Python (How to create a Host Checker) Complete Guide

Hello. Today we are going to make a Python up/down host checker "How to Make a Python host checker for Linux" that works on Linux only.

You are going to need:

– Python 3.4

– Internet Connection

– Computer with Windows or Linux

If you haven't got installed Python yet, download it from the following link:

https://www.python.org/downloads/

You can find some of the Python basics in my first tutorial at http://www.hacking-tutorial.com/hacking-tutorial/code-your-first-simple-sql-injection-checking-vulnerability-with-python/

Why Linux only?

We never recommend using 3rd party libraries, but, without them you cant normally ping on Windows. Like, if you use ping command on Linux, you get 1 if the host is up, and other numbers if it is down. That means, on Linux, when the ping target is not pinged successfully, the ping returns 1 (operation completed successfully), in another case, it gives you the error number. On Windows, this is more complicated. If you ping with ping command, you get operation completed successfully, even if the host is up or down. Howewer, I don’t think any of you actually use Windows for hacking.

Setting up

Before starting, please connect to the internet, and if you would have another computers up, that would be pretty nice. Get your local IPv4 address, think what ports do you want to scan.

Coding How to Make a Python host checker for Linux

Coding is the easy part. Begin from importing sys and socket, then, write the following code:

import os # Importing main libs

import sys

start = "" # Setting up variables

range1 = 0

range2 = 0

 

for carg in sys.argv: # Checking for arguments

    if carg == "-s":

        argnum = sys.argv.index(carg)

        argnum += 1

        start = sys.argv[argnum]

    elif carg == "-r1":

        argnum = sys.argv.index(carg)

        argnum += 1

        range1r = sys.argv[argnum]

        range1 = int(range1r)

    elif carg == "-r2":

        argnum = sys.argv.index(carg)

        argnum += 1

        range2r = sys.argv[argnum]

        range2 = int(range2r)

 

print ("[*] Host Scanner launched!") # Informs user about initialize

 

if start == "": # Checks if all the information is provided

    print ("[E] No host provided")

elif range1 == 0:

    print ("[E] No range1 provided")

elif range2 == 0:

    print ("[E] No range2 provided")

else:

    if range1 > range2:

        count = range1 - range2

    elif range1 < range2:

        count = range2 - range1

    for ccount in range(range1, range2): # Counts the IP range to ping

            target = start + "." + str(ccount)

            response = os.system("ping " + target + " 2>&1 >/dev/null") # Sets response to ping

            if response == 0: # Reads response, checks if it is 0

                err = 0 # sets err to 0

            else:

                err = 1 # sets err to 1

            if err == 0: # when err is equal to 0

                print ("[+] " + target + " is up!") # Informs user about hosts that are up

Code should look like this (comments are cut, do not worry):

So, that is pretty easy. The end perimeters in th ping command supresses the commands output. So, save the file, run it from terminal and test this out!

Read More

DNS Addressing (How to on Windows)

Introduction

 

   Information

This tutorial is to guide you, the user, in changing your DNS address to (hopefully) a better alternative.OpenDNS, one of said alternatives, will be used as our main example but there are many others out there. Now while OpenDNS is great, it isn't for everyone: The best way to find the best one for you is to consult the link in the tutorial for a list of alternatives and choose the best (testing one yourself first hand here is key).

OpenDNS is a free, powerful, and easy to use DNS alternative best suited for people in the US and London areas.

Here is a direct quote from their site:

Quote:

OpenDNS is the leading provider of free security and infrastructure services that make the Internet safer through integrated Web content filtering, anti-phishing and DNS. OpenDNS services enable consumers and network administrators to secure their networks from online threats, reduce costs and enforce Internet-use policies. OpenDNS is used today by millions of users and organizations around the world.

Now the question that you may ask is how this may benefit you? Well the default DNS server provided by ISPs tend to be slower than OpenDNS because of promotional offers included in said servers or the ISP doesn't have a good quality server to begin with (would Verizon please stand up?). This means that by using OpenDNS not only will your surfing be generally faster but any promotional offers that said ISP might try to spam you with or any phishing attacks will be blocked. To summarize, OpenDNS provides an all around better web experience PLUS its free so why not give it a try? Now with all good stories there are two sides. With the advantages that I have described, there are disadvantages. Now while I could myself describe what these are, I felt that a fellow member by the name of Charles Kane did it better than I could have with his scenario given. Please read this quote given and all credit goes to him for this part:

Quote:

1. Anyone can use OpenDNS safely.
2. Free optional registration with OpenDNS enables the control panel which allows you to use preset content filtering, whitelisting and blacklisting of websites.
3. OpenDNS claims surfing speed and stability improvements. Speed may be enhanced with the centralized caching of internet addresses. The benefits of this claim should be weighed against your location (OpenDNS has 8 servers in the US and one in London with one planned for Hong Kong), the quality of your own ISPs caching, and particularly whether your ISP is using any particular servers to provide improved speeds in the seving of content.

