The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

tryhackme rp nmap


While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.








Script Categories :- Click Here

TryHackMe :- Click Here


TryHackMe has recently had their 500th user sign up to access varied content from fundamentals of web security to basic reverse engineering. Their self contained virtual classrooms make it easy for users to focus on a particular area by aggregating the necessary information. They want users to focus on the learning instead of spending time scouring the internet for resources! They are a relatively new company, so they are still in the process of creating custom VMs for learning purposes, but more content is being released weekly and their newsletter gives users an insight to whats being released on a weekly basis ahead of time.

Question:

1) First, how do you access the help menu?


         -h           



2) Often referred to as a stealth scan, what is the first switch listed for a ‘Syn Scan’?



        --sS         



3) Not quite as useful but how about a ‘UDP Scan’?


        --sU         




4) What about operating system detection?



        --O         



5) How about service version detection?
   


         --sV       



6) Most people like to see some output to know that their scan is actually doing things, what is the verbosity flag?
 


        --v           






7) What about ‘very verbose’? (A personal favorite)



       --vv        




8)  Sometimes saving output in a common document format can be really handy for reporting, how do we save output in xml format?   -oX



      --oX       



9) Aggressive scans can be nice when other scans just aren’t getting the output that you want and you really don’t care how ‘loud’ you are, what is the switch for enabling this?



        -A        




10) How do I set the timing to the max level, sometimes called ‘Insane’?
   


      -T5        



11) What about if I want to scan a specific port?
   







       -P            




12 )How about if I want to scan every port?


        -p-        



13) What if I want to enable using a script from the nmap scripting engine? For this, just include the first part of the switch without the specification of what script to run.



   --script      






14) What if I want to run all scripts out of the vulnerability category?


    --script  vuln    



15) What switch should I include if I don’t want to ping the host?



         -Pn         

Nmap Scanning

1) Let’s go ahead and start with the basics and perform a syn scan on the box provided. What will this command be without the host IP address?





      nmap  -sS        









2) After scanning this, how many ports do we find open under 1000?






       ANS : 2       



3) What communication protocol is given for these ports following the port number?



      ANS : tcp       





4) Perform a service version detection scan, what is the version of the software running on port 22?



   nmap -sV <ip>   








   ANS : 6.6.1p1   




5) Perform an aggressive scan, what flag isn’t set under the results for port 80?




   nmap -A <ip>  








 ANS: httponly 






6) Perform a script scan of vulnerabilities associated with this box, what denial of service (DOS) attack is this box susceptible to? Answer with the name for the vulnerability that is given as the section title in the scan output. A vuln scan can take a while to complete. In case you get stuck, the answer for this question has been provided in the hint, however, it’s good to still run this scan and get used to using it as it can be invaluable.




 nmap --script vuln <ip> 








 ANS: http-slowloris-check 

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

Video Tutorial :-  

       

I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

 

1) Wayback Machine

The Wayback Machine is a digital archive of the World Wide Web,
founded by the Internet Archive, a nonprofit organization based in San
Francisco. It allows the user to go “back in time” and see what websites
looked like in the past.  CEH v10 4 Wayback Machine (Internet Archive) Alternatives in 2020









URl http://web.archive.org/

2) Archive.today

Archive.fo is online tool that helps you to create a copy of the webpage. This copy will remain online, even if the original page is removed. Best 4 alternative Wayback Machine (Internet Archive)  in 2020


Features:

• This application saves a text and a graphical copy of the page for better accuracy.
• It gives a short link to an unalterable record of any web page.
• This tool allows you to track changes of the website containing job offer, price list, blog post, real estate listing, and so on.
• Saved pages do not contain any malware or popups.

Link: https://archive.fo

3) Perma.cc

Perma.cc is a web archiving app developed and maintained by the Harvard Law School Library. It helps you to create permanent records of the websites.


Features:

• You can delete links within 24 hours after creation.
• It helps you to view archived records through Perma.cc link
• URLs can be inserted via blog or paper articles.
• It enables you to create Parma that visits the website and create a record of the content of that website.
• If the preservation fails, this app will give you options to upload PDF file or image.
• Individuals can get access to permalinks via tiered subscriptions.
• You can assign users to any organization by simply submitting the user's email address into this cloud-based program.

Link: https://perma.cc

4) Stillio

• You can set screenshot frequencies according to your customized duration
• You can add multiple URL at once.
• You can save the screenshot to Dropbox.
• It supports URL sharing.
• This tool enables you to filter URLs by domain.
• You can use custom titles to keep everything organized.
• Stillio helps you to take a screenshot from the website geographic location by identifying it's IP address.
• You can hide unwanted elements like overlays, banners, or cookie popups.

