All language subtitles for [English (auto-generated)] The Complete Python Hacking Course Beginner To Advance 2023 & [DownSub.com]

hello everybody and welcome to this

complete Python 3 hacking course

now in this course we are going to code

multiple projects each one of them will

have its own purpose and you will have

all of the code at the end of each

project in the resources list to

download

and by the end of this course you should

have a pretty good knowledge on how to

create tools using Python 3 for your own

penetration tests

so as I mentioned this will gather

different tools from different fields

such as for example Port scanners back

doors email Scrappers vulnerability

scanners and many more

I'm going to code as we go and explain

everything line by line so you should

have no problem understanding the code

and just in case you don't like to code

along you will have all of the programs

available to download at the end of each

project you can simply just download the

code and follow along the tutorials as I

explain without having to code anything

okay

now one important thing is if you have

any questions regarding any program or

if you have any proposals and you want

me to add something to the course feel

free to post in the Q a section and I

will respond as soon as I can

also if you don't understand anything

make sure that you post in the Q a

section or send me a private message and

I will also respond there as well

another thing to mention is that

throughout the course there will be

different articles and bonus lectures

which will give you additional knowledge

and for example if this course doesn't

cover something such as for example

installing Windows 7 virtual machine

I'll make sure to leave a link to the

tutorial where you can watch and follow

along the tutorial in order to continue

the course

this course will be updated every month

with new lectures with updated code and

with your proposals if you tell me for

example you want to see an updated

keylogger I will make sure that they

create it and put it inside of a course

now in this course we are going to use

Kali Linux as a virtual machine and

don't worry I will lead you through the

steps of installation in the

introductory part of the course in case

you're an advanced ethical hacker feel

free to skip the introductory part and

get straight into the coding lessons

for all of you beginners I will teach

you in the introductory video how you

can create your own virtual machine and

set up your own environment in order to

start with this course

another advice that I have is in case

you don't have too much python knowledge

feel free to also take a course on the

side as we are not going to cover Python

3 Basics we're going to get straight

into coding different tools with python

3.

now even though I'm going to explain

some of the basics throughout our code

it would still be best for you if you

would take a Python 3 separate course

and I will also have some of my

recommendations for Python 3 courses in

the resources of this lecture so without

further Ado thank you for enrolling and

let's not make this any longer and let's

get straight into the course

hello everyone and welcome to the

trailer of our course now in this short

video I will give you a small teaser as

to what you can expect after you finish

this course it's always the best idea to

show the students some of the things

that you will be doing inside of the

course and some of the things that they

will learn and master at the end

so for this teaser I decided to show you

the back door but not just any back door

I decided to show you a back door that

we're going to run from two separate

machines and we will establish two

connections with Target systems we will

be able to switch between both of these

connections and execute commands on both

of the systems

let me show you what they mean now don't

worry if you don't understand anything

in this tutorial we're going to code all

of this and I will explain it in the

future projects for now on just sit back

and enjoy the teaser

here we have the Kali Linux machine from

this cataly Linux machine I will use

Python 3 to run a command the control

center which is our program that we

coded I will run it right here and it

will tell us that it is waiting for the

incoming connections

okay so now if I go back to my Windows

10 machine which is this one I will have

this picture.jpg file which looks like a

normal image but if we execute it

it will also open up the image and

nothing else if we see nothing else is

being opened so everything looks

normally but this actual file in the

background opened up our back door which

is also a program that we're going to

code

if you go to Kali Linux

in just a few seconds we should see the

connection from our Windows 10 machine

while it is connecting to our Command

control center oh here it is so we got

the connection from

192.168.1.2 which is the IP address of

my windows 10. let's also run the same

file from my Windows 10 virtual machine

if I go right here double click on

picture.jpg click on run it will open up

an image and nothing else but it will

also run in the background our back door

let's go to our Cal Linux and see

whether we receive the connection

and here it is here's the connection

from the Windows 7 machine so now we got

two Targets connected to our commander

control center we can check all the

sessions that we have by typing targets

command it will print us session zero

with this IP address and session one

with this IP address right here

in order to access any of these sessions

we can simply just specify session one

which is our Windows 7 machine and type

who am I and execute all of the commands

such as ipconfig

such as deer in order to check all the

contents in that specific directory so

here it is if we want to we can also set

this session to the background

and clear the screen and we can enter

session 0 which is Windows 10 machine

if I type who am I inside of a Windows

10 machine I will see a different

response than to Windows 7 which means

we are on a different Target

if I type ipconfig

you will see a different IP address as

well as there will give you a different

output for that specific directory

okay we can use the clear command inside

of a shell in order to clear the screen

in case we have multiple commands

if I type the help command inside of a

shell function it will give us all the

available things that we can do with our

Target

we can change the directories using CD

command we can upload files download

files we can start our keylogger using

the key log start so let's give it a try

let's start our key logger let's type

key log

underscore start

it will give us a message that the

keylogger has been started so let's open

up Notepad

and start typing something inside of our

Windows 10 notepad so if I type how is

your day

question mark can you see this message

and we go back to our Calvin Linux

machine and we take a look at the help

command keylog underscore dump we'll

print the keystrokes the target inputted

so let's try it out key log underscore

dump

press enter and here we get notepad how

is your date question mark can you see

this message another question mark

we can also stop the key logger by

typing keylog underscore stop which will

stop and self-destruct the keylogger

file as it says right here

if we want we can also create the

persistence

which will allow us to start our back

door every time that the target restarts

their machine

so they only need to start the first

time and every other time our backdoor

will start on its own

and another interesting command that we

can do which is not specified right here

is the screenshot command so if I type

screenshot

and before I press enter let me lower

this so we can see everything

if I type screenshot and press enter in

just a few seconds we should have a

screenshot of the target's desktop saved

on our cataly Linux machine

so let's see whether we saved it

correctly if we go to the file

here is the screenshot saved under the

name screenshot 0.

and here it is it is the exact same

image that we saw before we pressed

enter on the screenshot command so we

successfully have the screenshot option

in order to capture the target's desktop

and that is just some of the options the

power back door can do and this Vector

is just one of the programs that we're

going to code throughout this course

so this is just a small teaser I showed

you what we are going to do

this is only a small portion of it or

just a small portion of what our back

door can do and we're going to see how

we can code all of this inside of the

future projects so thank you for

watching and I will see you in the

future lectures bye

welcome everybody to the first lecture

of our introduction section of our

python hacking course

so in this tutorial I'm going to show

you where you can find and how you can

download and install the virtualbox

software that we're going to need in

order to create our virtual machines

okay now it is rather easy to install

the software and as its name says we're

going to need it in order to host the

Cal Linux machine in which we are going

to write our python code so let's get

straight into how to download it so all

you need to do is go to your Google home

or Firefox whichever search engine

you're using and navigate to the link

virtualbox.org

once you visit this link it will lead

you to this page where it would tell you

to download virtualbox 6.1 now it

doesn't really matter which version you

are going to download they're rather all

the same so you can simply just click on

the newest one which in my case at the

moment is 6.1 click on download

and it will lead you to this page where

it will ask you for which type of host

you want to download the virtualbox

and right here under the virtualbox

platform packages you can choose Windows

hosts or sex hosts Linux distributions

and Solaris hosts

since I am running Windows 10

environment on my main PC I'm going to

navigate to the windows hosts and just

like that it should start downloading

the virtualbox installer file onto my

machine as we can see right here it is

not that larger file it is 108 megabytes

large so as soon as it downloads you can

simply just run it and install

virtualbox

the process of installation virtualbox

is rather easy but I'm still going to

guide you through the steps as to how to

install virtualbox

so as we can see right here there's not

much time left

okay so here it is

let's open this up

showing folder

I will paste it onto my desktop right

here

and all you need to do is run the file

we get a pop-up window which says

preparing to install

and here is the welcome window to the

fertile box we want to click next right

here

next here as well

and under the custom setup you can

choose which options you want to leave

unchecked and which options you want to

uncheck so for example I will leave all

four checked as I do one start menu

entries and I also want shortcut on my

desktop so I'm just going to click on

next right here

and this is a warning that usually comes

up once you install virtualbox which

tells you that during the installation

of virtualbox you might actually

temporarily disconnect from the internet

even though that never really happened

to me it might be the best idea in case

you're downloading something to actually

wait for that to finish before you

actually click on the yes to proceed the

installation since I am not doing

anything at the moment I am simply just

going to click here yes

and click here on install

and as it says right here this may take

several minutes usually it is around two

to three minutes it will ask us for the

administrator password we are going to

click here yes since I don't really have

a password to type in and it should

start installing virtualbox on my

machine

now you might notice that I already do

have virtualbox but this is 6.0 version

and this version is actually going to be

updated to the newest one which is 6.1

so I'm just going to wait for this to

finish and I will get back to you right

away okay so the installation has

finished and I'm just going to click

right here finish and it should

automatically start my virtualbox

and here it is now your window might be

a little bit different because I already

have some machines installed right here

and you should not see any of these

cataly Linux machines or Ubuntu machines

ovas machines on your screen this should

all be empty you should see these

buttons right here which new stands for

basically creating a new virtual machine

which we're going to take a look at how

to do in the next video for now on WE

successfully install Oracle virtualbox

and in the next video we're going to see

how we can install Kali Linux as our

operating system on the virtual machine

okay so thank you for watching this

tutorial and I will see you in the next

lecture bye

welcome back everyone since in the

previous video we successfully installed

virtualbox right now we want to see

where we can download Kali Linux which

version should we download and how we

can create a virtual machine okay so

right now if you go to your Google home

and navigate to the official Cal Linux

website which is the link kelly.org

downloads you should see this page which

will give you the latest version of Kali

Linux

in this case at the current time this is

2020.1 a and it is the size of 2

gigabytes

now as I mentioned this is the newest

version possible but I will not be using

this version in the course

the reason for that is it seems to be a

little bit laggy on my PC but if you

want to use the newest version and it

works perfectly for you feel free to

download it it doesn't really matter

regarding the course content so in order

to download it you simply just click on

Cal Linux 64-bit and it should start

downloading it over http

and you also have the option to download

it over torrent if you'd like

now for those of you that also do not

like the newest version you can simply

just go to another page which is

old.kelly.org which will have all of the

previous Kali Linux versions and their

release dates so you can download any

version you like in my case I will just

use the version before the newest one

which is 2019.4 you simply just click on

the Kali 2019.4

and it should lead you to this page

where you can download the ISO file for

the Cal Linux 2019.4 version

464-bit and 32-bit machine okay

so I would simply just download Cal

Linux 2019.4 and use this ISO file in

order to continue the installation if

you want to use the newest version well

then you download this scale Linux

64-bit or Cal Linux 32-bit depending on

your machine but you are most likely

going to have a 64-bit machine

so once you click on it as we can see in

just a few seconds it should start

downloading it but I'm not going to wait

for this because I already have the ISO

file downloaded so I will just cancel

this installation

I will navigate to my virtualbox and

let's see how we can use the ISO file in

combination with virtualbox to create a

calorie Linux virtual machine

also you might have noticed that I

already have a couple Cal Linux machines

installed right here I'm going to use

this one for the actual course but I

will show you how you can proceed with

the installation of the newest version

since it just came out and it has some

different options during the

installation that you might get confused

with so let's cover that as well you

simply just click on the new button

which will create a new virtual machine

it should pop up with this window where

it will ask you for the name and

operating system

you can name it anything you want I will

name it Neil Kelly

set the type of the operating system to

be Linux and the version to be Debian

64-bit in case you downloaded the 64-bit

version of cat Linux

now the reason we use Debian is because

Square Enix is Debian based therefore we

choose this option

click here on next and here it will ask

you for the memory size or the RAM

memory that you want to allocate to your

virtual machine

I would advise you not to go below the

one gigabyte of ram but you can also go

up to the 4 5 maybe even 8 gigabytes of

RAM depending on your actual machine

okay so I will just leave it on one

gigabyte

uh we want to leave the option create a

virtual hard disk now click on create

also leave it on virtualbox disk image

click on next and we want to set

dynamically allocated

here you allocate the amount of memory

you want to give from your hard disk to

the virtual machine and you should not

go below 20 Gigabytes especially in the

newest version which allows you to

download an install bunch of different

softwares used for ethical hacking so

I'm just going to leave it on 20

Gigabytes and click on create

and we can see the new Cali has been

added

now before we proceed with the

installation of the cataly Linux in the

next video we need to change a few of

the settings inside of this machine

so select your machine that you just

created click on settings and under the

storage settings you want to navigate to

the controller IDE delete this empty

part by right clicking on it and

clicking remove attachment

click on remove and then you want to

click on this circle with a plus

added the version of Cal Linux that you

downloaded in this case I have the

2019.4 and 2020.1 a and I'm just going

to show you for the purpose of this

tutorial the 2020.1 a

click on choose

now another thing that you might want to

consider in case you cannot see them

right here you can go on to the ad

and simply just find the ISO file that

you downloaded inside of your PC

wherever you saved it

okay

so let's click on cancel

and also another thing that you want to

change is under the network settings you

want to go to the attach to and click on

bridged adapter

also make sure that you leave it on the

ethernet cable connection since wireless

adapters know to actually present

problem inside the Linux and most of

them aren't even supported therefore you

might actually have problem connected to

the internet if you connect over

wireless adapter that's why it is always

the best idea to use ethernet cable

okay so once you finish all of that

click on OK and your new Cal Linux

machine is ready for the installation

so we're going to continue with that in

the next video we're going to pass

through all of the steps and then we are

ready to jump into the coding sections

of this course

now keep in mind that even after the

installation there are a few things that

you should do with Cal Linux I'll make

sure to leave all of the links below so

we don't waste time explaining the

catalytics and explaining the command

line and instead we can just focus on

the coding parts of the course okay so

thank you for watching this tutorial and

I will see you in the next lecture bye

welcome back in this tutorial we're

going to continue with the installation

of Cal Linux so we successfully managed

to set up all of the options inside of

our virtualbox and right now we are

ready to start our machine and install

the operating system I'm going to lead

you through all of the steps needed to

take in order to install Cal Linux and

then in the next video we are ready to

start hacking using python okay so all

you need to do right now is click on the

start button while you select your

cataly Linux machine

as we can see this is the first window

that we will encounter let me just

enlarge my screen it will ask us for

different types of options such as if we

want the graphical install or the usual

install it doesn't really matter we can

simply just go with the graphical

install and install the cat Linux like

that

okay so here's the next option that pops

up it will ask us to select the language

I will leave it in English

the location it doesn't really matter I

could just leave it on United States if

you like to you can select your own

location click on continue

and here it asks us which type of

keyboard configuration we want to use I

will leave it on American English click

on continue

now while this is installing another

thing I want to mention is another

reason why I don't really like the

newest version because it will ask you

to actually have a new user and not use

the root account in order to complete

your actions inside the Cal Linux and

that is also another thing why I prefer

the older versions because you can

simply just use root account to perform

anything you'd like now keep in mind

that using root account can cause some

security breaches but since we're using

a virtual machine this is just for the

learning purposes it doesn't really

matter that's why I chose the 2019.4

version of Cal Linux which I find better

and more suitable for this course but

right now here is the next option that

pops up which is the configuration of

network the hostname we can call it test

the domain name we can simply just

delete and leave on empty because we

don't really need it at the moment and

here is the option that they talked

about it will ask us to set up users and

passwords and this option didn't exist

in the previous versions only in

2020.18 version which is the one where

Instinct at the moment so you will have

to create a new user in this case I will

just call it test

username for your account will also be

test and here we choose a password for

the new user here you can type any

password you like I'm going to type test

one two three four

and also test one two three four

and click on continue

configuring the clock I will select

Eastern

the partitioning of disks we want to

select the option guided use entire disk

select the hard disk you created during

the previous video and click on continue

and here we want to set all files in one

partition as it does even say in the

brackets recommended for new users click

on continue

click finish partitioning and write

changes to disk we want to select yes

and click on continue

now this will start the installation

which will get interrupted with maybe

one two questions keep in mind that this

will take some time to actually install

especially the newest version uh it did

take me around 45 minutes to an hour to

actually finish all of the installations

and once it finishes that you should be

ready to use your catalytics machine

now we're just going to leave it right

here and if we get any pop-up question

I'm going to get back to you right away

okay so here is the first pop-up

question it is the configuration of the

package manager here you simply just

want to click on continue and leave this

blank

all right so here is another question

and this is actually the newest feature

of the Cal Linux 2020.1 a which allows

us to actually install desired tools and

not install everything that we might

never use but even though I would still

advise you to actually select everything

or at least select the most important

tools for Cal Linux especially if you

plan on using it later on even after the

course

now for our course it really doesn't

matter what you select right here as we

are simply just going to use Python 3

during our lectures

so right here you can use spacebar to

select different things such as Cali

desktop environment where you can select

everything if you want

it doesn't really matter just once you

select everything that you need

you can click on continue

and this installation right here will

take some time there will be another

pop-up question which will ask you

something along the lines whether you

want to install the grab about loader to

the master boot record where you want to

select yes

and after that I believe there will be

no more pop-ups and you should have the

installation complete and your Cal Linux

will be ready to use

so that would be about it for this

installation tutorial I will leave some

links in the resources of the lecture

where you can get familiar with the Cal

Linux a little bit more and where you

can perform top 10 things that everyone

should do after installing catalytics

okay so that would be about it for this

tutorial and in the next lecture we're

finally going to see how we can download

and install pycharm which we are going

to use for creating our programs

hope I see you there and take care bye

welcome back now that we got our

catalytics setup and ready all we are

left to do before we can start coding is

install the pycharm

now what is pycharm you might be asking

well pycharm is an integrated

development environment used for

computer programming especially aimed

for python programmers it is also a

cross-platform so you can get it for

Windows Mac OS and Linux systems if

you'd like

now let's see how we can actually

download it

first of all we need to open up our

Firefox and depending on which version

of Cal Linux you are running it might be

located on the left side of the screen

right here in case you're using the

newest version and in case you're using

the 2019.4 version like I am you simply

just go to this icon right here type in

Firefox

and click enter

it will open up the Firefox for you and

then we can navigate to the Google

search bar and type pie chart

click on the first link that pops up

and then click on download

you will see that it will automatically

realize that we are running Linux

systems and we'll get two different

versions available for download we get

the professional version and the

community version now since the

community version is free and open

source we're going to download that one

instead of the professional version

in just a few seconds this pop-up window

should come up and it will ask us

whether we want to open the file or save

the file in this case we want to save

the file click here on OK

and right here under this Arrow if you

click on it you will see that it has

started downloading pycharm on our Cal

Linux machine

now while this is downloading I just

want to mention one thing so I will just

lower this

and I will open up the terminal which is

this icon right here

in case you are using the newest version

you will not be a root account inside of

the terminal you will simply just be a

user that you created during the

installation which is showed in the

previous few videos

if you're using the the 2019.4 version

like I am you will not have a problem

with root account as you will simply

just be the root account every time you

log in as we can see right here

now let me just zoom this in so we can

see everything a little bit better

okay so it's good now uh therefore some

of the commands that we run will require

root privileges and I just want to show

you how you can run them for example

let's say the command who am I

requires root privileges now it doesn't

but let's say it does

if you're using a simple user account

and not a root account in order to run

the who am I command and not get the

access denied error you can simply just

type sudo who am I

now on the newest version of Cal Linux

it will ask you for the password of your

own account you simply just type it in

and it will execute this command and

give you the output okay

so I just wanted to mention that in case

you run into some errors where you

require root privileges in order to run

and now let's see if our download has

finished we have 73 more Megabytes left

so I'm just going to wait for this to

finish and then we will proceed with the

installation

okay so it is finished we want to click

on this icon right here which will open

up the folder where our pytarm is

located we can close the Firefox as we

no longer need it and right here we can

see that the pycharm is located in the

slash root slash downloads directory

now on the new catalytics it might be

slash the name of your account and then

slash downloads

so let's navigate inside of our terminal

to that directory slash root

slash downloads

type LS and we can see pycharm is right

here

now you might notice that it has the

extension of dot star.gc which simply

just means that this is a packed file

and we have to unpack it before we

actually run anything from it in order

to unpack this you could simply just

type the command tar and then Dash

xzf and then the name of the file

you can simply just type py and then tap

in order to auto complete the name so

you don't have to bother typing all of

this by yourself

press here enter and in just a few

seconds this should be unpacked

okay so here it is once we type LS once

again now we will have another director

which will be the unpacked python

directory

so let's navigate to there using the ecd

command

type LS and we will see bunch of files

and directories inside of this pycharm

directory we want to go to the bin

directory type LS once again

and inside of this pin directory we want

to run this pycharm.sh file now you

might notice that this is a DOT sh

extension therefore we need to run it

using bash we simply just type in bash

and then pycharm.sh

now this is another command that might

require root privileges in order to run

so in case you are using the newest

version of Cal Linux and you are not

root account you simply just type sudo

and then bash pycharm.sh type in the

password and this should execute with no

problems

so let's run this

it will run the pycharm.sh program and

it should start pycharm for us

here it is we got pycharm opened up and

before we actually click on create new

project we want to go down here under

the configure

and click on create desktop entry

we want to check create the entry for

all users and click on OK

once we do that we can simply just click

on create new project

call it test since this is the test

project and we're not going to code

anything inside of this project and it

should load up this window right here it

will create the virtual environment for

you it will give you some tips for the

programming and also for the pycharm

which we are not really interested in

and when everything is done and

everything is loaded up we should be

ready to code so let's click on close

right here let's enlarge this to so this

is how pycharm looks like now in order

to create a file and start coding you

can go to the test right click on it

click on new and then python file let's

call it test Dot py

and it will let you code Python program

right here

so you can simply just type print

hello world

and then go under run

the program

from the test

and here it is the output which says

hello world

now if you install python for the first

time these letters right here might be

too small for you let's see how we can

increase the font of these letters so

you can go on to the file

go to the settings

under the settings you want to go to the

editor

click on font

and under the font you can change

whichever font you like so let's say 22

click on OK and the letters are now

larger

so now that we got the pycharm ready in

the next section we're going to start

off with our first project which is

going to be a port scanner in Python 3

okay so that would be about it for this

tutorial thank you for watching and

let's get straight into the hacking in

the next section take care bye

hello everybody and welcome to our first

project where we are going to code our

own port scanner using python 3.