As an example, for an Australian, the OpenDNS resolvers are at least 12 hops away (roughly 200ms) and the local server a maximum 4 hops (about 40ms) so the benefits may be reduced. Speed improvements for sites cached by your ISPs servers, especially common sites, are likely to be insignificant as network latency dominates DNS resolution time. The Pacific Ocean is the problem.

High quality ISPs (such as many of those in Australia), especially those that provide additional benefits such as Akamai delivered content delivered from servers within the local network will also be a major consideration. Akamai delivered content may be particularly important with streaming video and audio and big downloads (including Microsoft Download and Microsoft Update).

OpenDNS may give the greatest benefits if you are with a crappy ISP, relatively close to OpenDNS servers, if you want the benefits of their user control panel (filtering), or mainly access addresses unlikely to be cached by your ISP. OpenDNS server provision in North America makes OpenDNS particularly attractive for North American users.

Now to setup OpenDNS (or your other alternative) is rather easy and can be accomplished in less than a couple of minutes...

 

   Tip

You may also elect to sign up for an account at their website. It is also free and you will able to customize web site filtering and ad management....quite a handy control panel for your internet browsing experience (especially businesses that need content control).

 

   Tip

If you feel that OpenDNS is not for you than please consult this comprehensive list PortForward.com - Free Help Setting up Your Router or Firewall to find one near you! Just replace the numbers given here with the numbers given for your DNS server of choice from that page or anywhere else; these steps still apply.

Here's How:

1. Open the Control Panel.

2. Open up Network and Internet and go to the Network and Sharing Center.

3. Click on Change adapter settings on the left hand panel.

4. This will bring up a list of adapters present on your computer. Most people will have a Local Area Connection while laptop users will add a Wireless Network Connection and possibly a Bluetooth Network Connection...go ahead andright click on Local Area Connection and click on Properties.
NOTE: These steps do not change if you are modifying the Wireless Network Connection instead

5. If prompted by UAC, click on Yes.

6. Highlight Internet Protocol Version 4 (TCP/IPv4) and click on properties.

7. In the properties window you will see a few radio boxes with both of them saying Obtain an IP/DNS Address Automatically....we will leave the IP address alone and will change the Obtain DNS....to use the following:

In the Preferred DNS server boxes enter this sequence: 208.67.222.222

In the Alternate DNS server boxes enter this sequence: 208.67.220.220

8. Check the validate settings upon exit (Optional) check box, click OK, and then Close to finish. (See screenshot above)

9. Windows will check your settings (if you checked the option above) and you will be finished! Now start surfing to feel the effects of a quicker and more secure browsing experience!

   Tip

For more info on OpenDNS don't hesitate to ask here or visit their website at OpenDNS | Providing A Safer And Faster Internet

 

   Tip

If you happen to be managing a network under a router, this tip will save you some time. If you change therouter's DNS settings instead of each computer on the network than as long as each computer is set toObtain a DNS Address Automatically, your choice of a DNS server will be applied to all the computers. Please consult the manual of your router or their respective website to do this.

Hope it helps,

Read More

Kick User(s) Off From Wifi

WiFi Kill allows you to boot people off your WiFi connection. What you need:

• ROOTED Android Phone


• Android 2.1 or higher


• Target WiFi network


• WiFi Kill APK (download here: http://forum.ponury.net/viewtopic.php?f=12&t=10 )

1. Connect to the target WiFi network with your Android phone.


2. Open WiFi Kill app.


3. Click the ON button


4. The app will now scan the network for PC's


5. Press the check box next to any computer you want to boot off the internet, and their internet connection will no longer work until you uncheck it!

Tags:

Read More

Base64 (Complete Guide For Images Encryption)

Base64 and image files

For those who don’t know base64 it’s an encoding format for any data. In that case with the images we can simply say, that base64 equals to text (string) representation of the image itself. In most cases you’ve image tags with src attribute pointing to the http source of the image.

Overview of the problem

Let’s say we’ve a HTML document with 100 images into. That’s a rare case I agree, but sometimes it happens. You’ve to preload the thumbnails of an image gallery where only one image is displayed in a bigger size. As I mentioned before the progressive JPEG suits better for a large image but for the thumbnails you’ve to use baseline JPEGs.

Note: In fact the technique with base64 representation of the images is not well known. I think that’s because there are not so much examples with pages with more than 100 images.

But anyway. We’ve the HTML document with 100 images (100 <img> tags). That means directly 101 requests/responses from the server. In my tests on my localhost, which is supposed to be fast enough, that case loaded 2 MB with a simple small JPEG for the image, loaded 100 times, and approximately 3 seconds. Which yet again on the localhost is extreamly slow. The image is on my machine, the server is here… what else?

