Network Reconnaissance & Server Exploitation

When an Android device joins a network, it’s often trusted. This module teaches you to weaponize that trust. We move beyond standard port scanning to focus on practical, high-impact attacks that can be launched efficiently from an Android device. You’ll learn to map internal networks, relay credentials, exploit network services, and use the phone as a covert proxy to route your attacks, all while maintaining a low profile.

 

What You Will Learn

Part 1: The Android-Centric Attack Methodology

• Understanding the Mobile Adversary’s Advantage: Stealth, inherent trust, and persistent network presence.

• Mobile-Optimized Toolchains: Curating a toolkit that works effectively on ARM architecture without heavy dependencies.

• Bypassing Network Restrictions: Using tools like Corrupt (Termux) for packet crafting and bypassing captive portals.

Part 2: Stealthy Network Reconnaissance from Android

• Living Off the Land & Passive Recon:

  • Using netstat and /proc/net/tcp to map active connections from the device itself.

  • Analyzing ARP tables and network routes to discover subnets and gateways.

• Active Scanning with Mobile Efficiency:

  • Using nmap (Termux) for targeted, slow scans to avoid detection.

  • Ping Sweeps & Port Knocking: Identifying live hosts and triggering open ports.

  • Service Fingerprinting: Lightweight banner grabbing with netcat and simple scripts.

Part 3: Exploiting Network Trust Relationships

• LLMNR/NBT-NS Poisoning with Responder:

  • Capturing and relaying hashes from Windows machines on the local network.

  • Cracking NetNTLMv1/v2 hashes offline or relaying them for direct access.

• ARP Spoofing & MITM from Android:

  • Using BetterCAP on Android to poison the ARP table of the local gateway and target devices.

  • Intercepting unencrypted traffic and credentials (FTP, Telnet, HTTP auth).

• Exploiting mDNS and SSDP: Discovering additional services and devices (printers, IoT) that are often less secure.

Part 4: Server & Service Exploitation

• Web Application Attacks:

  • Using cURL and custom scripts for manual SQL Injection and XSS testing.

  • Mobile-Optimized SQLi: Using sqlmap with minimal threads and verbosity for stealth.

  • Uploading Web Shells: Gaining a foothold on web servers via file upload vulnerabilities.

• Credential Stuffing & Spraying:

  • Building wordlists from device data and using tools like Hydra for targeted attacks on SSH, FTP, and web logins.

• Exploiting Common Services:

  • SMB: Using smbclient to enumerate and access misconfigured shares.

  • Redis & Memcached: Exploiting unauthenticated in-memory databases for code execution.

  • Jenkins/Docker APIs: Attacking misconfigured development and orchestration services.

Part 5: Pivoting and Persistence

• Setting Up a Mobile Relay:

  • Using ssh with Dynamic SOCKS Proxy (-D flag) to create a secure tunnel from your Kali machine through the compromised Android device.

  • Configuring proxychains on your main machine to route all traffic through the phone.

• Port Forwarding & Redirection: Using adb reverse and socat to expose internal services to your attack machine.

• Maintaining Network Access: Installing persistent backdoors on compromised internal servers to ensure continued access, even if the Android device is lost.

Hands-On Lab: The Internal Breach
You will execute a full attack chain from an Android device:

1. Recon: Use nmap from Termux to perform a stealth scan of the local network, identifying a Windows machine and a web server.

2. Credential Harvesting: Run Responder to poison LLMNR requests, capturing a user’s NTLMv2 hash when they mistype a share.

3. Cracking & Access: Crack the hash offline using hashcat on your main machine, then use the credentials to access the Windows SMB share from the Android device.

4. Pivoting: Establish a SOCKS proxy from your Kali machine through the Android device using SSH, allowing you to directly attack the internal web server as if you were on the local network.

5. Exploitation: Use your Kali machine (through the pivot) to run a full sqlmap scan and exploit a SQL injection vulnerability on the internal web server, uploading a web shell.

Key Takeaways:
By the end of this module, you will be able to:

• Use an Android device as an effective pivot point into an internal corporate network.

• Perform stealthy reconnaissance and exploit network protocol weaknesses (LLMNR, ARP) from a mobile platform.

• Conduct credentialed attacks and exploit common misconfigured services from Android.

• Establish persistent tunnels to route attacks from your main machine through the compromised mobile device.

• Understand the unique offensive capabilities and limitations of using Android for network intrusion.