so in the previous section we introduced

ourselves to Cal Linux we installed

pycharm and now we are ready to start

writing our code

before we start let's first explain what

is the purpose of a port scanner but it

will do and how are we going to create

it

well first of all a port scanner is a

program that allows you to scan Target

machine and discover whether it has some

open or closed ports for example we all

know that the port 80 is used in order

to serve HTTP and in order to serve a

website page

now how would you actually discover

whether Port 80 is open without visiting

that page

well using our Port scanner we can see

whether we can connect to that Port 80

or whether we cannot if we can connect

that means that the port is open and it

is most likely hosting a web page there

and if we cannot connect that means that

the port is closed simple as that

so that will be the Baseline and the

base part of our program

now let's open a new project and to do

that we can go right here onto file and

then new project here we can call it

Port scanner

click on create it will ask you whether

you want to open the new project in this

window or in another window I will

simply just select this window right

here

it will create the virtual environment

for this project and then we can start

coding

now here it is the port scanner we will

click on new

and then python file and we will call it

port scanner.py

okay python file we created it let me

just enlarge a little bit more the font

size

so once again to the editor font

and right here let's go 24 apply and now

we are ready to go now for this project

we are going to need two different

python libraries we're going to need to

import the socket Library

and we're also going to need to import

a library called

ipy and we're going to import it like

this from ipy

import IP

now right away

you might notice that the ipy and IP are

both red underlined this means that the

pi charm cannot recognize this library

and cannot find it

so before we actually start using it we

need to download it first

now there are a few ways we can actually

download it you can download it using a

regular terminal which we are going to

do as a first try

right here so I will just

put it like this so we can see

everything

now in order to install a desired

Library using the terminal you have to

use a command called pip3 install

now pip3 is a byte of Python 3 and it is

used to actually install Python 3

libraries that are missing and that you

need in order to run your program

okay now if you're using a new Cal Linux

you most likely won't have pip3

installed and in order to install it you

simply just typed apt install

python3 Dash pip

press here enter and it will install it

for you for me it is already been

installed so we can continue right away

let me clear the screen and launch this

a little bit just in case you cannot see

what I'm typing

and let's get the library that we're

missing so pip3

install ipy press your enter

and it will say requirement already

satisfied

now this might seem confusing because

two minutes ago I just told you that we

are missing this library that we cannot

find it

and here inside the terminal it says

that the requirement has already been

satisfied and that we already have this

library at this location

well that is another part of the pie

charm that you need to understand

pycharm simply creates a virtual

environment every time you create a new

project that means that the library that

you have installed inside of your Cal

Linux doesn't necessarily have to be

installed inside of your pycharm program

therefore this ipy library has not been

installed inside of this virtual

environment so where can we install it

well you can go here on Terminal and you

will see right away that before the root

Cali and then the actual directory we

have this VNV inside of brackets which

stands for virtual environment

so right here if we type the same

command which is pip3 installed and then

ipy press here enter

you can see that right now it is

successfully downloading it and it has

downloaded it inside of our virtual

environment right now if we lower this

go right here you can see that this is

no longer red underlined and now we have

both of our libraries ready to use

so I just wanted to show you that

because it is really important and we

will be switching between libraries

throughout the entire course so it is

important for you to understand the

meaning of a virtual environment

therefore once you next time try to

install a desired library that is

missing from Pine charm don't use

calendar next terminal like this you

simply just go down here and inside of

this python project you can install the

desired library inside of the virtual

environment

so now that we imported the desired

libraries in the next video we can start

finally coding our Port scanner

see you there bye welcome back everybody

let's continue with our Port scanner so

what we did by now is we imported two

libraries that we need in order for our

program to work let's get straight into

coding the main program

okay so first thing let's think about it

what we need to logically do in order to

discover where the report is open or

closed

well we need to establish a connection

with the target machine and then we need

to try to connect to the specific Port

if we manage to connect the port is open

if we don't manage to connect the port

is closed

now there is another thing that can

happen and that is that the port is

filtered but we are not going to cover

that at the moment so first of all let's

see how we can establish the connection

here is where we use the socket Library

socket Library allows us to establish

the connection over internet so how can

we do that well it's rather easy and

it's something that we will use

throughout this course a lot it's a same

shim of a few different lines of code

that will allow us to connect to the

Target machine

so in the first line we will Define a

socket descriptor

we do that by specifying the name and

then equals socket.socket

just like this we Define the socket

descriptor and you can name this

anything you want it doesn't have to be

named sock it can be named s but for the

purpose of this tutorial we're going to

leave it on sock as soon as we do that

we can try to connect to the Target

machine

so sock.connect

and inside the disconnect function we

need to specify two open and two close

brackets and there we need to specify

the IP address

and the port that we want to connect to

all right now you will see right away

that once again this IP address and this

port is underlined red that means that

this is not defined so we need to Define

what IP address is and what port is

what we're going to do is we're simply

just going to create a variable which

will be called IP address

and we're going to set this variable to

be equal to whatever the user of this

program inputs during the running of the

program

now what they mean by that is we're

going to use the input function which

allows us to add the runtime specify the

IP address that we want to scan

so we're going to prompt to the user of

this program

something like this

enter Target to scan

okay

now that we have that we also need to

define the port

and let's say the port will be port 80.

it will be a simple integer so we're

going to select it like this and now our

code is good to go

all we are left to do is we're left to

wrap this inside of a try and accept

Rule and this try and accept rule

basically means that we are going to try

this and in case that doesn't work we're

going to try something else which will

be under this except part so try and

then sock dot connect we are trying to

connect to the port and if we don't

manage to connect we're going to print

to the screen

that's the port

is closed

and one can simply just specify Port 80

is closed because we are scanning that

port

if we do manage to connect we can print

Port 80 is open okay so this is the base

part of the program let's see whether

this works now in order to test this and

see whether it works I'm going to pick a

random IP address which in this case

will be the IP address of my laptop and

in your case you can simply just scan

any website on the internet for example

let's say we go to Firefox

and we can visit any website we want now

keep in mind once we actually manage to

visit the website that means that the

port 80 is open because we are loading

the web page so let's go to this one

you can choose any you like I'm going to

scan this one

okay so let's copy this

this is the name of the website

let's go right here inside of our

terminal and let's try to run the

program Python 3 and then the name of

the program which in our case oops

in our case it is

Python 3 or scanner.py

it will ask us to enter the target to

scan now you will notice if you specify

like this so we paste the name of the

website and we click here enter it will

tell you that the port 80 is closed

now why does it tell that is the port 80

really closed well not really since we

actually managed to open it right here

on our Firefox therefore something is

wrong with our program

well we cannot really specify the link

to the actual website so how can we

discover the IP address to this website

well we can use something called

nslookup

and we specify the actual link

press here enter

and what this will do whoops it says

cannot find let's just try like this

without the http www and then the name

of the website

okay so here it is now we are able to

retrieve the IP address to this specific

website

what if we copy this IP address and go

with this so copy

and let's clear the screen and run our

Port scanner once again enter Target to

scan we paste this and now we get the

correct result it says Port 80 is open

okay so for now on what we did we

created two simple variables one will

host the IP address that we input during

the running of the program and the other

one will host the port number 80. so we

are not inputting this we are not

changing this this will simply just

stick to 80 for now

then we try to connect and if we manage

to connect we print that the port 80 is

open if we don't manage to connect we

print Port 80 is closed

okay so good for now we discovered that

the port 80 is open on this specific

website that we scanned

but this is not really what we want

right we want to actually scan multiple

targets we want to scan all ports or as

many number of ports as we like we want

to print which port is open which Port

is closed

and ideally we also want to connect to

that port and see which software is it

running on that open port

now that word scanner would be a really

good one

so let's see in the next few videos how

we can Implement all of that we would

also like to change this program to also

accept the links and not just the IP

addresses so you saw previously we

couldn't really specify the link it gave

us the wrong result because it cannot

really connect to a link inside of this

program but we also want to make sure

that once the user of this program

specifies a link such as www.google.com

it will also manage to discover open and

close ports so we're going to see how we

can perform all of that in the next few

lectures

for now on we created the base part and

we are ready to continue coding on

alright so hope I see you in the next

tutorial bye

all right welcome back let's continue

with our Port scanner what we did by now

as you can see from the previous video

we only discovered that the port 80 is

open on the website that we scanned

so what we need to do now is we need to

wrap this code inside the function

and let me show you why we are doing

that if I simply Define a function which

will be called scan underscore port

and for those of you who don't know to

define a function you simply just type

Def and then the function name

this function will take two parameters

which will be the IP address

which were defined at the beginning of

the program and it will also be report

okay

we specify two dots and now we need to

tap all of this code in

so it can belong to the function that we

created

okay so here it is what this function

will do is it will scan the port and it

will define whether it is open or closed

now another thing that we want to do is

we don't really want the ports to be

already predetermined for example let's

say that the user of this program wants

to scan Port 22 which is the SSH Port

well we want to allow them to actually

do that so we need to remove this port

equals 18.

and also from these comments right here

we want to type

port

and then we are going to type it like

this

Plus

string from the port and the reason why

we are using the string function onto

this port variable is because the port

variable will hold an integer value

therefore once we actually try to print

it we will get an error if we try to

print an integer value so we need to

convert it first to string using this

Str function and then we can print this

so for example if the for if the port is

number 23 this will print Port 23 is

open

we also need to do the same right here

string from Port

okay so Port 23 is closed and now let's

test our function but let's add a little

bit of a Twist to it so what we want to

do is we want to scan first 10 ports on

our website

all right so how can we do that well we

don't have a port specified at all so we

need to iterate over numbers 1 through

10 and then specify for each number that

the port is equal that exact number

let me show you what they mean so right

here if I go all the way down and below

the function I specify

for Port

in range

one to ten

I want to perform a function scan oops

underscore port on the IP address

with the port number

so what this will do is it will go for

port in range from 1 to 10 so first of

all Port would be number one we want to

scan the IP address with the port equal

to one then it will perform this task

right here

then it will go back

change the port variable to be equal to

2 and then it will perform the same task

just with the port number equal to 2.

also what we want to do is we want to

copy this

copy then we can delete it

and we can paste it below the function

right here

okay now let's see whether this works

so once again for this feel free to scan

any website you want I will simply just

go with the same website that we used in

the previous video and once again in

order to discover the IP address of the

link We simply just type nslookup

and then

the link to the actual website copy IP

address

copy

and then let's run the program

enter Target to scan we select the IP

address here it is

and now it is scanning first 10 ports

now right away you can notice that it's

not really printing anything it is

actually going rather slow and it is

still not even finished with the first

Port now we don't really want this we

want our Port scanner to work faster so

how can we fix this well first of all

Ctrl C onto the program

right here and then inside of our scan

Port function we need to add another

line

which will be

sock dot set

timeout and we want to set the timeout

to be equal to 0.5 seconds

now keep in mind also that the accuracy

of the scan will depend on the length of

the timeout so some ports will take a

longer to connect to and some ports will

take less to connect to if you simply

just leave it without timeout the

accuracy will be the highest the lower

the timeout the smaller the accuracy but

this is a price that we want to pay in

order to actually scan the target faster

so let's see whether this worked so

Python 3 Port scanner

we paste the IP address and we can see

Port 1 is closed and all of the 10 ports

are closed on our website

so we scan ports 1 through 10.

okay now this is probably correct for

the website that I'm scanning but how

can we check that well in the previous

video I scanned the exact same website

and I scan the port 80. so how can I

check whether this is working correctly

well instead of the range 1 through 10 I

will simply just type

75

through 85

and most likely all of the ports will be

closed except the port 80. so let's see

how this works Python 3 Port scanner

paste the IP address

all the ports are closed and we have one

port open and that is port 80. okay so

our program seems to work really well

okay so we discovered that we need to

set the timeout in order to actually

scan ports faster

we lose the accuracy but we gain on time

in the next video we're going to take a

look at how we can convert the link to

an actual IP address

for example we're going to take a look

at how we can convert our link of a

website to an IP address inside of our

program so whether the user of this

program specifies a link or an IP

address this will still work

okay so I hope I see you in the next

video and take care bye

welcome back everyone let's continue

with our Port scanner so what we did by

now is we simply just created this

function which allows us to scan the

ports and we also saw how we can use for

Loop in order to iterate over a certain

amount of ports and scan each and every

one of them

but right now let's see how we can

Implement a function that will allow the

user of this program to specify the

domain name as well as the IP address if

they like

well here is where our ipy library comes

in help

so you will notice that this is still

gray that means that we haven't used it

inside of our code and that will change

now

so

we'll simply just create a function up

here which will be called let's say

check underscore IP

and this function will take one

parameter which we will specify inside

of these brackets and that parameter

will be the IP address okay

now before we code any of this function

we need to specify all the way down

what we are going to provide to this

function and by that I mean which

parameter are we going to send well

logically in our case we're going to

send the IP address parameter keep in

mind that this IP address variable

doesn't have to store the IP address it

can also store the domain name

so what we need to do is we need to

simply just after the user specifies the

target we'll simply just call the

function check underscore IP and we will

paste the IP address

inside of that function

then we are going to store all of this

inside of a converted

underscore IP and you will see in just a

second why we are doing this so right

here we are going to scan the converted

IP address

and the port number

okay so let's code function above so

obviously we need to use this library

right here and this actual Library comes

with a specific function which is simply

called ipfunction okay

so if I go to my Google home and I have

a page opened right here which is

basically the documentation of the ipy

library we can see that they use right

here this IP function in order to

convert an IP address to the IP format

so in order for our function to work we

need to specify inside of the brackets

the IP address which is the parameter of

our function

if it manages to convert the IP address

that means that this works successfully

and that the user actually specified the

actual IP address to the Target if it

gets an value error that means that the

user specify the domain name

so let's write that right here and in

case you don't understand we are going

to test this so don't worry we're going

to try to convert the IP address

and if it manages we are going to return

simply what we sent to the function

which is the IP

and in case it doesn't work we are going

to get the value error

which means that the user most likely

specified the domain name and therefore

we're going to return a function which

belongs to the socket Library which

allows us to convert the actual hostname

to the IP address so all we need to do

is specify that function and call it

upon our IP address and we can do that

by simply specifying return socket dot

get host by name

and here we specify the hostname or in

our case the IP which we paste it to our

function okay so this is our internal

function now let's see inside of a

terminal

and let's open up our python 3.

and here we can import IP oops let me

just do it like this first of all I will

enlarge this so we can see it better

open Python 3 import or

from ipy

import IP

and now let's say we have a variable

called IP address

and it will be

192.168.1.1 okay and now if I simply

just call converted IP

equals

IP from IP address

and I print the converted IP

you will see it will still be the same

IP address so it really didn't change

anything therefore right here if it

manages to do that we're simply just

returning the IP address that we pasted

inside of this function and we are not

making any changes to it

but that is only the case if this user

specifies the IP address if the user

specifies the domain name so let's

create a variable called domain name

equals and then let's say

google.com

and we try the same thing so converted

IP

equals IP

from the domain name

and you will see we will get an error

and it will be the value error

so that is the case right here

then we are going to perform the get

host by name which will retrieve the IP

address of the google.com and then we

will return the IP address inside of our

scan Port function

so that is all there is for this

function now let's see whether this

works

okay so let's run the program Python 3

and then Port scanner

enter Target to scan let's say we enter

let's say the same website as before

let's not change it right now and

instead of the IP address we now enter

the domain name

we're going to leave this to run and

here we can see that it works

successfully as it did manage to find

the port 80 open we will get the same

result even if we scanned with an IP

address so right now we can specify both

the domain name and IP address so that

is good

now in the next video we're going to

take a look at how we can specify

multiple targets and scan multiple

targets at once

so we don't have to run our program over

and over again we can do the same thing

just by specifying multiple targets

inside of our program

and it will scan them one by one

so we're going to take a look at that in

the next tutorial hope you enjoyed this

small lecture and I will see you in the

next one bye

welcome back everybody and let's

continue with our Port scanner so we

managed to create a function that will

convert the domain name into an IP

address and now we want to be able to

specify multiple targets for our program

to scan

okay so how we can do that well it is

rather easy we're going to implement a

little bit of changes down here at the

bottom of our program so here you will

notice that we have the variable called

IP address

now it says enter Target to scan

well we could simply just do something

like this and specify to the user of

this program that they can also enter

multiple targets by typing Target slash

S

and also we're going to specify to the

user

split multiple targets

with

comma

okay so simple as that let us make this

a little bit better but this is just the

part where we prompt the user how they

can specify multiple targets now we need

to actually split these targets and scan

each one of them one by one

so how can we do that well first thing

we're going to do is so we don't get

confused we are going to rename this

into targets variable

and then what we're going to do we're

going to delete this line for now

we're going to specify if and then

comma

in targets

if there is command targets logically

that means that the user of this program

specified multiple targets to scan if

there is not comma inside of the targets

variable that means that the user only

specified one target to scan so we're

going to lead by that logic

so if comma is in targets then for IP

address

and we're going to call it simply just

IP underscore add

in targets

and we're going to call the function

called split

and what this function does is basically

it will split the string

with the character that we specify

inside of the brackets so we want to

split at every comma if we split at

every comma that means we're going to

split all of the IP addresses one by one

therefore we're specify right here for

IP address in targets.split we want to

scan each and every IP address so scan

port

IP address

and then

so we want to scan each and every Target

from this list and in order to do that

we're going to create a function which

is going to be called scan now I know we

do have a scan Port function but we're

going to use this function in order to

scan one single port one by one

and we're going to call this scan

function in order to scan each and every

Target and also convert the domain name

into an IP address if needed so all that

this function will take as a parameter

will be the IP address which we'll get

from this for Loop right here okay we

also want to strip it from any

unnecessary empty spaces in case there

are some

and right now all we need to do is code

this function let's go all the way up

and call the scan function onto the

target so this will be one single Target

and first we need to do is to get back

the line that we deleted before which is

the conversion of the IP address so

converted underscore IP

will be equal

to check IP which is our function that

we coded in the previous lecture and we

need to check the IP address

from the target which is our parameter

inside of the function

okay and now we will print just so we

know what we're doing we're going to

print

first of all new line character

which is backslash n

[Music]

