{"id":31811,"date":"2019-10-31T21:43:17","date_gmt":"2019-10-31T18:43:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/network-tools-ili-s-chego-nachat-pentesteru\/"},"modified":"2019-10-31T21:43:17","modified_gmt":"2019-10-31T18:43:17","slug":"network-tools-ili-s-chego-nachat-pentesteru","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/network-tools-ili-s-chego-nachat-pentesteru","title":{"rendered":"Network tools, or where to start for a pentester?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A Beginner's Penetration Testing Toolkit: Introducing a brief overview of essential tools that will be useful for penetration testing of internal networks. These tools are already widely used by a broad range of professionals, making it beneficial for everyone to know their capabilities and master them. <\/p>\n<p><img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/a6846992cd5eb7769c87bbfb5aaaabbc.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Contents:<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"#Nmap\">Nmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Zmap\">Zmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Masscan\">Masscan<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Nessus\">Nessus<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Net-Creds\">Net-Creds<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#network-miner\">network-miner<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#mitm6\">mitm6<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Responder\">Responder<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Evil_Foca\">Evil_Foca<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Bettercap\">Bettercap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#gateway_finder\">gateway_finder<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#mitmproxy\">mitmproxy<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#SIET\">SIET<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#yersinia\">yersinia<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#proxychains\">proxychains<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Nmap\"><\/a><\/noindex>Nmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/nmap.org\/\">Nmap<\/a><\/noindex> \u2013 an open-source utility for network scanning, it is one of the most popular tools among security professionals and system administrators. Primarily used for port scanning, it also has a vast array of useful features that essentially make Nmap <b>a super tool<\/b> for network exploration.<\/p>\n<p>In addition to checking open\/closed ports, Nmap can identify the service listening on an open port and its version, and can sometimes help to determine the OS. Nmap supports scripting for scanning (NSE \u2014 Nmap Scripting Engine). Using scripts, it is possible to check for vulnerabilities for various services (if, of course, there is a script for them, or one can always write their own) or brute-force passwords for different services. <\/p>\n<p>Thus, Nmap allows creating a detailed map of the network, gathering maximum information about running services on hosts in the network, and preemptively checking for some vulnerabilities. Nmap also has flexible scanning settings, enabling adjustment of the scanning speed, number of threads, number of groups for scanning, etc.<br \/>\nConvenient for scanning small networks and indispensable for targeted scanning of individual hosts.<\/p>\n<h4>Pros:<\/h4>\n<ul>\n<li>Works quickly with a small range of hosts;<\/li>\n<li>Flexibility of settings \u2014 options can be combined in a way to obtain the most informative data in a reasonable time; <\/li>\n<li>Parallel scanning \u2014 the list of target hosts is divided into groups, and then each group is scanned sequentially, using parallel scanning within the group. This grouping is also a minor drawback (see below);<\/li>\n<li>Predefined script sets for different tasks \u2014 you can save time on selecting specific scripts by specifying groups of scripts;<\/li>\n<li>Output formats \u2014 5 different formats, including XML, which can be imported into other tools;<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>Host group scanning \u2014 information about any host is unavailable until the scanning of the entire group is completed. This can be resolved by setting maximum group size and maximum timeout options for how long to wait for a response to a request before ceasing attempts or making another;<\/li>\n<li>When scanning, Nmap sends SYN packets to the target port and waits for any response packet or a timeout in cases where there is no response. This negatively impacts the performance of the scanner as a whole, compared to asynchronous scanners (such as zmap or masscan);<\/li>\n<li>When scanning large networks using flags for faster scanning (--min-rate, --min-parallelism), false-negative results may occur, potentially missing open ports on the host. These options should also be used with caution, as a high packet rate may lead to unintended DoS. <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/189c9a5145449871571ad11d8b0be9c2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Zmap\"><\/a><\/noindex>Zmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/zmap\/zmap\">Zmap<\/a><\/noindex> (not to be confused with ZenMap) \u2014 is also an open-source scanner, created as a faster alternative to Nmap.<\/p>\n<p>Unlike nmap \u2014 Zmap does not wait for a response when sending SYN packets and continues scanning while concurrently awaiting responses from all hosts, thus effectively not maintaining connection state. When a response to the SYN packet arrives, Zmap understands which port and on which host was opened based on the content of the packet. Moreover, Zmap sends only one SYN packet to the scanned port. There is also the possibility of using PF_RING for fast scanning of large networks if you happen to have a 10-gigabit interface and a compatible network card on hand.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Scanning speed;<\/li>\n<li>Zmap generates Ethernet frames bypassing the system's TCP\/IP stack;<\/li>\n<li>Possibility of using PF_RING;<\/li>\n<li>ZMap randomizes targets for even load distribution on the scanned side;<\/li>\n<li>Ability to integrate with ZGrab (a tool for gathering information about services at the application level L7).