1. Metasploit
Metasploit is the de facto standard hacking tool when it comes to performing vulnerability assessment. This is one of the most feature rich platforms that allows even beginner criminals to launch sophisticated attacks using short commands. By far this is one of the most popular suites when it comes to teaching both security professionals and hackers about vulnerability scanning and penetration testing.
It is available in several editions (free and paid versions are available) and depending on the configuration and goals it can be used in different ways. Metasploit is comprised of a flexible framework that allows its operators to launch exploits and payloads. The modular approach can be used to launch well-known attacks, as well as custom code against whole networks. The framework is typically used in conjunction with other network security tools to conduct a preliminary analysis of the intended targets.
Once the criminals know what operating system, device and services are running, they can use Metasploit to launch hacking attacks and break into the system. Depending on the version and configuration the available tools can include any of the following:
command
line or graphical interfaces, third-party import of exploits,
manual/automatic brute force, network discovery, evidence collection,
social engineering campaigns, web applications testing and VPN
tunneling.
Metasploit contains one of the largest collections of
exploits available for both applications, operating systems, dedicated
devices or multi-platform injections. It can be extended by plug-ins or
third-party modules if the core functionality is limiting. Using it in
live hacker attacks the operators can institute a wide variety of
infection types: from overtaking the devices to spying on the users in real time and stealing sensitive information and credentials.
In comparison with other similar platforms Metasploit contains post
exploitation capabilities as well. This is a very important step when it
comes to sensitive data collection and deep infections.The framework has been used to launch dangerous persistent installations – viruses and malware that attach themselves deep in the computer settings and cannot be removed by using any manual methods. Only the use of a quality anti-spyware solution can remedy them.
2. Wireshark
Wireshark is probably one of the most widely used tool both by security and network administrators and computer criminals. It is a multi-platform network protocol analyzer that allows its users to capture data from a wide variety of network sources – Wi-fi networks, Bluetooth, wired connections and etc. It can be used to live record the data or analyze it offline for further inspection.
One of the reasons why Wireshark is so useful is that it supports practically all capture file formats used in the industry. The application is compatible with virtually all popular devices and operating systems. In addition it supports decryption of many protocols and all results can be exported to further formats for storage and analysis.
A Wireshark session is usually started in the following sequence:
- Start the application with the required privileges to load network traffic.
- Configure the interface options by specifying which interface is going to be used for the traffic capture and engage the process.
- Use the available plugins, filters and scripts to show the data stream.
- The extracted data can be exported to other standart formats for further analysis if that is required.
3. Nmap
Nmap (short for “Network Mapper”) is a versatile and powerful tool used for network discovery and security audit. Network administrators can use it to create a detailed report of all available devices on the connected networks, monitor uptime or discover online services.
The utility has many features including raw packets identification, service detection and one of the best operating system fingerprint detection databases. Nmap is capable of identifying both the version of the running systems, but also all server applications.
Using a single command the administrators can query a wide array of detailed network data on whole computer networks. The developers maintain binary packages for the most popular operating systems – Gnu/Linux, Microsoft Windows and Mac OS X.
Part of the security suite that is related to Nmap also includes the following applications:
- Zenmap – a powerful graphical user interface to Nmap.
- Ncat – a very powerful data transfer and debugging tool.
- Ndiff – results comparison tool.
- Nping – packet generation and response analyst tool.
Nmap is also famed for its scripting engine called NSE (Nmap Scripting Engine). It allows the users to write, share and execute scripts written in the Lua programming language. Using ready made commands the majority of routine network security tasks can be automated.
The extensive features available for Nmap allow its operators to evade firewalls and intrusion detection systems, as well as spoof devices and imitate application protocols. Depending on the individual cases the penetration testers can utilize different tactics in their hacking campaigns.
4. John the Ripper 
John
the Ripper is probably the most famous password cracker. The
applications is compatible with the most popular operating systems and
can be used to break all kinds of passwords. Hacking different types of
data is easily achieved using crackers like this one.
The primary
aim of the application is to detect and recover weak Unix passwords.
However due to the wide availability of features and the smart algorithm
integrated into the code, John the Ripper has become a standard tool
for breaking common ciphers.
John can be used by supplying the
program with a password file. Optional parameters include the cracking
mode and specific performance-related settings. Wordlist files can also
be fine tuned to mangle the words, eliminate duplicate candidate
passwords, assign certain length and etc. The following hash types are
supported out of the box:
Traditional
DES-based, SHA-crypt, SunMD5, NTML and Mac OS X salted SHA1-hashes,
“bigcrypt”, BSDI extended DES-based, FreeBSD MD5-based, OpenBSD
Blowfish-based, Kerberos/AFS, Windows LM and DES-based tripcodes.
Ready-made
editions can also be used to crack passwords used by database servers,
network authentication servers, IRC bots, services, remote desktop
protocols, PDF files, archives and other sensitive data and services.
The
password cracking engine can be used to perform intrusions in
situations where vulnerabilities cannot be detected. Using this approach
hackers can break into systems where an additional layer of
authentication or another security feature has not been implemented.
5. Kismet
This is a console-based wireless network detector with advanced features. It can be used to identify networks in range by using passive scanning as opposed to other approaches. This gives it the advantage of being able to detect hidden networks even if they are not in use and do not transmit the usual beacons.
Other features include the following:
- Automatic detection of network IP blocks by analyzing the sent TCP, UDP, ARP and DHCP packets.
- It can log the traffic in a Wireshark compatible format that can be analyzed by the application.
- If a GPS device is configured and connected to the device Kismet can automatically plot the detected networks and estimate the ranges on a map.
- Kismet can be expanded using plugins to enable additional commands.
- It operates using a client-server model which allows it to be executed under flexible conditions.
- Multiple capture source is supported.
Users of the utility can enable and use basic and advanced filtering to gain information on the target networks. The built-in engine the app can also be used to alert the operators about certain characteristics and any unusual probes, floods and other indications. Its ability to act as a potent intrusion detection system can be utilized to watch out for any unusual events. Together with the traffic data gathered and analyzed in Wireshark, the hacker operators can gain a detailed perspective of the Wi-Fi networks in range.
6. Nikto
Nikto is a powerful web server scanner that is able to perform extensive tests on target machines. The application is able to create a security audit on the intended targets by launching an array of assessment tests. It is designed to identify default and insecure installation, configuration parameters and running services on the target web servers. Penetration testers and computer criminals can use it to find potential vulnerabilities in the target systems.
Nikto can run on every platform that supports the Perl environment – from ordinary laptops and desktops to board computers and mobile devices. The engine supports proxies, SSL connections, host authentication methods, attack encoding and other features. Its interface is very easy to use it as it uses a logical and easy to use command-line syntax.
The utility can be used as a first point of analysis of certain web addresses as it is able to identify the running services using several different methods for better accuracy. If configured the web scanner is also able to map out the domains and utilize subdomain guessing to give further insight into the setup. To facilitate a complete security audit Nikto can log all results and output to the Metasploit framework. Nikto is one of the top choices when hacking target hosts.
7. The Aircrack Suite
Aircrack is a suite of tools for hacking wireless networks. It is comprised of several applications that are used in conjunction with each other.
They can be used both for manipulating data streams, crafting packets and analyzing the captured network traffic. In comparison with other tools on this list it requires more manual intervention and is designed for more technical users and system administrators. However it is a really powerful tools in the hands of the adept security engineer or criminal as the applications provide a nearly unlimited array of launching all sorts of attacks. The complete Aircrack suite includes the following tools:
- aircrack-ng – This is the main application that can crack WEP passwords using several different methods. The software allow for dictionary attacks and other methods when such actions are done against the more complex WPA2-PSK protected networks.
- airdecap-ng This program decrypts WEP/WPA encrypted files using a known key.
- airmon-ng – The execution of this app places the different card in monitor mode.
- aireplay-ng – This is a packet injector that can be used to craft malicious packets. Such software can be used to exploit discovered vulnerabilities.
- airodump-ng – A packet sniffer that is able to collect network traffic data and export it in either pcap or IVS standard files.
- airtun-ng – A virtual tunnel interface creator.
- packetforge-ng – A packet injector similar to aireplay-ng that crafts encrypted data instead of plaintext.
- ivstools – Utility used to merge and convert recoreded packet data.
- airbase-ng – This tool allows for the coordination of techniques to attack individual hosts.
- airdecloak-ng – Modifies PCAP captured data by removing recorded WEP cloaking.
- airolib-ng – This part of the Aircrack suite is used to store and manage the ESSID network names and passwords. It also generates Pairwise master keys.
- airserv-ng – Airserv allows the operators to access the configured wireless cards from other computers.
- easside-ng – Aircrack utility that allows for access point communication without a WEP security key.
- easside-ng – A helper application that communicates with easside-ng when run on a remote host.
- tkiptun-ng – WPA/TKIP encryption attack tool.
- wesside-ng – A hacking tool that automates WEP security key recovery.
8. THC-Hydra
THC-Hydra is an optimized network cracker. It supports many different services and thanks to its wide feature set and service compatibility THC-Hydra (or simply Hydra) it is one of the most widely used utilities when it comes to hacking network devices.
Hydra works with a wide range of protocols, services and applications protected by passwords. The latest version can act against the following targets:
Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP,
HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST,
HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-POST,
HTTPS-HEAD,
HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, RTSP, S7-300, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP, SOCKS5, SSH (v1 and v2), Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.
The most popular web protocols
(HTTP, POP3, IMAP and SMTP) are fully supported with several login
mechanisms used for authentication – plaintext credentials, MD5 digests,
hashes and etc. The application uses a simple graphical user interface
(GUI) that allows even inexperienced users to launch hacking attacks.HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, RTSP, S7-300, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP, SOCKS5, SSH (v1 and v2), Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.
The cracking attempts can be routed over several type of proxy server for privacy reasons. And when compared with other similar password crackers THC-Hydra shows that it has one of the most extensive feature lists and capabilities. It has grown into a preferred method of launching intrusion attempts as it supports services often used in corporate environments – Oracle databases, Active Directory protocols, email and web services, remote desktop sessions and more.
9. The Social-Engineer Toolkit
The Social-Engineer Toolkit is a popular open-source framework that is designed to launch exploits and social engineering attacks. The utility provides a very easy to use command-line interface and supports custom attack vectors. Like Metasploit it features a modular engine that allows programmers to create custom code that can be adapted to specific scenarios.
By default the malicious engine allows for the coordination of the following types of network attacks:
- Spear-Phishing Attacks – They constitute one of the most popular social engineering scams sent to potential victims. The targets receive messages that appear as being sent by legitimate institutions, usually by e-mail, social networks or instant messaging services. The most popular examples include posing as PayPal, Google or other famous and widely used Internet companies. The victims are redirected to sites that appear as login pages or service home pages where they are asked to enter their account credentials. Other case include adding malware as file attachments or hyperlinks.
- Website Attacks – The Social-Engineer Toolkit includes an engine capable of conducting potent attacks to attempt hacker intrusions into the targets. The framework allows its operators to launch multiple attacks at once to increase the success ratio.
- Infectious Media Generator – This function allows the criminals to create a malicious payload that can be used to infect victim systems.
- Mass Mailer Attack – The attack allows the hacker operators to setup and coordinate spam messages and other similar campaigns.
- Create a Payload and Listener – It uses the Metasploit farmework to generate a binary file that has to be installed on the victim machines. Once in place it is used to “listen” to the machines.
- Arduino-Based Attack Vector – These types of attacks can overtake Arduino-based devices and reprogram their code. They are usually used in many IoT (Internet of Things) products, as well as DIY hobby projects.
- SMS Spoofing Attack Vector – This option allows the criminal operators to spoof phone numbers and send SMS messages. Such attacks are useful in the process of running a social engineering campaign in combination with other attacks such as credentials harvesters. The Social-Engineer Toolkit can utilize ready-made templates and perform mass SMS message sending at once.
- Wireless Access Point Attack Vector – One of the most popular mechanisms of hacking devices is by spawning a malicious wireless access point and using the DNS spoofing attack to make the devices connect to the rogue network. When this is done another attack can be initiated to infect them. As soon as the connection is made all generated traffic can be spied upon by the hackers. Such attacks are very useful when conducting identity theft and other related crimes.
- QRCode Generator Attack Vector – Social-Engineer Toolkit includes an engine that is able to generate malicious QR codes. When they are scanned by the targets they are redirected to a crafted hacker-supplied address or an exploit is launched depending on the configuration.
- Powershell Attack Vectors – Automated shell scripts written in PowerShell can be executed on the infected computers when instructed via the menu options.
- Third Party Modules – The Social-Engineer Toolkit can be extended using additional scripts and plugins.
10. The Tor Project
The Tor network is probably the most famous international anonymous network that is used by computer users who want to protect their security and privacy. Tor routes the network traffic through a series of routers and nodes which makes it very hard to for Internet service providers, service owners and system administrators to locate the point of origin. It is primarily used to combat censorship however it has grown to be an essential part of every hacker toolkit.
The criminals route their activities and attacks through the network to hide their true origins and abuse the network’s capabilities frequently by operating hacker underground markets and chats on the hidden network. The majority of operations are actually planned on private forums and communities that are only accessible via the Tor browser. Wannabe criminals frequently “lurk” or browse the underground sites in search of tutorials and instructions for hacking computers and networks.
No comments:
Post a Comment