Plus

and let's make some type of a smiley

right here which will look something

like this so

and let's print scanning Target

we also want to specify which Target are

we scanning in case there are multiple

ones so we'll specify the string of the

target which will be either the domain

name or the IP address

if we specify plus the string of the

converted IP it will only specify the IP

address since it will already be

converted from the domain name

but we don't want that we want to

specify plus the string of Target which

will be the names that the user

specified to the program and then we

need to copy this part from Below which

is four port in range

scan each and every port

let's copy this we no longer need it

right here we can delete it from here

and we can move it inside of our scan

function

so right here

let me just tap this properly and we're

going to change a few things if we need

so for porting range 75 to 85 we can

change that right away for example from

Port 1 to Port 100 and you can keep this

number as low or as high as you want

just for the purposes of this tutorial

we're going to leave it on only scanning

100 ports since most of the ports that

we want to see whether they're open or

closed will be in the first 100 ports

okay

and then we will call the scan Port

function onto the port number and also

onto the converted IP which we converted

in the first line of our function

okay so everything makes sense now

another thing that we need to change

down here

since we specified if comma in targets

that means that the actual user

specified multiple targets to scan but

what if they specify only one target

well then nothing of this will get

executed and we will not really scan any

Target throughout our program it will

simply just exit the program without

scanning the target

so we need to add an else statement

right here

so if command targets else

we want to scan the targets simple as

that because in this case the targets

will be just one IP address or one

domain name then it will jump from that

function to the scan function which will

convert that IP address and it will

perform this scan Port function onto the

first 100 ports

okay so everything makes sense now let's

see whether we have an error inside of

our program or if everything works

perfectly okay so let's see how we can

run it let's open up our terminal

and navigate

and first I will enlarge this so we can

see everything

and we need to navigate to our pycharm

directory it will usually be in the

slash root directory so here it is

pycharm projects I will CD to that

directory type LS

we have the test directory which we

created once we install the pycharm and

we have our Port scanner directory or

our Port scanner project so let's change

the directory to the port scanner type

LS once again and here is our port

scanner.py

I will clear the screen and I will run

the program

first of all let's try it with one

target

so

let's switch it up a little bit I will

use my actual router IP address in order

to perform test of this program so I

will type 182.168.1.1

press here enter and you will see it

will perform the scan really fast

because my router is close to me

therefore we can see most of the ports

are closed we have the port 22 open for

23 open

let's see which ones are also open port

53 open for the DNS and Port 80 open all

the other ports are closed okay

so right away we can notice that this is

not really that good to look at we don't

really want to print the closed ports as

there is too much happening right here

especially if you scan more than 100

ports it will be really hard to find all

of the open ones so let's see what we

can do inside of our program in order to

print only the open ports okay so right

here whoops

need to go right here inside our code

and in the scan Port function is our

print statements for default open and

Port closed so what we can do is instead

of Printing Port is closed we can delete

this

and we can simply specify pass

now what this will do is it will not

perform anything it will not print any

statements it will simply just pass in

case the port is closed okay simple as

that let's test it once again Python 3

Port scanner.py specify the IP address

of my router once again and this is a

lot better we can see scanning Target

and then the actual IP address of my

router and then which ports are open and

it is the exact same four ports that we

saw before

let's try another Target let's specify

actually two Targets now

if I run the program

and for this test you can specify the

same Target as I will which will be an

actual domain name

which is called test PHP Dot oneweb.com

okay

so let's specify this Target and also

you can specify any other random IP

address or domain name if you want in

this case I will specify once again my

router so we have a mixture of the

domain name and the IP address so we can

see whether this will work properly if I

press enter it will first start off with

this domain name right here and it will

scan for the open ports and then it will

proceed to the IP address of my router

and scan the open ports for that router

as well

so we can see on the first link it found

four ports open for 21 22 53 and 80 and

on my router the same four ports as

before

program works correctly

we're almost close to finishing our

program but there is one more thing that

we actually want to do we want to also

print which service is running on an

open port

for example let's say we want to

discover whether Port 80 is running

Apache 2 or some other version of a web

server

well we can do that by simply grabbing

the banner on an open port and more

about that in the next lecture for now

on we are glad that we can scan multiple

targets whether they are specified as a

domain name or as an IP address we can

split them by comma we can also scan one

target if we want and we also print only

open ports as we are not really

interested in the closed ports okay so

thank you for watching this lecture and

I will see you in the next one bye

welcome back everybody and let's finally

finish our Port scanner as I mentioned

in the previous video we're only left to

do one small thing before our Port

scanner is complete and ready to use and

that is to perform the banner grabbing

on the open ports to discover which

services and which softwares are running

on those open ports which can give us

even more detail and information that we

can use in our future attack okay so

what we need to do

is let's first of all think how we can

actually grab the banner from an open

port well logically we need to connect

to that Port we need to try to receive

something from that open port and then

read that information that we received

from that port

so we already performed half of that job

we connect to that Port right here at

this line

so all we're left to do after it is

check whether that Port retrieves some

information or send some information

back to us once we connect okay so how

can we do that well right after the

connect function we can try to retrieve

the information

we're going to use a specific function

to do that and we will store the result

of that function inside of our variable

which we will name Banner so Banner will

be equal

uh to the function which will be called

get banner and that function will take

as a parameter the socket object

so we're pasting our socket object

inside of this function so we can use it

inside of it and then we will retrieve

the actual Banner if we manage to get it

to the banner variable

all right so let's first of all code

that function we can do it right here

between the scan port and check

ipfunction and we will call it as we

already said get Banner

this function will take the socket

object as a parameter which we already

pasted inside of our scan Port function

and all we need to return from this is

we need to return the socket object and

then dot receive which is the function

that receives the data from this open

port

we can also specify inside of the

brackets which amount of bytes we want

to receive and usually this number is

specified as 1024 bytes as we don't

really need more in order to get and

print the banner okay so this is the

entire function the entire get Banner

function now we need to perform some

modifications right here inside of our

program

so we have the function right here

and we try right here to store the

banner inside this variable okay

now if we do manage to store it we're

going to print

port and then the string of the port is

open

but let's change it up so it looks a

little bit better so we're going to

delete all of this and print the exact

same thing just with the Bender attached

so we're going to print something like

this let's add the plus sign which means

that the port is open so open port

and then space we will add the string of

the port number that we are scanning

so plus the string of port

and then the next thing we want to do is

plus and we want to add the banner let's

separate it with two dots

and then add or concat the string from

the banner

to our open port number so we are going

to leave it like this

let me just see another thing that we

need to add is another accept statement

right here so accept in case we cannot

get the banner we're only going to print

open port and we're not going to print

any type of banner as we didn't really

manage to retrieve it so open port

plus the string of port and that is all

we need to do right here

now let's see whether this will work

if we open the terminal

right here

and large

the letter so we can see everything and

navigate to pycharm projects and then

Port scanner

then we try to run the port scanner and

specify

same two websites as in the previous

video so test PHP Dot oneweb.com

let's first of all try with this one

it will scan the Target and we can see

right here we do manage to retrieve some

of the banners from two different open

ports

so here it is we got the banner for the

open port 21 and now we know the

diversion of the software running on the

open port 21 which is the FTP Port is

pro ftpd

1.3.3 e server and what we can do with

this information we can simply just copy

this paste it inside of a Google and see

whether there is any type of exploit for

this specific version of the FTP server

we can also perform the same thing for

the SSH which is on Port 22 we see that

the version is SSH 2.1 open SSH 5.3 P1

Debian Ubuntu then we can copy this and

try to find it on Google for some and

try to find some vulnerabilities for

this version in Google

simple as that

but let's make our actual output a

little bit prettier we don't really want

it to print this B and then the

apostrophe and we also don't want it to

print the slash r or the backslash R

backslash n which seem to just stand for

the new line character okay so let's see

how we can get rid of that well in the

part where we are printing the banner if

we take a look at the hour output we can

see that the banner output starts with b

and then apostrophe

that is because we haven't really

decoded our Banner

once it actually receives the message or

receives this 1024 bytes those 1024

bytes will be encoded by default

in order for us to remove that b and the

apostrophe we can simply just type

Banner dot decode

which is a function which will remove

that and we also want to strip the new

line character so how we can do that

well we can add another function to this

Banner which is dot strip

and right here we can specify

backslash n

for example let's see whether this

worked if I go right here

and type same website test PHP

Dot oneweb.com

here it is now we got the prettier

output if you compare this one

with this one you will notice we no

longer get this B apostrophe and this

backslash R and backslash n

all right so great our Port scanner

works let's also test it to see whether

it works on multiple targets so I will

clear the screen

run my port scanner

specify for example three targets which

one of them will be this one which we

used in the first lectures of our Port

scanner then we can use the IP address

on my router

and then we can use the same test PHP

Dot oneweb.com

it will go and scan one by one first of

all it will start with this IP address

right here if it manages to find open

ports it will print them out if it also

manages to grab the banner it will also

print that out it will also print the

banner out as well next to the open port

then it will proceed to the next two

Targets and perform the exact same task

on both of them

now you might notice that some targets

will go slower in scanning and some

targets will go faster and that is

pretty much normal keep in mind that

this part right here which is the socket

dot set timeout is crucial in order to

get more or less accurate scan

if we simply just remove this line then

some actual targets might be scanning

for hours depending on the distance and

the open ports that they have and also

the services that they are running

sometimes it might take longer to

connect to those ports and so on and so

on therefore it is always good to set a

timeout so you don't have to wait an

entire day for your scan to finish

but by lowering this timeout you will

also lose the accuracy of your scan for

example let's say we have a port that

takes one second to connect to and you

set the timeout 0.5 seconds

well then after 0.5 seconds it will

determine that this port is closed even

though it is not it just takes longer to

connect to therefore you will lose the

accuracy and you will not know that that

port is open

so this part right here which is the

timeout is completely up to you you can

change it to whichever time you want

let's go back to our scan and we can see

all three scans have finished on the

first Target we only found one open port

we didn't manage to retrieve any Banner

for it on my router we found four open

ports and Port 22 sent the banner back

to us and now we know which version of

software it is running

and the target number three we already

scanned and we got the exact same result

okay so our Port scanner is complete it

can scan multiple targets it retrieves

the banners

and now we are ready to use it for our

penetration testing okay so in the next

video we're going to go really fast over

this code so we can explain it once

again for those of you that have some

inconvenience or if there is something

that you do not understand I will simply

just go fast through that code and then

we're going to see how we can also

import our Port scanner into another

Python program if we want to

after that video we're going to proceed

to our next project okay so thank you

for watching this video and I will see

you in the next one bye welcome back

everyone and this is the last video to

our Port scanner project

right now what we're going to do is we

are going to first of all recap what we

did inside of this program

so we're just going to go to the program

code real fast and explain what

everything is doing once again

and then I will show you how you can use

this program and import it inside of

another program so you can use it all

right so first of all let's navigate all

the way down to the beginning of the

program here as you can see we prompt

the user to input the Target or multiple

targets we then check whether they

specified one target or multiple targets

if we find comma inside of this variable

that means they specified multiple

targets therefore we will split all of

those targets and for each and every IP

address inside of this variable we will

perform the scanning of that IP address

in any other case that means if we

didn't find comma that means they only

specified one target therefore we are

going to perform the scan function onto

the targets variable as it is only

storing one IP address or one domain

name okay

then once we navigate to the scan

function

here we first take the converted IP

variable and then we perform the check

IP function onto the specified Target if

the specified Target is simply IP

address we will return that IP address

and it will be stored inside of the

converted IP in case the target is an

actual domain name therefore we're going

to perform this socket get host by name

method which allows us to convert the

domain name into an IP address

okay

right after we convert the IB address we

scan for 100 ports now this number keep

in mind can be changed for example you

can scan for first 500 ports if you'd

like it doesn't have to be 100 this is a

number that you can change now another

thing that you might want to implement

in this program if you want is you can

also prompt to the user for how many

ports they want to scan

how we would do that but we will simply

do that by specifying something like

this you go to the beginning of the

program and there you can simply type

Port num let's say we call the variable

like that and then input

enter

number of ports that you want

can

then the user would enter the number of

ports

oops let's not leave this to to be

Capital let's leave it like this so

enter number of ports that you want to

scan then you would take this actual

variable and you will also paste it into

the scan function

once you do that if you go back to the

scan function right here you would

simply have something like portnum

as a parameter and then you would have

for porting range one through port

number so you wouldn't have 500 you

would have something like Port num

so simple as that

but we're not going to leave it like

this let's just leave it as the way it

was before this is just something that

you can Implement and leave it in the

program if you want in this case we are

not going to use that since it is not

necessary we simply just always want to

scan for first 500 ports

so I will delete this

also keep in mind if you leave that

option you also need to specify the port

number inside of this line right here

and also inside of this line right here

as a second parameter to the function

okay so once we get to this for Loop we

scan for each and every port between the

range of 1 and 500 and we do that by

using the scan Port function

so let's go to the scan board function

and this is the main part of the program

here we create the socket object we set

the timeout so we don't actually waste

too much of our time trying to figure

out whether a port is closed or open

keep in mind that the accuracy of the

scan will depend on the amount of the

timeout that you set the lower the

timeout the lesser the accuracy the

harder the timeout the bigger the

accuracy okay so then we perform the

connect function onto the target IP

address and the port number

right after it if we manage to connect

we will simply just try to get banner

and figure out which software is the

target running on that specific open

port if we don't manage to get the

Bender we will simply just print open

port without the banner and if we do

manage to get it we'll print open port

then the port number and we will attach

the banner right after the two dots okay

in any other case if we don't manage to

connect we will simply just pass and not

print anything because we are not really

interested in printing which ports are

closed we're only interested in printing

the open ports okay so this is basically

the whole idea of this port scanner

project and now let's see how we can

actually use this program and import it

into another program okay so how can we

do that well first of all what we need

to do is we need to create another file

so I'm just going to go right click on

the port scanner

then go to the new and then python file

and let's call this file ipscan.py

it will automatically add it right here

so you will have two tabs one for

default scanner and one for the IP scan

and now we want to import this program

now one thing before you actually do

that is you need to make sure that both

of these files are in the same directory

in my case they are both in the port

scanner project therefore they are in

the same directory so I can proceed

now the next thing that we need to take

a look at is the name of our Port

scanner so it is named portscanner.py

now in order to actually import this

file into another file in the same

directory we simply just type the

command import and then the name of the

program that we want to import in our

case it is Port scanner

so let's type it right here for scanner

and you will see that pycharm already

recognizes it therefore we successfully

managed to import our Port scanner

program

now how can we perform the same task

that we did right here

just without typing all of this code

well we can simply just call these

functions from our second program and

use them independently Okay so

the use of this importing is basically

if anyone else wants to use our Port

scanner they can simply just import it

and use the functions from that program

into their own program

so what we're going to specify right

here first is the IP address to for

example be

test PHP Dot oneweb.com

this is the domain name that we use to

test with our Port scanner before so

nothing new right here and all we need

to do to actually run this port scanner

inside of a different program is to call

the scan function

now at first you might be asking well

why are we calling the scan function

well basically you will notice that by

calling this scan function all of the

other functions get called as well

for example inside with the scan

function we first call the check IP

function in order to check for the IP

address then we call the scan Port

function which will scan each and every

port that we specify inside of this for

Loop and inside of the scan Port

function the get Banner function gets

called in order to print the banner so

we don't need to call specifically all

of these functions we can simply just

call the scan function

okay so how can we do that well in order

to call a function from a different

program we first of all need to specify

the program name just the same way that

you would specify a method from a

different library for example right here

we use socket library and we called a

method or a function

and we call the function from that

specific library but before we had to

specify the library name same way goes

here we first need to specify Port

scanner and then Dot and then scan

you remember that this can function

takes one argument which will be the

target as the pycharm already tells us

right here and our Target will be the IP

address

and believe it or not but this is the

entire program

just by using these three lines we can

perform the same thing that we did

inside of our Port scanner project

so this is the power of importing

libraries you can see that anyone who

wants to use this can simply just write

three lines and they will perform the

same task that we performed by coding

the entire Port scanner

but there is another thing that we need

to take a look at before we actually try

to run the IP scan you might notice this

part right here

well we didn't really want to run this

since first of all we're calling this

can function already inside of our

ipscan program therefore we don't really

want to call it twice and we would

actually call it because by importing

the port scanner into our ipscan we're

also calling this part of the code

importing a library simply means that we

are going to paste the entire Port

scanner code into our ipscan function

therefore this part of the code will

also get ran

so how can we make sure that this part

of the code doesn't get ran well simply

we can type

if underscore underscore name underscore

underscore equals equals and then open

double quotes underscore underscore main

underscore underscore

if this is equal to Main

then we're going to run this part of

code

so let's tap all of these lines in so

they belong to this if statement

and now this part of program will only

get ran if we run the port scanner

this line basically means that the

actual python will recognize whether

this program is being ran as a main

program or it is being imported into a

different program and ran from there in

case it is being important in different

program like in this case right here

then it will not run this part of the

code

if it is not imported into a different

program and if we simply just try to run

the port scanner itself then this part

of the code will actually run and that

is the meaning of this line right here

you can simply just remember this as if

this is the main program then run this

part of the code okay so right now let's

test our ipscan.py

let's open the terminal

and let's type Python 3 ipscan.py

you can see it is scanning the target it

already found the two ports open and it

will scan for first 500 ports as we

specified and changed the number from

100 to 500 you can see we are also

getting some banners from these open

ports we got open port 106 open port 110

143 we can see here is a long Banner

from that Port not really sure what this

is

we also discover another open port which

is Port 465 and therefore our program

closes as it reached the 500 ports

number

okay so it actually does work now

another thing that you should keep in

mind is that you will need to actually

code this part of the code into this IP

scan because for example if a user

specifies comma and then an IP address

this will not work because we do not

have this part and this if statement

right here therefore it will not be able

to scan because of this comma right here

so if you want to be able to scan

multiple targets from your ipscan

program make sure that you implement

this if statement into the IP scan but

we are not going to do that at the

moment there is no need for that we

already did that in the port scanner

program and I will leave that up to you

okay so with this we actually finish our

first project which will be the port

scanner and in the next project we're

going to take a look at how we can

create the vulnerability scanner which

will be based on this port scanner that

we just created so make sure not to

delete this program as we are going to

need it you also know that you will have

all of these actual programs in the

resources at the end of each project

okay so you can simply just download

them if you don't want to code them I

hope you enjoyed this lecture and I will

see you in the vulnerability scanner

project take care and bye welcome

everybody to our second project of this

course which would be a vulnerability

scanner all right so what we did by now

is we created our Port scanner which

managed to scan multiple targets as well

as one Target and also discover which

ports were open and closed and we also

managed to discover some of the

softwares running on those open ports

all right right now we want to advance

our game and create a vulnerability

scanner which will be able to detect

which of those softwares are potentially

vulnerable to some type of the attack

so there are a few approaches that we

can do in order to create this I picked

one which is going to be based on our

Port scanner meaning that we are first

going to import our Port scanner we are

going to scan for the open ports then we

are going to create a list of vulnerable

softwares in a txt file which then we're

going to also import into our program

and then we are going to compare the

softwares on the open ports with the

softwares named in the list or in our

txt file and if they do match that means

that we discover the loadable software

which can be exploited all right now you

can actually download some of these

vulnerable software's list over the

Internet or for the purposes of this

tutorial you can simply just create a

small list of a few softwares like I

will in order to test our program but

before we do any of that let us open up

our pycharm and create our new project

all right so I will open up my pycharm

by going here and typing pycharm

here it is it loaded fully and by

default it will open up our previous

project which will be the port scanner

project but we do not want to continue

coding inside of that project we want to

create a new one and then we are going

to copy paste the port scanner into that

