© Sanjib Sinha 2018
Sanjib SinhaBeginning Ethical Hacking with Kali Linuxhttps://doi.org/10.1007/978-1-4842-3891-2_5

5. How to Build a Kali Web Server

Sanjib Sinha1 
(1)
Howrah, West Bengal, India
 

The first release of Kali Linux made the hacking community sit up and take notice. In 2012, this Debian-based Linux distribution introduced new architectural patterns with more than 300 hacking-related tools specialized for penetration testing and digital forensics.

Kali 2.0 was introduced to the hacking community in 2016. This time it included even more hacking-related tools, with many updates and new desktop environments such as Xfce, KDE, and more. Offensive Security Ltd. maintains and funds Kali Linux now, and the number of tools has exceeded 600 and continues to grow.

However, the real benefit is when you combine Kali Linux and Python in a creative manner. One is a Debian-based Linux distribution for penetration testing purposes, and the other is a great programming language with a huge library available (Figure 5-1) for penetration testing and digital forensics.

As you see, they have one thing in common, and that is related to information security. Quite naturally, this combination has fast become the best tool combination to use in ethical hacking.

In this chapter, you will learn how to build a Kali Linux web server by using the Python Socket library.
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig1_HTML.jpg
Figure 5-1

Writing a Python Socket library script in Kali Linux

Why Do You Need a Web Server?

In the coming chapters, you will see how this knowledge of building a web server helps you understand many hacking-related processes including sniffing, SQL mapping, and using frameworks like Metasploit and Armitage.

A simple real-life example will make this clear. Suppose you are going to exploit a remote system by sending a malicious link. In this case, you need your own web server because the target will click the link and connect with your server through a certain open port so that a session is created on the target machine. Once that session is created, you can enter the target system through the shell using your web server. (I will show how to do this in detail in Chapter 15.)

It is always a good practice to hide your tracks from the beginning. To that, you need to keep your anonymity intact throughout the operations phase. Therefore, you need to make your web server anonymous. So, in the first half of this chapter, you will learn how to build your own server, and in the second half, you will learn how to hide your tracks by making yourself anonymous.

Before building a web server, you should know a few things about sockets.

Introducing Sockets

On a computer network, there are internal endpoints that are meant for sending and receiving data within a node. A socket is the representation of these endpoints.

Basically, sockets are virtual endpoints of a communication channel between two processes. Here, a “process” could be a program. These programs or processes may stay on the same or different machines. You may simply call it network communication.

Sockets are the fundamental things behind these network applications. An example is when you open any web site in your browser and your browser creates a socket and connects to that remote web server. There is a socket on that web server also. That web server accepts the connection and sends your browser the web page that you have requested.

Beginning the Web Server

You will now build a Kali Linux web server that listens to a certain port and connects to the client.

Let’s write a Python file called myServer.py first .
# myServer.py will create a Kali Web Server
import socket
import sys
# We need to pass an empty string, so that all interfaces are available
HOST = "
# You can choose any arbitrary port number
PORT = 8080
mySocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print('Socket has been created')
# Let us bind the socket to local host and port
try:
    mySocket.bind((HOST, PORT))
except socket.error as msg:
    print('Binding has failed. Error Code is : ' + str(msg[0]) + ' Message ' + msg[1])
    sys.exit()
print('Socket bind is complete. Now we can proceed to make it listen...')
# Server is listening now on socket
mySocket.listen(10)
print('Socket is now listening')
# Let the server keep talking with the client
while 1:
    # We are waiting to accept a connection - blocking call
    connection, address = mySocket.accept()
    print('Connected with ' + address[0] + ':' + str(address[1]))
mySocket.close()
Let’s run the file through the terminal, which will start the server to run a Python script. You just type python and after that write the name of the file.
python myServer.py

The output says that the socket has been created; the act of binding has been done. Then it has been put into listening mode. At this point, try to connect to this server from another terminal using the telnet command .

The port is 8080 (in fact, you can choose any port like 8888 instead 8080). It is common to use predefined port numbers. The standard ones are usually booked up like 80 for HTTP and 443 for HTTPS. Port numbers range from 0 to 65535; however, 0 to 1023 are reserved. They are designated as well-known ports.

