There are many online phone number services that offer free or cheap temporary phone number facilities. Although the temporary phone service providers discourage the misuse of the services, scammers use these numbers to send fake messages or make phone calls to the target audience. One way to track these phone numbers is to find their online existence using open-source intelligence tools. Phoneinfoga is one such tool that can accurately gather useful information about the target phone number using free and publicly available resources. Phoneinfoga is an advanced phone number information-gathering tool that collects standard phone information as well as the online footprints using resources like search engines, phone books, Google hacking, and external APIs.  The standard results show country, carrier, and line type information. The online footprints are individual results, social media related record, and service providers-related information.

HOW TO INSTALL PHONEINFOGA

The Phoneinfoga framework has a major shift from Python to Go programming language. The earlier version (1.XX) of the tool is a Python-based script that can be downloaded from the following repository.

https://github.com/sundowndev/PhoneInfoga/tree/v1.11

In this tutorial, we are going to install the latest version from the following release page.

https://github.com/sundowndev/PhoneInfoga/releases

The screenshot shows all the latest available versions supported by different OS architectures.

The Linux users can get their system information using the following command.

uname -m

Download the appropriate version according to your system’s specification.

The 64 bit Linux OS users can locate and extract the downloaded compressed file using the following terminal command.

tar xzf <file name>

The above command extracts the ready-to-use Phoneinfoga binary file as shown below.

There is no other installation required to use the framework.

HOW PHONEINFOGA WORKS?

As discussed earlier, Phoneinfoga explores open-source databases to collect standard and footprinting information. The following command displays all the Phoneinfoga’s scanning features.

./phoneinfoga

There are two main command options in the help section. The scan option is used to scan the phone numbers using the command line interface. The serve command is used to explore the phone numbers using the web interface. Both of these command options are explained below.

COMMAND LINE INTERFACE SCAN EXAMPLE

The scan help command displays all the available scan-related parameters.

./phoneinfoga scan -h

The following command-syntax is used to scan the target phone number.

./phoneinfoga scan -n <phonenumber>

we have selected a free VOIP phone number to test the tool’s information-gathering capabilities.

./phoneinfoga scan -n +4915207829823

The information-gathering process starts with the local scan results, showing the different phone number formats and the origin country.

In the next step, the tool tries to find the phone number carrier and line type (whether it is a mobile or landline number).

After completing the standard scanning process, Phoneinfoga searches the online resources to get phone number reputation, social media traces, and online phone number service providers’ footprints. The reputation footprints help in tracking the user information related to the phone number.

The social media footprints give a hint about the social media accounts of popular networks (Facebook, LinkedIn, Instagram, etc.) who might have used the number for account verification purposes.

The temporary phone-number-providers’ footprints show the possible online services where the number is hosted for public use.

WEB INTERFACE SCAN EXAMPLE

The latest version of Phoneinfoga is loaded with the ability to scan phone numbers through a web interface. The web interface can be initiated using the serve command.

./phoneinfoga serve –help

A port number is required to run Phoneinfoga’s web tool. Use the following command to set up the desired port number.

./phoneinfoga serve -p <port number>

Example:

./phoneinfoga serve -p 5586

After setting up the port number, type your local IP and port number in a web browser to open Phoneinfoga’s web interface. The IP can be located using the following commands.

ipconfig # for Windows users
ifconfig # for Linux users

In our case, the local IP address is 10.0.2.15. Hence, we use the following address to open the web interface of the framework.

10.0.2.15:5558

Type the desired phone number in the input field to fetch the information. The results are gathered in the following format.

One can verify the available information by exploring these results. For instance, we can visit the gathered phone number providers’ links to verify the phone number’s ownership information.

CONCLUSION

Phoneinfoga can help in tracing the temporary phone numbers and avoiding the Vishing and Smishing attacks. The footprinting information is quite a handy feature available in the tool. However, the footprinting results are invalidated. A manual verification process is required to visit and test each link gathered by the framework.

Katana Framework (KTF) is a multi-dimensional Python Framework that supports a number of open-source penetration testing scripts. These scripts or modules can be classified into the following three categories.

1) WEB MODULES

The web-related scripts include the following information gathering and vulnerabilities assessment modules.

