# Ethical Hacking mit Python und Kali Linux

Kali Linux ist DAS Hacker Linux mit allen nötigen Tools um einen vernünftigen Pentest zu machen. Know your Enemy

[Heise Security Tips](https://www.heise.de/select/ct-wissen/2021/11/softlinks/wn7d?wt_mc=pred.red.ct.sh_wissen112021.106.softlink.softlink)

## Nmap

nmap -O ip-adresse # gibt unter anderem das Betriebssystem wieder  
nmap -sV ip-adresse # gibt Versionen wieder

### Subdomains finden

Subfinder findet alles

docker pull projectdiscovery/subfinder  
docker run projectdiscovery/subfinder -d example.com

## Metasploit

## Burpsuite

## Netcat

## Social-Engineering Toolkit

[Link Simulating Basic Attack](https://www.youtube.com/watch?v=gKykLr59LW8)

## Nikto

Scanning von Websiten

## John the ripper

[Download](https://www.openwall.com/john/)

### Filtermasken erstellen

[Filtermasken](https://github.com/openwall/john/blob/bleeding-jumbo/doc/MASK)

Zun‰chst muss man aus einer Datei, die mit einem Passwort gesch¸tzt ist, den Hashwert herausbekommen. Das funktioniert mit

`zip2john verschluesselt.zip > hast.txt` f¸r ein Zip File

`pdf2john verschluesselt.pdf > hast.txt` sollte eigentlich das Passwort einer Zip-Datei herausfinden

Danach wird der Hashwert mit **John the Ripper** gekrackt:

`john hash.txt`

### pdf2john funktionert nicht

```
git clone "https://github.com/magnumripper/JohnTheRipper.git" && cd JohnTheRipper/src && ./configure && sudo make -s clean && sudo make -sj4

```

### John Maske

für nur buchstaben und Zahlen

`--mask=[A-Za-z0-9] --max-length=6`

### Cheatsheet

oder als PDF [jtr-cheat-sheet.pdf](https://books.hhml.selfhost.co/attachments/1)

### John Resources

<div class="page-content" id="bkmrk-john-jumbo-dev-relea"><div class="page-content"><div dir="auto">- [John jumbo dev release](https://github.com/openwall/john-packages/releases/tag/jumbo-dev)
- [John binaries](https://download.openwall.net/pub/projects/john/contrib/)
- [John docs](https://nrupentheking.blogspot.com/search/label/Password%20Cracker)
- [John docs](https://reusablesec.blogspot.com/)
- [Password Analysis and Cracking Kit](https://thesprawl.org/projects/pack/)
- [Mangling Rules Generation](http://www.openwall.com/presentations/Passwords12-Mangling-Rules-Generation/)

</div></div></div>### John Installation

[Genau Beschreibung der Installation](https://books.hhml.selfhost.co/books/linux/page/john-the-ripper-installieren "John the Ripper installieren")

<div class="page-content" id="bkmrk-"><div class="page-content"><div class="page-content"><div dir="auto"><div class="code-header" id="bkmrk--1"><div class="copy-code-container"><button aria-label="Copy code block to your clipboard" class="copy-code-button" data-code="git%20clone%20https://github.com/openwall/john%20-b%20bleeding-jumbo%20/data/tools/john%20;%20cd%20/data/tools/john/src/%20;%20./configure%20&&%20make%20-s%20clean%20&&%20make%20-sj4%20;%20cd%20~" type="button"></button>  
</div></div></div></div></div></div>```
git clone https://github.com/openwall/john -b bleeding-jumbo /data/tools/john ; cd /data/tools/john/src/ ; ./configure && make -s clean && make -sj4 ; cd ~

```

#### John Modes

<div class="page-content" id="bkmrk-wordlist-mode-%28dicti"><div class="page-content"><div dir="auto">- Wordlist mode (dictionary attack) - `john --wordlist=<wordlist> <hash>`
- Mangling rules mode - `john --wordlist=<wordlist> --rules:<rulename> <hash>`
- Incremental mode - `john --incremental <hash>`
- External mode - `john --external:<rulename> <hash>`
- Loopback mode (use .pot files) - `john --loopback <hash>`
- Mask mode - `john --mask=?1?1?1?1?1?1?1?1 -1=[A-Z] -min-len=8 <hash>`
- Markov mode - `calc_stat <wordlist> markovstats` `john -markov:200 -max-len:12 --mkv-stats=markovstats <hash>`
- Prince mode - `john --prince=<wordlist> <hash>`

</div></div></div>Refer the [link](https://4n3i5v74.github.io/posts/tryhackme-john-the-ripper/) for more examples.

#### CPU and GPU options

<div class="page-content" id="bkmrk-list-opencl-devices-"><div class="page-content"><div dir="auto">- List opencl devices - `john --list=opencl-devices`
- List formats supported by opencl - `john --list=formats --format=opencl`
- Use multiple CPU - `john hashes --wordlist:<wordlist> --rules:<rulename> --dev=2 --fork=4`
- Use multiple GPU - `john hashes --format:<openclformat> --wordlist:<wordlist> --rules:<rulename> --dev=0,1 --fork=2`

</div></div></div>#### Rules

<div class="page-content" id="bkmrk-single-wordlist-extr"><div class="page-content"><div dir="auto">- Single
- wordlist
- Extra
- Jumbo (Single, wordlist and Extra)
- KoreLogic
- All (Single, wordlist, Extra and KoreLogic)

</div></div></div>#### Incremental modes

<div class="page-content" id="bkmrk-lower-%2826-char%29-alph"><div class="page-content"><div dir="auto">- Lower (26 char)
- Alpha (52 char)
- Digits (10 char)
- Alnum (62 char)

</div></div></div>#### New rule

<div class="page-content" id="bkmrk--2"><div class="page-content"><div class="page-content"><div dir="auto"><div class="code-header" id="bkmrk--0"><div class="copy-code-container"><button aria-label="Copy code block to your clipboard" class="copy-code-button" data-code="[List.Rules:Tryout]%0Al%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20[convert%20to%20lowercase]%0Au%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20[convert%20to%20uppercase]%0Ac%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20[capitalize]%0Al%20r%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20[lowercase%20and%20reverse%20(palindrome)]%0Al%20Az%222015%22%20%20%20%20%20%20%20%20%20%20%20%20%20%20[lowercase%20and%20append%20%222015%22%20at%20end%20of%20word]%0Al%20A0%222015%22%20%20%20%20%20%20%20%20%20%20%20%20%20%20[lowercase%20and%20prepend%20%222015%22%20at%20end%20of%20word]%0Ad%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20[duplicate]%0AA0%22#%22Az%22#%22%20%20%20%20%20%20%20%20%20%20%20%20%20%20[append%20and%20prepend%20%22#%22]" type="button"></button>  
</div></div></div></div></div></div>```
[List.Rules:Tryout]
l                       [convert to lowercase]
u                       [convert to uppercase]
c                       [capitalize]
l r                     [lowercase and reverse (palindrome)]
l Az"2015"              [lowercase and append "2015" at end of word]
l A0"2015"              [lowercase and prepend "2015" at end of word]
d                       [duplicate]
A0"#"Az"#"              [append and prepend "#"]