So today we will know about the open source tool that helps in keep anonymous, TorghostNG - Make all your internet traffic anonymized with Tor network. This tool is scripted in python language as you can tell -_- you can help us by subscribing to our youtube channel :. Kumar Atul Jaiswal .: before using the too.

About TorghostNG

TorghostNG is a tool that make all your internet traffic anonymized through Tor network.

Rewritten from TorGhost with Python 3.

TorghostNG was tested on:

•     Kali Linux
•     Manjaro
•     ...

  
  
Privoxy is a non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk. Privoxy has a flexible configuration and can be customized to suit individual needs and tastes. It has application for both stand-alone systems and multi-user networks.
TorghostNG - Make all your internet traffic anonymized with Tor network.

Before you use TorghostNG

• For the goodness of Tor network, BitTorrent traffic will be blocked by iptables. Although you can bypass it with some tweaks with your torrent client disappointed_relieved. It's difficult to completely block all torrent traffic.
• For security reason, TorghostNG is gonna disable IPv6 to prevent IPv6 leaks (it happened to me lmao or whatismyip.live). tor network TorghostNG  - How to anonymize your internet traffic

Installing TorghostNG

•     GNU/Linux distros that based on Arch Linux
•     GNU/Linux distros that based on Debian/Ubuntu
•     GNU/Linux distros that based on Fedora, CentOS, RHEL, openSUSE
•     Solus OS
•     Void Linux
•     Anh the elder guy: Slackware
•     (Too much package managers for one day :v) torghostng

How To Install ?

3) sudo python3 install.py






4) sudo python3 torghostng.py







5) sudo python3 torghostng.py -s -c -id it

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

Video Tutorial :- 

 

A word that is embeded in the mind of every youth in this modern period, and this words attracts these  youths so much that they cannot stop themselves and that is the word that and perhaps you will be the people from me who will get pleasure from inside by hearing the name hacking word and there will be many of you who want to become hackers, so in this modern era it it hacking. The word is very exciting.

so, in via this article website we will know about ethical hacking, I think currently version of Ethical Hacking is in 10 ( CEHv10 ) trend and since many people are involved in preparing for the exam, we want that through this article too you can increase your knowledge in many places and share your knowledge.
Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?

About Hacking

Hacking — Hacking is identifying weakness in computer systems or network to exploit its weakness gain access. Example of hacking :- using password cracking algorithm to gain access to a system.




In mid 80s & 90s, The media termed hacking related to cyber crime as false. Some peacocks then started using the very beautiful word - before moral hacking and it has become ethical hacking. Just ridiculous.



Media falsely related hacking to cyber crime. Some moron then started using a much pretty word — ethical to precede hacking and it’s become Ethical Hacking. Simply ridiculous.



Cyber security training has developed a mushroom over the years. Most of them are just fake. And innocent youth who consider cyber security to be a demanding field of computer science are keen to become a hacker.



No person can become a hacker from a street course like CEH. Nor can one become a successful hacker (LOL) by two or three years of undergraduate or diploma courses. Studying to become a successful security specialist requires a lot of sweaty hours of study and many nights of sleep with many systems.


Those who cannot cope with the CLI should simply move away from the information security field. Also system scripting languages ​​such as bash, csh, sh, perl, python are required to write their own code to deal with the system and talk with the network. By using just the tools available in Kali Linux or using Metasploit etc., it does not mean that you are a good security expert or so-called hacker.


Cyber security is a matter of own experience in dealing with vulnerabilities and threats. I saw many students who successfully completed a hacking course like CEH and still struggle to avoid getting stuck in simple Linux gotchas.

Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?

No, 10th and 12th class marks are not important in hacking career and not only 10th and 12th even graduation/post graduation marks also not important in hacking career. Is 10 and 12th marks are important in the field of ethical hacking mainly in PCM?



You can excel in a cyber security career even without a degree, but you have the passion and determination to break into the system with your skilled mind (unlike the years of skill and patience that you have in films overnight Or do not become hackers in short time.)


If you have a good knowledge on any one of the below

• Network Security
• web applications Security
• Exploit writing
• Reverse engineering
• Wireless Security
• IOT Security then no need of even degrees.

For private companies: Your sound knowledge on concepts is irrespective of the certificate and marks you have obtained after graduation / post graduation. I know that some members (from hacking groups) excel in their hacking careers without a degree.



