Why we need of Virtualization technology ?

Virtualization technology is a way to create multiple virtual versions of a physical computer or other hardware resources, such as a server or network. This is done by using specialized software, called a hypervisor or virtual machine monitor, which creates a layer of abstraction between the hardware and the virtual machines.

Virtualization technology allows multiple operating systems to run on a single physical machine simultaneously, without interfering with each other. Each virtual machine has its own virtualized hardware, including CPU, RAM, storage, and network interfaces, and can run its own applications and services as if it were a physical machine.

Virtualization technology has many benefits, including improved hardware utilization, easier software deployment, increased flexibility, and improved disaster recovery capabilities. It is widely used in data centers and cloud computing environments, as well as in desktop and mobile computing environments.

How to enable virtualization technology in bios?

The steps to enable virtualization technology in BIOS may vary slightly depending on the motherboard and BIOS version, but generally, the following steps should work:

   

# Start or restart your computer and enter the BIOS setup by pressing the appropriate key during the boot process (this key is usually displayed on the screen, and commonly it's F2 or Del key).
 

# Navigate to the "Advanced" or "System Configuration" or "Security" tab, depending on your motherboard manufacturer and BIOS version.

# Look for an option called "Intel Virtualization Technology", "Intel VT-x", "Virtualization Extensions", "AMD-V", or something similar.

# Change the setting to "Enabled" or "On".

# Save the changes and exit the BIOS setup.

    Restart your computer and the virtualization technology should now be enabled.

It's important to note that not all CPUs support virtualization technology, and some older motherboards or BIOS versions may not have this option. Also, be aware that enabling .

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

G-R-U-B

GRUB (short for Grand Unified Bootloader) is a popular boot loader used on many Linux and Unix-like operating systems. It is responsible for loading the operating system kernel and other necessary files, and it is typically the first software component that runs when a computer boots up.

GRUB provides a menu interface that allows the user to select which operating system or kernel to boot, and it supports a wide range of file systems, including the popular ext4 file system used by many Linux distributions. It also allows users to specify boot options, such as kernel parameters or alternate boot locations.

Also Read - FAT32 vs NTFS

One of the advantages of GRUB is its flexibility and configurability. It can be customized to meet specific system requirements, and it is often used as part of the boot process for custom Linux distributions and other specialized systems. Additionally, GRUB is open source software, meaning that its source code is freely available for inspection and modification by developers and users.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

One is fat and the other is nuts

FAT file allocation table or FAT mark was created by Donald in 1977.


File size: FAT32 has a maximum file size limit of 4GB, whereas NTFS can support much larger file sizes, up to 16 exabytes (EB).

Partition size: FAT32 has a maximum partition size of 8TB, while NTFS has a maximum partition size of 256TB.

And after this FAT32 came and FAT32 means that the data is saved in 32 bits chunks and the new technology file system was created by Microsoft and IBM together, It was introduced in the Windows NT platform in 1993, since then it is seen in the Windows based server operating system Windows XP and subsequent operating systems, so let's take a little more information about these two and between them Also know what is the difference


In FAT32, the file size can be maximum of 4GB minus 2 bytes, it can create a file of approximately 4GB whereas in NTFS you can.

You can create a file of 244 bytes or 16 terabytes minus 64 kilobytes, that is, the maximum size of an NTFS file is around 16 terabytes.

FAT32 systems are less fault tolerant, the operating system maintains 2 copies of the file allocation table and can be restored from a backup if corrupted, such as in case of a power failure, while NTFS provides more fault tolerance. Is and maintains the law of changes in this disk and tries to repair any corruption such as if there is a power failure, NTFS auto repairs the file system and that too in the background so that in most cases Doesn't know if this auto repair feature is repairing NTFS or not

Apart from this, FAT32 systems are less secure, only share permissions are available for this security, due to which your systems are secured from the network, that is, the upper stored data of your system can be accessed only with permissions but This does not happen locally and all the files stored on the device that you will be accessing the systems And can use the folder in any way, while NTFS is a very secure system, with the help of file permissions, you can define which users can access the locally kept files and folders to what extent. Yes, NTFS provides security both locally and over the network


FAT32 does not have any compression features i.e. you cannot save space by compressing the data.

While NTFS provides compression features

Apart from this, you can convert your FAT32 system to FAT32 at any time while you cannot convert NTFS to FAT32.

In NTFS and FAT32 you can choose the file system according to your requirement where FAT32 is simple file system and It is popular in storage media like memory cards, USB pen drives and MP3 players or flash drives because of its simplicity but you need features like security and compression, in our case you have to choose NTFS.