```

<div class="page-content" id="bkmrk-display-password-can"><div class="page-content"><div dir="auto">- Display password candidates - `john --wordlist=<wordlist> --stdout --rules:Tryout`
- Generate password candidates - `john --wordlist=<wordlist> --stdout=8 --rules:Tryout`

</div></div></div>#### Other rules

<div class="page-content" id="bkmrk--3"><div class="page-content"><div class="page-content"><div dir="auto"><div class="code-header" id="bkmrk--4"><div class="copy-code-container"><button aria-label="Copy code block to your clipboard" class="copy-code-button" data-code="C%20%20%20%20%20[lowercase%20first%20char,%20uppercase%20rest]%0At%20%20%20%20%20[toggle%20case%20of%20all%20chars]%0ATN%20%20%20%20[toggle%20case%20of%20char%20in%20position%20N]%0Ar%20%20%20%20%20[reverse%20word%20-%20test123%20-%3E%20321tset]%0Ad%20%20%20%20%20[duplicate%20word%20-%20test123%20-%3E%20test123test123]%0Af%20%20%20%20%20[reflect%20word%20-%20test123%20-%3E%20test123321tset]%0A%7B%20%20%20%20%20[rotate%20word%20left%20-%20test123%20-%3E%20est123t]%0A%7D%20%20%20%20%20[rotate%20word%20right%20-%20test123%20-%3E%203test12]%0A$X%20%20%20%20[append%20word%20with%20X]%0A%5EX%20%20%20%20[prefix%20word%20with%20X]%0A[%20%20%20%20%20[remove%20first%20char]%0A]%20%20%20%20%20[remove%20last%20char]%0ADN%20%20%20%20[delete%20char%20in%20posision%20N]%0AxNM%20%20%20[extract%20from%20position%20N%20till%20M%20chars]%0AiNX%20%20%20[insert%20X%20in%20place%20of%20N%20and%20shift%20rest%20right]%0AoNX%20%20%20[overwrite%20N%20with%20X]%0AS%20%20%20%20%20[shift%20case%20-%20test123%20-%3E%20TEST!@#]%0AV%20%20%20%20%20[lowercase%20vowels,%20uppercase%20consonents%20-%20test123%20-%3E%20TeST123]%0AR%20%20%20%20%20[shift%20each%20char%20right,%20using%20keyboard%20key%20-%20test123%20-%3E%20yrdy234]%0AL%20%20%20%20%20[shift%20each%20char%20left,%20using%20keyboard%20key%20-%20test123%20-%3E%20rwar012]%0A%3CN%20%20%20%20[reject%20words%20unless%20less%20than%20length%20N]%0A%3EN%20%20%20%20[reject%20words%20unless%20greater%20than%20length%20N]%0AN%20%20%20%20%20[truncate%20to%20length%20N]" type="button"></button>  
</div></div></div></div></div></div>```
C     [lowercase first char, uppercase rest]
t     [toggle case of all chars]
TN    [toggle case of char in position N]
r     [reverse word - test123 -> 321tset]
d     [duplicate word - test123 -> test123test123]
f     [reflect word - test123 -> test123321tset]
{     [rotate word left - test123 -> est123t]
}     [rotate word right - test123 -> 3test12]
$X    [append word with X]
^X    [prefix word with X]
[     [remove first char]
]     [remove last char]
DN    [delete char in posision N]
xNM   [extract from position N till M chars]
iNX   [insert X in place of N and shift rest right]
oNX   [overwrite N with X]
S     [shift case - test123 -> TEST!@#]
V     [lowercase vowels, uppercase consonents - test123 -> TeST123]
R     [shift each char right, using keyboard key - test123 -> yrdy234]
L     [shift each char left, using keyboard key - test123 -> rwar012]
<N    [reject words unless less than length N]
>N    [reject words unless greater than length N]
N     [truncate to length N]

```

#### New charset

<div class="page-content" id="bkmrk--5"><div class="page-content"><div class="page-content"><div dir="auto"><div class="code-header" id="bkmrk--6"><div class="copy-code-container"><button aria-label="Copy code block to your clipboard" class="copy-code-button" data-code="john%20--make-charset=set.char" type="button"></button>  
</div></div></div></div></div></div>```
john --make-charset=set.char