Next, issue this command on another terminal:
# telnet command to run the localhost
telnet localhost 8080
Now you have two terminals. The first one is running your Python file, and the second one is trying to run your newly created Kali web server on port 8080. The first terminal will give output like this:
# output from the first terminal
pg@kali:~/PyCharmProjects/kaliServer$ python myServer.py
Socket has been created
Socket bind is complete. Now we can proceed to make it listen...
Socket is now listening
Take a look at the second terminal. The telnet command now should connect to the newly created server. The server terminal will definitely show this:
# the output in the second terminal
pg@kali:~$ telnet localhost 8080
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Once it gets the connection, the first terminal will immediately spit out this output:
# output on the first terminal after it gets connected
pg@kali:~/PyCharmProjects/kaliServer$ python myServer.py
Socket has been created
Socket bind is complete. Now we can proceed to make it listen...
Socket is now listening
Connected with 127.0.0.1:47720

Congratulations! You have successfully created your Kali Linux web server by using the Python Socket and System libraries .

Diving into Sockets

Let’s delve into sockets in more detail. You’ll also see more examples of how you can connect to a remote web server like Google. You will also rewrite your old code of creating a local web server in a different way.

By the way, the term socket is also used for an internal endpoint of local interprocess communication (IPC). It is not over a network. You need to understand how Python handles this interprocess communication.

Python provides two levels of accessing network services.

  • At the lower level, you can access the basic socket support, like you created in your own server. In a different sense, it is nothing but the underlying operating system that allows you to implement the client and the server for both—the connected and the connectionless protocols. For a connected or connection-oriented client-server protocol, all packets will follow the same path. In a connection-less protocol, this path will be random. In both cases, packets will be transferred from one device to the other. Connection-oriented protocols are faster than the connection-less because traffic congestion is greater in the latter. Connection-oriented protocols are also more reliable. The main difference is in the connection-oriented protocol. Until one party ends the connection, the connection does not terminate. But in the connection-less protocol, once a packet is sent, the connection terminates, and it waits for further requests.

  • Python also provides a higher level of access through its rich variety of libraries. Using these libraries, you can target specific application-level protocols such as HTTP, FTP, and other protocols.

Therefore, sockets are the bidirectional endpoints of protocols that open up communication channels between the clients and the servers. Sockets also serve the processes, where the process is working with the local client and the remote server is residing on a different continent.

Let’s see an example of how this works.
# How to connect to Google by using the socket programming in Python
# the first line refers to the socket, we need to import it from the library
import socket
import sys
try:
    mySocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print("Socket successfully created")
except socket.error as err:
    print("socket creation failed with error %s" % (err))
# default port for the socket
port = 80
try:
    host_ip = socket.gethostbyname('www.google.com')
except socket.gaierror:
    # this means could not resolve the host
    print("there was an error resolving the host")
    sys.exit()
# connecting to the server
mySocket.connect((host_ip, port))
print("the socket has successfully connected to google on port == %s" % (host_ip))
Here is the output:
/home/pg/PyCharmProjects/kaliServer/venv/bin/python /home/pg/PyCharmProjects/kaliServer/kaliServer.py
Socket successfully created
the socket has successfully connected to google on port == 74.125.200.99
Process finished with exit code 0
Figure 5-2 shows a Kali Linux web server working through a Python script.
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig2_HTML.jpg
Figure 5-2

Kali Linux web server working through Python script

INET sockets account for at least 99 percent of the sockets in use. You have used this type of socket in the Python code where you created the socket. This Internet socket is IP protocol based, which is why most web traffic uses this protocol.

You are using the socket.SOCK_STREAM sockets here, because you need a connection-oriented TCP protocol so that it will be reliable and faster than the connection-less protocols. Others are as follows:

  • socket.SOCK_DGRAM

  • socket.SOCK_RAW

  • socket.SOCK_RDM

  • socket.SOCK_SEQPACKET

These constants represent the socket types, used for the second argument to the socket() method . However, only SOCK_STREAM and SOCK_DGRAM are more useful. This is because SOCK_STREAM represents a connection-oriented protocol, and SOCK_DGRAM represents a connection-less protocol.

Depending on the context, the meaning of sockets may vary. Usually, a “client” socket is an endpoint of a conversation, and a “server” socket is more like a switchboard operator. The browser in your machine is an example of a client application. It uses client sockets exclusively. But the web server uses both server sockets and client sockets. In the previous code, after getting connected, Google does the same thing.

Here Python’s socket() method returns a socket object whose methods implement the various socket system calls.