 

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

301 and 302?

you have a website you have a domain!! What happens if after a while you decide that you don't like that domain name what do you do ?


Hello Guys i'm Atul from behalf of Hacking Truth and today i'm going to be explaining how you can use 301 and 302 redirects as well as what's the difference between them so first of!!


If you have a domain name let's say you started out with  kumaratuljaiswal.in  and you decided you know what i have these sixteen letter domain names they're too long i actually want a two letter domain name i just want kumaratuljaiswal.in if you decide that it's too long and you're gonna change from kumaratuljaiswal.in to kumaratul.in you wanna do what's called a 301 redirect a 301 redirect tells google that hey we've changed names we have a new domain name take all our existing rankings from this site and transfer it  over to this new site and they do that it roughly takes anywhere from a few weeks to sometimes up to a few months to fully kick in but when you do a 301 redirect you're telling
google we've permanently moved.

Think of it as changing an address when you move locations a new apartment a new home you're telling the postal service that hey i've changed locations and now they forward all mail to your new address the same thing happens when you use a 301 redirect a 302 redirect on the other hand is telling google hey we've temporarily changed locations think of it as you're going to a summer home and you're staying there so you want your mail forwarded there for a few months and then you're going to go back to your original home that's the same way it works on the web with the 302 redirect in which let's say you offer winter products and summer products so your domain name is kumaratuljaiswal.in/summer and you
decide that hey summer's over we're now going to shift into winter products well you can do a 302 redirect saying hey we've moved kumaratuljaiswal.in/summer to kumaratuljaiswal.in/winter that tells google hey temporarily send all the traffic and the rankings etc to kumaratuljaiswal.in/winter now in the eyes of google they said recently that they start looking at 301 redirects and 302 redirects the same but not all search engines do this if you do a permanent move use a 301 and if you're doing a temporary move use a 302 redirect.




You can do this for whole domain names and you can do this for web URLs as well so it could be web pages on your site subdirectory subdomains etc if you're going to do this i could say hey here's how to
do it but i don't recommend that you actually do the redirects yourself unless you're technical i did this with my own website kumaratuljaiswal.in/br i made a mistake with my 301 redirects and you know what i eventually fixed it but my traffic didn't bounce back it went to 90 percent of where it was it took roughly 3 months to recuperate most the traffic.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Python is a general purpose programming language that is often applied in scripting roles.So, Python is programming language as well as scripting language. Python is also called as Interpreted language.

Lets start with question no 1 python assignment.

1. Write a program to create a class, constructor and functions to accept and display the values.

#!/usr/bin/python3

class Atul:

     def __init__(self):
          self.x = input("Enter firstname ")
          self.y = input("Enter lastname ")
     def show(self):
         print("Your firstname is : " , self.x)
         print("Your lastname is : " , self.y)

obj = Atul()
obj.show()

2. WAP using Dictionary to store userid and password and validate the user based on userid and password.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ cat second.py       
#!/usr/bin/python3

from getpass import getpass
import time

a = input("Enter username ")
b = getpass("Enter password ")

#key = [1, 2, 3]
#value = {"java", "android", "web development"}

stored = dict.fromkeys({a},b)

#print(stored)



username = input("Enter username : ")

if username in stored:
   password = input("Enter password : ")
   if stored[username] == password :
      print("Please wait a seond for checking userid and password...")
      time.sleep(2)
      print("Username and password match")
   else:
      print("user entered the wrong password")
else:
    print("your username is not registered")


                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ 

3. Write a program to create a user defined exception in python and handle the exception using user defined class.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ cat third3.py 
class ValueError(Exception):
    pass
try:
    age= 10
    print("Age is:")
    print(age)
    if age<=0:
        raise ValueError
    yearOfBirth= 2021-age
    print("Year of Birth is:")
    print(yearOfBirth)
except ValueError:
    print("Input Correct age.")
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ 

4. Write a program to start different executable files of system such as calculator, notepad, msword etc.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ cat fourth2.py
#!/usr/bin/python3

import os
import subprocess

def Exitapp():
     exit()

application = []
while(True):
       print("1 for notepad.exe ")
       print("2 for calc.exe ")
       print("3 for notepad.exe ")
       print("4 for cmd.exe ")
       print("5 for exit ")


name = int(input("Enter your choice"))

if(num == 1):
    os.system(application)
elseif(num == 2):
    os.system(application)
elseif(num == 3):
    os.system(application)
elseif(num == 4):
    os.system(application)
elseif(num == 5):
    Exitapp()


