{"id":3500,"date":"2023-03-21T23:43:51","date_gmt":"2023-03-22T03:43:51","guid":{"rendered":"https:\/\/dft.wiki\/?p=3500"},"modified":"2026-06-08T16:54:06","modified_gmt":"2026-06-08T20:54:06","slug":"kali-purple-defencive-tools-cheat-sheet","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=3500","title":{"rendered":"Kali Purple &#8211; Defensive Tools Overview and Cheat Sheet"},"content":{"rendered":"<p><strong>Kali Linux<\/strong> is a Debian-based Linux distribution <strong>originally designed for offensive information security<\/strong>. It contains tools for penetration testing, network security, bug hunting, cybersecurity research, digital forensics, and reverse engineering.<\/p>\n<p>At its 10th anniversary, Kali released <strong>Kali Purple<\/strong> 2023.1, a variation of the original build. It includes additional <strong>tools focused on defensive information security<\/strong> plus a new defensive menu structure:<\/p>\n<table style=\"margin-left: auto; margin-right: auto; text-align: center;\">\n<tbody>\n<tr>\n<th><strong>Identify<\/strong><\/th>\n<th><strong>Protect<\/strong><\/th>\n<th><strong>Detect<\/strong><\/th>\n<th><strong>Respond<\/strong><\/th>\n<th><strong>Recover<\/strong><\/th>\n<\/tr>\n<tr>\n<td style=\"vertical-align: top;\"><img decoding=\"async\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-21-23-30-23.png\" alt=\"\" width=\"130\" \/><\/td>\n<td style=\"vertical-align: top;\"><img decoding=\"async\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-21-23-31-40.png\" alt=\"\" width=\"130\" \/><\/td>\n<td style=\"vertical-align: top;\"><img decoding=\"async\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-21-23-34-20.png\" alt=\"\" width=\"130\" \/><\/td>\n<td style=\"vertical-align: top;\"><img decoding=\"async\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-21-23-35-08.png\" alt=\"\" width=\"130\" \/><\/td>\n<td style=\"vertical-align: top;\"><img decoding=\"async\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-21-23-35-41.png\" alt=\"\" width=\"130\" \/><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Note:<\/strong> Most of these tools were already part of Kali; they are simply organised in a way that makes sense for a blue\/purple team rather than a purely red team approach.<\/p>\n<hr \/>\n<p><strong>FEATURED DEFENSIVE TOOLS<\/strong><\/p>\n<ul>\n<li><strong>Arkime<\/strong>\n<ul>\n<li>Full packet capture and analysis tool designed to provide greater visibility, but not as a replacement for an IDS [<a href=\"https:\/\/arkime.com\/#download\">Link<\/a>]. Source code available at [<a href=\"https:\/\/github.com\/arkime\/arkime\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>CyberChef<\/strong>\n<ul>\n<li>Intuitive web app for data manipulation and conversion [<a href=\"https:\/\/gchq.github.io\/CyberChef\/\">Link<\/a>]. Open source, with code available at [<a href=\"https:\/\/github.com\/gchq\/CyberChef\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Elastic Security<\/strong>\n<ul>\n<li>Security information and event management tool that combines SIEM, EDR, and cloud security capabilities [<a href=\"https:\/\/www.elastic.co\/security\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Greenbone Vulnerability Manager<\/strong>\n<ul>\n<li>Also known as OpenVAS [<a href=\"https:\/\/github.com\/greenbone\/openvas-scanner\">Link<\/a>], it offers more than just a vulnerability scanner [<a href=\"https:\/\/github.com\/greenbone\/gvmd\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>TheHive<\/strong>\n<ul>\n<li>Incident response platform that can sync with one or more MISP [<a href=\"http:\/\/www.misp-project.org\/\">Link<\/a>] instances to start investigations from MISP events [<a href=\"https:\/\/github.com\/TheHive-Project\/TheHive\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Malcolm<\/strong>\n<ul>\n<li>A network traffic analysis tool suite [<a href=\"https:\/\/malcolm.fyi\/\">Link<\/a>]. Source code available at [<a href=\"https:\/\/github.com\/cisagov\/Malcolm\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Suricata<\/strong>\n<ul>\n<li>A network IDS appliance. As included in the Kali Purple build, it is NOT meant to be used as a router but in campaigns [<a href=\"https:\/\/suricata.io\/download\/\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Zeek<\/strong>\n<ul>\n<li>An open source IDS formerly known as Bro [<a href=\"https:\/\/zeek.org\/get-zeek\/\">Link<\/a>]. Source code available at [<a href=\"https:\/\/github.com\/zeek\/zeek\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Kali Autopilot<\/strong>\n<ul>\n<li>An attack script builder framework for automated attacks. It can share scripts for blue teams to run against, as well as practice packet captures for network analysis training [<a href=\"https:\/\/gitlab.com\/kalilinux\/kali-purple\/documentation\/-\/wikis\/O_1001_20:-Kali-Autopilot\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>CHEAT SHEET<\/strong><\/p>\n<p><strong>Identify<\/strong><\/p>\n<ul>\n<li><code>amass<\/code>\n<ul>\n<li>OWASP Amass is an open source tool written in Go for network mapping, attack surface discovery, and asset discovery using both active and passive techniques [<a href=\"https:\/\/github.com\/OWASP\/Amass\">Link<\/a>].<\/li>\n<li><code>amass intel<\/code> for intelligence gathering.\n<ul>\n<li><code>-active<\/code> enables active methods.