A pair (host, port) is used for the AF_INET address family, where the host is a string representing either a hostname in an Internet domain notation like google.com or an IPv4 address like 100.50.200.5 and port is an integer. You have just seen this in the previous code. For the AF_INET6 address family, a four-tuple (host, port, flow info, scope ID) is used.

If you don’t have any Python background, please read the Python documentation. A tuple is an immutable list of collections.

Socket objects have many methods. They start with the socket.accept() method . They accept a connection. The socket must be bound to an address and listening for connections. The socket.close() method closes the socket.

Once you close the socket, all future operations on the socket object will fail. The remote end will receive no more data (after the queued data is flushed). You used the socket.connect(address) method in the previous example. This method connects to a remote socket at the address.

Now you will see how you can build another Kali Linux local web server that listens to a certain port that you define (Figure 5-3).
# first of all import the socket library import socket
# next we will create a socket object
mySocket = socket.socket()
print("Socket successfully created")
# let us reserve a port on our computer
# in our case it is 8080 but it can be anything like 12345
port = 8080
# Next we will bind to the port and we have not typed any IP in the ip field
# we keep an empty string; because, this makes the server listen to any request
# coming from other computers on the network
mySocket.bind((", port))
print("socket bounded to %s" % (port))
# let us put the socket into listening mode
mySocket.listen(5)
print("socket is now listening")
# we can make it a forever loop until we interrupt it or an error occurs
while True:
    # Establish connection with client.
    c, addr = mySocket.accept()
    print('Got a connection from this', addr)
# we can send a thank you message to the client.
   c.send('Thank you for connecting')
    # Close the connection with the client
    c.close()
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig3_HTML.jpg
Figure 5-3

Connecting to the remote host from the Kali server

The output looks like this:
pg@kali:~/PyCharmProjects/kaliServer$ telnet localhost 8080
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Thank you for connectingConnection closed by foreign host.
===========
pg@kali:~$ cd PyCharmProjects/kaliServer/
pg@kali:~/PyCharmProjects/kaliServer$ ls
kaliServer.py  serverClient.py  venv
pg@kali:~/PyCharmProjects/kaliServer$ python serverClient.py
Socket successfully created
socket bounded to 8080
socket is listening
('Got connection from', ('127.0.0.1', 51290))
Let’s see what happens if you don’t run the server; the output is different for that case (Figure 5-4).
pg@kali:~$ cd PyCharmProjects/kaliServer/
pg@kali:~/PyCharmProjects/kaliServer$ telnet localhost 8080
Trying ::1...
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig4_HTML.jpg
Figure 5-4

Unable to find the remote host; local server not running

In the next section, you’ll learn how to install PyCharm and the Wing IDE to create some more Python code for further penetration testing.

After that, you’ll see how to install the desktop environment.

Before the configuration part begins, you’ll take a quick look at the encrypted Kali version and see how you can install it on your machine. This installation process is as same as the normal installation; however, there are some exceptions.

As the book progresses, you’ll be introduced to more resources to master Kali Linux, the penetration testing distribution.

Installing PyCharm and the Wing IDE Editor

For penetration test, you need to use Python. You also need a good Python IDE for writing, running, and testing your code. You need to make a choice here. PyCharm (Figure 5-5) and Wing both are good.
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig5_HTML.jpg
Figure 5-5

PyCharm in Kali Linux

Installing PyCharm or the Wing Python editor is extremely easy.

I personally prefer PyCharm because the community edition has more features and it’s free. Wing is also good, and a personal version is available, but you will miss many features that are available in the professional version.

In both cases, the professional versions usually come with more features.

Carefully consider the options before using either PyCharm or Wing. The Wing professional version comes with a full-featured Python IDE.

The Wing personal version is a free Python IDE for students and hobbyists. But it has a simplified debugger, full-featured editor (that you need), and limited code inspection and navigation; finally, it gives you freedom for the project management.

The professional version of PyCharm is also a full-featured IDE for Python and web development, whereas the community edition is free and a lightweight IDE for Python and scientific development.

Go to the PyCharm web site and download the zipped community version.

Once you extract the file, you will find a pycharm.sh file in the Bin directory. Run this file by typing the following command in your terminal (Figure 5-6):
# running pycharm.sh file
./pycharm.sh
You can also install it through the terminal. Just type this command on your terminal:
#installing PyCharm through terminal
sudo apt-get install pycharm-community
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig6_HTML.jpg
Figure 5-6

PyCharm installing in Kali Linux

How to Stay Anonymous

Is it possible to make yourself completely anonymous? If it is, for how long? There are several components to this, such as time, morality, technology, and physical addresses.