                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ 

5. Write a menu-driven program to find the area of a circle, square and rectangle in python.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ cat fifth.py  
#!/usr/bin/python3
import sys
import os
from colorama import Fore, Back, Style

print("\n****************************************")
print("Menu Driven Program")
print(Fore.LIGHTWHITE_EX + "1 For Area of Circle")
print(Fore.LIGHTGREEN_EX + "2 For Area of Square")
print(Fore.LIGHTWHITE_EX + "3 For Area of Rectangle")
print(Fore.LIGHTGREEN_EX + "4 For Quit")
print("****************************************\n")


num=int(input("Enter your choice:"))

if num==1:
   radius=int(input("Enter radius of Circle:"))
   print("Area of Circle",3.14*radius*radius)
     
elif num==2:
     length=int(input("Enter length of Rectangle:"))
     breadth=int(input("Enter breadth of Rectangle:"))
     print("Area of Rectangle:",length*breadth)
     
elif num==3:
     side=int(input("Enter side of Square:"))
     print("Area:",side*side)

elif num==4:
     sys.exit() #break
else:
     print("Wrong Choice")

repeat=input("Do you want to continue? (y/n)")
if repeat=='n'or repeat=='N':
    sys.exit() #break
else:
    os.system("python3 fifth.py")
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ 

6. Write a program to insert, update, delete and display the values using dictionary in python.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ cat sixth.py 
#!/usr/bin/python3

import time

a = input("Enter the key attribute : ")
b = input("Enter the value of key attribute : ")

dict = {}



#for insert an element

dict_append = ({a,b})
#key = [a, a, a]
#print(dict_append, key)
print(dict_append)

print("Please wait a second")
time.sleep(2)
print("Now we will use update")

#for update an element
stored = dict.update({a:b})
dict['salary'] = 1000
print("Updated Dict is: ", dict)
print(stored)


#for delete an element
sixMonths = {1:31, 2:28, 3:31, 4:30, 5:31, 6:"joker"}
print(sixMonths.popitem())
print(sixMonths)

                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ 

7. Create a Digital clock using tkinter in python.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ cat seventh.py
#!/usr/bin/python3

from tikinter import *
import time

win = Tk()
win.title("Digital Clock")
win.geometry("400 x 150")
label = label(win.font="Arial", 60, "bold", bg="yellow", font="red", col=25)

label.grid(row=0, column=1)

def clock():
    t1.time.strftime("%H:%M%S")
    label.config(text=t1)
    label.after(1000, clock)

clock()
win.mainloop()

                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ 

8. Write a program to insert, delete and displaying elements in ascending and descending order using List data type in python.

# List implementation to perform insert, delete and display operations in ascending and descending order

# function to insert elements in the list
def insert_elements(my_list, element):
    my_list.append(element)
    print("Element inserted successfully.")

# function to delete elements from the list
def delete_element(my_list, element):
    if element in my_list:
        my_list.remove(element)
        print("Element deleted successfully.")
    else:
        print("Element not found in the list.")

# function to display elements in ascending order
def display_ascending_order(my_list):
    my_list.sort()
    print("Elements in ascending order:")
    print(*my_list)

# function to display elements in descending order
def display_descending_order(my_list):
    my_list.sort(reverse=True)
    print("Elements in descending order:")
    print(*my_list)

# main function
def main():
    my_list = []
    while True:
        print("1. Insert elements")
        print("2. Delete elements")
        print("3. Display elements in ascending order")
        print("4. Display elements in descending order")
        print("5. Exit")
        choice = int(input("Enter your choice: "))
        if choice == 1:
            element = int(input("Enter the element to be inserted: "))
            insert_elements(my_list, element)
        elif choice == 2:
            element = int(input("Enter the element to be deleted: "))
            delete_element(my_list, element)
        elif choice == 3:
            display_ascending_order(my_list)
        elif choice == 4:
            display_descending_order(my_list)
        elif choice == 5:
            break
        else:
            print("Invalid choice.")

# driver code
if __name__ == '__main__':
    main()

9. Write a program to create a PhoneBook using Dictionary for adding, updating, searching and deleting phone Numbers.

# PhoneBook using Dictionary

# function to add a new contact to the phonebook
def add_contact(phonebook, name, number):
    phonebook[name] = number
    print("Contact added successfully.")

# function to update an existing contact in the phonebook
def update_contact(phonebook, name, number):
    if name in phonebook:
        phonebook[name] = number
        print("Contact updated successfully.")
    else:
        print("Contact not found.")

