Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
In part one, I ended with the site Pipl and how you can search for yourself online.
https://cdn-images-1.medium.com/max/621/0*bMksVN944xZejONc.png
https://www.intelius.com/
https://www.beenverified.com/
https://www.spokeo.com/
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
In part one, I ended with the site Pipl and how you can search for yourself online.
https://cdn-images-1.medium.com/max/621/0*bMksVN944xZejONc.png
https://www.intelius.com/
https://www.beenverified.com/
https://www.spokeo.com/
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Check How Exposed You Are Online Part 2
https://www.intelius.com/ https://www.beenverified.com/ https://www.spokeo.com/
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Everyone is advertising free WiFi nowadays as a way to lure customers in.
https://cdn-images-1.medium.com/max/626/0*Ha3KL4sIfLVSUplT.jpg
You may think it would be super complex in order for these malicious parties to set this up but you would be wrong. Useful tools such as…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Everyone is advertising free WiFi nowadays as a way to lure customers in.
https://cdn-images-1.medium.com/max/626/0*Ha3KL4sIfLVSUplT.jpg
You may think it would be super complex in order for these malicious parties to set this up but you would be wrong. Useful tools such as…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Creating A Rogue Access Point
You may think it would be super complex in order for these malicious parties to set this up but you would be wrong. Useful tools such as…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Rockyou.txt will only get you so far.
https://cdn-images-1.medium.com/max/626/0*LrGls7YOr5Dsx0Tj.jpg
cupp and CeWL are tools that allow you to generate a wordlist based on the profile of the person or site that you are trying to hack.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Rockyou.txt will only get you so far.
https://cdn-images-1.medium.com/max/626/0*LrGls7YOr5Dsx0Tj.jpg
cupp and CeWL are tools that allow you to generate a wordlist based on the profile of the person or site that you are trying to hack.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Generating Custom Wordlists For Targeted Attacks
cupp and CeWL are tools that allow you to generate a wordlist based on the profile of the person or site that you are trying to hack.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Cracking PDFs and ZIP files
https://cdn-images-1.medium.com/max/626/0*fbjNrI_HUk4xYkv8.jpg
Password protecting your files using a password is a great way to add additional security controls. The problem is, there are tools out…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Cracking PDFs and ZIP files
https://cdn-images-1.medium.com/max/626/0*fbjNrI_HUk4xYkv8.jpg
Password protecting your files using a password is a great way to add additional security controls. The problem is, there are tools out…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Cracking PDFs and ZIP files
Password protecting your files using a password is a great way to add additional security controls. The problem is, there are tools out…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Grabify is a service that can help you identify who is on the receiving end of your chats or emails.
https://cdn-images-1.medium.com/max/1360/0*MOpgqcLB3JHoJI_a.png
The link to the site is: https://grabify.link/
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Grabify is a service that can help you identify who is on the receiving end of your chats or emails.
https://cdn-images-1.medium.com/max/1360/0*MOpgqcLB3JHoJI_a.png
The link to the site is: https://grabify.link/
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Using Grabify To Track URLs
The link to the site is: https://grabify.link/
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Steganography is a way of hiding data in plain sight.
https://cdn-images-1.medium.com/max/600/0*bkTua1BjZTUXBVtE
This practice is commonly used to hide malware inside other files in order to get it onto a victim’s machine. The user would just see or…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Steganography is a way of hiding data in plain sight.
