Welcome to part two of this module while we're finally here.
I've made mention of cool several times in the modules that were leading up to this one and now it's
time to take a look at it.
Cool is located in applications.
Password attacks.
And it's right at the top of the list.
It can also be brought up in the terminal window by typing.
Cool Tack Tack H.
Cool is a custom word list generator.
It falls into the category of password cracking tools and Cally Linux.
First off you might be wondering what exactly is it.
In its basic definition it is a program that you can use to generate a custom word list based on a target
Web site.
You can give it a U.R.L. and allow it to Spider the site it will extract unique words and arrange them
into a text file that you can use for brute force cracking.
So why would you want to create a custom list in this way.
Well when it comes to creating passwords.
Most people most of the time are just not that creative.
The average user is not going to use a 20 plus character passphrase.
And so the passwords that they do pick tend to be very predictable.
People go with something that is easy to remember rather than something that is properly secure.
We've seen this with large scale data breaches that have happened in the last few years such as the
Ashley Madison hack where an entire lists of usernames and passwords were dumped on the Internet.
The passwords people were using were just not very strong at all such as things like for example password
1 2 3 or the name of the company that they worked for and then they thought to make this secure.
By doing something like adding a number at the end of the word for instance if their password was Raiders
because that happened to be their favorite football team they might go with Raiders 1 2 3.
Thinking that the inclusion of numbers on the end would make them on hackable but in the modern age
of password hacking those passwords are going to get cracked in no time at all so for a penetration
tester creating a custom word list for the company that you are targeting as part of a sanctioned pen
test can potentially yield you a lot of legitimate passwords.
Once you've generated this list with cool you can go back and do some manual recon and add some custom
words to your list viewing people's profiles on social media services like Facebook Twitter LinkedIn
etc where people post almost every single aspect of their lives.
You can learn a lot about a person just by going through those pages that they setup and building lists
out of them.
Think of it like this.
Let's say you're doing a pen test and you want to target the account of the company's chief executive
officer the probability is pretty high that you can use a dictionary style attack to get their password.
Just basing it off of their Facebook page.
So you pull up the CEO's Facebook page you can see things like what their hobbies are their kids names
their birthdays anniversaries and things of that nature and more often than not someone working at a
company uses the company name and their password in some form or another.
They may do things like the company name or add a 1 or a 0 at the end of it or an asterisk or something
like that using these custom word lists gives you a better chance of success at gaining access to their
account over some of the default lists that are out there.
You can also combined the lists you create using this tool with other lists you have created using other
methods and tools as well as with full sized dictionary length word lists that you might download off
the Internet or those that come prepackaged with Kelly Linux the long and short of it is.
These methods allow you to tailor your brute force attack based on what you can learn about your target
through open source intelligence and reconnaissance.
In this video we won't be covering every detail about how password cracking works.
Since each module is intended to be standalone for the tool that is being discussed.
However if you have been following along with these modules in order you will have already seen several
examples of word lists being used for brute forcing and there will doubtless be more examples as we
go along so let's go ahead and take a look at some of the options that are available.
For demonstration purposes we'll use a second terminal window for carrying out our word list creation
and leave the first to serve as a list of available options.
There aren't a lot of options to go over but what options are available are actually quite useful in
helping you to create custom lists as we work through them.
One of the things that you're going to notice is that some of these options are meant to be used in
conjunction with other options.
They aren't necessarily arranged that way over the course of this tutorial will be grouping them together
so we aren't necessarily going to be going through them from top to bottom.
It's basically going to be broken down to the function of each.
Each option and how they work together.
So let's start with some basic usage of the tool and you can run cool without specifying any options.
In this case you'd simply supply it with a target.
It is at this point that I am required to give a word of caution however the use of this tool falls
into a certain gray area in terms of its legality.
The information cool collects is really effectively open source which is to say it is gathering words
off websites and assembling them into lists.
That is something you could do by hand if you really wanted to.
