Welcome to part four of this module
in this video.
We're going to be taking a look at Sparta.
Sparta is a network infrastructure penetration testing tool that was designed by Leo needs.
Stanley Otis it is in fact a kind of all in one Swiss army knife of a program which contains several
other tools and even provides the option of adding more tools to it.
Sparta is designed to run many of these programs more or less back to back.
And all in one place for convenience it is meant to help penetration testers during the scanning and
enumeration phases of pen test.
When you give it a host to scan it runs many of its programs in the background and displays the information
in a single user interface as was the case with Dimitri I was at something of a loss to know just where
to put this module within the progression of this class because while Sparta uses many information gathering
utilities such as and map it also uses several hacking tools.
I intend to cover individual tools and dedicated modules so there's really nowhere I can present this
particular module where each piece will have been previously explained.
So if there is a particular program mentioned in the course of this module that you wish to know more
about Please look through the sections until you find the module that corresponds to that tool since
the creators of Kelly 2.0 have classified Sparta as an information gathering tool under that category.
That is where I have placed this this module within the class progression.
Sparta requires updated Python libraries to run and these should be included with any up to date version
of Kelly Linux.
If not it will be necessary to install two dependencies.
Python elixir and Python Kuti for Sparta also requires and map Hydra and Kuti capped to be installed
in order to function properly.
These also come prepackaged with.
It is possible to include additional tools into Sparta to do this you would need to edit the configuration
file for example if you wish to add the use of an NSC script to the use of n map scans you could simply
set that in the config file and Sparta will use those settings when it utilizes the end map utility
on all of its future runs to add new tools.
You simply need to add its information to the config file.
The same goes for any changes you wish to make to house said tool operates.
The authors of Sparta have stated that they plan to add a settings menu within the program to allow
you to make these changes without having to mess with the configuration file and potentially damage
a program if you make a mistake.
So keep an eye out for that option within future versions.
To load Sparta we just go to applications information gathering and click on Sparta.
It is also possible to load directly from the terminal window by typing Sparta.
In either case a small terminal window will open in the background which acts kind of like a running
a log file that will display the actions you are taking within Sparta as they are happening.
The main window for Sparta is a graphical interface seen right here.
So we'll go through this step by step starting from the top.
The final menu new will allow you to create a new project open will let you open any saved Sparta projects
you might have save and save as are obvious add hosts to scope allows you to add either a target IP
address or a range of eyepiece import and map will allow you to import and map excel file.
So for example if you already ran a scan using and map against a target and saved the results as an
Excel file you can then import that file into Sparta and then still be able to run all the other tests
that come with Sparta.
This can be a time saver in the case of a very large network.
Unfortunately with regards to the help option this button doesn't seem to work.
I'm honestly not certain if it is a compatibility issue or a glitch.
The option used to work with older versions of Cali and backtrack so my suspicion is it is a problem
specific to Cali 2.0 and something that the designers will eventually fix.
By all means try the button yourself but if nothing comes up then your guess is as good as mine.
There is however plenty of help and documentation that can be found online through a simple search.
So if you run into problems it shouldn't really matter.
Still it would be nice if this glitch was corrected in future versions.
Now we'll move down to the scan tab.
You can see under it that it has three sub tabs it has hosts which you can click on here to add your
target IP address that Sparta will scan.
It shows you the various format options for how you can enter the IP such as for example a range such
as for example a range of IP addresses or you could just enter a single host in there which is what
we will be doing in this demonstration.
You can also set to run and map hosted discovery as well as in map staged scans.
I'll talk a little bit more about this as we get into running them.
This is the default behavior with Sparta and it makes it run more quickly and smoothly.
Whenever you're running a staged scan so closing out of this we go to the services tab
there isn't going to be anything here yet but this is where your discovered services of your target
are going to be listed after running your scans you'll hopefully see a list of maybe each GDP or FCP
or SS H or anything else found in your target host as your scans are running your tools tab is a window
that shows which tools are currently in operation such as any map or Hydra you can click on each one
and the individual results of each tool will show up in these windows if we go over to the brute.
Tab this is where we can setup the brute force password settings you would give it the IP address of
your hosts and the port that you are going against and the service.
You can see that it has a rather lengthy list of services you can attack in the drag down menu.
For example
if you wish to brute force
FCP service you could just set it and then for the rest of these services just leave them as default
with regards to the user name and password.
You actually have three different options about how to proceed.
The first grouping that is to say these two right here root and password is for situations where you
already know the user name or you already know the password or both.
You can specify them here by changing the default options if you click the radial buttons
and don't specify anything sport.
It will automatically use root and password as default username and password.
The second grouping over here is to set a username and password list.
This would be a text file containing letters words numbers which you would select by clicking the browse
button.
And then navigating to it Sparta will then attempt to brute force usernames and passwords using these
lists.
You can use common dictionary word which you can use made from downloaded off the Internet.
You could use Sparta as somewhat limited built enlist or you can create your own list.
This last option is particularly useful if you already know something about your target and if you already
know some of the targets usernames and passwords from other compromised systems you can also use certain
applications within Cali such as Cupp and cool to custom build word lists that are tailored to a specific
target based on information you give them.
