuswien.ac.at
registrar:
registrant: FCW1942152-NICAT
admin-c: <data not disclosed>
tech-c: NLTU11579014-NICAT
nserver: ns.nextlayer.at
remarks: 81.16.150.30
nserver: ns2.nextlayer.at
remarks: 81.16.151.30
changed: 20171003 19:16:08
source: AT-DOM
personname:
organization: fh campus wien
street address: Favoritenstrasse 226
postal code: A-1100
city: Vienna
country: Austria
phone: +43160668771000
fax-no: +43160668771009
e-mail: office@fh-campuswien.ac.at
nic-hdl: FCW1942152-NICAT
changed: 20100323 17:12:46
source: AT-DOM
personname: Hostmaster Hostmaster
organization: next layer Telekommunikationsdienstleistungs- und BeratungsGmbH
street address: Mariahilfer Guertel 37- 7
postal code: 1150
city: Vienna
country: Austria
phone: +43517649
e-mail: hostmaster@nextlayer.at
nic-hdl: NLTU11579014-NICAT
changed: 20170929 13:17:54
source: AT-DOM

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Overall a nice tool, useful for beginners who don't have experience with the basic tools yet. However, to an experienced IT Security specialist, the tools that DMitry is based on, like nmap and whois would be the better choice to use here, since they just offer you the same output and nmap and whois itself offer much more options. One drawback however is that you need to install whois separately, whilst DMitry will be in the preinstalled set of tools. When it comes to portscan, it offers pretty insufficient results in DMitry.
This tool is fairly outdated nowadays, although it used to be very good a few years ago. Now there are better alternatives.</div>
For more information please refer to the full [https://linux.die.net/man/1/dmitry tool documentation].