How to put the images inline?

The other way to do that is to put all you images in you HTML document. Than the first and more important rule for optimization (see more here), to make fewer requests is done. You now have only one request. And with the response you’ve all 100 images. That’s good when you’ve different images, cause every repeatable element in your CSS should be made with HTTP request once and than repeated with the CSS. In other way you risk the size of the document transfered in the web.

The results

The second case with the inline images and the only one request is giving me an average response time of 900ms. The size of the document is bigger, yes. I had 5KB for the HTML with no base64 images, and then the size increased to 45KB. That’s 9 times more. But however 45KB is nothing for the web, instead of all those 2 MB in the previous test.

How to make your images to strings?

Speaking in PHP terminology there is a function called base64_encode, which with a combination of file_get_contents(imagefile), make the files a base64 string.

Is there any issue?

Yes there is. First you cannot have your image files in a remote server, cause file_get_contents must read only from the local filesystem. Than if you process all those files before returning them to the client, where’s the point? You lose all that time you’ve spent with the technique.

The reasonable solution

I think this technique is good for cases like the one described at the beggining. You’ve a page with more than 100 images. Then you’ve the base64 representation already. Let say you have it in your database as string and don’t need to convert it everytime you return the image. That may happen on upload of the image and the image enters the database with its base64 representation, and it’s done.

Read More

Vulnerability Assessment (Short Guide)

Vulnerability assessment is a methodology that acknowledges and classifies the security bugs in a pc, network, or infrastructure.

Some type of automated scanning product is used to look at the ports and companies on a vary of IP addresses. Most of those merchandise can even check for the kind of working system and utility software program operating and the variations, patch ranges, consumer accounts, and companies which can be additionally operating.

These findings are matched up with related flaws within the product’s database. The remaining consequence is a giant assortment of reviews that current a record of every system’s flaws and corresponding countermeasures to lower the related risk. Essentially, the software states, “Here is a record of your bugs and right here is a record of issues it’s good to do to repair them.

The drawback with simply relying upon this outcomes is that it was generated by an automatic software that has a arduous time placing its findings into the right context of the given atmosphere

For instance, many of those instruments current an alert of “High” for vulnerabilities that don’t have a extremely possible risk related to them. The instruments additionally can not perceive how a small flaw can be utilized in a giant organized . Vulnerability evaluation is nice for recognizing the foundational security points inside an atmosphere, however many occasions, it takes an moral hacker to essentially check and qualify the extent of threat particular vulnerabilities pose.

Read More

Google dorks (Specific File(s))

Depends entirely on what you are looking for, here are some:

"favorite links" Keyword(s)

"favorite links"

"favorite sites" Keyword(s)

"favorite sites"

"Keyword(s) sites"

"Keyword(s) website"

"Keyword(s)"

"list * Keyword(s) * sites"

"list * Keyword(s)"

"list of Keyword(s) sites"

"list of Keyword(s)"

"recommended links" Keyword(s)

"recommended links"

"recommended sites" Keyword(s)

"recommended sites"

directory * Keyword(s)

intitle:directory "Keyword(s)"

inurl:directory "Keyword(s)"

Keyword(s)

Keyword(s) * directory

Keyword(s) catalog

Keyword(s) directory

Keyword(s) sites

Keyword(s) websites |Keyword(s)

Keyword(s) websites

Read More

Full-stack Web Developer (Complete Guide)

Summary: a full-stack web developer is someone who has honed skills in both front-end web design/development and back-end/server coding. You can count on a full-stack web developer to design, code, implement and maintain a fully functional modern interactive website on his/her own (not just a static website with a few pages).

Full-stack Web Developer

With the ever evolvement of the almighty World Wide Web, new job functions are created virtually every day. Just a few years ago, you only needed a web designer to create the visual design in Photoshop and/or Dreamweaver and a web developer to code the front-end/back-end scripts and the website was ready to go. At that time, websites were charged based on the number of “pages” (a concept borrowed from print design).

Fast forward to the present, we now have (not a exhaustive list) :

• visual designer


• web designer


• UI designer


• UX designer


• interaction designer


• art director


• front-end developer


• back-end developer


• web developer


• mobile developer


• database developer


• database administrator


• web master


• web server administrator


• SEO specialist


• web analyst


• web security professional


• quality assurance tester


• project manager


• growth hacker


• …

Several roles may be taken up by the same individual depending on the size of the company and the resources. Very large and profitable companies may gather experts from each field in their teams with a view to create the best-ever-possible web products of the world.

But normally, in the down-to-earth company, the web designer/developer distinction still applies. The web designer will be responsible for the visual/web/UI/UX/interaction design while the web developer will do the front-end coding/back-end coding/database administration/server setup/debugging/etc. However, problems always occur in areas when the two have to work together yet only either one takes responsible. Factors like miscommunications/false assumptions of job role and scope/misunderstanding of the technology/etc. will render the end product a subpar one.