  • How long you can remain anonymous is using a trade-off.

  • With the help of anonymity, what you’re doing is another big deal. Here comes the moral part. As an anonymous person, you cannot steal data or attack a legal system.

  • What type of technology are you using? Is it tenable? Can it maintain the persistence of the anonymity?

  • The last big trade-off is the physical address. After all, that is the endpoint. Every anonymity ends at the hardware used for doing some anonymous tasks. Once it’s located, your anonymity ends. You can also hide that by changing your MAC address.

You need to stay anonymous for one single reason; in penetration testing, you have to use your Kali Linux server again and again. It’s not that you will have to build your server manually by using Python. Many hacking-related tools automatically build it while sniffing or exploiting a target.

Therefore, hiding your tracks or keeping your anonymity in ethical hacking is one of the prerequisites that you should keep in mind.

In this second, you’ll get a brief introduction to anonymity. I’ll discuss only the technology part of it. Ethical hacking involves a few tricks to keep you anonymous. Even in a VirtualBox environment, it’s a good practice to take every precaution to hide your IP addresses and other stuff. Let’s begin with the Tor browser.

First, you need to install the Tor browser (Figure 5-7). You can download it from https://torproject.org . To make yourself anonymous in a VirtualBox environment, you have to log in as a user; don’t log in as root or the superuser. In some cases, you need the root privilege; when you need it in Kali Linux, issue the su command and type the root password. You will definitely need it when you have to change some core functionalities of Kali Linux. You also will need it when you want to download new packages or update your distribution.

Once the download is complete, you can access the necessary file in your Download folder. Unzip it, open it, and run it. Before using Tor, read the documentation.
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig7_HTML.jpg
Figure 5-7

Tor browser in Kali Linux Download folder

Tor maintains your anonymity through several proxies. Behind these proxies, you can hide your true identity. But Kali Linux also gives you a special opportunity to change the configuration at the root so that you can hide your true identity while browsing the Web using Tor.

Changing Your Proxy Chain

In this case, you need to configure your proxychains.conf file . You will find this file in your etc folder.

Open the configuration file using the Leafpad text editor.

Open your Kali Linux terminal as a root user and enter this command:
su leafpad /etc/proxychains.conf
This will open the proxychains.conf file (Figure 5-8). There are three types of proxies that you can use. But you can’t use all the proxies at a time. Let’s first see how this file looks. The documentation is clear and to the point.
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig8_HTML.jpg
Figure 5-8

Proxychains.conf file in Kali Linux

Uncomment the line where dynamic_chain is located. After that, comment out strict_chain and random_chain one after the other, before testing the proxy.

The advantage of choosing dynamic_chain over others is clearly stated. If your connection does not get one working proxy, then it automatically jumps to the other. The other two don’t give you that opportunity to route your traffic.

Let me explain it more. Suppose you have two proxies in place: A and B. What happens in the case of strict_chain is that when you browse web pages, your connection is routed through A and B strictly. This means A and B should be in order and live. Otherwise, your connection simply fails. In the case of dynamic_chain , this does not happen. If A is down, then it jumps to take B. For that reason, you are going to use dynamic_chain so that if one proxy is down, the other may replace it.

In between you get a line like this:
# Proxy DNS requests - no leak for DNS data
proxy_dns

This is an important line to be considered seriously. You see I have uncommented proxy_dns. This will protect against leaking DNS data. You can’t allow DNS data to be leaked. In other words, your real IP address should not be leaked by chance. That is why I have uncommented this line so that your proxies are in the proper place working without any hitches.

At the end of the list you’ll find this line:
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks4  127.0.0.1       9050
socks5  127.0.0.1       9050
socks5 185.43.7.146     1080
socks5 75.98.148.183    45021
Inspect the last two lines that I have added. I’ll explain them, but first I’ll explain the example lines just given before. They read like this:
# ProxyList format
#       type  host  port [user pass]
#       (values separated by 'tab' or 'blank')
#        Examples:
#               socks5  192.168.67.78   1080    lamer   secret
#               http    192.168.89.3    8080    justu   hidden
#               socks4  192.168.1.49    1080
#               http    192.168.39.93   8080
This clearly states how your proxy list should be formatted. Consider the first line:
#               socks5  192.168.67.78   1080    lamer   secret

This means the first word is the type of the proxy. It should be socks5 . The second one is the host. The third one is the port, and the last two words stand for username and password in case you pay for it. Sometimes people buy VPN services; in such cases, the service provides the login credentials. Another important thing is that you must separate the words using either a Tab or space.

