Kali Linux - An Ethical Hacker's Cookbook

4.3 (3 reviews total)
By Himanshu Sharma
    Advance your knowledge in tech with a Packt subscription

  • Instant online access to over 7,500+ books and videos
  • Constantly updated with 100+ new titles each month
  • Breadth and depth in over 1,000+ technologies
  1. Kali – An Introduction

About this book

With the current rate of hacking, it is very important to pentest your environment in order to ensure advanced-level security. This book is packed with practical recipes that will quickly get you started with Kali Linux (version 2016.2) according to your needs, and move on to core functionalities. This book will start with the installation and configuration of Kali Linux so that you can perform your tests. You will learn how to plan attack strategies and perform web application exploitation using tools such as Burp, and Jexboss. You will also learn how to perform network exploitation using Metasploit, Sparta, and Wireshark. Next, you will perform wireless and password attacks using tools such as Patator, John the Ripper, and airoscript-ng. Lastly, you will learn how to create an optimum quality pentest report! By the end of this book, you will know how to conduct advanced penetration testing thanks to the book’s crisp and task-oriented recipes.

Publication date:
October 2017
Publisher
Packt
Pages
376
ISBN
9781787121829

 

Chapter 1. Kali – An Introduction

In this chapter, we will cover the following recipes:

  • Configuring Kali Linux
  • Configuring the Xfce environment
  • Configuring the Mate environment
  • Configuring the LXDE environment
  • Configuring the e17 environment
  • Configuring the KDE environment
  • Prepping up with custom tools
  • Pentesting VPN's ike-scan
  • Setting up proxychains
  • Going on a hunt with Routerhunter
 

Introduction


Kali was first introduced in 2012 with a completely new architecture. This Debian-based distro was released with over 300 tools specialized for penetration testing and digital forensics. It is maintained and funded by Offensive Security Ltd with core developers being Mati Aharoni, Devon Kearns, and Raphael Hertzog.

Kali 2.0 came into the picture in 2016 with tons of new updates and new desktop environments such as KDE, Mate, LXDE, e17, and Xfce builds.

While Kali is already pre-equipped with hundreds of amazing tools and utilities to help penetration testers around the globe to perform their job efficiently, in this chapter, we will primarily cover some custom tweaks that can be used to have an even better pentesting experience for the users.

 

Configuring Kali Linux


We will use the official Kali Linux ISO provided by Offensive Security to install and configure different desktop environments such as Mate, e17, Xfce, LXDE, and KDE desktops.

Getting ready

To start with this recipe we will use the 64-bit Kali Linux ISO listed on the Offensive Security website:

https://www.kali.org/downloads/

Note

For users looking to configure Kali in a virtual machine such as VMware, VirtualBox, and so on, a pre-built image of the Linux can be downloaded from https://www.offensive-security.com/kali-linux-vmware-virtualbox-image-download/.

We will use the virtual image in this chapter and customize it with some additional tools.

How to do it...

You can configure Kali with the help of the given steps:

  1. Double-click on the VirtualBox image, it should open with VirtualBox:
  1. Click Import:
  1. Start the machine and enter the password as toor:
  1. Now, Kali is started and by default is configured with the GNOME desktop environment:

How it works...

With the pre-built image you don't need to worry about the installation process. You can consider it as a ready-to-go solution. Simply click on run and the virtual machine will boot up Linux just like a normal machine.

 

Configuring the Xfce environment


Xfce is a free, fast, and lightweight desktop environment for Unix and Unix-like platforms. It was started by Olivier Fourdan in 1996. The name Xfce originally stood for XForms Common Environment, but since that time Xfce has been rewritten twice and no longer uses the XForms toolkit.

How to do it...

To configure the Xfce environment follow the given steps:

  1. We start by using the following command to install Xfce along with all plugins and goodies:
        apt-get install kali-defaults kali-root desktop-base xfce4
        xfce4-places-plugin xfce4-goodies

The following screenshot shows the preceding command:

  1. Type Y when it asks for confirmation on additional space requirements.
  2. Select Ok on the dialogue box that appears.
  1. We select lightdm as our default desktop manager and press the Enter key.
  2. When the installation is complete we open a Terminal window and type the following command:
        update-alternatives --config x-session-manager

The following screenshot shows the output of the preceding command:

  1. Choose the option xfce4-session (in our case 3) and press the  Enter key.
  1. Log out and log in again or you can restart the machine and we will see the Xfce environment:
 

Configuring the Mate environment


The Mate desktop environment was built in continuation of GNOME 2. It was first released in 2011.

How to do it...

To configure the Mate environment follow the given steps:

  1. We start by using the following command to install the Mate environment:
        apt-get install desktop-base mate-desktop-environment

The following screenshot shows the preceding command:

  1. Type Y when it asks for confirmation on additional space requirements.
  2. When installation is complete we will use the following command to set Mate as our default environment:
        update-alternatives --config x-session-manager
  1. Choose the option mate-session (in our case 2) and press the Enter key:
  1. Log out and log in again or restart and we will see the Mate environment:
 

Configuring the LXDE environment


LXDE is a free open source environment written in C using GTK+ toolkit for Unix and other POSIX platforms. Lightweight X11 Desktop Environment (LXDE) is the default environment for many operating systems such as Knoppix, Raspbian, Lubuntu, and so on.

How to do it...

To configure the LXDE environment follow the given steps:

  1. We start by using the following command to install LXDE:
        apt-get install lxde-core lxde
  1. Type Y when it asks for confirmation on additional space requirements.
  2. When the installation is complete we open a Terminal window and type the following command:
        update-alternatives --config x-session-manager

The following screenshot shows the output for the preceding command:

  1. Choose the option lxsession (in our case 4) and press Enter.
  1. Log out and log in again and we will see the LXDE environment:
 

Configuring the e17 environment


Enlightenment, or otherwise known as E, is a window manager for the X Windows system. It was first released in 1997. It has lots of features such as engage, virtual desktop, tiling, and so on.

How to do it...

Due to compatibility issues and dependencies hassle it is better to set up the Kali environment as a different machine. This ISO image (Kali 64-bit e17) is already available on the official website of Kali Linux and can be downloaded from the following URL:

https://www.kali.org/downloads/.

 

Configuring the KDE environment


KDE is an international community for free software. The plasma desktop is one of the most popular projects of KDE; it comes as a default desktop environment for a lot of Linux distributions. It was founded in 1996 by Matthias Ettrich.

How to do it...

To configure the KDE environment follow the given steps:

  1. We use the following command to install KDE:
        apt-get install kali-defaults kali-root-login desktop-base
        kde-plasma-desktop

The following screenshot shows the output for the preceding command:

  1. Type Y when it asks for confirmation on additional space requirements.
  2. Click OK on both the windows that pop up.
  3. When the installation is complete we open a Terminal window and type the following command:
        update-alternatives --config x-session-manager

The following screenshot shows the output for the preceding command:

  1. Choose the option KDE session (in our case 2) and press Enter.
  2. Log out and log in again and we will see the KDE environment:

Note

Kali already has provided prebuilt images of different desktop environments. These can be downloaded from here: https://www.kali.org/downloads/.

 

Prepping up with custom tools


These tools you will install are open source available on GitHub. They are much faster and contain collections of different tweaks that people have included over a period of time during their own pentesting experience.

Getting ready

Here is a list of some tools that you will need before we dive deeper into penetration testing. Not to worry, you will be learning their usage with some real-life examples in the next few chapters. However, if you still wish to learn basics in an early stage it can simply be done with simple commands:

  • toolname -help
  • toolname -h

How to do it...

Some of the tools are listed in the following sections.

Dnscan

Dnscan is a Python tool that uses a wordlist to resolve valid subdomains. To learn about Dnscan follow the given steps:

  1. We will use a simple command to clone the git repository:
        git clone https://github.com/rbsec/dnscan.git

The following screenshot shows the preceding command:

  1. You can also download and save it from https://github.com/rbsec/dnscan.
  2. Next we browse into the directory where we downloaded Dnscan.
  1. Run Dnscan by using the following command:
        ./dnscan.py -h

The following screenshot shows the output for the preceding command:

Subbrute

Next we will install subbrute. It is amazingly fast and provides an extra layer of anonymity as it uses public resolvers to brute force the subdomains:

  1. The command here is again simple:
        git clone https://github.com/TheRook/subbrute.git

The following screenshot shows the preceding command:

  1. Or you can download and save it from https://github.com/TheRook/subbrute.
  2. Once the installation is complete we will need a wordlist for it to run for which we can download dnspop's list. This list can be used in the previous recipe too: https://github.com/bitquark/dnspop/tree/master/results.
  3. Once both are set up we browse into the subbrute's directory and run it using the following command:
        ./subbrute.py
  1. To run it against a domain with our wordlist we use the following command:
        ./subbrute.py -s /path/to/wordlist hostname.com

Dirsearch

Our next tool in the line is dirsearch. As the name suggests it is a simple command-line tool that can be used to brute force the directories. It is much faster than the traditional DIRB:

  1. The command to install is:
        git clone https://github.com/maurosoria/dirsearch.git
  1. Or you can download and save it from https://github.com/maurosoria/dirsearch. The following screenshot shows the preceding command:
  1. Once the cloning is complete browse to the directory and run the tool by using the following:
        ./dirsearch.py -u hostname.com -e aspx,php

The following screenshot shows the output for the preceding command:

 

Pentesting VPN's ike-scan


Often during a pentest we may encounter VPN endpoints. However, finding vulnerabilities in those endpoints and exploiting them is not a well known method. VPN endpoints use Internet Key Exchange (IKE) protocol to set up a security association between multiple clients to establish a VPN tunnel.

IKE has two phases, phase 1 is responsible for setting up and establishing secure authenticated communication channel, and phase 2 encrypts and transports data.