=== Recon-ng ===
Category: Information Gathering - general 
On the first glance, it looks very similar to Metasploit. You can start it via the command line and enter an environment in the shell. It is a python web reconnaissance framework designed specifically for web-based information gathering, and is, unlike Metasploit, not an exploitation framework. 
To navigate it, always utilize the help flag to view possible options. At first, you won't have any modules enables/installed, which is kind of confusing and one really has to look into the documentation first before using it because the shell environment isn't that intuitive. 
To view available modules, use <code>show modules</code>. When you want to start now, create a workspace first where your retrieved data will be saved:
[recon-ng][default] > workspaces create test
Now install the module you would like to use, we will use hackertarget to get subdomains. You can use <code>marketplace search hackertarget</code> to view the module and install it by:
[recon-ng][test] > marketplace install hackertarget
[*] Module installed: recon/domains-hosts/hackertarget
[*] Reloading modules...
Now we will load the module and set the source of input, which we want to retrieve data from. With the command <code>info</code> or <code>input</code> you can view the current source. Execute the module with <code>run</code>:
[recon-ng][test] > modules load hackertarget
[recon-ng][test][hackertarget] > options set SOURCE tesla.com
[recon-ng][test][hackertarget] > run
This will get you 27 found hosts, after the <code>show hosts</code> command you can review them in an arranged list:
+---------------------------------------------------------------------------------------------------------------------+
| rowid | host | ip_address | region | country | latitude | longitude | notes | module |
+---------------------------------------------------------------------------------------------------------------------+
| 1 | tesla.com | 199.66.11.62 | | | | | | hackertarget |
| 2 | o7.ptr6980.tesla.com | 149.72.144.42 | | | | | | hackertarget |
| 3 | vpn1.tesla.com | 8.45.124.215 | | | | | | hackertarget |
| 4 | model3.tesla.com | 205.234.27.221 | | | | | | hackertarget |
| 5 | o3.ptr1444.tesla.com | 149.72.152.236 | | | | | | hackertarget |
| 6 | o2.ptr556.tesla.com | 149.72.134.64 | | | | | | hackertarget |
| 7 | o5.ptr8466.tesla.com | 149.72.172.170 | | | | | | hackertarget |
| 8 | o6.ptr9437.tesla.com | 168.245.123.10 | | | | | | hackertarget |
| 9 | o4.ptr1867.tesla.com | 149.72.163.58 | | | | | | hackertarget |
| 10 | mobile.tesla.com | 209.133.79.82 | | | | | | hackertarget |
| 11 | marketing.tesla.com | 13.111.47.196 | | | | | | hackertarget |
| 12 | o1.ptr2410.link.tesla.com | 149.72.247.52 | | | | | | hackertarget |
| 13 | referral.tesla.com | 72.10.32.90 | | | | | | hackertarget |
| 14 | mta2.email.tesla.com | 13.111.4.231 | | | | | | hackertarget |
| 15 | mta.email.tesla.com | 13.111.14.190 | | | | | | hackertarget |
| 16 | xmail.tesla.com | 204.74.99.100 | | | | | | hackertarget |
| 17 | comparison.tesla.com | 64.125.183.133 | | | | | | hackertarget |
| 18 | emails.tesla.com | 13.111.18.27 | | | | | | hackertarget |
| 19 | mta2.emails.tesla.com | 13.111.88.1 | | | | | | hackertarget |
| 20 | mta3.emails.tesla.com | 13.111.88.2 | | | | | | hackertarget |
| 21 | mta4.emails.tesla.com | 13.111.88.52 | | | | | | hackertarget |
| 22 | mta5.emails.tesla.com | 13.111.88.53 | | | | | | hackertarget |
| 23 | mta.emails.tesla.com | 13.111.62.118 | | | | | | hackertarget |
| 24 | click.emails.tesla.com | 13.111.48.179 | | | | | | hackertarget |
| 25 | view.emails.tesla.com | 13.111.49.179 | | | | | | hackertarget |
| 26 | events.tesla.com | 13.111.47.195 | | | | | | hackertarget |
| 27 | shop.eu.tesla.com | 205.234.27.221 | | | | | | hackertarget |
+---------------------------------------------------------------------------------------------------------------------+
Disclaimer: the used Recon-ng version here is <code>recon-ng v5.1.1</code>, which is important to note, because countless tutorials on the internet refer to older commands which no longer work, so you kind of really have to play around with it to see which modules work (because some don't) and what commands are available by always utilizing the <code>help</code> flag along the way.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A powerful framework that offers many modules to perform reconnaissance on web-hosts. Personally would not recommend to newbies, simply because it is not that easy and intuitive to navigate, some modules are not working and the documentation is pretty lacking, with internet tutorials often showing old versions of commands.</div>
For more information please refer to the official [https://tools.kali.org/information-gathering/recon-ng documentation] or Github, however the documentation in this case is quite lacking.

=== Maltego ===
Category: Information Gathering - OSINT 
Maltego is a graphical footprinting tool with quite some extensions available. With the preinstalled extensions you can allready footprint any domain and view it as a tree. where this tree is formatted according to the amount discovered and may change to a mesh view, if it would get too crowded.
[[File:Elvis.science.png|thumb|none|700px|Example footprinting of elvis.science]]

