Category: Hacking Tools

Posted on by

WhatWeb tool: Beginners guide

Hello, aspiring ethical hackers. In one of our previous blogpost, you learnt about what is website hacking, what are the various website hacking techniques used by hackers etc. In this blogpost, you will learn about WhatWeb tool, a web scanner.

WhatWeb tool is a tool that can be used to identify a website. As its makers say, the goal of WhatWeb tool is to answer the question “What is that website?”.

That’s right because WhatWeb can identify a variety of web technologies used on a website that include web servers, Content Management System (CMS), blogging platforms, statistics and analytic packages, JavaScript libraries, embedded devices, version numbers of the software, email addresses, account in web framework modules, SQL errors etc. WhatWeb too has over 1800 plugins, each to recognize something different.

WhatWeb is installed by default in Kali Linux. Let’s see how to use it for scanning the website. As target, we will be using Multillidae in Metasploitable 2. To scan a website, all you have to do is specify the target website or its IP to WhatWeb as shown below.

WhatWeb has different levels of aggression while scanning its targets. By default it is set to 1 (stealthy) and it makes one HTTP request per target. However, we can set the level of aggression while scanning the target. If we set the aggression level to “3 (aggressive)” as shown below, WhatWeb will send additional requests once it finds a level 1 plugin.

Similarly, setting the aggression level to “4 (Heavy)”, WhatWeb makes a lot of HTTP requests per target. In this level, URLs from all plugins are attempted.

At the beginning of the article, I told you that WhatWeb has lot of plugins each suited for a specific purpose. You can view all the plugins of WhatWeb using the “-l” option.

If you want to view the information about each plugin the “–info-plugins” option will do this for you.

You can also search for a particular plugin from the list of plugins using the “–search- plugins” option. For example, let’s search for webdav plugin in WhatWeb.

To use a particular plugin the option is “-p”. For example, let’s use the “webdav” plugin with the same target.

If you want the result to be in more detailed format while scanning with WhatWeb, you can use the verbose option with WhatWeb.

Whatweb also has a quiet mode scan option that scans a website without showing output to terminal (stdout) as shown below.

Posted on by

Beginners guide to dirbuster

Hello, aspiring ethical hackers. In this blogpost, you will learn about dirbuster, a tool used to scan web directories and file names on web application servers. Dirbuster is written in Java and can be installed on Linux systems. Almost all pentesting distros include this in their tools list. For this tutorial, we are going to use Kali Linux. Dirbuster can be started on Kali by using the command as shown below.

dirbuster

Typing this command will open a GUI window as shown below.

Here, you can configure all the options required to scan the target web server. For this tutorial, we will be using Metasploitable 2 as our target. Any directory scanning and fuzzing tool is as good as the wordlist it uses while scanning for hidden directories and files. Dirbuster provides its own set of wordlists which are located in “usr/share/dirbuster/wordlists” directory in Kali.

Unlike other wordlists, these wordlists are created using a different approach. These lists are created from scratch by crawling the internet and making a collection of the all the files used by all developers. It comes with a total of 9 different lists. If all these lists fail, dirbuster also has brute force option.

The scan starts. Depending on the size of the target web server, finishing time may vary. The progress of the scan will be displayed in the “scan information” tab.

As the scan continues, you can see the results in different views. The “List view” shows all the detected directories and files by dirbuster in the form of a list.

You can also see the results of the scan in the form of “Tree view” that enables us to gain understanding about the target web server directories structure.

You can right click on the detected directories for more options as shown below.

If dirbuster faces any errors while scanning directories, they are displayed in the “errors” tab.

You can wait until the scan finishes or you can even end the scan by hitting “stop” button. Once you do that, dirbuster will prompt you to save the result of the scan as shown below.

You can also use dirbuster by specifying its options through command line. The basic options to set are the URL and the wordlist. These can be set with ‘-U’ and ‘-r’ options respectively.

Then, all you have to do is click on “Start”. If you want to find files with a particular extension with dirbuster the option is ‘-e’. For example, let’s say you want it scan for files with “php” extension here is the command,

To save the output of dirbuster scan, use command line option ‘-r’.

Headless mode (-H)

You can run dirbuster in headless mode without GUI option as shown below.

Posted on by

Beginners guide to ffuf tool

Hello, aspiring ethical hackers. In one of our previous blogposts on website footprinting, you learnt that web directory scanning and fuzzing are some of the techniques used to gather information about a website. In this blogpost, you will learn about a tool named ffuf, which is a fuzzing tool known for its speed.

Written in Go language, it is considered a very fast web fuzzer available on the market. It can be used for web content discovery (director scanning), virtual host discovery, parameter fuzzing, POST data fuzzing, configuration file check etc.

In this blogpost, let’s see how to use ffuf for fuzzing. It is installed by default on Kali and we are going to use the same. Metasploitable 2 is our target as always. See how to create a virtual hacking lab with Kali and Metasploitable 2.

Just like any other directory scanner out there, you need to specify an URL and a wordlist for fuzzing with ffuf. However, unlike other directory scanners, you need to use a word FUZZ while using this tool as shown below.

Here, we are fuzzing Mutillidae installed by default on Metasploitable 2. Here’s the result of the scan.

Colorize output(-c)

It found some interesting directories. However, the output is monotonous. With ffuf however, you can colorize the output using the “-c” option.

Here’s the result.