https://cdn-images-1.medium.com/max/600/0*bkTua1BjZTUXBVtE
This practice is commonly used to hide malware inside other files in order to get it onto a victim’s machine. The user would just see or…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Using Steganography To Hide Data In Plain Sight
This practice is commonly used to hide malware inside other files in order to get it onto a victim’s machine. The user would just see or…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
If you have a piece of tape covering your webcam, you have most likely heard that hackers or the…
https://cdn-images-1.medium.com/max/626/0*a4BTOtaz2OycdHO-.jpg
Now it could be that your CCTV, IP camera is simply exposed on the Internet and the attacker has found it on sites such as Shodan. You…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
If you have a piece of tape covering your webcam, you have most likely heard that hackers or the…
https://cdn-images-1.medium.com/max/626/0*a4BTOtaz2OycdHO-.jpg
Now it could be that your CCTV, IP camera is simply exposed on the Internet and the attacker has found it on sites such as Shodan. You…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Reverse Shells and Controlling Webcams
Now it could be that your CCTV, IP camera is simply exposed on the Internet and the attacker has found it on sites such as Shodan. You…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
If you look at your phone, you will most likely have around 3–4 shopping or social media…
https://cdn-images-1.medium.com/max/626/0*ItoH5EHU0n2Q1GDE.jpg
The “Forgot my password” might save you in times of need but it could also be your downfall. If you think about some of the shopping or…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
If you look at your phone, you will most likely have around 3–4 shopping or social media…
https://cdn-images-1.medium.com/max/626/0*ItoH5EHU0n2Q1GDE.jpg
The “Forgot my password” might save you in times of need but it could also be your downfall. If you think about some of the shopping or…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Why Securing Your Email Account Is Important
The “Forgot my password” might save you in times of need but it could also be your downfall. If you think about some of the shopping or…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How Digital Security Demands Strong Passwords
https://cdn-images-1.medium.com/max/1125/0*ppw3cMWi4SCBliIP
We are digital citizens who use the password as the key to unlocking the doors of digital portals.
Continue reading on The Daily Cuppa »
___________________________
@hacking_Attack
@Hacking_Video
How Digital Security Demands Strong Passwords
https://cdn-images-1.medium.com/max/1125/0*ppw3cMWi4SCBliIP
We are digital citizens who use the password as the key to unlocking the doors of digital portals.
Continue reading on The Daily Cuppa »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How Digital Security Demands Strong Passwords
We are digital citizens who use the password as the key to unlocking the doors of digital portals.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Hackable: 3 VulnHub Walkthrough
Hackable: 3, Vulnhub medium machine was created by Elias Sousa and can be downloaded here.This lab is designed for experienced CTF players who want to put their abilities to the test. We used the machine in the way that it was designed. Also, if you haven’t checked the machine or are having problems, you can attempt every approach you know. The key is port knocking, so let’s get started and discover how to split things down into digestible chunks. Pentesting MethodologyNetwork Scanning
* netdiscover
* nmap
Enumeration
* abusing http
* dirb
* wordlist
* port knocking
Exploitation
* hydra
* ssh
* user flag
* linpeas
Privilege Escalation
* lxd
* root flag
Level: Medium Network ScanningTo begin with, we must use the netdiscover command to scan the network for the IP address of the victim machine.
netdiscover
Our IP address is 192.168.1.185.
https://blogger.googleusercontent.com/img/a/AVvXsEhVERM4UlvgrikfFqiOYmQ2Z8vmPZ-73pkMQCBy9i1-QOZTAtw7kcVLbzG5x-EFkjAVrvUb1NmlpxbATDh4a4c8yWXs3IbJemu2bA8mpCQa7h_X6nv3BPNBPaRsjUGvPtnmMckC9_POPfDnnloZ_yv4mJBvz8h6h9ygCWb5nXGYXzwqpT0UsPq_UgEpgw=s16000
To move forward in this process, we are launching Nmap. For open port enumeration.
nmap -sC -sV 192.168.1.185
According to Nmap, we have an SSH server operating on port 22 and an HTTP service (Apache Server) running on port 80.
https://blogger.googleusercontent.com/img/a/AVvXsEh7BOL_YWDJOF051U9Nug9s-L59Ic1QK5YcjB5iX7Qkytt9ykvj8rVYILq7c9UZjI1XK30nxoXvkamcNP0ZvCLZQwq-hOhmgeexZAW94nN8dUzVO4HmtxC3Itqo7savKGUpNrAlxMkm3x6bNKL9vuNMaUYd5KmKtSyUNnCkiy7WdOeoQ2PGE8NxBYFLUw=s16000 EnumerationFirst, we’ll attempt to use HTTP. Let’s look at port 80 and see if anything interesting comes up. We can immediately verify it in the browser because the Apache Server is listening on port 80.
https://blogger.googleusercontent.com/img/a/AVvXsEi211wSF6iWL58biBopenZC8-0IZEaqXGblPKo7gtWQ3y77D2KwmCuCwLrxh8AiYkz7ZhSndIjgJL7JCABakYKKUUuHMK_4kx4s0xCy5_IlIBQ8FbCaw2j0m0s4RGdJw3gWz27scHQF4HFhYJyZ4--W_J4AWuN_SQo5P3uRSL_cTjnglO7OgPz-EDmH3g=s16000 w
Nothing in-trusting on the main page. As a result, we examined its source code and discovered some information that will be valuable in this lab.
