Nmap

Network Mapper, commonly used as Nmap, is a free and open-source tool for Network and Port scanning. It is also proficient in many other active information gathering techniques. Nmap is by far the most widely used information-gathering tool used by penetration-testers. It is a CLI based tool, but it also has a GUI based version in the market named Zenmap. It was once a “Unix Only” tool but now supports many other operating systems such as Windows, FreeBSD, OpenBSD, Sun Solaris, and many others. Nmap comes pre-installed in penetration testing distros like Kali Linux and Parrot OS. It can also be installed on other Operating Systems. To do so, seek Nmap here.

Figure 1.1 shows you a normal scan and results. The scan revealed the open ports 902 and 8080. Figure 1.2 shows you a simple service scan, which tells what service is running on the port. Figure 1.3 shows a default script scan. These scripts sometimes reveal interesting information that can be further used in the lateral parts of a pen-test. For more options, type nmap in the terminal, and it will show you the version, usage, and all other options available.

Fig 1.1: Simple Nmap scan

Fig 1.2: Nmap service/version scan

Fig 1.3: Default script scan

Tcpdump

Tcpdump is a free data-network packet analyzer that works on the CLI interface. It allows users to see, read, or capture network traffic being transmitted over a network that is attached to the computer. Originally written in 1988 by four workers at Lawrence Berkely Laboratory Network Research Group, it was organized in 1999 by Michael Richardson and Bill Fenner, who created www.tcpdump.org. It works on all Unix-like operating systems (Linux, Solaris, All BSDs, macOS, SunSolaris, etc). The windows version of Tcpdump is called WinDump and uses WinPcap, the windows alternative for libpcap.

To install tcpdump:

Usage:

For options detail :

Wireshark

Wireshark is an immensely interactive network traffic analyzer. One can dump and analyze packets as they are received. Originally developed by Gerald Combs in 1998 as Ethereal, it was renamed Wireshark in 2006 due to trademark issues. Wireshark also offers different filters so the user can specify what type of traffic to be shown or dumped for later analysis. Wireshark can be downloaded from www.wireshark.org/#download. It is available on most of the common Operating Systems (Windows, Linux, macOS), and comes pre-installed in most penetration distros like Kali Linux and Parrot OS.

Wireshark is a powerful tool and needs a good understanding of basic networking. It converts the traffic into a format that humans can easily read. It can help the users troubleshoot latency problems, dropped packets, or even hacking attempts against your organization. Moreover, it supports up to two thousand network protocols. One may not be able to use all of them as common traffic consists of UDP, TCP, DNS, and ICMP packets.

Amap

Application Mapper (also amap), as the name may suggest, is a tool to map applications on open ports on a device. It is a next generation tool that can discover applications and processes even when they are not running on their conventional ports. For example, if a web server is running on port 1337 instead of the standard port 80, amap can discover this. Amap comes with two prominent modules. First, amapcrap can send mock data to ports to generate some kind of response from the target port, which can later be used for further analysis. Second, amap has the core module, which is the Application Mapper (amap).

Amap usage:

Fig 4.1 Sample amap scan

p0f

p0f is the short form for “passive OS fingerprinting” (A zero is used instead of an O). It is a passive scanner that can identify systems remotely. p0f uses fingerprint techniques to analyze TCP/IP packets and in order to determine different configurations including the operating system of the host. It has the ability to perform this process passively without generating any suspicious traffic. p0f can also read pcap files.

Usage:

Fig 5.1 Sample p0f output
The host has to either connect to your network (spontaneously or induced) or be connected to some entity on your network by some standard means (web browsing, etc.) The host can accept or refuse the connection. This method is able to see through packet firewalls and is not bound by the restrictions of an active fingerprinting. Passive OS fingerprinting is mainly used for attacker profiling, visitor profiling, customer/user profiling, penetration testing, etc.

Cessation

Reconnaissance or Information Gathering is the first step in any penetration test. It is an essential part of the process. Starting a penetration test without a decent recon is like going to a war without knowing where and who you are fighting. As always, there is a world of amazing recon tools apart from the ones above. All thanks to an amazing open-source and cybersecurity community!

Happy Recon!

Sanitization of inputs is the process of cleansing of the inputs, so the data inserted is not used to find or exploit security holes in a website or server.

Vulnerable sites are either unsanitized or very poorly and incompletely sanitized. It is an indirect attack. The payload is indirectly sent to the victim. The malicious code is inserted on the website by the attacker, and then it becomes a part of it. Whenever the user (victim) visits the webpage, the malicious code is moved to the browser. Hence, the user is unaware of anything happening.

With XSS, an attacker can:

• Manipulate, destroy, or even deface a website.
• Expose sensitive user data
• Capture user’s authenticated session cookies
• Upload a Phishing page
• Redirect users to a malicious area

XSS has been in the OWASP Top Ten for the last decade. More than 75% of the surface web is vulnerable to XSS.

There are 4 types of XSS:

• Stored XSS
• Reflected XSS
• DOM-based XSS
• Blind XSS

When checking for XSS in a pentest, one may get weary of finding the injection. Most pentesters use XSS Tools to get the job done. Automating the process not only saves time and effort but, more importantly, gives accurate results.

Today we will discuss some of the tools which are free and helpful. We will also discuss how to install and use them.

XSSer:

XSSer or cross-site scripter is an automatic framework that helps users find and exploit XSS vulnerabilities on websites. It has a pre-installed library of around 1300 vulnerabilities, which helps bypass many WAFs.

Let’s see how we can use it to find XSS vulnerabilities!

Installation:

We need to clone xsser from the following GitHub repo.

Now, xsser is in our system. Traverse into the xsser folder and run setup.py

It will install any dependencies, which already been installed and will install xsser. Now it’s time to run it.

Run GUI:

A window like this would appear:

If you are a beginner, go through the wizard. If you are a pro, I will recommend configuring XSSer to your own needs through the configure tab.

Run in Terminal:

Here is a site that challenges you to exploit XSS. We will find a few vulnerabilities by using xsser. We give the target URL to xsser, and it will start checking for vulnerabilities.

Once it is done, results are saved in a file. Here is an XSSreport.raw. You can always come back to see which of the payloads worked. Since this was a beginner level challenge, most of the vulnerabilities are FOUND here.

XSSniper:

Cross-Site Sniper, also known as XSSniper, is another xss discovery tool with mass scanning functionalities. It scans the target for GET parameters and then injects an XSS payload into them.

Its ability to crawl the target URL for relative links is deemed as another useful feature. Every link found is added to the scan queue and processed, so it is easier to test an entire website.

In the end, this method is not foolproof, but it’s a good heuristic to mass find injection points and test escape strategies. Also, since there is no browser emulation, you have to manually test the discovered injections against various browser’s xss protections.

To install XSSniper:

XSStrike:

This cross-site scripting detection tool is equipped with:

• 4 hand-written parsers
• an intelligent payload generator
• a powerful fuzzing engine
• an incredibly fast crawler

It deals with both reflected and DOM XSS Scanning.

Installation:

Usage:

Optional arguments:

Single URL scan:

Crawling example:

XSS Hunter:

It is a recently launched framework in this field of XSS vulnerabilities, with the perks of easy management, organization & monitorization. It generally works by keeping specific logs through HTML files of web pages. To find any type of cross-site scripting vulnerabilities, including the blind XSS (which is, generally, often missed) as an advantage over common XSS tools.

Installation:

Configuration:

– run the configuration script as:

– now start the API as

To use GUI server, you need to follow and execute these commands:

W3af:

Another open-source vulnerability testing tool which mainly uses JS to test specific webpages for vulnerabilities. The major requirement is configuring the tool according to your demand. Once done, it will efficiently do its work and identify XSS vulnerabilities. It is a plugin-based toolwhich is mainly divided into three sections:

• Core (for basic functioning and providing libraries for plugins)
• UI
• Plugins

Installation:

To install w3af onto your Linux system, just follow-through the steps below:

Clone the GitHub repo.

Install the version you want to use.

>If you like to use the GUI version:

If you prefer to use the console version:

Both of them will require installing dependencies if not already installed.

A script is created at /tmp/script.sh, which will install all the dependencies for you.

The GUI version of w3af is given as follows:

Meanwhile, the console version is the traditional terminal (CLI)-look tool.

Usage

1. Configure target

In target, menu run command set target TARGET_URL.

2. Config audit profile

W3af comes with some profile that already has properly configured plugins to run an audit. To use profile, run command, use PROFILE_NAME.

