WEBVTT

00:00:01.440 --> 00:00:02.110
Hey there.

00:00:02.120 --> 00:00:03.660
Welcome to our lab environment.

00:00:04.140 --> 00:00:05.180
As I mentioned before,

00:00:05.190 --> 00:00:10.020
I have here a virtual machine with the Kali Linux version 2021.1.

00:00:11.140 --> 00:00:12.350
So, let's get started.

00:00:12.490 --> 00:00:16.360
Let's take a look at how to install the Sn1per tool in Kali Linux.

00:00:17.440 --> 00:00:19.660
The Sn1per tool is hosted on GitHub.

00:00:20.340 --> 00:00:25.230
You can find it on this address here. And in here, you find not only the

00:00:25.230 --> 00:00:28.950
source code, but also really good documentation about the tool.

00:00:30.440 --> 00:00:33.860
So first, we need to download the source code to our Kali machine.

00:00:34.640 --> 00:00:36.560
For that, I will open the terminal,

00:00:37.340 --> 00:00:43.270
go to my Desktop, and then use this command, git clone, to

00:00:43.270 --> 00:00:47.760
get all of the source code from GitHub to my computer. And in

00:00:47.760 --> 00:00:52.260
here, I'm using the github URL, which is the same as we saw a few seconds ago.

00:00:55.840 --> 00:00:59.950
And when this is done, I'll have here on my desktop this folder called Sn1per.

00:01:00.940 --> 00:01:04.459
So, let's enter it and take a look at what is inside.

00:01:05.440 --> 00:01:08.160
Perfect. To install Sn1per is really simple.

00:01:08.540 --> 00:01:12.460
All I have to do is run this install.sh as root.

00:01:13.340 --> 00:01:19.450
So for that, I'll type sudo bash install.sh.

00:01:20.540 --> 00:01:24.540
And this might take several minutes, so to save us some time, I

00:01:24.540 --> 00:01:26.460
already ran this before recording this demo.

00:01:27.340 --> 00:01:28.600
And once this is completed,

00:01:28.610 --> 00:01:32.600
you have Sn1per installed on your VM. To check if everything is

00:01:32.600 --> 00:01:35.550
working, first I need to elevate my privilege to root,

00:01:36.040 --> 00:01:39.360
and the reason for that is because Sn1per needs to be run as root.

00:01:40.640 --> 00:01:46.390
And now I can use sniper ‑h. And, if the help page is displayed,

00:01:46.410 --> 00:01:49.060
then you're good to go. Perfect.

00:01:49.060 --> 00:01:50.650
So, let's do some reconnaissance.

00:01:51.340 --> 00:01:54.360
Let's gather some information about the globomantics.com domain.

00:01:55.340 --> 00:01:55.940
For that,

00:01:55.950 --> 00:02:01.210
I'll use sniper ‑t, and then the domain that I want to gather

00:02:01.210 --> 00:02:04.430
information about. If I run this command,

00:02:04.440 --> 00:02:08.150
it will run a normal scan, meaning that I will use passive and

00:02:08.160 --> 00:02:11.960
active techniques to gather information, and this includes the

00:02:11.960 --> 00:02:14.660
import scans and active vulnerability scans.

00:02:15.740 --> 00:02:16.340
Personally,

00:02:16.350 --> 00:02:20.060
I would only do this type of scan if you have authorization to do that.

00:02:20.940 --> 00:02:22.710
This generates a lot of noise,

00:02:22.720 --> 00:02:27.020
and you could easily be detected by the SOC team. In here, as I'm

00:02:27.020 --> 00:02:29.840
authorized by Globomantics to perform active tests,

00:02:30.070 --> 00:02:35.390
I can run this. And now, what Sn1per is doing is running dozens

00:02:35.390 --> 00:02:38.270
of really common reconnaissance scripts to get us the most

00:02:38.270 --> 00:02:40.260
information possible about my target.

00:02:41.540 --> 00:02:42.740
For example, take a look.

00:02:42.750 --> 00:02:46.870
Sn1per just executed a well‑known script to detect if the client has

00:02:46.870 --> 00:02:50.470
a web application firewall. And, as we can see,

00:02:50.480 --> 00:02:53.560
it seems that Globomantics does have a WAF solution.

