Kali Linux - An Ethical Hacker's Cookbook: End-to-end penetration testing solutions

To start with this recipe we will use the 64-bit Kali Linux ISO listed on the Offensive Security website:

https://www.kali.org/downloads/

We will use the virtual image in this chapter and customize it with some additional tools.

You can configure Kali with the help of the given steps:

With the pre-built image you don't need to worry about the installation process. You can consider it as a ready-to-go solution. Simply click on run and the virtual machine will boot up Linux just like a normal machine.

To configure the Xfce environment follow the given steps:

        apt-get install kali-defaults kali-root desktop-base xfce4
        xfce4-places-plugin xfce4-goodies

The following screenshot shows the preceding command:

        update-alternatives --config x-session-manager

The following screenshot shows the output of the preceding command:

To configure the Mate environment follow the given steps:

        apt-get install desktop-base mate-desktop-environment

The following screenshot shows the preceding command:

        update-alternatives --config x-session-manager

To configure the LXDE environment follow the given steps:

        apt-get install lxde-core lxde

        update-alternatives --config x-session-manager

The following screenshot shows the output for the preceding command:

Due to compatibility issues and dependencies hassle it is better to set up the Kali environment as a different machine. This ISO image (Kali 64-bit e17) is already available on the official website of Kali Linux and can be downloaded from the following URL:

https://www.kali.org/downloads/.

To configure the KDE environment follow the given steps:

        apt-get install kali-defaults kali-root-login desktop-base
        kde-plasma-desktop

The following screenshot shows the output for the preceding command:

        update-alternatives --config x-session-manager

The following screenshot shows the output for the preceding command:

Here is a list of some tools that you will need before we dive deeper into penetration testing. Not to worry, you will be learning their usage with some real-life examples in the next few chapters. However, if you still wish to learn basics in an early stage it can simply be done with simple commands:

Some of the tools are listed in the following sections.

Dnscan

Dnscan is a Python tool that uses a wordlist to resolve valid subdomains. To learn about Dnscan follow the given steps:

1. We will use a simple command to clone the git repository:

        git clone https://github.com/rbsec/dnscan.git

The following screenshot shows the preceding command:

2. You can also download and save it from https://github.com/rbsec/dnscan.
3. Next we browse into the directory where we downloaded Dnscan.

4. Run Dnscan by using the following command:

        ./dnscan.py -h

The following screenshot shows the output for the preceding command:

Subbrute

Next we will install subbrute. It is amazingly fast and provides an extra layer of anonymity as it uses public resolvers to brute force the subdomains:

1. The command here is again simple:

        git clone https://github.com/TheRook/subbrute.git

The following screenshot shows the preceding command:

2. Or you can download and save it from https://github.com/TheRook/subbrute.
3. Once the installation is complete we will need a wordlist for it to run for which we can download dnspop's list. This list can be used in the previous recipe too: https://github.com/bitquark/dnspop/tree/master/results.
4. Once both are set up we browse into the subbrute's directory and run it using the following command:

        ./subbrute.py

5. To run it against a domain with our wordlist we use the following command:

        ./subbrute.py -s /path/to/wordlist hostname.com

Dirsearch

Our next tool in the line is dirsearch. As the name suggests it is a simple command-line tool that can be used to brute force the directories. It is much faster than the traditional DIRB:

1. The command to install is:

        git clone https://github.com/maurosoria/dirsearch.git

2. Or you can download and save it from https://github.com/maurosoria/dirsearch. The following screenshot shows the preceding command:

3. Once the cloning is complete browse to the directory and run the tool by using the following:

        ./dirsearch.py -u hostname.com -e aspx,php

The following screenshot shows the output for the preceding command:

For this recipe we will use the tools ike-scan and ikeprobe. First we install ike-scan by cloning the git repository:

git clone https://github.com/royhills/ike-scan.git

Or you can use the following URL to download it from https://github.com/royhills/ike-scan.

To configure ike-scan follow the given steps:

        apt-get install autoconf

        ike-scan x.x.x.x -M -A

The following screenshot shows the output for the preceding command:

        ike-scan x.x.x.x -M -A id=vpn

The following screenshot shows the example of the preceding command:

Cracking the PSK

To learn how to crack the PSK follow the given steps:

1. Adding a -P flag in the ike-scan command it will show a response with the captured hash.
2. To save the hash we provide a filename along with the -P flag.
3. Next we can use the psk-crack with the following command:

        psk-crack -b 5 /path/to/pskkey

4. Where -b is brute force mode and length is 5.
5. To use a dictionary based attack we use the following command:

        psk-crack -d /path/to/dictionary /path/to/pskkey

The following screenshot shows the output for the preceding command:

In aggressive mode the authentication hash is transmitted as a response to the packet of the VPN client that tries to establish a connection Tunnel (IPSEC). This hash is not encrypted and hence it allows us to capture the hash and perform a brute force attack against it to recover our PSK.

This is not possible in main mode as it uses an encrypted hash along with a six way handshake, whereas aggressive mode uses only three way.

Proxychains is already installed in Kali. However, we need a list of proxies into its configuration file that we want to use:

        leafpad /etc/proxychains.conf

The following screenshot shows the output for the preceding command:

We can add all the proxies we want in the preceding highlighted area and then save.

Proxychains also allows us to use dynamic chain or random chain while connecting to proxy servers.

Using proxychains with tor

To learn about tor follow the given steps:

1. To use proxychains with tor we first need to install tor using the following command:

        apt-get install tor

2. Once it is installed we run tor by typing tor in the Terminal.
3. We then open another Terminal and type the following command to use an application via proxychains:

        proxychains toolname -arguments

The following screenshot shows the example of the preceding commands:

For this recipe, you will again need to clone a git repository.

We will use the following command:

git clone https://github.com/jh00nbr/RouterHunterBR.git

To execute RouterHunterBR.php follow the given steps:

        php RouterHunterBR.php -h

The following screenshot shows the output of the preceding command: