How To Install Kali NetHunter On Any Android Device - Universal Method.

<div dir="ltr" style="text-align: left;" trbidi="on"> <br /> In the previous <a href="http://www.hackcave.net/2017/01/how-to-install-kali-nethunter-on-any-Device.html" target="_blank"><b><span style="color: #274e13;">Tutorial On How To Install Kali NetHunter On Any Android Device</span></b></a>, I have covered some methods to make Kali NeHunter work on some specific devices. As a continuation to that, I have made a tutorial to install and run Kali NetHunter on any android device. So this is the universal method to to install Kali Nethunter on Android devices. So if the previous methods of how to install Kali NetHunter on Android devices did not work or your phone is not supported, follow this process. Do it at your own risk. Some functionalities might be limited.<br /> <br /> <h2 style="text-align: left;"> Pre-Requisites:</h2> <ul style="text-align: left;"> <li>There are certain requirements that are to be met before installing NetHunter using this method. </li> <li>The device should be properly rooted. If rooted with KingRoot, replace KingUser with SuperSu</li> <li>BusyBox installed. Install it from PlaySore. </li> <li>Ample Storage </li> <li>Custom ROMs like CM12 CM12.1 CM13. (Desired, not mandatory)</li> </ul> <h2 style="text-align: left;"> Procedure to Install Kali NetHunter On Any Android Device</h2> <ul style="text-align: left;"> <li><a href="https://www.offensive-security.com/kali-linux-nethunter-download/" rel="nofollow" target="_blank"><b><span style="color: #274e13;">Download any Nethunter ROM</span></b></a> from Offensive Security Web Site according to your Android Version. </li> <li>Extract the Zip file and go to /data/app. Install the apps present in that folder one by one. </li> <li>Now with any root explorer app, go to /data/data/com.offsec.nethunter/files/scripts. Then copy all the files and paste into /system/bin (Note: If you don't see the folder or content in files/scripts, open NetHunter app and then close it and check again)</li> <li>Next, open the Nethunter App and Go to the Kali Chroot Manager and install the "Minimal Chroot". You can also select "Full Chroot" but this is not recommended. </li> <li>Open Terminal Emulator or nh-terminal and choose "KALI". This will open up Kali shell. You may be prompted to allow root permission. Just grant it and you will be good to go.</li> </ul> <div class="separator" style="clear: both; text-align: center;"> <a href="https://1.bp.blogspot.com/-GF0CqLx8Kbs/WRU_hvcvw2I/AAAAAAAAAZk/yfEqS9xLjjgAL_jrXqDe_IeNHqnre8rcgCLcB/s1600/One.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="How to install NetHunter on Any Device" border="0" height="236" src="https://1.bp.blogspot.com/-GF0CqLx8Kbs/WRU_hvcvw2I/AAAAAAAAAZk/yfEqS9xLjjgAL_jrXqDe_IeNHqnre8rcgCLcB/s640/One.png" title="" width="640" /></a></div> <div> <br /></div> <ul style="text-align: left;"> <li>After that, run these commands one by one in the terminal:</li> </ul> <b><span style="color: red;">apt-get update</span></b><br /> <b><span style="color: red;">apt-get upgrade</span></b><br /> <b><span style="color: red;">apt-get dist-upgrade</span></b><br /> <b><span style="color: red;">apt-get install kali-linux-nethunter</span></b><br /> <br /> <h2 style="text-align: left;"> How To Setup Metasploit In Kali NetHunter</h2> <br /> To enjoy the full functionalities of Kali NetHunter, setting up and enabling Metasploit is very essential. This step is necessary for using the features of Metasploit and other tools which make use of Metasploit Modules. Follow the below given steps.