# function to search for a contact in the phonebook
def search_contact(phonebook, name):
    if name in phonebook:
        print(name, ":", phonebook[name])
    else:
        print("Contact not found.")

# function to delete a contact from the phonebook
def delete_contact(phonebook, name):
    if name in phonebook:
        del phonebook[name]
        print("Contact deleted successfully.")
    else:
        print("Contact not found.")

# main function
def main():
    phonebook = {}
    while True:
        print("1. Add Contact")
        print("2. Update Contact")
        print("3. Search Contact")
        print("4. Delete Contact")
        print("5. Exit")
        choice = int(input("Enter your choice: "))
        if choice == 1:
            name = input("Enter name: ")
            number = input("Enter phone number: ")
            add_contact(phonebook, name, number)
        elif choice == 2:
            name = input("Enter name: ")
            number = input("Enter phone number: ")
            update_contact(phonebook, name, number)
        elif choice == 3:
            name = input("Enter name: ")
            search_contact(phonebook, name)
        elif choice == 4:
            name = input("Enter name: ")
            delete_contact(phonebook, name)
        elif choice == 5:
            break
        else:
            print("Invalid choice.")

# driver code
if __name__ == '__main__':
    main()

10. WAP in python to store students details in csv file.

#!/usr/bin/python

import csv 

header = ['sname', 'class', 'roll no', 'subject']

data = [['Atul', 'MCA', 67], ['Khushboo', 'MCA', 64], ['Priya', 'MCA', 64], ['Tinki', 'MCA', 14], ['Umesh', 'MCA', 66], ['Muskan', 'MCA', 8], ['Sweta', 'MCA', 9]]

filename = 'student_data.csv'

with open(filename, 'w') as file:
     for header in header:
         file.write(str(header) + ', ')
     file.write('\n')
     for row in data:
         for x in row:
             file.write(str(x) + ',')
             file.write('\n')

11. WAP in python to create a decorator and decorate a function.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$ cat eleventh.py                                                                                                                                                 1 ⚙
#!/usr/bin/python3

def decorator_function(func):
    def wrapper_function(*args, **kwargs):
        print("Wrapper function executed before {}".format(func.__name__))
        result = func(*args, **kwargs)
        print("Wrapper function executed after {}".format(func.__name__))
        return result
    return wrapper_function

@decorator_function
def display_info(name, age):
    print("Displaying information:")
    print("Name: {}".format(name))
    print("Age: {}".format(age))

display_info("Atul", 30)
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/rnc-university-mca/mca-3rdsem-python]
└─$                                                                                                                                                                 1 ⚙

12. WAP in python to insert, update, display and delete data in mysql database.

import mysql.connector

# Connect to the database
conn = mysql.connector.connect(
    host="hostname",
    user="username",
    password="password",
    database="database_name"
)

# Create a cursor to execute SQL commands
cursor = conn.cursor()

# Insert data
sql_insert = "INSERT INTO table_name (column1, column2) VALUES (%s, %s)"
val = ("value1", "value2")
cursor.execute(sql_insert, val)
conn.commit()

# Display data
sql_select = "SELECT * FROM table_name"
cursor.execute(sql_select)
rows = cursor.fetchall()
for row in rows:
    print(row)

# Update data
sql_update = "UPDATE table_name SET column1 = %s WHERE column2 = %s"
val = ("new_value1", "value2")
cursor.execute(sql_update, val)
conn.commit()

# Delete data
sql_delete = "DELETE FROM table_name WHERE column2 = %s"
val = ("value2",)
cursor.execute(sql_delete, val)
conn.commit()

# Close the cursor and connection
cursor.close()
conn.close()

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Here's one cool tip for reducing the amount of code needed to create an if else check suppose you have some weather and you want to create a message depending on the weather that you have so if the weather is clear we'll make the message nice otherwise we'll make the message uh oh and all we want to do is print that message if we run it as it is we'll get nice back because right now the
weather is clear but this took four lines of code and we can actually reduce this to one by using Python's ternary operator.

weather: str = 'CLEAR'
weather: str = ''

if weather == 'CLEAR':
   message = 'Nice'
else:
   message = 'Uh oh...'

print(message)

so instead let's type message of type string it's going to equal nice if the weather is equal to clear else we'll type in uh oh so this reduced the same statement to a single line and if we run it we'll have the exact same result a simple way to look at this is do this if the Boolean is true else do this and that's the secret to using the ternary operator syntax in Python.

weather: str = 'CLEAR'
weather: str = ''

message: str = 'Nice!' if  weather == 'Clear' else 'Uh oh...'

print(message)

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Enumeration is the first step you have to take once you gain access to any system. You may have accessed the system by exploiting a critical vulnerability that resulted in root-level access or just found a way to send commands using a low privileged account. Penetration testing engagements, unlike CTF machines, don't end once you gain access to a specific system or user privilege level.
As you will see, enumeration is as important during the post-compromise phase as it is before.

hostname

The hostname command will return the hostname of the target machine. Although this value can easily be changed or have a
relatively meaningless string (e.g. Ubuntu-3487340239), in some cases, it can provide information about the target system’s
role within the corporate network (e.g. SQL-PROD-01 for a production SQL server).