<\/li>\n<li><code>-d<\/code>, <code>-addr<\/code>, <code>-asn<\/code>, and <code>-cidr<\/code> define a list or range of in-scope targets.<\/li>\n<li><code>-df<\/code> and <code>-de<\/code> provide file lists of domains to include and exclude from scope.<\/li>\n<li><code>-whois<\/code> and <code>-org<\/code> search directories for reverse whois and organisation names respectively.<\/li>\n<li>\n<pre>amass intel -list\r\namass intel -whois -d domain.com\r\namass intel -org CompanyName<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>amass enum<\/code> for enumeration.\n<ul>\n<li><code>-active<\/code> and <code>-passive<\/code> enable active methods or define a purely passive scan.<\/li>\n<li><code>-df<\/code>, <code>-ef<\/code>, and <code>-blf<\/code> specify files for domains to include, exclude, root names, and blacklisted domains respectively.<\/li>\n<li><code>-dns-qps<\/code>, <code>-max-dns-queries<\/code>, and <code>-min-for-recursive<\/code> set limits.<\/li>\n<li><code>-iface<\/code> specifies the interface to send traffic from (a VPN such as <code>tun0<\/code> is recommended).<\/li>\n<li>\n<pre>amass enum -list\r\namass enum -min-for-recursive 5 -ip -brute -v -src -d domain.com<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>amass viz<\/code> creates a visualisation graph to add structure to collected information.\n<ul>\n<li><code>-o<\/code> and <code>-oA<\/code> use an existing output file as source and set the prefix for the output file name respectively.<\/li>\n<li><code>-graphistry<\/code>, <code>-maltego<\/code>, and <code>-dot<\/code> define the graph output format.<\/li>\n<li>\n<pre>amass viz -graphistry -d domain.com\r\namass viz -maltego -d domain.com<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>amass track<\/code> analyses a target over time across logged enumerations.\n<ul>\n<li>\n<pre>amass track -d domain.com<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>amass db<\/code> views collected data stored in the database or output directory.\n<ul>\n<li>\n<pre>amass db -d domain.com<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li>In all cases, additional flags are available for help (<code>-h<\/code>), extra verbosity (<code>-v<\/code>), or quiet output (<code>-silent<\/code>). See the documentation for more [<a href=\"https:\/\/github.com\/OWASP\/Amass\/tree\/master\/doc\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><code>assetfinder<\/code>\n<ul>\n<li>Passively finds related domains and subdomains for in-scope targets [<a href=\"https:\/\/github.com\/tomnomnom\/assetfinder\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install assetfinder -y\r\nassetfinder -h\r\nassetfinder domain.com<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>cisco-auditing-tool<\/code>\n<ul>\n<li>Scans Cisco devices and appliances for common vulnerabilities.\n<ul>\n<li><code>-h<\/code> and <code>-f<\/code> for a single host or a list of hosts.<\/li>\n<li><code>-p<\/code> specifies the port number.<\/li>\n<li><code>-w<\/code> and <code>-a<\/code> use word and password lists.<\/li>\n<li>\n<pre>sudo apt install cisco-auditing-tool -y\r\nCAT --help\r\nCAT 192.168.1.1<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>defectdojo<\/code>\n<ul>\n<li>A vulnerability management platform for DevSecOps teams [<a href=\"https:\/\/github.com\/DefectDojo\/django-DefectDojo\">Link<\/a>], with triage support and integrations for Jira and Slack.<\/li>\n<li>\n<pre>sudo apt install defectdojo -y\r\ndefectdojo start\r\ndefectdojo stop<\/pre>\n<\/li>\n<li>Navigate to <a href=\"http:\/\/127.0.0.1:42003\">http:\/\/127.0.0.1:42003<\/a> and use the following command to create an admin user:<\/li>\n<li>\n<pre>cd \/usr\/lib\/defectdojo && sudo -u _defectdojo -- python3 manage.py createsuperuser<\/pre>\n<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3515\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-10-32-37.png\" alt=\"\" width=\"1669\" height=\"807\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-10-32-37.png 1669w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-10-32-37-300x145.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-10-32-37-1024x495.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-10-32-37-768x371.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-10-32-37-1536x743.png 1536w\" sizes=\"auto, (max-width: 1669px) 100vw, 1669px\" \/><\/li>\n<\/ul>\n<\/li>\n<li><code>hb-honeypot<\/code>\n<ul>\n<li>A honeypot [<a href=\"https:\/\/gitlab.com\/kalilinux\/packages\/hb-honeypot\">Link<\/a>] for the Heartbleed vulnerability (CVE-2014-0160), a high-severity OpenSSL flaw [<a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2014-0160\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install hb-honeypot -y<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>maltego<\/code>\n<ul>\n<li>Maltego graphically illustrates and analyses output from intelligence and forensics tools [<a href=\"https:\/\/www.maltego.com\/\">Link<\/a>], making it easy to spot patterns that might otherwise go unnoticed.<\/li>\n<li>\n<pre>sudo apt install maltego -y<\/pre>\n<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3517\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-11-41-16.png\" alt=\"\" width=\"1239\" height=\"264\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-11-41-16.png 1239w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-11-41-16-300x64.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-11-41-16-1024x218.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-25-11-41-16-768x164.png 768w\" sizes=\"auto, (max-width: 1239px) 100vw, 1239px\" \/><\/li>\n<\/ul>\n<\/li>\n<li><code>maryam<\/code>\n<ul>\n<li>OWASP Maryam is an OSINT-based framework for data acquisition and aggregation [<a href=\"https:\/\/github.com\/saeeddhqan\/maryam\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install maryam -y\r\nmaryam -e show modules\r\nmaryam -e crt -q \"domain.com\"\r\nmaryam -e github -q \"userName\"<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>nipper<\/code>\n<ul>\n<li>Audits the configuration of Cisco routers, firewalls, switches, and other network devices for security issues [<a href=\"https:\/\/gitlab.com\/kalilinux\/packages\/nipper-ng\">Link<\/a>]. Note: this tool appears to be unmaintained.<\/li>\n<li>\n<pre>sudo apt install nipper-ng -y\r\nnipper --ios-switch --input=\/PATH\/switch.config --xml --output=audit.xml<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>osrframework<\/code>\n<ul>\n<li>A set of libraries for OSINT collection tasks [<a href=\"https:\/\/github.com\/i3visio\/osrframework\">Link<\/a>].<\/li>\n<li><code>usufy<\/code> identifies social media sites containing a given username.<\/li>\n<li><code>mailfy<\/code> searches for a given email address or username.<\/li>\n<li><code>phonepy<\/code> looks for a phone number in popular directories.<\/li>\n<li><code>domainfy<\/code> finds domains matching a query that resolve to an IP.<\/li>\n<li><code>searchfy<\/code> searches all sources for a given string or name.<\/li>\n<li><code>checkfy<\/code> finds potential email addresses based on known aliases and patterns.<\/li>\n<li>\n<pre>sudo apt install osrframework -y\r\nusufy -n userName\r\nmailfy -n userName\r\nphonefy -n phoneNumber\r\ndomainfy -n domainPrefix\r\nsearchfy -q 'Full Name'\r\n<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>searchsploit<\/code>\n<ul>\n<li>A CLI tool to query the Exploit Database [<a href=\"https:\/\/www.exploit-db.com\/\">Link<\/a>]. It searches for exploits by query string or filter against a local copy of the database.<\/li>\n<li>This database is maintained by the Kali team, but other relevant databases should also be considered during a thorough campaign (not all are equally trustworthy):\n<ul>\n<li>Rapid7 [<a href=\"https:\/\/www.rapid7.com\/db\/\">Link<\/a>]<\/li>\n<li>Vulnerability Lab [<a href=\"https:\/\/www.vulnerability-lab.com\/\">Link<\/a>]<\/li>\n<li>CXSecurity [<a href=\"https:\/\/cxsecurity.com\/exploit\/\">Link<\/a>]<\/li>\n<li>Oday.Today [<a href=\"https:\/\/0day.today\">Link<\/a>]<\/li>\n<li>Packet Storm [<a href=\"https:\/\/packetstormsecurity.com\/files\/tags\/exploit\/\">Link<\/a>]<\/li>\n<\/ul>\n<\/li>\n<li>\n<pre>sudo apt install exploitdb -y\r\nsearchsploit sftp windows\r\nsearchsploit sftp windows --json\r\nsearchsploit -p 40828\r\nsearchsploit sftp --exclude=\"(PoC)|\/dos\/\"\r\nsearchsploit --cve 2021-44228<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>tiger<\/code>\n<ul>\n<li>A collection of tools for internal security auditing and intrusion detection on UNIX-based systems [<a href=\"https:\/\/www.nongnu.org\/tiger\/\">Link<\/a>].<\/li>\n<li>Run <code>sudo tiger<\/code> for a full audit.\n<ul>\n<li><code>-l<\/code> specifies the output directory.<\/li>\n<li><code>-G<\/code> generates MD5 signatures for binary files to detect tampering.<\/li>\n<li><code>-e<\/code> and <code>-E<\/code> provide explanations for findings.<\/li>\n<li><code>-q<\/code> limits output to security issues only.<\/li>\n<li>\n<pre>sudo apt install tiger -y\r\nsudo tiger\r\ntiger -l \/PATH\/\r\ntiger -G<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li>Kali&#8217;s documentation also mentions the alternatives <code>checksecurity<\/code>, <code>lsat<\/code>, and <code>yasat<\/code>.<\/li>\n<\/ul>\n<\/li>\n<li><code>wapiti<\/code>\n<ul>\n<li>A web application dynamic tester [<a href=\"https:\/\/wapiti-scanner.github.io\/\">Link<\/a>] that fuzzes and injects well-known exploits for SQL, XSS, Shell, XXE, CRLF, CSRF, and more.<\/li>\n<li>\n<pre>sudo apt install wapiti -y\r\nwapiti -u http:\/\/domain.com\/app<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>witnessme<\/code>\n<ul>\n<li>This tool is not listed on the Kali tools page and has no <code>man<\/code> file. It appears to take screenshots of remote hosts, possibly via VNC.<\/li>\n<\/ul>\n<\/li>\n<li><code>zap<\/code>\n<ul>\n<li>OWASP ZAP is a proxy tool similar to Burp Suite, used for web application pentesting [<a href=\"https:\/\/www.zaproxy.org\/\">Link<\/a>].<\/li>\n<li>It may not be my favourite tool, but it gets the job done without feature throttling (unlike Burp Community Edition for non-paying users).<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-3519 size-large\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/zap-1024x641.png\" alt=\"\" width=\"640\" height=\"401\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/zap-1024x641.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/zap-300x188.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/zap-768x481.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/zap.png 1438w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Protect<\/strong><\/p>\n<ul>\n<li><code>clamav<\/code>\n<ul>\n<li>ClamAV is probably the most widely used open source antivirus for Linux [<a href=\"https:\/\/www.clamav.net\/\">Link<\/a>].<\/li>\n<li>This signature-based AV engine is the default in many open source projects for scanning email, traffic, and files.<\/li>\n<li>\n<pre>sudo apt install clamav clamav-daemon -y\r\nsudo clamscan --infected --remove --recursive \/PATH\r\n\r\n<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>cryptsetup<\/code>\n<ul>\n<li>A disk encryption setup tool [<a href=\"https:\/\/gitlab.com\/cryptsetup\/cryptsetup\">Link<\/a>].<\/li>\n<li>It uses LUKS (Linux Unified Key Setup) and kernel modules to provide low-overhead encryption for read\/write operations on encrypted partitions.<\/li>\n<li>See the full walk-through in this post [<a href=\"https:\/\/dft.wiki\/?p=2886\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><code>fwbuilder<\/code>\n<ul>\n<li>Firewall Builder is a GUI for creating, editing, and auditing firewall policies across various vendors and platforms [<a href=\"https:\/\/github.com\/fwbuilder\/fwbuilder\/\">Link<\/a>].<\/li>\n<li>It displays rules and policies as objects in a directory structure.<\/li>\n<li>\n<pre>sudo apt install fwbuilder -y<\/pre>\n<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3520\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-26-11-11-14.png\" alt=\"\" width=\"1434\" height=\"592\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-26-11-11-14.png 1434w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-26-11-11-14-300x124.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-26-11-11-14-1024x423.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-26-11-11-14-768x317.png 768w\" sizes=\"auto, (max-width: 1434px) 100vw, 1434px\" \/><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Detect<\/strong><\/p>\n<ul>\n<li><code>grokevt<\/code>\n<ul>\n<li>GrokEVT uses multiple scripts to parse legacy Microsoft Windows event logs [<a href=\"http:\/\/projects.sentinelchicken.org\/grokevt\/\">Link<\/a>]. It appears to be unmaintained.<\/li>\n<li>\n<pre>sudo apt install grokevt -y\r\ngrokevt-parselog -l \/var\/db\/grokevt\/mysystem\r\ngrokevt-parselog \/var\/db\/grokevt\/mysystem System\r\ngrokevt-findlogs dumpDisk.img<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>sentrypeer<\/code>\n<ul>\n<li>A decentralised project for protecting SIP\/VoIP servers without relying on centralised infrastructure [<a href=\"https:\/\/sentrypeer.org\/\">Link<\/a>].<\/li>\n<li>It uses a peer-to-peer method to share suspicious IPs and phone numbers between servers to detect fraud and trigger notifications.<\/li>\n<li>\n<pre>sudo apt install sentrypeer -y\r\nsentrypeer -w -j -f \/PATH\/sentrypeer.db -l \/PATH\/json.log<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Respond<\/strong><\/p>\n<ul>\n<li><code>dc3dd<\/code>\n<ul>\n<li>A forensics tool similar to <code>dd<\/code> but with additional features such as automatic bad sector skipping, hash generation over the copied data stream, compression, and encryption [<a href=\"https:\/\/sourceforge.net\/projects\/dc3dd\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install dc3dd -y\r\ndc3dd -i\r\ndc3dd if=\/dev\/sda of=image.dd hash=sha512<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>ewf-tools<\/code>\n<ul>\n<li>A set of forensics tools and libraries with support for EWF (Expert Witness Format) image files [<a href=\"https:\/\/github.com\/libyal\/libewf-legacy\">Link<\/a>].\n<ul>\n<li><code>ewfacquire<\/code> writes device storage to EWF files.<\/li>\n<li><code>ewfacquirestream<\/code> writes data from standard input to EWF files.<\/li>\n<li><code>ewfexport<\/code> exports storage media data from EWF files to RAW or a specific EWF version.<\/li>\n<li><code>ewfinfo<\/code> displays EWF metadata.<\/li>\n<li><code>ewfmount<\/code> mounts EWF files.<\/li>\n<li><code>ewfrecover<\/code> creates a new set of EWF files from a corrupt set.<\/li>\n<li><code>ewfverify<\/code> verifies EWF integrity and authenticity.<\/li>\n<li>\n<pre>sudo apt install ewf-tools -y\r\newfinfo image.E01\r\newfverify image.E01\r\newfmount image.E01 \/PATH\r\newfrecover image.E01 \/PATH\r\nsudo ewfacquire \/dev\/sda image.E01\r\nsudo ewfacquirestream \/dev\/sda - | ssh user@200.200.200.200 \"cat > \/PATH\/image.E01\"\r\newfacquirestream image.raw | ssh user@200.200.200.200 remote.example.com \"cat > \/PATH\/image.E01\"\r\newfexport image.E01 -f raw -t image.dd<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>foremost<\/code>\n<ul>\n<li>A file recovery tool that reads from image files or directly from a storage device [<a href=\"https:\/\/sourceforge.net\/projects\/foremost\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install foremost -y\r\nforemost -t jpg,png -i \/dev\/sdb1 -o \/PATH\/RECOVERED\/\r\nforemost -c custom.conf -i image.dd -o \/PATH\/RECOVERED\/\r\nforemost -t pdf -i \/dev\/sdc1 -o \/PATH\/RECOVERED\/ -s \/usr\/share\/foremost\/pdf.confidential<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>galleta<\/code>\n<ul>\n<li>A tool to extract cookies from the defunct Microsoft Internet Explorer.<\/li>\n<li>\n<pre>sudo apt install galleta -y\r\ngalleta -d\";\" output.txt\r\ngalleta example.cookie > output.txt<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>ghidra<\/code>\n<ul>\n<li><strong>Ghidra<\/strong> is an open source GUI tool for software reverse engineering, developed by the NSA [<a href=\"https:\/\/github.com\/NationalSecurityAgency\/ghidra\">Link<\/a>]. It supports disassembly, decompilation, and debugging, among other features for analysing binary files and software including malware, firmware, and compiled programs.