Elvis Wiki - User contributions [en]

RIOT-OS: Setup

2025-06-17T12:51:01Z

NKirnbauer: /* Step 3 */

== Summary ==

Setting up Riot-OS on a Atmel SAM R21 Xpro Board.

== Requirements ==

* Operating system: Ubuntu 20.04
* Packages: git

== Description ==

=== Step 1 ===

Install the following packages

sudo apt-get update
sudo apt-get install git
openocd
gcc-multilib
build-essential
python3-serial
libudev-dev
moserial

=== Step 2 ===

Install the toolchain

sudo apt-get install gcc-arm-none-eabi

If you use a recent version of RIOT-OS (Release-2021.07) you can go on with '''Step 3'''.

If you use an older RIOT-OS version, you will have to do the following steps:

Goto https://developer.arm.com/tools-and-software/open-source-software/developer-tools/gnu-toolchain/gnu-rm and download

gcc-arm-none-eabi-7-2018-q2-update-linux.tar.bz2

Move it to your home directory.

Uninstall old packages

sudo apt remove binutils-arm-none-eabi gcc-arm-none-eabi libnewlib-arm-none-eabi

Unzip the downloaded file

tar -xjvf gcc-arm-none-eabi-7-2018-q2-update-linux.tar.bz2

Add the toolchain to your path

export PATH=$PATH:/home/(your user)/gcc-arm-none-eabi-7-2018-q2-update/bin/

For now: you will have to do this in the bash where you build your application - after each restart.

Add toolchain permanently to PATH (otherwise it's necessary to do it manually after every restart):

vim ~/.profile

and/or
vim ~/.bashrc

Add the following line to the bottom and save (adapt to your used ARM toolchain!):

export PATH=$PATH:<path to unzipped folder>/gcc-arm-none-eabi-9-2020-q2-update/bin

Apply changes for current shell:

source ~/.profile
source ~/.bashrc

=== Step 3 ===

Download Riot-OS

git clone https://github.com/RIOT-OS/RIOT.git myRIOT

Move to the "Hello World"-Example

cd myRIOT/examples/basic/hello-world

Build the application on "native"

make all term

Now, you should see this output in your terminal:

RIOT native interrupts/signals initialized.
LED_RED_OFF
LED_GREEN_ON
RIOT native board initialized.
RIOT native hardware initialization complete.

main(): This is RIOT! (Version: 2022.01-devel-129-g554d3)
Hello World!
You are running RIOT on a(n) native board.
This board features a(n) native MCU.

=== Step 4 ===

Build and run "Hello World" on the SAM R21 Board.

Set the rights for your username to be able to flash the application on the board.

sudo usermod -a -G dialout <username>

Then reboot your computer.

Connect the board to your computer via micro USB cable (USB EDBG interface).

[[File:samr21EDBGconnect.jpg]]

Connect via Moserial.

[[File:moSerial.jpg]]

Build and flash the application.

cd myRIOT/examples/hello-world
make BOARD=samr21-xpro
make BOARD=samr21-xpro flash

If you do not use a serial terminal like moserial or terraterm use term

make BOARD=samr21-xpro term

Or via <code>pyterm</code> (which is shipped with RIOT-OS):

sudo pip3 install pyserial
cd RIOT/dist/tools/pyterm
./pyterm -p /dev/ttyACM0

'''You may also set the BOARD in the Makefile of the application.'''

To find out the correct <code>tty</code> when multiple (SAMR21-xpro) boards are connected to your system:

$ cd RIOT/examples/hello-world
$ make list-ttys
/sys/bus/usb/devices/1-3: Atmel Corp. EDBG CMSIS-DAP, serial: 'ATMLXXXXXXX80000XXX1', tty(s): ttyACM0
/sys/bus/usb/devices/1-2: Atmel Corp. EDBG CMSIS-DAP, serial: 'ATMLXXXXXXX80000XXX2', tty(s): ttyACM1

If you have multiple boards connected to your computer it is necessary to provide the serial during flashing:

BOARD=samr21-xpro SERIAL="ATMLXXXXXXX80000XXX1" make flash

== Used Hardware ==

* Remote IoTLab [[Atmel SAM R21 Xplained Pro Evaluation Platform]]
* [[Atmel_SAM_R21_Xplained_Pro]]
== Courses ==

* Mobile and Embedded Security (2019-)

== RIOT More Information/Resources/Links ==

* [[RIOT-OS_and_IEEE_802.15.4_/_6LoWPAN|Wiki: RIOT-OS and IEEE 802.15.4 / 6LoWPAN]]
* [[Raspberry_Pi_3B%2B_802.15.4/6LoWPAN_Setup|Wiki: Raspberry Pi 3B+ 802.15.4/6LoWPAN Setup]]
* Paper (optional): Baccelli, Emmanuel, et al. _"RIOT: An open source operating system for low-end embedded devices in the IoT."_ IEEE Internet of Things Journal 5.6 (2018): 4428-4440.
* Riot-OS Setup (ELVIS Wiki): https://wiki.elvis.science/index.php?title=Riot-OS_Setup
** RIOT-OS+SAMR21 Setup (CoMatrix): https://comatrix.eu/setup/samr21_and_RIOT-OS/
* RIOT-OS Github repository: https://github.com/RIOT-OS/RIOT
** Examples: https://github.com/RIOT-OS/RIOT/tree/master/examples
** Tests: https://github.com/RIOT-OS/RIOT/tree/master/tests
* Getting Started: https://doc.riot-os.org/getting-started.html
** Introduction: https://github.com/RIOT-OS/RIOT/wiki/Introduction
** Changelog/Release Notes: https://doc.riot-os.org/changelog.html
** Use Docker to build RIOT:
*** https://doc.riot-os.org/getting-started.html#docker
*** https://doc.riot-os.org/build-in-docker.html
*** Podman: https://github.com/RIOT-OS/RIOT/pull/18671
* API documentation: https://doc.riot-os.org/
* Wiki: https://github.com/RIOT-OS/RIOT/wiki
** FAQ: https://github.com/RIOT-OS/RIOT/wiki/FAQ
** Best Practice for RIOT Programming: https://github.com/RIOT-OS/RIOT/wiki/Best-Practice-for-RIOT-Programming
* Tutorials: https://github.com/RIOT-OS/Tutorials
** RIOT online course: https://github.com/RIOT-OS/riot-course
** RIOT Beginner Tutorial - RIOT Summit 2021: https://riot-os.github.io/riot-course/slides/tutorial-summit-networking/
** Networking in RIOT: https://riot-os.github.io/riot-course/slides/04-networking-in-riot/
** RIOT Tutorial - IoT Security with Microcontrollers: https://riot-os.github.io/riot-course/slides/tutorial-summit-security
* Forum: https://forum.riot-os.org/
** Matrix Channel: https://matrix.to/#/#riot-os:matrix.org
* ... and slides from Silvie
* pyterm is an alternative to Moserial
** i.e. implicit use with <code>make BOARD=samr21-xpro term</code>
* <code>make list-ttys</code>: returns the list of serial ports available with information on the board connected (useful when working with multiple boards)
** afterwards e.g. <code>make term SERIAL="1232135328821"`</code>
* <code>make debug</code>
* '''Remember that the examples directory is very helpful - as well as the test directories :)'''

