-->

ABOUT US

Our development agency is committed to providing you the best service.

OUR TEAM

The awesome people behind our brand ... and their life motto.

  • Kumar Atul Jaiswal

    Ethical Hacker

    Hacking is a Speed of Innovation And Technology with Romance.

  • Kumar Atul Jaiswal

    CEO Of Hacking Truth

    Loopholes are every major Security,Just need to Understand it well.

  • Kumar Atul Jaiswal

    Web Developer

    Techonology is the best way to Change Everything, like Mindset Goal.

OUR SKILLS

We pride ourselves with strong, flexible and top notch skills.

Marketing

Development 90%
Design 80%
Marketing 70%

Websites

Development 90%
Design 80%
Marketing 70%

PR

Development 90%
Design 80%
Marketing 70%

ACHIEVEMENTS

We help our clients integrate, analyze, and use their data to improve their business.

150

GREAT PROJECTS

300

HAPPY CLIENTS

650

COFFEES DRUNK

1568

FACEBOOK LIKES

STRATEGY & CREATIVITY

Phasellus iaculis dolor nec urna nullam. Vivamus mattis blandit porttitor nullam.

PORTFOLIO

We pride ourselves on bringing a fresh perspective and effective marketing to each project.

Showing posts with label enumeration. Show all posts
Showing posts with label enumeration. Show all posts
  • All about LDAP enumeration

     


     

    LDAP Enumeration



    LDAP stands for light weight directory access protocol and it is an internet protocol for accessing disturbed directory services like active directory or openLDAP etc. A directory service is a hirerchical and logical structure for storing records of users. LDAP is based on client and server transmitted b/w client and server using basic encoding rules (BER).


    LDAP Enumeration - LDAP  supports anonymous remote query on the server. The query will disclose sensitive information such as username, address, contact details, department details etc.



    LDAP Enumeration Tools



    The following table shows the list of tools to perform LDAP enumeration.


    1) Softerra LDAP

    http://www.idapadministrator.com/


    2) Jxplorer

    http://jsxplorer.org/


    3) Active directory domain services management pack for system center

    https://www.microsoft.com/en-in/download/details.aspx?id=21357


    4) LDAP Admin Tool


    http://www.idapadmin.org/


    5) LDAP adminstrator tool

    https://sourceforge.netprojects/idapadmin/



    LDAP Security Controls



    The following are the security controls to prevent LDAP enumeration attacks.

    # Use SSL to encrypt LDAP communication.

    # Use kerberos to restrict the access to known users.

    # Enable account lockout to restrict brute forcing.




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.
     

  • Taxonomy of Reconnaissance

     

    Taxonomy of Reconnaissance

     

    Taxonomy of Reconnaissance

     

    In a red team operation, you might start with no more than a company name, from which you need to start gathering information about the target. This is where reconnaissance comes into play. Reconnaissance (recon) can be defined as a preliminary survey or observation of your target (client) without alerting them to your activities. If your recon activities create too much noise, the other party would be alerted, which might decrease the likelihood of your success.


    Reconnaissance (recon) can be classified into two parts:

    # Passive Recon: can be carried out by watching passively
    # Active Recon: requires interacting with the target to provoke it in order to observe its response.


    Passive recon doesn't require interacting with the target. In other words, you aren't sending any packets or requests to the target or the systems your target owns. Instead, passive recon relies on publicly available information that is collected and maintained by a third party. Open Source Intelligence (OSINT) is used to collect information about the target and can be as simple as viewing a target's publicly available social media profile. Example information that we might collect includes domain names, IP address blocks, email addresses, employee names, and job posts. In the upcoming task, we'll see how to query DNS records and expand on the topics from the Passive Reconnaissance room and introduce advanced tooling to aid in your recon.


    Active recon requires interacting with the target by sending requests and packets and observing if and how it responds. The responses collected - or lack of responses - would enable us to expand on the picture we started developing using passive recon. An example of active reconnaissance is using Nmap to scan target subnets and live hosts. Other examples can be found in the Active Reconnaissance room. Some information that we would want to discover include live hosts, running servers, listening services, and version numbers.



    Active recon can be classified as:


    # External Recon: Conducted outside the target's network and focuses on the externally facing assets assessable from the Internet. One example is running Nikto from outside the company network.

    # Internal Recon: Conducted from within the target company's network. In other words, the pentester or red teamer might be physically located inside the company building. In this scenario, they might be using an exploited host on the target's network. An example would be using Nessus to scan the internal network using one of the target’s computers.


     

     


    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

     

  • All about Enumeration

     

    All about Enumeration



    Enumeration is the first step you have to take once you gain access to any system. You may have accessed the system by exploiting a critical vulnerability that resulted in root-level access or just found a way to send commands using a low privileged account. Penetration testing engagements, unlike CTF machines, don't end once you gain access to a specific system or user privilege level.
    As you will see, enumeration is as important during the post-compromise phase as it is before.



    hostname


    The hostname command will return the hostname of the target machine. Although this value can easily be changed or have a
    relatively meaningless string (e.g. Ubuntu-3487340239), in some cases, it can provide information about the target system’s
    role within the corporate network (e.g. SQL-PROD-01 for a production SQL server).



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ hostname              
    KumarAtulJaiswal
                                                                                                                                                                            
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    uname -a


    Will print system information giving us additional detail about the kernel used by the system. This will be useful when searching for any potential kernel vulnerabilities that could lead to privilege escalation.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ uname -a
    Linux KumarAtulJaiswal 5.18.0-kali2-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20) x86_64 GNU/Linux
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    



    /proc/version


    The proc filesystem (procfs) provides information about the target system processes. You will find proc on many different Linux
    flavours, making it an essential tool to have in your arsenal.