<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3554\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-45-27.png\" alt=\"\" width=\"1289\" height=\"480\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-45-27.png 1289w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-45-27-300x112.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-45-27-1024x381.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-45-27-768x286.png 768w\" sizes=\"auto, (max-width: 1289px) 100vw, 1289px\" \/><\/li>\n<\/ul>\n<\/li>\n<li><code>guymager<\/code>\n<ul>\n<li>A graphical forensic imaging tool for media acquisition that supports multiple image formats (<code>dd<\/code>, <code>ewf<\/code>, and <code>aff<\/code>, plus disk cloning) and a multi-threaded engine for fast parallel compression [<a href=\"https:\/\/guymager.sourceforge.io\/\">Link<\/a>].<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3555\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-47-57.png\" alt=\"\" width=\"1289\" height=\"430\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-47-57.png 1289w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-47-57-300x100.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-47-57-1024x342.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-03-31-08-47-57-768x256.png 768w\" sizes=\"auto, (max-width: 1289px) 100vw, 1289px\" \/><\/li>\n<\/ul>\n<\/li>\n<li><code>hashrat<\/code>\n<ul>\n<li>Hashrat generates hashes using md5, sha1, sha256, sha512, whirlpool, jh-244, jh256, jh-384, jh-512, and other algorithms, useful for password generation, file integrity checking, and duplicate detection [<a href=\"http:\/\/www.cjpaget.co.uk\/Code\/Hashrat\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install hashrat -y\r\ncat fileName | hashrat -md5<\/pre>\n<\/li>\n<li><strong>Note:<\/strong> the example above is equivalent to <code>md5sum fileName<\/code>, but Hashrat offers much more functionality.<\/li>\n<\/ul>\n<\/li>\n<li><code>sleuthkit<\/code>\n<ul>\n<li>TSK (The Sleuth Kit) is a digital forensics library and collection of command line tools for analysing disk volumes and file systems [<a href=\"https:\/\/www.sleuthkit.org\/sleuthkit\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install libtsk-dev libtsk19 sleuthkit -y<\/pre>\n<ul>\n<li><code>blkcalc<\/code><\/li>\n<li><code>blkcat<\/code><\/li>\n<li><code>blkls<\/code><\/li>\n<li><code>blkstat<\/code><\/li>\n<li><code>fcat<\/code><\/li>\n<li><code>ffind<\/code><\/li>\n<li><code>fiwalk<\/code><\/li>\n<li><code>fls<\/code><\/li>\n<li><code>fsstat<\/code><\/li>\n<li><code>hfind<\/code><\/li>\n<li><code>icat<\/code><\/li>\n<li><code>ifind<\/code><\/li>\n<li><code>ils<\/code><\/li>\n<li><code>img_cat<\/code><\/li>\n<li><code>img_stat<\/code><\/li>\n<li><code>istat<\/code><\/li>\n<li><code>jcat<\/code><\/li>\n<li><code>jls<\/code><\/li>\n<li><code>jpeg_extract<\/code><\/li>\n<li><code>mactime<\/code><\/li>\n<li><code>mmcat<\/code><\/li>\n<li><code>mmls<\/code><\/li>\n<li><code>mmstat<\/code><\/li>\n<li><code>pstat<\/code><\/li>\n<li><code>sigfind<\/code><\/li>\n<li><code>sorter<\/code><\/li>\n<li><code>srch_strings<\/code><\/li>\n<li><code>tsk_comparedir<\/code><\/li>\n<li><code>tsk_gettimes<\/code><\/li>\n<li><code>tsk_imageinfo<\/code><\/li>\n<li><code>tsk_loaddb<\/code><\/li>\n<li><code>tsk_recover<\/code><\/li>\n<li><code>usnjls<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>mac-robber<\/code>\n<ul>\n<li>A sibling project of TSK and Autopsy. <strong>Mac-Robber<\/strong> is a digital investigation and incident response tool that collects metadata from allocated files and directories in a mounted file system [<a href=\"https:\/\/www.sleuthkit.org\/mac-robber\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install mac-robber -y\r\nmac-robber \/PATH\/\r\nmac-robber \/PATH\/ | mactime -z EST<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>impacket-scripts<\/code>\n<ul>\n<li><strong>Impacket<\/strong> is a Python library with tools for interacting with network services such as SMB, MSSQL, and LDAP. It is commonly used for password cracking, network sniffing, packet manipulation, password spraying, and privilege escalation by security researchers [<a href=\"https:\/\/github.com\/fortra\/impacket\">Link<\/a>]. <strong>Impacket-Scripts<\/strong> can be used for both offensive (pentesting) and defensive (network monitoring, detection, and incident response) purposes.