<br /> <br /> <b>Initialize the database</b>: run this command <b><span style="color: red;">msfdb init </span></b>(Alternatively goto Kali Services Tab on Nethunter App and set it to "Start at boot")<br /> <br /> <b>To run Metasploit : </b>use this command <b><span style="color: red;">msfconsole </span></b>or open any tool which uses Metasploit like setoolkit<br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://4.bp.blogspot.com/-8cvW4iihvx4/WRVCIIPBK9I/AAAAAAAAAZ8/rFzfBwH5Z-gHYYD6eGUtj6AWkbak05khgCLcB/s1600/two.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Setup Metasploit in Kali NetHunter" border="0" height="380" src="https://4.bp.blogspot.com/-8cvW4iihvx4/WRVCIIPBK9I/AAAAAAAAAZ8/rFzfBwH5Z-gHYYD6eGUtj6AWkbak05khgCLcB/s640/two.png" title="" width="640" /></a></div> <br /> <br /> This should install everything required to run Kali NetHunter in Any Android Device. You can access most of the Kali Linux tools from the terminal. However If you want to try the GUI tools, follow the below steps.<br /> <br /> <h2 style="text-align: left;"> How to install and Enable VNC in Kali NetHunter.</h2> <br /> VNC Viewer is required to work on GUI tools. For this, VNC server needs to be installed in the Kali NethHunter. This can be done by following the below given steps.<br /> <ul style="text-align: left;"> <li>Open Terminal and execute the following command in Kali Terminal</li> </ul> <b><span style="color: red;">apt-get install tightvncserver</span></b><br /> <br /> <ul style="text-align: left;"> <li>To run VNC Server type the following command</li> </ul> <br /> <b><span style="color: red;">vncserver :1 -geometry 1280x720 -depth 16</span></b><br /> <br /> Explanation of switches: -<br /> <br /> <b>:1</b> (Display 1,2,3,4 etc..)*<br /> <br /> <b>-geometry </b>(Resolution width x height)<br /> <br /> <b>-depth</b> (16, 24, Color Depth, use 16)<br /> <ul style="text-align: left;"> <li>Now Install any VNC app from PlayStore and open it. I suggest using this App called <a href="https://play.google.com/store/apps/details?id=com.realvnc.viewer.android&hl=en" rel="nofollow" target="_blank"><b><span style="color: #274e13;">VNC Viewer</span></b></a> by RealVNC Limited We will use it to connect to Kali NetHunter GUI. Setup VNC app with the below details.</li> </ul> <b>Alias: </b>Kali Linux<br /> <br /> <b>Password:</b> The password you set before<br /> <br /> <b>Address: </b>127.0.0.1 or your Private IP<br /> <br /> <b>Port:</b> 5901 (Depends on display i.e., for display 2, Port will be 5902 and so on)<br /> <br /> <b>Username</b>: root<br /> <ul style="text-align: left;"> <li>Click connect and now you can enjoy the NetHunter Tools in GUI.</li> </ul> <div> <b>Credits</b>: <a href="https://forum.xda-developers.com/sitesearch.php?q=NetHunter" rel="nofollow" target="_blank"><b><span style="color: #274e13;">XDA</span></b></a></div> </div>