3. Config plugin

4. Config HTTP

5. Run audit

For more information, go to http://w3af.org/:

Cessation:

These tools are just a drop in the ocean as the internet is full of amazing tools. Tools like Burp and webscarab can also be used to detect XSS. Also, hats-off to the wonderful open-source community, which comes up with exciting solutions for every new and unique problem. ]]> https://linuxhint.com/parrotos_interview_nong_hoang_tu_gmknght/ Thu, 15 Oct 2020 19:20:34 +0000 https://linuxhint.com/?p=71732 Parrot OS was initially released on 10th April 2013. It has now grown to become one of the most popular penetration testing distros in the arena.

So, we asked the Parrot Dev Team some interesting questions and got some interesting answers. Here’s what NONG HOANG Tu, aka @dmknght, ​one of the developers, had to say:

How would you respond to “Kali vs Parrot” debate? How is Parrot better?

“Kali is Debian testing based distro + pentest tools are maintained by their developers. It was not designed for daily OS.

Parrot is Debian testing based distro + custom tools are developed by us + default configurations for environments + pentest tools are forked from Kali repo. So:

In the pentesting section:

Both distros are the same. (have the same toolkit)

Parrot has a home edition which is focused on privacy. We have pre-installed toolkit like anonsurf, mat2 (a tool that removes metadata from files), …

Parrot never wanted users to run the system as root. Kali has changed their login method from 2020.

Parrot has default configurations for a friendly environment: a default firefox profile with add-ons that protect users’ privacy, very useful and friendly to pannels, customized bashrc, … Kali just added their default zshrc (2020.3?) and well it looks… you know…

Performance:

This is a “myth”: some articles on the internet say Parrot has better runtime performance than Kali. well… This depends on Desktop Environment that the system is using. If you compare Gnome3 vs Mate, ofc mate is the winner *smile*. Since 2020, Kali provides their default customized XFCE DE so the comparison is not true anymore. I would like to see if there is any comparison of Kali XFCE and Parrot XFCE.

Undercover mode:

Our team agreed that was a theme changing only. Ofc Kali did a good job by creating a script for the XFCE environment. If you want something like that from Parrot in future. I’m sure we don’t do that. Try finding some Easter Eggs in our system. *Mona Lisa smile* Team:

The core team of Parrot now is having only 5 members. And we have to manage everything: servers, mirrors (there are many mirrors are maintained by volunteers, not our team. Big thanks to them), community, development.

More about tools:

We want to have a complete new pentesting / forensic toolkit and it has been a year but we couldn’t complete it because of human resource problem. A little secret: I’ve completed a solution for maintaining so many pentest tools for such a small team like Parrot so we can have a big update for the security section in the next few months.

We are researching a newer solution based on docker and sandbox. The scope is to protect users in both security edition and home edition.

We are researching our application firewall and malware scanner to provide users from known malicious activities (Well don’t expect it too much. A small team with some contributors is like dreamers. But I’m sure it can be better than chrootkit or rootkit hunter for checking real malware in your system and it can solve some critical problems of ClamAV).

So is Parrot better?

“There is nothing “wrong” or “worse”. But life can be a lot easier”

(A member in Nim programming language channel.) It is true. Well, in life, sometimes you have to hear the blame when bugs are made by a different team. *smile*

PS: Oh does Kali still use Perl script to do the “launcher update” after install/uninstall any applications using apt?

Well, if yes then we have a better thing *smile*: we have used a launcher updater that was written in Nim lang which has a rocket speed. We had a golang version before but nim version has a smaller binary size and faster runtime performance. Maybe many users didn’t notice it. Try it (4.10 vs 4.5 for example)”

Some people view ParrotOS as a distro for ScriptKiddies and Noobs, What would you say about it?

“Myth:

• This error is on Parrot ONLYYYYYY… Parrot suxxxx
• Kali is for Pro, Parrot is for noobs
• Parrot is more friendly so it is for noob ( ?? ?? )
• Parrot is a modded version of Kali (Lmao)

Answer:

• Any error on Debian affects Parrot AND Debian testing based distros.
• Any error on Kali (about pentesting tools only) could be on Parrot.
• Are you (to everybody) sure any answer like “parrot is for noob” is not from a noob??
• “Both have the same toolkit, so what is the problem?” –

Egg82.​ He is a very good guy with good security knowledge.”

