Scanning Tool Tutorials
legion tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
legion introduction
Legion is the successor the the python 2 tool called sparta. It is an open source tool that has a GUI and help network penetration testing. it can be used for the following;
- OSINT
- Network mapping
- Scanning and reconnaissance with tools like namp, nikto and several others
- Automated scanning
- IPS evasion
- Detecting CVEs
- Linking CVEs to exploits from exploit DB
installing legion on kali
sudo apt install legion -y
Modern versions of kali linux should have this tool already installed but you can install it if it is not on your system. As mentioned, it is a replacement for sparta.
running legion on kali
legion
This will start the tool. A GUI window will open that looks like the one shown in the figure below.
From the window that opens, go to the left side of the screen under the "hosts" section and click where it says "Click here to add hosts(s) to scope".
This will open a new windows where we can input different parameters for our scan.
You can insert the IP address range for the network to scan. I selected "hard" mode for more options. I then enabled host discovery options and selected the "TCP SYN" scan. I then added nmap options for OS detection, ports scanning with service enumeration and no DNS lookup (-O -sV -n). You can then click on the submit button to begin the scan.
The scan will begin and the progress will be shown at the bottom of the window.
When the scan is done, you will see the results. From my results, I am able to see the hosts on my network. I can click on each IP address and view more specific information about each device on the right side highlighted with the red arrows. Navigate the options to see what services are running, any scripts, general information such as the OS, location and other, any CVE codes based on known vulnerabilities and much more. You can of course click on the "services" section rather than the "hosts" to see all the services across all the systems.
Here is an example of looking at the services running on one host.
The tool also has a brute force tool for connecting to a machine. You can supply the IP address of the target, the service name or port number and check some options. You can even include some username password combinations to try.
In summary, legion is a wonderful tool to use for a host discovery, port scanning, service enumeration, OS detection, vulnerability analysis and more.