• Login/admin console finder
• Subdomain lookup tool
• WHOIS information gathering utility
• DNS explorer
• Form and authentication-based bruteforce tester
• SQL and Local File Disclosure (LFD) vulnerabilities checker

2) NETWORK MODULES

The KTF contains network modules with the following scanning and offensive properties.

• LAN hosts scanning
• Ports scanning
• HTTP traffic sniffing
• DNS spoofing
• ARP poisoning
• ARP DOS attacks
• Web DOS attacks

3) MISCELLANEOUS MODULES

Besides web and network-scripts, there are some miscellaneous modules in the Katana framework that can perform the following penetration testing tasks.

• Metasploit payloads generation
• FTP, SQL, SSH, and POP3 protocols bruteforce
• Images forensics
• RAR and ZIP extension files bruteforce
• Wi-Fi DOS and phishing attacks

HOW TO INSTALL KATANA FRAMEWORK?

Katana Framework can be installed either by downloading the installation package from Sourceforge or cloning the source files from the following Github repository.

git clone https://github.com/PowerScript/KatanaFramework.git

The missing packages/libraries can be installed using the following dependencies commands.

cd KatanaFramework
sudo sh dependencies

Once all the dependencies are fulfilled, run the following command to complete the installation process.

sudo python install

HOW KATANA FRAMEWORK WORKS?

Operating the Katana framework is a fairly simple process. Execute the ktf.console file to load the root console of the framework.

ktf.console

Typing the help command in the console displays all the following modules, functions, and parameters supported by the tool.

KTF Parameters

KTF Functions

KTF Sessions

The following command displays all the inbuilt and integrated modules related to web, network, and miscellaneous functions.

show modules

We can run these modules using the following module execution command format.

use <module name>

USAGE EXAMPLES

In order to analyze the working of the Katana framework, we have tested some of the modules and functions supported by the framework.

WEB MODULE EXAMPLE

The KTF has support for the following web-based modules.

Let’s suppose we want to find the admin panels on the following test web application.

webscantest.com

We can use the web/ap.finder module for this purpose. The following command loads the admin panel finder module in the console.

use web/ap.finder

The show options or show full options command displays all the required and optional parameters used to run the module.

show full options

As we can see in the screenshot, the SSL, Path, and Target are the mandatory parameters.  We can set values for these parameters using the following set commands.

set <parameter> <desired value>

The SSL parameter must be set to true or false depending on the availability of the certificate. Since the target test domain does not have a valid SSL certificate, we can set the SSL flag as false.

set ssl false
set path /
set target webscanttest.com

After setting all the required options, we can execute the module using the run command.

run

The module launches the bruteforce attack to find all the possible login pages on the target web host.

The successfully retrieved pages/results are displayed in the following format.

NETWORK MODULE EXAMPLE

The following image presents the Katana’s network-related modules.

In this example, we use the net/sc.hosts module to find the live hosts in the local area network.

use net/sc.hosts

We need to define the LAN IP range using the following command in order to find the live hosts.

set range 10.0.2.1/24

The run command triggers the module to fetch all live hosts in the network.

The module not only shows the live hosts but also gathers the MAC information of the live machines in the vicinity.

MISCELLANEOUS MODULES EXAMPLE

The selection and execution method for the rest of the scripts including the miscellaneous module is similar to the web and network modules. For instance, we can generate the Metasploit payload using the following MSF module.

use msf/back.door

The show options command displays all the available parameters and supported platforms to generate the desired payload.

KATANA FRAMEWORK FUNCTIONS

Besides modules, the KTF supports the following functions to perform miscellaneous activities.

We can run each function using the following syntax.

f::<function name>

For instance, we can find the internal IP address of the machine using the following function.

f::get_local_ip

Similarly, we can find the network interfaces and put them in the monitoring mode using the following functions.

f::get_interfaces
f::start_monitor_(etho0)

CONCLUSION

The Katana framework incorporates multi-dimensional penetration testing utilities in the form of some lightweight and robust third-party modules. The framework is focused on information gathering and vulnerabilities assessment of web and network domains. The framework can also be helpful in assessing the web and network security against various bruteforce and DOS attacks.

There are many open-source tools used by security experts to perform penetration testing. The Attack Team Automation Tool (ATAT) is one such utility that can perform various penetration testing tasks without human interaction. The ATAT utilizes the resources from other security tools to offer the following functionalities.

