Cross-platform hacking All programs we wrote are pure python programs They do not rely on OS-specific resources. Result: They work on any OS with a python interpreter. If packaged, they will work on any OS if even if python is NOT installed.…

BACKDOORS Sockets Problem: TCP is stream-based. Difficult to identify the end of message/batch. Solution: Make sure the message is well defined. Implement a protocol that sends and receives methods conform to. Send the size of the message as a header…

REVERSE_BACKDOOR Access file system. Execute system commands. Download files. Upload files. Persistence. BACKDOORS An interactive program gives access to a system its executed on. Command execution. Access file system. Upload/download files. Run keyl…

Handling Errors: If the client or server crashes, the connection will be lost. Backdoor crashes if: An incorrect command is sent. The correct command is miss-used. Listener: #!/usr/bin/env python import socket import json import base64 class Listener…

File Upload: A file is a series of characters. Uploading a file is the opposite of downloading a file. Therefore to transfer a file we need to: 1. Read the file as a sequence of characters. 2. Send this sequence of characters. 3. Create a new empty f…

File Download: A file is a series of characters. Therefore to transfer a file we need to: 1. Read the file as a sequence of characters. 2. Send this sequence of characters. 3. Create a new empty file at the destination. 4. Store the transferred seque…

REVERSE_BACKDOOR - cd command Access file system: cd command changes current working directory. It has 2 behaviours: cd -> shows current working directory. cd directoryname -> changes current working directory to directoryname Client side - Backdoor…

Refactoring - Creating a Listener Class #!/usr/bin/env python import socket class Listener: def __init__(self, ip, port): listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM) listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) list…

Typical Network ARP Spoofing Why ARP Spoofing is possible: 1. Clients accept responses even if they did not send a request. 2. Clients trust response without any form of verification. 1. Run the following command on the victim - Windows 10 Machine. a…

DICTIONARIES Similar to lists but use key instead of an index. LISTS List of values/elements, all can be stored in one variable. Improving the Program Using a List of Dictionaries: #!/usr/bin/env python import scapy.all as scapy def scan(ip): arp_req…

NETWORK_SCANNER Discover all devices on the network. Display their IP address. Display their MAC address. Write the Python code using the scapy.all module. Refer to: https://scapy.readthedocs.io/en/latest/installation.html #!/usr/bin/env python impor…

SIMPLE ALGORITHM Goal  -> Check if MAC address was changed. Steps: 1. Execute and read ifconfig. 2. Read the mac address from the output. 3. Check if MAC in ifconfig is what the user requested. 4. Print appropriate message. To find the MAC address, w…

FUNCTIONS Set of instructions to carry out a task. Can take input, and return a result. Make the code clearer, reusable, and more abstract. input() function prompts the user to enter the value. Rewrite the Python script using the function style. #!/u…

MAC ADDRESS Media Access Control Permanent Physical Unique Assigned by manufacturer WHY CHANGE THE MAC ADDRESS 1.Increase anonymity 2.Impersonate other devices 3.Bypass filters Change the MAC Address manually. ifconfig ifconfig eth0 down ifconfig eth…

The Lab and Needed Software Attacker Machine - Kali Linux https://www.kali.org/ 1. Install the software terminator, which is very useful for multi-tasks: apt-get install terminator 2. Download, extract and copy the Python IDE - PyCharm to the folder…

What is Hacking? Gaining unauthorized access. Hackers? 1.Black-hat Hackers 2.White-hat Hackers 3.Grey-hat Hackers WHAT IS A PROGRAM? A set of instructions to do a certain task or solve a problem.…

Automatically Discovering Vulnerabilities Using the Vulnerability Scanner 1. Modify the run_scanner method in the scanner class. #!/usr/bin/env python import requests import re from bs4 import BeautifulSoup from urllib.parse import urljoin class Scan…

Implementing Code To Discover XSS in Parameters 1. Watch the URL of the XSS reflected page carefully. 2. Add the  test_xss_in_link method in the Scanner class. #!/usr/bin/env python import requests import re from bs4 import BeautifulSoup from urllib.…

VULNERABILITY_SCANNER How to discover a vulnerability in a web application? 1. Go into every possible page. 2. Look for ways to send data to the web application(URL + Forms). 3. Send payloads to discover vulnerabilities. 4. Analyze the response to ch…

HTTPS: Problem: Data in HTTP is sent as plain text. A MITM can read and edit requests and responses. -> not secure Solution: Use HTTPS. HTTPS is an adaptation of HTTP. Encrypt HTTP using TLS(Transport Layer Security) or SSL(Secure Sockets Layer). ARP…

Browser Exploitation Framework. Allows us to launch a number of attacks on a hooked target. Targets are hooked once they load Javascript code. Hook code can be placed in an HTML page and share it with a target. Or host page online and send URL to tar…

Recalculating Content-Length: #!/usr/bin/env python import re from netfilterqueue import NetfilterQueue from scapy.layers.inet import TCP, IP from scapy.packet import Raw def set_load(packet, load): packet[Raw].load = load del packet[IP].len del pack…

MODIFYING DATA IN HTTP LAYER Edit requests/responses. Replace download requests. Inject code(html/Javascript) Analyzing HTTP Responses #!/usr/bin/env python from netfilterqueue import NetfilterQueue from scapy.layers.inet import IP, TCP from scapy.pa…

MODIFYING DATA IN HTTP LAYER Edit requests/responses. Replace download requests. Inject code(html/Javascript) Modifying HTTP Requests on the Fly: #!/usr/bin/env python from netfilterqueue import NetfilterQueue from scapy.layers.inet import IP, TCP fr…

What is DNS Spoofing Sniff the DNSRR packet and show on the terminal. #!/usr/bin/env python from netfilterqueue import NetfilterQueue from scapy.layers.dns import DNSRR,IP def process_packet(packet): scapy_packet = IP(packet.get_payload()) if scapy_p…

INTERCEPTING & MODIFYING PACKETS Scapy can be used to: Create packets. Analyze packets. Send/receive packets. But it can't be used to intercept packets/flows. CLASSIC MITM SCENARIO  MITM - SNIFFING DATA  MITM - MODIFYING DATA 1. Execute the command -…

 Capturing passwords from any computer connected to the same network.  ARP_SPOOF + PACKET_SNIFFER Target a computer on the same network. arp_spoof to redirect the flow of packets(become MITM) Packet_sniffer to see URLs, usernames, and passwords sent…

PACKET_SNIFFER Capture data flowing through an interface. Filter this data. Display Interesting information such as: Login info(username&password). Visited websites. Images. ...etc PACKET_SNIFFER CAPTURE & FILTER DATA scapy has a sniffer function.…

WHAT IS A WEBSITE Computer with OS and some servers. Apache, MySQL ...etc. Cotains web application. PHP, Python ...etc. Web application is executed here and not on the client's machine. How to hack a website? An application installed on a computer. -…

Converting Python Programs to Linux Executables Note: You can not execute the program on Linux by double click. Install the PyInstaller. pip3 install PyInstaller Covert the Python Program to Linux executable. pyinstaller --onefile --noconsole reverse…