new project

all right so let's wait for it to reopen

all of the files from the port scanner

project

okay so here it is now let's go on to

the file right here

click on the new project

under the create new project in the

location we can create a name for our

new project which would be

vulnerability or let's just type phone

scanner it doesn't really matter you can

call it anything you want and then click

on create it will ask you whether you

want to open the project inside of this

window or whether you want to create a

new window for it we can simply just

create this window

and it will open up the new project we

just created all right so here it is

it's creating all the dependencies

needed and right now what we're going to

do we're going to open up our terminal

we are going to navigate to our Port

scanner project using our terminal and

then we'll copy our Port scanner to the

vulnerability scanner right so let's go

to the pycharm projects if I type LS

here are both of these then we want to

navigate to the port scanner type LS

once again and we want to copy the port

scanner.py into the portability scanner

directory all right so CP port

scanner.py to the root pycharm and then

vulnerability scanner

press enter and in just a few seconds we

should see our Port scanner right here

okay so here it is let's open it up

and here is our program

now as I mentioned previously we are

going to base our vulnerability scanner

onto the sports scanner right here but

we're not going to code it right in this

program we're simply just going to

import our Port scanner as I showed you

in the previous video how you can do

that and we're going to perform some

small modifications to this program

right here for example we want to make

this program a class so we're going to

delete some of the functions right here

we're going to modify this part of the

program and we're going to create this

to be one giant class all right but more

about that in the next tutorial for now

on we just simply copy this we created

our new project and in the next video we

are ready to start coding our

vulnerability scanner alright so see you

there and take care bye

welcome back everybody

so for now we haven't really done

anything yet but we did import our Port

scanner and now we are ready to start

coding the main part of the program so

let's go to the vulnerability scanner

right here right click on it click on

the new and click on python file so all

of this stuff we already learned we know

how to do it and let's create a program

which will be called

wolfscan.py now first thing that we want

to do is of course to import our Port

scanner

which makes sure that it is in the same

directory that is important

and that is actually going to be the

only library that we are going to need

since these two libraries which are

going to be the socket library and the

ipy library are already imported inside

of this port scanner program all right

now you might notice once again that

this ipy is actually red underlined

which means that this Library does not

exist inside the default virtual

environment and we already talked about

this before you need to actually pip3

install it inside of this virtual

environment so let's do that right away

using our terminal make sure that you're

using terminal inside of the pycharm and

simply just type pip3 install ipy

it will install the library for you and

as soon as it is finished you should no

longer have this red underlined all

right so let's see

here it is it is gone now and now we

have all of the libraries needed to

complete our project all right so let's

go back to our main part of the program

we imported our Port scanner and now

let's think about all of the things that

we need in order to complete this

project so first of all of course we

need the target if we are going to scan

so we want to prompt the user of this

program for the target's IP address so

let's call it targets IP equals input

and we're going to actually ask the user

for the input of this

so let's type it like this and then we

can add a star sign enter Target to scan

for vulnerable open ports

okay so this will be the target's IP

once again we also want to make sure

that this can be both IP address and the

actual domain name but we don't need to

worry about that as that part of the

code is already located inside of our

Port scanner that we imported so no need

to code it once again let's just go to

the next line and also let's ask for the

user for the number of ports that they

want to scan now we didn't use it in our

Port scanner so why not use it right

here let's say they want to scan 100

ports and a different user wants to scan

200 ports let's add that as an available

option as well so port number

will be equal to the input

and in the second line we prompt the

user for the amount

of ports

you want

scan

and let's also notify them inside of the

brackets that 500 will mean

first 500 ports okay so in case they get

confused they know what they need to

specify all right now another important

thing that we need to do about this line

is we need to make sure that this port

number is an integer value for example

if the user specifies number 100 it will

be stored inside of this port number but

it will be stored as a string and not as

an integer therefore we need to wrap

this entire part

inside of an integer function and this

integer function simply just converts

whatever is inside of the brackets into

an integer value

keep in mind that you will get an error

in case the actual user of this program

specifies a string for example they type

the word tree well that word will not

get converted to an integer because that

is not possible therefore this will only

work if the user specifies the actual

number which should be the case as we

are indeed asking for a number therefore

we want to convert it to integer so our

program can continue executing alright

so now that we got these two things out

of the way there is a third and last

thing that we need to ask the user

before we actually start running the

main part of the program and that is

going to be the actual file from which

we're going to read vulnerable softwares

so for this program to run we need a

file as I mentioned at the beginning of

this section we need a file that is

going to store vulnerable software names

that then we're going to compare with

the softwares running on open ports so

we're going to call that

for example wool underscore file and it

will be equal

to the input

oops let's add the double quotes

so to the input

and then we prompt the user enter path

to the file

with vulnerable

softwares

okay so now that we finished everything

these are three things that we need in

order to run this program

let's print also the new line character

so right after this

we can have a little bit better View and

now we want to use the port scanner onto

our program all right so we're simply

just going to call the function Port

scanner

dot scan

onto the targets IP

okay now

if you think about this a little bit you

will notice that this will not actually

work now why this will not work well

there are a few problems with our Port

scanner not with the port scanner itself

but with the way that we imported it and

that we are going to use it inside of

our vulnerability scanner so first of

all we got a problem with this port

number variable

we cannot really paste it into our scan

function as our scan function only takes

one parameter so that is the first

problem as we don't really have a way to

actually tell the port scanner that we

want to use this exact amount of ports

so that is the part that we also need to

edit inside of a report scanner

now another thing that we want to do is

we want to convert this entire actual

Port scanner into a class

and we also want to get rid of some of

the functions that we don't need

and also we want to get rid of this part

of the program

since there is a lot to do with this

port scanner we are going to leave that

for the next tutorial so in the next

tutorial we're going to cover this port

scanner and convert it to the best

possible way for us to use it inside of

our vulnerability scanner and then we're

going to continue from there alright so

for now we simply just prompted the user

for the needed things and in the next

video we're going to cover the port

scanner and how we can convert it the

best way possible

see you there and take care bye hello

everybody and welcome to this tutorial

and right now let's cover the port

scanner conversion to a class

all right so anyone who's actually

covered and learned python before knows

what classes are and knows why they are

important and in this case in our case

we want to make sure that we converted

class for the better usage inside of

this vulnerability scanner project

all right so first thing that we are

going to do

is we're going to create the class at

the top of this program we're going to

create it with the keyword class and

then we're going to call it let's say

port scan

open and close brackets and add two dots

and this is how we can create a class

now all of these functions that we have

below we want to make sure that they

belong to our port scan class

so what we can do is we can tap each and

every line so let's do it one by one

like this and you will see that some of

these actual keywords will start

changing colors as they start belonging

to our port scan class all right so

let's do it like this

all of it should be tapped once so let's

go like this and the scan port at the

end

okay so here it is now this part of the

program you might be asking what we're

going to do with this well in this case

we don't need it so we can simply just

delete that

all we need are our class with these

functions right here let me just create

space between each of these functions so

we can see each and every one of them a

little bit better and now let's see what

we need to do in order to get this to

work well first of all we are missing a

function that every class needs and that

is the init function this init function

will be coded at the top of the class so

right below the initiation of the class

itself we're going to type def

underscore underscore init underscore

underscore

all right and you will notice that by

default if I open and close brackets it

will add this self argument as a

parameter to this init function or init

method right here and this self-argument

basically means that it is belonging to

this class and what we're going to

Define inside of this init method is all

of the stuff well all of the parameters

that are going to define the object to

our class for example we want to define

the target parameter and the port number

parameter that is an actual attribute to

our class which defines our object all

right so next to the self argument we

need to define those two attributes so

the first one we can call Target

and the second one which is the new one

will be called Port underscore number

all right so simple as that and in order

to Define them inside of the init

function we simply just type self.target

will be equal to Target and self dot

port number

will be equal to port number

and this is just a python way to

actually Define them so nothing really

important there let me just delete this

empty space and now that we have our

init function we need to add this self

argument or self parameter to each and

every function that belongs to this

class

so we're simply just going to go right

here and type self

we're also going to type self right here

self right here

and South right here

and another very important thing that we

should consider is that we don't need

any of these other parameters outside of

the self parameter

and why is that well once you define

those attributes that we need inside of

this init method right here

we can access these variables throughout

each and every function in our class

so we don't need to paste them as

parameters let us just delete everything

but the cell parameter from each and

every class

and right here as well

make sure you do not delete it from the

init methods so let's leave it like this

so now that we fixed all of the methods

let's restructure our program a little

bit so I will start off with this scan

Port function

all right so what we're going to do with

this scan Port function besides it's

doing the usual stuff that it did inside

of our Port scanner uh project we're

going to add the converted IP

into the scan Port function instead of

the scan function

so we're going to delete it from the

scan function first let's go right here

we also are not interested into printing

anymore since printing we are going to

do in the main program which is going to

be the vulnerability scanner so our scan

function will be left with just these

two lines of code while the conversion

of the IP address will be moved right

here into the scan Port function

so we're going to call the check IP

function

and you will notice right away that some

of the stuff inside of our class is

actually red underlined and by some of

the stuff I mean a lot of things such as

for example these check IPS underlined

these two variables are underlined these

get Banner is underlined the port is

underlined so all this stuff are

underlined which means that they are not

recognized by the pie charm well why is

that

let's start off first with the functions

themselves as to why they are underlined

once you create a class you need to

actually rename those functions when you

call them inside of the class you need

to add the self argument before

so for example if I type self dot check

IP you will notice that it will no

longer be a red underlined and this will

get recognized by the pycharm this is

just a way to call different methods

from the class itself so the class can

recognize that this check IP belongs to

its own methods and therefore it knows

which actual method to call

same goes with this get Banner function

right here which we can simply just add

self.get banner and it will stop being

read underline

let's see whether we have another

function which is red underline here it

is scan Port if I simply just type self

Dot scanport

we can see it works successfully

now but what are we going to do with

these actual variables which are red

underlined well first of all we don't

really need this IP address variable

anymore as we are actually getting the

IP address from our main part of the

program which is going to be the

target's ipv variable right here and

then we're going to paste it into our

class which will then get stored inside

of the cell.target variable which then

we can use throughout our class so let's

change it everywhere we can first of all

we're going to change it in the check IP

method so we're no longer checking the

IP from the IP we're checking the

eyepiece from the self the Target and

make sure that throughout of this class

you also use the self-argument when

specifying the variable name so we're

trying the ipfunction from self.target

and in case it works we're returning

self.target

in case it doesn't work we want to

return the get host by name from the

cell.target once again keep in mind that

this will store the IP address from our

Target machine

goes right here to the scan Port we

don't really need this converted IP

anymore and why won't we need it well we

don't need it because as you can see

this scan Port function doesn't take the

IP address as a parameter anymore

therefore this is red underlined so we

can simply delete it

but what with this port number well we

actually need to send this port as a

parameter because we are inside this for

Loop therefore this port will change

through each iteration and we need to

specify to this method right here which

iteration is it currently at so we need

to send the port as an argument

therefore we're going to go to the scan

port

and next to the self we're going to add

Port as a parameter and you will see

right here at these three spots the red

underline will go away as this port now

exists in this program and the last part

which thread underlined is this IP

address right here

once again we don't really need this IP

address anymore we have self.target and

right here since at the beginning of

this try statement we converted the IP

we don't need to specify cell.target

right here we can specify converted IP

all right since this will be the IP

address whether the target was specified

as a domain or simply as an IP address

all right

another thing that we want to make sure

is that we don't have unnecessary

functions that can be put inside of a

different functions for example this get

Banner can also be put inside of this

scan Port function therefore we don't

really need this method right here

so we can simply just delete the get

Banner

and we can put it right here

as you will see this will get flagged as

get Banner doesn't exist anymore

therefore instead of trying to call this

function what we're going to do

is we're going to write the get better

function code instead right here so suck

dot receive

we want to receive 1024 bytes

and we're simply just using the sock

object that we created right here so no

worries about that we don't need to name

it anything differently we also want to

decode the response

and the reason why we're decoding the

response is so we didn't really have to

do it later on right here

so once we decode the response we then

want to strip it

from any unnecessary characters such as

for example backslash n and also we want

to strip it from backslash r

and the reason why we are performing

this stripping part

is because especially in this program

right here in our vulnerability scanner

it is important to strip everything that

we don't need from the response as this

Banner variable will store the most

important and crucial part to our

vulnerability scanner as inside of this

program we are going to compare this

Bender variable with the actual content

from this vulnerability file in order if

they match so for example if we have the

same Banner in a vulnerability file and

the same Banner gets retrieved into this

variable and imagine that we do not

strip these actual characters from it

well our program will not really find

the match as they will be different only

by this character

so that's why we're stripping it as the

new line character is not important to

us all right so simple as that

the next thing we actually don't need is

these print statements right here we

needed them inside of our Port scanner

project but we don't need them anymore

as we are not really interested in

printing which ports are closed and

which ports are open

since this is not a port scanner

but however there is another problem

that will occur and that is that this

Banner can only store one Banner at a

time

but we need to retrieve multiple banners

if we find multiple ports open on the

targets and if we also manage to

retrieve multiple bandits from those

open ports

so we will need to store multiple

banners and not just one so how can we

fix that well

we can actually easily fix that we can

simply just add

a list which will be at the beginning of

our class right here we're going to call

it banners and in order to define a list

we specify these square brackets right

here by specifying open and close square

brackets we initiate that this Benders

list will be empty for now and then

every time we actually manage to

retrieve the banner right here

with this line we can then right after

it below append

the actual Banner to the banners list

just like this and you will notice that

this Banner is that these banners is red

underlined that means that we need to

add the self dot banners argument right

here and everything will work correctly

and in case we don't manage to retrieve

the banner we're simply just going to

pass for now all right and at the end we

can simply just close the connection

with sock.close

so simple as that let me see if

everything

is correct for now everything seems to

be good

our get check IP function is good our

scan is good

but don't worry

there is another thing that we actually

have to do which is going to be to

create another list which is going to be

the open ports list

now you might be asking why are we

actually doing this

and this is more easily showed than

explain but I will try to explain it

anyway right now and once we run the

program you will get it while we need

this open ports list for now on let me

just try to explain it well once we

actually created this class right here

with these three methods you notice that

we also had to create this banners list

right here in order to store multiple

banners

once you actually get to actually

printing those banners and open ports

into our vulnerability scanner we want

to make sure that each open port will

match to each banner and since we

removed all of the print statements we

cannot really print open port one by one

we have to store all of the open ports

somewhere and all of the banners

somewhere and then we have to print them

each element one by one that's why we

also need the open port list that we

created right here and after each time

we managed to connect to a port we will

add that port to the open ports list so

self dot open ports and then dot append

the same way we are adding the banners

we're also going to add open ports and

we're simply just going to specify right

here Port all right

now that is not the end of our problems

you will notice once we actually had

Port scanner projects that we had more

open ports than more panels retrieved

for example some of the ports that were

open and that we tagged as open weren't

sending us any Banner therefore we just

didn't have Banner for that open port

and that could present us a problem

because if we have 10 open ports for

example and we retrieve only three

banners then in one list which will be

the open ports list we will have 10

elements or 10 ports and in the banners

list we will have three elements and

therefore once we want to print each

element one by one for example the

element one from the open ports should

correspond to the element 1 from banners

and so on and so on it will get confused

in some of the open ports which don't

have banners will get banners and it

will all get mixed up and it will not be

correct therefore we want to make sure

that the open port list has the exact

same amount of elements as the Banner's

list has so each element can respond to

each element from the different list

how can we do that since we are

obviously going to have less banners

than open ports well we can fix that

just by instead of the pass statement

right here under the accept we can also

pen to the banners list

so for each open port we're going to

append anyway even if it manages to

retrieve the banner we are going to

append and if it doesn't manage to

retrieve the banner we're also going to

append so self.banners dot append but in

this case we are simply just going to

append empty space we're not going to

append any string or anything else it

will simply just be there so an element

can get added to the banners list all

right so we simply change this so we can

have the same amount of elements in both

banners and open ports

and with this we successfully

transformed our Port scanner into an

actual class that we can use inside of

our vulnerability scanner project and in

the next video we're going to see how we

can call this class from our

vulnerability scanner okay so thank you

for watching this tutorial and I will

see you in the next one bye

welcome back everybody let's see now how

we can actually call our Port scanner

class into our vulnerability scanner

program all right so we have everything

ready right here we switched everything

that we needed to we also added some of

the lists some of the specific

attributes to this class we changed some

of the functions as well as deleted the

get Banner method from this class and we

also added the conversion of IP address

into the scan Port method all right

so now that what we need to do is we

need to see how we can create an object

that will belong to this class and how

we can use it inside of our

vulnerability scanner program

well right away I can tell you that this

will not work because with this we're

simply specifying the name of the file

that we imported and then the function

but this function no longer exists as a

separate function inside of the port

scanner that function is now the actual

method to the port scan class

so in order to actually call that we

first of all need to create an object

that will belong to that class

and we can simply call that object

Target so simple as that Target will be

our object and in order to initiate that

object to belong to the portskin class

we first of all need to specify the port

scanner which is the file that we are

using the class from and then the name

of the class itself

now you will notice that if I specify

the open and close brackets pycharm will

suggest right away that this port scan

class takes two parameters

the first parameter will be the target's

IP address and the number of ports that

we want to scan for the vulnerable

software

now why does it say these two parameters

well inside of our Port scanner class

you will notice that we have two

variables inside of our init method and

these two variables are exactly what we

need to specify to our object so we need

to know the target's IP address as well

as the number of ports so let's specify

that we already prompted to the user for

these two values therefore we can simply

just specify right here targets AP and

then comma port number all right and we

successfully created the object to our

port scan class

right now in order to initiate the scan

itself so we can scan for the open ports

and retrieve the Banners To those open

ports we need to initiate the method

from this class

and how do we do that we need to

initiate the method onto our object from

the port scanner class

so how can we do that but first of all

we need to check which method we need to

initiate and ideally we want to initiate

one method which will call all of the

other methods as well and in our case

that method would be this can function

as scan method called the scan Port

method and the scan Port method calls

the check IP method as well as checks

for the banners and adds them to the

list

so we need to type right here Target dot

scan

and simply we just these two lines we

perform the entire scan for open ports

and softwares on our Target's IP address

all we're left to do right now is

compare those banners that we retrieved

from the open ports with the banners

that we will have in a separate file

that we're just going that we're going

to create in just a second and if we

find a match that means that we found a

vulnerable software

all right so first of all we need to

perform something and that will be the

scanning of a Target and then we're

going to add two or three banners to the

actual txt file which then we're going

to use

well let me just show you it is easier

if I just show you first of all I will

enlarge this Zoom this in

and I will navigate to our pychon

projects as well as the port scanner

project and here if I simply just python

the port scanner.py

and let's say we test this website test

php.oneweb.com press your enter it will

scan for the open ports and we will

retrieve some banners from it

then we're going to copy these banners

and add them into a txt file which then

we will use inside of this program

so let's say we want to copy first two

banners all right we're just going to

wait for a few seconds for this scan to

finish and keep in mind we are using the

port scanner tool that we created so you

can see it can be sometimes useful

especially when you try to gather more

information about the targets machine

alright so here it is it has finished

now let's copy this

we don't need that IP address we're

going to copy this

then right here under the volt scanner

we're going to click on new but instead

of new python file we simply just want

to create new file it will be called