This is where a full-stack web developer can fill the gap. A full-stack web developer masters the best of both worlds (or to a minimum understands both worlds). (S)He will be able to steer the web projects in the right direction utilizing the best practices and latest advancements in the technology. (S)He will design and code the whole web project themselves or supervise others to perform the tasks by overlooking the whole process from scratch to finish.

When websites and web applications become more and more interactive and sophisticated, understanding the technical capabilities of the systems and having an eye for artistic/usability judgement are critical to the success. So it is natural for web professionals to evolve to full-stack web developers in due course.

Designers will become more like programmers as programming becomes more like design.

However, designing and coding are two distinct skills that require different regions of the brain to master . The right brain is for visual and creativity and the left brain is for structure and organization. Designers are predominately right-brainers while coder left-brainers. So there is still only a handful of full-stack web developer on the market .

Benefits of Being a Full-Stack Web Developer

1. You can build a professional website from scratches for your employer.


2. You can be a competent member in cross-functional Agile teamswhere you can perform both front-end and back-end development. As Agile project management is fast becoming the norm for web application development and UI/UX is gaining in importance for the success or failure of any web application, you will be seen as a valuable team member contributing to the success of projects.


3. You can start your own website design and development business.


4. You can build your own websites and monetize them through Adsense, affiliate marketing, selling your own products and more. The best of this is the flexibility of earning extra money alongside your regular job. There are many great examples of web developers turning this business into a career and quitting their regular jobs.
   
   
   
   • as an example, you can utilize your knowledge in web development to help others to select the most suitable website hosting plan with an earning of US$85 per referral.
     
     
     
     • Click here to join the A2 Hosting affiliate program for free. For a limited time, you will get US$10 upon signing up (there is a earning threshold of US$100 (i.e. 2 referrals) before they will send you the money). You will need to have a website to be eligible for the program.
     
     
     • Don’t worry if you don’t have a website, you can get unlimited hosting for a monthly fee as low as US$3.89 (with use of coupon code: WHTPRIME, please activate the discount here and click “Web Hosting” on the menu bar).
     
     
     
     
   
   
   
   

Read More

URL Rewriting (Complete Guide)

Original URL:
Eg:http://example.com/followers.php?id=techyganga

Rewriting URL
Eg:http://example.com/9lessons/followers

.htaccess Code

RewriteEngine On

RewriteRule ^([a-zA-Z0-9_-]+)/\followers$ followers.php?id=$1

RewriteRule ^([a-zA-Z0-9_-]+)/\following$ following.php?id=$1

Read More

SigPloit Framework (What You Need To Know)WYNTK

SigPloit Framework – Telecom Vulnerability Testing for SS7, GTP (3G), Diameter(4G), and SIP Made Easy

 

SiGploit a signaling security testing framework dedicated to Telecom Security professionals and reasearchers to pentest and exploit vulnerabilites in the signaling protocols used in mobile operators regardless of the geneartion being in use.

What is SigPloit

As described on GitHub, SigPloit is a framework intended for telecom security specialists. Researchers can use SigPloit for penetration testing of telecom networks in order to find known vulnerabilities in signaling protocols.

The stated purpose of the framework is security testing of all existing protocols that are used in telecom operators’ infrastructure, including SS7, GTP (3G), Diameter (4G), and even SIP for IMS and VoLTE, which is used at the access level and for encapsulating SS7 messages in SIP-T. According to the documentation, SigPloit uses testing results to provide network-specific recommendations on how to improve security.

SiGploit is developed on several versions

Note: In order to test SS7 attacks, you need to have an SS7 access or you can test in the virtual lab with the provided server sides of the attacks, the used values are provided.

Version 1: SS7

SiGploit will initially start with SS7 vulnerabilities providing the messages used to test the below attacking scenarios A- Location Tracking B- Call and SMS Interception C- Fraud

Version 2: GTP

This Version will focus on the data roaming attacks that occur on the IPX/GRX interconnects.

Version 3: Diameter

This Version will focus on the attacks occurring on the LTE roaming interconnects using Diameter as the signaling protocol.

Version 4: SIP

This is Version will be concerned with SIP as the signaling protocol used in the access layer for voice over LTE(VoLTE) and IMS infrastructure. Also, SIP will be used to encapsulate SS7 messages (ISUP) to be relayed over VoIP providers to SS7 networks taking advantage of SIP-T protocol, a protocol extension for SIP to provide intercompatability between VoIP and SS7 networks

Version 5: Reporting

This last Version will introduce the reporting feature. A comprehensive report with the tests done along with the recommendations provided for each vulnerability that has been exploited.