<\/li>\n<li>\n<pre>sudo apt install impacket-scripts -y<\/pre>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><code>impacket-addcomputer<\/code><\/li>\n<li><code>impacket-atexec<\/code><\/li>\n<li><code>impacket-dcomexec<\/code><\/li>\n<li><code>impacket-dpapi<\/code><\/li>\n<li><code>impacket-esentutl<\/code><\/li>\n<li><code>impacket-exchanger<\/code><\/li>\n<li><code>impacket-findDelegation<\/code><\/li>\n<li><code>impacket-GetADUsers<\/code><\/li>\n<li><code>impacket-getArch<\/code><\/li>\n<li><code>impacket-Get-GPPPassword<\/code><\/li>\n<li><code>impacket-GetNPUsers<\/code><\/li>\n<li><code>impacket-getPac<\/code><\/li>\n<li><code>impacket-getST<\/code><\/li>\n<li><code>impacket-getTGT<\/code><\/li>\n<li><code>impacket-GetUserSPNs<\/code><\/li>\n<li><code>impacket-goldenPac<\/code><\/li>\n<li><code>impacket-karmaSMB<\/code><\/li>\n<li><code>impacket-keylistattack<\/code><\/li>\n<li><code>impacket-kintercept<\/code><\/li>\n<li><code>impacket-lookupsid<\/code><\/li>\n<li><code>impacket-machine_role<\/code><\/li>\n<li><code>impacket-mimikatz<\/code><\/li>\n<li><code>impacket-mqtt_check<\/code><\/li>\n<li><code>impacket-mssqlclient<\/code><\/li>\n<li><code>impacket-mssqlinstance<\/code><\/li>\n<li><code>impacket-netview<\/code><\/li>\n<li><code>impacket-nmapAnswerMachine<\/code><\/li>\n<li><code>impacket-ntfs-read<\/code><\/li>\n<li><code>impacket-ntlmrelayx<\/code><\/li>\n<li><code>impacket-ping<\/code><\/li>\n<li><code>impacket-ping6<\/code><\/li>\n<li><code>impacket-psexec<\/code><\/li>\n<li><code>impacket-raiseChild<\/code><\/li>\n<li><code>impacket-rbcd<\/code><\/li>\n<li><code>impacket-rdp_check<\/code><\/li>\n<li><code>impacket-reg<\/code><\/li>\n<li><code>impacket-registry-read<\/code><\/li>\n<li><code>impacket-rpcdump<\/code><\/li>\n<li><code>impacket-rpcmap<\/code><\/li>\n<li><code>impacket-sambaPipe<\/code><\/li>\n<li><code>impacket-samrdump<\/code><\/li>\n<li><code>impacket-secretsdump<\/code><\/li>\n<li><code>impacket-services<\/code><\/li>\n<li><code>impacket-smbclient<\/code><\/li>\n<li><code>impacket-smbexec<\/code><\/li>\n<li><code>impacket-smbpasswd<\/code><\/li>\n<li><code>impacket-smbrelayx<\/code><\/li>\n<li><code>impacket-smbserver<\/code><\/li>\n<li><code>impacket-sniff<\/code><\/li>\n<li><code>impacket-sniffer<\/code><\/li>\n<li><code>impacket-split<\/code><\/li>\n<li><code>impacket-ticketConverter<\/code><\/li>\n<li><code>impacket-ticketer<\/code><\/li>\n<li><code>impacket-wmiexec<\/code><\/li>\n<li><code>impacket-wmipersist<\/code><\/li>\n<li><code>impacket-wmiquery<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>netsniff-ng<\/code>\n<ul>\n<li><strong>Netsniff-ng<\/strong> is a free Linux networking toolkit for network development, analysis, debugging, auditing, and reconnaissance [<a href=\"http:\/\/netsniff-ng.org\/\">Link<\/a>]. Source code available at [<a href=\"https:\/\/github.com\/netsniff-ng\/netsniff-ng\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install netsniff-ng<\/pre>\n<ul>\n<li><code>netsniff-ng<\/code> a zero-copy analyser and pcap capture\/replay tool compatible with <code>tcpdump<\/code> and <code>wireshark<\/code>.<\/li>\n<li><code>trafgen<\/code> a multi-threaded, low-level, zero-copy network packet generator (including raw 802.11 frames).<\/li>\n<li><code>mausezahn<\/code> a high-level packet generator for network appliances with a Cisco-style CLI, useful for stress testing, malformed packets, and malicious packet tests.<\/li>\n<li><code>bpfc<\/code> a BPF (Berkeley Packet Filter) compiler and disassembler with support for undocumented Linux filter extensions.<\/li>\n<li><code>ifpps<\/code> a top-like kernel networking statistics tool.\n<ul>\n<li><code>-d<\/code> or <code>--dev<\/code> specifies the device.<\/li>\n<li><code>-n<\/code> or <code>--num-cpus<\/code> specifies the number of CPUs\/cores to display in ncurses mode (default: 10).<\/li>\n<li><code>-t<\/code> or <code>--interval<\/code> sets the refresh interval (default: 1000ms).<\/li>\n<li><code>-c<\/code> or <code>--csv<\/code> outputs data in CSV format.<\/li>\n<li><code>-o<\/code> or <code>--omit-header<\/code> omits headers when used with <code>-c<\/code>.<\/li>\n<li><code>-l<\/code> or <code>--loop<\/code> continuously outputs data to the terminal after each refresh interval. Requires <code>-c<\/code>.<\/li>\n<li><code>-m<\/code> or <code>--median<\/code> shows median values across all CPUs\/cores for load and interrupts.<\/li>\n<li><code>-p<\/code> or <code>--promisc<\/code> enables promiscuous mode on the NIC. May also require hypervisor-level changes in virtualised environments.<\/li>\n<li><code>-P<\/code> or <code>--percentage<\/code> shows values relative to the line rate.<\/li>\n<li><code>-W<\/code> or <code>--no-warn<\/code> suppresses warnings.<\/li>\n<li>\n<pre>ifpps eth0\r\nsudo ifpps -pd eth0\r\nsudo ifpps -lpcd eth0 > eth0raw.data\r\nsudo ifpps -lpcd wlan0 > wlan0raw.data<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>flowtop<\/code> a top-like netfilter connection tracking tool.\n<ul>\n<li><code>-4<\/code> or <code>--ipv4<\/code> for IPv4 only.<\/li>\n<li><code>-6<\/code> or <code>--ipv6<\/code> for IPv6 only.<\/li>\n<li><code>-T<\/code> or <code>--tcp<\/code> for TCP traffic only.<\/li>\n<li><code>-U<\/code> or <code>--udp<\/code> for UDP traffic only.<\/li>\n<li><code>-I<\/code> or <code>--icmp<\/code> for ICMP traffic only.<\/li>\n<li><code>-D<\/code> or <code>--dccp<\/code> for DCCP traffic only.<\/li>\n<li><code>-S<\/code> or <code>--sctp<\/code> for SCTP traffic only.<\/li>\n<li><code>-n<\/code> or <code>--no-dns<\/code> disables reverse DNS lookups.<\/li>\n<li><code>-s<\/code> or <code>--show-src<\/code> shows the source IP.<\/li>\n<li><code>-b<\/code> or <code>--bits<\/code> shows speed in bits\/s instead of bytes\/s.<\/li>\n<li><code>-G<\/code> or <code>--no-geoip<\/code> disables the GeoIP database (recommended; known to be buggy).<\/li>\n<li><code>-u<\/code> or <code>--update<\/code> updates the local GeoIP database.<\/li>\n<li><code>-t<\/code> or <code>--interval<\/code> sets the refresh interval in seconds (default: 1). All flags can be combined.