How To Install Kali NetHunter On Any Android Device - Universal Method.

In the previous Tutorial On How To Install Kali NetHunter On Any Android Device , I have covered some methods to make Kali NeHunter work o...

Read more »

PINlogger: JavaScript tool to Hack Passwords Just By monitoring SmartPhone Sensors

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://2.bp.blogspot.com/-CFynlOC4o3k/WPLkUP52-6I/AAAAAAAAAYY/QLWCI1feSKUP-8IktYWiXahD82IMM4zAgCLcB/s1600/preview.jpg" imageanchor="1"><img alt="SmartPhone Sensor Hack" border="0" height="640" src="https://2.bp.blogspot.com/-CFynlOC4o3k/WPLkUP52-6I/AAAAAAAAAYY/QLWCI1feSKUP-8IktYWiXahD82IMM4zAgCLcB/s640/preview.jpg" title="PINlogger Attack" width="360" /></a></div> <div> <br /></div> <div> A typical SmartPhone comes with a number of sensors, like microphone, camera, proximity sensors, fingerprint reader etc for better user experience and features. A high-end SmartPhone comes with additional sensors like magnetometers, barometers, thermometers and even sophisticated sensors like accelerometers and gyroscopes for motion detecting. But did you know that these smartphone sensors can lead to potential compromise of your personal data which includes sensitive information like passwords? This post explains about the security and privacy concerns of growing number of SmartPhone Sensors.</div> <div> <br /></div> <h2 style="text-align: left;"> How SmartPhone Sensors can be leveraged to Hack Passwords. </h2> <div> <br /></div> <div> A recent study conducted by The Newcastle University shows that motion sensors found in android SmartPhones could let an attacker get the security PINs of users. They have proposed a JavaScript tool named <b>PINlogger.js</b> which is a JavaScript-based <b><a href="https://en.wikipedia.org/wiki/Side-channel_attack" rel="nofollow" target="_blank"><span style="color: #274e13;">side channel attack</span> </a></b>vector<b>.</b> This can be embedded into websites controlled by attackers and when an unsuspecting user visits the web page, it starts to listen to the motion and orientation sensors. This doesn't require any permission from the user and thereby works in stealth mode. Data thus collected is analyzed using an artificial neural network to infer the user’s PIN.</div> <div> <br /></div> <h2 style="text-align: left;"> Attack Methodology </h2> <div> <br /></div> <div> According to the researchers, the PINlogger.js can be embedded in web pages as well as standalone apps which can be installed on user devices. The study was conducted on Chrome on an Android device (Nexus 5), involving 10 users, each entering all the 50 4-digit PINs for 5 times. It was able to guess the PIN 70% of the time at first try. On increasing the rate, 100% success rate was reached on the fifth try. These results are rather concerning as the PIN guessing and success rate is extremely high. </div> <div> <br /></div> <table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><a href="https://3.bp.blogspot.com/-oH7lfqOQf2A/WPLkkbF538I/AAAAAAAAAYc/g_8D2FhTB1korbBvSWqCi8ZUnNFQVh7CwCLcB/s1600/1.gif" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="SmartPhone Sensor PINs hack" border="0" height="274" src="https://3.bp.blogspot.com/-oH7lfqOQf2A/WPLkkbF538I/AAAAAAAAAYc/g_8D2FhTB1korbBvSWqCi8ZUnNFQVh7CwCLcB/s640/1.gif" title="PINlogger" width="640" /></a></td></tr> <tr><td class="tr-caption" style="text-align: center;">Image credits: https://link.springer.com/article/10.1007/s10207-017-0369-x</td></tr> </tbody></table> <div> <br /></div> <h2 style="text-align: left;"> Should the users be worried about the SmartPhone Sensor monitoring attack? </h2> <div> <br /></div> <div> Yes and No. <a href="https://en.wikipedia.org/wiki/Artificial_neural_network" rel="nofollow" target="_blank"><b><span style="color: #274e13;">Neural Networks</span></b></a> are used here and practically deploying it to target a user required a good amount of training data. Moreover, the user has to keep a web page with the malicious javascript <b>PINlogger.js</b> injected opened in the background and then try to enter PINs repeatedly to result in a successful guessing. However this SmartPhone Sensor attack is successful mostly against guessing PINs, and most of the instances a simple 4 digit code are used for ATM PINs, NFC-based payment systems, etc. People use predictable and easy to remember set of digits like 0000, 1234, 1111 etc as PINs so a sophisticated neural network may not be required always to pull off a successful attack. </div> <div> <br /></div> <h2 style="text-align: left;"> Possible solutions against SmartPhone Sensor based attacks. </h2> <div> <br /></div> <div> Since the vulnerability is due to the SmartPhone sensors being misused, one possible solution suggested by the researchers is to restrict permissions how these sensors are accessed by apps and websites. Other suggested solutions are: - </div> <div> <ul style="text-align: left;"> <li>Use longer PINs, </li> <li>Change PINs often, </li> <li>Check the app permissions before installation,</li> <li>Stop the apps from running in the background unless necessary.</li> <li>Adopt other methods of authentication. </li> </ul> </div> <div> <br /></div> <div> <b>Source & Technical Details : https://link.springer.com/article/10.1007/s10207-017-0369-x</b><br /> <br /></div> </div>

PINlogger: JavaScript tool to Hack Passwords Just By monitoring SmartPhone Sensors

A typical SmartPhone comes with a number of sensors, like microphone, camera, proximity sensors, fingerprint reader etc for better use...

