Author: kanishka10

Posted on by

Beginners guide to Lynis

Hello, aspiring ethical hackers. In this blogpost, you will learn about a tool called Lynis, the security auditing and hardening tool for UNIX based systems like Linux, macOS, BSD and others. It performs an in-depth security scan to test security defenses and provide suggestions for further system hardening.

This tool audits the following features on the system.

  1. General system information.
  2. System tools.
  3. Operating system.
  4. Boot and other services.
  5. Kernel vulnerabilities.
  6. Memory and processes.
  7. Users, groups and authentication
  8. Kerberos
  9. Shells
  10. File systems
  11. USB devices
  12. Storage
  13. NFS
  14. Name Services
  15. Ports and packages
  16. Networking
  17. Printers and Spool
  18. Email and messaging software
  19. Firewalls
  20. Web servers
  21. SSH and SNMP
  22. Databases
  23. PHP (in web server)
  24. Logging and log files
  25. Insecure services
  26. Banners
  27. Scheduled Tasks
  28. Accounting
  29. Time and synchronization
  30. Cryptography
  31. Virtualization
  32. Containers
  33. Security frameworks
  34. System tools and malware
  35. File permissions etc.

Let’s see how to run Lynis for the first time. For this, we will be using Kali Linux. It can be installed on Kali as shown below.

After the installation is successful, run the command shown below to run it to audit the entire system.

lynis audit system

It runs as shown below.

While auditing, wherever there is scope for hardening, lynis adds a suggestion as shown below.

After the entire system is audited, Lynis provides summary of the entire audit as shown below.

Below the summary, you can find each suggestion as shown below.

You can harden your system based on these suggestions. You can also find this information in the log reports of Lynis.

Posted on by

Beginners guide to Eyewitness tool

Hello aspiring ethical hackers. In our previous blogpost, you studied about website footprinting. In this blogpost, you will learn about a tool called eyewitness which helps you to decide which website to focus on.

In ethical hacking, before trying to footprint a website, it would be good if we have a general idea about what websites to target first. For example, a company you are going to pen test may have multiple websites and sub domains. Before we jump into password cracking or exploitation or directory busting or perform any other attack, it would be good if we are first able to decide what website and URLs to target first. The role of eyewitness tool comes there. Eyewitness takes the screenshots of the URLs or websites you provide. Apart from taking screenshot of the URL, it will also capture any header info and default passwords.

Let’s see how to use this tool. For this we will be using Kali Linux as this tool is available by default in Kali repositories. As target, we will be using Metasploitable 2 installed in our virtual hacking Lab. It can be installed as shown below.

Target a single URL (–single)

You can take screenshot of a single URL as shown below.

As soon as it writes a report for your target, it will ask you if you want to open the report. Click on “Yes”. It will open the report as shown below.

You can even view the code of the URL you scanned.

But the real power of eyewitness can be seen when we are targeting multiple URLs at once. For doing this, we will first create a file called URLS.txt and add some URLs we want to target as shown below.

Target multiple URLs (-f)

Multiple URLs can be targeted with this tool by specifying the above created file with (-f) option.

Here’s the report.

One of our URLs we targeted ended up in a error.

Skip DNS resolution(–no-dns)

In some cases, while using eyewitness tool, you may have to go through a VPN. In such cases, it is good to skip DNS resolution when connecting to the website. This option helps you to do it.

Resolve IP / host name for your target (–resolve)

Time to wait while requesting an URL (–timeout)

By default, eyewitness waits for 7 seconds before it goes to take a screenshot of a new webpage. However, this can be changed with this option. For example, let’s change the timeout time to 1 second.

Add jitter (–jitter)

Using this option, we can randomize the URLs specified and add a random delay.

Add delay before taking a screenshot (–delay)

Using the option, we can add delay between opening of the navigator and taking a screenshot. This delay can be specified in seconds. For example, let’s add 10 seconds delay before taking screenshot.

Maximum retries (–max-retries)

This option specifies eyewitness tool how many retries it has to make if it fails to grab a screenshot on the first attempt.

Specify directory name for saving the report (-d)

This option is used to specify a directory name for saving the report.

Number of results to show on one page (–results)

By default, eyewitness shows output for all the URLs given as input on a single page. This option can be used to specify how many results to show per page. For example, let’s set it to show 1 result per page.

As you can see, now, all the results are shown on separate pages.

You don’t want to be prompted for viewing the report (–no-prompt)

If you don’t want eyewitness to prompt you to open the report after finishing its work, you can use this option.

Posted on by

How to create a payload

Hello, aspiring ethical hackers. In this blogpost, you will learn what is a payload and how to create a payload manually. Note that it is only for educational and knowledge purposes and not for performing any malicious actions. The aim of this article is to give you a basic understanding on how to create a payload. Let’s start with defining what exactly is a payload.

What is a payload?

A payload in cyber security is a piece of code that is executed after successfully running an exploit to take advantage of a vulnerability. When a Proof Of Concept (POC) for a vulnerability is disclosed, this allows most hackers around the world to execute their chosen payloads. This payload can be anything from malware, reverse shell, RAT, ransomware etc or their own custom payload.

For example, ms08_067 vulnerability was exploited in real-world to deploy Conficker worm payload, but while pen testing with Metasploit, meterpreter is used as payload. Although payloads can be created using payload generators simply, it would be very thrilling and educative to create manually.