\n<ul>\n<li>\n<pre>sudo flowtop -4UTIGs<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li>For the GeoIP database:\n<ul>\n<li>\n<pre>sudo mkdir \/usr\/share\/netsniff-ng\r\nsudo flowtop --update<\/pre>\n<\/li>\n<li>You may encounter a missing <code>GeoIP.dat.gz<\/code> file that can no longer be retrieved from mirrors. As a workaround, download and place the file in the specified directory manually, or disable GeoIP with <code>-G<\/code>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>curvetun<\/code> a lightweight Curve25519-based IP tunnel using TUN\/TAP to transfer IPv4\/IPv6 TCP\/UDP traffic over IPv4\/IPv6.<\/li>\n<li><code>astraceroute<\/code> an autonomous system (AS) traceroute utility that provides additional AS and GeoIP information compared to <code>traceroute<\/code> and <code>tcptraceroute<\/code>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>ollydbg<\/code>\n<ul>\n<li><strong>OllyDbg<\/strong> is a 32-bit assembler-level debugger and decompiler for Microsoft Windows binaries [<a href=\"https:\/\/www.ollydbg.de\/\">Link<\/a>]. It requires <code>wine<\/code> to run on Linux and is useful for malware analysis. Note: it is not open source.<\/li>\n<li>\n<pre>sudo dpkg --add-architecture i386 && sudo apt update && sudo apt -y install wine32\r\nollydbg<\/pre>\n<ul>\n<li>It may fail if <code>wine<\/code> cannot load <code>kernel32.dll<\/code>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>rkhunter<\/code>\n<ul>\n<li>Rootkit Hunter is an open source Unix-based tool that scans for rootkits, backdoors, and local exploits [<a href=\"https:\/\/rkhunter.sourceforge.net\/\">Link<\/a>].<\/li>\n<li>It compares hashes of important local files against known-good values in online databases.<\/li>\n<li>It also searches for rootkits, incorrect permissions, hidden files, suspicious strings in kernel modules, and performs specific tests for Linux and FreeBSD.<\/li>\n<li>\n<pre>sudo apt install rkhunter -y\r\nsudo rkhunter --update\r\nsudo rkhunter --propupd\r\nsudo rkhunter -c --enable all --disable none --rwo\r\nsudo rkhunter --check\r\nsudo tail -f \/var\/log\/rkhunter.log<\/pre>\n<ul>\n<li><strong>Note:<\/strong> There is limited value in running it directly on Kali unless it has a secondary drive mounted (cloned from a production server) and you use <code>chroot<\/code> to scan that system instead. It is most useful when run periodically on production environments as a cronjob with email notifications enabled (e.g. <code>0 3 * * * root \/usr\/bin\/rkhunter --cronjob --update --quiet<\/code>).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>unhide<\/code>\n<ul>\n<li><strong>Unhide<\/strong> is a forensics tool that detects processes and open ports hidden by rootkits, LKMs (loadable kernel modules), or other techniques [<a href=\"https:\/\/www.unhide-forensics.info\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install unhide -y<\/pre>\n<\/li>\n<li><code>unhide<\/code> reveals processes hidden from the process list.\n<ul>\n<li><code>brute<\/code> an aggressive method that checks areas not covered by default.<\/li>\n<li><code>proc<\/code> checks a specific process ID.<\/li>\n<li><code>procall<\/code> uses all available methods including <code>brute<\/code>.<\/li>\n<li><code>procfs<\/code> relies on <code>\/proc<\/code> to obtain the process list.<\/li>\n<li><code>quick<\/code> a faster, less intrusive check.<\/li>\n<li><code>reverse<\/code> runs checks in reverse order, starting from <code>brute<\/code>.<\/li>\n<li><code>sys<\/code> relies on <code>syscall<\/code> to obtain the process list.<\/li>\n<li>\n<pre>sudo unhide proc\r\nsudo unhide procall\r\nsudo unhide -v brute<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>unhide-linux<\/code> looks for processes hidden via Linux kernel modules.\n<ul>\n<li>\n<pre>sudo unhide-linux reverse<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>unhide-posix<\/code> checks for hidden TCP\/UDP ports (backdoors).\n<ul>\n<li>\n<pre>sudo unhide-posix sys\r\nsudo unhide-posix proc<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>unhide-tcp<\/code> also checks for hidden TCP\/UDP ports (backdoors).\n<ul>\n<li>\n<pre>sudo unhide-tcp -v<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>unhide_rb<\/code> checks for hidden processes using C functions commonly found in rootkits, written in Ruby.\n<ul>\n<li>\n<pre>sudo unhide_rb<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><strong>Note:<\/strong> <code>unhide-gui<\/code> is not included in Kali and does not appear to be functional.<\/li>\n<\/ul>\n<\/li>\n<li><code id=\"wireshark\">wireshark<\/code>\n<ul>\n<li>Wireshark is a network protocol analyser that captures traffic in real time, commonly used for troubleshooting, monitoring, and identifying security vulnerabilities [<a href=\"https:\/\/www.wireshark.org\/\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><code>xplico<\/code>\n<ul>\n<li>Xplico is a network forensics tool that extracts content from PCAP files [<a href=\"https:\/\/www.xplico.org\/\">Link<\/a>]. For example, it can reconstruct web pages, transferred files, and VoIP calls. It also offers a web interface at <strong>http:\/\/127.0.0.1:9876<\/strong> (default credentials: <strong>admin<\/strong>:<strong>xplico<\/strong>).