MartianHacks.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "name": "MartianHacks.ipynb",
      "version": "0.3.2",
      "provenance": [],
      "collapsed_sections": [],
      "toc_visible": true
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    },
    "accelerator": "GPU"
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "_byKvfytOiOl",
        "colab_type": "text"
      },
      "source": [
        "# Variables"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "3iFLEsE2OIni",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "HOST = '127.0.0.1'        #    <== CHANGE THIS\n",
        "\n",
        "# the host must be reachable from google VM\n",
        "\n",
        "\n",
        "######################################################################################################\n",
        "\n",
        "NMAP_DIR = '/content/NMAP'\n",
        "DIRB_DIR = '/content/DIRB'\n",
        "NIKTO_DIR = '/content/NIKTO'\n",
        "WORDLISTS_DIR = '/content/WORDLISTS'\n",
        "\n",
        "HTTP_WORDLIST = WORDLISTS_DIR + '/' + 'custom_url_wordlist.txt'\n",
        "HTTP_EXTENSIONS_FILE = WORDLISTS_DIR + '/' + 'custom_extensions_common.txt'\n"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "VprBgftyOoVY",
        "colab_type": "text"
      },
      "source": [
        "# Folder hierarchy "
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "eIGbg39rOn3o",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "%cd /content/\n",
        "!mkdir {NMAP_DIR}\n",
        "!mkdir {DIRB_DIR}\n",
        "!mkdir {NIKTO_DIR}\n",
        "!mkdir {WORDLISTS_DIR}"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "qJ8UCwrXOk-f",
        "colab_type": "text"
      },
      "source": [
        "# Setup"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "geNNgSl3KfKD",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "# nmap\n",
        "!apt-get install nmap\n",
        "\n",
        "# searchsploit\n",
        "!git clone https://github.com/offensive-security/exploitdb.git /opt/exploitdb\n",
        "!ln -sf /opt/exploitdb/searchsploit /usr/local/bin/searchsploit\n",
        "\n",
        "# dirb\n",
        "!apt-get install dirb\n",
        "\n",
        "# nikto\n",
        "!apt-get install nikto\n",
        "\n",
        "# xmllint for searchsploit (and not only)\n",
        "!apt-get install libxml2-utils\n",
        "\n",
        "# wordlists\n",
        "!curl -o \"$HTTP_WORDLIST\" https://raw.githubusercontent.com/Leviathan36/kaboom/master/kaboom/custom_url_wordlist.txt\n",
        "!curl -o \"$HTTP_EXTENSIONS_FILE\" https://raw.githubusercontent.com/Leviathan36/kaboom/master/kaboom/custom_extensions_common.txt\n"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "RdTt4lsXWf95",
        "colab_type": "text"
      },
      "source": [
        "# Functions"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "Na3yEfAidljb",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "# This function print the number of port for the open services\n",
        "\n",
        "import lxml.etree as xml\n",
        "\n",
        "def service_ports (name, prot='TCP', state='open', ssl_on=False):\n",
        "  root = xml.parse(\"/content/NMAP/syn_scan.xml\")\n",
        "  \n",
        "  if prot == 'UDP':\n",
        "    state = 'open|filtered'\n",
        "   \n",
        "  if ssl_on == False:\n",
        "    path = \".//port[state[@state=\" + \"'\" + state + \"'\" + \"] and service[@name=\" + \"'\" + name + \"'\" + \"]]\"\n",
        "  elif ssl_on == True:\n",
        "    path = \".//port[state[@state=\" + \"'\" + state + \"'\" + \"] and service[@name=\" + \"'\" + name + \"'\" + \" and @tunnel='ssl']]\"\n",
        "  else:\n",
        "    raise TypeError('Invalid type for SSL parameter')\n",
        "    \n",
        "  ports = []\n",
        "  for i in root.xpath(path):\n",
        "    ports.append(i.attrib['portid'])\n",
        "  \n",
        "  return ports"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "dZ6KgBp7PeRK",
        "colab_type": "text"
      },
      "source": [
        "# Info Gathering"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "hR549xAfPhz-",
        "colab_type": "text"
      },
      "source": [
        "## Port scan"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "ADxLjiOOPlKm",
        "colab_type": "text"
      },
      "source": [
        "### TCP-syn scan"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "h0I6nfH_Nel9",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!nmap -vvv -oA \"{NMAP_DIR}/syn_scan\" -PE -PS80,443,22,25,110,445 -PU -PP -PA80,443,22,25,110,445 -sS -p- -sV --allports -O --fuzzy --script \"(default or auth or vuln or exploit) and not http-enum\" {HOST}"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "ODoMMYikPnuK",
        "colab_type": "text"
      },
      "source": [
        "### UDP scan"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "gCIht93jPkap",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!nmap -vvv -oA \"{NMAP_DIR}/udp_scan\" -PE -PS80,443,22,25,110,445 -PU -PP -PA80,443,22,25,110,445 -sU --top-ports 200 -sV --allports {HOST}"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "VeZyAg7LUcwr",