Silent mode (-s)

If you don’t like this output or want this tool to display output without printing any additional information, you can do it with the “-s” option.

Changing HTTP method (-X)

By default, Ffuf uses HTTP GET method. We can change this using the option (-X). For example, let’s change it to use POST parameter as shown below.

Follow redirected URL’s (-r)

Many websites have URLs redirected to other URLs. By using this option, you can ask it to follow the redirected URL if it finds a redirection.

Ffuf has many filters available. Using this option, we can specify ffuf to automatically calibrate those filter options.

Delay (-D)

What is a fuzzer without the option for adding delay between requests. Ffuf too has this option to add delay between each request. For example, let’s add 3 seconds delay between each request.

Stop ffuf on getting error (-se)

If Ffuf faces an error while fuzzing, it continues scanning. By setting this option, you can ask ffuf to stop when it faces any spurious error.

Search for files with specified extension (-e)

This option is used to search for files with specified extensions.

Save output (-o)

Finally if you want to save output of ffuf to a file, this is the option to use.

Posted on by

BeEF Browser exploitation tool: Beginners guide

Hello, aspiring ethical hackers. In our previous blogposts, you learnt about Windows hacking techniques, Linux hacking techniques etc. In this blogpost, you will learn about BeEF tool that focuses on exploiting a software or program extensively used in both Linux and Windows operating systems. We are talking about web browser. BeEF is short for “The Browser Exploitation Framework”. It is a penetration testing tool focusing on the web browser.

In the noise of ever increasing cases of web server hacking and web application hacking, one that is often ignored is the exploitation of web clients, aka browser. Browsers once compromised, provide a easy way of gaining access to hackers. No doubt, attacks targeting web clients are on the rise. BeEF helps pen testers to understand the security posture of web browsers in an organization.

Let’s see how to use it. BeEF is present in the repositories of Kali Linux. We will be using the same for this tutorial. It can be installed on Kali as shown below.

After BeEF is successfully installed, don’t forget to run it with root privileges. Otherwise, it will not start.

After running for the first time, BeEF will ask you to setup a new password. Set it. Once you set it, it will start a web interface by default. Before that, it will display a hook as shown below.

Before you use BeEF further, you need to understand two terms related to it. They are,

  1. Hook: A hook is something used to trap a browser.
  2. Zombie: A trapped browser is known as a Zombie.

Once the web interface of BeEF opens, login with username “beef” and the password you set earlier.

Once you login, you will be greeted with the dashboard of BeEF. The interface can be divided into two parts. On the left, you will see hooked browsers section. All those browsers that are compromised by BeEF are shown here. On the right, you can see the general interface of BeEF.

It has three tabs. The “Logs” tab show all the activity happening with BeEF.

The “Zombies” tab, as you expected will display all the compromised browsers.

BeEF also has “Getting started” tab. Now, let’s see how to hook a browser. Browsers can be hooked by using the hooks shown at the beginning. You have to somehow make users click on this hook script. Of course, this requires social engineering.

For demonstration purpose, BeEF has two demo pages that work as hooks. One is basic and advanced. They can be found in “Getting Started” tab as highlighted in the above image. Here is the basic demo page and advanced demo page.

All we have to do is copy the links of the pages and make target users click on these links. As soon as they do it, the browser gets hooked as shown below.

When you click on the IP, the “current browser” tab opens, displaying general information about the target OS on which that browser is installed.

The “Current browser” tab opens a few sub-tabs of itself. You have seen about the “details” tab above. The “Logs” sub-tab shows all the logs belonging to the current browser.

The most powerful part of BeEF in its command section.

This section includes all the commands that can be executed on the target system.

For example, let’s execute a command “Detect Antivirus” as shown below. This command as its name suggests tries to detect if Antivirus is installed on target system or not. We can execute this module by clicking on “Execute” as shown below.

To see the result of the executed command, click on the command in history. It will display the result in command results window to the right.

In our case, it’s true that Antivirus is not installed on the target system. If you click on the “Zombies” tab you have learnt above earlier, your hooked browser can be seen, as shown below.

Posted on by

Beginners guide to theHarvester tool

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about OSINT. In this blogpost, you will learn about a tool called theharvester that is used to gather open source intelligence (OSINT) on a company or domain.

Using theHavester tool, we can gather information like subdomain names, email addresses, virtual hosts, open ports, banners and employee names of an organization from different public sources like search engines, pgp key servers, IP addresses and URLs.

theHarvester is installed by default on almost all pen testing distros. For this tutorial, we will be using Kali Linux. theHarvester is very simple to use but very powerful during footprinting stage of a red team assessment or a penetration test. It can take a domain or an organization as target as shown below.

theHarvester can list a lot of entries as part of performing OSINT. You can specify the limit to the number of entries you want to be displayed.

You can even start querying from particular entry form list of entries displayed. For example, you want to start querying from the 10th entry.

–shodan

theHarvester also has a option called “–shodan” that queries the Shodan search engine for any open ports or banners from discovered hosts. However, this requires api keys.

–screenshot

This command allows theHarvester to take screenshots of subdomains that are found.

–dns-brute

As the command explains, you can brute force DNS servers using this option.

–source

theHarvester uses many public sources to collect information. Some of them are anubis, baidu, bing, brave, censys, etc. We can even ask it to use a specific source using the “–source” command.

Learn how to perform OSINT using amass or Maltego or Spiderfoot.