if you're scanning websites for
vulnerabilities kali linux comes full of
useful tools for doing so but
unfortunately you normally need full
computer in order to take advantage of
this instead we'll show you how you can
use any unrooted android phone to scan
for web application vulnerabilities on
this episode left cyberweapons lab
[Music]
[Applause]
[Music]
it's relatively common for websites and
web applications to have a number of
vulnerabilities that make them easy to
attack hackers and penetration testers
know this so one of the first steps that
usually do is scanning a web application
or a URL for vulnerabilities now the
easiest way to do this is with Kali
Linux because it comes pre-installed
with a number of these awesome tools but
if you don't have access to a full Kali
system you can use an Android phone
instead and it doesn't even need to be
rooted now following the excellent guide
written by distortion on null bite we
can install Kali Linux on an Android
phone however a lot of these tools don't
exactly work because they require a full
root so we're going to use something
that actually works pretty well on an
Android phone in order to scan for web
vulnerabilities now we're going to be
using rapid scan which is a really
awesome tool that runs pretty well but
in order to download all the libraries
you're going to need a strong data
connection because it took us almost 45
minutes to download everything required
once you have an unrooted Android phone
and internet access so that you can
download all the libraries then we can
begin so the first step in getting
started with this is to refer to the
last guide on null bite if you haven't
already for how to turn an Android phone
into a hacking device without root
everything we do is going to rely on you
having already install this and you can
see our video is already up so go ahead
and take a look at this article and
watch the video if you haven't already
gotten Kali Linux on userland up on your
Android phone now if you have then I
recommend you check out this new article
because that's what we're going to be
basing everything on today and the list
of things we need to install in order to
satisfy the rapid scan dependencies is
quite extensive now you can see there's
only one real first command which is
just su so that we're rude and then all
of a sudden we get all this stuff so to
kind of track to the side here this is a
lot of things but this is a long list of
stuff so this is really where you're
going to spend a lot of time and you can
see this is the first result our sorry
this is the first step now actually what
you're going to what
do is update first because I ran this
and it's straight up did not work so
first you're going to run an update then
we're gonna run this very long list of
libraries and tools that this program
needs in order to work and then we'll
actually move on to the github
repository of what we're going to be
installing but first let's take a quick
look at what we're installing on our
phone today so we're going to install
what Web DNS recon and map laughs woof
I'm not going to just kind of read these
all off but basically these are various
ways that you know what nmap is it says
port scanner DNS recon and pulls up DNS
reconnaissance information about DNS
servers that know about that particular
web address or maybe they have their own
DNS server there's load balancers the
harvester for finding email addresses
Demetri Nick Doe which is a
vulnerability scanner in and of itself
will be using different modules of it
and then a DNS map so all these tools
again take a lot of time to load so make
sure you dedicate tons of time to being
able to sit here and spend on a good
data connection at least 45 minutes
waiting for this to download so let's go
ahead and if we've got user land set up
in our last guide we can switch to our
android phone here and I'm going to open
up user land and we'll be connecting via
SSH now as you can see there's all these
great options here and we're going to
select cally and then it should be set
up from our previous video guide on
setting up Kali on this particular phone
so we'll have a SSH password to put in
and I'm going to go ahead and put in my
super secret password
and press okay in order to login now as
you can see we are all the way logged in
so that's great so that means that we
can go ahead and type su so that we're
in the right directory and we don't need
to constantly sudo things and we'll need
to also run an update so if you skip
this step then basically nothing we'll
be able to find the correct repository
because it will have moved or updated or
the name will have changed so it's
really important to run this step first
so just by typing a apt update you
should be able to grab all the new
locations for every single one of the
libraries you're about to request
because otherwise most of them will go
ahead and fail so that means that you
can waste a lot of time trying to figure
out where they go but in this case we're
now updated and we can go ahead and
proceed to install the really long list
of things on the article so we're going
to in this case go apt install and I'm
gonna just do one screen and this will
of course not install anything because I
already have all of these because I
spent the time but in the case of you
entering every single one of them like
you're supposed to we'll probably take
around 45 minutes this can take even
longer if you're on a slow connection so
as soon as it's done downloading it has
to install which can take also some time
if you are on a slower phone so two
things fast connection and fast phone if
you have a slow connection any slow
phone expect this to maybe even take two
hours so just be aware of that before
you get started on this if you have to
go somewhere and you're on a Wi-Fi
connection it can be really painful to
have to disconnect now assuming that you
get all this downloaded it's time to go
ahead and use the tool that we're going
to use which is called rapid scan so to
do this we're going to do a git clone
