Welcome to the video Sparta and eyewitness in this video we will use a built in Kelly tool called Sparta
which will help not only automate our unmap scans but also automatically run pen testing tools against
our target hosts.
Based on what services are running will also install and use a free tool called eye witness together
web VANOC or RTP screenshots from a list of targets.
Up until now we've focused primarily on using unmap to discover information about the hosts and vulnerabilities
on our network.
And we've started to take a dive into how we can use various commands and flags to fine tune our scans
for just the specific information we're looking for.
We're going to get back to that in a bit but I wanted to call a brief time out and show you some other
great tools that can give you a jumpstart on a numerator in your network as well Sparta is one that
comes built right into Kally and in what will likely be a relief for some of you.
It has a nice slick gooey interface once you get Sparta open you can simply click where it says Click
here to add hostes to scope and type in the network or networks you'd like to scan I suggest leaving
the two checkbox settings alone and simply clicking add to scope as soon as you do.
Sparta gets to scanning as you can see in the log area of the screen there is actually a staged map
scan happening behind the scenes.
We'll get into how to tune that a little bit later.
But for now you'll also notice that Sparta is running a handful of other tools such as nikto which is
good at finding Web site vulnerabilities.
It also appears that Sparta is taking screenshots of services it finds along the left side of the Spart
a window we can click through our scan results host by host to see open ports as well as the associated
service name and version.
And then as we work our way across the tabs along the top we can see the results of the nikto scan a
screenshot of the web service on port 80 as well as a check for the existence of default credentials
on the hosts.
My sequel and FCP service which is pretty cool.
Bacot the Services menu.
Notice that we can right click any service and be prompted with a contextual menu.
So if I wanted to open this service with telnet I can do that with a quick click in this menu.
Same for S-sh and I can quickly open the site's web service in a browser as well.
Additionally Sparta has some tools to let you do some deeper testing of a host's services.
For example if I right click the service and click send to bruit I can now come over to this bruit tab
and set up for a brute force attack.
I can feed bruit a large list of usernames as well as a large list of passwords.
Then I simply click run and we're off and running.
Another feature that is incredibly handy and smart is a tab where you can fill in notes.
So if you're using Sparta for a pen test engagement you can jot some notes about your testing down for
later each host has its own notes field.
So it's easy to organize your thoughts and perhaps best of all it's easy to save a Sparta project file
and then come back to it at a later time.
Now you might remember back to when we first started the network scan with Sparta.
We saw a screen indicating that a staged in MAP scan was happening.
So what exactly is a staged and map scan.
And how can we get some more granular control over it.
Well all this part of magic happens in a file called Sparta.
If we can find that file quickly on our calling instance by simply typing in locate space Sparta com
I'll open it up N.A. here so we can have a look at it.
Now while at first glance this file might look intimidating.
It's broken down into several logical chunks first since we're talking about unmap Let's hop down to
staged in MAP settings.
This section essentially details in order several and map scans that will be run.
We can see that and map will first scan for ports 80 and 443 then move on to hitting 25 137 and a slew
of other common ports.
Stage three gets into telnet FGP and S-sh and so on until eventually all 65000 plus ports are scanned.
Now let's take a look at the section called Host actions host actions or options.
You can see when you right click on host in Sparta if we want to add actions of our own we can just
follow the syntax which starts with a unique identifier.
I'll just make a simple one called Ping then a label we want displayed in the pop up menu itself.
And then the command we actually want to run with the word IP in brackets.
So let's save this file out.
And then we will restart Sparta and give this a shot.
I'll open my previously saved Sparta project and then I'm going to write cook a host and click ping
seven times.
Notice that a new tab is opened with our ping tool output.
There are just a few other things I want to call your attention to in the Sparta Khant file.
The port actions are tools that can be run when you right click a port or service.
In Sparta and again these can be customized by following the syntax of an existing menu entry.
Once support action is run its output is saved to a tab.
In Sparta such as the GRABBE banner tool shown here in a similar fashion the port terminal actions can
be customized as well.
But what makes these different from Port actions is that these actions will respond in an external terminal
window.
For example if we want to open a telnet connection to a host.
Notice how it opens in a brand new terminal window.
Lastly you may have noticed that once our initial Sparta and map scan finished it also kicked off a
whole other slew of tools like nikto and some default credential checkers.
If you want to turn all that off scroll up near the top of the config file and where it says enables
schedular equals true change the word true to false.
Now the next time you do aspire to scan the staged and map scan will still kick off and finish but the
additional tools such as nikto or the screenshot utility or the default credential checkers will not
be launched
for additional information about Sparta visit Sparta SEC force dot com slash documentation.
Now there are dozens of other tools that can help you conduct basic network scanning but I want to show
you one that has been particularly helpful for me as part of my penetration testing process.
I can't tell you how many times I would wrap up a test and then be annoyed at myself for forgetting
to capture screenshots of the hosts that were in scope.
So now I use a tool called eye witness during the recon phase of the pen test so that those screen shots
are good to go when it comes time to write the report.
If you do a quick Google search on eyewitness get hub you will find the get how project for eye witness.
Now if you've never used get heard before.
No worries.
The steps in syntax to install a get how Project is usually pretty simple.
We're going to do is click the clone or download link then copy the command in the pop up into our clipboard
next in a terminal window we'll type.
Get space clone and then paste in our command followed by a destination directory.
Personally I like to use the slash opt folder for this so I'll type slash Opt. slash eyewitness and
hit enter.
Once the project is copied I would normally recommend you read the read me but to save us some time
I'm going to skip ahead and run the set up.
Sh script which automates the installation of any additional dependencies or configuration we might
need to do.
Now that eye witness is good to go.
Let me show you a few simple examples of using it.
Let's say I have a list of your else for my scan or pen test and I simply want eyewitness to fly by
and grab a screenshot of each one.
All we need to do is set up a you are elist.
I'll just call mine you or else directx t and then type a list of your else into it one per line.
Then I'll call eye witness and add a TAC f followed by my you or else RTX t followed by tac tac web
which will take an H TZP screenshot.
So let's let that go.
And when it's done eyewitnesses play it enough to ask us if we'd like to open the report will say yes
and boom our Web browser opens with not only some nice screen shots of each host but a bit more information
on the web services running on it as well.
We can simply click in to each screen shot to get a larger view and from there it's really easy to pull
the image into an editor.
Do some quick cropping.
So it fits a little nicer into your pen test reports.
Now let's say we're doing a scan or a pen test where we already did a full and map scan and saved the
output to the three different file types.
What's really nice is eye witness can simply take advantage of your existing scan in SML format by calling
eyewitness with the TAC X space.
The name of your file that has an X M-L extension plus tac tac weap and once the process is complete
will again be asked if we want to open up the report and boom we are all set.
Also don't forget eyewitness can also snag screenshots of VNC and RTP connections.
The syntax is largely the same as our very first scan.
We'll use eyewitness space tech f space the file name and then at the end you'll add either tac tac
RTP for remote desktop services or tac tac VANOC for VNC coin's.
Overall the flexibility and functionality of I-Witness can help us greatly both on the front and back
ends of our vulnerability scans and penetration tests.
In our next video we will start diving into a tool called Open vals which has a powerful scanning engine
you can use to automate the discovery of vulnerabilities within your network.