Kali Linux terminal commands on router security
Router Cleanup & Hardening
All commands assume ethical use: **your own router/lab**, written permission for clients, or legal targets like scanme.nmap.org. Run as root (`sudo -i`) where needed.
### 1. Network Discovery & Device Mapping (Find the router + connected devices)
- Basic live host discovery:
```bash
sudo nmap -sn 192.168.0.0/24 # Replace with your subnet (Tenda often 192.168.0.0/24)
```
- Detailed ARP scan (great for local WiFi networks):
```bash
sudo arp-scan --localnet --interface=wlan0 # Or eth0 if wired
```
- Find router specifically:
```bash
ip route | grep default # Shows gateway IP (your router)
arp -a | grep -i "router\|tenda" # Look for Tenda MAC/vendor
```
### 2. Router-Specific Deep Scanning (Detect open ports, services, OS, vulns)
- Aggressive scan with vuln scripts (your go-to for before/after hardening proof):
```bash
sudo nmap -sS -sV -O -A --script vuln,router-http*,default,exploit -p- -T4 192.168.0.1 -oN tenda_full_scan.txt
```
- `-p-` = all 65k ports (slow but thorough)
- `--script vuln` = checks common router vulns
- Add `--reason` for why ports are open/closed
- Version + service detection only (faster):
```bash
sudo nmap -sV -sC 192.168.0.1
```
### 3. Vulnerability Scanning (Modern, fast alternative/complement to Nmap)
Install if needed: `sudo apt install nuclei`
- Scan for IoT/router-specific high/critical issues:
```bash
nuclei -u http://192.168.0.1 -t cves/ -t exposed-panels/ -t iot/ -t vulnerabilities/ -severity critical,high -o nuclei_tenda.txt
```
- Nuclei has templates for many Tenda CVEs (command injection, auth bypass, etc.)
### 4. Exploit Testing with Routersploit (Router-specific framework — huge for Tenda/Huawei/TP-Link)
Install if not present:
```bash
git clone https://github.com/threat9/routersploit
cd routersploit
sudo python3 -m pip install -r requirements.txt
```
Then run:
```bash
sudo python3 rsf.py
```
Inside rsf:
```
use scanners/autopwn
set target 192.168.0.1
run
```
- It auto-checks 100s of exploits (Misfortune Cookie, CVE injections common on Tenda).
- If vulnerable → demo to client: "This is how botnets like Mirai infect routers."
- Then fix (firmware + disable telnet/remote) and re-run to show clean.
### 5. Malware/Botnet Indicators on Router
- Check for open Telnet (classic Mirai entry):
```bash
sudo nmap -p 23,2323 --script telnet-ntlm-info,telnet-brute 192.168.0.1
```
- Capture suspicious traffic (C2 callbacks, unusual DNS):
```bash
sudo tcpdump -i any port 23 or port 2323 or port 53 -c 500 -w suspicious.pcap
# Then analyze: wireshark suspicious.pcap (or strings | grep http)
```
- If you can log into router via SSH/telnet (after enabling temporarily for audit):
```bash
ps aux | grep -E 'busybox|telnet|wget|curl|http'
netstat -tuln # Look for odd listening ports
```
### 6. Wi-Fi Security Checks (Show clients weak WiFi risks)
- Monitor nearby networks + clients:
```bash
sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon
```
- Targeted capture for handshake (WPA2/3 demo — only your network!):
```bash
sudo airodump-ng -c [channel] --bssid [your_BSSID] -w capture wlan0mon
```
### 7. Hardening Verification & Reporting
- Quick post-fix port check:
```bash
sudo nmap -Pn -sS -p 1-10000 192.168.0.1 # Should show almost nothing exposed
```
- One-liner report generator:
```bash
echo "Router Audit - $(date)" > report.txt
cat tenda_full_scan.txt nuclei_tenda.txt >> report.txt
echo "✅ Hardened: Remote mgmt off, WPA3, no open telnet, firmware updated." >> report.txt
```
### Motivation Boosters (Feel like a pro)
Run these for that "white-hat" rush:
- Fancy system info splash:
```bash
neofetch --ascii_distro kali
```
- Matrix rain while scanning:
```bash
cmatrix -u 9 # Press q to quit
```
- Hollywood-style fake terminal drama (fun for client demos):
```bash
hollywood
```
Practice sequence on your Tenda:
1. `sudo arp-scan --localnet`
2. `sudo nmap -A 192.168.0.1`
3. `nuclei ...` (if installed)
4. Routersploit autopwn
5. Fix issues → re-scan → see clean output
Paste any command output here (e.g., nmap results or nuclei findings), and I'll help interpret exactly what it means for security + how to explain/fix it for a client. Or tell me which area you want deeper (e.g., "more on wireless attacks" or "Metasploit router modules") — let's level you up! 🔒💻
Comments
Post a Comment