______ __ ______ __ __ __ __ _____ __ __ __
| __ \.-----.--| |______| __ \.---.-.| |--.| |--.|__| |_ ______| \.-----.----.--.--.--------.-----.-----.| |_.---.-.| |_|__|.-----.-----.
| <| -__| _ |______| <| _ || _ || _ || | _|______| -- | _ | __| | | | -__| || _| _ || _| || _ | |
|___|__||_____|_____| |___|__||___._||_____||_____||__|____| |_____/|_____|____|_____|__|__|__|_____|__|__||____|___._||____|__||_____|__|__|
The next few sections will be dedicated to the red rabbit documentation, the sections will be disected by module, eg: (0x0001 is module search) it goes from there
from the list above. Another example of how modules will be seperated is by the cloumn number in the chart above where Brute is the second module name, its section will
be labeled 0x0002 - BRUTE -, please take your time going through the documentation ALOT of people often forget about documentation then come to the devs confused as to
why some dont work, or how the script works and how to use it, so please, when i mean read it i mean READ IT CAREFULLY!
this section mainly will be talking about the 802.11 scripts in red rabbit
which involes alot of sniffing, and system recon for interfaces and addresses
and running the ping section, i decided to include the ping section here
cause alot of it revolves around 802.11 recon.
<<<<<<<<<<<<<< SECTION IS UNFINISHED
> sniff interfaces
this is a simple command, it will just
grab all your interfaces on your system
and output them to the terminal, giving you
the interface name, and the address name
this is going to be used later on in ping arp
not that you will have to manually input the
range and address but this shows what the arp
utiltity will see and use in a sense of host
discovery.
example output
RR6> Net Module: Found Device | lo | Addr: 127.0.0.1/8
RR6> Net Module: Found Device | lo | Addr: ::1/128
RR6> Net Module: Found Device | enp5s0 | Addr: 10.0.0.213/24
RR6> Net Module: Found Device | enp5s0 | Addr: 10.0.0.214/24
RR6> Net Module: Found Device | enp5s0 | Addr: 2601:589:8
RR6> Net Module: Found Device | enp5s0 | Addr: 2601:589:8
RR6> Net Module: Found Device | enp5s0 | Addr: 2601:589
RR6> Net Module: Found Device | enp5s0 | Addr: fe80::3e2
RR6> Net Module: Found Device | enp10s0 | Addr: 10.0
RR6> Net Module: Found Device | enp10s0 | Addr: 10.
RR6> Net Module: Found Device | enp10s0 | Addr: 2601:589:8001
RR6> Net Module: Found Device | enp10s0 | Addr: 2601:589:800
RR6> Net Module: Found Device | enp10s0 | Addr: fe80::de1d:
RR6> Net Module: Found Device | wlan0 | Addr: 0.0.0.0/24
RR6> Net Module: Found Device | wlan0 | Addr: 0.0.0.0/24
RR6> Net Module: Found Device | wlan0 | Addr: 2601:589
RR6> Net Module: Found Device | wlan0 | Addr: 2601:589:8
RR6> Net Module: Found Device | wlan0 | Addr: 2601:589:8001:b
RR6> Net Module: Found Device | wlan0 | Addr: 2601:589:8001:
RR6> Net Module: Found Device | wlan0 | Addr: fe80::d
this is a formatted and pre generated output to protect the
device information and beta users info.
> sniff iface info
This command does exactly what it is named
it will ask the user to input a device name
such as wlan0 and then grab all information
on that device like the following output
********************************************
* All information for interface [ wlan0 ] *
********************************************
INTERFACE > | wlan0 | < INTERFACE DATA > | UP|BROADCAST|MULTICAST | < MTU > | 0000 |
ETHERNET ADDRESS -> ff:ff:ff:ff:ff
NET TYPE > ip+net
NETWORK > | 0.0.0.0
NETWORK ADDRESS > | 0.0.0.21
NETWORK MASK > | ff000000
NETWORK SCOPE > | global unicast
it will do this for every range on the address or
network type it can find on that named interface
> sniff iface info *
as i have specified in this documentation server
before the `*` in red rabbit usually means all like
in SQL when you specify a query like `SELECT * FROM dbname`
that means that this command will do the same as above but
for every interface it finds on the system it will output information
based on that interface it found
example output
********************************************
* All information for interface [ lo ] *
********************************************
INTERFACE > | lo | INTERFACE DATA > | UP|LOOPBACK | MTU > | 65536 |
NET TYPE > ip+net
NETWORK > | 127.0.0.0
NETWORK ADDRESS > | 127.0.0.1
NETWORK MASK > | ff000000
NETWORK SCOPE > | loopback
NET TYPE > ip+net
NETWORK > | ::1
NETWORK ADDRESS > | ::1
NETWORK MASK > | nil>
NETWORK SCOPE > | loopback
********************************************
* All information for interface [ enp5s0 ] *
********************************************
INTERFACE > | enp5s0 | INTERFACE DATA > | UP|BROADCAST|MULTICAST | MTU > | 1500 |
ETHERNET ADDRESS -> 88:c9:b3:b0:5f:bc
NET TYPE > ip+net
NETWORK > | 10.0.0.0
NETWORK ADDRESS > | 10.0.0.213
NETWORK MASK > | ff000000
NETWORK SCOPE > | global unicast
> sniff tcp
command allows you to view and sniff all incoming TCP
packets, the following information is given about the packet
packet layers
packet decoded layers
source mac
source address
recieving address
[etc...]