        "colab_type": "text"
      },
      "source": [
        "# Web assessment"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "_ppQxIeIuszY",
        "colab_type": "text"
      },
      "source": [
        "## HTTP"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "MLll8vfSUien",
        "colab_type": "text"
      },
      "source": [
        "### Dirb"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab_type": "code",
        "id": "_IpFXPj7tVwb",
        "colab": {}
      },
      "source": [
        "for PORT in service_ports('http'):\n",
        "  !dirb \"http://{HOST}:{PORT}/\" {HTTP_WORDLIST} -r -l -o \"{DIRB_DIR}/dirb_{PORT}.txt\" -x {HTTP_EXTENSIONS_FILE} -z 200"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "NOg8Z73RUk6R",
        "colab_type": "text"
      },
      "source": [
        "### Nikto"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "8F-HGiJrUm8t",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "for PORT in service_ports('http'):\n",
        "  !nikto -Display PV -nolookup -ask no -Format htm -host \"{HOST}:{PORT}\" -output \"{NIKTO_DIR}/nikto_{PORT}.html\" -Plugins \"ms10_070;report_html;embedded;cookies;put_del_test;outdated;drupal(0:0);clientaccesspolicy;msgs;httpoptions;negotiate;parked;favicon;apache_expect_xss;headers\" -Tuning 4890bcde"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "2IYDARpjuxhS",
        "colab_type": "text"
      },
      "source": [
        "## HTTPS"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "WCibyBr3eI6F",
        "colab_type": "text"
      },
      "source": [
        "#### Pure HTTPS"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "VaG4G_8cuzSy",
        "colab_type": "text"
      },
      "source": [
        "### Dirb"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "wwr-NwXDu2c5",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "for PORT in service_ports('https'):\n",
        "  !dirb \"https://{HOST}:{PORT}/\" {HTTP_WORDLIST} -r -l -o \"{DIRB_DIR}/dirb_https_{PORT}.txt\" -x {HTTP_EXTENSIONS_FILE} -z 200"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "UBHi1yJ6u06B",
        "colab_type": "text"
      },
      "source": [
        "### Nikto"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "NcTQvcvJvShD",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "for PORT in service_ports('https'):\n",
        "  !nikto -ssl -port {PORT} -Display PV -nolookup -ask no -Format htm -host {HOST} -output \"{NIKTO_DIR}/nikto_https_{PORT}.html\" -Plugins \"ms10_070;report_html;embedded;cookies;put_del_test;outdated;drupal(0:0);clientaccesspolicy;msgs;httpoptions;negotiate;parked;favicon;apache_expect_xss;ssl;headers\" -Tuning 4890bcde"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "94vrwQq3vpOr",
        "colab_type": "text"
      },
      "source": [
        "#### SSL/HTTP"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "YdhIl2YlwOqQ",
        "colab_type": "text"
      },
      "source": [
        "### Dirb"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab_type": "code",
        "id": "iaaB9zYtwBzV",
        "colab": {}
      },
      "source": [
        "for PORT in service_ports('http', ssl_on=True):\n",
        "  !dirb \"https://{HOST}:{PORT}/\" {HTTP_WORDLIST} -r -l -o \"{DIRB_DIR}/dirb_https_{PORT}.txt\" -x {HTTP_EXTENSIONS_FILE} -z 200"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "FDcnqYJOwQIY",
        "colab_type": "text"
      },
      "source": [
        "### Nikto"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab_type": "code",
        "id": "MVjH-uIEwH2B",
        "colab": {}
      },
      "source": [
        "for PORT in service_ports('http', ssl_on=True):\n",
        "  !nikto -ssl -port {PORT} -Display PV -nolookup -ask no -Format htm -host {HOST} -output \"{NIKTO_DIR}/nikto_https_{PORT}.html\" -Plugins \"ms10_070;report_html;embedded;cookies;put_del_test;outdated;drupal(0:0);clientaccesspolicy;msgs;httpoptions;negotiate;parked;favicon;apache_expect_xss;ssl;headers\" -Tuning 4890bcde"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "4-JZzcl2SyMA",
        "colab_type": "text"
      },
      "source": [
        "# Vulnerability search"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "XvL61wUwS4XC",
        "colab_type": "text"
      },
      "source": [
        "## Exploit-DB -- Searchsploit"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "lhQSbe8vV-Dp",
        "colab_type": "text"
      },
      "source": [
        "### TCP services"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "N6f0sIzjS9as",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!searchsploit --www --nmap \"{NMAP_DIR}/syn_scan.xml\""
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "IPBfHsjqWGzH",
        "colab_type": "text"
      },
      "source": [
        "### UDP services"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "Wjqn9XspTSPB",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!searchsploit --www --nmap \"{NMAP_DIR}/udp_scan.xml\""
