• Responder

    respon­der: Lis­ten with respon­der on a net­work and wait for AD sys­tems to ask for a DC. This can reveal a NTLM hash. (Source) Start respon­der on the own system: sudo responder -I tun0 --wpad Con­nect from the tar­get sys­tem to this sys­tem via smb. In the Win­dows explor­er, or in the com­mand line via dir…

  • Wireshark

    See a pack­et in its context Kontextmenü, Follow auswählen Show only ICMP pack­ets from a host tcpdump host 10.11.1.128 and icmp -i tun0 Show oth­er sys­tems com­mu­ni­cat­ing out­side the own address ip.addr == 10.11.1.0/24 && !(ip.addr == 192.168.119.0/24) && ! dns && !browser && !ssdp && !nbns && !llmnr Record audio Wire­shark can trans­form cap­tured audio…

  • IPv6 enumeration

    Linux Detect IPv6 hosts There is no arp table like in Ethernet/IPv4. But we can sim­u­late is as fol­lows to list all neight­bours / direct­ly reach­able hosts: ping6 -c 5 ff02::1%eth0 >/dev/null ip -6 neigh Bonus: ip neigh shows the IPv4 address res­o­lu­tion table like the arp com­mand does. Detect IPv6 addresses for known IPv4 addresses Sce­nario:…

  • See also the Wire­shark post PSnuffle Metas­ploit mod­ule; analyse the live traf­fic for cre­den­tials of var­i­ous protocols. msf > use auxiliary/sniffer/psnuffle PCredz PCredz uses a PCAP file and extracts hash­es and oth­er credentials. pcredz -f dump.pcap Zeek GitHub — zeek/zeek: Zeek is a pow­er­ful net­work analy­sis frame­work that is much dif­fer­ent from the typ­i­cal IDS you…

  • Ettercap

    Sniff­ing and live con­tent fil­ter­ing. Oper­a­tion modes: Uni­fied:  sniffs all pack­ets from one inter­face. Pack­ets for an attack host are end­ing here, but are direct­ly for­ward­ed after receiving Brid­get: For­wards traf­fic from one inter­face to anoth­er. Absolute­ly secret because there is real­ly no one “between the cable” Usage ettercap OPTIONS TARGET1 TARGET2 Tar­gets are defined as MAC/IPv4s/IPv6s/PORT…