______ __ ______ __ __ __ __ _____ __ __ __
| __ \.-----.--| |______| __ \.---.-.| |--.| |--.|__| |_ ______| \.-----.----.--.--.--------.-----.-----.| |_.---.-.| |_|__|.-----.-----.
| <| -__| _ |______| <| _ || _ || _ || | _|______| -- | _ | __| | | | -__| || _| _ || _| || _ | |
|___|__||_____|_____| |___|__||___._||_____||_____||__|____| |_____/|_____|____|_____|__|__|__|_____|__|__||____|___._||____|__||_____|__|__|
The next few sections will be dedicated to the red rabbit documentation, the sections will be disected by module, eg: (0x0001 is module search) it goes from there
from the list above. Another example of how modules will be seperated is by the cloumn number in the chart above where Brute is the second module name, its section will
be labeled 0x0002 - BRUTE -, please take your time going through the documentation ALOT of people often forget about documentation then come to the devs confused as to
why some dont work, or how the script works and how to use it, so please, when i mean read it i mean READ IT CAREFULLY!
Section 0x0012 will be talking about all 4 ping commands that
can be used for host recon, simply all these do is check which
host is alive using different methods, however the one in here
will need extra descriptions
the reason there are different packets that can be used such as
UDP, TCP, ICMP is because some hosts respond or are reported alive
fatster than others when using different packet methods
NOTE: when running any ping command before you run red rabbit
you must specify -z or --CIDR or the defualt scan will be
[+] RR6> LOG: Settings: CONF -> 192.168.1.8/24
> ping icmp
Ping icmp is a command that will send out ICMP
based packets and ping all hosts on the network
trying to find out which host is alive, for every
host alive a table row will be added looking like
the following after each report
an example of using 10.0.0.1/24 as a range
from a reported beta tester
___COL_______HOST_________STATE____BOOL__
Address -> 10.0.0.1 | Alive | TRUE |
Address -> 10.0.0.15 | Alive | TRUE |
Address -> 10.0.0.16 | Alive | TRUE |
Address -> 10.0.0.17 | Alive | TRUE |
Address -> 10.0.0.18 | Alive | TRUE |
Address -> 10.0.0.10 | Alive | TRUE |
Address -> 10.0.0.20 | Alive | TRUE |
Address -> 10.0.0.21 | Alive | TRUE |
Address -> 10.0.0.59 | Alive | TRUE |
Address -> 10.0.0.114 | Alive | TRUE |
Address -> 10.0.0.213 | Alive | TRUE |
Address -> 10.0.0.214 | Alive | TRUE |
Address -> 10.0.0.254 | Alive | TRUE |
Address -> 10.0.0.96 | Alive | TRUE |
Address -> 10.0.0.155 | Alive | TRUE |
Address -> 10.0.0.207 | Alive | TRUE |
-----------------------------------------
> ping udp
Ping tcp is a command that will send out TCP
based packets and ping all hosts on the network
trying to find out which host is alive, for every
host alive a table row will be added looking like
the following after each report
an example of using 10.0.0.1/24 as a range
from a reported beta tester
___COL_______HOST_________STATE____BOOL__
Address -> 10.0.0.1 | Alive | TRUE |
Address -> 10.0.0.15 | Alive | TRUE |
Address -> 10.0.0.16 | Alive | TRUE |
Address -> 10.0.0.17 | Alive | TRUE |
Address -> 10.0.0.18 | Alive | TRUE |
Address -> 10.0.0.20 | Alive | TRUE |
Address -> 10.0.0.21 | Alive | TRUE |
Address -> 10.0.0.114 | Alive | TRUE |
Address -> 10.0.0.96 | Alive | TRUE |
Address -> 10.0.0.207 | Alive | TRUE |
Address -> 10.0.0.213 | Alive | TRUE |
Address -> 10.0.0.214 | Alive | TRUE |
Address -> 10.0.0.254 | Alive | TRUE |
Address -> 10.0.0.155 | Alive | TRUE |
Address -> 10.0.0.192 | Alive | TRUE |
-----------------------------------------
> ping udp
Ping udp is a command that will send out UDP
based packets and ping all hosts on the network
trying to find out which host is alive, for every
host alive a table row will be added looking like
the following after each report
an example of using 10.0.0.1/24 as a range
from a reported beta tester
___COL_______HOST_________STATE____BOOL__
Address -> 10.0.0.15 | Alive | TRUE |
Address -> 10.0.0.16 | Alive | TRUE |
Address -> 10.0.0.17 | Alive | TRUE |
Address -> 10.0.0.18 | Alive | TRUE |
Address -> 10.0.0.20 | Alive | TRUE |
Address -> 10.0.0.21 | Alive | TRUE |
Address -> 10.0.0.114 | Alive | TRUE |
Address -> 10.0.0.96 | Alive | TRUE |
Address -> 10.0.0.207 | Alive | TRUE |
Address -> 10.0.0.213 | Alive | TRUE |
Address -> 10.0.0.214 | Alive | TRUE |
Address -> 10.0.0.254 | Alive | TRUE |
Address -> 10.0.0.155 | Alive | TRUE |
Address -> 10.0.0.6 | Alive | TRUE |
-----------------------------------------
> ping arp
this one is a bit different from all ping commands.
The reason being is it has a few features, one being
it sends its own custom packets and waits for replys,
another being it starts on individual threads and
captures responses through each channel and reports it.
The feature that makes this one different from every other
feature in this list isnt the fact that it doesnt stop until you
say it can stop but it will trace the OUI of each mac it finds
on each IP
take the following example
IPA: 10.0.0.16 MAC: ff:ff:ff:ff:ff:ff OUI: [Raspberry Pi Trading Ltd]
IPA: 10.0.0.1 MAC: ff:ff:ff:ff:ff:ff OUI: [ARRIS Group, Inc.]
IPA: 10.0.0.215 MAC: ff:ff:ff:ff:ff:ff OUI: [ASUSTek COMPUTER INC.]
IPA: 10.0.0.16 MAC: ff:ff:ff:ff:ff:ff OUI: [Raspberry Pi Trading Ltd]
IPA: 10.0.0.96 MAC: ff:ff:ff:ff:ff:ff OUI: [Apple, Inc.]
IPA: 10.0.0.109 MAC: ff:ff:ff:ff:ff:ff OUI: [Amazon Technologies Inc.]
IPA: 10.0.0.207 MAC: ff:ff:ff:ff:ff:ff OUI: [AzureWave Technology Inc.]