(More and More people seem to convert to Parrot, nowadays. Ippse​ c also uses​    Parrot for his videos.)

“1 more thing: if you watch DEFCON, Hacktivity, you can see many security experts use Ubuntu, Windows (We call it winblows *laugh*), MacOS. Does anybody dare apply “For noob” on them?”

“Is Parrot OS Bloatware”?

“Yes and no. Parrot is made for a ready to use OS. Do you want to use the office suite? No? Well, but other users might use it. It is the same for everything else. And that means we have to deal with the size-limit of iso file and so many problems. I personally use keepassxc a lot but it was removed from default pre-installed list.

My tip: I’m using an encrypted USB that saves keepassxc data and I bring it with me. Try to secure your passwords by strong randomly password; always change and secure it. Have a good backup is also needed.

Security tools: It is forked from Kali and I’m sure the point is having enough tools for most common pentesting scenarios.”

Despite so much hype of privacy around the world, many people don’t know or use software like Anonsurf. What do you think could be the reason?

“Marketing problem? Herd behaviour (Well I’m using a translator for this word )? For example, if you are talking about being anonymous, ofc many people think about whonix and tail. Well, I’m no expert in this section but I’m sure AnonSurf can covert the network connection problem. Many users still think AnonSurf can’t do that as good as Tail or Whonix.  The job: redirects everything to the Tor network. So…?”

According to you, is 100% anonymity possible?

“Nothing is 100% but stop using Facebook and p*rnhub might be a good solution. *laugh*

My story: I live in a different city and I’m visiting home. A strange phone number called me “I’m sim provider from THIS city. Do you want to upgrade your sim?”. Well, it is a simple example of how I was being tracked by GSM and a sim card. Maybe your laptop’s privacy protection is good but are you sure it is the same for your other devices?”

I’d like to sincerely thank Parrot Dev Team and Nong Hoang Tu for the time he spared us. I hope this enables people to understand the depths of a distro and not promote hysterical myths. (Parrot is a modded version of Kali).

Happy Reading

ParrotSec has provided the answer to the question in the form of a program called Anonsurf – “Dance like no one’s watching.”

Anonsurf is a script made by the development team at ParrotSec, which included Lorenzo Faletra (@palinuro), Lisetta Ferrero (@sheireen) and Francesco Bonanno (@mibofra), and that is maintained by Nong Hoang Tu (@dmknght). This script was made to provide users with system-wide anonymization. In simpler words, anything you do while you have Anonsurf started on your system would be nearly untraceable. Anonsurf not only routes all your traffic through Tor, but it also lets you start i2p services and clear any traces left on the user disk. Anonsurf also kills away all dangerous applications by virtue of the Pandora bomb, so you do not need to worry about having a Tor browser and other scripts running to hide your system. The best part is that all this is contained in a simple start/stop function.

Anonsurf uses Tor IPTables for the configuration of IP packet filter rules. While Tor provides a browser solution, Anonsurf is capable of much more.

If the above paragraphs do not make sense to you yet, do not panic. It is very easy to use Anonsurf and we are here to guide you through to anonymity.

Anonsurf was also made available for Kali Linux, though the pictures in this article were taken on Parrot OS.

This article will show you how to run Anonsurf’s Anon Mode.

Step 1. Clone

You can clone Anonsurf and other integrated repos from GitHub using the command below. This repo was forked from ParrotSec. Und3rf10w has made some improvisations, like using DNS servers of Private Internet access. Plus, it already contains the Pandora package.

It will normally take a few moments to get this module downloaded, depending upon your internet connection. The following screen should appear after the download is complete:

Step 2. Install

First, find the downloaded folder “kali-anonsurf.”

Give the installer execute permissions.

Run the installer with ./installer.sh.

This adds keys, updates, and installs anonsurf for you.

The installation process can take a few minutes, after which you should be able to go completely anonymous with a single command. To check whether the installation is successful, enter the following command:

The following screen will appear if you have correctly gone through the installation process:

Step 3. Go Anonymous

Now that you have a working Anonsurf module, the following simple commands will help get you started.