Read more »

Stethoscope - An OpenSource, User Focused Security Tool By NetFlix

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://3.bp.blogspot.com/-_oNsLbcOCNQ/WLQfB2lIpuI/AAAAAAAAAWU/YcDEmndPr4g1qvooHHrNEFtL1DXSuqyvACLcB/s1600/Stethoscope%2BShmooCon%2B2017.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="378" src="https://3.bp.blogspot.com/-_oNsLbcOCNQ/WLQfB2lIpuI/AAAAAAAAAWU/YcDEmndPr4g1qvooHHrNEFtL1DXSuqyvACLcB/s640/Stethoscope%2BShmooCon%2B2017.png" width="640" /></a></div> <br /> <b>Stethoscope</b> is a web-based tool that gives Netflix employees a view into the security state of their devices, with specific recommendations regarding disk encryption, firewalls, and other device settings. The website, in conjunction with email alerts, gives Netflix employees a straightforward way to see what actions they should take to remain safe.<br /> <br /> <h2 style="text-align: left;"> User Focused Security</h2> <br /> Users cause most of the security incidents like data breaches and mass cyber attacks. Usually, big corporates and financial establishments will have a lot of security policies and tools which are enforced on the users and controlled centrally. But User Focused Security is formulated to change this approach. This approach of user-focused security largely depends on the direct action by the users to thwart cyber threats instead of a single point controlled security system. It relies on the user's knowledge and awareness about the possible security issues they might come across in their day to day work. This is achieved by informing the user about the potential security issues on the go as they continue doing their daily work. It is designed considering the true context of people’s work.<br /> <br /> <table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><a href="https://4.bp.blogspot.com/-in91XJwiLWw/WLQf95roALI/AAAAAAAAAWk/dN5KMwWy2AsFJS4CHSE3DEm209VKX52dwCLcB/s1600/pastedImage0%2B%25281%2529.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Netflix Stethoscope Security Tool" border="0" height="402" src="https://4.bp.blogspot.com/-in91XJwiLWw/WLQf95roALI/AAAAAAAAAWk/dN5KMwWy2AsFJS4CHSE3DEm209VKX52dwCLcB/s640/pastedImage0%2B%25281%2529.png" title="" width="640" /></a></td></tr> <tr><td class="tr-caption" style="text-align: center;">Image Credits: netflix.com</td></tr> </tbody></table> <h2 style="text-align: left;"> How Stethoscope implements User Focused Security</h2> <div> <br /> Stethoscope tool continuously monitors user activities and gives suggestions to users directly. These include a short description of the security threat so that the user can understand why it is being suggested and the importance of it. Below is an example of one such suggestion. It tells about the importance of updating an Android device to the latest available software version.<br /> <br /> <table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><a href="https://3.bp.blogspot.com/-nfyEEEeDtM4/WLQfL4Kkk2I/AAAAAAAAAWg/HA-kdN21l7M2qZW3EMvEKSwx2tbsduM3gCEw/s1600/pastedImage0.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Stethoscope Security Tool User Focused Security" border="0" height="382" src="https://3.bp.blogspot.com/-nfyEEEeDtM4/WLQfL4Kkk2I/AAAAAAAAAWg/HA-kdN21l7M2qZW3EMvEKSwx2tbsduM3gCEw/s640/pastedImage0.png" title="Stethoscope Security Tool" width="640" /></a></td></tr> <tr><td class="tr-caption" style="text-align: center;">Image Credits : netflix.com</td></tr> </tbody></table> <br /> <h2 style="text-align: left;"> What Security Elements are monitored?</h2> <br /> The following device configurations are monitored by the Stethoscope security tool and these are known as 'practices'<br /> <ul style="text-align: left;"> <li>Disk encryption</li> <li>Firewall</li> <li>Automatic updates</li> <li>Up-to-date OS/software</li> <li>Screen lock</li> <li>Not jailbroken/rooted</li> <li>Security software stack (e.g., Carbon Black) </li> </ul> These are rated based on the importance and criticality.