let's say Vol underscore file or no

let's not call it like the actual

variable uh wallbanners.txt

let's call it just like that and then

right here we're going to paste this as

a first Banner

and as a second Banner we are going to

paste

let's say this copy selection

and paste it right here all right so

here it is we got two banners ready

and now let's see if we managed to find

these two matches with our vulnerability

scanner okay so first of all what we

need to do in order to compare the

banners with the banners from the file

we need to open that file first so how

can we do that well in Python we do it

with this statement so with open

and then open and close brackets and

first parameter to this open function

would be the file name which is stored

inside of this wall file variable so

with open wall underscore file

and the second parameter would be how

you want to actually open it in our case

we want to open that file for reading so

we want to read from it you also have

the write and append option but in this

case we're going to open the file for

reading which we specified just by

simply typing smaller case r

and then we specify

as and then the name of the file object

as file let's call it like that so with

open vulnerability file for reading as

filed

then we need to perform the comparison

of these banners what we're going to do

first is we're going to add a count

variable which will be equal to 0 and

then we're going to take a look at all

of the banners that we gathered during

our scan all right so how can we do that

we can access those vendors by simply

typing Target dot banners

how can we do that well since we created

this object right here

this object besides these two variables

also has these two variables right here

or these two lists should I say so we

can also access them as well if we want

to using our object

so Target banners and what we want to do

with that is we want to iterate over it

so for Banner

in target.banners

we first of all want to navigate to the

beginning of our ball banners.txt file

and we can do that using file.seek zero

and the reason why we need this line is

because in case we remove this

it will only find the first result and

it will not manage to find the second

result because it will take the first

Banner then it will iterate over all of

the banners inside of this list and if

it finds it it will be stuck at the end

of the actual file and it will not get

back to read it from the beginning for

the next Banner it will just read it

from where it stopped that's why after

every Banner we need to actually seek to

the beginning of this file which we do

using file.seek zero zero means simply

return to the beginning and read all

over again

and now we need to iterate once again so

four line

in file.readlines

and you will notice that we actually

have two functions right here one is

read line and one is read lines if you

use Redline it will only read one

characters one by one so we don't really

want that we want to use read line so it

actually leads line by line

so let's just type it right here for

line in file dot read lines

and since this is a function we need to

open and close brackets

and now we can compare the banners if

line dot strip we want to strip it from

anything that might cause some problems

in matching these two banners and keep

in mind that this line is simply just

aligned from the dxt file for example it

can be this and then we need to compare

that with the banners from this list

right here so ifline.strip

in Banner

in Banner that we are currently reading

from this list

so if line.strips in better

and then here we want to print

let's print it like this

so open single quote

two exclamation marks and let's print in

capital letters for example vulnerable

Banner

and then

let's also add double quotes to our

actual string so we can add it between

the banner plus the banner itself Plus

and then single quotes double quotes at

the beginning and then on Port

and let's print it like this

plus the string

and here want to actually print the port

number corresponding to that specific

Banner so how can we do that

well that is why we need this count

variable since discount variable will

keep a track of each element that we'd

pass by by scanning each and every

Banner so each and every Banner will

correspond to the exact same number of

elements inside of this open ports list

right here so for example if the count

variable came to number three that means

we are scanning third banner and that

third Banner will be corresponding to

the third element of the open ports list

which will be the actual port number to

that specific better so in order to

access that list we need to type the

target object Dot

open ports we can access it the same way

that we access the banners so dot open

ports and here we need to specify which

element are we looking for and we

specify that in the square brackets

right here

so then we add right here count

so simple as that

for some reason we are getting these red

lines

in for example line dot strip port

scanner.port scan

and why is that

well let's just finish this

so we don't forget the last line which

will be to actually increase the count

variable by one and you need to keep in

mind where are you actually increasing

it inside of each Loop well you want to

increase it inside of this Loop but you

don't want to increase it inside of this

Loop so you want to increase it after

you pass every Banner you increase the

element by one because you proceed to

the next Banner in the list therefore we

want to increase it right here so count

plus equals 1.

okay so everything seems to be working

correctly we just seem to have bunch of

Errors right here but let's try to run

the program so we can see

what type of errors are those so we'll

scan Dot py

and it says right here invalid syntax

let's see where that is invalid syntax

inside of the profile

okay so we have a bracket extra so let's

delete this try it once again

oh no we actually do not have a bracket

extra

we're not even fixing the correct part

it is inside this wall file yeah we have

an extra square bracket right here so

let's delete that and if I run it once

again

I know we can notice that we no longer

have any errors so this extra bracket

right here created as the problem throat

the entire program so now that we fixed

it this should work enter Target to scan

for vulnerable open ports let's type

uh test php.1 web

.com

we want to scan for first 100 boards

because both of the vulnerable softwares

are located inside of the first 100

ports and we want to enter the path to

the file with vulnerable softwares while

in our case since the actual file is

inside the same directory as our program

we don't need to specify the path we can

simply just passify the file name but if

this file was in another directory you

would need to specify the full path to

the directory

in our case wallbanners.txt

press here enter and now we wait for it

to perform the scan first of the first

100 ports then it will go to this

iteration right here with opening of the

file and then comparing the banners and

if it manages to find the banner that

matches in both of the banners list and

the actual file that we open then it

will print native vulnerable software

has been found alright so let's see

right here it might take a few seconds

to finish

and here it is we found two vulnerable

banners as it prints right here

vulnerable Banner with this name right

here on Port 21 and vulnerable Banner

with this name on Port 22. alright so

good we managed to find vulnerable

banners and now we can simply just

proceed to exploit the target with these

two vulnerabilities all right so that

would be about it for this vulnerability

scanner as you can see it is not really

that big of a project it is mostly based

on our Port scanner we simply just

compare the actual banners from the file

and the scan itself and then we print it

out alright so once again this is

something that you can download from the

Internet or you can simply just create

it by yourself just by adding multiple

vulnerable banners to this list and then

creating your own list

and then you can use this program in

order to scan the Target in the next

video we are going to perform the recap

of this actual project we're going to

see once again how this program works

briefly explain it once again in case

there is something that you missed or

did not understand and then we are going

to proceed to our next project thank you

for watching and see you in the next

lecture bye welcome back let's perform a

recap on our vulnerability scanner all

right so let's go step by step so the

first thing that we did is we imported

our Port scanner that we coded in the

previous project

now in order for this port scanner to

work we perform some of the

modifications to the code Itself by

adding the actual port scan class which

will have these multiple methods and

each one of them will perform a separate

task

we also performed some little

modifications to the actual parameters

themselves and also deleted the get

Banner function and we put it inside of

the scan Port function we also removed

all the print statements as we do not

need them and we added two different

lists which is the banners list and the

open ports list in order to be able to

print the banners and open ports inside

of our vulnerability scanner after that

we then created these three variables

which will store all of the needed

information for our Port scanner to run

if we initiated an object right after it

which will belong to the class port scan

we then initiated the scan Itself by

calling the scan method from the port

scan class

after the scan has finished we now know

that after this line in our open ports

list right here and in our banners list

later here we have all of the results

ready

so then after the scan we open the file

which contains the vulnerable softwares

on an open port

as soon as we open the file we created

the count variable which is really

important in order to keep the track of

elements in the banners and open ports

as well

after every Banner that we scanned we

increase the count variable by 1 and

proceed to the next banner and then we

compare the line with the banner itself

and if there is any part that matches

with the banner we will print it as a

vulnerable Banner as well as specify

which Port this software is running on

all right so now that we recapped all of

the things that we did let's perform one

final test to see whether it works if I

clear this

Python 3 and then ballscan.py

let's perform the same test once again

mobile web.com

first 100 ports and wall banners

.txt now you might be asking the reason

why we are performing these Recaps after

every project well it is in case you

missed something or didn't understand

something so we just go over the code

one more time in short term and it will

also help you to remember everything

better and to fully understand the

program once it is fully coded and once

it is working as well as we can see we

got the exact same result as in the

previous video and we managed to find

both of the vulnerable banners which is

good

now if I try to for example scan my

router's IP address

100

world banners.txt

it will scan my router and you will see

it will not find any vulnerable

softwares as there is not any open port

on my router which is running one of

these two softwares all right so that

would be about it for this project I

hope you enjoyed it and in the next

video we're going to see how we can

still gain access to the Target machine

even if we don't find a vulnerable

software running on an open port and we

don't know how to exploit it we're going

to take a look at some of the different

things that we can do in order to enter

the targets machine such as for example

performing the SSH brute force and

gaining the SSH access to the Target

so we're going to see how we can do that

in our next project and after that many

more projects to go so thank you for

watching this tutorial and I will see

you in the next lecture bye hello

everyone and this is our bonus video for

the SSH Brute Force section and in this

video I will demonstrate how you can

install met exploitable as a virtual

machine

alright so there are a few things that

you need to do first of all you need to

open up your Google Chrome and type in

the metasploitable name inside of your

search bar

then you should navigate to the first

link which will be the sourceforce.net

metasploitable download click on it and

simply click on this green download

button it will start downloading this

ZIP file which is around 800 megabytes

large and once it has finished then you

can extract it to the desktop

or simply just move it to the desktop

create a new folder

call that folder for example

metasploitable

paste this ZIP file into that folder

then we want to extract all of the files

inside of this folder that we created

now this will take a few seconds to

finish and we should receive the

metasploitable.vmdk file which then we

will use in order to create our virtual

machine with all the vulnerable

softwares now the only thing we need

from this virtual machine is the SSH

client so once again if you have any SSH

service running on any other machine you

don't really need to do this you can

perform the SSH brute force on any SSH

machine that you managed to find and of

course that you have the permission to

test on alright so this is fist we got

this file right here and you will see a

couple of files in which we are

interested in this metasploitable file

which is dot vmdk it is the size of 1.79

gigabytes and right now we need to open

up our virtualbox

click on new

put in a name for your virtual machine

for example let's call it Metasploit

and make sure that under the type you

set Linux and under the version you set

all the way down other Linux 64-bit

click on next

512 megabytes is more than enough for

this machine so click on next and

instead of going with the create a

virtual hard disk now as we did with the

color Linux machine we want to go to the

use an existing virtual hard disk file

click on this and right here click on

this icon where it will open this video

where you can simply just find your

metasploitable vmdk file and use it as

your hard disk since I don't have it

right here I want to go to the ad

then I want to navigate to the desktop

2D met exploitable and then this file

and here it is the

metasploitable.vndk click on open

try to find it right here here it is I

will simply just double click on it it

will automatically set it right here and

I will click on create

as soon as that has finished we also

want to set the network settings that we

used in the Cal Linux we also want to

set it in the metasploitable as well so

go to the bridge adapter and set the

ethernet cable connection and once again

make sure cable connected is checked

click on OK and now you can start the

machine so I will simply just click on

start and you will notice that this

actual machine doesn't take too long to

install it will take just two or three

minutes possibly and then we are ready

to proceed with our brute forcer for the

SSH service all right so it says

starting up right here

it will automatically download and

install all of this stuff and all the

softwares that it needs so we don't

really have to do anything all we need

to do is to log into the machine once it

has finished installing everything all

right so we are going to wait for that

to finish and here it is it is already

over it is asking us for the login and

you will notice that above the actual

login it tells us that the username and

password is msf admin and msf admin so

let's go right here and type rsf admin

and as a password as well msf admin

clear the screen since this is just a

command line machine and if I type

ifconfig I make sure that we are in the

same local area network with the IP

address of

192.168.1.3 and this is basically it we

successfully downloaded and installed

metasploitable virtual machine

so thank you for watching this tutorial

and I will see you in the next lecture

bye

hello everybody and welcome to our third

project which is going to be the SSH

brute forcer so for now on we managed to

scan the open ports to determine which

ones were closed which ones were open we

also managed to scan for the softwares

running on those open ports and now

let's imagine an example that we didn't

really manage to find any vulnerable

software running on those open ports

well now we have to turn to different

approaches such as for example trying to

gain access through some of those

Services running all those open ports

and we're going to take a look at the

first one which is going to be the SSH

Brute Force now what is an SSH

well sh is a way that you can

communicate and control the target

machine over the Internet just by

performing the SSH connection to that

specific machine

now of course it is a secure protocol

therefore we would need the username and

password in order to gain access to that

specific machine over the SSH protocol

now for the purposes of this project

we're going to use a virtual machine

which is called metasploitable now I

downloaded it and already installed it

here it is and in case you don't know

how to do that I created a bonus video

which is going to be at the last section

of this course and there you should see

the bonus video which simply just shows

you how to download and install

metasploitable now I will assume that

you already have it and that you watch

that video so I will simply just start

this machine

and first of all we're going to take a

look at how we can simply just connect

over the SSH using our terminal and then

we're going to try to implement all of

that into our SSH Brute Force program

now there will be two versions of this

program one will be a regular sh brute

force and the other one will be the SSH

brute forcer with threading library now

the reason why we do that is because if

you use a Threading library in order to

perform brute forcing it will

automatically be faster than simply just

using one thread in order to perform the

Brute Force

but let's not bother ourselves with that

right now let's see how we can connect

to the SSH using our terminal so our

machine is up and running we log in

using the msf admin as a username and

msf admin as a password and here it is

everything works correctly if I type

ifconfig I will check my IP address

which is going to be

192.168.1.3 so I need to remember that

open up my terminal let me enlarge all

of this in

and now try to connect to that IP

address using as Sage protocol so SSH

and then

192.168.1.3 press here enter and here

are some of the stuff that happens once

you try to connect over the sh the

authenticity of the host can be

established as a key fingerprint is and

then this one are sure you want to

continue connecting we want to type here

yes

and it will tell us that it permanently

added the RSA to the list of known hosts

now this is just some regular stuff that

happens once you try to actually connect

to the sh and we're going to have to

implement some of these things in our

program as well so keep in mind for that

right now and it will ask us to connect

to the root account which we don't

really want so I'm just going to click

exit right here

I will control C and then I will SSH msf

admin and then add 192.168.1.3

okay and the password will be msf admin

if I'm not mistaken and here it is we

successfully managed to connect to the

msf admin account on the multiploitable

virtual machine using the SSH from our

terminal all right and now if I type

5config in this terminal you will see

that we get the exact same IP address as

we got when I typed ifconfig inside our

metasploitable

so we basically got something like a

reverse shell running and we can execute

any commands we want and we can do

anything onto our met exploitable

machine so let me exit this since we are

not really interested in doing this over

terminal and let's start the new project

on SSH brute forcer

now of course I showed you an example

let me just open up my pycharm now of

course I showed you an example in which

we actually know the password to the

Target and in our program we want to

make sure that we do not know the

password and we will try multiple

passwords until we actually find the

correct one okay and then once we find

the correct one we will print it to the

screen found password and we will print

the username and the password for that

specific account

Now by default we will probably open up

our previous project which is going to

be the vulnerability scanner yeah here

it is but we want to as usual create a

new project which we will call the SSH

brute forcer so let's wait for all of

this to load up

okay so it loaded up let's go to the

file

new project

let's name the project to be SSH Brute

Force

click on create we want to create and

open the new project inside of this

window

let's wait for it to create the virtual

environment for us and all the

dependencies

and now we can simply just create our

python file by right clicking new python

file and let's call it SSH brute.py

easy to remember so

all we are going to do in this video

before we end it is we're going to

import the needed libraries for this

program to work

now let's type the import command and

the first library and the most important

library for this actual project is going

to be the paramico

Library we will use this library in

order to automate the process of

connecting to our SSH client so this

library has already pre-made functions

that we can use in order to make this

process shorter all right then we're

going to need assist Library the OS

Library

the socket library of course every time

we actually try to perform some some

tasks over the Internet we will most

likely use the socket library and we are

also going to use the term color Library

now you will notice that out of these

file libraries two are actually red

underlined which means we do not have

them installed inside our virtual

environment so let's install them we

already know how to do that we will open

up our terminal inside our pycharm and

type pip3 install and first let's go

with the paramico since paramico is

essential for this program to work while

as term color we don't really need but

it will make our program look nicer and

we can see it successfully installed

paramico and now let's pip3 install term

color alright so paper is return color

and this will finish in just a second

here it is

if I exit this terminal and go back to

my program

for some reason this is still red

underline not really sure why let's

start typing something maybe it will go

away

print

yeah it went away great so everything is

imported successfully and in the next

video we can start off with our brute

forcer hope I see you in the next

lecture and take care bye welcome back

everyone and let's continue with the

coding of our brute forcer you will

notice right away that we're going to

start it rather the same as our

vulnerability scanner by prompting the

users to input three different things

that we are going to store into three

different variables and use throughout

our program

now two of those three things are going

to be the exact same as in our

vulnerability scanner and the third one

is going to be the username for the sh

account so first thing we're going to

prompt the user is to enter the host so

the actual IP address to the Target that

they want to connect to so we're going

to type it right here input

and let's add

plus sign

and then Target address

so the user can specify the target

address

the second thing that we are going to

need is going to be the username for the

account that we are trying to Brute

Force which in our case if you're using

that exploitable as I am is going to be

msf admin all right so we're going to

input

right here

at the plus sign once again and Sh

username

and the last thing that we want to

prompt to the user is to input the file

or the file name from which we are going

to read the passwords

all right so input file let's call it

like that and we're going to type input

single quotes plus sign and then

passwords file

alright so simple as that once the user

specifies all of these three things we

are ready to start running our program

the first thing that we're going to take

a look at is whether the username

specified the actual password file

correctly and we're going to do that

using the OS Library so we're going to

see whether this file actually exists if

it doesn't exist

we're going to print to the user file

doesn't exist okay so now in order to

actually do that we're going to use an

if statement and we're going to call the

OS library with the path and Dot exists

now this

os.path.exists will check for a

specified path whether that path simply

exists or not basically it performs the

same thing as its name says so

os.path.exists

and in the brackets we specify the

actual path to the file so in our case

that will be input file

and if it equals equals to false since

this actual function will return true

and false true if the file exists and

false if it doesn't exist so in this

case if it doesn't exist we're going to

print

that file doesn't exist and we also want

to make sure that we already here slash

path in case the user specifies path and

not just the file name

and then we're going to use the sys

library in order to exit the program

with number one so sys.exits in case

that file doesn't exist so the user can

actually rerun the program and specify

the correct file right now that we did

all of this we need to actually proceed

with the main part of the program which

is going to be the comparison of the

passwords with the SSH client so in

order to do that we're going to have to

open file first and to open this

password file we simply just use the

same thing as from the vulnerability

scanner which is the statement with open

and then we specify the file name in our

case it is stored inside the input file

variable and then we open it up for

reading once we do that we simply create

the file descriptor name which is going

to be just file and then we check

all the passwords line by line so for

each line

in file.redlines and keep in mind that

you need to use readline with s and

there is also read line but read line

will only read character one by one and

we want to make sure we use read line so

we read line by line all right

once it reads the line that line will be

a password and we're going to set it so

password equals

line and that line we want to strip out

any character that we don't need for

example the new line character we don't

really need it inside of the string so

we're going to strip any unnecessary

thing and store it in a new variable

that we just created which is going to

be called password all right once we

have the password ready to test then we

can simply just try to connect with that

password

and in order to do that we're going to

use a function SSH underscore whoops SSH

underscore connect

with this specified password now you

might notice right away that this is red

underline and the reason why this thread

underline is because this function

doesn't even exist

now you might be asking why are we using

it if it doesn't exist well we're going

to code it in the next video and inside

of this function we're going to use the

paramico library in order to automate

the SSH connection to the Target all

right so that would be about it for this

tutorial and I will see you in the next

lecture bye welcome back everyone and

right now we are ready to start coding

our sh connect function in the previous

video we coded all of this so this is

just the base part of the program where

we ask for some uh imported information

then we check whether that information

is correct and then we continue with the

actual brute forcing right now we are

going to call the sh connect function

and let's do it at the beginning of the

program we're going to Define it first

Define SSH underscore connect

[Music]