BETA Version of SiGploit will have the Location Tracking attacks of the SS7 phase 1

Installation and requirements

The requirements for this project are:

1) Python 2.7
2) Java version 1.7 +

To run use

python bin/SiGploit.py

Download Sigploit

Read More

Computer Strain (Save you eyes and Future)

No more watery eyes, when you wake up from sleep in the middle of the night to work on your bright computer screen. Your eye savior, f.lux is here. First things first, what is f.lux and why do you need it?

 

Why do you need f.lux ?

Decreasing the brightness is not that attractive an option, because the blue light emissions from your screen is still significant enough to well up your eyes with water and completely ruin your sleepy state. It is proven that exposure to blue light significantly aids in keeping you awake for a longer time in the night.

To get to the science behind it, here’s why. Most of us don’t know this, but there is another kind of receptor cells beside rods and cones in our retina. It’s called Melanopsin. The discovery was made about 15 years ago. Melanopsin is sensitive to narrow band of blue light in 460-480 nm range. Melanopsis works different functions for different creatures, but that’s another story.

There are two things I’d like to recommend to your reading list to get more information about melanopsin and effect of blue light on sleep:

1) Internal Time by Til Roennberg

2) Research Papers and articles – link

What is f.lux what does it do?

f.lux is a desktop applet for Windows, Linux, Mac, iPhone, iPad and iPod touch which limits the glow of your screen. Instead, it replaces that with a warm tone. There is no problem for your eyes not to feel comfortable on the screen in the morning. The daylight is sufficient and doesn’t let your eyes feel the glow that the screen throws. But say at 11 PM while you are, say trying to work late after sneaking on your father or wife, you power up your computer and you get instantly taken back by the brightness!

You can reduce the brightness and contrast to a certain extent, but there is a limit to which you can go without compromising your experience. f.lux comes to rescue here. It automatically switches to a warm tone at night and goes back to a brighter shade in the morning.

Don’t worry as it uses only 3.86MB of RAM approximately, is completely free, has no CPU load and works like a charm without any user interference. The working is also fairly simple. You can also customize the way it works, especially how warm you want your screen to be at night.

How to use f.lux to save your eyes?

It does the work by calculating your present location (through google maps)and works according to the sunrise/sunset cycle. The f.lux indicator applet automatically manages the color temperature of your screen based on your latitude and longitude, or if you are in the US, your zip code.



 

In the preferences panel, you can set your preferred night-time color temperature and see a preview, as well as seeing the current color temperature.

 





You can even pause the applet if you want to:



You can download f.lux for windows here and for Mac here.
For iPhone, iPad and iPod Touch you need to jailbreak your device in order to install it. You can follow the instructions here.

To install f.lux on Linux (Ubuntu) open up the terminal and copy paste the following commands one by one.

sudo add-apt-repository ppa:kilian/f.lux

1	sudo add–apt–repository ppa:kilian/f.lux

sudo apt-get update

1	sudo apt–get update

sudo apt-get install fluxgui

1	sudo apt–get install fluxgui

If you are having an error in adding the ppa (the first command), follow this link to troubleshoot it.

The Linux GUI of the f.lux applet doesn’t provide as much customizing options as that of the other platforms, so if you are interested in adding features to it, you could do it on its open source code on GitHub.

If you have any other query regarding f.lux, comment your queries below. Do share your experiences.

Read More

How to Change your Site from HTTP to HTTPS Complete guide

HTTP to HTTPS

Scenario :

You want to force people coming to your site to use HTTPS. Either for the entire site or a small sub-section of it.

Note

Using mod_rewrite to do this isn't the recommended behavior. 

Fix :

RewriteEngine On
# This will enable the Rewrite capabilities

RewriteCond %{HTTPS} !=on
# This checks to make sure the connection is not already HTTPS

RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
# This rule will redirect users from their original location, to the same location but using HTTPS.
# i.e.  http://www.example.com/foo/ to https://www.example.com/foo/
# The leading slash is made optional so that this will work either in httpd.conf
# or .htaccess context

Entire site (.htaccess) :

Note: While the rules you need are the same as above (because the rule above doesn't depend on any of the quirks of rewrite in .htaccess), you will need to ensure that you place this in a .htaccess file in the root of the site you want to apply it against, and to make sure you have the appropriate AllowOverride configuration in your httpd.conf

Specific Directory

Either put the above solution in a .htaccess file in the directory to be affected, or put the URI prefix in the regex itself.

RewriteEngine On
# This will enable the Rewrite capabilities

RewriteCond %{HTTPS} !=on
# This checks to make sure the connection is not already HTTPS

RewriteRule ^/?secure/(.*) https://%{SERVER_NAME}/secure/$1 [R,L]
# This rule will redirect all users who are using any part of /secure/ to the same location but using HTTPS.
# i.e.  http://www.example.com/secure/ to https://www.example.com/secure/
# This means if you dont want to force HTTPS for all directories you can force it for a specific sub-section of the site.