== References ==

* https://github.com/RIOT-OS/RIOT/wiki
* http://riot-os.org/api
* https://github.com/RIOT-OS/Tutorials

[[Category:Documentation]]

LoRa Indoor Gateway 868 MHz, WiFi: Instructions&First Steps

2025-05-12T12:21:35Z

NKirnbauer: LED states eine Option korrekt verbessert

<div style="max-width: 970px">

== Summary ==
The Things Industries 868MHz indoor gateway is designed to be a fully compliant, ultra low-cost LoRaWAN gateway, with Wi-Fi as the backhaul.
It comes with a wall plug and can be powered over <b>USB-C on 900mA</b>, making the gateway even suitable for applications that require dynamic coverage.

=== Features and Benefits ===

<div><ul>
<li style="display: inline-block;"> [[File:LoRa-Indoor-Gateway-Overview.JPG|thumb|none|350px|LoRa-Indoor-Gateway]] </li>
</ul></div>

&emsp;&emsp;➥ An 8 channel LoRaWAN indoor gateway

&emsp;&emsp;➥ One of the first gateways to support the state-of-the-art

&emsp;&emsp;➥ Basic station Protocol

&emsp;&emsp;➥ Supports LBT.

&emsp;&emsp;➥ Simple setup steps taking lesser than 5 mins.

&emsp;&emsp;➥ Can connect to any network backend of choice.

&emsp;&emsp;➥ Setup and Connectivity over WiFi.

&emsp;&emsp;➥ Built-in omnidirectional antenna for indoor use.

&emsp;&emsp;➥ EU868, US915, AS923 and CN470 versions available.

&emsp;&emsp;➥ Security via a range of modes.

== Specifications ==

<div><ul>
<li style="display: inline-block;"> [[File:LoRa-Indoor-Gateway-Highlights.JPG|thumb|none|500px|LoRa-Indoor-Gateway-Specs]] </li>
</ul></div>

<b>LoRa:</b>
<table border frame=box>
<tr>
<td align="left">&emsp;Chipset</td>
<td align="left">&emsp;&emsp;Semtech SX1308</td>
</tr>
<tr>
<td align="left">&emsp;Channels</td>
<td align="left">&emsp;&emsp;8/1 multi/high data rate</td>
</tr>
<tr>
<td align="left">&emsp;Transmit Power</td>
<td align="left">&emsp;&emsp;upto +27 dBM</td>
</tr>
</table>

<b>WiFi:</b>
<table border frame=box>
<tr>
<td align="left">&emsp;Modes</td>
<td align="left">&emsp;&emsp;802.11 b.g.n</td>
</tr>
<tr>
<td align="left">&emsp;Frequency Bands</td>
<td align="left">&emsp;&emsp;2.4 Ghz</td>
</tr>
<tr>
<td align="left">&emsp;USB Port</td>
<td align="left">&emsp;&emsp;USB Type-C (900 mA)</td>
</tr>
<tr>
<td align="left">&emsp;Security</td>
<td align="left">&emsp;&emsp;WPA and WPA2 personal</td>
</tr>
</table>

== Setup ==
=== Activate your gateway in less than 5 mins ===
<div style="border: 1px solid #8a6d3b; background-color: #fcf8e3; color: #8a6d3b; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note:</b>
First of all, Press the reset button (small button at the back of the gateway next to the USB-C port) for 5 seconds until the LED blinks rapidly GREEN ↔ RED for a couple of times.</div>

&emsp;<b>1.</b> Hold the SETUP (button at the top of the gateway, next to the LED) for 10 seconds until the LED blinks rapidly in RED.

<div><ul>
<li style="display: inline-block;"> [[File:LoRa-Indoor-Gateway-10sec.JPG|thumb|none|250px|LoRa-Indoor-Gateway-10sec]] </li>
</ul></div>

&emsp;<b>2.</b> The gateway now exposes a WiFi AP whose SSID is MINIHUB-xxxxxx where xxxxxx is the last 6 digits of the gateway ID.

<div><ul>
<li style="display: inline-block;"> [[File:LoRa-Indoor-Gateway-MiniHub-xxx.JPG|thumb|none|250px|LoRa-Indoor-Gateway-MiniHub-xxx]] </li>
</ul></div>

&emsp;<b>3.</b> The password for this network is printed on the back panel of the device under WiFi PW.

&emsp;<b>4.</b> After connecting to this network go to <code>192.168.4.1</code> using a web browser to access the WiFi config page.

<div><ul>
<li style="display: inline-block;"> [[File:LoRa-Indoor-Gateway-2-MiniHub-settings.JPG|thumb|none|500px|LoRa-Indoor-Gateway-2-MiniHub-settings]] </li>
</ul></div>

&emsp;&emsp;➥ Select the WiFi network and enter the password if it’s a closed network.

&emsp;&emsp;➥ Select the “Save and Reboot” option.

&emsp;<b>5.</b> If your config is right:

&emsp;&emsp;➥ The gateway will blink GREEN for a few seconds while it connects to this network.

&emsp;&emsp;➥ Then, it will blink GREEN ↔ RED for a few seconds while it connects to the CUPS endpoint and fetches the necessary<br>&emsp;&emsp;&emsp; information to connect to the LNS traffic endpoint.

&emsp;&emsp;➥ If your configuration was successful, the LED will be solid GREEN which means that the gateway is connected to the LoRaWAN network<br>&emsp;&emsp;&emsp; and is ready to handle packets.

== Operating Modes ==
=== Configuration Mode (CONF) ===
In this mode, the device acts as a WiFi AP to which users can connect and configure a WiFi network(s) to which the gateway will connect to during normal operation. The device cannot
route LoRaWAN packets in this mode.