```

Create `john.conf` with character set config.

<div class="page-content" id="bkmrk--7"><div class="page-content"><div class="page-content"><div dir="auto"><div class="code-header" id="bkmrk--8"><div class="copy-code-container"><button aria-label="Copy code block to your clipboard" class="copy-code-button" data-code="#%20Incremental%20modes%0A[Incremental:charset]%0AFile%20=%20$JOHN/set.char%0AMinLen%20=%200%0AMaxLen%20=%2030%0ACharCount%20=%2080" type="button"></button>  
</div></div></div></div></div></div>```
# Incremental modes
[Incremental:charset]
File = $JOHN/set.char
MinLen = 0
MaxLen = 30
CharCount = 80

```

<div class="page-content" id="bkmrk--9"><div class="page-content"><div class="page-content"><div dir="auto"><div class="code-header" id="bkmrk--10"><div class="copy-code-container"><button aria-label="Copy code block to your clipboard" class="copy-code-button" data-code="john%20--incremental=charset%20%3Chash%3E" type="button"></button>  
</div></div></div></div></div></div>```
john --incremental=charset <hash>

```

#### Wordlists

<div class="page-content" id="bkmrk-sort-wordlist--%C2%A0tr-a"><div class="page-content"><div dir="auto">- Sort wordlist - `tr A-Z a-z < <wordlist> | sort -u > <new-wordlist>`
- Generate wordlist using POT - `cut -d: -f2 john.pot | sort -u > pot.dict`
- Generate candidate pwd for slow hash - `john --wordlist=<wordlist> --stdout --rules:Jumbo | unique -mem=25 <unique-wordlist>`

</div></div></div>#### External mode

<div class="page-content" id="bkmrk-create-complex-passw"><div class="page-content"><div dir="auto">- Create complex password list - [link](http://www.lanmaster53.com/2011/02/creating-complex-password-lists-with-john-the-ripper/)
- Generate wordlist according to complexity filter - `./john --wordlist=<wordlist> --stdout --external:<filter> > <filtered-wordlist>`
- Use adjacent keys on `keyboard` - `john --external:Keyboard <hash>`

</div></div></div>#### Misc Options

<div class="page-content" id="bkmrk-hidden-options--%C2%A0joh"><div class="page-content"><div dir="auto">- Hidden options - `john --list=hidden-options`
- Display guesses - `john --incremental:Alpha -stdout -session=s1`
- Generate guesses with external programs - `crunch 1 6 abcdefg | ./john hashes -stdin -session=s1`
- Save session - `john hashes -session=name`
- Restore session - `john --restore:name`
- Show cracked passwords - `john hashes --pot=<pot> --show`

</div></div></div>#### Dictionaries

<div class="page-content" id="bkmrk-generate-wordlist-fr"><div class="page-content"><div dir="auto">- Generate wordlist from wikipedia - `wget https://raw.githubusercontent.com/zombiesam/wikigen/master/wwg.py ; python wwg.py -u http://pt.wikipedia.org/wiki/Fernando_Pessoa -t 5 -o fernandopessoa -m3`
- Aspell dictionary - `apt-get install aspell-es` `aspell dump dicts` `aspell -d es dump master | aspell -l es expand | awk 1 RS=" |\n" > aspell.dic`

</div></div></div><div class="page-content" id="bkmrk-version-%233-erstellt%3A"><div dir="auto">  
</div>---

<div class="text-muted text-small"><div class="entity-meta"><svg class="svg-icon" data-icon="history" role="presentation" viewbox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> </svg>Version #3   
<svg class="svg-icon" data-icon="star" role="presentation" viewbox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> </svg>Erstellt: 19 October 2022 10:52:19 von Herr_admin   
<svg class="svg-icon" data-icon="edit" role="presentation" viewbox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"> </svg>Zuletzt aktualisiert: 19 October 2022 11:18:20 von hermann</div></div></div>