There are several free proxies, so don’t worry about the username and password just now. Now you can again go back to the last lines that I added. In the last lines, the defaults are set to Tor. Before adding the last two lines, you need to add this line:
socks5  127.0.0.1        9050
You should do this because usually your proxychains.conf file comes up with only socks4, so you need to add socks5 that supports modern technology. Now you can test your Tor status.
  1. 1.

    Open your terminal and type the following:

     
service tor status
  1. 2.

    It will fail if you don’t start it. Type the following to start the service:

     
service tor start
Now you can open your browser through the terminal. Just type the following:
proxychains firefox www.duckduckgo.com

This search engine does not usually track IP addresses. Your browser will open, and you can check your IP address. You can also see the DNS leak test result. Let’s do that by typing dns leak test in the search engine. There are several services; you can click any one of them to see what it says.

I found that www.dnsleaktest.com is working to find out my original IP address and fails to find out. It shows an IP like 8.0.116.0, and it is from Germany. This is wrong as I am currently staying near Calcutta.

You can simultaneously test this in your normal browser, and you’ll find your actual IP address.

I have discussed the Tor browser and proxy chains. You have seen how you can use them. Another important concept in this regard is a virtual private network (VPN). Before moving to the VPN section, you will learn how to set the DNS settings because that will help you hide your IP address using VPN.

Working with DNS Settings

A DNS server normally checks the traffic filtering. So, if you can change your DNS server settings in your root, you can misguide that reading.

How can you do that?

Open your Kali Linux terminal and type the following:
cat /etc/resolv.conf
It will show something like this:
# Generated by NetworkManager
nameserver 192.168.1.1

In your terminal, there is every possibility that it’ll show something else. This is your home gateway. It will show what kind of router you’re using. Basically, you’ll change this so that when you again test your IP address, the DNS server can’t filter the traffic properly.

In my terminal when I type the same command, it reads like this:
nameserver 208.67.222.222
nameserver 208.67.220.220

I have changed it. Why have I changed this? Let me explain.

You need to understand the concept of a name server first. What does a name server do? The LAN IP address actually forwards the traffic to DNS servers, which in turn resolve the queries and send the traffic back accordingly.

In doing this, it records the amount of traffic going through your home gateway. You don’t need that. Why don’t you need that? You need to be anonymous. So, that is the main reason behind changing this name server.

You can do that through a virtual private network.

Let’s open the terminal again and type in this command:
nano /etc/dhcp/dhclient.conf

This will open the configuration file where you will change the name server address. I've opened it on my Ubuntu terminal. But you need to change it on your Kali Linux virtual machine.

Ubuntu is used for demonstration purpose because my Kali Linux dhclient.conf file has already been changed before. But the command is the same.

You will notice that there are lots of things written here. But you’re interested in this line:
prepend domain-name-servers 127.0.0.1;
You’ll uncomment this line first and then change it. There are lots of OpenDSN IP addresses available on the Web. Search with the term opendns, and you’ll get a lot of options from where you can copy the open DNS addresses; one of them is opendns.com . Let’s copy two addresses from them and just paste them in place of 127.0.0.1 like this:
prepend domain-name-servers 208.67.222.222 208.67.220.220;
Now all you need to do is restart the network manager. Type this command on your Kali Linux terminal:
service network-manager restart
Now you can check your name server again. It’ll show two new addresses.
root@kali:/home/ss# nano /etc/dhcp/dhclient.conf
root@kali:/home/ss# service network-manager restart
root@kali:/home/ss# cat /etc/resolv.conf
# Generated by NetworkManager
search domain.name
nameserver 208.67.222.222
nameserver 208.67.220.220
root@kali:/home/ss#

Another thing is important here. You need to check whether the media connection is enabled. Open your Mozilla browser; in Kali Linux, it is Iceweasel. You can find it in the top-right panel. Then from Preferences, select Advanced ➤ Network ➤ Connection item; finally, select Use System Proxy Settings.

Using a VPN

You can also search for a free open virtual private network. Remember, people often pay a hefty price for this because they use many proxy layers to guard their real identity.

But no VPN is secure all the time. Why are they not secure? It is because, sometimes, a country’s national security is under attack and server companies are pressured to give out information about their users. So, all along I have tried to emphasize one thing: never try to break the law. Ethical hacking is all about staying within the law.

