In this demo, we'll take a quick look at two popular note‑taking applications.
First we'll look at CherryTree and then we'll take a look at Microsoft OneNote.
Kali Linux offers a built‑in note tool called CherryTree.
We can find it by hitting the menu and searching for cherry tree.
In my opinion, it's a fine choice for notes,
although the interface is a bit dated,
and certain features that I like working with are missing.
Nonetheless, it's a popular option for taking notes.
It works well, it's fast, it's searchable, and has some great features.
Let's begin by setting up a hierarchy first.
I'm going to begin by creating a partial hierarchy of my pentest.
I'll start with the node called Pluralsight,
which is going to be my topmost level.
And then to that I'll add nodes for specifications,
which will contain the requirements, scope,
as well as the rules of engagement.
Next I'll define areas for passive and active reconnaissance and add a
few tool‑specific nodes for passive recon as well.
Here I can customize my node.
For example, I can make it bold,
change its background color or even give it an icon.
And my Pluralsight node is created.
I'm going to keep going and add the rest of the notes that I want to work
with. (Clicking) Now that we have our structure set up, let's go ahead
and save and password protect the file. (Clicking) And now the notebook
is saved and password protected.
Now that we have some data loaded into the tool, we can edit and format our
notes any way that we want. For example, I can quickly turn this DNS
Dumpster text into a headline, I can make it bold,
I can even change its background color to be something else.
Basically, any of the editing capabilities that you would expect in any other
note‑taking tool are here, so formatting your content and getting it to look
just right is not a problem with CherryTree.
You can quickly and easily add things like images directly to your notes.
You can embed audio or video files using the Insert File option, and you
have the ability to also add code using this nifty code window. Here you can
choose the language that you want to work with,
then decide on the size of the window, and when you create it,
you can simply paste your script in here.
Once done,
you get the benefit of syntax highlighting, and because
you chose the size for the window,
particularly long scripts won't take up too much room within your notes.
There's also the ability for you to execute and run
the code for certain compilers.
Lastly, you do have the capability to export your notes into
several different formats including PDF,
HTML, and plain text.
The other application that I wanted to demonstrate today is Microsoft
OneNote. Some people love it and some people hate it.
I happen to like the tool and have a number of different notebooks here.
Everything from my personal knowledge base to code snippets to different
hacking techniques and all of my notes are stored here in OneNote. There
are a couple of versions of this tool,
including a free version that ships with Windows 10 and 11, as well as
an Office 365 version which requires a subscription.
The paid version does have a few more features, including the ability
to search within images. Just like with CherryTree, I can bring in and
format my content any way that I want,
including various formatting options such as headings and lists.
I also have the option of tagging content and then searching on it.
This is very useful during a pentest, as you can go back and see what
you found important based on the specific tag. You can, of course,
customize the tags in any way that you want. Here I can add an
Important tag, and then when I go to search, I can search for the word
Important. Two options come up, which I can then click on and it'll
take me right to that page and section. Password protection works
differently here.
You have to protect each section individually. At the end of the
day, while this is not the best of options,
it does provide me with the security and assurances that I'm looking for.
(Clicking) Lastly, I wanted to demonstrate the image searching
feature here in the paid edition of Microsoft OneNote. Here I
have a screenshot of an Nmap scan.
I can right‑click on it and make sure that the image is enabled for searching,
and then I can use the search facility here within OneNote to look for things
in this image, same as I could in any other content. As an example, let's look
for an IP address that starts with 192.
As you can see, I have two results.
The first one is this Images, and you can see the IP address is
highlighted within the image, and the second one is this output from
DNSDumpster, which also has several references to 192 dot. Overall, I
would encourage you to spend time with as many note‑taking tools as you
can to see which one works best for you.
For example, I also use Typora, which is a simple markdown editor.
I use TextPad and Visual Studio Code as well,
all of which are capable of taking notes for you, but the one that I pick
because of its tagging and search capabilities is Microsoft OneNote. Since
you'll be spending a lot of time with your notes,
find a tool that you like to use. You'll know you have the
right one when you actually want to take notes and make the
tool part of your workflow.