Anonymous Operations
Skid Mark Tools
Do you want to help Anonymous with an Operation, but aren't a l33t h@x0r? Then this is the site for you! If you're a non-technical n00b....this might be too much. BUT if you have some basic technical skilz than you're likely a Skid (a.k.a - a Script Kiddie) and just need someone to give you some direction.
Too many times when an operation starts we get an influx of people who've decided they're going to "help". And then all they do is run nmap using the defaults. Many times when you hear of a company getting "DDoS'ed" in the news...its just bad architecture vs. a LOT of nmap scans.
Pro Tip: Thats not helpful and we end up with a lot of junk data. It also tips off the target that we are interested in them.
NOTE: This guide isn't a hand holding, spoon-fed guide to be a hacker. It assumes some basic technical skills and that you're willing to go do internet searches to get further information. The #skidmarks channel on the AnonOps IRC server focuses specifically on the tools listed here.
To be helpful AND useful to an operation there are a few things you need to do.
- OpSec, OpSec, OpSec - operational security is important. Read through this for more about OpSec -> https://anonymousplanet.org
- Create an email account to register various tools, Proton (https://proton.me) and Tuta (https://tuta.com) are good.
- Set up VirtualBox on your computer with Linux Mint as your "hacking" system (use your google-fu to find how-to's for this). Any linux will do but Mint is nice and this guide assumes Mint is the OS.
- Use a VPN. The ONLY free VPN you should consider is Proton. Otherwise, you need to use a known, non-loging, paid VPN service such as Mullvad, iVPN, Proton (the paid version), Mozilla, or CryptoStorm. The other option is to use Whonix (this is more complicated).
- Register an account on the websites listed below.
- Install the tools listed below.
- Read through this guide and the links thoroughly.
- Connect to irc.anonops.com via an IRC client and help on an Op!
The Op!
The first step of any Op is to gather information about the target. This is called Reconnaissance (recon) and you use OSINT (Open Source Intelligence) to do it. What this means is that we are going to passively look for data about the target.
There are two kinds of data gathering that you will want to do, passive and active. ALWAYS start with passive data gathering.
- Passive data collection - no touching the target
- Active data collection - touching the target
If you've followed the steps above, you should have VirtualBox setup, a VM of Linux Mint running (and updated), are using a VPN, and have setup an email account to use. If that's done, then proceed.
One thing to remember as you do recon...save the output as a JSON file, if possible, to make it easier to work with later.
Step 1 - Passive Collection
You will need to register with multiple sites to obtain an account for the passive data that we will need during an Op. Below is the list of sites that are commonly used for Op's. Using your Linux VM (which has the VPN installed, right?) go to these sites and register an account.
Passive Data Collection Sites -
Though some of these sites can be used without a registered account, it severely limits what you can access.
- Shodan (https://shodan.io)
- Censys (https://www.censys.io)
- BinaryEdge (https://app.binaryedge.io)
- URLScan (https://urlscan.io)
- CriminalIP (https://www.criminalip.io)
- Netlas (https://www.netlas.io)
These sites are also useful and do not require an account be set up before use.
- DNSdumpster (https://dnsdumpster.com)
- crt.sh (https://cert.sh)
- GrayhatWarfare (https://buckets.grayhatwarfare.com)
- CentralOps (https://centralops.net)
- DNSHistory (https://dnshistory.org)
Step 2 - Active Collection
Active collection means that you will use a tool to actively scan or probe the target to gather information. Yes, you can use nmap/masscan to get some information, but it can be noisey and the defaults don't work too well. I suggest taking a look at the basic scanning how-to at https://rentry.co/scanner-howto on how to run a scan with masscan in a way to more likely find open ports. You'll want to learn about doing scans slowly to prevent the security tools of the target from alerting.
Recently, the folks at Project Discovery have released a suite of tools that are very good (and FOSS!) that are preferred. They even have a tool that manages the suite of tools, the Open Source Tool Manager (https://github.com/projectdiscovery/pdtm). You will need to install Go first (they have directions for that) before you can install and use the tools.
Once you have the tools installed you can start actively scanning the targets.
Step 3 - Research
Once you've performed passive and active data collection...you need to review what you found. The types of things you want to look for are:
- mail servers
- VPN or other remote access
- web servers
- SCADA/IOT devices
- Conferencing/VoIP systems
- WebDAV
- Databases
Vulnerability Lookup
Hopefully the recon you did will reveal open ports and responses by the types of systems just listed. Even better is when those systems provide the software version. Using that information you can then search for possible exploits on the sites listed below. GitHub has a lot of Proof of Concept (PoC) exploit code.
- Sploitus (https://sploitus.com)
- Sploitify (https://sploitify.haxx.it)
- Exploit DB (https://www.exploit-db.com)
- GitHub (https://github.com)
Google Dorks
A Google Dork is using Google's search functionality to find interesting things. For example, you can specify a specific URL and look for files that might be of interest, such as "passwords.xlsx". For more info on dorking, take a look at these links:
- Google Hacking Database (https://www.exploit-db.com/google-hacking-database)
- Beginners Guide to Google Dorking (https://dorksearch.com/blog/beginners-guide-google-dorking)
- Google Dorking Cheatsheet (https://github.com/chr3st5an/Google-Dorking
Tool Links
Install How-To
We've written a quick and dirty installation guide to get you up and going - https://rentry.co/skidmark-tools-setup
References
Part 1 - https://blog.projectdiscovery.io/reconnaissance-a-deep-dive-in-active-passive-reconnaissance/
Part 2 - https://blog.projectdiscovery.io/recon-series-2/
Part 3 - https://blog.projectdiscovery.io/reconnaissance-series-3-host-and-port-discovery/
Part 4 - https://blog.projectdiscovery.io/reconnaissance-series-4/
Part 5 - https://blog.projectdiscovery.io/reconnaissance-series-5-additional-active-reconnaissance/
https://www.secjuice.com/finding-real-ips-of-origin-servers-behind-cloudflare-or-tor/
https://github.com/smicallef/spiderfoot
https://github.com/zidansec/CloudPeler
https://tracebit.com/blog/no-wildcard-how-i-discovered-the-organization-id-of-any-aws-account
https://github.com/HackShiv/OneDorkForAll/tree/main/dorks/1M_dork
https://github.com/jivoi/awesome-osint
https://github.com/CompassSecurity/Hacking_Tools_Cheat_Sheet
https://github.com/thehappydinoa/awesome-censys-queries
https://www.dionach.com/how-to-use-owasp-amass-an-extensive-tutorial/
https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS
https://github.com/owasp-amass/amass