<br /> <br /> <h2 style="text-align: left;"> Implementation of Stethoscope security Tool</h2> <table cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: left; margin-right: 1em; text-align: left;"><tbody> <tr><td style="text-align: center;"><br /> <a href="https://1.bp.blogspot.com/-yvw_7zv2cOQ/WLQfRe-jnOI/AAAAAAAAAWc/GlQRDTIWo-AGmI5_d3SBRjziZFWyk9MIACLcB/s1600/Stethoscope%2BShmooCon%2B2017%2B%25281%2529.png" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-left: auto; margin-right: auto;"><img alt="Netflix Stethoscope Security Tool" border="0" height="360" src="https://1.bp.blogspot.com/-yvw_7zv2cOQ/WLQfRe-jnOI/AAAAAAAAAWc/GlQRDTIWo-AGmI5_d3SBRjziZFWyk9MIACLcB/s640/Stethoscope%2BShmooCon%2B2017%2B%25281%2529.png" title="Davice Data Rerieeval" width="640" /></a></td></tr> <tr><td class="tr-caption" style="text-align: center;">Image Credits: Netflix.com</td></tr> </tbody></table> Stethoscope security tool is powered by a Python back-end and a React front end. It doesn't have its own data storage feature, instead, it directly fetches device information by querying various data sources and then merges that data for the final output.<br /> The data sources here are implemented as plugins which can be added easily. Currently, the following are supported- LANDESK (for Windows), JAMF (for Macs), and Google MDM (for mobile devices).<br /> <br /> <h2 style="text-align: left;"> Notification option by Stethoscope security Tool</h2> <br /> Stethoscope security Tool provides a dashboard for notifications and alerts. One can directly respond to notifications from there. An example notification is shown below.</div> <div> <table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody> <tr><td style="text-align: center;"><a href="https://3.bp.blogspot.com/-nfyEEEeDtM4/WLQfL4Kkk2I/AAAAAAAAAWY/b9ZxC-QIP6cP3EdOuZX65-0axZimYMrsACLcB/s1600/pastedImage0.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Netflix Stethoscope Security Tool" border="0" height="382" src="https://3.bp.blogspot.com/-nfyEEEeDtM4/WLQfL4Kkk2I/AAAAAAAAAWY/b9ZxC-QIP6cP3EdOuZX65-0axZimYMrsACLcB/s640/pastedImage0.png" title="Stethoscope Security Tool Notofications" width="640" /></a></td></tr> <tr><td class="tr-caption" style="text-align: center;">Image Credits: Netflix.com</td></tr> </tbody></table> <br /></div> <h2 style="text-align: left;"> How Stethoscope is different from traditional Security Tools.</h2> <div> <br /> Stethoscope is an innovative approach to security monitoring. It relies on the end users and their awareness to fight security threats. A normal SIEM implementation or an IDS/IPS has centralized consoles from where every security events and incidents are monitored and handled. The end user has little or no roles to play. Other than staying vigilant maximum he can do is to follow the instructions sent by the IT department in case of a security incident. Stethoscope security Tool works upon the motto of "Prevention Is Better Than Cure". Moreover, Stethoscope Security tool has a mobile friendly interface and this further makes the process of notifying users easy even if they are not at their desk.<br /> <br /> <b>Stethoscope Tool is available on</b> <a href="https://github.com/Netflix/Stethoscope" rel="nofollow" target="_blank"><b><span style="color: #274e13;">GitHub. </span></b></a></div> </div>

Stethoscope - An OpenSource, User Focused Security Tool By NetFlix

Stethoscope is a web-based tool that gives Netflix employees a view into the security state of their devices, with specific recommendat...

Read more »