Red Hawk: Comprehensive Information Gathering & Vulnerability Scanning in Kali Linux

Table of Contents#

1. Introduction to Red Hawk
2. Key Features of Red Hawk
3. Installation Guide
4. Basic Command Structure
5. Practical Usage Examples
   • Example 1: Domain Information Gathering
   • Example 2: Full Reconnaissance Scan
   • Example 3: Using a Proxy
6. Interpreting Scan Results
7. Best Practices for Effective Scanning
8. Limitations and Mitigations
9. Conclusion
10. References

Key Features of Red Hawk#

1. Multi-Engine Reconnaissance:

   • DNS record enumeration (A, MX, TXT, NS)
   • Subdomain discovery via Google, VirusTotal, Netcraft
   • WHOIS data retrieval
   • GeoIP location mapping
   • Web server fingerprinting (Server, WAF)

2. Vulnerability Detection:

   • Automated SQL Injection scanning (sqlmap integration)
   • Crawler-based XSS/LFI detection
   • Open port identification with service banners

3. Output Formats:

   • HTML reports (with visual graphs)
   • Text-based summaries
   • Scan logs for auditing

4. Third-Party API Integration:

   • Built-in support for VirusTotal, Shodan, and HaveIBeenPwned APIs

Installation Guide#

Red Hawk is not pre-installed on Kali Linux. To install:

# Clone the repository
git clone https://github.com/Tuhinshubhra/RED_HAWK
 
# Navigate to directory
cd RED_HAWK
 
# Install PHP dependencies
sudo apt install php php-curl php-xml
 
# Run the tool
php rhawk.php

Basic Command Structure#

php rhawk.php [Options] [Target]

Common Options:#

Practical Usage Examples#

Example 1: Domain Information Gathering#

Perform basic DNS/WAF/WHOIS lookup:

php rhawk.php -d example.com

Output includes:

• DNS records
• WHOIS registrant details
• Web Application Firewall (WAF) detection
• Open ports/services via Nmap

Example 2: Full Reconnaissance Scan#

Enable SQLi scanning and subdomain enumeration:

php rhawk.php -d example.com -s -r

This triggers:

1. Subdomain discovery with Sublist3r
2. SQLi tests on discovered URLs
3. Port scanning (top 1000 ports)
4. HTML report generation at results/example.com.html

Example 3: Using a Proxy#

Route traffic via Burp Suite:

php rhawk.php -d example.com -p 127.0.0.1:8080

Interpreting Scan Results#

Red Hawk generates structured reports in /results:

• WHOIS Data: Registrant names, emails, and expiry dates (potential for social engineering)
• Subdomains: Highlighted critical hosts (e.g., dev.example.com)
• SQLi Vulnerabilities:

  [SQLi] Parameter: id (POST)  
  Payload: admin' AND SLEEP(5)--  
  Status: VULNERABLE  

• WAF Detection:
  WAF: Cloudflare (Confirmed)
• Open Ports:

  PORT   STATE SERVICE   VERSION  
  80/tcp open  http      Apache 2.4.41

Best Practices for Effective Scanning#

1. Legal Compliance:

   • Obtain written permission before scanning ANY target.
   • Use localhost or authorized VPS environments for practice.

2. Scan Optimization:

   • Use -p with Burp Suite to debug false positives.
   • Limit scans to business hours for production systems.
   • Combine with -o (custom output directory) for organization.

3. False Positive Mitigation:

   • Manually verify SQLi/XSS findings with sqlmap or Burp Repeater.
   • Correlate port results with Nmap -sV for service validation.

4. API Integration:
   Add your VirusTotal API key in api.php to bypass rate limits:

   define('VT_API', 'your_api_key_here');

Limitations and Mitigations#

Conclusion#

Red Hawk provides a streamlined approach to reconnaissance and initial vulnerability scanning for Kali Linux users. While its consolidated outputs and ease of use make it ideal for quick audits, professionals should combine it with specialized tools like nmap, sqlmap, and Burp Suite for thorough engagements. Always adhere to ethical guidelines—unauthorized scanning is illegal.

References#

1. Official GitHub Repository
2. Kali Linux Tools Listing
3. MITRE ATT&CK Framework
4. OWASP Testing Guide
5. Shodan API Documentation