=== Netdiscover ===
Category: Information Gathering - Route Analysis 
This is another reconnaissance tool that can be used for host discovery on wireless and switched networks. You can scan your subnet at home or at work, wherever your device is connected. It works through ARP requests and can detect hosts either by actively sending requests, or if you set it to passive mode, only by sniffing. 
If Nmap is too much for a given moment and you just want to see quickly who is in your network, this is the way to go. Below is a comparison of Netdiscover used on a local subnet, a very well-arranged output, and nmap, which in some situations offers too much:
$ netdiscover -r 192.168.0.0/24
20 Captured ARP Req/Rep packets, from 16 hosts. Total size: 1200
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.0.1 00:xx:xx:xx:xx:c2 2 120 Cisco Systems, Inc
192.168.0.9 00:xx:xx:xx:xx:a9 1 60 Weinzierl Engineering GmbH
192.168.0.10 50:xx:xx:xx:xx:c7 1 60 Loxone Electronics GmbH
192.168.0.80 54:xx:xx:xx:xx:a0 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.81 18:xx:xx:xx:xx:50 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.82 54:xx:xx:xx:xx:ff 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.83 28:xx:xx:xx:xx:27 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.84 18:xx:xx:xx:xx:d7 1 60 Hangzhou Hikvision Digital Technology Co.,Ltd.
192.168.0.101 48:xx:xx:xx:xx:2e 1 60 ZENNIO AVANCE Y TECNOLOGIA, S.L.
192.168.0.102 00:xx:xx:xx:xx:bb 1 60 VMware, Inc.
192.168.0.109 fc:xx:xx:xx:xx:f9 4 240 Ubiquiti Networks Inc.
192.168.0.112 04:xx:xx:xx:xx:a5 1 60 ASUSTek COMPUTER INC.
192.168.0.132 00:xx:xx:xx:xx:d4 1 60 VMware, Inc.
192.168.0.149 c4:xx:xx:xx:xx:48 1 60 Hewlett Packard
192.168.0.172 8c:xx:xx:xx:xx:eb 1 60 Apple, Inc.
192.168.0.195 f2:xx:xx:xx:xx:3a 1 60 Unknown vendor
If you were to do this same information in Nmap, you would need to perform a host discovery scan first:
$ nmap -sP 192.168.0.0/24 
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-20 16:34 CEST
Nmap scan report for 192.168.0.1 Host is up (0.0051s latency).
Nmap scan report for 192.168.0.10 Host is up (0.00058s latency).
Nmap scan report for 192.168.0.80 Host is up (0.00034s latency).
Nmap scan report for 192.168.0.81 Host is up (0.0018s latency).
Nmap scan report for 192.168.0.82 Host is up (0.0017s latency).
Nmap scan report for 192.168.0.83 Host is up (0.0037s latency).
Nmap scan report for 192.168.0.84 Host is up (0.0019s latency).
Nmap scan report for 192.168.0.101 Host is up (0.00045s latency).
Nmap scan report for 192.168.0.102 Host is up (0.00018s latency).
Nmap scan report for 192.168.0.107 Host is up (0.00021s latency).
Nmap scan report for 192.168.0.109 Host is up (0.00049s latency).
Nmap scan report for 192.168.0.132 Host is up (0.00033s latency).
Nmap scan report for 192.168.0.172 Host is up (0.089s latency).
Nmap done: 256 IP addresses (13 hosts up) scanned in 2.42 seconds
Only then you can scan each alive host separately for their Hostname/OS/MAC address with <code>sudo nmap -O <IP address></code>. That is unless you want to wait several hours by scanning the whole subnet for their OS which I would not recommend since it takes so long. If you need a quick swipe, Nmap is possibly the inferior option here and could be used once you want to find out more about each host, their ports etc.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: Definitely a useful tool for an initial scan, or in a case where you don't know what range to look for exactly, since it is very fast. If you just want to find alive hosts and their IPs in a big range, this would be a good option. Nmap however, offers alive hosts discovery as well, and if you turn portscan off, it will be much faster than Netdiscover. Netdiscover kind of connects the various options of Nmap by showing IPs, MACs and Hostnames and makes it fairly easy to use, without having to read the extensive documentation of Nmap in the hope to find the correct options to perform a simple initial scan.</div>
For more information please refer to the full [https://manpages.debian.org/unstable/netdiscover/netdiscover.8.en.html tool documentation].

