Hacking Archives - Page 4 of 33 - Hackercool Magazine

Posted on July 11, 2024July 11, 2024 by kanishka10

Beginners guide to netdiscover

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt about network scanning. In this blogpost, you will learn about netdiscover tool. It is an active/passive network address discovering tool that was actually developed to discover wireless networks during wardriving but can also detect addresses on switched networks. It used ARP packets to detect network addresses.

It is mostly used to find the target IP address in hack the box challenges. But it can also be used to scan for network addresses of a network in real-world pen testing. It is installed by default in Kali Linux and we are going to use same for this tutorial.

The simplest way of using netdiscover to find out network addresses is to simply type the command “netdiscover” in the terminal as shown below.

Then it slowly scans for network addresses as shown below. This is how most people use it.

Fast mode

However, you don’t have to wait for netdiscover to finish scanning as long as it takes. You can scan faster with netdiscover too using the “-f” option.

Interface mode

Netdiscover can be set to scan network addresses on a specific network interface you want. For example, on Kali Linux, let’s use the command “ip a” to view all the network interfaces connected to it.

Interface mode can be set with the “-i” option. For example, let’s scan the interface “eth0” as shown below.

Scan a specific range

Similarly, netdiscover can be used to scan a specific range as shown below. For example, let’s scan the range 192.168.248.0/24.

Printable form (-p)

Netdiscover can also display its output in a way easy for printing using the “-p” option.

Posted on July 11, 2024 by kanishka10

Beginners guide to Zenmap

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt in detail about Nmap, the popular port scanner. If you are like me, you thought all those commands, types of scans and options are very difficult to grasp. Well, maybe even the makers of Nmap also thought the same. Hence, they release a GUI version of Nmap called Zenmap.

Zenmap is the official GUI version of Nmap security scanner. It works on almost all platforms (Linux, Windows, mac OSX, BSD etc.). Just like Nmap it is also open-source. In this blogpost you will learn in detail about Zenmap. It can be downloaded from here. Kali Linux has Zenmap in its repository as part of kaboxer. For this tutorial, we will be using this only.

In Kali Linux, open a terminal in kali and type the command “Zenmap-kbx”. If Zenmap is not already installed, the system will prompt you if you want to install it.

Type “y” to install it, Otherwise, it will open Zenmap GUI as shown below.

The interface of Zenmap can be divided in to five sections.

Target section
Profile section
Output section
Host / services section
Command section

The target section is where we specify a target. The target can be specified in all the variety of ways Nmap allows. The profile section allows you to choose a type of scan. There are various scan options available.

Let’s select Quick scan for now. The command section shows the command for each scan type you select. Yes, you can type the command also directly and run Zenmap here. But if you want to do it, you would have been content with Nmap only. For now, let’s click on ‘scan’. Very soon, the results will be out and can be seen in output section as shown below.

The output section has many other tabs that provide additional information about the target scanned. The ports/hosts tabs show the open ports, type of protocol it uses and the service running on it separately and clearly.

The “Topology” sub-section shows that our attacker machine and target machine in visual form.

You can even zoom on the visual representation for a better view.

The “Host details” tab shows details about the target host separately.

The “scans” section shows all the scans you have performed.

Let’s select a “Regular scan” now.

The “Hosts/services” section provides information about the target host and services running on it.

That was all about Zenmap. See how simple it is to use Zenmap for port scanning.

Posted on July 7, 2024July 7, 2024 by kanishka10

Beginners guide to Commix

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt what is command injection, types of command injection etc. In this blogpost, you will learn about Commix, a tool that is used to automatically exploit command injection vulnerability.

Commix, which is short for (comm) and (injection) e(x)ploiter is an open source pen testing tool written by Anastasior Stasinopolos that is useful in automatically detecting and exploiting command injection vulnerabilities. Written in Python, commix can be installed on any platform that supports Python.

On pen testing distros like Kali Linux, commix is installed by default. So, we will be using it for this tutorial. As target, we will be using mutillidae in Metasploitable 2. Mutillidae, is an intentionally vulnerable web application for practicing ethical hacking. See how to install Metasploitable 2 in virtualBox and set up a virtual hacking lab.

A webpage “dns-lookup.php” in mutillidae has a command injection vulnerability in the Hostname/IP field. These vulnerabilities can be detected using web vulnerability scanners like OWASP ZAP (aka zaproxy), Nikto, Burpsuite etc.

What this webpage does is when you provide an IP or hostname, it performs a DNS lookup of that IP or hostname (For example, we have used it on google.com).

This is its name functioning but when you join another command to the IP/hostname using ampersand as shown below, it also executes that command as shown below.

Commix allows us to exploit this vulnerability automatically. To do this, with commix, we need information about the parameter being sent while sending this query. This can be achieved by using OWASP ZAP as an intercepting proxy. See how to set OWASP ZAP as an intercepting proxy.

The target can be specified in commix using the “-u” option and POST data can be specified using “–data” option as shown below.

When you execute this command, commix will prompt you to set cookies. Cookies are not needed in this case.

Then, commix says the parameters we are testing is vulnerable to command injection and it will prompt you for a pseudo-terminal access.

Selecting ‘Yes” will give us access to the commix shell a shown below.

Apart from giving you a terminal on the target system, commix provides a lot of enumeration options. Let’s see some of them here.

–hostname

It retrieves the hostname of the target system.

–current-user

This command retrieves the current user on the target system.

–is-root

This command checks if the current user has root privileges.

–is-admin

This command checks if the current user has admin privileges.

–sys-info

As you might have guessed by now, this command retrieves the system information of the target.