* We received a link to the login page.
* We chose the username “jubiscleudo.”
* We have gotten a hint that this lab requires port knocking.
https://blogger.googleusercontent.com/img/a/AVvXsEg5dzsOwH__RbupQ-l5c033EKAS_KlSorzXpRQYECF8Eu_baDuetC0dNVN8i-FkHx5Njequkd9FpqRTWARIhskPJ1ECZnUhTNVepG5p4F5jVZ_HVMkFEp69kUsQ5xn1LKuETe12MLy_Upb07rw-TNhmosHSMiRzofKOMYwUDLtNfqnJZ6sy5iXcKDy9hQ=s16000
To find out more about this laboratory. To uncover certain hidden directory paths, we execute a dirb directory scan.
dirb http://192.168.1.185/
Let’s look through a lot of trustworthy directories, so let’s look through them one by one.
https://blogger.googleusercontent.com/img/a/AVvXsEgfDEzIaFgeGbBYlMfZKye_YNErmR_EsGKAvrjNgteQhZ9HkfxjfiSXnVzgalmE_LAiL2uyjoFbe0-LT_LItng9DnHSkeQVOn1lwKCDWGgsxuKkX6w7wn6gruokYREDdlOvxrnxYaDI8oPsiTTOC8MFvKD7CqxYLSOBJE5O__vTPYSlH9WzHAW6deRoIw=s16000
So, let’s have a look at the first result backup directory. We obtained a word list file that might be valuable in the future.
https://blogger.googleusercontent.com/img/a/AVvXsEgVZr5GcfS-MY8iGAWRKBjXMCkjJdzsUlOly6xYQVwsnGlnpNzxr3H9qbNucRp0TnrcH24edDpHN8MnRD4rDGx0TekOqe6SvCvcEt8HFO_L73m-3Hlrfsirm6mGHgodJMq6kdbquTCas_3HX6ylII__nhO3j8i6h_ZJCTIqSpZRMMfPrlPCXWDggT5tIg=s16000
As a result, we run the wget command to download this word list to our machine.
wget http://192.168.1.185/backup/wordlist.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhLZM499xBUbcE72tbHdXo13bTYS-wE5Zd0gsAIK-8ZCfiIBS26gyQHinfoNxv2h_HKXd7ILA1j9OehSYdyCZKy8SqfsdLEpOkZ7tMbAyKwy8mTma2zPNnuno-ljdlS1YMvUm7Tdags5PAenN-FQOY2GRY4oM4HOaA[...]
___________________________
@hacking_Attack
@Hacking_Video
Hackable: 3 VulnHub Walkthrough
Hackable: 3, Vulnhub medium machine was created by Elias Sousa and can be downloaded here.This lab is designed for experienced CTF players who want to put their abilities to the test. We used the machine in the way that it was designed. Also, if you haven’t checked the machine or are having problems, you can attempt every approach you know. The key is port knocking, so let’s get started and discover how to split things down into digestible chunks. Pentesting MethodologyNetwork Scanning
* netdiscover
* nmap
Enumeration
* abusing http
* dirb
* wordlist
* port knocking
Exploitation
* hydra
* ssh
* user flag
* linpeas
Privilege Escalation
* lxd
* root flag
Level: Medium Network ScanningTo begin with, we must use the netdiscover command to scan the network for the IP address of the victim machine.
netdiscover
Our IP address is 192.168.1.185.