Creation of a computer payload consists of six steps. They are,

  1. Decide the function you want your payload to perform.
  2. Select a programming language in which you want to code your payload.
  3. Code the payload.
  4. Compiling the payload.
  5. Testing.
  6. Sharing the payload.

Let’s learn about each step in detail.

1. Function of a payload:

Before you even start coding a payload, you need to decide what exactly you want your payload to do. In real-world, payloads perform many functions that include downloading and installing additional payloads, wiping data from the infected system and even taking complete control of the system. For example, I decide that my payload should open a Firefox browser when executed.

2. Choose your language:

After deciding the function you want your payload to perform, next thing you have to do is choose a programming language to code this payload. Payloads can be written in many programming languages like C, Delphi, Visual Basic, C#, C++, Cobol, Ruby, Python etc. They can also be created using scripting languages like JavaScript, Batch script, Bash, PowerShell etc. Choose the programming or scripting language of your choice. For example, I want to write my payload in Batch scripting.

3. Write code:

Once you select the programming language or scripting language, you need to code the payload. To code a batch script, all I have to do is open a notepad, add the code shown below and save the file as Batch file (with extension .bat)

@echo off
start firefox.exe

4. Compile (if necessary):

Compile the payload. Compiling is a process of converting source code into machine-readable code so that a computer can execute it. Since we have written our code in Batch, it doesn’t need any compilation. But programs written in C,C++, Python need compiling. Compiled programs are usually fast.

5. Test the payload:

Once you have finished coding the virus and compiling it, test its working by executing the virus. I execute the Batch virus I created and it open Firefox browser as shown below.

6. Share the virus:

The last step is to share the payload to make your target user execute it. Normally hackers use social engineering or phishing schemes to spread the paylaod.

Posted on by

Beginners guide to MAC flooding

Hello, aspiring ethical hackers. In our previous blogpost on data link layer attacks, you learnt what is a hub, What is a switch, how they both work, what is a MAC address, what is a CAM table and different types of LAN attacks etc. In this blogpost, you will learn about one such attack, MAC flooding attack.

What is MAC flooding?

MAC flooding attack is an attack on the network switch that floods the network switch with fake MAC addresses. The purpose of this attack is to consume memory of the network switch. Once the CAM table of the network switch becomes full, the MAC addresses of the legitimate devices are purged out of the CAM table.

The network switch can no longer save new MAC addresses sent to the switch and it soon falls into a fail-open mode in which it will broadcast the incoming data to all the ports of the switch instead of transferring it to the intended device. Typically, the switch here functions like a network hub.

Since the data is now being broadcast to all the devices connected to the network, hackers can sniff on data belonging to all the devices in the network.

There are many ways to perform MAC flooding. One such method is to using a too named macof. Macof is a tool that comes with dsniff package. macof is used to flood the local network with random MAC addresses. It is installed by default in Kali Linux. The default way to flood the switch with macof is to specify the interface as shown below. 

sudo macof -i eth0

This will create multiple random MAC addresses. You can even specify the number of packets you want to create as shown below.

sudo macof -i <interface> -n <number of packets to create>

You can even specify the source IP address from where these random MAC address should originate from.

sudo macof -i <interface> -s <IP address> -n <number of packets to create>

You can also specify the MAC address or physical address of the target device you want to flood with random MAC addresses. 

sudo macof -i <interface> -e <Physical address of target>
Posted on by

Beginners guide to dirbuster

Hello, aspiring ethical hackers. In this blogpost, you will learn about dirbuster, a tool used to scan web directories and file names on web application servers. Dirbuster is written in Java and can be installed on Linux systems. Almost all pentesting distros include this in their tools list. For this tutorial, we are going to use Kali Linux. Dirbuster can be started on Kali by using the command as shown below.

dirbuster

Typing this command will open a GUI window as shown below.

Here, you can configure all the options required to scan the target web server. For this tutorial, we will be using Metasploitable 2 as our target. Any directory scanning and fuzzing tool is as good as the wordlist it uses while scanning for hidden directories and files. Dirbuster provides its own set of wordlists which are located in “usr/share/dirbuster/wordlists” directory in Kali.

Unlike other wordlists, these wordlists are created using a different approach. These lists are created from scratch by crawling the internet and making a collection of the all the files used by all developers. It comes with a total of 9 different lists. If all these lists fail, dirbuster also has brute force option.

The scan starts. Depending on the size of the target web server, finishing time may vary. The progress of the scan will be displayed in the “scan information” tab.

As the scan continues, you can see the results in different views. The “List view” shows all the detected directories and files by dirbuster in the form of a list.

You can also see the results of the scan in the form of “Tree view” that enables us to gain understanding about the target web server directories structure.

You can right click on the detected directories for more options as shown below.

If dirbuster faces any errors while scanning directories, they are displayed in the “errors” tab.

You can wait until the scan finishes or you can even end the scan by hitting “stop” button. Once you do that, dirbuster will prompt you to save the result of the scan as shown below.

You can also use dirbuster by specifying its options through command line. The basic options to set are the URL and the wordlist. These can be set with ‘-U’ and ‘-r’ options respectively.

Then, all you have to do is click on “Start”. If you want to find files with a particular extension with dirbuster the option is ‘-e’. For example, let’s say you want it scan for files with “php” extension here is the command,

To save the output of dirbuster scan, use command line option ‘-r’.

Headless mode (-H)

You can run dirbuster in headless mode without GUI option as shown below.