00:02:55.240 --> 00:02:59.650
Also, we can see here that Globomantics is running on a CentOS machine.

00:03:00.440 --> 00:03:04.250
And again, this is just a fraction of all the scripts that Sn1per is running.

00:03:05.140 --> 00:03:08.160
This scan here might take up to half an hour to finish.

00:03:08.740 --> 00:03:10.140
So to save us some time,

00:03:10.150 --> 00:03:12.980
I will pause this recording and come back once it's

00:03:12.980 --> 00:03:18.860
finished. Done. The scan is now completed.

00:03:19.240 --> 00:03:21.150
In total, it took 15 minutes for me.

00:03:21.460 --> 00:03:22.240
And in your case,

00:03:22.240 --> 00:03:25.150
depending on the domain your scanning, it might take even longer.

00:03:26.340 --> 00:03:28.860
As you can see, the Sn1per found a lot of stuff.

00:03:29.540 --> 00:03:32.260
So, let's take a look at the report generated by Sn1per.

00:03:33.340 --> 00:03:35.460
For that, let's open File Explorer,

00:03:36.740 --> 00:03:44.830
and then let's go to the folder user, share, sniper, loot, and then

00:03:44.830 --> 00:03:51.540
workspace. In here, I have all the domains that I've scanned so far. So,

00:03:51.550 --> 00:03:54.050
let's open the folder for globomantics.com.

00:03:55.140 --> 00:04:00.560
Any in here, let's go to the folder reports. Perfect. Two reports.

00:04:01.040 --> 00:04:06.240
One of them is for the globomantics.com website on port 80, and the other one

00:04:06.250 --> 00:04:11.550
is for the website on port 443. As they are basically the same website, let's

00:04:11.550 --> 00:04:18.690
take a look at the report for the port 443. In here, we can see all the

00:04:18.690 --> 00:04:22.720
output for the Sn1per scanner, and we're not going to be able to go through

00:04:22.730 --> 00:04:27.350
every single detail since we have tons of information, but let's go through

00:04:27.350 --> 00:04:28.460
some of the main ones.

00:04:29.040 --> 00:04:29.710
For example,

00:04:29.720 --> 00:04:33.750
in here I can see the WAF information that we saw when the script was running.

00:04:34.840 --> 00:04:35.290
Also,

00:04:35.300 --> 00:04:38.610
we can see some details of the SSL certificate that is installed

00:04:38.610 --> 00:04:41.760
on the website. And, even more interesting,

00:04:41.770 --> 00:04:46.120
we can see here some vulnerabilities that could be exploited. And take

00:04:46.120 --> 00:04:48.750
a look, there's even a link for the exploit itself.

00:04:49.840 --> 00:04:50.650
Pretty cool, right?

00:04:51.340 --> 00:04:55.260
And again, this is just a fraction of all the information that Sn1per generates.

00:04:56.040 --> 00:04:59.550
At first, it might be overwhelming to you having all this data,

00:05:00.040 --> 00:05:03.760
but once you get used to it, you can easily find information you're looking for.

00:05:05.340 --> 00:05:05.850
Also,

00:05:05.860 --> 00:05:08.780
another cool thing about Sn1per is that all the data that was

00:05:08.780 --> 00:05:11.760
gathered is also organized in the workspace folder.

00:05:12.640 --> 00:05:15.880
For example, if you want to see all the vulnerabilities for this domain,

00:05:15.890 --> 00:05:20.550
you can go to the folder vulnerabilities and then open this file

00:05:20.550 --> 00:05:26.030
called sc0pe‑all‑vulnerabilities. In here, you have a list of all

00:05:26.030 --> 00:05:27.650
the vulnerabilities sorted by priority.

00:05:28.840 --> 00:05:33.140
And the cool part about having all the data organized into text files is

00:05:33.140 --> 00:05:36.160
that we can use this data to automate our exploitation.

00:05:36.940 --> 00:05:37.620
For example,

00:05:37.630 --> 00:05:40.680
I could develop a script to automatically download all

00:05:40.680 --> 00:05:42.360
the exploits from those websites.

00:05:42.840 --> 00:05:45.750
So then, it can save me some time during the exploitation phase.