\n<ul>\n<li>\n<pre>sudo xplico-webui<\/pre>\n<\/li>\n<li><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3569\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-04-09-15-31-11.png\" alt=\"\" width=\"1278\" height=\"665\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-04-09-15-31-11.png 1278w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-04-09-15-31-11-300x156.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-04-09-15-31-11-1024x533.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/03\/Screenshot-from-2023-04-09-15-31-11-768x400.png 768w\" sizes=\"auto, (max-width: 1278px) 100vw, 1278px\" \/><\/li>\n<\/ul>\n<\/li>\n<li>Command-line usage:\n<ul>\n<li>\n<pre>xplico -m pcap -f file.pcap\r\nsudo xplico -m rltm -i eth0<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>yara<\/code>\n<ul>\n<li>YARA rules identify patterns in malware binaries to aid in signature-based classification [<a href=\"https:\/\/virustotal.github.io\/yara\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install yara libyara9 libyara-dev -y<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Recover<\/strong><\/p>\n<ul>\n<li><code id=\"ddrescue\">ddrescue<\/code>\n<ul>\n<li>A widely used tool for recovering data from drives with damaged sectors or blocks [<a href=\"https:\/\/www.gnu.org\/software\/ddrescue\/\">Link<\/a>]. Other options include SpinRite (not open source, but widely regarded as the most powerful) [<a href=\"https:\/\/www.grc.com\/sr\/spinrite.htm\">Link<\/a>], MyRescue, Testdisk, Photorec, Foremost, and Scalpel.<\/li>\n<li>\n<pre>sudo ddrescue -f --no-split \/dev\/sdb1 \/dev\/sdc1 output.log<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>ext3grep<\/code>\n<ul>\n<li>A forensics tool for recovering deleted files [<a href=\"https:\/\/code.google.com\/archive\/p\/ext3grep\/source\/default\/source\">Link<\/a>]. Note: unmaintained, as <strong>ext3<\/strong> is considered obsolete.<\/li>\n<li>\n<pre>sudo apt install ext3grep -y\r\next3grep --dump-names \/dev\/sdb1 | grep 'fileName'\r\next3grep --ls --group 1000 \/dev\/sdb1\r\next3grep --restore-all \/dev\/sdb1<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>ext4magic<\/code>\n<ul>\n<li><strong>ext4magic<\/strong> was inspired by <strong>ext3grep<\/strong> and <strong>extundelete<\/strong> and can restore deleted files from <strong>ext3\/ext4<\/strong> file systems using the journal [<a href=\"https:\/\/ext4magic.sourceforge.net\/ext4magic_en.html\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install ext4magic -y\r\nsudo ext4magic \/dev\/sdb1 -M -d \/PATH\/Recovered\/<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>extundelete<\/code>\n<ul>\n<li><strong>ExtUndelete<\/strong> attempts to recover deleted files using clues found in the partition journal [<a href=\"https:\/\/extundelete.sourceforge.net\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install extundelete -y\r\nsudo extundelete \/dev\/sdb1 --restore-all<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>myrescue<\/code>\n<ul>\n<li><strong>MyRescue<\/strong> is an alternative to <strong>ddrescue<\/strong> that makes a best effort to recover data from defective drives [<a href=\"https:\/\/myrescue.sourceforge.net\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install myrescue -y<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>recoverdm<\/code>\n<ul>\n<li>RecoverDM recovers data from bad sectors by reading in raw mode while ignoring errors. It is a defunct, discontinued application with no official website.<\/li>\n<li>\n<pre>sudo apt install recoverdm -y<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>recoverjpeg<\/code>\n<ul>\n<li><strong>RecoverJPEG<\/strong> attempts to recover deleted JPEG and MOV files (using <code>recovermov<\/code>) from a partition [<a href=\"https:\/\/rfc1149.net\/devel\/recoverjpeg.html\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install recoverjpeg -y<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>scrounge-ntfs<\/code>\n<ul>\n<li><strong>Scrounge NTFS<\/strong> reads each block of a disk and attempts to rebuild the original file system structure into an output directory [<a href=\"http:\/\/thewalter.net\/stef\/software\/scrounge\/\">Link<\/a>].<\/li>\n<li>\n<pre>sudo apt install scrounge-ntfs -y\r\nsudo scrounge-ntfs -l \/dev\/sdb\r\nscrounge-ntfs -m <MFT_OFFSET> -c <CLUSTER_SIZE> <START_SECTOR> <END_SECTOR> -o \/PATH\/Recovered\/ \/dev\/sdb<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<li><code>undbx<\/code>\n<ul>\n<li><strong>UnDBX<\/strong> recovers deleted emails from MS Outlook <code>.dbx<\/code> files [<a href=\"https:\/\/sourceforge.net\/p\/undbx\/code\/ci\/master\/tree\/\">Link<\/a>] and can also recover emails or fragments from corrupted files.<\/li>\n<li>\n<pre>sudo apt install undbx -y\r\n<\/pre>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Kali Linux is a Debian-based Linux distribution originally designed for offensive information security. It contains [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-3500","post","type-post","status-publish","format-standard","hentry","category-hacking"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3500"}],"version-history":[{"count":29,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3500\/revisions"}],"predecessor-version":[{"id":5645,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3500\/revisions\/5645"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}