• start starts the anon mode
• stop finishes the anon session
• restart combines “stop” and “start” options
• start-bridge starts system-wide Tor tunnel with Obfs4 bridge support
• changeid     restarts Tor to change identity
• enable-boot enables Anonsurf at boot
  • Also by $ systemctl enable anonsurf
• disable-boot disables Anonsurf at boot
  • Also by $ systemctl disable anonsurf
• status checks whether Anonsurf is working properly
  • Uses the Nyx application to display information about Tor service, bandwidth, nodes, etc.
• myip checks your IP and verifies your Tor connection
• dns replaces your DNS with the OpenNIC DNS servers.

Run the following command from the terminal to launch a secure Tor channel to direct your traffic, which will change your IP every five to ten minutes

Yes, it is that simple. Be sure that you are running this command as the root user or using the sudo prefix. However, if you are a Parrot OS user, you can simply select the ‘start service’ option to anonymize your browsing immediately.

The program may prompt for a restart of various applications to clean out dangerous caches.

To check your IP at any given time, enter the following command:

To check the status of the module, enter the following command:

Nyx shows us information about the Tor service, bandwidth, and other information, such as nodes, average speed, etc.

A simple stop command ends the session and wipes clean any traces.

It is as simple as that!

Cessation

The use of VPNs and TOR will help you spoof or hide your IP address. Scripts like MAC changer allow users to spoof their Mac, too. The use of such tools in conjunction could bring you to your own optimized solution. The inclusion of i2p services in the tool covers both the circuit-based routing of Tor and the packet-based routing of i2p. Plus, these functions run in the background, so even if you kill the terminal, the sessions will continue. Anonsurf anonymizes the framework to a very good extent but does not give you a total incognito state.

However, there are a few weaknesses to Anonsurf, as well. As it follows the Tor protocols for routing and is encrypted by each hop, Anonsurf makes browsing a comparatively slower option than VPNs. It all depends on whether you prioritize anonymity or speed. Moreover, Anonsurf does not work in some countries, such as Egypt. People have been using solutions like Tor, Proxy-chains, and VPNs for some time, now. Still, no other tool is more complete of a solution than Aanonsurf.

There is no such thing as complete anonymization or a 100% secure channel yet, as there is no tool that is both easy to use and manage and fully secure. As you may have noticed, you do not have to be a professional to be able to use Anonsurf. This tool will work the same wonders for a beginner as for a professional.

You may have heard people say, “Privacy matters.” It sure does on the Internet!

Disclaimer

Anonsurf uses Tor services that may be deemed illegal to use in your country. Please keep up with your country’s laws and avoid doing anything that is illegal or not allowed. This article is for educational purposes only, and hence it is the responsibility of the reader to be responsible, use the information for lawful purposes, and avoid using the program for anything that may be harmful to them or others.

While SQL Injection can be dangerous, executing different commands by web page input to perform SQLi can be a very hectic job. From gathering data to developing the right payload can be a very time-taking and sometimes frustrating job. This is where the tools come into play. There are numerous tools available for testing and exploiting different types of SQL Injections. We will discuss some of the best ones.

Havij:

Havij (which means carrot in Persian) is a tool by ITSecTeam, an Iranian security company. It is a GUI enabled, fully automated SQLi tool and supports a variety of SQLi techniques. It was developed to assist penetration testers in finding vulnerabilities on web pages. It is a user-friendly tool and includes advanced features also, so its good for both beginners and professionals. Havij also has a Pro version. The exciting thing about Havij is the 95% successful injection rate on vulnerable targets. Havij is only made for windows but one can use wine to make it work on Linux. Though ITSecTeam’s official site has been down for a long time, Havij and Havij Pro are available on many websites and GitHub Repos.

BBQSQL:

BBQSQL known as ‘Blind SQL’ injection framework helps you to address issues when the available exploitation tools don’t work. Written in python, it is a sort of semi-automatic tool which allows customization to some extent for any complex SQL injection findings. BBQSQL asks several questions in a menu-driven approach and then creates the injection/attack according to the user’s response. It is a very versatile tool with built-in UI to make its usage easier. And the use of python gevent makes it pretty fast. It provides information regarding Cookies, Files, HTTP Auth, Proxies, URL, HTTP Method, Headers, Encoding methods, Redirects behavior, etc. The pre-usage requirements include setting up parameters, options, then configure the attack as required. The tool’s configuration can be changed to use either a frequency or a binary search technique. It can also determine if the SQL injection worked by just looking for some specific values in the HTTP responses from the application. An Error message is displayed by the database which complains about the incorrect syntax of SQL Query if the attacker successfully exploits SQL Injection. The only difference between Blind SQL and normal SQL injection is the way the data is being retrieved from the database.