More on this in future modules.
The second option would be to select your options from two different groups.
For example if you know the user name but you don't know the password.
You can set the user name
and then click the second password entry and use a word list to try to guess the password.
The success or failure of this method is dependent upon what type of system you're running.
How much time you want to spend and the security practices of your target.
Functionally speaking a single word password is very easy to crack as is a simple password containing
just a couple of numbers.
The longer and more complex the password though the harder it is to crack a word from a dictionary might
take 10 seconds while a string of letters and numbers of varying capitalization with symbols included
would be practically impossible if you devoted thousands of years to the activity.
Unfortunately where most ports are concerned you would be amazed at how often default passwords are
used since the average person simply doesn't think to defend against this kind of a cyber attack by
setting up strong passwords.
So for example if we browse we'll go to the desktop and I've already set up a word list here so I'll
click open and now it would use the user name I specify which in this case was user name and the word
list I specified
finally.
You can select found usernames and passwords as your third option.
In which case the tool will use any user names or passwords that it has already found to brute force
subsequent accounts that it comes across.
Once you have everything set you would just click Run to begin brute forcing these password accounts
as it's running everything is going to show up in the log window at the bottom of the screen.
That's pretty much it as far as the basic options that are available to you.
So let's now dive into doing actual scans with the tool before we begin though.
There's one option I would like to change and it strongly recommended that you do the same.
There is one change that I want to make to the config file for Sparta by default.
When you add a host it will automatically start running all of its pre configured tools against that
host.
All of these tools will fire up more or less at the same time and start their processes against the
target.
This is probably not a good idea though it needs to be remembered that this is an active scan and you
are actually going against a target.
So if you're running all of this stuff at the same time it's not exactly going to be stealthy on your
target's network.
You may just want to break it up and do one at a time and only run one or two of these tools at a time.
So to change this behavior we need to open up the Sparta configuration file which is located under a
user shared Sparta
right here.
If we open it up here and scroll up to the general settings
this enables scheduler setting is what we want to change from true to false
make sure that you save the file
and make doubly sure that you close Sparta down and restarted
this holds true of any time you make a change.
The Sparta config file otherwise it will not work the way you set it up
so we reload Sparta and we're back.
Setting the scheduler like that just gives you more control over how your scans are going to take place.
It will still run its and map scan by default but your other tools are not going to launch until you
tell them to.
At the end of this module I will do a quick demonstration of what it looks like when you run against
a target without having changed the setting.
It is ultimately up to you of course and you can always change it back to true if you prefer it that
way.
All right to get started with the scan.
The only thing that we need to do is add our target for this demonstration.
I've set up a meet a splitter Bill VM here in the office and that is what I'm going to be running against
for all of my scans.
You can select any target that you have available in your lab.
Once again a word of caution.
This is not a passive scanning tool.
Never run this program against any computer that you do not either own or have written permission from
the owner to pen test.
Otherwise you could be in violation of the law.
So I'm going to enter that network I address of my older scintillating tools like Hydra.
I'm going to leave the default settings checked and then we'll just click Add to scope.
You can see that as soon as I do that the end map starts its scan it shows us a staged scan
you can actually see this in the config file.
If you open it back up under staged and map settings you can see the type of scan that and map is going
to run on each stage of its scan.
Stage one only does ports 80 and 443.
Stage 2 as additional ports.
Stage 3 adds a few more ports and so on.
Doing it this way actually gets you results back faster rather than scanning through all sixty five
thousand five hundred and thirty five ports at one time so we'll just close this out again at each step
it gives you the status of if the stage has been finished or not.
And here it shows all the ports and services that we have available.
Of course with metal splitter Bill you can expect there to be a great many open and exploitable ports.
We'll let this run for just a minute
the way that you get additional tools to run is to go to one of the services
right click on it and this will give you a context menu with a list of options available for each service.
Each menu is therefore going to be slightly different depending on the service.
For instance port 25 gives you the option to enumerate S.M. T.P. if we click another one you can see
that the settings have actually changed.
We're going to take a look at this for port 80.
Each TTP you right click on it and you can see the options that we now have.
We can open it take a screenshot with Kutty capped run what web.
Nick Toh one thing I want to note here however is that there is an issue with web Slayer in Cali 2.0.
It simply isn't installed and as far as I can determine it is not present in the Cali repositories either.
Web Slayer did work with previous versions of Cali and backtrack but much like the Sparta help button
it just didn't survive being ported over to 2.0.
For the moment this option is unavailable even though it is listed and if you try to run it it will
crash sparked it out completely.
Hopefully future versions of either Sparta or Cali will once again include this bit of functionality
what we're actually going to do is run Nick to against it.
Just click on that.
And we can see that a new process is started for Nick to
and if we click on it we can see the information that is being brought back.
It shows you which ports it is going against
and what we're waiting for this to run.
I'll just show you what the terminal window looks like right now.
I mentioned that the terminal window stays open while you're running Sparta and it functions rather
like a log file of everything that you've been doing
so here we can see the information Nic too is discovered.
