Browsed by
Category: Tutorials

OSINT: Using Discover Tool For Information Gathering

OSINT: Using Discover Tool For Information Gathering

Well, guys today we are going to look at a very nice open source tool for information gathering. “Discover” tool is used to automate various pentesting tasks. You can find a lot of information(both passive and active) with this tool which you can later use in your pentesting scenario. It provides a well detailed report that you can present to an organization if need be. Here are the steps to install “Discover” tool. git clone https://github.com/leebaird/discover /opt/discover/ All scripts must…

Read More Read More

mac address spoofing: change your mac address with python.

mac address spoofing: change your mac address with python.

The reason hackers would want to change mac address is to gain access to networks while hiding who they really are. Mac spoofing for illegal purposes is beyond my responsibility. In this tutorial we are going to see how we can change the mac address manually(by terminal) and using a simple python program that we are going to write. So lets get started. Go to the terminal and type ifconfig to see list of network adapters we are connected to….

Read More Read More

Remain anonymous online through Kalitorify:

Remain anonymous online through Kalitorify:

We shall see how to set up and use kalitorify to remain anonymous. Kalitorify uses iptables to provide transparent proxy through the tor network for anonymization. It provides prevention against DNS leak. It can redirect all the traffic system through tor. Well, let’s set up kalitorify. Steps: We have to first install “tor” (if not yet installed). Run the following commands prior to installation of Tor: “apt update && apt-get upgrade”. Then we clone kalitorify from the GitHub repository using…

Read More Read More

Burp Suite 5: How to use Repeater in Burp Suite

Burp Suite 5: How to use Repeater in Burp Suite

The repeater is same as the intruder but in the repeater, we can apply payload and select the injection manually. Lets use the same login form as an example. Go to proxy->http history and select the login form and select send to Repeater or ctrl+R. Then go to the Repeater tab. Click on the “Go” to see the response of the website. Lets try to change the value and see the response. See if we change the password as pass…

Read More Read More

Burp Suite 4; How to use intruder for password cracking.

Burp Suite 4; How to use intruder for password cracking.

In this tutorial we are going to see how we can use intruder option in Burp Suite. Intruder helps us to find injection points to inject payloads into the website. In this example we are going to see how to use intruder for password cracking. First of all type the wrong password and enter login. In “http history” we can see I entered the wrong password as “123” and in the response tab we can see error message; “Invalid credentials…

Read More Read More

Burp Suite 3: How to crawl the entire website.

Burp Suite 3: How to crawl the entire website.

Burp Suite spider crawls the entire website that has been targeted on the scope. The spider crawls the entire website thereby mapping the entire structure of the website. Go to spider ->control and make sure Spider scope is set to use suite scope. In the “options” tab we can see the different options. let us take a look at the options presented. In crawler Setting; We can see robot.txt (it specifies which website to crawl and which website not to…

Read More Read More

Burp Suite 2: How To Setup Scope In The Burp Suite.

Burp Suite 2: How To Setup Scope In The Burp Suite.

Open Burp Suite and go to the target and scope tab. Under the “include in scope” click “add” to enter the website you want to test. Under the “exclude from scope” enter the website that you don’t want to test or intercept. For our project we don’t want to exclude anything so leave it as empty. Now go to site map tab. By default, we can see many other websites (subdomains of interest) that have been added for more tests….

Read More Read More

Burp Suite: Pentesting Web Applications vulnerability

Burp Suite: Pentesting Web Applications vulnerability

In this series we are going to use Burp Suite for complete web application testing. Let’s dive in. Tools. Burp suite (Tool to test) – comes pre-installed in Kali Linux but readily available for download. You can visit https://portswigger.net/ to learn more. Mozilla FireFox. BeeBox (Web application we are going to test) ~ it is an extremely buggy web application that we can use to explore all of OWASP top 10 and other web applic ation vulnerabilities. Foxy proxy. VirtualBox/Vmware…

Read More Read More

Nmap + Armitage: Fingerprint your victim network

Nmap + Armitage: Fingerprint your victim network

In the previous tutorial, we did set up Metasploitable and performed basic port scanning using Nmap. Here, we are going to use some advanced nmap options to better perform some advanced scanning. I will also introduce you to Armitarge ~ a GUI for the metasploit framework. Let’s start with getting detection of the OS running on the target machine. We type “nmap –O [ip adress] to see the OS” As we can it gives the OS detail as Linux. Metasploitable…

Read More Read More

Basic Lab Setup for Penetration Testing

Basic Lab Setup for Penetration Testing

In this tutorial we are going to see how we can setup a basic pentest lab and perform port scanning. (I feel this should have been the first post as I encourage every reader here to create a personal pentest lab. Performing unauthorized penetration testing and hacking on other people/organization systems MAY LAND YOU IN JAIL). I will assume you already have Kali Linux installed in VirtualBox. Note: Port Scanning without the prior permission is illegal. So please get office…

Read More Read More