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "cYDoaxUZWIGi",
        "colab_type": "text"
      },
      "source": [
        "## Nmap result browsing"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "colab_type": "text",
        "id": "4aDzg8H5xM4l"
      },
      "source": [
        "### TCP services"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "dyyAYnq7xQmZ",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!xmllint --xpath \"//table[elem[text()='VULNERABLE' and @key='state']]/@key\" \"{NMAP_DIR}/syn_scan.xml\" 2> /dev/null | tr \" \" \"\\n\" | cut -f2 -s -d'\"' | awk -F \"CVE-\" '{printf \"search cve:\" ; print $2}'"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "colab_type": "text",
        "id": "O0ZtM4JxxKW7"
      },
      "source": [
        "### UDP services"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "EUa_r5BfxUi_",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!xmllint --xpath \"//table[elem[text()='VULNERABLE' and @key='state']]/@key\" \"{NMAP_DIR}/udp_scan.xml\" 2> /dev/null | tr \" \" \"\\n\" | cut -f2 -s -d'\"' | awk -F \"CVE-\" '{printf \"search cve:\" ; print $2}'"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "hkrEjH6_YemK",
        "colab_type": "text"
      },
      "source": [
        "# Offline password cracking"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "TTqMfk5tq2Ji",
        "colab_type": "text"
      },
      "source": [
        "## Variables"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "ZC82ypAhq5xW",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "WORDLISTS_DIR = '/content/WORDLISTS'\n",
        "HASHES_DIR = '/content/HASHES'\n",
        "\n",
        "HASH_FILE = HASHES_DIR + 'hash_file.txt'    # THE FILE TO DECRYPT            #    <== CHANGE THIS\n",
        "HASHCAT_WORDLIST = WORDLISTS_DIR + '/fasttrack.txt'    # THE WORDLIST TO USE #    <== CHANGE THIS"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "rCJ7SCD5q33i",
        "colab_type": "text"
      },
      "source": [
        "## Setup"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "ylDgjKyO0YgA",
        "colab_type": "text"
      },
      "source": [
        "### Folder hierarchy"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "rRe7re5crRpN",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "# create WORDLISTS directory if it does not already exist\n",
        "\n",
        "%cd '/content/'\n",
        "!mkdir -p {WORDLISTS_DIR}\n",
        "!mkdir {HASHES_DIR}"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "5nd4urtx0c77",
        "colab_type": "text"
      },
      "source": [
        "### Install Hashcat"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "tqiuEwGc0fLv",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!apt-get install hashcat"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "z2OMzcnjf5z-",
        "colab_type": "text"
      },
      "source": [
        "### Downloading wordlists"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "Ewktx4w-f4yH",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "# fasttrack\n",
        "!curl -o \"{WORDLISTS_DIR}/fasttrack.txt\" https://raw.githubusercontent.com/Leviathan36/kaboom/master/kaboom/fasttrack.txt"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "code",
      "metadata": {
        "colab_type": "code",
        "id": "gg-uvAjXtKV-",
        "colab": {}
      },
      "source": [
        "# rockyou\n",
        "!curl -o \"{WORDLISTS_DIR}/rockyou.txt.tar.gz\" https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Leaked-Databases/rockyou.txt.tar.gz\n",
        "!tar -xvzf \"{WORDLISTS_DIR}/rockyou.txt.tar.gz\" -C {WORDLISTS_DIR}"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "_0xnWweFh4ca",
        "colab_type": "text"
      },
      "source": [
        "## Password Attacks"
      ]
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "1Y6frO4xB2CC",
        "colab_type": "text"
      },
      "source": [
        "### sha512crypt (6), SHA512 (Unix)"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "2m86ClDPfB_B",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!hashcat -m1800 -a0  {HASH_FILE} {HASHCAT_WORDLIST}"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "LmW3VldmDKPA",
        "colab_type": "text"
      },
      "source": [
        "### NTLM"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "zG5lWdb0DMXM",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!hashcat -m1000 -a0  {HASH_FILE} {HASHCAT_WORDLIST}"
      ],
      "execution_count": 0,
      "outputs": []
    },
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "x-OOJ7mvfCqr",
        "colab_type": "text"
      },
      "source": [
        "### MySQL4.1/MySQL5"
      ]
    },
    {
      "cell_type": "code",
      "metadata": {
        "id": "owzHxbIRCG2m",
        "colab_type": "code",
        "colab": {}
      },
      "source": [
        "!hashcat -m300 -a0  {HASH_FILE} {HASHCAT_WORDLIST}"
      ],
      "execution_count": 0,
      "outputs": []
    }
  ]
}