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ hostname              
KumarAtulJaiswal
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

uname -a

Will print system information giving us additional detail about the kernel used by the system. This will be useful when searching for any potential kernel vulnerabilities that could lead to privilege escalation.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ uname -a
Linux KumarAtulJaiswal 5.18.0-kali2-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20) x86_64 GNU/Linux
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

/proc/version

The proc filesystem (procfs) provides information about the target system processes. You will find proc on many different Linux
flavours, making it an essential tool to have in your arsenal.


Looking at /proc/version may give you information on the kernel version and additional data such as whether a compiler (e.g. GCC)
is installed.

                                                                                                                                                             
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ cat /proc/version                                       
Linux version 5.18.0-kali2-amd64 (devel@kali.org) (gcc-11 (Debian 11.3.0-3) 11.3.0, GNU ld (GNU Binutils for Debian) 2.38) #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

/etc/issue

Systems can also be identified by looking at the /etc/issue file. This file usually contains some information about the operating system but can easily be customized or changes. While on the subject, any file containing system information can be customized or changed. For a clearer understanding of the system, it is always good to look at all of these.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ cat /etc/issue     
Kali GNU/Linux Rolling \n \l

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

ps Command

The ps command is an effective way to see the running processes on a Linux system. Typing ps on your terminal will show processes for the current shell.

The output of the ps (Process Status) will show the following:

• PID: The process ID (unique to the process)
• TTY: Terminal type used by the user
• Time: Amount of CPU time used by the process (this is NOT the time this process has been running for)
• CMD: The command or executable running (will NOT display any command line parameter)

The “ps” command provides a few useful options.

• ps -A: View all running processes
• ps axjf: View process tree (see the tree formation until ps axjf is run below)

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ ps aux                
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.2 167472  9832 ?        Ss   11:06   0:02 /sbin/init splash
root           2  0.0  0.0      0     0 ?        S    11:06   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_gp]
root           4  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_par_gp]
root           5  0.0  0.0      0     0 ?        I<   11:06   0:00 [netns]
root           7  0.0  0.0      0     0 ?        I<   11:06   0:00 [kworker/0:0H-events_highpri]
root           9  0.0  0.0      0     0 ?        I<   11:06   0:02 [kworker/0:1H-events_highpri]
root          10  0.0  0.0      0     0 ?        I<   11:06   0:00 [mm_percpu_wq]
root          11  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_kthread]
root          12  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_rude_kthread]
root          13  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_trace_kthread]
root          14  0.0  0.0      0     0 ?        S    11:06   0:01 [ksoftirqd/0]
root          15  0.1  0.0      0     0 ?        I    11:06   0:22 [rcu_preempt]
root          16  0.0  0.0      0     0 ?        S    11:06   0:00 [migration/0]

env

The env command will show environmental variables.

 