=== Ike-scan ===
Category: Information Gathering - general 
Ike-scan is useful for VPN endpoints. To explain this a little, first we should know what IKE is. It is Internet Key Exchange protocol, which is used by IPsec. The majority of IPsec VPNs use IKE for key exchange. The Ike-scan tool is for discovering, testing and fingerprinting IPsec VPN systems. It sends IKE phase 1 packets to the target and displays the received responses. To be able to test this, we now need a target that we are certain uses IKE for key exchange. To achieve this, we will demonstrate this on an IP address found through www.shodan.io, where you need to search for the keyword "IKE" to find targets that satisfy this condition. For demonstration, we chose the IP 110.142.206.85, which should be a VPN in Melbourne, Australia.
$ ike-scan 110.142.206.85
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
110.142.206.85 Main Mode Handshake returned HDR=(CKY-R=49cc50cbfcf85509) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) VID=dbfb81eb5760b0788562067da102d755 VID=09002689dfd6b712 (XAUTH) VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0) VID=12f5f28c457168a9702d9fe274cc0100 (Cisco Unity)
Ending ike-scan 1.9.4: 1 hosts scanned in 0.356 seconds (2.81 hosts/sec). 1 returned handshake; 0 returned notify
This returns the main mode handshake and shows information like security associations (hash, encoding, authentication) and also vendor ID etc.
 The following scan tries to fingerprint the firewall in use and additionally to the previous output it shows the following:
$ ike-scan --showbackoff -v -v 110.142.206.85
DEBUG: pkt len=336 bytes, bandwidth=56000 bps, int=52000 us
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
--- Sending packet #1 to host entry 1 (110.142.206.85) tmo 500000 us
--- Received packet #1 from 110.142.206.85
--- Removing host entry 1 (110.142.206.85) - Received 152 bytes
IKE Backoff Patterns:
IP Address No. Recv time Delta Time
110.142.206.85 1 1624204029.790995 0.000000
110.142.206.85 Implementation guess: Linksys Etherfast
Ending ike-scan 1.9.4: 1 hosts scanned in 60.426 seconds (0.02 hosts/sec). 1 returned handshake; 0 returned notify
There is a possibility to use the so called aggressive mode (default is Main Mode) which uses a 3-way-handshake where the VPN sends an unencrypted message to the client containing the hashed PSK. If you manage to capture the plaintext hash, you could use psk-crack to perform a brute force attack and try to recover the PSK (Pre-shared key).
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This is not a very well known tool, however it can offer some valuable insights to experienced security experts and a possibility to use the recovered data in further exploitation/scanning.</div>
For more information please refer to the full [https://linux.die.net/man/1/ike-scan tool documentation].

=== Dnsenum ===
Category: Information Gathering - DNS Analysis 
This is an efficient and well-performing tool for locating all DNS servers and DNS entries for a given organization. A basic demonstration on the example of <code>google.com</code> is shown below (some entries have been replaced with ... to keep it as short as possible):
$ dnsenum google.com 255 ⨯
dnsenum VERSION:1.2.6
----- google.com -----
Host's addresses:
__________________
google.com. 300 IN A 216.58.201.78
Name Servers:
______________

ns2.google.com. 345600 IN A 216.239.34.10
ns4.google.com. 345600 IN A 216.239.38.10
ns1.google.com. 345600 IN A 216.239.32.10
ns3.google.com. 345600 IN A 216.239.36.10

Mail (MX) Servers:
___________________

aspmx.l.google.com. 293 IN A 173.194.69.27
alt1.aspmx.l.google.com. 293 IN A 142.250.150.27
alt2.aspmx.l.google.com. 293 IN A 74.125.200.27
alt3.aspmx.l.google.com. 293 IN A 142.250.157.27
alt4.aspmx.l.google.com. 293 IN A 173.194.202.26

Trying Zone Transfers and getting Bind Versions:
_________________________________________________
Trying Zone Transfer for google.com on ns1.google.com ...
AXFR record query failed: corrupt packet
...
Trying Zone Transfer for google.com on ns4.google.com ...
AXFR record query failed: corrupt packet

Brute forcing with /usr/share/dnsenum/dns.txt:
_______________________________________________

about.google.com. 0 IN CNAME www3.l.google.com.
www3.l.google.com. 300 IN A 172.217.23.238
accounts.google.com. 300 IN A 172.217.23.205
admin.google.com. 300 IN A 172.217.23.206
ads.google.com. 300 IN A 216.58.201.78
america.google.com. 0 IN CNAME www3.l.google.com.
...
www.google.com. 300 IN A 172.217.23.196

google.com class C netranges:
______________________________

8.8.4.0/24
8.8.8.0/24
...
216.239.36.0/24
216.239.38.0/24

Performing reverse lookup on 4096 ip addresses:
________________________________________________

68.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
69.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
70.224.9.64.in-addr.arpa. 86400 IN PTR vpn.google.com.
10.32.239.216.in-addr.arpa. 86400 IN PTR ns1.google.com.
11.32.239.216.in-addr.arpa. 86400 IN PTR ns.google.com.
15.32.239.216.in-addr.arpa. 86400 IN PTR time1.google.com.
116.32.239.216.in-addr.arpa. 86400 IN PTR e2a.google.com.
10.34.239.216.in-addr.arpa. 86400 IN PTR ns2.google.com.
10.36.239.216.in-addr.arpa. 86400 IN PTR ns3.google.com.
11.36.239.216.in-addr.arpa. 86400 IN PTR hedns1.google.com.
10.38.239.216.in-addr.arpa. 86400 IN PTR ns4.google.com.

