Nexus

Scan a Website for bugs using Kali Linux Tutorial

Read

Hello i am back with a new tutorial how to scan website for the bugs and vulnerability using BackTrack's uniscan tool. And as we all know that backtrack is specially designed for the security researchers so there are many tools pre installed in the backtrack like sqlmap, uniscan and all.

Follow the simple steps to find the vulnerability in any website !
Now make sure you have opened Backtrack operating system and now just open the terminal and write the bellow code in the terminal and hit okay!

cd /pentest/web/uniscan && ./uniscan.pl

Now you can see the bellow snapshot there are few options are given.

Now we have are going to use the bellow command and make sure you have the website link :)

./uniscan.pl -u http://www.website.com/ –bqdw

And your website’s URL should be end with the forward slash and now just hit enter and then the process will start :)

Now as you can see we got the IP address and the server of the website :) and wait we will get many more information :)

Directory Check: Directory check will check the directories of the website and it will list the directories of the website as shown in the bellow snapshot.

How to scan a website for bugs using backtrack

File check : Now as the name says it will check the files which are hosted in the website.

Now crawler is started it will grab all the email address and externals hosts and all the information

Emails :

External Host:

Web backdoors:

File upload forums :

Now let me tell you that using this tool we can scan the websites for many more vulnerability like sql-i, XSS, remote code execution and many more and you can make few bucks by participating in the bug bounty program :)

Check out: How i got 100$ from Google bugbounty program

Now you can see in the above snapshot the list of the bugs it will find :)
Check out: The list of the bug bounty program !

Now as shown in the above we the website is vulnerable to the blind sqli. :D Mission accomplished :) we have found the bug. if you have any question about this then make a comment :)

Now if you want to get the list of the sites hosted on the same server then simply add this command, just replace the ip address with the server’s ip address. and the list of the websites will be stored in the same directory with the name “sites.txt”

./uniscan.pl -i "ip:127.0.0.1"

and then if you want to scan the list of the website then simply run this command

./uniscan.pl -f sites.txt –bqwd

Now you have done ! :) I hope you have enjoyed this tutorial :)

Read More Add comment

Fern WIFI Cracker - WEP cracking With Kali Linux

By 0x000216

Read

0 Comments

Warning!
If you want to learn about using Aircrack-ng, Linux, network and so on do not use this tutorial. If you just want to crack a WEP network without learning anything this is the tutorial for you!

Fern Wifi Cracker is a GUI for Aircrack-ng, it makes cracking WEP it so damn simple. I’m on Backtrack 4 here and the only thing you will need download and installing Fern Wifi cracker is to open the terminal and use these two commands: (if you on another distro you might need to install some packets first )

Code:
wget http://fern-wifi-cracker.googlecode.com/files/Fern-Wifi-Cracker_1.2_all.deb
dpkg -i Fern-Wifi-Cracker_1.2_all.deb

To start the program go to:

Code:
/usr/share/applicationsFern_Wifi_Cracker.desktop

The first time you open Fern Wifi cracker, you’ll need to update it from 1.2 to version 1.5. You will see the text New update is Available

1. Click the Update button

[Image: snapshot1_tilpasset.png]

Wait for the update to be installed. You will see the text Please Restart application

2. Shutdown the application and start it back up again

[Image: snapshot2_tilpasse.png]

You will now see the text Latest update is already installed

3. Click the dropdown list Select interface

4. Select the interface you want to use

[Image: snapshot3_tilpasse.png]

After a minute a popup will open.

5. Click the Ok bottom

[Image: snapshot4_tilpasse.png]

Optional!
The next part might be unnecessary, but it’s my personally experience that cracking a network with connected client is much easier then without. Since this is a beginner tutorial I will not go in to why.

6. Doubleclick in any area of the main window

7. A window call Access Point Scan Preferences opens

8. Click the Enable XTerms checkbox

9. Click the Ok bottom

[Image: snapshot5_tilpasse.png]

Let’s start sniffing for Accesspoint nearby.

10. Click the Scan bottom

[Image: snapshot6_tilpasse.png]

If you did the part with enabling XTerm - two popups will appear. Since this tutorial will only show WEP cracking you can close the one named FERN (WPA SCAN). Now let’s have a look at the window called FERN (WEP SCAN). We need a accesspoint with a client connected to it. At the top half of the screen we see all the accesspoints in the area, and a lot of information about them. At the bottom of the window we see that a client is connected to a Accesspoint with the BSSID 00:13:f7:61:24:DA. If we compare this list in the top of the screen we will see that the name of this Accesspoint is SMC.So now we know that the accesspoint SMC have a client connected.

11. Close the window FERN (WEP SCAN)

[Image: snapshot7_tilpasse.png]

12. Click the WEP button

The window Fern WEP Attack opens.

13. Click the dropdown list at the top of the window

14. Select the access point SMC that we found before

[Image: snapshot9_tilpasse.png]

15. Click the Attack bottom and wait for the magic to happen.

If you did the part with enabling Xterm, two additional windows will open, just leave them be.

[Image: snapshot10_tilpasse.png]

Sit back and wait for the key to the network to appear!

[Image: snapshot13.png]

Read More Add comment

How to use aircrack-ng Suite Tutorial

By 0x000216

Read

0 Comments

Introduction

Disclaimer: I carried out this attack on my own network, all MAC Addresses and names have been faked. This tutorial is for learning purposes only and should not be used for any illegal activities.

Source LINK

Aircrack-ng is a suite of tools that allows you to monitor, gather packets, inject them and finally crack a networks key in order to gain access. Nearly all wireless networks now use WPA2 for security as you will see WEP security just wont meet the requirements any more.