• MSFVenom payloads generation
• Metasploit console and attack options
• Vulnerabilities assessment
• Scanning and enumeration
• Exploitation
• Privilege escalation
• Post exploitation tasks
• Wireless attacks

The aforementioned functions are performed by utilizing a number of penetration testing tools including Metasploit, Nmap, Hashcat, Bashark, LinEnum, Bloodhound, Empire, Masscan, SSLScan, and DeathStar. The tool supports a complete automaton for a lot of MSF post-exploitation activities. Some of these activities are listed below.

• Hosts enumeration
• Cached domains’ credentials dumping
• Installed apps information gathering
• Cookies dumping
• Browser’s saved credentials dumping
• OS environment information
• Target host’s installed apps information collection
• WPA, WEP, PSK passwords dumping
• Users’ search history dumping
• Mounted USB’s record gathering
• Security tools (AV, IDS, IPS, Firewalls) information
• IPTables, Wifi, open ports, and interfaces information
• Host files dump
• Logged users record
• DNS Cache data
• Bitlocker key extraction
• GPG credentials
• Certificates dumps

HOW TO INSTALL ATAT?

The ATAT can be downloaded from the Github repository using the following command.

git clone https://github.com/ll3N1GmAll/ATAT.git

There is no installation requirement since the tool runs through the ATAT.sh file. However, there may be few dependencies of the integrated tools that can be installed from the main menu of the ATAT explained in the following section.

HOW ATAT WORKS?

After cloning the ATAT, navigate to the tool’s directory and run the following shell script.

cd ATAT
./ATAT.sh

The command loads all the available testing modules as shown in the following screenshot.

Each module has a sub-menu containing different options, tools, or instructions to proceed with penetration testing. As mentioned in the installation section, the ATAT outsources the functionalities of different tools that may require additional packages/libraries to perform. These dependencies can be verified or fulfilled by running the dependency checker module indexed at the 8th position in the list. Type the dependency checker module’s sequence number to know about different packages that can be automatically installed from the console.

There are different scanning, assessment, attack and exploitation, post-exploitation, and escalation modules available in the main menu of the ATAT.  We can continue with the desired option by typing its sequence number in the command-line interface.

AUXILIARY & SCANNING EXAMPLE

To demonstrate the ATAT working, let’s start with the Auxiliary & Scanning module. The module has the following scanning and enumeration options.

The screenshot shows that the tool has support for multiple targets scanning together. To proceed with the Auxiliary and Scanning module’s options, we need to first define the target IPs and ports in the respective text files available in the ATAT’s directory. In this example, we are going to perform the multi-target SSL scan against the webscantest.com host. The IP of the target host can be found by using the following ping command.

ping webscantest.com

The IP of the target web server should be saved to the MSF_targets.txt file available in the ATAT’s directory.

Now we select the desired scanning option from the Auxiliary & Scanning module, which in this case is Multi-Target SSL Scan at number #5 on the list.

Upon a successful connection with the target, the module performs the following SSL checks.

TLS Fallback SCSV

TLS Renegotiation

TLS Compression

Heartbleed Test

Supported Server Cipher(s)

SSL Certificate

The same approach can be applied to test the other scanning options. For instance, we can launch the Multi-Target Masscan of all TCP ports (#8) for the following target IPs using a similar method.

The tool scans all the TCP ports and returns the results of all open TCP ports.

The results are also saved in a text file in the ATAT’s directory.

OTHER MODULES AND OPTIONS

All the other modules and options can be explored in a similar way as explained in the above examples. The Payload module can be used to create Windows, Linux, and Android payloads.

The Multi-Target Exploit module can be used to exploit the targets with the following features.

The Wireless Attacks module has a number of wireless credentials capturing, jamming, and phishing options.

The Listener module has a ton of payload types to exercise the MSF attack options.

The Privilege Escalation module gives decent choices to shift from an ordinary user to a super-user after gaining access to the target hosts.

CONCLUSION

The ATAT is a decent automation tool that requires very little human interaction to perform a handful of penetration testing tasks. The addition of reconnaissance and OSINT functionality can make the tool a better choice for every stage of the penetration testing cycle.