https://blogger.googleusercontent.com/img/a/AVvXsEhVERM4UlvgrikfFqiOYmQ2Z8vmPZ-73pkMQCBy9i1-QOZTAtw7kcVLbzG5x-EFkjAVrvUb1NmlpxbATDh4a4c8yWXs3IbJemu2bA8mpCQa7h_X6nv3BPNBPaRsjUGvPtnmMckC9_POPfDnnloZ_yv4mJBvz8h6h9ygCWb5nXGYXzwqpT0UsPq_UgEpgw=s16000
To move forward in this process, we are launching Nmap. For open port enumeration.
nmap -sC -sV 192.168.1.185
According to Nmap, we have an SSH server operating on port 22 and an HTTP service (Apache Server) running on port 80.
https://blogger.googleusercontent.com/img/a/AVvXsEh7BOL_YWDJOF051U9Nug9s-L59Ic1QK5YcjB5iX7Qkytt9ykvj8rVYILq7c9UZjI1XK30nxoXvkamcNP0ZvCLZQwq-hOhmgeexZAW94nN8dUzVO4HmtxC3Itqo7savKGUpNrAlxMkm3x6bNKL9vuNMaUYd5KmKtSyUNnCkiy7WdOeoQ2PGE8NxBYFLUw=s16000 EnumerationFirst, we’ll attempt to use HTTP. Let’s look at port 80 and see if anything interesting comes up. We can immediately verify it in the browser because the Apache Server is listening on port 80.
https://blogger.googleusercontent.com/img/a/AVvXsEi211wSF6iWL58biBopenZC8-0IZEaqXGblPKo7gtWQ3y77D2KwmCuCwLrxh8AiYkz7ZhSndIjgJL7JCABakYKKUUuHMK_4kx4s0xCy5_IlIBQ8FbCaw2j0m0s4RGdJw3gWz27scHQF4HFhYJyZ4--W_J4AWuN_SQo5P3uRSL_cTjnglO7OgPz-EDmH3g=s16000 w
Nothing in-trusting on the main page. As a result, we examined its source code and discovered some information that will be valuable in this lab.
* We received a link to the login page.
* We chose the username “jubiscleudo.”
* We have gotten a hint that this lab requires port knocking.
https://blogger.googleusercontent.com/img/a/AVvXsEg5dzsOwH__RbupQ-l5c033EKAS_KlSorzXpRQYECF8Eu_baDuetC0dNVN8i-FkHx5Njequkd9FpqRTWARIhskPJ1ECZnUhTNVepG5p4F5jVZ_HVMkFEp69kUsQ5xn1LKuETe12MLy_Upb07rw-TNhmosHSMiRzofKOMYwUDLtNfqnJZ6sy5iXcKDy9hQ=s16000
To find out more about this laboratory. To uncover certain hidden directory paths, we execute a dirb directory scan.
dirb http://192.168.1.185/
Let’s look through a lot of trustworthy directories, so let’s look through them one by one.
https://blogger.googleusercontent.com/img/a/AVvXsEgfDEzIaFgeGbBYlMfZKye_YNErmR_EsGKAvrjNgteQhZ9HkfxjfiSXnVzgalmE_LAiL2uyjoFbe0-LT_LItng9DnHSkeQVOn1lwKCDWGgsxuKkX6w7wn6gruokYREDdlOvxrnxYaDI8oPsiTTOC8MFvKD7CqxYLSOBJE5O__vTPYSlH9WzHAW6deRoIw=s16000
So, let’s have a look at the first result backup directory. We obtained a word list file that might be valuable in the future.
https://blogger.googleusercontent.com/img/a/AVvXsEgVZr5GcfS-MY8iGAWRKBjXMCkjJdzsUlOly6xYQVwsnGlnpNzxr3H9qbNucRp0TnrcH24edDpHN8MnRD4rDGx0TekOqe6SvCvcEt8HFO_L73m-3Hlrfsirm6mGHgodJMq6kdbquTCas_3HX6ylII__nhO3j8i6h_ZJCTIqSpZRMMfPrlPCXWDggT5tIg=s16000
As a result, we run the wget command to download this word list to our machine.