and that's going to go ahead and clone
the entire repository to our Android
phone so we'll type git clone
and then HTTP then colon slash slash
github.com and then we're going to do /s
ka v ng R then another splash and rapid
scan now you can see the destination
path already exists on my system but on
your system it'll go ahead and download
so we can type LS to see the new
directory and then CD rapid scan and
I'll use tab to autocomplete alright now
we're in the right directory but we
still have some work to do so the Python
file is not currently executable so we
can do that by typing chmod plus x and
then rapid scan up high
okay cool so now we can actually do this
so here is where we need to make sure we
also have screen installed because if we
get disconnected for any reason this
session can just go and run it's lonely
self out and you won't be able to access
it again because you'll get disconnected
you'll start a new SSH session and this
will just be running somewhere on the
system without any intervention and that
really sucks so let's type screen
and return and now we should be able to
rejoin the session if we get
disconnected for any reason so all right
let's go ahead and run this on a target
now we're going to use our favorite
punching bag price I'm calm because
they're awful so we'll type Python then
dot slash rapid scan dot hi and then
we'll use Priceline calm now I'm gonna
press return and let's see if it works
awesome there we go
now the way this will work is if we want
to completely just end this process
totally we can press ctrl-z at any time
now doing so will basically make any
results we find just go away so we won't
have any rapport whatsoever it'll never
get to that step so if we do discover
something along the way it'll all be
lost now there's an alternative to this
and this will probably be practical on
our unrooted system because some of
these tools might get stuck and that is
pressing ctrl C which will just skip the
particular scan but won't get the
overall process and there are 80
different scans that this will run so
skipping a scan that's running slow or
just not completing is actually just
fine because that might be necessary in
order to get through it in a reasonable
period of time now in spite of this most
of these actually don't need to be
skipped through so if you have a strong
data connection you can see we've
already found a vulnerability in about
one second but this is priceline.com
we're talking about so that's not
exactly for surprising so I'm gonna let
this run a little bit and I will skip
through a lot of these different things
that we're not waiting here for you know
maybe 30 minutes or something we want to
keep this video short but in general all
these will dig up a lot of interesting
information that a hacker could use to
formulate a plan of action against a
particular target now if this starts to
hang again just press ctrl C and I'll do
an injection here or a example here on
this injection scan and you can see it
just skipped that particular scan and
move right on to the next one where
we're at 10 of 80 so I'll let the scan
and we'll see exactly what crops up but
keep in mind again this is on any
Android phone so this could be you know
some really slow old Android phone
that's still able to do all these
awesome
Kali Linux scans without needing to be
rooted so let's let this run for a bit
and see what we find
alright here we've also found that
there's a cross-site scripting which is
a high vulnerability so it looks like
we've already managed to find a couple
things that could lead to a plan of
action for somebody who wants to hack
this website or maybe go a little bit
deeper into a attack
all right there we go that was a bit of
a long scan and I ended up skipping
nearly all of the modules but you can
see that we actually found a number of
vulnerabilities now this is important
because again we just did this on an
Android device so being able to find a
number of existing vulnerabilities on a
popular website is pretty powerful on an
Android phone now we can type ls' and
see that there's a vulnerability report
directory which we can use to view the
vulnerability log if we want to dig into
more details now the fact that we found
for vulnerabilities isn't exactly
surprising from a company that left me
stranded in the middle of the desert but
you should be advised that we can
probably find vulnerabilities on a lot
of different websites using only an
Android phone and userland
to create a callaloo Mnet's instance
that's pretty easy to use tools like
this particular vulnerability scanner so
if you want to go ahead and find
vulnerabilities you should check out
rapid scan on any Android device when
you're working with an unrooted Android
phone it's worth keeping in mind that
you don't have full route access while
rapid scan is a really good tool to use
on an Android phone because you can
simply cancel out of any commands that
don't work
some tools may not exit this gracefully
so you might end up with something that
you try that ends up just getting stuck
now in this event it's a really good
idea to master screen if you're going to
be using Kali Linux on an android device
because if you get disconnected you can
get really frustrated connecting back to
basically nothing and finding that all
your work is running in some
disconnected session you have no access
to screen allows you to be disconnected
and then jump back into the session you
were already in making this whole thing
a lot more appealing if you don't want
to get disconnected constantly and lose
your work that's all we have for this
episode of cyberweapons lab make sure to
check out the article written by
distortion because it breaks down all
these steps really well if you need some
more details and you can find that
article on the no bite linked in the
description and if you have any ideas
for the upcoming episodes we're shooting
or if you have any comments send me a
message on Twitter because they'd love
to hear from you we'll see you next time