I was playing with Metasploit Framework and I was using the msfvenom payload. For that purpose I was using Kali Linux as a Virtual Machine, mainly because all the tools are pre-installed there. Running a Virtual Machine is not as easy as running the tools in a host Operating System. The available RAM of course is much less than the actual host and some times configuring things can be complex.

Nmap (Free)

Nmap is the best port scanning tool you can use and also open source. Used widely, mainly because of the incredible power and flexibility it offers. On Mac OS Nmap comes with ZenMap, in the installation pack. For those who don’t like the terminal Zenmap is the perfect tool. I prefer using Nmap but in some cases, like for example when you have multiple hosts to scan, Zenmap makes reading them much easier.

Installation of Nmap is really simple and it does not require any typing at all. You can just download a .dmg file from the official website and do a normal installation like in every other application.

Links: NmapGithub

Nikto (Free)

Nikto comes pre-installed on Kali Linux and some times it can help you find some hidden Gems on the web server you are testing. Nikto is a Web Server scanner that will inform you in case there is an outdated software version, if it finds some insecure or default files / directories and about some possible server misconfigurations.

In order to install Nikto you need to install Homebrew. To install Homebrew you need to type a single command on your terminal.

ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

After installation if you didn’t agree with the Terms of Service of X-Code you will probably need to follow the instuctions. The instructions are pretty clear and simple to follow. Next you have to install Nikto. Go back to your terminal and type the following.

brew install nikto

After finishing the installation you will be able to scan every web server using the command nikto -h {URL}.

Links: HomebrewGithubNikto

Wireshark (Free)

The Wireshark is the most known Network Traffic Sniffer, that is open-source like all the tools so far. The Wireshark distribution also comes with TShark, which is aline-oriented sniffer (similar to Sun’s snoop, or tcpdump) that uses thesame dissection, capture-file reading and writing, and packet filteringcode as Wireshark, and with editcap, which is a program to read capturefiles and write the packets from that capture file, possibly in adifferent capture file format, and with some packets possibly removed from the capture.

Installation is pretty simple, since it come as a .dmg file and the installation is like on every other application on Mac OS. After installation a new icon will appear on the launchpad’s application list. From there just by clicking it you can start sniffing the network traffic, after specifying the interface you would like to intercept.

Links: WiresharkGithub

Sqlmap (Free)

The Sqlmap is a powerful tool for finding SQL injections. It is completely automated and just by specifying a parameter the tool will try to exploit the injectable parameter sometimes even without you having to specify the type of database. It supports multi databases including SQL and non-SQL databases. Installation is pretty simple by using brew.

brew install sqlmap

When the installation is complete you can just type sqlmap on terminal to launch the tool.

Links: sqlmapGithub

Zed Attack Proxy (Free)

The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers*. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. Its also a great tool for experienced pentesters to use for manual security testing.

The easiest way to install ZAP is by using brew. Start by installing caskroom.

brew install caskroom/cask/brew-cask

After the installation is complete the system is ready to install ZAP.

brew cask install owasp-zap

After the installation is complete a new ZAP icon will appear on the launchpad.

Links: OWASP ZAPGithub

Aircrack-ng

Unluckily the tool for every Wi-Fi pentration testing is partially available on OS X. You can do a really simple installation of the Aircrack-ng with macports, but Airodump-ng and Aireplay-ng are linux only and will not work under OS X native, so for reinjecting and sniffing you will have to use other means.

sudo port install aircrack-ng

After finishing the installation you can use it by typing aircrack-ng and the options you prefer.

Aircrack-ng 1.2 rc4 - (C) 2006-2015 Thomas d'Otreppe
  http://www.aircrack-ng.org

  usage: aircrack-ng [options] <.cap / .ivs file(s)>

  Common options:

      -a <amode> : force attack mode (1/WEP, 2/WPA-PSK)
      -e <essid> : target selection: network identifier
      -b <bssid> : target selection: access point's MAC
      -p <nbcpu> : # of CPU to use  (default: all CPUs)
      -q         : enable quiet mode (no status output)
      -C <macs>  : merge the given APs to a virtual one
      -l <file>  : write key to file

  Static WEP cracking options:

      -c         : search alpha-numeric characters only
      -t         : search binary coded decimal chr only
      -h         : search the numeric key for Fritz!BOX
      -d <mask>  : use masking of the key (A1:XX:CF:YY)
      -m <maddr> : MAC address to filter usable packets
      -n <nbits> : WEP key length :  64/128/152/256/512
      -i <index> : WEP key index (1 to 4), default: any
      -f <fudge> : bruteforce fudge factor,  default: 2
      -k <korek> : disable one attack method  (1 to 17)
      -x or -x0  : disable bruteforce for last keybytes
      -x1        : last keybyte bruteforcing  (default)
      -x2        : enable last  2 keybytes bruteforcing
      -X         : disable  bruteforce   multithreading
      -y         : experimental  single bruteforce mode
      -K         : use only old KoreK attacks (pre-PTW)
      -s         : show the key in ASCII while cracking
      -M <num>   : specify maximum number of IVs to use
      -D         : WEP decloak, skips broken keystreams
      -P <num>   : PTW debug:  1: disable Klein, 2: PTW
      -1         : run only 1 try to crack key with PTW

  WEP and WPA-PSK cracking options:

      -w <words> : path to wordlist(s) filename(s)

  WPA-PSK options:

      -E <file>  : create EWSA Project file v3
      -J <file>  : create Hashcat Capture file
      -S         : WPA cracking speed test
      -r <DB>    : path to airolib-ng database
                   (Cannot be used with -w)

  Other options:

      -u         : Displays # of CPUs & MMX/SSE support
      --help     : Displays this usage screen

Links: Aircrack-ngGithub

TestSSL (Free)

TestSSL is the best tool to test the SSL configuration of the server you are testing. What I like the most about TestSSL is the clean UI it offers and the simplicity in use. You get different results depending on the device you want to have as a reference and writes in really clean form the possible vulnerabilities of the current configuration.

To install TestSLL you firstly have to download the git repository from Github. Current stable version is 2.8.

git clone https://github.com/drwetter/testssl.sh.git

Then go to the folder of TestSSL.

cd testssl.sh/

If you want to run TestSSL on a server you can just execute the .sh file followed by the URL of the website.

./testssl.sh google.com

Links: TestSSLGithub

I will try to update this list of tools with new ones I will probably use in the future.

  • Was this Helpful ?
  • Yes   No

Related Post