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ env                                                                                                                      
COLORFGBG=15;0
COLORTERM=truecolor
COMMAND_NOT_FOUND_INSTALL_PROMPT=1
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
DESKTOP_SESSION=lightdm-xsession
DISPLAY=:0.0
DOTNET_CLI_TELEMETRY_OPTOUT=1
GDMSESSION=lightdm-xsession
GDM_LANG=en_IN.utf8
GTK_MODULES=gail:atk-bridge
HOME=/home/hackerboy
LANG=en_IN
LANGUAGE=en_IN:en
LOGNAME=hackerboy
PANEL_GDK_CORE_DEVICE_EVENTS=0
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
POWERSHELL_TELEMETRY_OPTOUT=1
POWERSHELL_UPDATECHECK=Off
PWD=/home/hackerboy
QT_ACCESSIBILITY=1
QT_AUTO_SCREEN_SCALE_FACTOR=0
QT_QPA_PLATFORMTHEME=qt5ct
SESSION_MANAGER=local/KumarAtulJaiswal:@/tmp/.ICE-unix/1092,unix/KumarAtulJaiswal:/tmp/.ICE-unix/1092
SHELL=/usr/bin/zsh
SSH_AGENT_PID=1147
SSH_AUTH_SOCK=/tmp/ssh-XXXXXXAg7KOV/agent.1092
TERM=xterm-256color
USER=hackerboy
WINDOWID=0
XAUTHORITY=/home/hackerboy/.Xauthority
XDG_CONFIG_DIRS=/etc/xdg
XDG_CURRENT_DESKTOP=XFCE
XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share
XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/hackerboy
XDG_MENU_PREFIX=xfce-
XDG_RUNTIME_DIR=/run/user/1000
XDG_SEAT=seat0
XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0
XDG_SESSION_CLASS=user
XDG_SESSION_DESKTOP=lightdm-xsession
XDG_SESSION_ID=3
XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0
XDG_SESSION_TYPE=x11
XDG_VTNR=7
_JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
SHLVL=1
OLDPWD=/home/hackerboy
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
LESS_TERMCAP_mb=
LESS_TERMCAP_md=                                                                                                                                                       
LESS_TERMCAP_me=                                                                                                                                                       
LESS_TERMCAP_so=
LESS_TERMCAP_se=                                                                                                                                                       
LESS_TERMCAP_us=
LESS_TERMCAP_ue=                                                                                                                                                       
_=/usr/bin/env
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

The PATH variable may have a compiler or a scripting language (e.g. Python) that could be used to run code on the target system or leveraged for privilege escalation.

sudo -l

The target system may be configured to allow users to run some (or all) commands with root privileges. The sudo -l command can be
used to list all commands your user can run using sudo.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ sudo -l                        
[sudo] password for hackerboy: 
Matching Defaults entries for hackerboy on KumarAtulJaiswal:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User hackerboy may run the following commands on KumarAtulJaiswal:
    (ALL : ALL) ALL
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

ls

One of the common commands used in Linux is probably ls.


While looking for potential privilege escalation vectors, please remember to always use the ls command with the -la parameter.
The example below shows how the “secret.txt” file can easily be missed using the ls or ls -l commands.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ls    
check.txt  id_rsa.txt
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ls -la
total 24
drwxr-xr-x   2 hackerboy hackerboy  4096 May 11  2022 .
drwxr-xr-x 138 hackerboy hackerboy 12288 Dec 27 14:35 ..
-rwxrwxrwx   1 hackerboy hackerboy   666 Oct 15  2020 check.txt
-rwxrwxrwx   1 hackerboy hackerboy  1674 Oct 15  2020 id_rsa.txt
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

Id

The id command will provide a general overview of the user’s privilege level and group memberships.
It is worth remembering that the id command can also be used to obtain the same information for another user as seen below.

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ id      
uid=1000(hackerboy) gid=1000(hackerboy) groups=1000(hackerboy),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),119(bluetooth),121(wireshark),134(scanner),142(kaboxer)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

/etc/passwd

Reading the /etc/passwd file can be an easy way to discover users on the system.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd
root:x:0:1:root:/root:/usr/bin/zsh
daemon:x:1:0:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:0:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync

While the output can be long and a bit intimidating, it can easily be cut and converted to a useful list for brute-force attacks.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd | cut -d ":" -f 1
root
daemon
bin
sys
sync
games
man
lp

Remember that this will return all users, some of which are system or service users that would not be very useful. Another approach could be to grep for “home” as real users will most likely have their folders under the “home” directory. 

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd | grep home       
hackerboy:x:1000:1000:hackerboy,,,:/home/hackerboy:/usr/bin/zsh
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

history

Looking at earlier commands with the history command can give us some idea about the target system and, albeit rarely,
have stored information such as passwords or usernames.

ifconfig

The target system may be a pivoting point to another network. The ifconfig command will give us information about the network
interfaces of the system. The example below shows the target system has three interfaces (eth0, tun0, and tun1). Our attacking
machine can reach the eth0 interface but can not directly access the two other networks.

This can be confirmed using the ip route command to see which network routes exist. 

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ip route
default via 192.168.13.125 dev usb0 proto dhcp src 192.168.13.51 metric 100 
192.168.13.0/24 dev usb0 proto kernel scope link src 192.168.13.51 metric 100 
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

netstat

Following an initial check for existing interfaces and network routes, it is worth looking into existing communications. The netstat command can be used with several different options to gather information on existing connections.

• netstat -a: shows all listening ports and established connections.
• netstat -at or netstat -au can also be used to list TCP or UDP protocols respectively.
• netstat -l: list ports in “listening” mode. These ports are open and ready to accept incoming connections. This can be used with the “t” option to list only ports that are listening using the TCP protocol (below).