We can click on the tools tab which shows the targets that it went against.
And the results on the far right of course in this case it was just one target but you could be doing
this against a range of targets.
In addition to being able to run something like Nic to we can go back and launch a net cat session on
port 80 we could even do a telnet as well if we do open browser.
It's just going to open a browser to our target host so as you can see it's a pretty nice tool to use.
Let's go ahead and get rid of this.
Let's go ahead and select.
First off I'm going to actually kill this because it's taking too long
so sport is a pretty nice tool to use.
Let's go ahead and select one of these FCP services we can see the options we have here.
We could do various things but we're going to use the brute forcing method to see what we can get out
of this to try to break into the account information.
If we click send to brute and then come over to the brute tab we can set our options.
You can see that it already has our target address set.
I'm going to set this to a user name and password list that I have prepay pre prepared.
These are just lists that I created for this specific demonstration and they will of course brute force
their way in very quickly your own mileage may vary depending on the security practices of your target
and the strength of your list when you try this yourself
so in this case I have my list on the desktop.
Once you have these things set.
All you need to do is click Run it uses Hydra to do the brute force password cracking.
We can see here that it did find the account
which was the default log in MSF admin password MSF admin.
That's a default for the A Boyd console and we can do the same thing against any of the services that
allow you to brute force their passwords after you've collected all of your data using Sparta.
You're going to want to save your file and your Sparta session.
We can do that by clicking file
save as and name it whatever you wish
click Save it will save everything as a Sparta logic file.
I'll show you what that looks like.
Since I chose to save the desktop
now if we go to the folder here
it created two different objects.
The main Sparta project file and it also created this folder which contains additional folders for each
of the tools that were run during this session.
If we go into these files we can see the particular results from that particular tool
all this information is contained within the Sparta configuration file.
Once you have everything saved if you need to come back to it later you can reload it and just go to
the file.
Actually let me show you I'll close out of this in this.
This is what I'm talking about.
So if we come up here to file open and then we open up our session file as you can see everything is
restored to exactly this point.
One last thing to point out.
If you decide to modify the config file to add your own tools the tool in question must not be one that
requires user input.
What I mean is it must be able to run from start to finish all on its own.
Just keep that in mind as you mess around with this aspect of Sparta Sparta won't allow you to add a
tool that requires user input because the the graphical interface simply won't support it.
So before I end this module I will quickly re edit my configuration file and show you what it looks
like when you run Sparta with the option set to true
so we'll change this option back to true
save the file
and we'll close out of Sparta and reload it
so here we've got a fresh Sparta window open.
I'm going to rehab mine met a split level post.
Add to scope and it will immediately begin to run.
All tools starting with the unmapped scan.
This can be kind of handy if you're 100 percent sure of the legality of what you're doing as it is less
likely that you'll forget to run a particular tool against a particular target.
This is especially true when dealing with a large range of targets.
You can also see that each module runs a new tab is created.
These are the same results you'd see if you ran these on their own and a terminal outside of Sparta.
For example here we can see that it grabbed a screenshot with Kuti capped and we can see the Nick 2
results are being collected but you can also see that this has suddenly become very slow in fact it
almost looks like it's locking up.
That's because all of these tools running simultaneously can be quite a drain on your system.
They don't always compliment each other in terms of efficiency
this is S.M. A.P. enumeration
and I should also add that because I'm using all the default settings Sparta is using its own default
word list for all brute force attacks.
Here we have my askew El one password was found it's identified the log in as root for that host
and the range of tabs is increasing so I'm going to scroll over post graphs one valid password found
log in post dress password post grass and of course it's probably not going to be that easy against
a real target a real target will have security practices one would hope
and here we have FTC scans against different ports.
Here we found that the log in is anonymous and the password.
His Sparta with an ampersand.
This is a good example of the fact that the password cracker can in fact crack passwords and account
names that contain symbols
so simply having a symbol in your password or a user name is not enough to foil the brute force attack
method.
It'll slow it down in the vast majority of cases but it's not enough by itself.
We found zero passwords for this port.
That's interesting.
It appears that this.
This tool x eleven screen was unsuccessful in grabbing a screen capture.
That's OK
in 2 4 8 1 8 0 T.C. P has pulled up a great deal of information
another screenshot.
This one of Port 8 1 8 0 TCE and as you can see these tools are still running down here so it's still
collecting results.
Now the system than it's scanning as I said is a highly vulnerable men a spoil system.
If you were scanning a range of targets this could take a very long time and you'd have a lot of tabs
and keeping them all straight can be a bit of a chore.
That's the one downside of Sparta.
Here we have the services tab.
It's just a reorganization of what you're already looking at.
And the tools tab.
In any case this will continue for all of the various ports and services that it has found.
It will run all tools that it has available against a particular port or service and display the results.
As you can see so that's Sparta in a nutshell really is a very cool tool.
And just remember that while the creators of Cali may have classified Sparta under the information gathering
category
and the scans it performs are active.
So always be lawful and ethical when you use it.
I hope you enjoyed this look at Sparta and that you now feel more confident about using it.
Does contain acting contesting tools such as Hydra.