 

Read More

Complete A-Z Kali Linux Commands

Kali Linux is a Debian-derived Linux distribution designed for digital forensics and penetration testing. It is maintained and funded by Offensive Security Ltd. Mati Aharoni, Devon Kearns and Raphaël Hertzog are the core developers.

Kali Linux is preinstalled with over 600 penetration-testing programs, including nmap (a port scanner), Wireshark (a packet analyzer), John the Ripper (a password cracker), Aircrack-ng (a software suite for penetration-testing wireless LANs), Burp suite and OWASP ZAP (both web application security scanners). Kali Linux can run natively when installed on a computer’s hard disk, can be booted from a live CD or live USB, or it can run within a virtual machine. It is a supported platform of the Metasploit Project’s Metasploit Framework, a tool for developing and executing security exploits.

Here below we are listing A-Z Kali Linux commands which will help you to ease of flow in work.

 

Kali Linux commands	Function
A
apropos	Search Help manual pages (man -k)
apt-get	Search for and install software packages (Debian)
aptitude	Search for and install software packages (Debian)
aspell	Spell Checker
awk	Find and Replace text, database sort/validate/index
B
basename	Strip directory and suffix from filenames
bash	GNU Bourne-Again Shell
bc	Arbitrary precision calculator language
bg	Send to background
break	Exit from a loop
builtin	Run a shell builtin
bzip2	Compress or decompress named files
C
cal	Display a calendar
case	Conditionally perform a command
cat	Concatenate and print (display) the content of files
cd	Change Directory
cfdisk	Partition table manipulator for Linux
chgrp	Change group ownership
chmod	Change access permissions
chown	Change file owner and group
chroot	Run a command with a different root directory
chkconfig	System services (runlevel)
cksum	Print CRC checksum and byte counts
clear	Clear terminal screen
cmp	Compare two files
comm	Compare two sorted files line by line
command	Run a command – ignoring shell functions
continue	Resume the next iteration of a loop
cp	Copy one or more files to another location
cron	Daemon to execute scheduled commands
crontab	Schedule a command to run at a later time
csplit	Split a file into context-determined pieces
cut	Divide a file into several parts
D
date	Display or change the date and time
dc	Desk Calculator
dd	Convert and copy a file, write disk headers, boot records
ddrescue	Data recovery tool
declare	Declare variables and give them attributes
df	Display free disk space
diff	Display the differences between two files
diff3	Show differences among three files
dig	DNS lookup
dir	Briefly list directory contents
dircolors	Colour setup for `ls’
dirname	Convert a full pathname to just a path
dirs	Display list of remembered directories
dmesg	Print kernel & driver messages
du	Estimate file space usage
E
echo	Display message on screen
egrep	Search files for lines that match an extended expression
eject	Eject removable media
enable	Enable and disable builtin shell commands
env	Environment variables
ethtool	Ethernet card settings
eval	Evaluate several commands/arguments
exec	Execute a command
exit	Exit the shell
expect	Automate arbitrary applications accessed over a terminal
expand	Convert tabs to spaces
export	Set an environment variable
expr	Evaluate expressions
F
false	Do nothing, unsuccessfully
fdformat	Low-level format a floppy disk
fdisk	Partition table manipulator for Linux
fg	Send job to foreground
fgrep	Search files for lines that match a fixed string
file	Determine file type
find	Search for files that meet a desired criteria
fmt	Reformat paragraph text
fold	Wrap text to fit a specified width
for	Expand words, and execute commands
format	Format disks or tapes
free	Display memory usage
fsck	File system consistency check and repair
ftp	File Transfer Protocol
function	Define Function Macros
fuser	Identify/kill the process that is accessing a file
G
gawk	Find and Replace text within files
getopts	Parse positional parameters
grep	Search files for lines that match a given pattern
groupadd	Add a user security group
groupdel	Delete a group
groupmod	Modify a group
groups	Print group names a user is in
gzip	Compress or decompress named files
H
hash	Remember the full pathname of a name argument
head	Output the first part of files
help	Display help for a built-in command
history	Command History
hostname	Print or set system name
I
iconv	Convert the character set of a file
id	Print user and group id’s
if	Conditionally perform a command
ifconfig	Configure a network interface
ifdown	Stop a network interface
ifup	Start a network interface up
import	Capture an X server screen and save the image to file
install	Copy files and set attributes
J
jobs	List active jobs
join	Join lines on a common field
K
kill	Stop a process from running
killall	Kill processes by name
L
less	Display output one screen at a time
let	Perform arithmetic on shell variables
ln	Create a symbolic link to a file
local	Create variables
locate	Find files
logname	Print current login name
logout	Exit a login shell