11 results out of 4096 IP addresses.

google.com ip blocks:
______________________

64.9.224.68/31
64.9.224.70/32
216.239.32.10/31
216.239.32.15/32
216.239.32.116/32
216.239.34.10/32
216.239.36.10/31
216.239.38.10/32

done.
You can also use the --enum flag to gather whois information and to dig up subdomains.
<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: A very convenient and useful tool for DNS information gathering on domains/servers etc. Results are also very well arranged and offer a clear overview.</div>
For more information please refer to the full [https://tools.kali.org/information-gathering/dnsenum tool documentation].

=== Swaks ===
Category: Information Gathering - SMTP Scan 
This tool is for sending e-mails of all kinds. Now, compared to a regular e-mail client, here you can change the header, attachments, which server to talk to and more. It handles TLS, authentication, and pipelining.
 Since I don't have my own SMTP server available, for demonstration purposes we will use the Gmail's SMTP server:
$ swaks -t example.receiver@gmail.com -s smtp.gmail.com:587 -tls -a LOGIN
You will then be prompted to enter Gmail credentials of an actual existing account. However, from security reasons, Gmail will probably block this login attempt, that's why using your own SMTP server would be ideal. To have a look at some more examples of changing headers and using different servers, please refer [https://github.com/jetmore/swaks/blob/v20201014.0/doc/base.pod here].

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This tool is known as the Swiss Army Knife for SMTP (=Swaks) and helps you with the complexity of setting up e-mail servers. You have many various possibilities of choosing a mail server and changing headers and other data, that you wouldn't have if you sent an email from a simple public mail server.</div>
For more information please refer to the full [https://linux.die.net/man/1/swaks tool documentation].

=== SSLdump ===
Category: Information Gathering - SSL Analysis 
SSLdump is a TLS/SSL network protocol analyzer that identifies TCP streams/connections from a specified port and interface and attempts to interpret them. Once it identifies SSL/TLS traffic, it decodes and displays the content in a readable form as text. If you provide a necessary key as well, it can decrypt the connection fully and display the exchanged application data traffic (<code>ssldump -Ad -k ~/privatekey.pem -p password -i eth0 host user123</code>). Below is a demonstration of a basic command that listens to traffic on port 443 of interface eth0:

$ sudo ssldump -i eth0 port 443
New TCP connection #2: 192.168.0.102(53984) <-> edge-star-mini-shv-01-vie1.facebook.com(443)
2 1 0.0096 (0.0096) C>S Handshake
ClientHello
Version 3.3
resume [32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipher suites
TLS_AES_128_GCM_SHA256
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
compression methods
NULL
extensions
server_name
host_name: www.facebook.com
extended_master_secret
renegotiation_info
supported_groups
ec_point_formats
session_ticket
application_layer_protocol_negotiation
status_request
key_share
supported_versions
signature_algorithms
psk_key_exchange_modes
record_size_limit
padding
ja3 string:
771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-51-43-13-45-28-21,29-23-24-25-256-257,0
ja3 fingerprint: aa7744226c695c0b2e440419848cf700
2 2 0.0146 (0.0049) S>C Handshake
ServerHello
Version 3.3
session_id[32]=
37 64 3d 51 d2 3d 5a 44 38 c6 72 d6 7f 34 16 ed
cc f0 32 fe ed 95 94 67 c8 dc ec 2e f5 ba 04 cf
cipherSuite TLS_AES_128_GCM_SHA256
compressionMethod NULL
extensions
supported_versions
key_share
ja3s string: 771,4865,43-51
ja3s fingerprint: f4febc55ea12b31ae17cfb7e614afda8
2 3 0.0146 (0.0000) S>C ChangeCipherSpec
2 4 0.0146 (0.0000) S>C application_data