For government companies : There is a systematic approach so here certificates and marks ( above 60%) matters.


If you are passionate and enthusiastic about security try to learn above any one of concepts deeply then jobs will come after you.





I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

A better Blogger experience on the web

Stats

Posts

Editor

Reading List

Settings

SQL Injection

SQL injection attacks uses SQL websites or web applications. It relies on the strategic injection of malicious code or script into existing queries. This malicious code is drafted with the intention of revealing or manipulating data that is stored in the tables within the database. SQL injection

SQL Injection is a powerful and dangerous attack. It identifies the flaws and vulnerabilities in a website or application. The fundamental concept of SQL injection is to impact commands to reveal sensitive information from the database. Hence, it can result to a high profile attack. How SQL Query works in database and how to hack database

Attack Surface of SQL Injection

Bypassing the authentication
Revealing Sensitive Information
Compromised Data Integrity
Erasing The Database
Remote Code Execution

How SQL Query Works ?

Injection of SQL query will be executed on the server and replied by the response. For example, following SQL Query is requester to the server.

• SELECT  *  FROM  [ Orders ]
• SELECT column1, column2, ....  FROM table_name;

These commands will reveal all information stored in the databse "Oredrs" table. If an organization maintains records of their orders into a database, all information kept in this database table will be extracted by the command.







Try it :- It's a Free 





Otherwise let's understand with another Example



In the following example, an attacker with the username link inserts their name after the = sign following the WHERE owner, which used to include the string 'name'; DELETE FROM items; -- for itemName , into an existing SQL command, and the query becomes the following two queries:

• SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; DELETE FROM items;--

Many of the common database products such as Microsoft’s SQL Server and Oracle’s Siebel allow several SQL statements separated by semicolons to be executed at once. This technique, known as batch execution, allows an attacker to execute multiple arbitrary
commands against a database. In other databases, this technique will generate an error and fail, so knowing the database you are attacking is essential.



If an attacker enters the string 'name'; DELETE FROM items; SELECT * FROM items WHERE   'a' = 'a' ,   the following three valid statements will be created:

• SELECT * FROM items WHERE owner = 'link' AND itemname = 'name'; 

• DELETE FROM items; SELECT * FROM items WHERE 'a' = 'a';

A good way to prevent SQL injection attacks is to use input validation, which ensures that only approved characters are accepted. Use whitelists, which dictate safe characters, and blacklists, which dictate unsafe characters.

Database

SQL Delete Query

The DELETE statement is used to delete existing records in a table. To understand, consider a table "Customers" in a database. The following information is the table "Customers" is containing.






Execution of  "delete" command will eraase the record.

• DELETE FROM Customers WHERE CustomerName='Alfreds Futterkiste';

Now the database table will be like this :-






There are lots of SQL query commands that can be used. Above are some of the most common and effective commands that are being used for injection.
for example :-

• UPDATE Customers SET ContactName = 'KumarAtulJaiswal', city= 'Delhi' WHERE CustomerID = 56;
• INSERT INTO Customers (column1, column2, column3, ...)
  VALUES (value1, value2, value3, ...); 

• Customers is a Table Name.

SQL Injection Tools

There are several tools available for SQL injection such as :-

• BSQL Hacker
• Marathon Tool
• SQL Power Injecto
• Havij

 Server Side Technologies

Server-side technologies come in many varieties and types, each of which offers
something specific to the user. Generally, each of the technologies allows the creation of dynamic and data-driven web applications. You can use a wide range of server-side technologies to create these types of web applications; among them are the following:

• ASP
• ASP.NET
• Oracle
• PHP
• JSP
• SQL Server
• IBM DB2
• MySQL
• Ruby on Rails

All of these technologies are powerful and offer the ability to generate web applications that are extremely versatile. Each also has vulnerabilities that can lead to it being compromised, but this chapter is not about those.



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

Whats app Web How to Enable Dark Mode in a Simple Trick

WhatsApp is a very popular messenger app that is used all over the world and this application exists with a very beautiful web interface.  After accessing it all people can send messages to each other, irrespective of the place of the world.

Recently, WhatsApp had provided a dark mode future to all the users inside its application and all the users are waiting for them to use WhatsApp Dark mode in their browser and according to a report, the dark mod features in the browser of WhatsApp is going to come very soon.  It is currently under development and very soon the users may get to see these features.