you can like all packets customize the
BPF (Berkly Packet Filter) here is an example
output of the settings
Enter an interface to use >>>> enp5s0
[+] Init Setting: {Interface} -> enp5s0
[-] Would you like to use a BPF (Berkly Packet Filter) (y/n)>>>> y
Enter a filter ex (tcp and port 80):>>>> tcp and port 80
> sniff d
Command will allow you to view and sniff all incoming
IP layered packets coming through on a given interface
> sniff dhcp
Command allows you to sniff all DHCP packets of all possible
types of DHCP packets, there is no specification yet for this
however it will tell you which version the packet or DHCP request is
its base layer, its payload, its mac, its src mac, its dst mac, its
src IP, dst IP, packet time etc
____________________________________________NEW DHCP PACKET_____________________________________________________________
| Packet (DHCP) Packet Number |-> 12502
| Packet (DHCP) Base Layer |-> {32:ff:ff:ff:ff:ff�Sc52��� }
| Packet (DHCP) Client HW Address |-> ff:ff:ff:ff:ff:ff
| Packet (DHCP) Client OUI HW Addr |-> No manufacturer found
| Packet (DHCP) Client OUI HW Addr |->
| Packet (DHCP) Client IP Address |-> 0.0.0.0
| Packet (DHCP) Your Client IPA |-> 0.0.0.0
| Packet (DHCP) Hardware Length |-> 6
| Packet (DHCP) Hardware Options |-> 0
| Packet (DHCP) Hardware Type |-> Ethernet
| Packet (DHCP) Next Server IP |-> 0.0.0.0
| Packet (DHCP) Operation |-> Request
| Packet (DHCP) Options |-> [Option(MessageType:Discover), Option(RequestIP:192.168.1.1)]
| Packet (DHCP) Relay Agent IP |-> 0.0.0.0
| Packet (DHCP) Secs |-> 0
| Packet (DHCP) Server name |->
| Packet (DHCP) XID |-> 0
| Packet (DHCP) Contents |-> fF:ff:ff:ff:ff:ff�Sc52���
| Packet (DHCP) Files |->
| Packet (DHCP) Flags |-> 0
| Packet (Layer) |-> Ethernet
| Packet (Layer) |-> IPv4
| Packet (Layer) |-> UDP
| Packet (Layer) |-> DHCPv4
| User Information |-> Packet output disabled not outputting packet
> sniff application
This command will allow you to sniff any and all application
layered packets that come across on your interface. This setting
can become very VERY messy in terms of output and most text yet
has had functions in it to decode this despite some of it still
being visible and somewhat readable. Here is an example using that option
---------------------------------------------- NEW PACKET (IPA Version 6) ----------------------------------------------------------
| Packet (IP Version 6) Version |-> 6
| Packet (IP Version 6) Traffic Class |-> 0
| Packet (IP Version 6) Source IPA |-> ffff::ffff:ffff:ffff:7168
| Packet (IP Version 6) Destination IPA |-> ff02::fb
| Packet (IP Version 6) Next Header |-> UDP
| Packet (IP Version 6) Length |-> 367
| Packet (IP Version 6) Hop Limit |-> 1
| Packet (IP Version 6) Hop by Hop |-> nil
| Packet (IP Version 6) Flow Label |-> 319831
� Packet (IP Version 6) Base Layer |-> {`�Wo����Èqh�� ��o�
_oculusal_sp_tcplocal
�8imperialfffffff::DESKTOP-5A972DI
_oculusal_sp_tcplocalimperialffffff::DESKTOP-fffff
_oculusal_sp_tcplocal!x�|DESKTOP-5fff2DIlocal�g�DESKTOP-fffffDIloca
a bit wack but it is still useable
> sniff ethernet
Sniffing ethernet will sniff all ethernet headed packets coming in
on your interface, like all other packet capture options you are allowed
to sniff via filter. use the following example as output
| Packet Source Mac |-> ff:ff:ff:ff:ff:ff
| Packet Destination Mac |-> ff:ff:ff:ff:ff:ff
| Packet Ether Type |-> IPv4
| Packet Length |-> 0
| Packet (Layer) |-> Ethernet
| Packet (Layer) |-> IPv4
| Packet (Layer) |-> UDP
| Packet (Layer) |-> Payload
| User Information |-> Packet output disabled not outputting packet
> sniff ssid
this is apart of the 802.11 networking and parsing modules for red rabbit.
In order to properly run this module or any of the following commands
[sniff ssid, sniff probe, sniff 802raw, sniff discovery]
then your interface will need to be in monitor, to do that use the
start cus interface.
this command opens a table on a given wifi card like the following
`wlan0mon`