<div style="border: 1px solid #225207; background-color: #dffdcd; color: #225207; padding: 5px 10px; margin-bottom: 5px; text-align: justify">Conclusion: This seems to be a very powerful tool with which you can actually sniff SSL encrypted traffic, and even if you don't have the private key, you can see the TLS handshake and the hello's from client and server together with their exchanged cipher suites.</div>
For more information please refer to the full [https://linux.die.net/man/1/ssldump tool documentation].

== What's different in ParrotOS? ==
As we know, you can install any tools from Kali also on ParrotOS, and the other way around, that's why in this context, the preinstalled tools are meant. Overall you can say, that the "main" tools are the same on both operating systems.
<div><ul>
<li style="display: inline-block;"> [[File:ComparisonKaliParr.png|thumb|none|500px|Information Gathering Tools Menu Preview Comparison]] </li>
</ul></div>
On the first glance the tools look very similar, however when you click on the the various sub-categories, you can see that Parrot offers a greater range of tools. Refer to the table below for a detailed overview:

<table class="wikitable" style="width: 50%>
<tr>
<th style="background-color: #ccccff; color: #000000;">Tool Category</th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Kali<<<<< </th>
<th style="background-color: #ccccff; color: #000000;"> >>>>>Parrot<<<<< </th>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">DNS Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsenum
 dnsrecon
 fierce 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
dnsdict6
 dnsenum
 dnsmap
 dnsrecon
 dnstracer
 dnswalk
 fierce
 gobuster
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">IDS/IPS Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 wafw00f 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
lbd
 fragrouter
 ftest 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Live Host Identification</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 fping
 hping3
 masscan
 thcping6 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
arping
 cdpsnarf
 detect-new-ip6
 fping
 hping3
 inverse_lookup6
 ncat
 passive_discovery6
 thcping6
 xprobe2 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Network & port scanners</td>
<td style="background-color: #f4f4ff; color: #000000;">
masscan
 nmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
amap
 etherape
 masscan
 nmap
 unicornscan
 wireshark 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">OSINT Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
maltego
 spiderfoot
 spiderfoot-cli
 theharvester 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
casefile
 maltego
 metagoofil
 theharvester
 urlcrazy 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">Route Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
netdiscover
 netmask 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
0trace
 intrace
 irpas-ass
 irpass-cdp
 netmask
 trace6 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMB Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
enum4linux
 nbtscan
 smbmap 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SMTP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">swaks</td>
<td style="background-color: #f4f4ff; color: #000000;">
smtp-user-enum
 swaks 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SNMP Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
onesixtyone
 snmp-check 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
braa
 onesixtyone
 snmp-check 
</td>
</tr>
<tr>
<td style="background-color: #e6e6ff; color: #000000; font-weight: bold">SSL Analysis</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
<td style="background-color: #f4f4ff; color: #000000;">
ssldump
 sslh
 sslscan
 sslyze 
</td>
</tr>

</table>

== References ==

* https://www.parrotsec.org/docs/
* https://www.kali.org/docs/

[[Category:Pentesting]]

File:Elvis.science.png

2021-06-24T08:13:32Z

MFriedl:

Kali vs. Black Arch vs. Parrot

2021-05-18T06:53:27Z

MFriedl:

== Summary ==

This is a draft about the differences of the three operating systems

== Differences ==

=== Description ===

==== Black Arch ====

Black Arch is an Arch Linux-based penetration testing distibution. It is a relatively new project, therefore there will be more bugs, less documentation and more room for improvement overall. The repository contains 2677 tools, which you can install either individually or in groups. Depending on whether you install the Full Iso or Slim Iso, which is a more lightweight version that will save you some storage space, you have multiple windows managers.

==== Kali Linux ====

Kali is a Debian-based well-known penetration testing and digital forensics Linux distribution, created for cyber security experts. It has around 600 pre-installed tools.

