Instructor: Welcome back.
In this, and in the next video,
I want to talk about something different.
We attacked different machines
from Windows machines to Linux machines,
but in these two videos I want to show you
that you can also target your own router
or the router from the network that you're attacking.
Now, it might seem that it is not that important
to test your router
but once you gain access to the router,
you pretty much have the control over the entire network.
And not only that,
gaining access to the router is powerful,
it means that you can change different network settings,
that you can forward different ports, and so on, and so on.
The routers are also the easiest devices to hack.
You might be asking, "Why?"
Well, because usually 90% of home routers
and home devices have default login passwords.
The vendors who provide homes with the routers
never really change the default password,
and default password is something
that you can find on the Internet.
These default password attacks,
we are going to check out in the next tutorial,
but for this one, I want to show you a cool tool
that you can use to test on your own router
to check out whether it is vulnerable to some exploits.
So just type in your search bar, routersploit,
and it'll lead you to this GitHub link
where we'll have our RouterSploit tool.
Now we already know how to download
all of these GitHub tools,
so let's copy the link straight away,
navigate to our desktop,
and we can get clone routersploit.
While this is copying,
let's go down to the installation commands
just to see how we can install this tool properly.
And here we have installation, Kali Linux,
and all of the commands that we must run.
So we must install python3.pip
even though I believe we already have this.
Let's run the command, just to make sure,
and it requires root privileges,
so let's enter the root account first,
and let's type the same command,
apt-get install python3.pip.
Everything is installed.
Let's move on to the next command.
We already did the git clone.
Let's change the directory to routersploit.
(keyboard typing)
And the next command is python3,
and then install the requirements.
As we can see, inside of the routersploit directory,
we have requirements.txt file.
And whenever you have this requirements.txt,
we already know that we must run this command
to install all the requirements from that file.
Let's press enter.
As soon as it installs all of these files that it needs,
we should be ready to run the RouterSploit tool,
which is this rsf.py.
Okay, so everything is finished,
and let's python3 rsf.py.
And you will notice that, once you run this tool,
it will open something that looks similar to the MSFconsole.
We get this command line type
and here we can execute different commands.
It says right here that it has 132 exploits, four scanners,
171 credential attacks, four generic attacks,
32 payloads, and six encoders.
Now, to check out all of the available commands,
we can run help command,
and it will tell us how to use a certain module,
how to execute a shell command argument,
and here we can also search for different tools.
Now, if we type search scanners,
it will give us all of the four scanners that it has.
And in this video, we're going to use this autopwn scanner.
This will test for all the exploits
from the RouterSploit tool onto our target router
to see whether it is vulnerable to any one of them.
So let's type use scanners and then autopwn.
Once you select it, you can type help,
or, pardon me, you can type show options
the same way that we do inside of the MSFconsole,
and the only thing that we must set is target IP address.
To do that, we can type set target 192.168.1.1.
This is the router, in my case.
If you want to check out your gateway or your router,
you can type the command netstat -nr,
and under the gateway,
you will have the IP address of your gateway.
Once you check it out, type it right here
and as soon as you set your IP address, you can type run.
As it says, it'll start the vulnerability check
and it'll go through all of these exploits,
and see whether your router
is vulnerable to any one of them.
If you have this minus sign,
that means that the router is not vulnerable.
If you have this star sign,
that means routersploit cannot really determine
whether your router is vulnerable to this security threat.
As it says right here, it could not be verified.
And if you have a plus sign,
which we don't have at the moment,
that means it found a security vulnerability
for your router.
In my case, I believe I don't have any at the moment,
but you might find some vulnerability for the router.
Let's wait for this scan to finish,
and it is done.
It says, "Could not confirm any vulnerability,"
and it couldn't find default credentials.
And this part right here is not exactly true.
We're going to check out default credentials
in the next video.
However, you can test these exploits
with the RouterSploit tool.
You can also check out these ones that says,
"Could not verify exploitability."
This could possibly mean that
they are vulnerable to these attacks
or this exploit is simply just not the type of exploit
that targets your router.
Okay, now that we covered the RouterSploit tool
we're going to see how we can gain access to the router,
with the default credentials, vulnerability that
at least 70 to 80% of home routers have.
See you on the next video.