And I'm not personally aware of any law against it.
That being said I'm not a lawyer and I'm not familiar with the laws in every country and jurisdiction.
So for that reason I'm going to tell you to only use this tool against a website or a target that you
either own or have express written permission to conduct your penetration test against.
And remember that while gathering word lists and creating word lists off a website may be legal in your
country or jurisdiction using them to brute force passwords is pretty much universally against the law.
If you do decide to run this tool Please make certain that you are acting within the limits of all applicable
laws and if you aren't sure don't run it.
So with that out of the way I'm going to be running cool against the menace applicable to a virtual
machine that I have running on the network.
So we're going to run it in the simplest possible way to start out with you use the other window by
typing cool and supplying it with the target.
This would be a Web site but since it's on the network I'll just be using the IP address.
If we just type it in and hit enter with no options
and give it just a few minutes it's going to come back with a list of words from that Web site.
There are several Web applications that come prepackaged with many a split appeal to the larger the
Web site.
The longer this process will take cool as a ruby app and I think perhaps I need to update my ruby libraries.
Which is why we're getting this message but it should still work.
That being said I'm going to make a small cut to the recording here to save time as this will most probably
take a few minutes to complete already.
As you can see it went through the site and there are a lot of unique words that it discovered.
It's actually quite a long list.
This is what it looks like when you run the tool just by itself without any specific options being specified
one thing to point out here is that since we ran it with no options being specified all we're getting
is output in the terminal window.
This doesn't actually save anything that we can go back and work with later in order to save results.
We're going to need to use the TAC w switch and that lets you specify a file to write your output to
unless you specify otherwise which we'll get to in a minute.
The file will be saved to the directory you're in.
Which in this case is a folder called cool which I created for this test.
I'll name the file after the target which in this case is met a split ABL.
So cool tech w that Floyd double for our file name 10 month 0 0 to 8 press Enter
really do you need to update those ruby libraries so I'll let this run again and make another small
cut to the recording here and we're done.
There's nothing to indicate that the tool has finished collecting words except that we once again have
a command prompt.
So if we do class we can see that a file called met a split table has been created in our default folder.
So we're gonna go ahead and we're going to cap the file and there.
There you have it.
If you're doing a pen test I do recommend that you create the folder based on the name of your target
so that you stay organized and know where to find all the files relevant to what you're doing.
Here we see that the file we created contains the same data that we got when we ran cool the first time.
We can also quickly find out what the word count was.
If we do W.C. tech l split about 5000 164 words in total found off that Web site.
All unique words I should add.
So let's take a look at what some of the options are for the four spider ring a site.
The first option we'll look at is the tack C option.
Basically all this does is show you the number of times this word is found on a particular Web site
let's take a look at it here.
We had entered and one thing to keep in mind depending on the size the website you're going against
this process can take some time to run.
Generally speaking for that 5000 wondered and 64 words.
This process is taking about three minutes but larger Web sites will definitely take much longer and
that can be even longer.
If you expand the spider ing process to include hyperlinks and subsidiary sites that are only nominally
connected to your target.
We'll speak about that in a moment.
For now I'm going to make another brief cut with the process now finished.
We can see that each of the words in the display has a number next to it if we screw up
we can see that the numbers increase.
This is telling you the number of times a particular word was found.
One thousand two hundred and twenty six injection five hundred and seventy three motility three hundred
ninety two etc..
The benefit of doing this is to help you to tweak your word list to narrow it down and focus it more
keenly on your target when you're looking at password cracking you're probably not going to want to
include words like the or and or four you can use this to cut those out of your list.
But if we see other words that are found frequently on the site there may be a good chance that a lazy
user will have used that word in some form or fashion as part of their password for that site.
Generally speaking the higher the number count and the larger the user base of a particular site the
higher the chance that you'll get lucky and grab at least some passwords.
Now the next option we're going to be looking at is the tack D option.
This controls the spider in depth by default if you don't use this option cool is going to only spider
two pages deep into the Web site with TAC D.
You can specify a higher number but as I said depending on the size of the site this is going to dramatically
affect how long the spider ring process will take.
Also keep in mind that increasing the spider ring depth is going to increase the amount of traffic to
that target Web site.
The next one that goes along with this is the tack o switch.
This tells cool that you can visit sites that are linked outside of your target domain for example with
metal splitsville sites.
If there is a hyperlink that goes to say Yahoo dot com then what is going to happen is if you use the
TAC o option cool is not only going to Spider the target but it's also going to Spider the Yahoo site
as well.
Once again this is going to get you into a gray area legally.
If the tool is following links to other sites outside of the approved scope of your penetration test
you run a potential risk of breaking the law.
Once again this information that cool collects is only what is normally available to anyone who views
the page in a normal way.
But it's somewhat self-defeating to the ultimate purpose of cool which is to tailor your efforts against
one particular target.
While there is a certain degree of likelihood that a user is going to select a password or even a user
name based on something related to the Web site that your spider ring.
It doesn't necessarily follow or seem very likely that a nominally related site would be used.
What you'd end up with is a list of words that don't relate to your target at all and is only going
to slow down the brute forcing process by cluttering up your word list for these reasons I don't recommend
using Tak o at all but it is your option.
Again with the aforementioned warning to always make sure that you're using it in a manner consistent
with the law and if you do wish to create larger word lists.
My suggestion would be to use cool against your target omit the attack o option entirely and then combine
the word list you create using cool with a proper full length word list such as the ones that come prepackaged
with Carly or that you download off the Internet in this way you achieve a balance of efficiency in
size and you're less likely to end up with a lot of duplicate words.
The next option that kind of goes along with this group of options is the TAC Ms which this lets you
specify a minimum more length.
The default is three as you saw when we did the other scan.
Words like and or the or four showed up in our list.
Now if you happen to know the password policy of your target you might know that the policy calls for
a minimum number of characters if the password has to be eight characters long for example any words
below eight characters would be useless and that would just clutter up your list and waste time.
Of course this is assuming that the user didn't take a word that is shorter than the minimum number
of characters and then increase the length by adding in numbers or something.
In any event with the tack M switch you can set a limit on how many characters long the words are that
are returned by the spider in process.
It may or may not be a good idea but the option is there and it's worth remembering the next group of
options is going to allow us to scan for metadata contained within a site cool will actually download
certain types of data from a target Web site and then use the E F tool to extract metadata out of them.
Then these extra words can be added to your word list if you want them to be in other words cool we'll
download things like documents PD FS PowerPoint files ledgers just to name a few.
There are several file extension types that it will download and then try to extract metadata out of
so in conjunction with attack a switch you can tell cool to keep these downloaded files.
You may want to keep those files for future reference such as for example if you were doing more reconnaissance
against the target there might be something in those documents that would help you gain a foothold either
way to save this data by default cool will store these files in these slash temp directory but you can
use the TAC TAC met a temp directory to specify another directory you want to save the files to.
So basically it would look like this cool tack tack mirrored dash temp dash DIY her and we'll put it
into the cool folder tack a tack tack metal file mid exploitable die text 0 0 8
so we specified the directory
to save these files we're going to use the TAC 8 option so that it processes the metadata and we'll
also use the tac tac metaphor file option to give the file a specific name.
In this case let's just call it met a split of DOT tax.
I confess I haven't actually looked to see if the various vulnerable Web apps that come pre installed
on met a split able to have any document or PBF type files for cool to analyze.
So I guess we'll just have to find out as we go even if it doesn't produce a result.
This is how you would use the tool in cases where documents are present already so it's finished.
After a little bit of spam which I cleared between sessions let's have a look at what came up if anything
so you can see that it actually created a file.