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

netstat -s: list network usage statistics by protocol (below) This can also be used with the -t or -u options to limit the output to a specific protocol.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -s 
Ip:
    Forwarding: 2
    32791 total packets received
    2 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    32782 incoming packets delivered
    29047 requests sent out
Icmp:
    0 ICMP messages received
    0 input ICMP message failed
    ICMP input histogram:
    0 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
Tcp:
    423 active connection openings
    0 passive connection openings
    2 failed connection attempts
    2 connection resets received
    10 connections established
    21178 segments received
    20463 segments sent out
    94 segments retransmitted
    4 bad segments received
    674 resets sent
Udp:
    11606 packets received
    0 packets to unknown port received
    0 packet receive errors
    10177 packets sent
    0 receive buffer errors
    0 send buffer errors
UdpLite:
TcpExt:
    184 TCP sockets finished time wait in fast timer
    2 packetes rejected in established connections because of timestamp
    213 delayed acks sent
    Quick ack mode was activated 33 times
    9166 packet headers predicted
    1752 acknowledgments not containing data payload received
    1803 predicted acknowledgments
    TCPSackRecovery: 3
    Detected reordering 14 times using SACK
    1 congestion windows fully recovered without slow start
    TCPDSACKUndo: 2
    TCPLostRetransmit: 1
    3 fast retransmits
    TCPTimeouts: 11
    TCPLossProbes: 82
    TCPLossProbeRecovery: 10
    TCPDSACKOldSent: 33
    TCPDSACKOfoSent: 12
    TCPDSACKRecv: 45
    94 connections reset due to unexpected data
    2 connections reset due to early user close
    TCPDSACKIgnoredNoUndo: 24
    TCPSackShiftFallback: 31
    TCPRcvCoalesce: 4786
    TCPOFOQueue: 5029
    TCPOFOMerge: 12
    TCPChallengeACK: 4
    TCPSYNChallenge: 4
    TCPAutoCorking: 38
    TCPSynRetrans: 9
    TCPOrigDataSent: 5683
    TCPHystartDelayDetect: 1
    TCPHystartDelayCwnd: 320
    TCPACKSkippedPAWS: 1
    TCPKeepAlive: 292
    TCPDelivered: 5862
    TCPAckCompressed: 1018
    TCPDSACKRecvSegs: 45
IpExt:
    InOctets: 34605350
    OutOctets: 14722497
    InNoECTPkts: 32749
    InECT0Pkts: 42
MPTcpExt:
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

netstat -tp: list connections with the service name and PID information.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -tp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 192.168.63.167:34046    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:50054    server-18-161-111:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:55010    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:48406    233.90.160.34.bc.:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:38404    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:43460    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:32888    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:43446    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:44862    ec2-3-225-70-247.:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:38596    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:36350    ec2-100-20-114-17:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:57030    201.181.244.35.bc:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:50894    23.58.120.34.bc.g:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:58606    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:34198    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

This can also be used with the -l option to list listening ports (below)

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -ltp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      -                   
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -                   
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

We can see the “PID/Program name” column is empty as this process is owned by another user.

Below is the same command run with root privileges and reveals this information as 2641/nc (netcat)

netstat -i: Shows interface statistics. We see below that “eth0” and “tun0” are more active than “tun1”

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -i   
Kernel Interface table
Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0      1500        0      0      0 0             0      0      0      0 BMU
lo       65536        4      0      0 0             4      0      0      0 LRU
usb0      1500    36151      0      0 0         38299      0      0      0 BMRU
wlan0     1500        0      0      0 0             0      0      0      0 BMU
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

The netstat usage you will probably see most often in blog posts, write-ups, and courses is netstat -ano which could be broken down as follows;

•     -a: Display all sockets
•     -n: Do not resolve names
•     -o: Display timers

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -ano
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 192.168.63.167:50054    18.161.111.125:443      TIME_WAIT   timewait (4.61/0/0)
tcp        0      0 192.168.63.167:55010    142.251.42.41:443       ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.63.167:48406    34.160.90.233:443       TIME_WAIT   timewait (5.55/0/0)

find Command

Searching the target system for important information and potential privilege escalation vectors can be fruitful. The built-in “find” command is useful and worth keeping in your arsenal.

Below are some useful examples for the “find” command.