==== ParrotOS ====

ParrotOS is a Debian-based Linux distibution, while the Parrot Security is especially designed for security specialists, offering tools for pentesting, digital forensics and reverse engineering, but also for software engineers. It has a simplistic GUI and is a lightweight distro and comes with even more pre-installed tools than Kali does.

=== First Impression ===

==== Black Arch ====
First impression is a very sterile and simplistic one. Basically you just see the background, date and time on the bottom, and only by doing a right click, you can access the "blackarch menu" tab, from where you can open terminals in various color schemes and access all of the available tools, as can be seen in the screenshot below.

<div><ul>
<li style="display: inline-block;"> [[File:BlackArch_Homescreen.PNG|thumb|none|700px|Black Arch homescreen Tools overview]] </li>
</ul></div>

==== Kali Linux ====
A big leap from the BlackArch aesthetics. This now looks like an actual homescreen, more like something a human would want to work with, compared to BlackArch, but this obviously comes down to everyone's own preference. There is a dropdown menu from where you access the preinstalled tools, as shown in the screenshot below.

<div><ul>
<li style="display: inline-block;"> [[File:Kali_Homescreen.PNG|thumb|none|700px|Kali Linux homescreen Tools overview]] </li>
</ul></div>

==== ParrotOS ====
At the first glance looks very nice and neat, like with Kali you can see a menu on top from where you can access all of the tools for pentesting, programming etc.

<div><ul>
<li style="display: inline-block;"> [[File:Parrot_Homescreen.PNG|thumb|none|700px|Parrot Security homescreen Tools overview]] </li>
</ul></div>

=== User friendliness (for lay people) ===
Kali and ParrotOS are pretty on par on user friendliness. Both offer the installed pentesting tools directly in the start menu of the OS. Parrot is more colorful and therefore offers more clarity. 
BlackArch on the other hand is not very user friendly. the only menu available is found on right-clicking on the desktop and some of the sub menus are completely overfilled, so even on a UHD display not all programms can be displayed; no scrollig available. 
On the bash, there's not much difference between the OSes.

=== Kernel Type ===
{| class="wikitable"
|-
! OS !! Kernel
|-
| BlackArch || Arch Linux
|-
| Kali || Debian
|-
| ParrotOS || Debian
|}

=== Stability ===
All three OSes are build upon a very stable and far developed Linux kernel. During our works we weren't able to discern them in any way

=== Installing ===

The installation is quite similar with all distributions, however some cause more problems than the others. Black Arch is the fastest, has the least setup to go through: basically you just choose the boot and you are good to go to log in with the default username and password. Afterwards you can create users and change these settings, but the setup itself does NOT require you to.
 
On the other hand, the Parrot OS takes a while to set up, going through all the setup steps. It might happen, that your setup (especially in a VM) will not work if you click some wrong setting. However, the complexity of the setup corresponds to the result, ParrotOS being really nice and user friendly, while getting a small window in Black Arch with no idea, how to actually use it since there are no buttons.
 
Kali Linux is also somewhat more complex to set up, but works more effortlessly. You can set up users and passwords right in the setup process, choose a desktop environment of your choice (Xfce, GNOME, KDE Plasma...)
 

The installation process has been thoroughly documented in the following links:
*[https://wiki.elvis.science/index.php?title=Install_ParrotOS ParrotOS Installation]
*[https://wiki.elvis.science/index.php?title=Kali_Linux_VMware_Installation Kali Linux Installation]
*[https://wiki.elvis.science/index.php?title=Black_Arch_VMware_Installation Black Arch Installation]

=== Packager ===

* Black Arch: Pacman
* ParrotOS: APT
* Kali Linux: APT

=== Pre-installed Tools ===

=== Desktop Environment ===
* Black Arch: XFCE Desktop Environment
* ParrotOS: MATE, KDE, XFCE
* Kali Linux: GNOME, KDE, XFCE

== Used Hardware ==

VM Ware virtual Machines with each:
* 4 vCPU
* 8 GB RAM
* 100 GB HDD

=== Idly used Hardware of the OS ===
This stats are aggregates by watching htop over at least an hour and executing du -sh in the root directory:
{| class="wikitable"
|-
! OS !! RAM/MiB !! HDD/GiB
|-
| BlackArch || 333 || 65
|-
| Kali || 749 || 14
|-
| ParrotOS || 679 || 12
|}