=== Gateway Mode (GW) ===
In this mode, the device acts as a gateway to route traffic between the LoRaWAN Device and the Network. The WiFi AP for configuration is not available in this mode.

== LED states ==

<table border frame=box>
<tr bgcolor=#42b0f5>
<th align="left">&emsp;Color(s)</th>
<th align="left">&emsp;Illuminating Pattern</th>
<th align="left">&emsp;Operating Mode</th>
<th align="left">&emsp;Meaning</th>
</tr>
<tr>
<td align="left">&emsp;GREEN</td>
<td align="left">&emsp;&emsp;Blinking (freq 1 sec)</td>
<td align="left">&emsp;GW</td>
<td align="left">&emsp;WiFi not connected (or trying to connect)</td>
</tr>
<tr>
<td align="left">&emsp;GREEN</td>
<td align="left">&emsp;Blinking (freq 1/4 sec)</td>
<td align="left">&emsp;GW</td>
<td align="left">&emsp;Connected to WiFi, establishing connection to LNS/configuring radio</td>
</tr>
<tr>
<td align="left">&emsp;GREEN</td>
<td align="left">&emsp;&emsp;Solid</td>
<td align="left">&emsp;GW</td>
<td align="left">&emsp;Connected to WiFi, connected to LNS backend, listening for packets</td>
</tr>
<tr>
<td align="left">&emsp;GREEN/RED</td>
<td align="left">&emsp;&emsp;Alternate Blinking (freq 1/4 sec)</td>
<td align="left">&emsp;CONF</td>
<td align="left">&emsp;Scanning WiFi networks, setting up Config AP</td>
</tr>
<tr>
<td align="left">&emsp;RED</td>
<td align="left">&emsp;&emsp;Blinking (freq 1/4 sec)</td>
<td align="left">&emsp;CONF</td>
<td align="left">&emsp;Config AP Active</td>
</tr>
</table>

== Button Actions ==
There are three possible button actions on the TTIG:

&emsp;➥ SETUP Button pressed for 10s:

&emsp;&emsp;• Switch to CONF mode if in GW mode.

&emsp;➥ SETUP Button pressed for 5s:

&emsp;&emsp;• Reboot if in CONF mode, do nothing in GW mode.

&emsp;➥ RESET Button pressed for 5s:

&emsp;&emsp;• Factory reset (wipe out WiFi and LNS credentials, though CUPS credentials are retained).

== Used Hardware ==

&emsp;➠ [[TTN Indoor LoRaWAN Gateway 868 MHz, WiFi, LoRa]]

== References ==
&emsp;➠ https://www.thethingsnetwork.org/docs/gateways/thethingsindoor/

[[Category:Documentation]]

BLE CTF

2025-03-21T14:44:30Z

NKirnbauer: -r hat gefehlt

== Summary ==

This tutorial explains how to setup an ESP-32 device for solving 20 flag based BLE challenges.
Check out the CTF and the description of the flags: [https://github.com/hackgnar/ble_ctf]

== Requirements ==

* Operating systems: Ubuntu 18.04 bionic amd64, Kali
* On Kali you'll have to install the bluetooth package:
apt-get install bluetooth

* You might have to start the bluetooth service:
service bluetooth start

== Description ==

=== Step 1 - Standard Setup of Toolchain for Linux ===

Install prerequisites:

sudo apt-get install git wget flex bison gperf python3 python3-pip python3-setuptools cmake ninja-build ccache libffi-dev libssl-dev dfu-util libusb-1.0-0

Download [https://dl.espressif.com/dl/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz ESP32 toolchain for Linux] and extract it in ~/esp directory:

mkdir -p ~/esp
cd ~/esp
tar -xzf ~/Downloads/xtensa-esp32-elf-linux64-1.22.0-80-g6c4433a-5.2.0.tar.gz

Update your PATH environment variable in ~/.profile to use the toolchain. To do this, add the following line to your ~/.profile file:

export PATH="$HOME/esp/xtensa-esp32-elf/bin:$PATH"

On UBUNTU: log off and log back in to make the changes effective.
On KALI do not log off.

Run the following command to verify if PATH is correctly set:

printenv PATH

The output in Ubuntu should contain (userName gets replaced by your user name):

/home/userName/esp/xtensa-esp32-elf/bin

=== Step 2 - Install ESP-IDF ===

Go to ~/esp and clone the repository:

cd ~/esp
git clone --recursive https://github.com/espressif/esp-idf.git

Set the IDF_PATH environment variable. To do this, add the following line to ~/.profile:

export IDF_PATH=~/esp/esp-idf

Log off and log back in to make the changes effective.

Verify if the variable has been set correctly:

printenv IDF_PATH

The output should display the previously entered path (replace userName with your user name):

/home/userName/esp/esp-idf

=== Step 3 - Install Python packages ===

Run installation script:

cd ~/esp-idf
./install.sh esp32

=== Step 4 - Connect the device ===

Make sure your device is unplugged, then run:

ls /dev/tty*

Plug your device into the host computer and run again:

ls /dev/tty*

The port that appears the second time is the one needed.

=== Step 5 - CTF Setup ===

Unplug your device.

Change into your ~/esp directory and execute the following commands:

cd ~/esp
git clone https://github.com/hackgnar/ble_ctf.git
cd ble_ctf
make menuconfig

Make sure to turn Bluetooth in the "Component config" on.

If you receive a error while the make command, please rerun make menuconfig. Go to Compiler options ---> Turn on the "Disable new warnings introduced in GCC 6 - 8" option.

KALI --> if you get an error on Kali you have to configure the Makefile by adding:

ESP_IDF = ~/esp/esp-idf

A window appears. Navigate to "Serial flasher config" > "Default Serial port" and enter the port you found out in step 4. Confirm, save and exit.

make

Plug your device into your host computer.

make flash

Press the RST button on your device.

=== Step 6 - First Interaction with ESP-32 via BLE ===

Discover the MAC address of your device:

sudo hcitool lescan

The device with the description "BLECTF" is your device.

Display current score (replace the x's with the MAC address discovered before):

gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n'

The terminal should display:

Score: 0/20

=== Step 7 - Upload your first flag ===

Run (replace the x's with your MAC address):

gatttool -b xx:xx:xx:xx:xx:xx --char-write-req -a 0x002c -n $(echo -n "12345678901234567890"|xxd -ps)

Display the score (replace the x's with your MAC address):

gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a|awk -F':' '{print $2}'|tr -d ' '|xxd -r -p;printf '\n'

The output should now display:

Score:1 /20

Congratulations!! You successfully setup your ESP-32 and successfully uploaded the first flag! :)

=== Important Commands for the BLE CTF ===

Start the BLE CTF: https://github.com/hackgnar/ble_ctf

'''hciconfig'''

sudo hciconfig -a
...lists all hci interfaces

sudo hciconfig hciX down
sudo hciconfig hciX up
You might need this on receiving I/O errors.

'''hcitool'''

sudo hcitool lescan
...lists all availble BLE devices.

'''gatttool'''

sudo gatttool -i hci0 -b XX:XX:XX:XX:XX:XX --characteristics
...lists all characteristics/handles of the GATT server

sudo gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011
...reading the characteristic/handle value from handle 0x0011

sudo gatttool -b XX:XX:XX:XX:XX:XX --char-write -a 0x0011 -n 0x1122
...writes the value 0x1122 to characteristic/handle 0x0011

gatttool -b XX:XX:XX:XX:XX:XX --char-read -a 0x0011 --listen
...streams data while subscription / listening

gatttool -b XX:XX:XX:XX:XX:XX -I
...for persistent connections to a GATT server

'''Speed-up'''
Shell script for retrieving the current score:

$ cat <<EOF > score.sh
#!/bin/bash
gatttool -b xx:xx:xx:xx:xx:xx --char-read -a 0x002a | awk -F':' '{print \$2}' | tr -d ' ' | xxd -r -p; printf '\n'
EOF
$ chmod u+x score.sh
$ ./score.sh

== Used Hardware ==

* Ubuntu host computer
* [[ESP-32 NodeMCU Development Board]]
* Micro USB cable

== References ==

* http://www.hackgnar.com/2018/06/learning-bluetooth-hackery-with-ble-ctf.html?m=1
* https://docs.espressif.com/projects/esp-idf/en/latest/get-started/#setup-toolchain
* http://web.archive.org/web/20181214013848/https://docs.espressif.com/projects/esp-idf/en/latest/get-started/add-idf_path-to-profile.html
* https://docs.espressif.com/projects/esp-idf/en/latest/get-started/establish-serial-connection.html
* https://github.com/hackgnar/ble_ctf/blob/master/docs/setup.md

[[Category:Documentation]]

Genymotion Setup Example

2025-02-28T18:44:04Z

NKirnbauer: Created page with "== Summary == This documentation explains how to set up a virtual phone using Genymotion for later use in IT security testing, such as attacks and vulnerability analysis. == Description == Genymotion is a versatile Android emulation platform that started as a fast developer-focused emulator and has grown into a cloud and desktop-based "Android as a Service" solution. === Step 1 === First download Genymotion: https://www.genymotion.com/product-desktop/download/ ==..."

== Summary ==

This documentation explains how to set up a virtual phone using Genymotion for later use in IT security testing, such as attacks and vulnerability analysis.

== Description ==

Genymotion is a versatile Android emulation platform that started as a fast developer-focused emulator and has grown into a cloud and desktop-based "Android as a Service" solution.

=== Step 1 ===

First download Genymotion: https://www.genymotion.com/product-desktop/download/

=== Step 2 ===

Add a new phone.

[[File:Genymotion1.png]]

=== Step 3 ===

Choose which phone you would like to emulate and set all your preferences in the following configurations.

[[File:Genymotion2.png]]

The only thing important is that you set the network mode to be bridged, so that the virtual device can directly communicate with the local network. (and with making it a potential target for attacks within the network)

[[File:Genymotion3.png]]

Make sure that the atacker machine is in the same network. In Virtual Box this can be seen in the settings in the network tap of the atacker machine. It should look like this:

[[File:Genymotion4.png]]

=== Step 4 ===

After this you can already start your phone and you will see that a popup of a virtual phone apears.

[[File:Genymotion5.png]]

=== Step 5 ===

Once you have the virtual phone running, you can use the adb shell to access the device's command line interface. This provides you with a variety of options to interact with the virtual phone, such as configuring network settings, managing files, installing apps, or even executing specific commands to troubleshoot or control the device remotely. ADB stands for (Android Debug Bridge Shell) and it is part of the Android SDK (Software Development Kit).

For setting up first ensure that the Android SDK is installed on the computer. When Android Studio is installed, ADB is usually included as part of the installation. The ADB executable then typically is located in the following path:

C:\Users\<YourUserName>\AppData\Local\Android\Sdk\platform-tools\adb.exe

This path needs to be added to the environment varibales.

Search for environment varibles:

[[File:Genymotion6.png]]

Under System Variables, select Path, then click Edit.

[[File:Genymotion7.png]]

[[File:Genymotion8.png]]

Add the path to the platform-tools directory:

[[File:Genymotion9.png]]

Now, the virtual phone can be accessed in the command line with the adb shell command, allowing commands to be issued as needed.

[[File:Genymotion10.png]]

== References ==

* https://www.genymotion.com/

[[Category:Documentation]]

File:Genymotion10.png

2025-02-28T18:42:32Z

NKirnbauer: == Source == Screenshot Elvis

== Summary ==
== Source ==
Screenshot Elvis

File:Genymotion9.png

2025-02-28T18:37:20Z

NKirnbauer: == Source == Elvis Screenshot

== Summary ==
== Source ==
Elvis Screenshot

File:Genymotion8.png

2025-02-28T18:36:59Z

NKirnbauer: == Source == Elvis Screenshot

== Summary ==
== Source ==
Elvis Screenshot

File:Genymotion7.png

2025-02-28T18:35:42Z

NKirnbauer: == Source == Elvis Screenshot

== Summary ==
== Source ==
Elvis Screenshot

File:Genymotion6.png

2025-02-28T18:34:51Z

NKirnbauer: == Source == Elvis Screenshot

== Summary ==
== Source ==
Elvis Screenshot

File:Genymotion5.png

2025-02-28T18:07:06Z

NKirnbauer: == Source == Elvis Screenshot

== Summary ==
== Source ==
Elvis Screenshot

File:Genymotion4.png

2025-02-28T18:05:29Z

NKirnbauer: == Source == Screenshot Elvis

== Summary ==
== Source ==
Screenshot Elvis

File:Genymotion2.png

2025-02-28T17:58:53Z

NKirnbauer: == Source == Elvis Screenshot

== Summary ==
== Source ==
Elvis Screenshot

File:Genymotion3.png

2025-02-28T17:58:19Z

NKirnbauer: == Source == Elvis Screenshot

== Summary ==
== Source ==
Elvis Screenshot

File:Genymotion1.png

2025-02-28T12:34:13Z

NKirnbauer: == Source == Screenshot Elvis

== Summary ==
== Source ==
Screenshot Elvis

File:MidnightBlizzardOverview.png

2025-02-12T16:17:56Z

NKirnbauer: == Source == https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices

== Summary ==
== Source ==
https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices

Midnight Blizzard Attack on Microsoft

2025-02-12T16:15:15Z

NKirnbauer: Created page with "== Summary == This documentation is about who Midnight Blizzard is and with which steps they were able to successfully attack Microsoft. == Who is Midnight Blizzard? == Midnight Blizzard is known under many different names, including Nobelium, APT29 and Cozy Bear. It is a state-sponsored Russian threat hacker group that emerged in the 2010s, where they often engaged in campaigns targeting diplomatic and political intelligence collection. The group was involved in ma..."

== Summary ==

This documentation is about who Midnight Blizzard is and with which steps they were able to successfully attack Microsoft.

== Who is Midnight Blizzard? ==

Midnight Blizzard is known under many different names, including Nobelium, APT29 and Cozy Bear. It is a state-sponsored Russian threat hacker group that emerged in the 2010s, where they often engaged in campaigns targeting diplomatic and political intelligence collection. The group was involved in many different attacks including:
* Democratic National Committee cyber attacks
* SUNBURST: attack on SolarWinds
* attack on Hewlett Packard Enterprise
* attack on TeamViewer
* attack on Microsoft

== Which strategies where used? ==
* Password spraying
* attacking a legacy, non-production test tenant account
* OAuth Application abuse
* Privilege Escalation Manoeuvres

== The Breach Mechanics: Step by Step ==

[[File:MidnightBlizzardOverview.png|800px]]

The attack targeted Microsoft’s Entra ID environment. Microsoft Entra ID is a cloud-based identity and access management solution. It provides users with a single sign-on experience regardless of whether their applications are cloud or on-premises-based.

=== Step 1: Initial Access ===
The attacker group decided to target a non-production test tenant, because security protocols might not be as stringent as in production environments. Test environments are often overlooked in security operations, making them more vulnerable to attacks. The attaced test tenant of Microsoft's environment didn´t use Multi-Factor Authentication and used a weak password and therefore was vulnerable. For attacking the client the password spraying method was used.

=== What is password spraying ===
Password spraying is a form of brute-force attack. The attacker trys to use the same password on multiple accounts before moving on to try another password. This method is particularly effective against accounts lacking robust security measures like Multi-Factor Authentication (MFA).

The attaced application was a legacy test OAuth application that had elevated access to the Microsoft corporate environment.

=== Step 2: Privilege Escalation ===
The attackers acquired an access token using the credentials of the compromised OAuth test application. This token provided access to the corporate tenant, leveraging previously granted elevated permissions. The problem here was that the legacy OAuth test application was granted too high priviledges.

With those permissions and the access token they were able to created a new user account to grant consent in the Microsoft corporate environment. They were able to assign the newly created user a Global Administrator role. The creation of the new user automatically led to the creation of a Service Principal for each malicious app registration within Microsoft's corporate tenant.

=== Step 3: Embedding multiple backdors ===
The attackers created additional OAuth applications, which might be a strategy to embed multiple backdoors within the environment and thus complicate detection and eradication efforts, ensuring persistent access for the attackers. With this strategy they ensured that they had multiple access points, so that even if one application is discovered and neutralized, others can still be used for malicious activity.

=== Step 4: Granting Extensive Permissions ===
The newly created OAuth applications were granted really high permissions, which allow extensive access and privileges to Office 356 applications, among them the access to target mailboxes.

=== Step 5: Information collection ===
With this, they were able to access any mailbox within the corporate tenant, thus effectively compromising the confidentiality of the internal communications of Microsoft.

== Mitigation ==

* Implement Multi-Factor Authentication (MFA)
* Ensure test environments have the same security standards as production environments
* Monitor and Audit Permissions: use principle of least privilege (limiting access to the minimum necessary to perform job functions)
* Secure and Monitor App Registrations: control the creation and management of OAuth applications, implement approval processes
* Implement Anomaly Detection and Behavioral Analytics to detect unusual activities that could indicate an attack
* Update or replace legacy systems

== References ==

* https://msrc.microsoft.com/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
* https://www.mitiga.io/blog/microsoft-breach-by-midnight-blizzard-apt29-what-happened-and-what-now
* https://en.wikipedia.org/wiki/Cozy_Bear
* https://www.forbes.com/sites/jamesfarrell/2024/03/08/who-is-midnight-blizzard-russian-linked-group-has-repeatedly-targeted-microsoft-company-says/
* https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices
* https://www.heise.de/news/Russische-Angreifer-klauen-Quellcode-von-Microsoft-9650468.html
* https://www.coretocloud.co.uk/unraveling-the-midnight-blizzard-attack-on-microsoft/

[[Category:Documentation]]

SambaCry

2025-02-11T14:28:29Z

NKirnbauer: /* Mitagtion */

SambaCry

2025-02-11T14:27:51Z

NKirnbauer: /* Mitagtion */

SambaCry

2025-02-11T14:22:05Z

NKirnbauer:

SambaCry

2025-02-11T14:21:05Z

NKirnbauer: Created page with "== Summary == SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017. It allows a remote attacker to execute arbitrary code on a vulnerable server. This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it. == What is Samba? == Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between..."

== Summary ==

SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017.

It allows a remote attacker to execute arbitrary code on a vulnerable server.

This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it.

== What is Samba? ==
Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between systems running Unix/Linux and Windows.

== Which systems are vulnerable? ==
All that run a version of Samba from 3.5.0 onwards are vulnerable to this remote code execution vulnerability.

== Exploitation ==

=== Requirements ===

* Attacker machine (eg. Kali Linux) with Metasploit
* Vulnerable machine (eg. with Metasploitable)

=== Step 1 ===

Setup of machines.

For the victim machine I downloaded Metasploitable 2 from this webpage: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/

For the actacer machine I used [https://www.kali.org/get-kali/#kali-platforms Kali Linux]

=== Step 2 ===

First up we need to find the vulnerable machine in network, so that we know which ip to attack.

We can do this be simply issuing the ip a command on the victims machine:

[[File:Samba1.png|700px]]

But in a real scenario you haven´t access to the machine. Thats why we normally scan all machines on the network to determine which IP address we are interested in. To do this, we perform a network scan using tools like nmap or ping sweeps to identify active devices on the network and the services they offer. Thats how you can narrow down potential targets and further investigate their services to see if they are vulnerable to specific exploits.

In our case we use the command nmap 192.168.1.0/24. This will show us all active ip addresses on the network:

[[File:Samba2.png|700px]]

[[File:Samba3.png|700px]]

We can observe that the ip 192.168.1.135 has a lot of open ports, so we assume that this device could be vulnerable and invest further by running a service version detection on this ip address with nmap 192.168.1.135 -sV:

[[File:Samba4.png|700px]]

This shows us that it is indeed the device that use metasploitable. Also we can see now all services and decide which one we want to exploit. As can be seen the ports 139 and 445 are open and both use Samba with a version that is in the range of the vulnerable versions of SambaCry.

=== Step 3 ===

Now that we discovered a vulnerable device we start the metasploit framework on the attacer machine with
msfconsole

If you don´t already have it you need to install it with
sudo apt install metasploit-framework

We can then search for samba do find the correct exploit or directly enter the CVE code to find it:

[[File:Samba5.png|700px]]

[[File:Samba6.png|700px]]

We then select it by the keyword use:

[[File:Samba7.png|700px]]

By using the command options, we can see all exploit options we need/can set.

== Mitagtion ==

Firewalls can be used to block access from untrusted networks to port tcp/445 and tcp/139.

samba.org also released patched versions of their software, including ones for older, unsupported releases. Upgrading to one of these versions and restarting smbd fixes the issue.

Add the parameter:

nt pipe support = no

to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.

== References ==

* https://www.quantum.com/en/service-support/security-bulletins/sambacry/
* https://www.samba.org/samba/security/CVE-2017-7494.html
* https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb
* https://es-la.tenable.com/blog/detecting-sambacry-cve-2017-7494
* https://www.f5.com/labs/articles/threat-intelligence/sambacry-the-linux-sequel-to-wannacry

[[Category:Documentation]]

== Summary ==

SambaCry is a vulnerability that is also known as CVE-2017-7494 and was discovered in the Samba Software in 2017.

It allows a remote attacker to execute arbitrary code on a vulnerable server.

This works because a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it.

== What is Samba? ==
Samba is an open-source implementation of the SMB/CIFS protocol, allowing file and print sharing between systems running Unix/Linux and Windows.

== Which systems are vulnerable? ==
All that run a version of Samba from 3.5.0 onwards are vulnerable to this remote code execution vulnerability.

== Exploitation ==

=== Requirements ===

* Attacker machine (eg. Kali Linux) with Metasploit
* Vulnerable machine (eg. with Metasploitable)

=== Step 1 ===

Setup of machines.

For the victim machine I downloaded Metasploitable 2 from this webpage: https://sourceforge.net/projects/metasploitable/files/Metasploitable2/

For the actacer machine I used [https://www.kali.org/get-kali/#kali-platforms Kali Linux]

=== Step 2 ===

First up we need to find the vulnerable machine in network, so that we know which ip to attack.

We can do this be simply issuing the ip a command on the victims machine:

[[File:Samba1.png|700px]]

But in a real scenario you haven´t access to the machine. Thats why we normally scan all machines on the network to determine which IP address we are interested in. To do this, we perform a network scan using tools like nmap or ping sweeps to identify active devices on the network and the services they offer. Thats how you can narrow down potential targets and further investigate their services to see if they are vulnerable to specific exploits.

In our case we use the command nmap 192.168.1.0/24. This will show us all active ip addresses on the network:

[[File:Samba2.png|700px]]

[[File:Samba3.png|700px]]

We can observe that the ip 192.168.1.135 has a lot of open ports, so we assume that this device could be vulnerable and invest further by running a service version detection on this ip address with nmap 192.168.1.135 -sV:

[[File:Samba4.png|700px]]

This shows us that it is indeed the device that use metasploitable. Also we can see now all services and decide which one we want to exploit. As can be seen the ports 139 and 445 are open and both use Samba with a version that is in the range of the vulnerable versions of SambaCry.

=== Step 3 ===

Now that we discovered a vulnerable device we start the metasploit framework on the attacer machine with
msfconsole

If you don´t already have it you need to install it with
sudo apt install metasploit-framework

We can then search for samba do find the correct exploit or directly enter the CVE code to find it:

[[File:Samba5.png|700px]]

[[File:Samba6.png|700px]]

We then select it by the keyword use:

[[File:Samba7.png|700px]]

By using the command options, we can see all exploit options we need/can set.

When all options are set you can start the exploit by the command "run" or "exploit".
It then opens a reverse shell where you can issue the commands you like on the victims machine.

== Mitagtion ==

Firewalls can be used to block access from untrusted networks to port tcp/445 and tcp/139.

samba.org also released patched versions of their software, including ones for older, unsupported releases. Upgrading to one of these versions and restarting smbd fixes the issue.

Add the parameter:

nt pipe support = no

to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.

== References ==

* https://www.quantum.com/en/service-support/security-bulletins/sambacry/
* https://www.samba.org/samba/security/CVE-2017-7494.html
* https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb
* https://es-la.tenable.com/blog/detecting-sambacry-cve-2017-7494
* https://www.f5.com/labs/articles/threat-intelligence/sambacry-the-linux-sequel-to-wannacry

[[Category:Documentation]]

File:Samba7.png

2024-12-19T17:39:37Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Samba6.png

2024-12-19T17:37:11Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Samba5.png

2024-12-19T17:34:06Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Samba4.png

2024-12-19T17:25:23Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Samba3.png

2024-12-19T17:16:20Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Samba2.png

2024-12-19T17:14:16Z

NKirnbauer:

== Source ==
Screenshot Elvis Lab

File:Samba2.png

2024-12-19T17:14:03Z

NKirnbauer:

File:Samba1.png

2024-12-19T16:19:52Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

Website Spoofing: Using Setoolkit

2024-12-07T02:05:30Z

NKirnbauer: Created page with "== Summary == Website Spoffing is when a legitimate website is replicated to trick user into thinking it’s the real one. When they then enter for example their username and password or other sensitive information, the hacker obtains this information and can use it in their favor. == URL Spoofing == A website’s URL gets altered, typically in a way that the user doesn’t immediately notice. There are several common methods for this: === Homograph Attack or IDN..."