Install BBQSQL:

Leviathan:

The word Leviathan refers to a sea creature, sea devil, or sea monster. The tool is so named due to its attacking feature. The tool was first launched at Black Hat USA 2017 Arsenal. It is a framework that consists of many open source tools including masscan, ncrack, DSSS, etc to perform different actions including SQLi, custom exploit, etc. The tools can be used in combination too. It is commonly used for penetration testing tasks, like discovering machines and identifying the vulnerable ones, enumerating services working on these devices, and finding attack possibilities through attack simulation. It can identify vulnerabilities in Telnet, SSH, RDP, MYSQL, and FTP. Leviathan is highly proficient in checking SQL vulnerabilities on URLs. The basic objective of the Leviathan tool is to perform massive scans on many systems at once. The proficiency of checking for SQL vulnerabilities makes leviathan. The dependencies required to use Leviathan Framework are bs4, shodan, google-API-python-client, lxml, paramiko, requests.

Install Leviathan:

WhiteWidow:

Whitewidow is a commonly used tool for vulnerability scanning in application security and penetration testing. Most people interested in this tool are pen-testers and security professionals. Whitewidow is also open-source and is an automated SQL vulnerability scanner that can use a file list or Google to scrape potentially vulnerable websites. The prime objective of this tool was learning and to tell users what vulnerability looks like. WhiteWidow requires some dependencies to work, such as: mechanize, nokogiri, rest-client, webmock, rspec, and vcr. It is developed in a ruby programming language. Thousands of carefully researched queries are used to scrape Google for finding vulnerabilities in different websites. When you Launch Whitewidow, it will start checking for vulnerable sites straightaway. They can be later exploited manually.

Install WhiteWidow:

jSQL Injection:

jSQL is a java-based automatic SQL Injection tool, hence the name jSQL.
It is FOSS and is cross-platform compatible. It is assembled using libraries like Hibernate, Spock, and Spring. jSQL Injection supports 23 different databases including Access, MySQL, SQL Server, Oracle, PostgreSQL, SQLite, Teradata, Firebird, Ingris, and many more. jSQL Injection is placed on GitHub and uses platform Travis CI for continuous integration. It checks for multiple injection strategies: Normal, Error, Blind, and Time. It has other features such as searching for administration pages, brute-force of password hash, creation and visualization of Web shell and SQL shell, etc. jSQL Injection can also read or write files.
jSQL injection is available in Operating Systems like Kali, Parrot OS, Pentest Box, BlackArch Linux, and other pen-testing distros.

Install jSQL:

SQLmap

SQLmap is an automated tool written in python that automatically checks for SQL vulnerabilities, exploits them, and takes over database servers. It is free and open-source software and is probably the most commonly used tool for pen-testing SQLi vulnerable targets. It is free and open-source software with an amazingly powerful detection engine. Created by Daniele Bellucci in 2006, it was later developed and promoted by Bernardo Damele. The most notable step in development for sqlmap was Black Hat Europe 2009, coming to the spotlight with all the media attention. SQLmap supports most types of Databases, SQL Injection techniques, and password cracking based on dictionary-based attacks. It can also be used to edit/download/upload files in a database. Meterpreter’s (Metasploit) getsystem command is used for Privilege Escalation. For ICMP tunneling, an impacket library is added. SQLmap provides retrieval of results using DNS recursive resolution much faster than time-based or boolean-based methods. SQL queries are used to trigger required DNS requests. SQLmap is supported by python 2.6,2.7 and python 3 onwards.
According to Ed Skoudis, a complete SQLmap attack depends on a 5-step model:

1. Reconnaissance
2. Scanning
3. Exploit
4. Keeping access
5. Covering tracks

Install SQLmap:

Or

Though this list is a compact one, it consists of the most popular tools that are used for detecting and exploiting SQLi. SQL Injection is a very common vulnerability and comes in a variety of shapes, so the tools are really helpful for the detection of these vulnerabilities and help a lot of penetration testers and script-kiddies do the job in a really easy way.

Happy Injecting!

Disclaimer: The above-written article is only for educational purposes. It is the user’s responsibility to not use the above-given tools on a target without permission.