Our focus of interest here would be phase 1; it uses two methods of exchanging keys:

  • Main mode
  • Aggressive mode

We will hunt for aggressive mode enabled VPN endpoints using PSK authentication.

Getting ready

For this recipe we will use the tools ike-scan and ikeprobe. First we install ike-scan by cloning the git repository:

git clone https://github.com/royhills/ike-scan.git

Or you can use the following URL to download it from https://github.com/royhills/ike-scan.

How to do it...

To configure ike-scan follow the given steps:

  1. Browse to the directory where ike-scan is installed.
  2. Install autoconf by running the following command:
        apt-get install autoconf
  1. Run autoreconf --install to generate a .configure file.
  2. Run ./configure.
  3. Run make to build the project.
  4. Run make check to verify the building stage.
  5. Run make install to install ike-scan.
  6. To scan a host for an aggressive mode handshake, use the following commands:
        ike-scan x.x.x.x -M -A

The following screenshot shows the output for the preceding command:

  1. Sometimes we will see the response after providing a valid group name like (vpn):
        ike-scan x.x.x.x -M -A id=vpn

The following screenshot shows the example of the preceding command:

Note

We can even brute force the groupnames using the following script:https://github.com/SpiderLabs/groupenum.https://github.com/SpiderLabs/groupenum The command:./dt_group_enum.sh x.x.x.x groupnames.dic

Cracking the PSK

To learn how to crack the PSK follow the given steps:

  1. Adding a -P flag in the ike-scan command it will show a response with the captured hash.
  2. To save the hash we provide a filename along with the -P flag.
  3. Next we can use the psk-crack with the following command:
        psk-crack -b 5 /path/to/pskkey
  1. Where -b is brute force mode and length is 5.
  2. To use a dictionary based attack we use the following command:
        psk-crack -d /path/to/dictionary /path/to/pskkey

The following screenshot shows the output for the preceding command:

How it works...

In aggressive mode the authentication hash is transmitted as a response to the packet of the VPN client that tries to establish a connection Tunnel (IPSEC). This hash is not encrypted and hence it allows us to capture the hash and perform a brute force attack against it to recover our PSK.

This is not possible in main mode as it uses an encrypted hash along with a six way handshake, whereas aggressive mode uses only three way.

 

Setting up proxychains


Sometimes we need to remain untraceable while performing a pentest activity. Proxychains helps us by allowing us to use an intermediary system whose IP can be left in the logs of the system without the worry of it tracing back to us.

Proxychains is a tool that allows any application to follow connection via proxy such as SOCKS5, Tor, and so on.

How to do it...

Proxychains is already installed in Kali. However, we need a list of proxies into its configuration file that we want to use:

  1. To do that we open the config file of proxychains in a text editor with this command:
        leafpad /etc/proxychains.conf

The following screenshot shows the output for the preceding command:

We can add all the proxies we want in the preceding highlighted area and then save.

Proxychains also allows us to use dynamic chain or random chain while connecting to proxy servers.

  1. In the config file uncomment the dynamic_chain or random_chain:

Using proxychains with tor

To learn about tor follow the given steps:

  1. To use proxychains with tor we first need to install tor using the following command:
        apt-get install tor
  1. Once it is installed we run tor by typing tor in the Terminal.
  2. We then open another Terminal and type the following command to use an application via proxychains:
        proxychains toolname -arguments

The following screenshot shows the example of the preceding commands:

 

Going on a hunt with Routerhunter


Routerhunter is a tool used to find vulnerable routers on a network and perform various attacks on it to exploit the DNSChanger vulnerability. This vulnerability allows an attacker to change the DNS server of the router hence directing all the traffic to desired websites.

Getting ready

For this recipe, you will again need to clone a git repository.

We will use the following command:

git clone https://github.com/jh00nbr/RouterHunterBR.git

How to do it...

To execute RouterHunterBR.php follow the given steps:

  1. Once the file is cloned, enter the directory.
  2. Run the following command:
        php RouterHunterBR.php -h

The following screenshot shows the output of the preceding command:

  1. We can provide Routerhunter an IP range, DNS server IP's, and so on.

 

About the Author

  • Himanshu Sharma

    Himanshu Sharma has already achieved fame for finding security loopholes and vulnerabilities in Apple, Google, Microsoft, Facebook, Adobe, Uber, AT&T, Avira, and many others. He has assisted international celebrities such as Harbajan Singh in recovering their hacked accounts. He has been a speaker and trainer at international conferences such as Botconf 2013, CONFidence, RSA Singapore, LeHack, Hacktivity, Hack In the Box, and SEC-T. He also spoke at the IEEE Conference for Tedx. Currently, he is the cofounder of BugsBounty, a crowdsourced security platform.

    Browse publications by this author

Latest Reviews

(3 reviews total)
Great books by great authors. I love them all.
rápida y eficaz. Sencilla
Well written book easy to read.
Book Title
Unlock this book and the full library for FREE
Start free trial