look	Display lines beginning with a given string
lpc	Line printer control program
lpr	Off line print
lprint	Print a file
lprintd	Abort a print job
lprintq	List the print queue
lprm	Remove jobs from the print queue
ls	List information about files
lsof	List open files
M
make	Recompile a group of programs
man	Help manual
mkdir	Create new folders
mkfifo	Make FIFOs (named pipes)
mkisofs	Create an hybrid ISO9660/JOLIET/HFS filesystem
mknod	Make block or character special files
more	Display output one screen at a time
mount	Mount a file system
mtools	Manipulate MS-DOS files
mtr	Network diagnostics (traceroute/ping)
mv	Move or rename files or directories
mmv	Mass Move and rename files
N
netstat	Networking information
nice	Set the priority of a command or job
nl	Number lines and write files
nohup	Run a command immune to hangups
notify-send	Send desktop notifications
nslookup	Query Internet name servers interactively
O
open	Open a file in its default application
op	Operator access
P
passwd	Modify a user password
paste	Merge lines of files
pathchk	Check file name portability
ping	Test a network connection
pkill	Stop processes from running
popd	Restore the previous value of the current directory
pr	Prepare files for printing
printcap	Printer capability database
printenv	Print environment variables
printf	Format and print data
ps	Process status
pushd	Save and then change the current directory
pwd	Print Working Directory
Q
quota	Display disk usage and limits
quotacheck	Scan a file system for disk usage
quotactl	Set disk quotas
R
ram	ram disk device
rcp	Copy files between two machines
read	Read a line from standard input
readarray	Read from stdin into an array variable
readonly	Mark variables/functions as readonly
reboot	Reboot the system
rename	Rename files
renice	Alter priority of running processes
remsync	Synchronize remote files via email
return	Exit a shell function
rev	Reverse lines of a file
rm	Remove files
rmdir	Remove folders
rsync	Remote file copy (Synchronize file trees)
S
screen	Multiplex terminal, run remote shells via ssh
scp	Secure copy (remote file copy)
sdiff	Merge two files interactively
sed	Stream Editor
select	Accept keyboard input
seq	Print numeric sequences
set	Manipulate shell variables and functions
sftp	Secure File Transfer Program
shift	Shift positional parameters
shopt	Shell Options
shutdown	Shutdown or restart linux
sleep	Delay for a specified time
slocate	Find files
sort	Sort text files
source	Run commands from a file
split	Split a file into fixed-size pieces
ssh	Secure Shell client (remote login program)
strace	Trace system calls and signals
su	Substitute user identity
sudo	Execute a command as another user
sum	Print a checksum for a file
suspend	Suspend execution of this shell
symlink	Make a new name for a file
sync	Synchronize data on disk with memory
T
tail	Output the last part of file
tar	Tape Archiver
tee	Redirect output to multiple files
test	Evaluate a conditional expression
time	Measure Program running time
times	User and system times
touch	Change file timestamps
top	List processes running on the system
traceroute	Trace Route to Host
trap	Run a command when a signal is set(bourne)
tr	Translate, squeeze, and/or delete characters
true	Do nothing, successfully
tsort	Topological sort
tty	Print filename of terminal on stdin
type	Describe a command
U
ulimit	Limit user resources
umask	Users file creation mask
umount	Unmount a device
unalias	Remove an alias
uname	Print system information
unexpand	Convert spaces to tabs
uniq	Uniquify files
units	Convert units from one scale to another
unset	Remove variable or function names
unshar	Unpack shell archive scripts
until	Execute commands (until error)
uptime	Show uptime
useradd	Create new user account
usermod	Modify user account
users	List users currently logged in
uuencode	Encode a binary file
uudecode	Decode a file created by uuencode
V
v	Verbosely list directory contents (`ls -l -b’)
vdir	Verbosely list directory contents (`ls -l -b’)
vi	Text Editor
vmstat	Report virtual memory statistics
W
wait	Wait for a process to complete
watch	Execute/display a program periodically
wc	Print byte, word, and line counts
whereis	Search the user’s $path, man pages and source files for a program
which	Search the user’s $path for a program file
while	Execute commands
who	Print all usernames currently logged in
whoami	Print the current user id and name (`id -un’)
wget	Retrieve web pages or files via HTTP, HTTPS or FTP
write	Send a message to another user
X
xargs	Execute utility, passing constructed argument lists
xdg-open	Open a file or URL in the user’s preferred application
Y
yes	Print a string until interrupted

 

 

Read More

Penetration Testing (Types)

There are primarily three varieties of penetration testing: white field, black field, and grey field.

– White Box Testing
White field testing is when the testing crew has entry to network diagrams, asset data, and different helpful knowledge. This technique is used when budgets are tight and the quantity of allowed hours is proscribed. This kind of testing is the least lifelike, in of what an attacker could do.