and this function will actually take two

parameters one of them is going to be

the password which we specified right

here and the other one we're going to

actually declare right here in the

brackets and we're going to call it code

to be equal to zero what this means when

you simply specify code to be equal to

zero is in case we don't really specify

anything as a second parameter right

here in this line that means that this

code parameter will automatically be set

to zero all right and we want it like

that so let's add two dots right here

and start coding the part of the

function first of all we need to create

a variable which is going to be called

SSH and that variable will be equal to

parametical

dot sh client

so we're going to use this sh client

function in order to declare this

variable

and then we're going to use this

variable

to set missing host key policy so this

is a long function as you can see you

can simply just tab it to auto complete

it once the pycharm outputs it as a

possible function to use so we're going

to type as Sage set musicowski policy

and right here we need to specify

paramico

dot Auto add

policy and this is also function so this

is just some basic two lines that we

need to set before we try to connect to

the SSH client and right after it comes

the connect part which we will try with

the try and accept statement

similar thing that we did with our Port

scanner we're going to do right here

we're going to try to connect inside

this try statement and in the accept

statement we're going to print that the

password was incorrect all right so

right here in the try statement we're

going to type SSH dot connect

we're going to connect onto the host and

keep in mind that the host is this

variable right here which stores the IP

address that the user specifies

we want to connect over the port 22

because the port 22 is a regular port

for the SSH

we want to set the username to be equal

to username

which once again is this variable right

here

and we want to set the last thing which

is going to be the password to be equal

to password

which we pasted right here as a

parameter

so it is going to get stored from here

to here all right so this connect

function that comes with the parameter

library has four parameters the IP

address the port number the username and

the password and this is all that we are

going to do right here in the try

statement in the accept statement we're

going to check for an error which is

going to be called paramico

authentication exception which simply

just stands for if the password is was

incorrect we're going to perform this

part of the code so if the

authentication didn't manage to go

through that means we specified the

incorrect password and therefore we're

going to set the code parameter which

remember is the second parameter to our

function to be equal to one

and in the last case which is going to

be another accept statement we're going

to set right here

accept

socket error

as e

we're going to set the code to be equal

to 2.

and before I explain this try and except

once again let me just type here as

sage.close once we finish everything and

we want to return the code from this

function

so let's go through it once again we

declare the sh client we add the auto

add policy these are two standard lines

before we try to connect then we try to

connect to the Target if we manage to

connect with the password then the

second parameter which is called will

remain zero if we specify wrong password

the code will be changed to 1 and if

there is any error during the connection

for example we cannot connect to the

Target because it is offline then the

code will be 2. therefore once we return

the code and we check it then we will

know which password is correct and which

password isn't correct all right so

we're going to finish that in the next

tutorial for now on we got our function

ready and before I finish off this

lecture I will just add right here that

the response is going to be equal to sh

connect with the password

the reason for that is since we are

returning the code from our function we

want to store the result inside of a

response variable therefore this

response variable will contain the value

of the code whether it is 0 1 or 2 all

right so simple as that and let's

continue in the next tutorial hope I see

you there and take care bye

welcome back let's wrap up our program

and run it for a test

so there are a few things that we

actually need to finish before we do

that for now on we got the main part of

the program ready which is the connect

function we used up all of these four

libraries and we are just now going to

use the term color Library as well and

we also managed to open the file read

the password from the file and now we

need to compare the actual code that we

return from the response

and see whether that password is correct

or not all right so the last line is US

returning the code and storing it in the

response variable so let's think about

what we need to do after it well we need

to compare the actual response with 0 1

and 2 simple as that

so in the try statement we are first of

all going to compare if response equals

equals to zero that means let's check it

out first but zero means well since 0 is

a parameter that is already set by

default or the code is parameter that is

already set by default to be equal to

zero and we do not change it if we

manage to connect that means that 0

equals successful connection so we're

going to print found password

let's print it like this so inside we

are going to add the plus sign

found

password

two dots and then let's add the password

as a string

and let's also add for which account we

managed to find the password so for

account

and then let's also add Plus

username all right

and let me just move this a little bit

to the side so everything can fit inside

of our screen and now there is the part

where we can use term card library and

what term color Library allows us to do

is to print the statements in different

colors

that's what I meant when I mentioned

that it is not needed inside of this

program but it will make it look a

little bit prettier so inside of the

print statement we're going to Define

term color

and then dot colored which is the actual

function that we need to use

open up two brackets right here

and in the first bracket we're going to

type the actual print statement which is

this thing

let us go to the site

so here we close the first bracket then

we need to add the comma and in between

the single quotes here we specify in

which color we want to print let's say

we want to print in green color

as we successfully managed to connect so

it will be green and then we need to

close the first bracket which is going

to be the bracket to the term color

function and now the second bracket

which is going to be the bracket to the

print statement

so let's check if we have the right

amount of brackets one bracket two

bracket three brackets and three close

brackets all right so everything seems

to be good

now let's go down here if we manage to

find the password let me just move this

so we can see entire code

if we manage to find the password

then we can break out of this program

since we don't really need to test

anymore we managed to find it in case we

don't manage

which will be the else if statement or

else if response equals equals to one

then we will simply just print incorrect

login and we're going to add the

password so we can see which password is

incorrect and the last case which is if

the response

is equal to 2

then we're going to print simply just

let's print it like this

and let's print can't connect

as an error so we didn't manage to

connect possibly the target is offline

and after it we want to see us exit the

program since we didn't manage to

connect there is nothing really more to

test right here and after it as the

accept statement we want to print any

other exception in case there is some

exception that we didn't cover such as

connection wrong password or didn't

manage to connect we want to print it

right here so accept exception

as e

we want to print that exception so print

e and then we can pass

since this actual exception can occur

only in one password therefore we don't

really want to break out of the program

we want to print that exception and

possibly go on to the next password okay

so this is the entire program

let's see if there is anything that we

didn't code let's delete this empty

space right here we used up all the

libraries that's been imported this is

the part of the program well we'll check

for the password and this is the actual

connection part of the program alright

so let's test it up we're going to open

up our terminal

enlarge everything so we can see it

better

and before we actually test it you might

notice that we're missing one thing and

that thing is going to be the passwords

list now once again for this for the

purposes of this tutorial I'm going to

create a small password list with around

10 passwords but if you were to perform

a real life attack you would actually

use a lot bigger password with possibly

tens of thousands or hundreds of

thousand passwords and see which one is

correct if you manage to find it

now of course in the bonus videos I will

leave a video where I will show you

where you can actually download some of

the bigger password lists that are used

for real life attacks but right now

we're going to test it on a small

password list that we're going to create

so let's go right here right click

right click right here new and we want

well we don't want that we want to go

once again a new new file just a regular

file and let's call it passwords.txt

and let's add some random passwords such

as for example hello world

one two three

five four three two one password one two

three

let's type in another password

test four three two one let's add a real

password right now so we can see whether

it works which is msf admin and let's

add two more passwords so so root and

root one two three why not so we have

around

nine passwords so let's add one more so

we can Circle it to ten one two three

four five six seven eight nine and this

is our password list all right so let's

test our program

we have our terminal open

we zoomed everything in now let's go to

the pie charm let's go to the

sh brute force and right here we want to

run the sh blue.py so Python 3 SSH root

Dot py

we have somewhere invalid syntax so

let's see where that is file.redlines

this is somewhere down here

four line in file.readlines and at the

end of the fourth statement we need to

specify two dots therefore this didn't

work let's test it once again

Target address we specify

192.168.1.3 and once again in order to

check out the IP address of your target

machine

you simply just type ifconfig inside of

your met exploitable and you will get

the inet address right here which is

192.168.1.3 in my case in your case it

will most likely be something different

so don't specify the same thing right

here okay so now that specify this press

enter the SSH username for the Met

splitable is msf admin now you can

perform this attack if you want to

practice after this on a root account on

metasploitable with a big password list

that you can download online and see

whether you can crack the root as Sage

account on the met exploitable so asset

username msf admin and passwords file

will be

passwords.txt press here enter

and let's see whether this will work as

you can see first password is incorrect

second password incorrect third and

fourth are also Incorrect and let's see

what happens once we get to the msf

admin

and here it is found password msf admin

for account msf admin

then it exited out of the program

because there is no point in testing out

other passwords

so all we need to do in order to fix

this

so it can look a little bit prettier is

we want to

print right here right after the

input file we want to print the new line

character so we can differentiate the

input parameters that we specify from

the actual passwords that it tests so

print backslash n

and let's run it once again right here

clear

182.168.1.3

msf admin and passwords.txt

here it is new line character is there

and it will perform the exact same task

as it did previously now you might

notice that this is going a little bit

slow and that is something that we will

fix in the next video as we're going to

see how we can import threading library

inside of this program to make it Brute

Force the passwords faster because in

real life attacks if you for example had

100 000 passwords this would take a long

time to actually brute force and you

don't really want to sit for a week

waiting for a hundred thousand passwords

to finish you want to finish it as fast

as possible so we're going to take a

look at that in the next tutorial I hope

you enjoyed this one

and I will see you in the threading part

of this section take care bye welcome

everyone to this lecture where we are

going to take a look at the code of how

we can make our SSH brute forcer work

faster by using thread Library

all right so here is the code and the

reason why we are not going to code it

ourselves is because it is rather

similar to the first program that we

coded in the previous few videos there

are just some minor changes as well as

adding some libraries that we're going

to need so let's start off from the

beginning well first of all there are

two different libraries that we had to

import next to these four those two are

time library and threading Library both

of these libraries belong to the default

python libraries so there is no need for

you to actually install them in your

virtual environment as they are already

there

right after it at the beginning of the

program we declare a stop flag variable

and this variable is going to be of use

to us once we get to the actual

threading part so for now on WE simply

just declare a variable and it will be

an integer value of zero in our sh

connect function we make a few minor

changes such as for example we declared

that we are going to use the global stop

flag variable inside of this function

then we perform the same two things that

we performed in the regular brute forcer

after it we try to connect and if we

manage to connect then we set the stop

flag to be equal to 1.

then after it we print that the password

was found and in any other case we'll

print incorrect login and we will close

the sh connection now let's get to the

part where we actually set the stop flag

variable to be equal to one why do we do

that well if we go all the way down

all these things are the same as in the

previous program right here I just added

a print statement that says starting

threaded sh Brute Force

and Below there we open the file for

passwords and if we go to the

passwords.txt file you will notice that

I added a few more passwords right here

around 150.