–users

This command retrieves all the users on the target system.

–passwords

This command retrieves passwords of all the users on the system.

Here, of course we did not get any password hashes, as we do not have enough privileges to get those.

–privileges

This command retrieves the privileges of all the users on the target system.

–ps-version

This command retrieves the version of the PowerShell installed on the target system.

–all

Instead of enumerating each item separately, you can retrieve all the information from the target system using the “–all” option.

–os-cmd

This command is used to execute a single operating system command on the target system. For example, let’s execute “ls” command on the target system.

–os=

This command is used to force the backend operating system (For example, Windows or UNIX.

Posted on July 6, 2024July 6, 2024 by kanishka10

Beginners guide to XSSer

Hello, aspiring ethical hackers. In one of our previous blogposts, you learnt what XSS vulnerability is, what are the different types of XSS vulnerabilities and its impact on web security. Wouldn’t it be good if there was a tool that can automatically detect and exploit XSS vulnerabilities? In this blogpost, you will be learning about one such tool named XSSer which is an automatic framework to detect, exploit and report XSS vulnerabilities in web applications.

XSSer is a python script and can be installed on all Linux systems with python installed. It is installed by default in Kali Linux and we are going to use the same for this tutorial. See how to install kali Linux in virtual Box. We will be using Mutillidae in Metasploitable 2 as target to test with XSSer as it is easily available to download and this tutorial is easily reproducible. See how to install Metasploitable 2 in VirtualBox.

Mutillidae is a vulnerable web app that intentionally consists of all OWASP 10 vulnerabilities for practicing web application hacking. Also see how to create a virtual hacking lab in virtual Box. In the page shown below belonging to Mutillidae, the blog entry field consists of a XSS vulnerability. These vulnerable pages can be detected using web vulnerability scanners like OWASP ZAP aka Zaproxy, Nikto and Burpsuite etc.

XSSer can also be used to scan for XSS vulnerabilities using the “–all” option” as shown below.

However, here XSSer failed to find any XSS vulnerability. Let’s see how to find any XSS vulnerability in this specific section. For this, I start OWASP ZAP as intercepting proxy to capture web requests. Then, I change the setting in the browser to access the web through this proxy and visit the vulnerable page again on this browser.

I type “This is a new blogpost” in the blogpost entry and save the blogpost. Now, when we view the captured web request in OWASP ZAP as shown below, we can see the request being sent to the target.

Now, we copy the highlighted data above and use it in our XSSer tool. The only difference is to find out the XSS vulnerability, we add text “XSS” in the place of any vector that us vulnerable to XSS.

Note the method the query is using to pass this data. There are two methods by which data is sent and received: GET and POST. XSSer has an option to use both the methods: (-g) for GET method and (-p) for POST method. OWASP ZAP has shown us that this data is being passed using the POST method. So, we will be using the same with XSSer.

Now, you can see that vector “blog_entry” is vulnerable to cross site scripting using URL method. Here, we tried one vector. XSSer provides an option to inject a list of vectors provided by XSSer. To test all these vectors, we can use the “—auto” option. XSSer in total has 1291 injection vectors.

As you can see, XSSer found 1287 of 1291 injection vectors in the web app. XSSer also has the option of using payloads. Here the payload can be anything even the most popular <script> alert (“HC”)</script). Here is how we specify the payload in XSSer.

Here I have given the same above-mentioned script as payload.

Specify your own payload

Using the “-Fp” option, you can even specify your own payload for final injection.

Execute payload remotely

The “-Fr” option is used to execute the payload remotely.

Posted on May 23, 2024May 23, 2024 by kanishka10

Beginners guide to pen testing

Hello, aspiring ethical hackers. In this blogpost, you will learn about what is pen testing, types of pen tests, the purpose of a pen test etc.

What is pen testing?

Pen testing also known as penetration testing is the testing done to exploit the vulnerabilities and weakness in the applications, system, device and network. The aim of pen testing is to find out about any vulnerabilities in the target and patch or fix them so that malicious hackers cannot exploit them and compromise the security of the organization.

Different approaches to pen testing

Pen tests can be classified based on the information that is provided to the pen testers. They are,

1. Black Box Pen test:

In a Black box pen test, no information about the target is provided to the pen tester. This pen test is performed to simulate the Real-World Black Hat hacking attacks that usually start from the phase of reconnaissance.

2. Grey Box Pen test:

In a Grey Box pen test, the pen tester is provided limited information about the target network or organization. For example, this information is something like that gives basic login access to the pen tester. This pen test saves the elaborate time that takes to perform a Black box pen test.

3. White Box Pen test:

In this type of pen test, the maximum information needed about the target is provided to the pen tester as much as possible. This test is done to simulate the hacking attack in which the hacker knows about the target organization, someone like an internal employee. This test saves time and expenses.

Based on the location of the pen test being done, pen tests are classified as Internal & External pen tests.

4. Internal Pen testing:

This pen test is performed from inside the organization. This is to simulate the inside threats, who have extensive knowledge about the organization and its resources.

5. External Pen testing:

As you might have already expected, this pen test is performed from outside the organization. This test is usually performed to test the perimeter security of the network.

Types of pen testing

There are different types of pen tests. They are,

Network Penetration Testing.
Wireless Penetration Testing.
Social engineering Pen test.
Physical pen test.
Red Team pen test.
Web app pen test.
Mobile Pen test.
IOT Pen test.
Cloud Pen test.

Category: Hacking

Beginners guide to netdiscover

Beginners guide to Zenmap

Beginners guide to Commix

Beginners guide to XSSer

Beginners guide to pen testing

Categories