wget http://192.168.1.185/backup/wordlist.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhLZM499xBUbcE72tbHdXo13bTYS-wE5Zd0gsAIK-8ZCfiIBS26gyQHinfoNxv2h_HKXd7ILA1j9OehSYdyCZKy8SqfsdLEpOkZ7tMbAyKwy8mTma2zPNnuno-ljdlS1YMvUm7Tdags5PAenN-FQOY2GRY4oM4HOaA[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Hackable: 3 VulnHub Walkthrough
Hackable 3 VulnHub guide: Exploit LFI to gain shell access and escalate privileges to root via cron job misconfiguration.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Hackable: 3 VulnHub Walkthrough Hackable: 3, Vulnhub medium machine was created by Elias Sousa and can be downloaded here.This lab is designed for experienced CTF players who want to put their abilities to the test. We used the machine in…
BmZ5gJq-ougO2PyJ7CnlvZhVtag=s16000
Let’s look at the second config directory; we found a file called 1.txt. We ran this file through the browser and discovered some essential but mysterious context.
https://blogger.googleusercontent.com/img/a/AVvXsEj0utZBhOMYO_pXGcaN-_Vjvj3r_qrsqim8JJz4ILThIQFglyv1lCG475WzxQlLN4EAyeuwnuzy4PjQLN63TC4OGcsMOysI8BHLwuB6bIWzvqgoBQuVeiwcRNEUtFYtk3mgkNyx9s-9kNV4BscJQWd6Czins-VsDu7D5T96r8XVKfDFQn-OyR7WGr9xww=s16000
As a result, we attempt to decode this text using the following command.We received our first text of port knocking after recovering the initial text (10000).
echo MTAwMDA= | base64 -d
https://blogger.googleusercontent.com/img/a/AVvXsEgonhSm44bJZc5fmvbpi7g0RqmAaT9UjwllWkObLO-EALHuV89yRKLUcvcQLbsYJa-HBFm4Lj2nAVgj17ibVlY3gh4gbNn5nSWhr8UxDsF9DI346MFJTiTqJBFRri4noWeSblQlQ_D5oPb6vWtTwTLYZHPvChQz-Ci0HDMIBSS5wcLP5W2qmoiLx-Z8cg=s16000
When we checked the third one (CSS directory), we got another text file called 2.txt. where we obtained an enumeration of brain fucks.
https://blogger.googleusercontent.com/img/a/AVvXsEjmFUIY0qp3UIHI8_LU04ORswWN8T1iEFPQAIW0rzjh6K3o5F2DCXwOgZoKIuDP2-51BLV5rCpfR8ygyZpRd_My1sbZPOkfMfb3NBrhjM7BM356R_OqcG9cuzrh8us3BLR2B1i6cnn9OzfU9dolL1U367em0opfsMyKROCPxY8wi4skQJneo9eXpzQLIA=s16000
So, we checked the brain fuck decoder online and recovered the second context (4444) of port knocking activity by providing them with our text.
https://blogger.googleusercontent.com/img/a/AVvXsEg53JmRn9-a9LhwhtHVjUYE16CsWxDXW3rohNyCX4luBpoSykts6FCjdKqHlAACkDDu5twYYiD8a7OyR4kd3e72Vbdns8xRsBIgmUenLSQq4O52vVr1yc0Nqnlb6nUCKrQPlX-ZxfgoSu8fNvPDO2peI-ay-xbuohs6cFf__SUkSE9PX95QBFX13LxWLA=s16000
Now we have two port knocking contexts: 10000 and 4444. Remember that we obtained a link to a login page earlier? We immediately checked that URL but found nothing interesting. So, we looked at the source code. We found an image called 3.jpg that might provide some insight into the problem.
https://blogger.googleusercontent.com/img/a/AVvXsEjUQ73dkIia9EO5R77nxiP9mRfgL9NYzYd0tXdcBhfhKS9YVkE-Ok9TaQ-YHSzkv8YbUiaRQcyBtprc2wAFFnP8fkHAsfuuErceIodB3hMEQlMRIxaaIygncjm4K57foKqH8D0WwIbui1qkT_nqniu6rhcUEnA8WylMzPUzsBEw_G_EvqviuKwvVYb8DQ=s16000
We looked at that image, but there was nothing unusual about it. We’ll have to think beyond the box.
