Flashlight is an automated information gathering tool that allows you to scan networks and gather information.
- -h, –help: It shows the information about using the Flashlight application.
- -p <ProjectName> or –project < ProjectName>: It sets project name with the name given. This parameter can be used to save different projects in different workspaces.
- -s <ScanType> or –scan_type < ScanType >: It sets the type of scans. There are four types of scans: Active Scan, Passive Scan, Screenshot Scan, and Filtering. These types of scans will be examined later in detail.
- -d < DestinationNetwork>, –destination < DestinationNetwork >: It sets the network or IP where the scan will be executed against.
- -c <FileName>, –config <FileName>: It specifies the configuration file. The scanning is realized according to the information in the configuration file.
- -u <NetworkInterface>, –interface < NetworkInterface>: It sets the network interface used during passive scanning.
- -f <PcapFile>, –pcap_file < PcapFile >: It sets cap File that will be filtered.
- -r <RasterizeFile>, –rasterize < RasterizeFile>: It sets the specific location of Rasterize JavaScript file which will be used for taking screenshots.
- -t <ThreadNumber>, –thread <Threadnember>: It sets the number of Threads. This parameter is valid only on screenshot scanning (screen scan) mode.
- -o <OutputDiectory>, –output < OutputDiectory >: It sets the directory in which the scan results can be saved. The scan results are saved in 3 sub-directories: For Nmap scanning results, “nmap” subdirectory, for PCAP files “pcap” subdirectory and for screenshots “screen” subdirectories are used. Scan results are saved in the directory, shown under the output directories by this parameter. If this option is not set, scan results are saved in the directory that Flashlight applications are running.
- -a, –alive: It performs ping scan to discover up IP addresses before the actual vulnerability scan. It is used for the active scan.
- -g <DefaultGateway>, –gateway < DefaultGateway >: It identifies the IP address of the gateway. If not set, interface with “-I” parameter is chosen.
- -l <LogFile>, –log < LogFile >: It specifies the log file to save the scan results. If not set, logs are saved in “flashlight.log” file in the working directory.
- -k <PassiveTimeout>, –passive_timeout <PassiveTimeout>: It specifies the timeout for sniffing in passive mode. Default value is 15 seconds. This parameter is used for the passive scan.
- -m, –mim: It is used to perform MITM attack.
- -n, –nmap-optimize: It is used to optimize nmap scan.
- -v, –verbose: It is used to list detailed information.
- -V, –version: It specifies the version of the program.
Installation
apt-get install nmap tshark tcpdump dsniff
- Passive Scan
./flashlight.py -s passive -p passive-pro-01 -i eth0 -o /root/Desktop/flashlight_test -l /root/Desktop/log –v
Directory structure of “flashlight_test” is like below. PCAP file is saved into “/root/Desktop/flashlight_test/output/passive-pro-01/pcap” directory. This PCAP file can be used for analysis purposes. ls /root/Desktop/flashlight_test -R
./flashlight.py -s passive -p passive-project-02 -i eth0 -g 192.168.74.2 -m -k 50 -v
By analyzing captured PCAP file HTTP traffic can be seen.
By decoding Basic Authentication message, credentials denoting access information for web servers will be accessed.
All parameters during passive scanning are listed below.
./flashlight.py -s passive -p passive-pro-03 -i eth0 -g 192.168.74.2 -m -k 50 -o /root/Desktop/flashlight_passive_full -l /root/Desktop/log -v
- Active Scan
- 21, 22, 23, 25, 80, 443, 445, 3128, 8080
udp_ports:
- 53, 161
scripts:
- http-enum
screen_ports:
- 80, 443, 8080, 8443
According to “flashlight.yaml” configuration file, the scan executes against “21, 22, 23, 25, 80, 443, 445, 3128, 8080” TCP ports, “53, 161” UDP ports, “http-enum” script by using NMAP.
Note: During active scan “screen_ports” option is useless. This option just works with screen scan.
“-a” option is useful to discover up hosts by sending ICMP packets. Beside this, incrementing thread number by using “-t” parameter increases scan speed.
./flashlight.py -p active-project -s active -d 192.168.74.0/24 –t 30 -a -v
The example commands that Flashlight Application runs can be given like so:
- Operating System Scan: /usr/bin/nmap -n -Pn -O -T5 -iL /tmp/”IPListFile” -oA /root/Desktop/flashlight/output/active-project/nmap/OsScan-“Date”
- Ping Scan: /usr/bin/nmap -n -sn -T5 -iL /tmp/”IPListFile” -oA /root/Desktop/flashlight/output/active-project/nmap/PingScan-“Date”
- Port Scan: /usr/bin/nmap -n -Pn -T5 –open -iL /tmp/”IPListFile” -sS -p T:21,22,23,25,80,443,445,3128,8080,U:53,161 -sU -oA /root/Desktop/flashlight/output/active-project/nmap/PortScan-“Date”
- Script Scan: /usr/bin/nmap -n -Pn -T5 -iL /tmp/”IPListFile” -sS -p T:21,22,23,25,80,443,445,3128,8080,U:53,161 -sU –script=default,http-enum -oA /root/Desktop/flashlight/output/active-project/nmap/ScriptScan-“Date”
To run an effective and optimized active scan, “-n” parameter can be used:
./flashlight.py -p active-project -s active -d 192.168.74.0/24 -n -a –v
“-n” parameter adds additional NMAP options which are shown below;
… -min-hostgroup 64 -min-parallelism 64 -host-timeout=300m -max-rtt-timeout=600ms -initial-rtt-timeout=300ms -min-rtt-timeout=300ms -max-retries=2 -min-rate=150 …
- Screen Scan
- 80, 443, 8080, 8443
Sample screen scan can be performed like this:
./flashlight.py -p project -s screen -d 192.168.74.0/24 -r /usr/local/rasterize.js -t 10 -v
- Filtering
./flashlight.py -p filter-project -s filter -f /root/Desktop/flashlight/output/passive-project-02/pcap/20150815072543.pcap -v
This option analyzes PCAP packets according to below properties:
- Windows hosts
- Top 10 DNS requests