Hey there.
Welcome to our lab environment.
As I mentioned before,
I have here a virtual machine with the Kali Linux version 2021.1.
So, let's get started.
Let's take a look at how to install the Sn1per tool in Kali Linux.
The Sn1per tool is hosted on GitHub.
You can find it on this address here. And in here, you find not only the
source code, but also really good documentation about the tool.
So first, we need to download the source code to our Kali machine.
For that, I will open the terminal,
go to my Desktop, and then use this command, git clone, to
get all of the source code from GitHub to my computer. And in
here, I'm using the github URL, which is the same as we saw a few seconds ago.
And when this is done, I'll have here on my desktop this folder called Sn1per.
So, let's enter it and take a look at what is inside.
Perfect. To install Sn1per is really simple.
All I have to do is run this install.sh as root.
So for that, I'll type sudo bash install.sh.
And this might take several minutes, so to save us some time, I
already ran this before recording this demo.
And once this is completed,
you have Sn1per installed on your VM. To check if everything is
working, first I need to elevate my privilege to root,
and the reason for that is because Sn1per needs to be run as root.
And now I can use sniper ‑h. And, if the help page is displayed,
then you're good to go. Perfect.
So, let's do some reconnaissance.
Let's gather some information about the globomantics.com domain.
For that,
I'll use sniper ‑t, and then the domain that I want to gather
information about. If I run this command,
it will run a normal scan, meaning that I will use passive and
active techniques to gather information, and this includes the
import scans and active vulnerability scans.
Personally,
I would only do this type of scan if you have authorization to do that.
This generates a lot of noise,
and you could easily be detected by the SOC team. In here, as I'm
authorized by Globomantics to perform active tests,
I can run this. And now, what Sn1per is doing is running dozens
of really common reconnaissance scripts to get us the most
information possible about my target.
For example, take a look.
Sn1per just executed a well‑known script to detect if the client has
a web application firewall. And, as we can see,
it seems that Globomantics does have a WAF solution.
Also, we can see here that Globomantics is running on a CentOS machine.
And again, this is just a fraction of all the scripts that Sn1per is running.
This scan here might take up to half an hour to finish.
So to save us some time,
I will pause this recording and come back once it's
finished. Done. The scan is now completed.
In total, it took 15 minutes for me.
And in your case,
depending on the domain your scanning, it might take even longer.
As you can see, the Sn1per found a lot of stuff.
So, let's take a look at the report generated by Sn1per.
For that, let's open File Explorer,
and then let's go to the folder user, share, sniper, loot, and then
workspace. In here, I have all the domains that I've scanned so far. So,
let's open the folder for globomantics.com.
Any in here, let's go to the folder reports. Perfect. Two reports.
One of them is for the globomantics.com website on port 80, and the other one
is for the website on port 443. As they are basically the same website, let's
take a look at the report for the port 443. In here, we can see all the
output for the Sn1per scanner, and we're not going to be able to go through
every single detail since we have tons of information, but let's go through
some of the main ones.
For example,
in here I can see the WAF information that we saw when the script was running.
Also,
we can see some details of the SSL certificate that is installed
on the website. And, even more interesting,
we can see here some vulnerabilities that could be exploited. And take
a look, there's even a link for the exploit itself.
Pretty cool, right?
And again, this is just a fraction of all the information that Sn1per generates.
At first, it might be overwhelming to you having all this data,
but once you get used to it, you can easily find information you're looking for.
Also,
another cool thing about Sn1per is that all the data that was
gathered is also organized in the workspace folder.
For example, if you want to see all the vulnerabilities for this domain,
you can go to the folder vulnerabilities and then open this file
called sc0pe‑all‑vulnerabilities. In here, you have a list of all
the vulnerabilities sorted by priority.
And the cool part about having all the data organized into text files is
that we can use this data to automate our exploitation.
For example,
I could develop a script to automatically download all
the exploits from those websites.
So then, it can save me some time during the exploitation phase.