Let’s download the open VPN from www.vpnbook.com . In the right panel, you’ll find the name of the providers. It varies, and from which country you’ll download really doesn’t matter as long as it works.

While downloading, you’ll notice that a combination of username and password is given. Copy them and save them somewhere as you’ll need them when you run the virtual private network on your machine.

In the Downloads folder of your Kali Linux, you have a zipped version of the VPN. Unzip it and then run it. How can you do that? Let me open my Kali Linux Downloads folder to show you.
root@kali:~# cd Downloads/
root@kali:~/Downloads# ls
VPNBook.com-OpenVPN-DE1.zip
I have downloaded the openvpn zipped file. Now, I am going to unzip it using the following command:
root@kali:~/Downloads# unzip VPNBook.com-OpenVPN-DE1.zip
Archive:  VPNBook.com-OpenVPN-DE1.zip
  inflating: vpnbook-de233-tcp80.ovpn
  inflating: vpnbook-de233-tcp443.ovpn
  inflating: vpnbook-de233-udp53.ovpn
  inflating: vpnbook-de233-udp25000.ovpn
Now, you can take a look what is inside the openvpn folder.
root@kali:~/Downloads# ls
VPNBook.com-OpenVPN-DE1.zip  vpnbook-de233-udp25000.ovpn
vpnbook-de233-tcp443.ovpn    vpnbook-de233-udp53.ovpn
vpnbook-de233-tcp80.ovpn
Issue this command with your Internet connection open:
openvpn vpnbook-de233-tcp443.ovpn
It will run for a few seconds. The initialization process of making proxy layers is done, and you will get some output like this:
root@kali:~/Downloads# openvpn vpnbook-de233-tcp443.ovpn
Fri Jun 22 23:22:43 2018 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 10 2017
Fri Jun 22 23:22:43 2018 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Enter Auth Username: vpnbook
Enter Auth Password: *******
Fri Jun 22 23:23:44 2018 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Jun 22 23:23:44 2018 NOTE: --fast-io is disabled since we are not using UDP
Fri Jun 22 23:23:44 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]178.162.193.233:443
Fri Jun 22 23:23:44 2018 Socket Buffers: R=[87380->87380] S=[16384->16384]
Fri Jun 22 23:23:44 2018 Attempting to establish TCP connection with [AF_INET]178.162.193.233:443 [nonblock]
Fri Jun 22 23:23:45 2018 TCP connection established with [AF_INET]178.162.193.233:443
Fri Jun 22 23:23:45 2018 TCP_CLIENT link local: (not bound)
Fri Jun 22 23:23:45 2018 TCP_CLIENT link remote: [AF_INET]178.162.193.233:443
Fri Jun 22 23:23:45 2018 TLS: Initial packet from [AF_INET]178.162.193.233:443, sid=251528ba 7b643294
Fri Jun 22 23:23:45 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Jun 22 23:23:47 2018 VERIFY OK: depth=1, C=CH, ST=Zurich, L=Zurich, O=vpnbook.com, OU=IT, CN=vpnbook.com, name=vpnbook.com, [email protected]
Fri Jun 22 23:23:47 2018 VERIFY OK: depth=0, C=CH, ST=Zurich, L=Zurich, O=vpnbook.com, OU=IT, CN=vpnbook.com, name=vpnbook.com, [email protected]
Fri Jun 22 23:23:48 2018 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Fri Jun 22 23:23:48 2018 [vpnbook.com] Peer Connection Initiated with [AF_INET]178.162.193.233:443
Fri Jun 22 23:23:49 2018 SENT CONTROL [vpnbook.com]: 'PUSH_REQUEST' (status=1)
Fri Jun 22 23:23:50 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS  37.58.58.137,dhcp-option DNS  91.109.25.225,redirect-gateway def1 bypass-dhcp,route 10.9.0.1,topology net30,ping 5,ping-restart 30,ifconfig 10.9.0.62 10.9.0.61,peer-id 0,cipher AES-256-GCM'
Fri Jun 22 23:23:50 2018 OPTIONS IMPORT: timers and/or timeouts modified
Fri Jun 22 23:23:50 2018 OPTIONS IMPORT: --ifconfig/up options modified
Fri Jun 22 23:23:50 2018 OPTIONS IMPORT: route options modified
Fri Jun 22 23:23:50 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Jun 22 23:23:50 2018 OPTIONS IMPORT: peer-id set
Fri Jun 22 23:23:50 2018 OPTIONS IMPORT: adjusting link_mtu to 1627
Fri Jun 22 23:23:50 2018 OPTIONS IMPORT: data channel crypto options modified
Fri Jun 22 23:23:50 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Fri Jun 22 23:23:50 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Jun 22 23:23:50 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Jun 22 23:23:50 2018 ROUTE_GATEWAY 192.168.2.1/255.255.255.0 IFACE=eth0 HWADDR=08:00:27:fe:da:71
Fri Jun 22 23:23:50 2018 TUN/TAP device tun1 opened
Fri Jun 22 23:23:50 2018 TUN/TAP TX queue length set to 100
Fri Jun 22 23:23:50 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Fri Jun 22 23:23:50 2018 /sbin/ip link set dev tun1 up mtu 1500
Fri Jun 22 23:23:50 2018 /sbin/ip addr add dev tun1 local 10.9.0.62 peer 10.9.0.61
Fri Jun 22 23:23:53 2018 /sbin/ip route add 178.162.193.233/32 via 192.168.2.1
Fri Jun 22 23:23:53 2018 /sbin/ip route add 0.0.0.0/1 via 10.9.0.61
Fri Jun 22 23:23:53 2018 /sbin/ip route add 128.0.0.0/1 via 10.9.0.61
Fri Jun 22 23:23:53 2018 /sbin/ip route add 10.9.0.1/32 via 10.9.0.61
Fri Jun 22 23:23:53 2018 Initialization Sequence Completed