Most wireless networks will use either WEP or WPA, to be able to crack either of these you will need to have a wireless card that can both monitor and inject packets. I've aimed this tutorial as a step by step for beginners, so if you already know how to setup your wireless card ready for an attack crack on
Step 1 - Setting up your wireless card.

In order to capture network traffic without associating with the target access point we need to set our wireless network card in monitor mode. To do this open a terminal window and type:

Code:

iwconfig

This will find all wireless network interfaces and their current status. In my case its called wlan0. Next you will want to run the command:

Code:

airmon-ng start wlan0

This will set that wireless interface (wlan0) into monitor mode. If you run iwconfig again you will see what looks like another device has appeared, in my case mon0. This is just the monitoring side of your wireless card that we will use for the next step.

Step 2 - Monitoring available access points

Now that you have your wireless card in monitor mode lets check out what AP's are available in our area by running the command:

Code:

airodump-ng mon0

As mentioned in step 1 you will now use mon0 instead of wlan0 to monitor the networks. By running airodump-ng this activates a passive listening mode were we can see all AP's available to you and some details about them. All you need to do now is select a target of your choice, once you have done this note down its Channel and BSSID (MAC address). It is also handy to note down any STATION that is associated with the same BSSID.

Step 3 - Capturing Data

WEP is easy to crack compared to WPA-PSK. This is due to the fact that we only need to capture between 20k and 40k of interesting packets. Cracking WPA-PSK is a little harder as we need to carry out a dictionary attack on a captured handshake between the access point and an associated client.

To capture data from a single access point we run the command:

Code:

airodump-ng -c 6 bssid 00:0F:CC:7D:5A:74 -w HackThis mon0

This is a breakdown of the command we just used

This will capture data on channel 6 only: -c 6

This is the MAC address of our targets access point: bssid 00:0F:CC:7D:5A:74

This saves captured packets into a file called "HackThis" in the current directory: -w HackThis

This just states the wireless adaptor that we have used to carry out the data capture: mon0

Step 4 - How to Increase Traffic

The time taken to capture the data from a target network can vary depending on how many uses are connected and if they are actively using it. Sometimes you may need to speed up this process as the users are inactive and it would take hours to gather the number of packets required to crack the key.

This is were injecting packets comes into play. By injecting packets you will increase the traffic on the wireless network which in turn will reduce the time required to capture the quantity of data we need.
To carry out the next step you will have to open another terminal window and type the command:

Code:

aireplay-ng -3 -b 00:0F:CC:7D:5A:74 -h 00:14:A5:2F:A7:DE -x 50 wlan0

-3 Type of attack, in our case ARP-request replay
-b MAC address of access point
-h MAC address of associated client from airodump-ng
-x 50 Limited to sending 50 packets per second
wlan0 Again our wireless network interface

Step 5 - Cracking the WEP Key

As mentioned earlier WEP cracking is the easiest to do as you only need to collect a certain amount of data. To crack the WEP Key we will run the command:

Code:

aircrack-ng HackThis.cap

Remember that you require around 20k and 40k worth of packets, you can sometimes do it with around 10k packets if the target only had a short key/password.

Step 6 - Cracking WPA or WPA2 PSK

Cracking WPA is similar to WEP up to the point were you are gathering packets. This time you have to wait for is a successful capture of the four-way-handshake association between the access point and a client machine. To do this you set the capture going as in step 3 then either wait for a device to authorise with the AP or my favourite is to de-authenticate a client so that they have to reconnect, essentially booting them off their own network for a fraction of time then capturing the handshake when they reconnect.

To de-authenticate an client you carry out the following command in a separate terminal:

Code:

aireplay-ng --deauth 3 -a APMAC -c ClientMAC mon0

APMAC is the MAC address of the access point
ClientMAC is the MAC address of an associated client

Step 7 - Cracking the WPA Key

Once you have captured a four-way handshake, you will need a large dictionary file, i'll leave that up to you to find.
You then run the command:

Code:

aircrack-ng -w wordlist capture_HackThis

Wordlist is your dictionary file and capture_HackThis is a .cap file with a valid WPA handshake.
The length of time it will take you to crack a WPA key is based on the length of the targets password and the quality of your wordlist/dictionary file.

Points to remember:

[*] Cracking WPA-PSK and WPA2-PSK only needs a handshake
[*] Cracking WPA is CPU intensive so a powerful machine is recommended.
[*] Aquire a good size wordlist (google is your friend here).
[*] WEP requires 20k+ IV packets for a decent shot at decrypting the key.
[*] If your like me you dont fancy using your mac address on an attack you can always spoof it with the macchanger command

Summary of commands used:

airmon-ng - Used to switch the wireless network card to monitor mode.
airodump-ng - Used for monitoring and capturing network packets.
aireplay-ng - Used to generate extra traffic on the wireless network.
aircrack-ng - Used to crack the WEP key, or launch a dictionary attack on WPA-PSK.

And thats it

Nexus

Scan a Website for bugs using Kali Linux Tutorial

Fern WIFI Cracker - WEP cracking With Kali Linux

How to use aircrack-ng Suite Tutorial

Step 2 - Monitoring available access points

Step 3 - Capturing Data

Step 4 - How to Increase Traffic

Step 5 - Cracking the WEP Key

Step 6 - Cracking WPA or WPA2 PSK

Step 7 - Cracking the WPA Key

Points to remember:

Summary of commands used:

tutorial - Web-based LDAPv3 client

tutorial - How To use Yum

Get Rid of/ Remove Lpcloudbox328.com Pop-ups Completely

Recent Posts

Facebook