That is why, before coming to this features, we are telling you a very good way, with the help of which you can run WhatsApp web in dark mode in your browser.

How To enable This Feature ?

Dark mode features have already been given to many users in WhatsApp applications.  But if you want.  Running WhatsApp in dark mode inside your browser.  For this, there is a very simple way that you have to activate.



#First of all, open the official website of your https://web.whatsapp.com/


#Open WhatsApp Web from the official page web.whatsapp.com.


#Log-in to the web interface: You need to open WhatsApp on your phone > tap on three-dot icons on the top right corner > tap on ‘WhatsApp Web’. Now scan the QR Code on the computer screen with your phone.


#Once you are logged in, right-click on the blank area outside the chat and select ‘Inspect’.


#The browser shows the inspector or console and the code of the page. Now you need to scroll to find the string— body class=“web”






#WABetaInfo said that “web” is the class of the original theme, the one we are currently using. To enable dark mode, we need to replace it with “web dark”.


#Once you replace the string, WhatsApp Web will turn to Dark Mode.



We tried the method and it worked fine for us. However, since changing the string using Inspect on a web page is only for preview purpose, WhatsApp Web will turn to normal mode once you refresh the page or close it.

The WhatsApp tracker also confirmed that the Dark Theme is not yet available and the platform is testing the feature in order to ensure a bug-free experience. Since the feature is under development, it is currently not available in the WhatsApp Web or the WhatsApp Desktop app.



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

Video Tutorial :- SooN

Top 9 phishing Tool for hack a social site, website etc

Today's youth was interested and more is being seen on hacking tomorrow, due to which if no one has technical knowledge.  He can also do hacking using a hacking tool and is a very well-known tool.  Which is called a fishing tool and this tool helps in many different types of fishing attacks. Top 9 Advance phishing Tool for hack a social site, website etc


Here you will be told about different types of fishing attack tools and the first tool is our Evilginx2.

1) EVILGINX2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication.






EVILGINX2 is a  man-in-the-middle attack framework used for fixing login credentials along with session cookies, which in turns allows bypassing two factor authentication production


Github :- https://github.com/kgretzky/evilginx2

2) HIDDEN EYE

Modern Phishing Tool With Advanced Functionality And Multiple Tunnelling Services [ Android-Support-Available ]





Github :- https://www.cyberpunk.rs/hidden-eye-modern-phishing-tool

3) KING PHISHER

King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness training to more complicated scenarios in which user aware content is served for harvesting credentials. Top 9 Advance phishing Tool for hack a social site, website etc










King Phisher is only to be used for legal applications when the explicit permission of the targeted organization has been obtained.


Github :- https://github.com/rsmusllp/king-phisher

See Also :- 

• How To Change MAC Address :- Click Here 

• Find Leaked Email and Password via onion service :- Click Here

4) GOPHISH

Gophish is open source facing toolkit design for business and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagement and security awareness training.






Website :- https://getgophish.com/

5) WIFIPHISHER

Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks. Wifiphisher can be further used to mount victim-customized web phishing attacks against the connected clients in order to capture credentials (e.g. from third party login pages or WPA/WPA2 Pre-Shared Keys) or infect the victim stations with malwares.






Github :-  https://github.com/wifiphisher/wifiphisher

6) BLACK EYE

The most complete phishing tool, with 32 templates+1 customizable.




Github :-  https://github.com/thelinuxchoice/blackeye

7) EDUCATION PHISHING TOOL

Educational Phishing Tool & Information Collector.




Github :- https://github.com/UndeadSec/SocialFish

8) SOCIAL MEDIA PHISHING PAGES

The way phishing works is that an attacker clones a trusted website or spoofs an email of a known target which leads the person to believe that he is visiting a trusted website like social media sites, e.g.,  shellphish github termux Facebook, SnapChat, Instagram, Google, Netflix, and so on. The target will then put his/her username and password on the malicious website (cloned website) and then the username and password will be sent to the attacker instead of the real website, and the target will be redirected to the real website. Let’s do a demo of phishing using shellphish. shellphish github download





Website :- https://www.hackingtruth.in/2019/10/the-linux-choice-shell-phish.html

9) ZPHISHER

Zphisher is an upgraded form of Shellphish. The main source code is from Shellphish. But I have not fully copied it. I have upgraded it & cleared the Unnecessary Files. It has 37 Phishing Page Templates ; including Facebook , Twitter & Paypal. It also has 4 Port Forwarding Tools .







Github :- https://github.com/htr-tech/zphisher






I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)