While downloading the openvpn zipped folder, you will get a username and password. Please write it down in a separate text file so that when you run the previous code, you can issue the credentials.

If the machine says “openvpn command not found,” you will have to install it. Installing anything through the terminal is quite easy in Linux. Search the Web, and you’ll find tons of tutorials that will guide you through the process. Usually, this is done with the apt-get command.

When you try to run openvpn, it will ask for the username first. Then it’ll ask for the password. Once this process is complete, it’ll try to build the connection. Unless you get a message “initialization complete,” you can’t open your browser. It may take several minutes.

If you’re not lucky, this message won’t crop up. In that case, it says “connection failed.”

Once you get the message “initialization complete,” you can open the browser and search through www.duckduckgo.com .

In my case, once the initialization process was complete, I opened the Kali Linux web browser and found that the IP address had been changed. So, it has made me completely anonymous.

At the same time, I opened the host web browser and tested my IP. This gives a different result (Figure 5-9).
../images/468667_1_En_5_Chapter/468667_1_En_5_Fig9_HTML.jpg
Figure 5-9

A different IP is being shown by the virtual Kali Linux web browser. On the top is my host web browser and original IP address.

Your first job will be to check the DNS leak. Go for it, and you'll definitely find a changed IP address.

This means you have successfully connected through the virtual private network, and your original ISP DNS server is completely hidden.

Changing Your MAC Address

You have learned many tricks so far, all about anonymity. But let’s always try to go to a higher level. Changing the MAC address falls into that category.

In a simple way, it is your hardware address. Basically, it’s not the hardware address of your machine, but it’s the hardware address of your network card through which you’re connected to the outer world.

Let’s start the Kali Linux virtual machine and open the terminal. Issue the command ipconfig .

It’ll produce something like this:
root@kali:~# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500     inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255  inet6 e80::a00:27ff:fef4:16ec  prefixlen 64  scopeid 0x20<link>
ether xx.xx.xx.xx.xx.xx  txqueuelen 1000  (Ethernet)    RX packets 19  bytes 1820 (1.7 KiB) RX errors 0  dropped 0  overruns 0  frame 0         TX packets 31  bytes 2427 (2.3 KiB)    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo:
flags=73<UP,LOOPBACK,RUNNING>  mtu 65536        inet 127.0.0.1  netmask 255.0.0.0   inet6 ::1  prefixlen 128  scopeid 0x10<host>  loop  txqueuelen 0  (Local Loopback)  RX packets 36  bytes 2160 (2.1 KiB)   RX errors 0  dropped 0  overruns 0  frame 0        TX packets 36  bytes 2160 (2.1 KiB)  TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

In your case, the output could be different. You’re concerned about the hardware address of your network, and you want to change it.

You see this line:
ether 08:00:27:f4:16:ec
This is Kali Linux virtual machine’s MAC address or local network card address. Now in some cases, it might be like this:
 Hwaddr xx.xx.xx.xx.xx.xx
HWaddr

In some cases, it is different. They are network cards; they could be Ethernet cards, wireless cards, wireless adapters, and so on.