https://blogger.googleusercontent.com/img/a/AVvXsEju1fwyTWbGTIQo_nmuPKXadl8_ZvhYbE4FaOVTxAz5CIj_FDRtQw7KlueubQcAKGPlBEuu8DBKzGLKO7VWimOZZM-I3XzuVz4nA7smSAk7AZlnKt3KlxEgq7XkfuSHa8DDSK0scWIzpyjzGCvatlTMxOVcT6_CgztHp1y2Ru0DO5MfNz84f01WaZzL_w=s16000
It might have something, so we considered steghide, which could be useful in certain situations. For our image file, we now provide the steghide tool. Hurray!! We received a top-secret text file.
steghide extract -sf 3.jpg
To explore this file, we use the cat command. Congratulations!! 65535 is our third context of port knocking.
cat steganopayload48505.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgaW5gIjfhX1cFYtylI_IZle-QWiOcUq0ZjjPaZfIsOfOyi1wXaD7CjMPD79HZvGjaSVQrAq8umJDyyFyaGjWnDt0cdEfB3B4QrUWMBkMvnNiHKndrEvm7WkjY_LxKmpumvoNWQRbg0GVBwjCYVhqtL7o5fPk07bjfFR_RM3CgOZExn9VdKUNGEL7-DVw=s16000
We’re now ready to perform port knocking. We’re good to go if we use this command in conjunction with our context.
knock 192.168.1.185 10000 4444 65535
We run a nmap scan after port knocking to see what results we get. As you can see, the ssh port has been opened.
nmap -sV 192.168.1.185
https://blogger.googleusercontent.com/img/a/AVvXsEj4XJ8il2EhcF72wFhFketOyAtyYJDbwGmqFUyR-5wPOH3b4qu2f7W0XDWYvm_cKHxElmiz2qXLtLiUaj1eurO6B6RH7ylPby9gfRz9eAkdnshBsNjQ_XW38_i8uN_9UvjpCiEJVRH366AJVxd8P4_Z-3B3Da_sqwJ5KflFSgOxUAVbjdnS-aPfX_p0eg=s16000 ExploitationNow we’re ready to attempt exploitation using the information we gained from previous outcomes, including a user name gained from source code. Let’s try a brute force attack with the word list we stored for later.
Let’s use the hydra to[...]
___________________________
@hacking_Attack
@Hacking_Video
Let’s look at the second config directory; we found a file called 1.txt. We ran this file through the browser and discovered some essential but mysterious context.
https://blogger.googleusercontent.com/img/a/AVvXsEj0utZBhOMYO_pXGcaN-_Vjvj3r_qrsqim8JJz4ILThIQFglyv1lCG475WzxQlLN4EAyeuwnuzy4PjQLN63TC4OGcsMOysI8BHLwuB6bIWzvqgoBQuVeiwcRNEUtFYtk3mgkNyx9s-9kNV4BscJQWd6Czins-VsDu7D5T96r8XVKfDFQn-OyR7WGr9xww=s16000
As a result, we attempt to decode this text using the following command.We received our first text of port knocking after recovering the initial text (10000).
echo MTAwMDA= | base64 -d
https://blogger.googleusercontent.com/img/a/AVvXsEgonhSm44bJZc5fmvbpi7g0RqmAaT9UjwllWkObLO-EALHuV89yRKLUcvcQLbsYJa-HBFm4Lj2nAVgj17ibVlY3gh4gbNn5nSWhr8UxDsF9DI346MFJTiTqJBFRri4noWeSblQlQ_D5oPb6vWtTwTLYZHPvChQz-Ci0HDMIBSS5wcLP5W2qmoiLx-Z8cg=s16000
When we checked the third one (CSS directory), we got another text file called 2.txt. where we obtained an enumeration of brain fucks.