Cool underscore temp dot PD F and the F tool will use any files created and it will extract any metadata
any documents or whatnot from the site will be stored in the default folder as you can see looking at
the metadata could also be helpful because a lot of times particularly with word documents or PD apps
they will contain things like author's name email addresses and sometimes you can even find internal
directory structures or things of that nature.
So it's always a good idea to check the metadata whenever possible these next couple of options pertain
to how cool connects to a Web site.
The first grouping that we're going to be looking at are the authentication options right down here.
It may be that your target requires either H TTP digest or basic authentication before you can actually
access the site.
Cool gives you the ability to specify those options here.
So if we just use the tac tac off type you can specify which of these two you wish to use the username
and password required can also be specified.
If you know them CURRENTLY COOL only supports digest and basic but look for future versions that will
expand on these options
the next group is for proxy access I think these are pretty self-explanatory but I'll just quickly go
over them here.
If you have to go through a proxy to get to your target you can specify the proxy host whether it's
a proxy name or IP address the port the proxy is on and the username and password.
If one is required for that proxy the next option that is nominally grouped with these is the TAC you
for user agent.
This will allow you to specify your own user agent to use when cool performs at spider ring processes.
One reason you might want to do this would be if your target has an IP sorry wharf setup.
Maybe the user agent that cool sends could be flagged by some of those and trigger some kind of alert
the solution might be to specify a user agent that is common such as for example the Mozilla strings.
Then it will let you bypass any wharf rules that might be in place and mitigate any suspicious looking
activity
here on user agents dot org.
You can find all of the user agent strings.
It really is as easy as just copying and pasting the one you want after the switch.
If you look down the list you can see that there are tons of different user agent strings that you can
use at your leisure up to this point.
The options that we've looked at have been focused on generating a list to use with a password cracker.
Cool also gives us the option to gather possible user names from a target Web site.
It does this in the form of any email addresses that are contained and there are a couple of switches
that you can use to extract the email addresses from the website itself.
There is the Tak e option and that basically tells cool to include any email address it finds Well it's
spider ring.
Then there is the tac tac email file option which generates a file to save those email addresses in
so going back to our example.
This is what that would look like.
Cool.
Tak e Tak tak email underscore file and I'm going to call this one something else.
Mrs. Floyd of all emails and then we supply our target and we press Enter cool should now generate a
list of any emails contained within the H PML of the target site.
These will be placed into a file in our default directory.
It does this by looking at any of the mail to tags that are contained within the H Tamil code itself
because I neglected to specify attack w switch the passwords that would have been put into a file were
not written.
However the user names hopefully were so we'll type class and we can see that Mideast political emails
was created.
I don't know if they're gonna be any emails in this file I haven't actually tried to gather any email
addresses from the Metis political machine using cool before so this will be interesting so we'll cap
the file
all right.
We did pull some emails they're not very good emails.
They're obviously just for demonstration purposes but these could be used for user names and obviously
if you are looking at a real web site chances are you would be able to pull a great many more emails
than this and you could use these extra email addresses.
And create a custom user name list for your brute forcing attacks and that pretty much covers cool.
This is a really fun tool.
It's really simple to use it doesn't have a lot of options.
As I said at the beginning of the introduction but the options that it does have are very useful and
flexible.
So by using this tool to create your own custom word lists it should greatly improve your odds of brute
forcing a target within a timely manner and that is a big consideration during any penetration test.
Remember that if you're using a full length dictionary file every word from a to z then it's going to
take a very very long time to try all possible combinations.
It may take days it may take weeks it may take months.
It's probably an exaggeration but you get the idea.
The point is it will take for too long and that is time that the connection to the target has to be
maintained at least in the case of online attacks and it's potentially time that the system administrator
that you're trying to test might detect your presence.
So again this tool is a useful way to go about making your brute forcing process more efficient.
I hope this tutorial was helpful to you and that you find cool to be as useful and as fun to use as
I've always found it.
Thank you.