<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>Can cause denial of service of network equipment, for example, incapacitating intermediate routers, despite the distributed load, since all packets will pass through one router.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/474b04785f27540510421d4fb715d4b4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Masscan\"><\/a><\/noindex>Masscan<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/robertdavidgraham\/masscan\">Masscan<\/a><\/noindex> Surprisingly, it is also an open-source scanner created with one purpose: to scan the Internet even faster (in less than 6 minutes at a speed of ~10 million packets\/s). Essentially, it works almost the same as Zmap, only even faster.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>The syntax is similar to Nmap, and the program supports some options compatible with Nmap.<\/li>\n<li>Speed is one of the fastest asynchronous scanners.<\/li>\n<li>Flexible scanning mechanism \u2014 resuming interrupted scans, distributing load across multiple devices (like in Zmap).<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>As with Zmap, the load on the network itself is extremely high, which can lead to DoS.<\/li>\n<li>By default, it cannot scan at the application level L7.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/cc919cc2dfd848594f4d8d6a35f9c1cf.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Nessus\"><\/a><\/noindex>Nessus<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/products\/nessus\/nessus-professional\">Nessus<\/a><\/noindex> It is a scanner for automating the checking and discovery of known vulnerabilities in the system. The source code is closed; there is a free version called Nessus Home, which allows scanning up to 16 IP addresses with the same speed and detailed analysis as the paid version.<\/p>\n<p>It can identify vulnerable versions of services or servers, discover configuration errors in the system, perform bruteforce dictionary password attacks. It can be used to verify the correctness of service settings (mail, updates, etc.), as well as in preparation for PCI DSS audits. Furthermore, in Nessus, credentials for the host (SSH or domain account in Active Directory) can be provided, allowing the scanner to access the host and conduct checks directly on it; this option is called credential scan. It is convenient for companies conducting audits of their own networks.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Specific scripts for each vulnerability, with a constantly updated database.<\/li>\n<li>Result output formats - plain text, XML, HTML, and LaTeX.<\/li>\n<li>Nessus API - allows automation of scanning processes and result retrieval.<\/li>\n<li>Credential Scan, can use Windows or Linux credentials to check for updates or other vulnerabilities.<\/li>\n<li>Ability to write custom embedded security modules - the scanner has its own scripting language called NASL (Nessus Attack Scripting Language).<\/li>\n<li>You can set a time for regular scanning of the local network - this way, the Information Security Service will be aware of all changes in security configuration, the appearance of new hosts, and the use of dictionary passwords or default passwords.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>There may be disruptions in the operation of scanned systems \u2014 caution is required when working with the safe checks option disabled;<\/li>\n<li>The version allowing commercial use is not free.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/07117e6a14a384a1ce2d285a19ca08fb.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Net-Creds\"><\/a><\/noindex>Net-Creds<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/DanMcInerney\/net-creds\">Net-Creds<\/a><\/noindex> \u2014 a Python tool for collecting passwords and hashes, as well as other information, such as visited URLs, uploaded files, and other data from traffic, both in real time during a MiTM attack and from previously saved PCAP files. Suitable for rapid and superficial analysis of large volumes of traffic, for instance, during network MiTM attacks when time is limited, and manual analysis with Wireshark is time-consuming.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Service identification is based on packet analysis instead of determining the service by the port number used;<\/li>\n<li>Easy to use;<\/li>\n<li>A wide range of extractable data \u2014 including usernames and passwords for FTP, POP, IMAP, SMTP, NTLMv1\/v2 protocols, as well as information from HTTP requests, such as login forms and basic auth;<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/45048ea241e42fe7008bf5a8f81c2efe.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"network-miner\"><\/a><\/noindex>network-miner<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.netresec.com\/?page=networkminer\">network-miner<\/a><\/noindex> \u2014 similar to Net-Creds in its operation principles, but with greater functionality, such as the ability to extract files transferred over SMB protocols. Like Net-Creds, it is convenient for quickly analyzing large volumes of traffic. It also features a user-friendly graphical interface.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Graphical interface;<\/li>\n<li>Visualization and classification of data into groups \u2014 simplifies traffic analysis and makes it swift.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>The demo version has some functional limitations.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/4e3a8c72150e3e9a4aceeff0ac7bd5db.