https://blogger.googleusercontent.com/img/a/AVvXsEjmFUIY0qp3UIHI8_LU04ORswWN8T1iEFPQAIW0rzjh6K3o5F2DCXwOgZoKIuDP2-51BLV5rCpfR8ygyZpRd_My1sbZPOkfMfb3NBrhjM7BM356R_OqcG9cuzrh8us3BLR2B1i6cnn9OzfU9dolL1U367em0opfsMyKROCPxY8wi4skQJneo9eXpzQLIA=s16000
So, we checked the brain fuck decoder online and recovered the second context (4444) of port knocking activity by providing them with our text.
https://blogger.googleusercontent.com/img/a/AVvXsEg53JmRn9-a9LhwhtHVjUYE16CsWxDXW3rohNyCX4luBpoSykts6FCjdKqHlAACkDDu5twYYiD8a7OyR4kd3e72Vbdns8xRsBIgmUenLSQq4O52vVr1yc0Nqnlb6nUCKrQPlX-ZxfgoSu8fNvPDO2peI-ay-xbuohs6cFf__SUkSE9PX95QBFX13LxWLA=s16000
Now we have two port knocking contexts: 10000 and 4444. Remember that we obtained a link to a login page earlier? We immediately checked that URL but found nothing interesting. So, we looked at the source code. We found an image called 3.jpg that might provide some insight into the problem.
https://blogger.googleusercontent.com/img/a/AVvXsEjUQ73dkIia9EO5R77nxiP9mRfgL9NYzYd0tXdcBhfhKS9YVkE-Ok9TaQ-YHSzkv8YbUiaRQcyBtprc2wAFFnP8fkHAsfuuErceIodB3hMEQlMRIxaaIygncjm4K57foKqH8D0WwIbui1qkT_nqniu6rhcUEnA8WylMzPUzsBEw_G_EvqviuKwvVYb8DQ=s16000
We looked at that image, but there was nothing unusual about it. We’ll have to think beyond the box.
https://blogger.googleusercontent.com/img/a/AVvXsEju1fwyTWbGTIQo_nmuPKXadl8_ZvhYbE4FaOVTxAz5CIj_FDRtQw7KlueubQcAKGPlBEuu8DBKzGLKO7VWimOZZM-I3XzuVz4nA7smSAk7AZlnKt3KlxEgq7XkfuSHa8DDSK0scWIzpyjzGCvatlTMxOVcT6_CgztHp1y2Ru0DO5MfNz84f01WaZzL_w=s16000
It might have something, so we considered steghide, which could be useful in certain situations. For our image file, we now provide the steghide tool. Hurray!! We received a top-secret text file.
steghide extract -sf 3.jpg
To explore this file, we use the cat command. Congratulations!! 65535 is our third context of port knocking.
cat steganopayload48505.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgaW5gIjfhX1cFYtylI_IZle-QWiOcUq0ZjjPaZfIsOfOyi1wXaD7CjMPD79HZvGjaSVQrAq8umJDyyFyaGjWnDt0cdEfB3B4QrUWMBkMvnNiHKndrEvm7WkjY_LxKmpumvoNWQRbg0GVBwjCYVhqtL7o5fPk07bjfFR_RM3CgOZExn9VdKUNGEL7-DVw=s16000
We’re now ready to perform port knocking. We’re good to go if we use this command in conjunction with our context.
knock 192.168.1.185 10000 4444 65535
We run a nmap scan after port knocking to see what results we get. As you can see, the ssh port has been opened.
nmap -sV 192.168.1.185
https://blogger.googleusercontent.com/img/a/AVvXsEj4XJ8il2EhcF72wFhFketOyAtyYJDbwGmqFUyR-5wPOH3b4qu2f7W0XDWYvm_cKHxElmiz2qXLtLiUaj1eurO6B6RH7ylPby9gfRz9eAkdnshBsNjQ_XW38_i8uN_9UvjpCiEJVRH366AJVxd8P4_Z-3B3Da_sqwJ5KflFSgOxUAVbjdnS-aPfX_p0eg=s16000 ExploitationNow we’re ready to attempt exploitation using the information we gained from previous outcomes, including a user name gained from source code. Let’s try a brute force attack with the word list we stored for later.
Let’s use the hydra to[...]
___________________________
@hacking_Attack
@Hacking_Video