== References ==

* https://www.kali.org
* https://www.parrotlinux.org/
* https://www.blackarch.org

[[Category:Documentation]]

Kali vs. Black Arch vs. Parrot

2021-05-16T10:13:32Z

MFriedl:

== Summary ==

This is a draft about the differences of the three operating systems

== Differences ==

=== User friendliness (for lay people) ===

=== Kernel Type ===

=== Stability ===

=== Installing ===

=== Packager ===

=== Pre-installed Tools ===

== Used Hardware ==

VM Ware virtual Machines with each:
* 4 vCPU
* 8 GB RAM
* 100 GB HDD

=== Idly used Hardware of the OS ===

== References ==

* https://www.kali.org
* https://parrotlinux.org
* https://www.blackarch.org

[[Category:Documentation]]

Kali vs. Black Arch vs. Parrot

2021-05-16T09:46:52Z

MFriedl:

== Summary ==

This is a draft about the differences of the three operating systems

== Differences ==

=== User friendliness (for lay people) ===

=== Kernel Type ===

=== Stability ===

=== Installing ===

=== Packager ===

=== Pre-installed Tools ===

== Used Hardware ==

VM Ware virtual Machines with each:
* 4 vCPU
* 8 GB RAM
* 100 GB HDD

== References ==

* https://www.kali.org
* https://parrotlinux.org
* https://www.blackarch.org

[[Category:Documentation]]

Kali vs. Black Arch vs. Parrot

2021-05-16T09:35:17Z

MFriedl:

== Summary ==

This is a draft about the differences of the three operating systems

== Differences ==

=== User friendliness (for lay people) ===

=== Kernel Type ===

=== Stability ===

=== Installing ===

=== Tools ===

== Used Hardware ==

VM Ware virtual Machines with each:
* 4 vCPU
* 8 GB RAM
* 100 GB HDD

== References ==

* https://www.kali.org
* https://parrotlinux.org
* https://www.blackarch.org

[[Category:Documentation]]

Install ParrotOS

2021-04-11T13:54:33Z

MFriedl:

<div style="max-width: 970px">

<div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">
== Table of Contents ==
<div class="mw-collapsible-content">
__TOC__
</div></div>

== Summary ==

In this documentation we describe the steps taken to install ParotOS onto a system, either physical or on a VM.

== Requirements ==

* Media: install image of the most recent version of Parrot Security OS
* Server: a physical or virtual machine with at least:
** 2 CPUs
** 2GB RAM
** 40GB HDD

== Description ==

=== Step 1 ===


The images can be downloaded via the official site https://www.parrotsec.org/download/.
to get the version with all available security tools available for Parrot, choose the Security Edition and next you can choose between MATE and KDE desktops(accessed of 11.04.2021.)

You can either run ParrotOS as a Live system or install it, where the installer is a little out of sight at the bottom of the choices:
[[File:Install_Parrot_Screen.png]]
under some circumstances the installer won't acknowledge the DVD(or image for virtual systems) and can't continue to install. In such a case, start the Live version and install it from there, the option is on the desktop. Or if you are an advanced user, you can enter the shell and take the steps manually, but his won't be covered in this wiki page.


=== Step 2 ===

The rest is a typical Linux installation:
* choose localization
* choose keymap settings
* choose partitioning and filesystems used
* create a sudo user and choose its password

== Used Hardware ==

* Virtual machine in VMWare: 4 vCPUs, 8GB RAM, 100GB SCSI HDD

== References ==

* https://www.parrotsec.org/

[[Category:Basic]]

Install ParrotOS

2021-04-11T13:51:46Z

MFriedl: Created page with "<div style="max-width: 970px"> <div class="toccolours mw-collapsible mw-collapsed" style="border-color: #eaecf0; background-color: white; overflow:auto; calc(100% - 12px);">..."

File:Install Parrot Screen.png

2021-04-11T13:20:00Z

MFriedl: