View source for JavaScript Pentest Powerhouse

<span id="javascript-pentest-powerhouse"></span>
= JavaScript Pentest Powerhouse =

'''The source code for this project can be found on [https://git.fh-campuswien.ac.at/c2110475053/wfp1_datasniffer Gitlab]!'''

<span id="introduction"></span>
== Introduction ==

The goal of this project is to create an automated penetration testing platform capable of executing various attack methods, with a specific focus on man-in-the-middle attacks targeting the HTTP protocol. The main objective is to inject malicious JavaScript code into legitimate HTTP responses. Traditionally, performing such attacks has been a cumbersome process. However, our software streamlines these tasks by automating them, requiring users to input critical environmental variables (stored in a .env file).

To achieve this, we have developed a Python-based framework that utilizes additional libraries such as nmap and scapy. Notably, scapy plays an essential role in crafting customized packets to optimize the effectiveness of the attacks. Our project places a strong emphasis on performance and user convenience, relieving users from labor-intensive tasks by seamlessly handling complex aspects. We intend to continue working on this project beyond the current semester.

Specifically, the attack is designed to function in the following manner: - Establish MITM via ARP spoofing or rogue DHCP server - Intercept HTTP responses meant for legitimate clients and forward them to the proxy server using mitmproxy. The response can be modified by inserting (malicious) JavaScript into the HTTP head, causing the target browser to execute our chosen JavaScript - Alternatively, you can load the Beef framework (https://beefproject.com/) to take control of target browsers.

[[File:illustration_wfp1.png|thumb|none|alt=illustration image|illustration image]]

Dependencies/libraries used by Powerhouse:
* python-dotenv -&gt; for loading the .env variables
* netifaces -&gt; for enumerating network interfaces
* netaddr -&gt; network address manipulation library
* python-nmap -&gt; network scanning, host detection and monitoring
* scapy -&gt; packet crafting
* dhcpkit -&gt; dhcp
* mitmproxy -&gt; intercepts HTTP responses and modifies them according to user parameters
* sslsplitter -&gt; intercept HTTPS traffic
* beef -&gt; a framework that offers an intuitive web GUI, enabling users to trigger events on a target browser through the injection of a hook.js file.
* pm2 -&gt; a very useful process management tool within npm, we use it to start/stop processes



<span id="setup-guide-based-on-kali-linux-running-on-a-raspberry-pi"></span>
== Setup guide (based on Kali Linux running on a Raspberry Pi) ==

# Install Kali Linux for Raspberry Pi.
# Run: <code>sudo apt update</code>
# Run: <code>sudo apt upgrade</code> (optional)
# Run: <code>sudo apt install npm</code>
# Run: <code>npm install pm2 -g</code> -&gt; needs to be installed globally (-g)
# Run: <code>sudo apt install mitmproxy</code> (if not already pre-installed with Kali Linux)
# Run: <code>sudo apt install beef-xss</code>
# Run: <code>sudo apt install sslsplit</code>
# Run: <code>cd</code>
# Run: <code>wget http://standards-oui.ieee.org/oui.txt</code> (for DHCP leasing record)
# Run: <code>sudo mv oui.txt /usr/local/etc</code> (folder can only be modified with sudo rights / file has “644” rights)
# Switch to the “Code” directory
# Run: <code>sudo apt install python3.11-venv</code> (may not be necessary)
# Run: <code>python -m venv venv</code>
# Run: <code>source venv/bin/activate</code>
# Run: <code>venv/bin/pip install -r requirements.txt</code>
# To run the program: <code>sudo venv/bin/python main.py</code>
# Press <code>Ctrl + C</code> to exit the program
# Run: <code>deactivate</code>

The program assumes the username is “kali”. If your username is different, you might need to change that in the code. Refer to the error message logged to the console during the execution of the program!

Every system is different, therefore refer to any possible error messages/logging if something doesn’t work!

<span id="the-.env-file"></span>
=== The <code>.env</code> file ===

Here is where things get interesting. In the <code>.env</code> file, you can change various settings related to the execution of the program.

'''General Settings:'''

* <code>METHOD</code>: Here, you can specify which modules of the program shall be used.
** Examples:
*** <code>dhcp;webserver;proxy</code> (use rogue DHCP server, web server to host all relevant files, (mitm)proxy to edit incoming HTTP responses)
*** <code>arp;webserver;proxy</code> (use ARP spoofing instead of rogue DHCP)
*** <code>arp;webserver;beef</code> (launch the BeEF framework -&gt; this injects the hook.js needed to connect a target browser to the framework)
* <code>IGNORE_GATEWAY</code>: When set to “YES”, the program will ignore the gateway (not spoof it).
* <code>IGNORE_IPS</code>: In this variable, you can list any IPs you don’t want to spoof.
** Example: <code>IGNORE_IPS=&quot;192.168.1.1;192.168.1.2&quot;</code>
* <code>IFACE</code>: In case you need to tell the program which specific network interface to use, you can specify it here. Under Kali Linux running on a Raspberry Pi, the default interface is <code>eth0</code>.
* <code>RESET_IPTABLES_RULES</code>: Can be useful if any errors/problems arise regarding <code>iptables</code>.

'''Proxy Settings:'''

* <code>INJECT_FILE</code>: Here you can choose which JavaScript code you want to insert into HTTP responses intercepted by the program. These JavaScript files can be found in <code>WFP1/Code/res_changer_www</code>. If you have any custom JavaScript you want to sneak into other hosts’ HTTP responses, feel free to add JavaScript files to this directory and reference them in this parameter of the <code>.env</code> file.

'''SSL Settings:'''

Here you can find some settings related to the SSL certificate creation process.

* <code>NEW_CERTIFICATE</code>: if set to <code>YES</code> a new ssl certificate is created, used and stored in the <code>certs</code> folder. if set to <code>NO</code> a existing cert is read. Use the <code>CERTIFICATE</code> variable to define the certificate. Use <code>latest</code> or <code>%Y_%m_%d__%H_%M_%S</code>

'''Web Server Settings:'''

These parameters can be used in case you need to modify anything related to the webserver.

(In our Git repository, you can also find example <code>.env</code> files with some extra explanations.)

<span id="contact"></span>
== Contact ==

If you have any questions regarding this project, feel free to email us at: [mailto:timothy.nicholson@stud.fh-campuswien.ac.at timothy.nicholson@stud.fh-campuswien.ac.at] or [mailto:valentin.kogard@stud.fh-campuswien.ac.at valentin.kogard@stud.fh-campuswien.ac.at].

[[Category:Documentation]]