Find files:

•     find . -name flag1.txt: find the file named “flag1.txt” in the current directory
•     find /home -name flag1.txt: find the file names “flag1.txt” in the /home directory
•     find / -type d -name config: find the directory named config under “/”
•     find / -type f -perm 0777: find files with the 777 permissions (files readable, writable, and executable by all users)
•     find / -perm a=x: find executable files
•     find /home -user frank: find all files for user “frank” under “/home”
•     find / -mtime 10: find files that were modified in the last 10 days
•     find / -atime 10: find files that were accessed in the last 10 day
•     find / -cmin -60: find files changed within the last hour (60 minutes)
•     find / -amin -60: find files accesses within the last hour (60 minutes)
•     find / -size 50M: find files with a 50 MB size

This command can also be used with (+) and (-) signs to specify a file that is larger or smaller than the given size.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ find / -size +100M                
/home/hackerboy/Videos/3.mp4
/home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
/home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
/home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
/home/hackerboy/Documents/sql/rockyou.txt
/home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
/home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
find: ‘/proc/3159/ns’: Permission denied
find: ‘/proc/3166/task/3166/fd’: Permission denied
find: ‘/proc/3166/task/3166/fdinfo’: Permission denied
find: ‘/proc/3166/task/3166/ns’: Permission denied
find: ‘/proc/3166/fd’: Permission denied
find: ‘/proc/3166/map_files’: Permission denied
find: ‘/proc/3166/fdinfo’: Permission denied
find: ‘/proc/3166/ns’: Permission denied
find: ‘/proc/3221/task/3221/fd’: Permission denied
find: ‘/proc/3221/task/3221/fdinfo’: Permission denied
find: ‘/proc/3221/task/3221/ns’: Permission denied
find: ‘/proc/3221/fd’: Permission denied
find: ‘/proc/3221/map_files’: Permission denied
find: ‘/proc/3221/fdinfo’: Permission denied
find: ‘/proc/3221/ns’: Permission denied
find: ‘/proc/3222/task/3222/fd’: Permission denied
find: ‘/proc/3222/task/3222/fdinfo’: Permission denied
find: ‘/proc/3222/task/3222/ns’: Permission denied
find: ‘/proc/3222/fd’: Permission denied
find: ‘/proc/3222/map_files’: Permission denied
find: ‘/proc/3222/fdinfo’: Permission denied
find: ‘/proc/3222/ns’: Permission denied
find: ‘/proc/3316/task/3316/fd/5’: No such file or directory
find: ‘/proc/3316/task/3316/fdinfo/5’: No such file or directory
find: ‘/proc/3316/fd/6’: No such file or directory
find: ‘/proc/3316/fdinfo/6’: No such file or directory
find: ‘/.cache’: Permission denied
/usr/share/burpsuite/burpsuite.jar

The example above returns files that are larger than 100 MB. It is important to note that the “find” command tends to generate errors which sometimes makes the output hard to read. This is why it would be wise to use the “find” command with “-type f 2>/dev/null” to redirect errors to “/dev/null” and have a cleaner output (below).

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ find / -size +100M -type f 2>/dev/null
/home/hackerboy/Videos/3.mp4
/home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
/home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
/home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
/home/hackerboy/Documents/sql/rockyou.txt
/home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
/home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
/home/hackerboy/Documents/iMaHackerBoY/new/kali/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
/home/hackerboy/Documents/rockyou.txt
/home/hackerboy/Documents/import/rainbow table/winrtgen/md5_alpha-numeric#1-7_0_2400x40000000_oxid#000.rt
/home/hackerboy/Documents/import/cerified website for CEH/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf

Folders and files that can be written to or executed from:

•     find / -writable -type d 2>/dev/null : Find world-writeable folders
•     find / -perm -222 -type d 2>/dev/null: Find world-writeable folders
•     find / -perm -o w -type d 2>/dev/null: Find world-writeable folders

The reason we see three different “find” commands that could potentially lead to the same result can be seen in the manual document. As you can see below, the perm parameter affects the way “find” works.

•     find / -perm -o x -type d 2>/dev/null : Find world-executable folders

Find development tools and supported languages:

•     find / -name perl*
•     find / -name python*
•     find / -name gcc*

Find specific file permissions:

Below is a short example used to find files that have the SUID bit set. The SUID bit allows the file to run with the privilege level of the account that owns it, rather than the account which runs it. This allows for an interesting privilege escalation path,we will see in more details on task 6. The example below is given to complete the subject on the “find” command.

•     find / -perm -u=s -type f 2>/dev/null: Find files with the SUID bit, which allows us to run the file with a higher privilege level than the current user.

General Linux Commands

As we are in the Linux realm, familiarity with Linux commands, in general, will be very useful. Please spend some time getting comfortable with commands such as find, locate, grep, cut, sort, etc.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.