______ __ ______ __ __ __ __ _____ __ __ __ | __ \.-----.--| |______| __ \.---.-.| |--.| |--.|__| |_ ______| \.-----.----.--.--.--------.-----.-----.| |_.---.-.| |_|__|.-----.-----. | <| -__| _ |______| <| _ || _ || _ || | _|______| -- | _ | __| | | | -__| || _| _ || _| || _ | | |___|__||_____|_____| |___|__||___._||_____||_____||__|____| |_____/|_____|____|_____|__|__|__|_____|__|__||____|___._||____|__||_____|__|__| The next few sections will be dedicated to the red rabbit documentation, the sections will be disected by module, eg: (0x0001 is module search) it goes from there from the list above. Another example of how modules will be seperated is by the cloumn number in the chart above where Brute is the second module name, its section will be labeled 0x0002 - BRUTE -, please take your time going through the documentation ALOT of people often forget about documentation then come to the devs confused as to why some dont work, or how the script works and how to use it, so please, when i mean read it i mean READ IT CAREFULLY!






0x0004 Interacting with databases, SSH, Generators, regex, and file utilities
This section talks specifically about the utilities, etc, ssh, db functions and utilities including things like shells, SSH test utilities, beta utilities, host blockers and more this section will kinda knock out multiple sections in a row instead of splitting them up, if they are in any relation to each other, an example being the utils blocker will include all 3 parts of that in one section, to simplify it and make the process go by faster
> utils blocker l, utils blocker s, utils blocker fix this blocker i have had for a while now, and it comes in handy from time to time whenever i need to make a private connection between a computer / node and a hostname, this blocker works by taking a url or url list as an input and writing to the etc/hosts file, and does it pretty quickly it will also make sure that the connection is terminated between you and the host or becomes private. using the command "utils blcoker l" you can input a list of hosts and block every host in that URL here is an example of what the output will look like using this command
[+] Setting: (IGNORE) | Wrote host to filename, host should NOT be reachable [+] Setting: (IGNORE) | Wrote host to filename, host should NOT be reachable [+] Setting: (IGNORE) | Wrote host to filename, host should NOT be reachable [ * ] DATA: HOST -> https://www.google.com:80 BLOCKED [ * ] DATA: HOST -> https://www.youtube.com:80 BLOCKED [ * ] DATA: HOST -> https://www.hulu.com:80 BLOCKED
this means that all hosts should not be accessible now utils blocker s does the same thing but with one host instead of a list given that our file usually can be annoying to work with, there is a function in red rabbit and a command named utils blocker fix which will reset the file back to normal based on templates. This command will find the path of the hosts file, delete the file, remake the filename hosts.txt then place the new data from the template that has been parsed into the file so our new file will look like this
RR6> OS MODULE: Was able to remove the filename, prepping to repair... RR6> OS MODULE: Remade filepath, going to repair file.... RR6> OS MODULE: 127.0.0.1 localhost definition repaired and remade.... RR6> OS MODULE: 127.0.0.1 node_host definition repaired and remade.... RR6> OS MODULE: Wrote -> ::1 localhost ip6-localhost ip6-loopback and finished.... RR6> OS MODULE: Wrote -> ff02::1 ip6-allnodes and finished.... RR6> OS MODULE: Wrote -> ff02::2 ip6-allrouters and finished.... ========================== REPAIRED FILE ============== 127.0.0.1 localhost 127.0.0.1 XE43P3X ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters

> utils verify | goes for any command that does verification There is not much to this, the reason i added this into the script was to make sure your hostnames, emails, and MAC's or other data would pass verification by red rabbit to be used in other attacks so if you wanted to make sure a hostname works or something like host:port would work in something like web recon or scanning you could use this the regex verification tools include verifying and checking that all of the following can be used in red rabbit without issues mac addresses email addresses IPv4 addresses IPv6 addresses Host:port formatted host addresses there is no output for this
> utils db | all commands that include database utilities This section here is specified to databases which are supported as the following : : PostGreSQL : MySQL : Mongo : Microsoft SQL there are a few commands set here and all of these are pretty much the same the first one in this is ping databasetype, ping will simply check if a database is alive on a given host, and that a port scanner did not give off a false positive or that it is not a honeypot and the service truly isnt up. The output will just be a true or false message, and the only way to use this is to enter the host / ip of the server. here is an example of using the ping utility to see if my local database is alive
[+] Setting: Pinging Host | 127.0.0.1 [+] Setting: Port | 5432 [+] Setting: Pinging host | 127.0.0.1:5432 [+] Information: Got a good ping on the host and dial, database is alive
the last command apart of the db section will be ` db auth databasetype` this will simply check if a verification in the server is correct, and if your configuration such as username and password and host are all correct this stands for simplicity really not for everyday usage this is also the reason it is set as an extra
> utils gen | this section also will talk about the utils build gmapl utility This is the section of basically all generation utilities, including generationg of images, generating links, generating maltego reports even building google maps links. first we will start with command -> utils gen rjpg this is experimental, and the point of this is to generate a random image with actuall data in it that you can use for stegonography if you do not have a JPEG image on hand this image will be randomized in color, almost like a capture of a static TV with random RGB bits everywhere, or on the top of the image, you can set the name to the image and that is about it right now, later on you will be able to generate your own images with your own settings, colors, pixle rates, etc.. second command we will talk about is -> utils gen map this is a second hand utility that you can use without having to find the GPS of a image, as we talked about in 0x0001 we talked about searching an image for GPS locations, and it will attempt to generate an image based on the LAT and LON of the direct location like a google maps image. Well if you want to you can do this yourself simply type utils gen JPG and you can use the lat and lon from really any data you find or output you have from any tool and generate an image
  • Image example here
  • third command we will be going over is going to be -> utils gen JPG This command will generate a image of a map based off of the geo lat and lon cords found in an image, JPG images. similar to the command above but with the geo cords in a JPEG image fourth command we will be going to talk about is -> gmapl this is quite simple, this tool allows you to generate a google maps link based on the lat and lon you input. fifth command in this list will be -> utils gen emailmail this command was set a bit weird but the simplist version and description of what this command does it take a URL and attempts to find all emails on the page, and then throws it into a maltego formatted output. the same thing goes for command `utils gen linkmail` instead of emailas it will crawl the page for URL's and parse that into a maltego like response / report here is an example of the output you will get from crawling a URL and formatting it into a maltego like report.
    MaltegoMessage> MaltegoTransformResponseMessage> Entities> Entity Type="maltego.Domain"> Value>https://www.iana.org/domains/example/Value> /Entities> /MaltegoTransformResponseMessage> /MaltegoMessage>

    > ssh | including all utils secure shell related > ssh check - The first command on list for this is ssh check this command simply checks to see if a SSH server on a given host is alive, simple and for this there is no intense or hyper output to go over > ssh transfer - second on the list is ssh transfer, this was ripped off from my old script and program named SSH-Sploit which used SCP to transfer files to a SSH hostname, simply just making the SSH posession process alot easier > ssh auth - third command on the SSH list is ssh auth this command will authenticate a ssh server based on your own configuration which requires a username and password > ssh auth key - fourth command on the SSH list is ssh auth key this command uses the ssh key directory to be authenticated with a username and password simple, and plain. > ssh auth config - fifth command on the SSH list is ssh auth config like many of the other config based options this will use a custom configuration files in YAML the path for this file is going to be in the /config/services/ssh path, if the file is not located or around then this file may be lost, if not please look in the same directory > ssh exec - sixth command on the SSH list is `ssh exec` this command allows you to sign onto a SSH server via password and username and capture the output of the command and report it back to the server > ssh dial config - seventh command on the SSH list is `ssh dial config` this command uses the same config file as set before but allows you to ping the SSH server / host and check to see if it is alive. if the server is alive the report would be a simple status message. > ssh check config - the eighth command on the SSH list is the `ssh check config` using the configuration file simply check if the SSH server is alive or not, if it is alive like above a simple stat message will keep alive. > ssh start shell - the final most useful command of all on the SSH listr will be `ssh start shell` this is a interactive SSH shell that will allow you to execute any command remotely this requires a private key and a username to be executed properly.