so we can see how fast it will Brute

Force the correct password is somewhere

around here and let's continue with the

program so we go into the for Loop and

we read password by password or line by

line and if stop flag is equal to zero

then we will join all threads and exit

the program

and the threads that we create are

actually down here okay so let's

not pay attention to this part of the

code at the moment so for each password

we perform the strip function onto that

password so we can get rid of all the

unnecessary characters then we create a

thread object which is going to be

called T we perform the actual thread

object and the thread function onto the

SSH connect function and that is the

first parameter to this thread function

so the target is the actual function

that you're going to perform the thread

on and the args are the arguments to

that function so in our case that is

just one argument which is the password

parameter and this comma right here has

to be there even though we don't have a

second parameter otherwise this will not

work so we have to add it right here

right after we create the thread object

and we call it onto the target of SSH

connect with the arguments of password

then we can start that thread and we can

sleep for 0.5 seconds after every time

we start a thread all right

so what this will do is it will start to

thread each time a new password is being

read from the file and each password

will have its own thread and in case the

stop flag gets switched to 1 well that

means that some of those threads

actually manage to find the correct

password as they manage to connect to

the Target therefore we set the flag to

be equal to 1 and once the flag is set

to 1 that means that we can close the

program since we found the correct

password therefore we perform the T dot

join function which will join all the

threads that running and then we can

exit the program

and that is the entire program that runs

on threads so let's see whether it is

faster than the previous one

first I'm going to go and enlarge this

then I will navigate to the pycharm and

then as Sage brute force and first we

will run the previous program

so the previous program had no threading

library and let's see how that one will

do so the target address is

192.168.1.3 in my case the SSH username

is msf admin and the passwords file is

password

or passwords.txt press here enter

it will start running we can see we got

some incorrect logins

and you can see each password takes

around one second to finish therefore

this is going rather slow so let's just

Ctrl CD so we don't wait for the correct

password

and if we run the second program which

is our threaded brute forcer

and type in the same information

it will start our threaded brute forcer

and you will see that the passwords go a

lot faster than before

as you can see we already managed to

cover more than 20 passwords and here it

is here is the correct password and few

seconds after that it closes the program

now the reason why it goes for few more

passwords after finding the correct

password is because all of these

passwords were separate threads that for

ran before this one has finished

therefore it had to finish these ones

first and then exit program

and you can see how many passwords we

managed to actually cover in just a

matter of a second or two and it also

managed to find the correct password

now the reason why incorrect passwords

are printed in Red is because I also

added a print statement

somewhere around here which says that we

print the incorrect password in red

color by using term color.colored

function which we already covered before

that's basically it for this sh brute

forcer I hope you enjoyed this section

as well as the previous two and this was

also some type of a recap video to this

Brute Force so therefore we are not

going to do a recap video as a next

lecture we are going to go straight into

the next project so hope you enjoyed

this one once again and I will see you

in the next tutorial bye

hello everyone and Welcome to our next

project which is going to be a project

on our spoofing now this is going to be

a little bit of harder project than the

previous View that we did since we're

going to interact with different packets

and different internet protocols inside

of this section we're also going to

introduce a new library which is a

massive Library called scapi which

allows us to modify send and receive

different packets and responses alright

now for those of you that are not

familiar with networking with Arps

poofing or with our packets in general I

will make sure to leave some of the

resources links so you can read more

about the Arps spoofing and understand

it a whole lot better

in this project we're going to create

two programs first one is going to be

the Manual Arts proofing so we're going

to go through the entire process of Arps

moving line by line we're going to see

the responses how it happens what we

need to specify in order for our

spoofing to happen and then we are going

to create a second program which is

going to automate that entire process

the reason why we are first performing

the manual a lot of spoofing is so we

can understand everything a little bit

better all right

now let's explain our spoofing briefly

well let's imagine we have three

machines on the network the first one is

router which is routing the connections

the second two are two different laptops

one of them is the target laptop and one

of them is the attacker laptop

now the attacker machine sends the ARP

packets which tell the router and tell

the machine that their connection should

go over the attacker's machine

how do they do that well simply the

attacker sends the router a packet which

tells the router hey I am the target

machine you can send the packets to me

instead of the real Target machine

then what we do with those packets we

read them and then we can forward them

to the actual Target machine so the

target will have no idea that anything

is happening since the packets are

arriving at the destination

if we do the opposite to the Target so

we send the arc package to the Target

which tell the target machine hey I am

the router please send the packets to me

and then

the packets that were supposed to go

from the target machine to the router go

first to our machine and then we forward

them to the router and therefore we are

the man in the middle there by ours

proofing the correction all right so

another thing to keep in mind is that

this will not work on all networks it

will only work of some networks where

our spoofing is still possible there are

a bunch of different networks in the

world that have security measures that

prevent ARB spoofing

but there is even more of them that do

not prevent ARP spoofing

so that's why we are covering this

project let's start with creating the

project inside of a pycharm here it is I

already went on file and the new project

so I will simply just type right here

Arps buffer

click on create we want to create on

this window

and we're going to start off by

importing the libraries that we need

for the first program which is going to

be us going line by line and checking

out how arp's proofing Works we're only

going to need one library and that is

going to be this KP Library so first of

all

I will go right here and click on new

python file and we will call this first

program malicious ARP packet and we can

shorten that by simply typing Mal art

dot py simple as that and all we need to

do is type fromskp.all

import

and Then star sign and the Star Sign

simply implicates that we are importing

everything from kp.all but you can

notice that the Escape is actually red

underlying therefore we need to install

it first so let's open up our terminal

53 oops pip 3 installed escapee

it will collect the library and in no

time we should have it up and running

here it is if we go right here in just a

few seconds this red line will go away

all right so let's experiment with skp a

little bit

so if I go and open up my terminal right

here

and before we actually code anything

inside of pycharm Let Us open up our

terminal

zoom in our terminal

and run scapey now you will notice that

you can simply just run scapey instead

of python in your terminal and it will

open a platform or a framework that

allows you to only execute commands

all right so here it is I will enlarge

this so we can see everything better in

case you don't have scaping installed

simply you can install it by using pip3

as we showed in pie chart

now what Skippy allows us to do is it

allows us to create different types of

packets for example we have TCP packets

UDP packets we can also create icmp

packets and in our case in this section

we are going to use our packets

so if I simply just type LS

and in brackets I specify arp

you will notice that first of all this

LS is the same as the ls command inside

of a terminal it will simply just list

all of the different fields that the r

packet has

so we have all of those fields that we

need to specify inside of an ARP packet

before we actually try to send it

we have pdst

hwdst B source and HW source and op and

these five fields are the most important

to us for this section this P DSD is

actually the destination to which we are

sending the packet the hwdst destination

Mac address which we are sending the

packet the P source is our own IP

address and the HW source is our own Mac

address

the op field is simply set to either one

or two

and the reason for that is because there

are two types of our packets if op is

set to one that means we are sending the

ARP request and if op is set to 2 that

means we are sending the ARP response

and the request is simply us asking for

example at which Mac address and IP

address is the router and the response

would be if someone asks for our own Mac

address over the broadcast we would

simply reply K that IP address is at

this Mac address and that is the ARP

response all right

but even though if you don't understand

you will understand it too the process

of coding now in order to create a

packet inside of scapey we can define

something like packet equals and then

ARP specifying which packet we want and

inside of the brackets we specify all of

these options that we need

for example I can simply specify P

destination equals and then let's say

the IP address of my router

and if I just type packet.show

you will see all of the fields for my

packet most of them will be set

automatically

you will notice that the HW source and P

Source are set automatically and this is

the MAC address of our Cal Linux machine

and the IP address of our Cal Linux

machine

the op is set to who has which means

this is a request if we try to change it

for example packets

dot op equals to

and then we type once again packet.show

we got

changed op value which is now is at so

this means we are sending a response all

right the packet type is is ipv4 and you

can see the HW type is 0x1

and all these values are set except the

hardware destination or the MAC address

of the actual Target that we want to get

the MAC address from

alright so this is just small intro to

the art packets and in the next video

we're going to implement this in our

pycharm and send our first malicious Arc

packet thank you for watching and take

care bye

welcome back

let's see how arp's pooping really works

alright so

now that we Import in our library the

first thing and the first step in order

to actually perform the Arts proofing is

to create the malicious packet

so how can we do that

well first of all we need to figure out

which machines are we trying to attack

in this case I will try to attack my

Windows 10 main PC so this environment

right here

now you can also try to attack Windows

machine but it can also be a Linux

machine if you'd like

all right so the first thing that we

need to do is to pretend that we do not

know how to communicate with our Target

machine therefore we need to find out

its Mac address first how can we do that

well we can simply just send an ARP

request through the broadcast Mac

address which means that every machine

on this local area network will receive

the request and possibly send a reply

so how can we do that well first of all

we need to create a packet

which is going to cover the broadcast

Mac address

we can set the broadcast Mac address

inside of the adder layer of the packet

so we will simply just create the editor

packet with the destination of

the broadcast Mac address which we all

know to be FF ffff and this now we

specify six times all right now if we go

to the escapee right here from our

terminal and we type LS on the adder

packet we can see it only has three

fields which is the type the source and

the destination

if I create a packet which is going to

be equal to enter with the destination

that we just specified of the broadcast

Mac address

and print packet.show

you will see that the source will

automatically be set to the MAC address

of my Kali Linux machine

and the type will be set as well as we

can see right here the destination is

set to the broadcast Mac address

but if we want to we can actually add

the r player to this Adder layer in

order to create a full packet and that

is what we're going to do

so what I'm going to do

is before even coding it in the pie

charm I'm going to restart scapey right

here and demonstrate the creation of

packet first because we have a visuals

right here therefore we can understand

it a whole lot better let's create a

broadcast packet that we already typed

in the pi term

that will have the other layer with the

destination to be equal to the broadcast

since we are sending out a request to

everyone and hopefully getting a reply

from someone who knows where our Windows

10 machine is located all right

now after we do that we need to also add

the r player so let's just create our

player right here

to be equal to the arp

and here all we need to do is specify

the IP address of our Target machine so

I'm going to check the IP address of my

Windows 10 machine right here

by opening up the command prompt and

typing ipconfig

press your enter and we can see that the

IP address of my Windows 10 machine is

192.168.1.2

so that is what we need to specify

inside of our R player we are interested

at the destination so we will specify

pdst

to be equal to the IP address of Windows

10 machine all right so we got that

ready

let me enlarge this a little bit more

and now if I simply just type R player

dot show

will have all of the fields filled

automatically by default

our IP address is there and our Mac

address is there as well the op is also

said to be an ARP request now in order

to actually combine these two packets

all we need to do is create another

variable which will be called entire

packet

and this entire packet will be equal to

broadcast

slash ARP layer

and that is how we can combine these two

packets

let me just show you right here so you

can understand it better if I type

entire packet dot show

you will see right now we have two

layers to our entire packet

the ethernet layer which we set the

destination to be the broadcast Mac

address and the r player which we set

the IP destination to be the IP address

of our Windows 10 machine

now we can send out this packet alright

so how can we do that

well we can use a function which is

called SRP

and this function allows us to send the

entire packet we can also specify the

timeout to be equal to 2 seconds and we

want to set the verbose to be equal to

true

now

this actual function will retrieve two

lists the first list will be the

answered responses and the second list

would be the unanswered machines all

right so in order to actually print that

list afterwards we first of all need to

store it and let's call the variable

answer and since I just mentioned that

it retrieves two lists we want to pick

the first list by specifying this 0

inside of square brackets since the

first list are answered responses if I

press here enter

it will tell us that it received one

package got one answers and remaining

zero packets so everything worked

properly if I type here print answer

it will tell you the results which means

that we got other response it was not a

TCP answer or UDP or icmp it was under

the other and by other it means we got

the ARP response which is good now in

order to print this response we can

simply just type print answer

and select the first element

and you will see our packet right here

now if we take a look at this packet we

will see that this is our own packet

that we sent since we have the ethernet

set for the destination to the broadcast

and the r player set to have the IP

destination to the Windows 10 machine

and this right here

would be the response that we got as we

can see the destination Mac address is

the MAC address of our own Kali Linux

machine

the source is the MAC address from our

Windows 10 machine since our Windows 10

machine sent this packet back to us

telling us that this is its own Mac

address

we can also see it right here where the

HW source is the MAC address of Windows

10 machine the P source is the source IP

address of Windows 10 machine and this

is where the Windows 10 machine sent the

packet to which is our Cal Linux machine

therefore we received it now what we

want to get out of this entire packet is

this Mac address right here

so how we can do that well we can simply

just print let's print something like

this answer

and since this has bunch of elements we

will select the first one which is this

and then we can select

the second element

under the number one if we print it

Python 3 makes no sense

wait if I just type print dot show

here it is bound method we only get the

response now as we can see right here we

no longer get this part and all we want

to select from this response is the HW

source which is this right here since

this is the MAC address of the Windows

10 machine so let's select it if we type

here Target Mac address

we can set it to be equal to

answer

first element which is the packet that

we sent and the packet that we received

but since we only want the packet that

we received we set the second element

and that is this part right here and

from the second element we want to get

the HW source which is the MAC address

of the Windows 10 machine

if I press here enter

and we print the target Mac address

we get just the MAC address of Windows

10 machine alright great how cool is

that we successfully retrieved the MAC

address of Windows 10 Machine by sending

the art packet and getting the ARP

response back to us

now it is time to get to the hacking

stuff this was all just small networking

right now we want to create a malformed

or unalicious art packet and send it

once again

how can we do that

well first we need to craft the packet

all right so we already know how to do

that let's create a variable called

packet and this packet variable will be

equal to the art packet

first since this is a malicious packet

let's see what we want this packet to do

well we want this packet to tell the

Windows 10 machine that our Kali Linux

machine is a router so it sends all of

its packets to us first of all we need

to set the op value to be equal to 2

since we want our packet to be the art

response we are telling the Windows 10

machine that we are the router we are

not requesting anything therefore we

will set the op to be equal to 2.

the next thing we want to set is the

hardware destination or the MAC address

of our Windows 10 machine and this is

why we needed Mac address that we

received from this packet right here we

got it in the Target Mac address

variable so you can either specify the

MAC address itself or you can specify

Target Mac address

all right

the next thing that we need to specify

is the P destination

which is the IP address to our Target

machine in my case that is 192.168.1.2

and the last thing that we need to

specify is the P source

if I specify psrc equals here we

specified the machine that we want to

impersonate in our case we want to be

the router therefore I will specify my

router's IP address which is

192.168.1.1 in case you don't know what

your router's IP address is you can

simply just go open up your terminal and

type in netstat dash NR

under the Gateway you will see your

router's IP address all right so let's

close this

now that we have everything ready once

again we are sending the op equals to

because we are saying that we are

Gateway so this is a response let's

press here enter if I just type packet

dot show

here is the contents of our packet we

got everything ready to go

but before we actually send out this

packet let's see what are the ARP tables

on our Windows 10 machine so how can we

do that well open up your command prompt

once again I will clear the screen and

if you type ARP Dash a

you will see the ARP table on our

Windows 10 machine we can see that the

router's IP address is at this Mac

address right here

the Kali Linux IP address is at this Mac

address right here

you will notice once we send the

malicious packet that these two IP

addresses which is the router's IP

address and the Cal Linux IP address

will have the same Mac addresses that

means that we successfully spoofed the

Windows 10 machine into thinking

that we are the router and then it will

send all of its packets to our Mac

address instead of the router's MAC

address

so let's see if this will work

in order to send this packet we will

simply just use the send function we

will specify packet and then

verbose equals false since we don't need

to see anything we send the packet and

let's go to our Command Prompt and run

the same command once again

and here it is we successfully spoofed

the Windows 10 machine

now we got the

192.168.1.1 which is our router and

192.168.1.4 which is scale Linux machine

to have the same Mac address

how cool is that we successfully spoofed

the Windows 10 machine

and this is what's called the ARP

spoofing

now if you don't run this packet in a

while loop this will most likely get

reset after a few seconds or minutes so

let's see if we still have it yeah it

already got reset back as you can see

the router is already set back to its

own real Mac address but if we send this

once again

and type the ARP Dashay once again

we spoke the router one more time

Okay so

we're going to see in the next video how

we can do this in a while loop and how

we can create a program that will

automate this entire process

so thank you for watching and I will see

you in the next tutorial bye

welcome back we are ready for our final

project of this section let's create the

ARP spoofer which will automate the

entire process and run it in a while

loop

since we already did this in the

previous video in using KP in our

terminal we don't really need it right

here

we can simply just create a new file

which we can call ARP spoofer

Dot py

all right

we need the same library that we

imported before so import

so we're going to import scapi like this

import kp.org

escapee

we also want to import the sys Library

and we want to import the time Library

all right so these are the three

libraries that we are going to need as

you can see we have all three of them so

we need to install any additional

libraries

now the first thing that we want to

prompt to the user is for the target's

IP address and router's IP address

now before we actually even code

anything let's discuss what we want this

program to do in the previous video we

showed how we actually sent a malicious

packet to Windows 10 machine telling

them that we are the router now we need

to do that two times so we need to send

the malicious packet to Windows 10

machine telling the Windows 10 that we

are the router and we also need to send

the malicious packet to the router

telling the router that we are Windows

10 machine

and then we can forward the packets from

one machine to another

and vice versa

if you think about it it should be

rather easy so let's start with it we

first of all need to prompt the user of

this program to specify the target's IP

address and the router's IP address

all right so let's start with the target

IP

and since we imported assist Library we

can simply just specify that the target

IP will be equal to the sys dot arc V

which is number two and this basically

means that we are going to read the

targets IP and the router's IP from the

command line once the user of this

program runs it let me just give you a

quick look if so you can understand it

uh

for example this program will be ran

something like this so Python 3 ARP

spoofer

oops Dot py and then after it we would

specify

192.168.1.1 and

192.168.1.2 so the first argument will

be

the IP address of our router and the

second argument will be the IP address

from our Target machine and then we're

going to read the IP addresses from the

command line and store it into these

variables so the target IB will be the

second parameter or in this case the

third parameter since counting of

elements starts from 0 and the zero

element is the actual name of the

program all right and we are left with

the router IP to be equal to sys.org V

first element or the second element in

this case which will be the

IP address of the router all right so

we're going to read these two from the

command

then we're storing it right here and the

next thing that we want to do with these

two information since this is the only

thing that we are going to get from the

user of this program we want to get the

Mac addresses for these two Targets

so how can we do that well let's simply

specify another variable called Target

Mac and that variable will be equal to

get MAC address

from the targets IP

then you will see that this is red

underlined that means this function does

not exist therefore we are going to have

to code it and don't worry about it we

already kind of coded this function in

the previous video once we saw the

process of getting the MAC address of

our Windows 10 machine all we need to do

is the same the exact same thing just

now we need to do it with both Windows

10 machine and the router

so let's type it right here router Mac

equals

get MAC address

from the routers

IP

and we need to make sure that all of

these variables are strings as we are

going to use them so we're just going to

wrap them just in case inside of a

string

function

all right so string

we also want to make sure that the IP

addresses are strings

just in case let's wrap this so we have

everything set to go

now what we need to do is we need to

code the get MAC address function

so let's code it right here

let's define it first so Define get MAC

address

let's lower this in for just a second so

we can see the program better and since

we already noticed right here this

function will take a parameter the IP

address

whether it is the IP address of the

Target or the router it doesn't matter

the function will perform the same so if

we remember from the previous video what

we first did is we created the broadcast

layer

that will be equal to KP dot ather

with the destination

to the broadcast Mac address

alright so this is the first layer and

the second layer you already know is the

ARP layer

this will be equal to kp.arp

and the P destination has to be set to

the IP address of this actual function

so in this case it will be the targets

IP and in this case the router's IP

basically once again we are sending the

broadcast Mac address so we're sending

to the entire network asking what is the

MAC address of this IP address right

here

all right

we already know that the other fields of

the r packet will get filled

automatically so we don't need to

specify them by default if you remember

the op parameter of this art packet will

be set to 1 which means it is by default

a request so we don't have to set that

as well

and right now let's create a packet a

final packet which we can call get Mac

packet

just so we can understand everything

better once we read the program code

and this get Mac packet will be the

broadcast layer slash ARP layer

all right

all we will have to do is send this

packet and retrieve the MAC address

if you remember we will store this

inside of our answer variable and then

we will perform the SRP function which

sends and retrieves the response

we will perform that on the get Mac

packet

with the timeout of two seconds

we want to set different post to be

equal to false

and we want to grab the first element of

this list which is going to be the list

with answers

all right and then from that list with

answers we want to return the MAC

address of the specified Target so we

are returning the answer this answer

variable will also have a bunch of lists

so we need to set right here that we

want the first list

then from the first list we want the

response which is going to have the MAC

address of the Target and therefore we

want to get it with HW SRC so we are

returning the MAC address of the target

machine

alright so before we continue anything

let's see whether this works

at the end we're going to print

the router Mac

and we want to print

the target Mac

so let's run the program we already know

that we have to run it like this so keep

in mind that you do not reverse these

two IP addresses the first IP address

that should go is the router's IP which

we can see right here since this is the

element 2 and this is the element 3 and

the second argument is the target's IP

so if I run this

we get both of the Mac addresses printed

out at the screen so we successfully get

the Mac addresses to our router and

Target machine

good

in the next video we can code this poof

part which is going to actually send the

malicious packet and create our spoofing

between these two Targets so thank you

for watching this lecture and I will see

you in the next video bye

welcome back so for now on half of the

program is done good we managed to get

Mac addresses from our Target and our

router now it's time to actually perform

the hacking stuff and spoke these two

Targets

alright so let's do it now that we got

the Mac addresses let's see what's next

step first of all I'm going to delete

these two print statements as we don't

really need them

at the moment

lower this

and now if you remember we need to enter

a while loop in order for our spoofing

to last longer

so what we are going to do is I'm going

to type the try and accept statement

right here

and in this try statement we'll simply

just try to spoof the targets so while

true

we want to spoof

and we will see in just a second what

parameters will this pull function take

and in the accept statement we want to

accept

keyboard Interruption and the re the

reason why we're specifying the keyboard

interrupt is because if you take a

closer look this is a while true Loop

and while true Loop are infinite Loops

that means this false proof for the

infinite amount of time therefore we

want to make sure that at any time that

we want to stop the program we'll simply

just keyboard interrupt and it will

close the spoofing

so I will print right here

closing arp's buffer

and then we can simply exit the program

all right

so now let's get back to this both

function it is read underlined of course

because it doesn't exist therefore we

will have to code it but before we do

that let's take a look at what

parameters this function should take

well

it actually has to take all of these

four parameters right here since we want

to spoof both to the targets and for

each of the target we need its own Mac

address and its own IP address therefore

we need to send all of these four

variables into this spool function

let's keep a track of in which order we

are sending them so we're first of all

going to send

router IP

then we will send Target IP

then we'll send router Mac and the last

thing we need to send is the target Mac

so we are sending these four variables

and right here we will code the function

itself

and keep in mind that we need to specify

the exact same order of these variables

so we don't get error when running the

program

the next one is Target IP

after it comes the router Mac

and lastly the target Mac here it is now

let's see what we need to code right

here

in the first video of this section once

we created the first malicious packet we

created it using an OP equals tool which

is a response which is good it should be

like that and we're going to do the same

thing right here just right now instead

of one packet we're going to create two

packets one will be sent to the router

and the other one will be sent to the

Windows 10 machine spoofing them both at

the same time

so let's create a variable which will be

called packet one

the packet one will be a packet that we

will determine to go to the router

so how can we do that we'll we'll simply

create escape.arp packet as usual

we send the op to be equal to 2 since

this is a response and in order to to

navigate this packet to router we simply

send the hardware destination to be

equal to router Mac

we also need to send the P destination

to be equal to router IP

right here and another thing that we

need is going to be the P source

now before I actually type this B Source

I will create packet2

which is going to be navigated to the

Windows 10 machine

or to your own Target machine which is

not router

op has to be equal to two

Hardware destination has to be equal to

Target Mac

NDP destination has to be equal to

Target IP

and P Source once again we're going to

leave empty right here

and the reason why we are leaving it

empty what do you think what should be

the P Source or the packet source

in the first packet

keep in mind that the P source is the IP

address of the machine that is sending

this packet so in our case that will be

the IP address of the cataly Linux

machine

but we're not going to specify the IP

address of the Cal Linux machine because

then it would just be a regular packet

we want to create a malicious packet

that will be able to spoof the

connection

so what we need to specify right here is

the target's IP

we want to send this packet to the

router and make it seem as it came from

the Windows 10 machine

the same thing goes with the packet 2.