== Summary ==

Website Spoffing is when a legitimate website is replicated to trick user into thinking it’s the real one. When they then enter for example their username and password or other sensitive information, the hacker obtains this information and can use it in their favor.

== URL Spoofing ==

A website’s URL gets altered, typically in a way that the user doesn’t immediately notice.
There are several common methods for this:

=== Homograph Attack or IDN (Internationalized Domain Name) ===

For this method visually similar characters from different scripts (e.g. Latin or Cyrillic) are used so that the fake URL looks similar to a real URL.

Example:

Real Website with latin a: https://www.amazon.at

Fake Website with cyrillic a: https://www.аmazon.at

=== Typosquatting ===
This method involves using common misspellings of legitimate websites which aren´t easily recognisable.

Example:

Real Website with 2 o´s: https://www.google.com

Real Website with 3 o´s: https://www.gooogle.com

Another way is to change the domain endings to a wrong version.

== Usage ==

For replicating a website and creating a fake one you can use the tool SET (The Social Engineering Toolkit).
"It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering." [https://trustedsec.com/resources/tools/the-social-engineer-toolkit-set]

=== Step 1 ===

Install

sudo apt install set

=== Step 2 ===

Start setools:

sudo setoolkit

This is how the interface looks like:

[[File:setoolkit1.png]]

=== Step 3 ===
Select the right options - in this case we select the appropriate option for website spoofing and for obtaining credential data.

[[File:setoolkit2.png]]

[[File:setoolkit3_old.png]]

[[File:setoolkit4.png]]

[[File:setoolkit5.png]]

=== Step 4 ===
Set the parameters: ip address and the url (for example to the login website you want to spoof)
Set the ip address to use the same network your computer also is in, so you can access the website outside of the virtual machine. (But the proposed ip address would also work - for this just press enter)

[[File:setoolkit6.png]]

=== Step 5 ===
Accessing the fake website. When entering the ip address in your browser the fake website will appear.

[[File:setoolkit7.png]]

== Step 6 ==
Now you will be able to see the data that got entered in the fake website.

[[File:setoolkit8.png]]

Another example where this works would be Spotify:

[[File:setoolkit9.png]]

== References ==

* https://en.wikipedia.org/wiki/Website_spoofing
* https://bolster.ai/glossary/website-spoofing
* https://medium.com/@goodycyb/demonstration-of-social-engineering-attack-using-setoolkit-c6874a264df4
* https://www.kaspersky.com/resource-center/definitions/what-is-typosquatting
* https://github.com/trustedsec/social-engineer-toolkit
* https://github.com/trustedsec/social-engineer-toolkit/raw/master/readme/User_Manual.pdf
* https://trustedsec.com/resources/tools/the-social-engineer-toolkit-set
* https://www.kali.org/tools/set/

[[Category:Documentation]]

File:Setoolkit9.png

2024-12-07T01:50:53Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit8.png

2024-12-07T01:49:52Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit7.png

2024-12-07T01:49:02Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit6.png

2024-12-07T01:42:24Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit5.png

2024-12-07T01:41:31Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit4.png

2024-12-07T01:40:54Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit3.png

2024-12-07T01:37:59Z

NKirnbauer: NKirnbauer uploaded File:Setoolkit3.png

#REDIRECT [[File:Setoolkit3 old.png]]

File:Setoolkit3.png

2024-12-07T01:36:54Z

NKirnbauer: NKirnbauer moved page File:Setoolkit3.png to File:Setoolkit3 old.png

#REDIRECT [[File:Setoolkit3 old.png]]

File:Setoolkit3 old.png

2024-12-07T01:36:54Z

NKirnbauer: NKirnbauer moved page File:Setoolkit3.png to File:Setoolkit3 old.png

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit3 old.png

2024-12-07T01:33:59Z

NKirnbauer: NKirnbauer uploaded a new version of File:Setoolkit3.png

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit3 old.png

2024-12-07T01:18:57Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit2.png

2024-12-07T01:15:52Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Setoolkit1.png

2024-12-07T00:52:15Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

Sherlock: An OSINT Tool

2024-12-06T18:10:45Z

NKirnbauer: /* Functionallity */

== Summary ==

Sherlock is a well-known tool for OSINT (Open-Source Intelligence). You can use this tool to find users across different social media platforms based on their username.
This article gives you a brief overview of how to use Sherlock and how it works.

== Installation ==

On Kali Linux, enter these commands in the shell
to install:

sudo apt install sherlock

to check installation:

sherlock --version

== Usage ==

Search for a user with sherlock:
sherlock <<username>>
[[File:sherlock_elvis1.png]]
[[File:sherlock_elvis2.png]]

This command will list all pages with the respective URLs to the user’s profile.
Note: I observed that there were some pages where sherlock says that the user exists but the then the link ends up on a user not found page.

To search for multiple usernames at once, use this command:
sherlock <<username>> <<username2>>

== Suported Websites ==
You can check here the supported social media sides:
https://sherlockproject.xyz/sites

== Functionallity ==
Sherlocks functionallity is actually pretty simple and straightforward.

You have entries like this, which are specifying the different social media platforms.

[[File:Sherlock_instagram_entry.png]]

Sherlock then iterates through this entries and checks the provided path to the user with the given username. If the pages returns with a statuscode of 200 OK Sherlock will assume that the user exists, whereas 404 Not Found indicates that the user doesn´t exist. Sherlock also offers other mechanisms to check if a user exists.

== References ==

* https://github.com/sherlock-project/sherlock
* https://sherlockproject.xyz/installation
* https://www.kali.org/tools/sherlock/

[[Category:Documentation]]

Sherlock: An OSINT Tool

2024-12-06T18:10:20Z

NKirnbauer: /* Usage */

== Summary ==

Sherlock is a well-known tool for OSINT (Open-Source Intelligence). You can use this tool to find users across different social media platforms based on their username.
This article gives you a brief overview of how to use Sherlock and how it works.

== Installation ==

On Kali Linux, enter these commands in the shell
to install:

sudo apt install sherlock

to check installation:

sherlock --version

== Usage ==

Search for a user with sherlock:
sherlock <<username>>
[[File:sherlock_elvis1.png]]
[[File:sherlock_elvis2.png]]

This command will list all pages with the respective URLs to the user’s profile.
Note: I observed that there were some pages where sherlock says that the user exists but the then the link ends up on a user not found page.

To search for multiple usernames at once, use this command:
sherlock <<username>> <<username2>>

== Suported Websites ==
You can check here the supported social media sides:
https://sherlockproject.xyz/sites

== Functionallity ==
Sherlocks functionallity is actually pretty simple and straightforward.

You have entries like this, which are specifying the different social media platforms.
[[File:Sherlock_instagram_entry.png]]

Sherlock then iterates through this entries and checks the provided path to the user with the given username. If the pages returns with a statuscode of 200 OK Sherlock will assume that the user exists, whereas 404 Not Found indicates that the user doesn´t exist. Sherlock also offers other mechanisms to check if a user exists.

== References ==

* https://github.com/sherlock-project/sherlock
* https://sherlockproject.xyz/installation
* https://www.kali.org/tools/sherlock/

[[Category:Documentation]]

Sherlock: An OSINT Tool

2024-12-06T18:10:06Z

NKirnbauer: /* Installation */

== Summary ==

Sherlock is a well-known tool for OSINT (Open-Source Intelligence). You can use this tool to find users across different social media platforms based on their username.
This article gives you a brief overview of how to use Sherlock and how it works.

== Installation ==

On Kali Linux, enter these commands in the shell
to install:

sudo apt install sherlock

to check installation:

sherlock --version

== Usage ==

Search for a user with sherlock:
sherlock <<username>>
[[File:sherlock_elvis1.png]]
[[File:sherlock_elvis2.png]]
This command will list all pages with the respective URLs to the user’s profile.
Note: I observed that there were some pages where sherlock says that the user exists but the then the link ends up on a user not found page.

To search for multiple usernames at once, use this command:
sherlock <<username>> <<username2>>

== Suported Websites ==
You can check here the supported social media sides:
https://sherlockproject.xyz/sites

== Functionallity ==
Sherlocks functionallity is actually pretty simple and straightforward.

You have entries like this, which are specifying the different social media platforms.
[[File:Sherlock_instagram_entry.png]]

Sherlock then iterates through this entries and checks the provided path to the user with the given username. If the pages returns with a statuscode of 200 OK Sherlock will assume that the user exists, whereas 404 Not Found indicates that the user doesn´t exist. Sherlock also offers other mechanisms to check if a user exists.

== References ==

* https://github.com/sherlock-project/sherlock
* https://sherlockproject.xyz/installation
* https://www.kali.org/tools/sherlock/

[[Category:Documentation]]

Sherlock: An OSINT Tool

2024-12-06T18:09:47Z

NKirnbauer: /* Installation */

== Summary ==

Sherlock is a well-known tool for OSINT (Open-Source Intelligence). You can use this tool to find users across different social media platforms based on their username.
This article gives you a brief overview of how to use Sherlock and how it works.

== Installation ==

On Kali Linux, enter these commands in the shell
to install:

sudo apt install sherlock

to check installation:
sherlock --version

== Usage ==

Search for a user with sherlock:
sherlock <<username>>
[[File:sherlock_elvis1.png]]
[[File:sherlock_elvis2.png]]
This command will list all pages with the respective URLs to the user’s profile.
Note: I observed that there were some pages where sherlock says that the user exists but the then the link ends up on a user not found page.

To search for multiple usernames at once, use this command:
sherlock <<username>> <<username2>>

== Suported Websites ==
You can check here the supported social media sides:
https://sherlockproject.xyz/sites

== Functionallity ==
Sherlocks functionallity is actually pretty simple and straightforward.

You have entries like this, which are specifying the different social media platforms.
[[File:Sherlock_instagram_entry.png]]

Sherlock then iterates through this entries and checks the provided path to the user with the given username. If the pages returns with a statuscode of 200 OK Sherlock will assume that the user exists, whereas 404 Not Found indicates that the user doesn´t exist. Sherlock also offers other mechanisms to check if a user exists.

== References ==

* https://github.com/sherlock-project/sherlock
* https://sherlockproject.xyz/installation
* https://www.kali.org/tools/sherlock/

[[Category:Documentation]]

Sherlock: An OSINT Tool

2024-12-06T18:09:34Z

NKirnbauer: Created page with "== Summary == Sherlock is a well-known tool for OSINT (Open-Source Intelligence). You can use this tool to find users across different social media platforms based on their username. This article gives you a brief overview of how to use Sherlock and how it works. == Installation == On Kali Linux, enter these commands in the shell to install: sudo apt install sherlock to check installation: sherlock --version == Usage == Search for a user with sherlock: sh..."

== Summary ==

Sherlock is a well-known tool for OSINT (Open-Source Intelligence). You can use this tool to find users across different social media platforms based on their username.
This article gives you a brief overview of how to use Sherlock and how it works.

== Installation ==

On Kali Linux, enter these commands in the shell
to install:

sudo apt install sherlock

to check installation:
sherlock --version

== Usage ==

Search for a user with sherlock:
sherlock <<username>>
[[File:sherlock_elvis1.png]]
[[File:sherlock_elvis2.png]]
This command will list all pages with the respective URLs to the user’s profile.
Note: I observed that there were some pages where sherlock says that the user exists but the then the link ends up on a user not found page.

To search for multiple usernames at once, use this command:
sherlock <<username>> <<username2>>

== Suported Websites ==
You can check here the supported social media sides:
https://sherlockproject.xyz/sites

== Functionallity ==
Sherlocks functionallity is actually pretty simple and straightforward.

You have entries like this, which are specifying the different social media platforms.
[[File:Sherlock_instagram_entry.png]]

Sherlock then iterates through this entries and checks the provided path to the user with the given username. If the pages returns with a statuscode of 200 OK Sherlock will assume that the user exists, whereas 404 Not Found indicates that the user doesn´t exist. Sherlock also offers other mechanisms to check if a user exists.

== References ==

* https://github.com/sherlock-project/sherlock
* https://sherlockproject.xyz/installation
* https://www.kali.org/tools/sherlock/

[[Category:Documentation]]

File:Sherlock elvis2.png

2024-12-06T17:52:38Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Sherlock elvis1.png

2024-12-06T17:51:21Z

NKirnbauer: == Source == Screenshot Elvis Lab

== Summary ==
== Source ==
Screenshot Elvis Lab

File:Sherlock instagram entry.png

2024-12-06T17:37:20Z

NKirnbauer: == Source == Screenshot https://github.com/sherlock-project/sherlock/blob/master/sherlock_project/resources/data.json

== Summary ==
== Source ==
Screenshot https://github.com/sherlock-project/sherlock/blob/master/sherlock_project/resources/data.json