– Black Box Testing
Black field testing is when there may be positively no info supplied to the penetration testing crew. Actually, utilizing this technique of testing, the penetration testing crew could solely be given the group title. Other instances, they might be given an IP vary and different parameters to restrict the potential for collateral harm. This kind of testing most precisely represents what an attacker could do and is probably the most lifelike.

– Gray Box Testing
Gray field testing is, you guessed it, someplace in between white field testing and black field testing. This is the very best form of penetration testing the place the penetration testing crew is supplied with restricted info and solely as wanted. So, as they work their manner from the skin in, extra entry to info is granted to hurry the method up. This technique of testing maximizes actuality whereas remaining price range pleasant.

Read More

How to Hack your ISP (Internal Service Provider)

What is FUP?

Most ISPs implement a Fair Usage Policy which will decrease the speed after you reach the usage limit. For eg. - in my case I will have to live with 512 kbps after my 50 GB data usage is over

The ISP doesn't (officialy) provide customers with any interface to view their current usage. This is pretty frustrating as you never know whether you have actually gone over your FUP limit or not.

With the outside temperatures reaching 43-44 degrees, I had no other option but to stay in the house and do something. My first aim was to understand how the ISP was maintaining the usage info of its customers. I logged into my router's admin console (192.168.2.1) and went straight to the page which shows me the info about the internet connection (PPPOE). From there I found the gateway IP address. Gateway IP address is the IP address of a router/computer through which all your internet traffic goes. You can imagine it as a big router which connects all the customers to internet. This should be the place where my internet usage is getting recorded.



I started a scanning the Gateway IP address for open ports using Zenmap(nmap GUI for Windows). I found that the following ports were open and seemed interesting.

• Port 80 - http


• Port 443 - https


• Port 3306 - mysql

Since port 80 and 443 were open. I quickly opened the Gateway IP address on my browser and found the login page of the customer management portal. This was the place I was looking for.



I tried entering my PPPOE username and default password and voila it worked. I could now see my current usage, change the default password and do much more. A quick glance on the info assured me of the foul play by my ISP. The ISP was actually just giving me 30GB FUP instead of the promised 50GB.



This was enough for the hacker inside me to wake up and start working. I went to the login page and tried some basic SQL injection inputs and luckily one of inputs worked and I was logged into someone else's account. I saw that this username was starting with letter 'a' and I quickly figured out that this must be the first username in the database. The SQL injection has bypassed the username and password check and logged me in as the first available user. I tried some more SQL injection queries to find whether error based SQL injection was an option or not. But sadly they have disabled all the errors. I also tried some other options but none of them seemed to work.

 

Now the only option that I could think of was doing a Time Based Blind SQL injection which would take a lot of time since it like asking database true or false questions and then making sense depending on the answers.

I knew that doing this manually is not an option. So I fired up a KALI Linux instance on a Hyper-V Virtual Machine and instructed SQLMAP (an automated SQL injection tool) to do all of the hard work for me for the rest of the night. You have to patient if you are doing a Time Based SQL injection.

KALI Linux is an Advanced Penetration Testing Linux distribution used for Penetration Testing. Hyper-V is an alternative to Virtual Box that comes pre-installed on Windows.

 



I woke up next morning to find out the I have got the dump of table containing four username and password of elevated users of the management software. I appended /admin to the Gateway IP hoping that it would take me to the admin login page and I was right.

Now the problem was that the password was hashed one way. I looked at the hash and quickly figured out that it is a MD5 hash(32 character). I googled 'MD5 reverse', opened the first link and pasted the hash in the hope of getting the original value. Out of the four hashes I was able to reverse the two because the passwords were same and very simple. You must be wondering what was the password. Try to reverse this hash d8578edf8458ce06fbc5bb76a58c5ca4 and you will get it. It was really that simple.

I logged in with the username and password and the ship was now in my control.



But this user didn't had some of the more elevated privileges like changing the minimum speed of the user etc.

So I took the other hash and started trying to reverse it on various different websites. Luckily on one of the sites, I was able to successfully reverse the hash, the password was 9 character long containing upper and lowercase letters, numbers and special characters. I know such a password is generallly regarded as safe but one should clearly accept the fact that MD5 is easy to reverse and short passwords are always a bad idea even if there contain special characters.

What information was available in admin panel?

• All the usernames and their MD5 password hashes. The ISP used the default password for everyone and it was a single password therefore it was very simple to reverse it.


• A good thing was that each account was binded with a MAC address. So even if I had the username and password of someone else I would not be able to use that. The bad thing about this was I also got their MAC addresses from the admin panel so I could easily fake my MAC address in my router settings and use any other username and password easily. I never tried this but I am sure that it would have worked for sure.


• Various other information like phone, email, address etc. that I didn't cared about.

Read More