Welcome to part four of this module
this video is going to be a quick look at goalless marrow the web knife.
This may be one of the shortest videos in this class because this tool is painfully straightforward
to bring up goals marrow.
We should go to applications vulnerability analysis
and then select goalless marrow.
You can also launch it from the terminal window just by typing goalless marrow and you could launch
it directly against a target.
My typing goalless marrow followed by the target website domain or IP address for legal reasons I will
be using the IP of my own met hospitable machine.
As you have already seen me do in prior modules.
This is because nothing about goalless marrow is subtle stealthy or even particularly legal so to do
this to launch goalless marrow against a target type flawless marrow and supply the target information
which in this case is my own met a spoiled ball machine
so right away we see that this is another auditing tool like Sparta goalless marrow is a kind of all
in one Swiss army knife of a tool running multiple other tools such as Nic to and map etc. It also brute
forces looking for vulnerabilities in target Web sites.
The idea here is pretty simple and that idea is that you run it against a Web site although it makes
lofty claims in its documentation about having multiple stages to its scanning process.
The first of which is billed as being non-intrusive that is in fact an accurate.
This program is anything but non-intrusive.
I can't even run it against scan me Dot and map dot org as its pension for brute forcing willy nilly
against targets would violate the terms of the web scanning permission.
That's why I'm having to do it against a metal splitter both machine Gulf's marrow comes prepackaged
with Kali 2.0.
This particular tool can be run on a wide range of operating systems including but not limited to OSX.
Windows Linux BSD and even the Raspberry Pi with the correct plugins installed.
This tool will check showdown spider foot open VHS for the tool to work properly.
You at least need Nick to map open VHS and SSL scan spider foot installed and configured
unlike other all in one tools like for example Sparta.
This script is not particularly easy to configure.
It is about as subtle as firing a cannon at a wall to look for cracks and half any halfway competent
administrator will spot this sort of a probe and much of what it does will be logged as you can probably
tell I'm not a big fan of this tool because I like to run powerful tools individually and control the
levels of my exposure during a pen test.
Of course if you plan to run all of these tools against a Web site anyway I suppose you may as well
use goalless Mario
the tool has four principal scanning phases.
Phase one is reconnaissance followed by phase two which is falsely claimed to be non-intrusive scanning
the third phase is exploitation which it admits is in fact intrusive checking for things like open SSL
Heartbleed and other such attack vectors.
Its fourth and final stage is reporting in which you can see at the bottom of the screen when the scan
completes
because this program takes quite a long time to complete.
Even the most basic scan like I said it's throwing the kitchen sink at the target and without any subtlety.
I am going to make a small cut to the recording.
There's no reason to watch this brute forcing process go on in general against a single target.
It will take a bout 15 minutes to complete.
Although I have seen it get stuck in the high 90s of the third phase the brute forcing process
penetration testers who rely on goalless marrow are being a bit lazy in my opinion.
Yes the tool does what it is supposed to do but you're relying on a script to conduct and map scans
and running to and these are things that are part science and part art black hats on the other hand
may find it useful to perform quick and dirty scans against Web sites that they wish to hack and therefore
it is viable to run this tool as part of a pen test to make sure that nothing really obvious jumps out
that the script kiddies can then grab on to the one salient quality of goalless marrow is that it can
be run on virtually any system including a Raspberry Pi.
So it's pretty easy to setup a cheap ten dollar pi connected to the Internet on a connection that is
not related to the tester such as for instance a coffee shop and scan a large number of sites on the
web quickly and with little concern.
This is in the vast majority of cases illegal but as a security professional you will need to be aware
of this sort of tactic.
It is also possible to use this tool in conjunction with methods of anonymous using such as virtual
private networks and proxy chains both of which are subjects covered at greater length in the modules
dealing with anonymity.
In summary this is a script that does a lot of things for you that you should really be doing yourself.
However it is undeniably effective for some users as it distills the use of more complex tools down
into a single command.
I don't personally like it but you may find it to be a useful addition to your toolkit thank you.