we want to send this packet to the

Windows 10 machine and make it seem like

it came from the router therefore in the

packet 2 we are specifying router IP

simple as that

all we are left to do right now is send

these two packets

so how can we do that well using the

send function so kp.send

we will first send back F1

and then scapit.send

packet two

all right simple as that and our program

is almost done all we are left to add is

right here under the while true Loop

below this pull function we want to add

a small timeout so it doesn't spoof too

fast we want to add time.sleep

let's sleep for 2 seconds between each

and every packet that we send so we will

send the ARP response the malicious art

response every two seconds and we will

keep the ARP tables updated with the

incorrect Mac addresses to the router

and Windows 10 machine

so our program should be finished now

Let's test it and see how it works if I

open up my terminal right here

clear the screen and type python Arps

and then I specify

192.168.1.1 so first goes the router's

IP address and then 182.168.1

.2 this is the Windows 10 IP address

before we run it let's check once again

the arc tables of this target machine

let's also open a browser so we can see

that we can connect to the internet

okay so here is the browser and every

time we actually open this browser our

connection goes through the router

through this Mac address and then it

retrieves this page back to us and right

now we're going to try to make this

browser open the page while going

through our Linux machine

so let's run the program

it will print right here send one packet

these are the packets that are being

sent each and every two seconds as we

specified right here now let's check the

arc tables on our Windows 10 machine

and we can see we successfully spoofed

the MAC address of the router now the

Windows 10 machine thinks that the

router is our Linux machine and sends

all the packets to us

same goes with the router the router is

also spoofed and sends all the packets

that should go to the Windows 10 machine

to our Cal Linux machine

now if we try to go

and open

some page

I clicked on a random website you will

notice that it will load pretty long

matter of fact in just a few seconds it

will say that the actual connection

cannot be established and it will not

open this page

now why is that well let me click X

right here

if we close this program right here

there is one thing that we forgot to do

we successfully spoofed both of the

targets but now we perform more of

something like a Dos attack on both of

these targets as they cannot connect to

the internet anymore

that is because we are not forwarding

packets from one target to another

in order to be able to forward the

packets we need to run the command

inside of our terminal

which is Echo 1

and then these two arrows to write at

this location so slash proc slash sys

slash net

slash ipv4 and slash IP forward

press here enter

and if I run the program once again

and try to load the website

now it loads successfully

we can load every website that we want

if you want to we can also go to

facebook.com

it will load all the pages without any

problem and on the Windows 10 machine

you will not notice anything out of

order you will most likely never know

that you have been R spoofed and that

someone can read all of your information

the only way that you can actually

notice that if you simply just go to

your command prompt and type the command

arp-8

and you notice that two different IP

addresses have same Mac address this is

a good indication that at the moment you

are being arp spoofed all right so we

can see our arp's buffer works correctly

now all the packets are going through

our own machine and we can read them if

we want to but more about that in the

later sections when we code our own

password sniffer then we are going to

combine our arp's buffer right here with

the password sniffer and we're going to

see how these two tools will combine in

order for us to sniff the passwords that

some more types in their browser alright

so that would be about it for this

section in the next video of course we

are going to perform a small recap onto

this program and then we will proceed to

the next project

thank you for watching and take care bye

welcome back and before we finish off

with this section let us do a recap on

our ARP Stover

so we'll start off from the beginning of

the program

we first prompt the user from 40 Target

IP and the router IP which they provide

us with the command itself so the

command goes Python 3 arp's buffer then

the IP address of the router and then

the IP address of the target machine

then with these information that we

gather from the command itself we

proceed to perform our own function

which is get MAC address function using

these information to get the target Mac

address and the router Mac address so we

use this function right here which is

get MAC address

we craft our own packet that will

consist of the broadcast layer which

will be the ethernet layer containing

the broadcast Mac address as the

destination

the second layer will be the r player

which will contain the IP address of the

target machine as the destination IP

then we craft that packet by adding both

of these layers together and then we

send the packet from the response of the

packet We Gather the MAC address of that

machine

right after we do that for both the

target Mac and the router Mac address

then we proceed to go into the while

true Loop or the infinite Loop which

will perform the spool function every

two seconds

so at every two seconds this function

right here will get executed and what

this function does is it creates two

different malformed or malicious packets

which one of them the first one spoofs

the router while the second one spoofs

the target machine

then we send both of these packets and

we perform that action every two seconds

in case we want to close the program we

simply just keyboard interrupt it and it

will exit the program

so we tested it in the previous video

therefore there is no really need to

test it right now and that is the entire

Arps spoofer now keep in mind that you

should not delete this program as we are

going to use it throughout the course in

order to show you what is the real power

of this ARP spoofer once we get to the

password sniffers the password crackers

and so on and so on for now on let's

just be there and wait for us as a

project in the pie chart and then we're

going to get back to it as soon as we

need it again alright so that would be

about all for this section I hope you

enjoyed it and I will see you in the

next project bye

hello everyone and welcome to the

password sniffer project

since we finished our ARP spoofer the

best idea would be to continue with the

project that we can combine with our

Arps buffer in order to be able to do a

complete attack

we already know that our Arab spoofer

can create man in the middle that allows

us to save the packets from the target

machine that we specify and right now we

need a password sniffer that will be

able to extract usernames and passwords

from all the packets that flow by

therefore let's get this going hopefully

you're excited and let's create a new

project

go on file new project and password

sniffer

let's call it like that

we want to create it in a separate

window

creating the virtual environment as

usual and for this project we're going

to use some libraries that we haven't

encountered before

so let's import them straight away we're

going to create our file new python file

and let's call it pass

Dash sniffer dot py simple as that we

are going to need escapee Library

which we used before so nothing really

to explain right here

and we will also need the URL lib

Library

all right and the third library that

we're going to need is going to be the

re or the regex library and the regex

library is something that we are going

to need in order to extract the

usernames and passwords from the entire

packet alright

now our program will have two different

functions

one of the functions will parse the

packets that we Sniff and the second

function will try to extract the

username and password from those packets

but before we do any of that and before

we code those two functions we first of

all need to start sniffing for the

packets

now let's imagine that our arp's buffer

is running so what we would want to do

is we will want to try to sniff those

packets and this sniff function is

something that exists in KP so we don't

really need to code it we simply just

specify Sniff and it will gather all the

packets on the specified interface

sounds good right so since I said that

it will gather the packets on a

specified interface therefore we need to

specify the interface

we will select the iFace to be equal to

I face

and we can code up here I face to be

equal to your interface in my case that

is eth0

now in order to check out what is the

name of your interface you simply just

open up your terminal and you can type

ifconfig

the interface is the name right here

since I'm using ethernet cable on Kali

Linux and this is the actual interface

which I am using to connect to the

internet I will specify this name inside

of my program

if you are for example using a wireless

adapter you don't want to specify this

interface you want to specify the

wireless adapter which you are using to

connect to the internet

if you're simply just connecting over

the internet cable like me feel free to

specify the ethernet interface all right

simple as that let's close this

now that we got that out of the way

let's continue with our sniff function

the next parameter is going to be PRN

which simply means whatever we specify

after the equal sign

that function will be used in order to

parse the packets that we sniffed using

this sniff function

so we're going to create later on a

function called packet parser

and the third parameter and last

parameter is going to be stored to be

equal to zero so we don't want to store

anything we don't want to save it

anywhere we simply just want it to Flow

by

all right so as I mentioned before there

are two functions that we are going to

need the first one will be the packet

parser which we use to parse the packets

from our sniff function as we can see

right here

so packet parser

this packet parser will take one

parameter which will be the packet

itself or we can simply type it like

this packet

and the second function would be

Define get login pass

and this function will also take a

parameter which will be

Well for now on we're not we're going to

leave it without the parameter and we're

going to add it later on we created

these two functions all we're left to do

is run the code inside them

but let's not get ahead

we're just going to leave them for this

video and right here we're going to add

the accept statement

of course keyboard interrupt if we

interrupt the keyboard

then we can print for example exiting

and we can then sis or because you could

just exit the program since we don't

have the sys Library imported

and one more thing before we finish off

with this video is that we need to

install this KP Library

we know how to do that pip3 install

Skippy

and after this downloads we should be

good to go and we should be ready to

code these two functions in the next few

videos

so thank you for watching this

introductory video on password sniffer

and I will see you in the next lecture

bye

welcome back let's continue with our

password sniffer

so the first function out of these two

which we mentioned that we are going to

need is this one we want to first of all

parse the packets and filter them should

I say so we want to filter for the

specific packets that might contain the

username and password and then only

after this is done we're going to paste

the content of those packets into this

get login password function and in this

function we're going to extract the

username and password all right so let's

start off with packet parser

first thing that we need to specify

right here is we need to check for

whether this packet has the TCP layer

now we can simply just do that if we

specify if packet

dot has layer

and this is a function that exists in KP

we simply specify in the brackets which

layer we want to look for in our case

TCP all right so if packet has this

layer

then we're going to filter It Forward

there is another layer that you should

have and that is

packet dot has layer

Raw

and this raw layer is just a sub layer

of the TCP layer so if there is a raw

layer there is for sure going to be a

TCP layer

well in most cases

now another thing that we want to

specify right here is if it also has

the IP layer

now if these three statements are

satisfied then that is the packet that

we are looking for so we're going to

type right here two dots

and you might notice that right here

these names are red underlined well some

of them uh don't worry about that we're

going to worry about that later on it

will most likely even work without us

having to fix anything right here and

that is just some problem with the pie

charm itself so no need to worry about

that at the moment if there is anything

that we need to fix later on we are

going to fix it all right so now that we

got this statement right here

if that statement is fulfilled what we

want to do is we want to extract the

body of the packet

since in the body of the packet there is

going to be all the information that we

are looking for such as usernames and

passwords how can we do that well we can

simply just specify a variable which

will be called body and that variable

will be equal to the string

of the packet TCP part so we select it

like this in the square brackets and

then we want to select dot payload

all right so we're selecting the packet

taking the TCP part and inside of the

payload of the TCP layer there is going

to be a username and password in case

the target tried to log into some page

now what we want to do is we want to

send this body to our second function

which is going to be get login pass

so let's call the function get login

underscore pass

and we will pass the body straight to

that function

so let's go over this once again

we sniff on our interface which is eth0

then we check for each and every packet

if it has layer TCP if it has layer raw

and if it has layer IP if all of these

three conditions are met then we select

the body variable to be equal to the

payload of the TCP layer

once we select that we send this body to

our second function which is get login

pass

now inside of this function what we need

to do is we first of all need to need to

select two different variables first one

is going to be user to be equal to none

and password to be equal to none

now none simply means that we do not

have any value at the moment inside of

these two variables and hopefully at the

end of this function we should have the

username and password stored right here

so let's end our tutorial here and we

are going to continue in the next

lecture with the coding of our two

functions take care bye

welcome back this is our third tutorial

to our password sniffer

and you might notice that I added

something right here that we didn't have

in the previous video and those are

these two lists so I added the user's

fields and the passwords fields

these two lists are going to help us to

find for the usernames and passwords

inside of the body that we paste to this

function

so right here now that I mentioned body

I will paste it straight away since in

our packet parser function we do call it

as a parameter all right

so we're going to check for each and

every element from this list if it is

located inside of this body and if it is

we're going to print the username and

the password

now for you you don't really have to

type all of this if you don't want you

can go to the resources of this project

or at the end of this section and

download this program and simply just

copy and paste these two Fields all

right

so let's get straight into the coding

now that we have these two fields for

all the possible names for the usernames

and the passwords what we can do is we

can iterate over each and every element

so for example let's go over the user

Fields first

so far login

in user fields

we can simply just do

what we're going to do right here is

we're going to use regex in order to

extract the user names now I will first

type it right here and then I will

explain it to you so I'll create a

variable called login underscore R E

standing for regex and I'm going to call

the regex library with the search

function

in that function I'm going to specify

the pattern

which will be percent s equals open

square brackets close square brackets

upper sign

then this sign right here not really

sure how it is called and then at the

end we specify a plus

okay so this is our pattern and

wait for just a second I will explain it

we then type percent

login

and then comma body and then comma r e

dot ignore case

okay so before we continue I need to

explain this line a little bit better

so what we're doing right here is we're

creating login.re object

now we're calling the re Library which

is the regex library and on this Library

we are calling the search function what

this search function does is it takes a

pattern that we specify which is this

right here and to explain this pattern

you really need to know regex so if you

do know it that's great if you don't

know it well then I will leave some

resources in the description so you can

get more familiar with regex and its

patterns what basically this is is the

pattern which we are going to use in

order to try to get the usernames

the second parameter to this function is

the body and body simply means where are

we going to search for the username so

we're searching the usernames in body

and the last parameter which is ignore

case simply means that we don't care

about the uppercase and lowercase

letters okay

now this pattern right here this percent

as since that is the first thing will

get replaced with the login and keep in

mind the login is the iterable and it

will be each and every of these elements

so for this example let's take this

element

what we are looking for is something

like username equals and then something

right here

this pattern simply specifies something

like this if we find this inside of a

body that means that we successfully

found the username and we're going to

print this to the screen

okay so let's delete this

now that we got that out of the way

we now need to check whether there is

anything stored inside of this login

since if there is that means we found

the username so if login underscore re

then our user variable which we created

at the beginning of the program and set

the value of none to it is going to be

equal

to login underscore re dot group and

group are just the results that we got

from this function right here therefore

it will simply just store the username

inside of this variable

all right so the same thing we need to

perform for the passwords as well so

let's go right here for pass field

in pass fields

we're going to create an object once

again called pass underscore re and we

perform the exact same thing so I'm

going to copy this

so we don't have to type it twice and

paste it right here

well not there we don't want it there we

want it here okay good

now the pattern right here will remain

the same as for the usernames just in

our case what we are searching for is

something like this password equals and

then random password okay

so let's delete this and in order to

actually search for a password we need

to replace this login

with pass field

since we are iterating right now over

the second list which is the possible

names for the password field

okay

all of this will remain the same and now

we need to check whether we got this

so if

if pass underscore r e

then we are going to store in our pass

WD variable which is once again at the

beginning of this function and set to

none

we will store

as underscore re dot group

okay good

and now at the end

we need to return these two values so we

will specify if user and password

we will return

both username and password

all right so this is the entire get

login pass function and now we are ready

to go back to our packet parser function

now before we close this video I'm going

to just select the username comma

password to be equal to get login pass

with the body as a parameter since we

are returning the two values from this

function

therefore we need to set those two

values inside of these two values

user will be set inside of a username

and password will be set inside of a

password so in the next video we're

going to wrap up our program and we are

going to go for a first test of it all

right so thank you for watching this

tutorial and I will see you in the next

lecture bye

welcome back

so we've had quite a tough task in the

previous few videos but we managed to

get it all to work now it's time to wrap

up our program and run it for a first

test

so what we did for now is we returned

the username and password extracted it

from the body and stored it in these two

variables now what we need to do is we

need to print these two variables as a

result so right here after this we need

to check whether username and password

is not equal to none

oops seems like we cannot specify two of

these variables so we need to delete

this what we're going to do instead

is we are going to store this inside of

one variable let's call it like this

now the reason why we're storing it in

one variable is because we can use one

if statement later on even though we are

returning two values this will both be

stored inside of a user pass just as two

different elements all right so

after that we can check whether if user

underscore pass is not equal to none and

what this simply means since we set the

user and pass to be equal to none if we

don't manage to find any username and

password these two values will remain

none and they will be returned as none

at the end of the function therefore

right here we are checking if user and

password is not equal to none and we

specify that with this exclamation mark

and equal sign

then what we want to print

is parse dot unquote

and this is just a way for us to print

these two values so parse.unquote and we

will select the first element of the

user pass

and we need to select the second element

which would be the password as well so

parse dot unquote

user underscore pass

and the second element okay

so once again if these two values are

not equal to none we will print the

username and password

in any other case

and by in any other case I mean if we

encounter any other packet that doesn't

satisfy these three statements right

here

we're going to Simply pass and let that

packet go since it will probably not

store any username or any password

all right so this should be the entire

program

here it is let's see how it runs

if I open up the terminal

clear the screen and run it

you will see it did run successfully we

don't see anything right here nothing is

being printed so let's check out whether

we can get something to print right here

if we open up our Firefox

and I simply go to the

192.168.1.1

which is my router's login page and I go

for example type hello as a username and

world as a password and click on login

you will see right here we do get both

username and password now the password

is encrypted but that is because of my

router security therefore our program

successfully works

we do manage to get the username and

password now let's see on another

website as well let's go to our good old

test php.phoneweb.com

here if you go on the sign up we will

have a page where it will ask us for the

username and password so let's type the

username and password right here let's

go once again with hello and then world

click on login

and we get both hello and both World in

our terminal right here so our program

worked correctly

now in case you also want to get from

which website are these usernames and

passwords coming from which would be a

good idea

all you need to do is go down

in our packet parser function and if the

packet has these three statements

fulfilled

we also want to print packet

TCP

and then dot payload

all right so let's go and run it once

again

and go to Firefox and type

oh never mind we will be printing a

whole lot more packets than we need so

this actual statement

should go

here

and not here so we only want to print it

if the user and pass is not equal to

none so let's go once again and print it

now once we reload we are not getting

any random packets so let's type right

here admin and password will be password

click on OK we get the username to be

admin and the password to be password

and we also get the entire packet above

so now we can see

that the login is coming from this

website

we also see a bunch of other different

information which could be useful to us

but for now on we're only interested in

this host information and in these two

values which are username and password

all right

now that we are sure that our program

works and that we can sniff usernames

and passwords on different websites and

by the way keep in mind this will only

work on HTTP websites if you want to

sniff the information and passwords over

the https websites you will also need to

run a cell strip on the site

and that will only work for the S cell

connections and not for the TLs

encryption all right

but

let's put that on the side in the next

video we can combine it with our Arps

buffer and see how we can sniff the

usernames and passwords on a different

machine the same way we did right now in

Kali Linux just we're going to try to

sniff the usernames and passwords on

Windows 10 machine

so thank you for watching this lecture

and I will see you in the next video bye

welcome back and this is the first video

where we are going to test two of our

tools together

we're going to test our passwords to

infer that we coded in this project and

we're going to combine it with our Arps

buffer that we created in the previous

section so let's see how that will go

first what we need to do is open up our

terminal and I will go on to the actions

and split the terminal horizontally so

it will have two of these screens right

here

in the first screen I will navigate to

pycharm

and I will navigate to the password

sniffer project

and in the second screen I will navigate

once again to pycharm and to arp's

buffer project

all right

so if I type LS in the ARP spoofer

you will remember that our arp's buffer

code requires us to specify the target

IP address and the router's IP address

has two arguments to the command

so let's run the arbit hover right away

I will type python 3.

arp's buffer

192.168.1.1 and the IP address of my

Windows 10 machine is 192.168.1.2

run this and this will start working as

we can see it is not closing it is

sending two packets every two seconds

if you want to check whether it worked

we can simply just go to the CMD or the

command prompt in Windows and type ARP

Dash a and we will see that both of the

Cal Linux and router have the same Mac

address therefore our Arps proofing

worked

now let's see how this will help us to

actually sniff the password on Windows

10 machine

now if I go to my password slaver and I

simply just run it so python3

password sniffer

as we can see it seems to work correctly

all we are left to do right now is go on

Windows 10 to Google Chrome or any

search engine that you're using

wait for it to open up and once it opens

up let's first of all go to my router

right here

whoops it will not connect because you

remember we forgot one thing so let us

just close our apps buffer

for a second we actually have to forward

our packets first so let's do that with

the command echo1

two arrows to the right slash Brock

slash sys

slash net slash ipv4

and slash IP underscore forward once we

do that we can run our spofer once again

[Music]

okay so it is working let's go back to

our page and try to reload it here it is

and if we type some random username such

as for example admin and password to be

password

press on login and go back to our Cal

Linux machine we will get the full

packet printed out right here here is

the username and the password due to

security measures is actually set to be

encrypted and we can also see the actual

host or the website to which these two

Fields have been specified and in this

case it is

192.168.1.1 or our router now if we go

on to the different website which is

test

php.phoneweb.com and we go to the sign

up specify right here admin and then

password

click on login go back to our care Linux

machine we will also get that packet as

well okay so here it is username is

admin password is password in plain text

we can see it right here

and we can also see where are these

fields specified in our case they are

specified on this website right here

alright so our password safer works we

combined our two tools our password

sniffer and our arms buffer in order to

sniff the passwords from the HTTP

websites on the different machines on

our local network now if you want to do

this on multiple targets at once you can

either just upgrade our arf's buffer to

be able to spoof every machine on the

local area network or you can use a

different tool with combination with our

password sniffer so you can use a tool

called for example mitmf not really sure

if it is installed right here yeah you

can also use the mitm proxy but I would

advise you to go into the Firefox

if you want to use the real man in the

middle and ARP spoofing tool that comes

with bunch of different options that

will help you fully execute your attack

you simply just go and download a tool

called mitmf

you would simply just click on this

first link

go all the way down you would clone this

page with Git clone then you can go to

the installation instructions right here

and follow these instructions in these

commands in order to install mitmf

properly once you do that you can simply

just use the tool to perform ARP

spoofing and use our password sniffer in

order to sniff passwords on every

machine on local area network

okay so that would be about it for this

section we successfully saw how we can

combine these two tools and in the next

project we're also going to see another

tool that we will create that you can

either combine with our spoofer if you

like or you can simply just use it on

your own with another tool perhaps such

as mitmf or with the any other tool that

performs man in the middle attack as

well okay so thank you for watching this

section and I will see you in the next

project bye