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"mitm6\"><\/a><\/noindex>mitm6<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/fox-it\/mitm6\">mitm6 <\/a><\/noindex> \u2014 a tool for executing attacks on IPv6 (SLAAC-attack). IPv6 is prioritized in Windows OS (generally, and in other OSs too), and by default, the IPv6 interface is enabled, which allows an attacker to set their DNS server for the victim using Router Advertisement packets, after which the attacker can spoof the victim's DNS. It is excellent for carrying out Relay attacks together with the ntlmrelayx utility, enabling successful attacks on Windows networks. <\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>It works exceptionally well in many networks due to the standard configurations of Windows hosts and networks;<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Responder\"><\/a><\/noindex>Responder<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SpiderLabs\/Responder\">Responder<\/a><\/noindex> \u2014 a tool for spoofing broadcast name resolution protocols (LLMNR, NetBIOS, MDNS). An indispensable tool in Active Directory networks. Besides spoofing, it can intercept NTLM authentication, and comes with a set of tools for collecting information and executing NTLM-Relay attacks. <\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li> By default, it raises multiple servers with NTLM authentication support: SMB, MSSQL, HTTP, HTTPS, LDAP, FTP, POP3, IMAP, SMTP;<\/li>\n<li>Allows DNS spoofing in the case of MITM attacks (ARP spoofing, etc.); <\/li>\n<li>Fingerprinting hosts that have made a broadcast request;<\/li>\n<li>Analyze mode \u2014 for passive monitoring of requests;<\/li>\n<li>The format of intercepted hashes during NTLM authentication is compatible with John the Ripper and Hashcat.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>When running on Windows, binding port 445 (SMB) is associated with some complexities (requires stopping relevant services and rebooting);<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/ebe0c72c960bb3f6cfa6e6f34b5d2ec9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/477fe7559f446176ae8c6fc3c351b769.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Evil_Foca\"><\/a><\/noindex>Evil_Foca<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ElevenPaths\/EvilFOCA\">Evil Foca<\/a><\/noindex> \u2014 a tool for testing various network attacks in IPv4 and IPv6 networks. Scans the local network, identifying devices, routers, and their network interfaces, after which various attacks can be executed against network participants.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Convenient for conducting MITM attacks (ARP spoofing, DHCP ACK injections, SLAAC attack, DHCP spoofing);<\/li>\n<li>Can perform DoS attacks \u2014 with ARP spoofing for IPv4 networks, with SLAAC DoS in IPv6 networks;<\/li>\n<li>DNS hijacking can be performed;<\/li>\n<li>Easy to use, with a user-friendly graphical interface.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>Works only on Windows.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/f9ae7134162a703ad6fd1bdc05667a95.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Bettercap\"><\/a><\/noindex>Bettercap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/bettercap\/bettercap\">Bettercap<\/a><\/noindex> \u2014 a powerful framework for analyzing and attacking networks, including attacks on wireless networks, BLE (Bluetooth Low Energy), and even MouseJack attacks on wireless HID devices. It also includes functionality for gathering information from traffic (similar to net-creds). In general, a Swiss army knife (all in one). Recently, it also has <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/bettercap\/hydra\">a graphical web-based interface<\/a><\/noindex>.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Credential sniffer \u2014 can capture visited URLs and HTTPS hosts, HTTP authentication, and credentials across various protocols;<\/li>\n<li>Many built-in MITM attacks;<\/li>\n<li>Modular HTTP(S) transparent proxy \u2014 traffic can be managed according to needs;<\/li>\n<li>Built-in HTTP server;<\/li>\n<li>Support for caplets \u2014 files that allow complex and automated attacks to be described in a scripting language.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>Some modules \u2014 for example, ble.enum \u2014 are partially unsupported on macOS and Windows, and some are only designed for Linux \u2014 packet.proxy.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/68f5b6ccd737b3fa0ee5235f31dde4d3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"gateway_finder\"><\/a><\/noindex>gateway_finder<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pentestmonkey\/gateway-finder\">gateway finder <\/a><\/noindex> \u2014 a Python script that helps identify possible gateways in the network. Useful for checking segmentation or finding hosts that can route to the necessary subnet or the Internet. Suitable for internal pentests when a quick check of unauthorized routes or routes to other internal local networks is needed. <\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Easy to use and customize.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/dee33c0d4426c3b98e89dd726c5b647c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"mitmproxy\"><\/a><\/noindex>mitmproxy<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/mitmproxy\/mitmproxy\">mitmproxy<\/a><\/noindex> \u2014 an open-source tool for analyzing traffic secured with SSL\/TLS. mitmproxy is convenient for intercepting and modifying secure traffic, of course with some caveats; the tool does not perform SSL\/TLS decryption attacks. It is used when you need to intercept and log changes in SSL\/TLS secured traffic. It consists of Mitmproxy \u2014 for proxying traffic, mitmdump \u2014 similar to tcpdump, but for HTTP(S) traffic, and mitmweb \u2014 a web interface for Mitmproxy.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Works with various protocols and supports modification of different formats, from HTML to Protobuf;<\/li>\n<li>API for Python \u2014 allows you to write scripts for non-standard tasks;<\/li>\n<li>Can operate in a transparent proxy mode with traffic interception.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>The dump format is incompatible with anything \u2014 it's hard to use grep, you have to write scripts;<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/2049cb5c62067cd65b07abdb1a2d40a5.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/a37457f2faafae55f333b4d6839d5254.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"SIET\"><\/a><\/noindex>SIET<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Sab0tag3d\/SIET\">SIET<\/a><\/noindex> \u2014 a tool for exploiting the capabilities of the Cisco Smart Install protocol. It allows for obtaining and modifying the configuration, as well as taking control of the Cisco device. If you managed to obtain the configuration of the Cisco device, you can check it using <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/cisco-config-analysis-tool\/ccat\">CCAT<\/a><\/noindex>, this tool is useful for analyzing the security of the configurations of Cisco devices.<\/p>\n<h4>Pros:<\/h4>\n<p>\nThe use of the Cisco Smart Install protocol allows for:<\/p>\n<ul>\n<li>Changing the TFTP server address on the client device by sending a single malformed TCP packet;<\/li>\n<li>Copying the configuration file of the device;<\/li>\n<li>Replacing the device configuration, for example, by adding a new user;<\/li>\n<li>Updating the iOS image on the device;<\/li>\n<li>Executing arbitrary commands on the device. This new feature works only in versions 3.6.0E and 15.2 (2) E iOS;<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>Works with a limited set of Cisco devices, and a 'white' IP is needed to receive a response from the device, or it must be in the same network as the device;<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/643e5511c44940d1f9c313347c74029a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"yersinia\"><\/a><\/noindex>yersinia<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/tomac\/yersinia\">yersinia<\/a><\/noindex> \u2014 a framework for L2 attacks, designed to exploit security flaws in various L2 network protocols.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Allows for attacks on STP, CDP, DTP, DHCP, HSRP, VTP and other protocols.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Cons:<\/h4>\n<p><\/p>\n<ul>\n<li>Not the most user-friendly interface.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/d0cb4b5fac1fc0e5c302ad133d5b4504.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"proxychains\"><\/a><\/noindex>proxychains<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/haad\/proxychains\">proxychains<\/a><\/noindex> \u2014 a tool that allows redirecting application traffic through a specified SOCKS proxy.<\/p>\n<h4>Pros:<\/h4>\n<p><\/p>\n<ul>\n<li>Helps redirect traffic for some applications that do not natively support proxies;<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Network tools, or where to start for a pentester?\" src=\"\/wp-content\/uploads\/2019\/04\/d09dcdaf7429ea29ff70fb682e7cd590.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn this article, we briefly reviewed the advantages and disadvantages of the main tools for pentesting an internal network. Stay tuned for updates, as we plan to release such compilations in the future: Web, databases, mobile applications \u2014 we will definitely cover that as well.<\/p>\n<p>Share your favorite tools in the comments!<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/447882\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Toolkit \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430: \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438. \u042d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0448\u0438\u0440\u043e\u043a\u0438\u043c \u043a\u0440\u0443\u0433\u043e\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u043d\u0430\u0442\u044c \u043e\u0431 \u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u0445 \u0438 \u0432\u043b\u0430\u0434\u0435\u0442\u044c \u0432 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0441\u0442\u0432\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u043a\u0430\u0436\u0434\u043e\u043c\u0443. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435: Nmap Zmap Masscan Nessus Net-Creds network-miner mitm6 Responder Evil_Foca Bettercap gateway_finder mitmproxy SIET yersinia proxychains Nmap Nmap \u2013 opensource \u0443\u0442\u0438\u043b\u0438\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23689,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31811","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Toolkit \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430: \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/network-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Network tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Toolkit \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430: \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/network-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:43:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:43:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Network tools, or where to start for a pentester? | ProHoster","description":"Toolkit for beginner pentesters: here\u2019s a brief digest of the main tools that will be useful for pentesting an internal network.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/network-tools-ili-s-chego-nachat-pentesteru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Network tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster","og:description":"Toolkit \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430: \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c \u043a\u0440\u0430\u0442\u043a\u0438\u0439 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u0433\u043b\u0430\u0432\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u044f\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/network-tools-ili-s-chego-nachat-pentesteru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:17+00:00","article:modified_time":"2019-10-31T18:43:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31811","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:57:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:10:46","updated":"2026-01-21 07:57:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31811","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=31811"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31811\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/23689"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=31811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=31811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=31811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}