But this address is extremely important as it is used to identify you on the vast Web. The first three digits are the symbols that represent the manufacturer.

You can check it out here also by issuing this command:
root@kali:~# macchanger -s eth0
Current MAC:   xx:xx:xx:xx:16:ec (CADMUS COMPUTER SYSTEMS)
Permanent MAC: xx:xx:xx:xx:xx:ec (CADMUS COMPUTER SYSTEMS)

As you see, it shows two MAC addresses; one is current, and the other is permanent. You may ask why I’m checking this here. I have checked it once by issuing the command ifconfig .

It’s because the command ifconfig will show only the current MAC address. It won’t show the permanent MAC address. In other words, when you have changed the MAC address and issued the ifconfig command, it’ll show only the changed one, not the permanent one. The permanent one is basically the hardware address or physical address. When you change the current setting, the permanent one will reflect that. This is also called MAC spoofing . It’s like you are pretending to be some other physical device that you are not.

Now you want to change the MAC address. Let’s issue this command:
root@kali:~# macchanger –h
This will produce output like this:
GNU MAC Changer
Usage: macchanger [options] device
  -h,  --help                   Print this help
  -V,  --version                Print version and exit
  -s,  --show                   Print the MAC address and exit
  -e,  --ending                 Don't change the vendor bytes
  -a,  --another  Set random vendor MAC of the same kind
  -A                            Set random vendor MAC of any kind
  -p,  --permanent              Reset to original, permanent hardware MAC
  -r,  --random                 Set fully random MAC
  -l,  --list[=keyword]         Print known vendors
  -b,  --bia                    Pretend to be a burned-in-address
  -m,  --mac=XX:XX:XX:XX:XX:XX
       --mac XX:XX:XX:XX:XX:XX  Set the MAC XX:XX:XX:XX:XX:XX
Report bugs to https://github.com/alobbs/macchanger/issues
Consider the following first three lines:
-a, --another
-A   Set random vendor MAC of any kind
-p,  --permanent              Reset to original, permanent hardware MAC

These allow you to change the MAC address but not the vendor. In this case, there is every possibility of losing your anonymity. The first three sets (-a, -A, -p) belong to the net card manufacturer, and since that has not been changed, you can be identified.

The third line in the previous code (-p, --permanent Reset to original, permanent hardware MAC) is quite self-explanatory in its meaning. It says you can change back to the original MAC address.

So far, the best option available is this line:
– -r, --random                 Set fully random MAC
It is clearly said that you can set a fully random MAC address. That is, the six sets, XX:XX:XX:XX:XX:XX, are completely random, which is what you want. However, the most important of them is the last line.
-m,  --mac=XX:XX:XX:XX:XX:XX
Now you can change the MAC address this way:
root@kali:~# macchanger -m mac=XX:XX:XX:XX:XX:XXeth0

Why is this important? It is because you can change the MAC address completely.

You can have a list of all vendors with the simple command – l . If you issue that command, it will give you a long list. Let’s pick up a few of them.
root@kali:~# macchanger -l
Misc MACs:
Num    MAC        Vendor
---    ---        ------
0000 - 00:00:00 - XEROX CORPORATION
0001 - 00:00:01 - XEROX CORPORATION
0002 - 00:00:02 - XEROX CORPORATION
0003 - 00:00:03 - XEROX CORPORATION
0004 - 00:00:04 - XEROX CORPORATION
0005 - 00:00:05 - XEROX CORPORATION
0006 - 00:00:06 - XEROX CORPORATION
Etc...
Here you take the first few lines, six currently. But the last one is 19010 - xx:xx:xx - Hitachi Reftechno, Inc. (it is not visible here). The list is not complete. After that, there are the wireless MAC addresses. There are 39 of them. You may ask what they are actually. They are nothing but bits of the company MAC address. Let’s consider the last example, shown here:
0006 - 00:00:06 - XEROX CORPORATION

The first setting (0006) is the serial number. The second one is the MAC address. You can change your vendor address. You can use any of these addresses and pretend to be using this company.

Ethical hackers sometimes use that trick, although not for any illegal purposes. Usually, in penetration testing, when you are working for a client, you do not need to change the physical address. After all, you are not going to do anything illegal. What you are going to do is completely legal, and you will get the necessary consent from your client.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.129.39.252