    Looking at /proc/version may give you information on the kernel version and additional data such as whether a compiler (e.g. GCC)
    is installed.


                                                                                                                                                                 
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ cat /proc/version                                       
    Linux version 5.18.0-kali2-amd64 (devel@kali.org) (gcc-11 (Debian 11.3.0-3) 11.3.0, GNU ld (GNU Binutils for Debian) 2.38) #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20)
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    



    /etc/issue


    Systems can also be identified by looking at the /etc/issue file. This file usually contains some information about the operating system but can easily be customized or changes. While on the subject, any file containing system information can be customized or changed. For a clearer understanding of the system, it is always good to look at all of these.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ cat /etc/issue     
    Kali GNU/Linux Rolling \n \l
    
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    
    

    ps Command


    The ps command is an effective way to see the running processes on a Linux system. Typing ps on your terminal will show processes for the current shell.

    The output of the ps (Process Status) will show the following:


    • PID: The process ID (unique to the process)
    • TTY: Terminal type used by the user
    • Time: Amount of CPU time used by the process (this is NOT the time this process has been running for)
    • CMD: The command or executable running (will NOT display any command line parameter)



    The “ps” command provides a few useful options.

    • ps -A: View all running processes
    • ps axjf: View process tree (see the tree formation until ps axjf is run below)


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ ps aux                
    USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
    root           1  0.0  0.2 167472  9832 ?        Ss   11:06   0:02 /sbin/init splash
    root           2  0.0  0.0      0     0 ?        S    11:06   0:00 [kthreadd]
    root           3  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_gp]
    root           4  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_par_gp]
    root           5  0.0  0.0      0     0 ?        I<   11:06   0:00 [netns]
    root           7  0.0  0.0      0     0 ?        I<   11:06   0:00 [kworker/0:0H-events_highpri]
    root           9  0.0  0.0      0     0 ?        I<   11:06   0:02 [kworker/0:1H-events_highpri]
    root          10  0.0  0.0      0     0 ?        I<   11:06   0:00 [mm_percpu_wq]
    root          11  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_kthread]
    root          12  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_rude_kthread]
    root          13  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_trace_kthread]
    root          14  0.0  0.0      0     0 ?        S    11:06   0:01 [ksoftirqd/0]
    root          15  0.1  0.0      0     0 ?        I    11:06   0:22 [rcu_preempt]
    root          16  0.0  0.0      0     0 ?        S    11:06   0:00 [migration/0]
    
    


     

    env


    The env command will show environmental variables.

     

                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ env                                                                                                                      
    COLORFGBG=15;0
    COLORTERM=truecolor
    COMMAND_NOT_FOUND_INSTALL_PROMPT=1
    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
    DESKTOP_SESSION=lightdm-xsession
    DISPLAY=:0.0
    DOTNET_CLI_TELEMETRY_OPTOUT=1
    GDMSESSION=lightdm-xsession
    GDM_LANG=en_IN.utf8
    GTK_MODULES=gail:atk-bridge
    HOME=/home/hackerboy
    LANG=en_IN
    LANGUAGE=en_IN:en
    LOGNAME=hackerboy
    PANEL_GDK_CORE_DEVICE_EVENTS=0
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
    POWERSHELL_TELEMETRY_OPTOUT=1
    POWERSHELL_UPDATECHECK=Off
    PWD=/home/hackerboy
    QT_ACCESSIBILITY=1
    QT_AUTO_SCREEN_SCALE_FACTOR=0
    QT_QPA_PLATFORMTHEME=qt5ct
    SESSION_MANAGER=local/KumarAtulJaiswal:@/tmp/.ICE-unix/1092,unix/KumarAtulJaiswal:/tmp/.ICE-unix/1092
    SHELL=/usr/bin/zsh
    SSH_AGENT_PID=1147
    SSH_AUTH_SOCK=/tmp/ssh-XXXXXXAg7KOV/agent.1092
    TERM=xterm-256color
    USER=hackerboy
    WINDOWID=0
    XAUTHORITY=/home/hackerboy/.Xauthority
    XDG_CONFIG_DIRS=/etc/xdg
    XDG_CURRENT_DESKTOP=XFCE
    XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share
    XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/hackerboy
    XDG_MENU_PREFIX=xfce-
    XDG_RUNTIME_DIR=/run/user/1000
    XDG_SEAT=seat0
    XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0
    XDG_SESSION_CLASS=user
    XDG_SESSION_DESKTOP=lightdm-xsession
    XDG_SESSION_ID=3
    XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0
    XDG_SESSION_TYPE=x11
    XDG_VTNR=7
    _JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
    SHLVL=1
    OLDPWD=/home/hackerboy
    LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
    LESS_TERMCAP_mb=
    LESS_TERMCAP_md=                                                                                                                                                       
    LESS_TERMCAP_me=                                                                                                                                                       
    LESS_TERMCAP_so=
    LESS_TERMCAP_se=                                                                                                                                                       
    LESS_TERMCAP_us=
    LESS_TERMCAP_ue=                                                                                                                                                       
    _=/usr/bin/env
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    


    The PATH variable may have a compiler or a scripting language (e.g. Python) that could be used to run code on the target system or leveraged for privilege escalation.



    sudo -l


    The target system may be configured to allow users to run some (or all) commands with root privileges. The sudo -l command can be
    used to list all commands your user can run using sudo.




                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ sudo -l                        
    [sudo] password for hackerboy: 
    Matching Defaults entries for hackerboy on KumarAtulJaiswal:
        env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
    
    User hackerboy may run the following commands on KumarAtulJaiswal:
        (ALL : ALL) ALL
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    


    ls


    One of the common commands used in Linux is probably ls.


    While looking for potential privilege escalation vectors, please remember to always use the ls command with the -la parameter.
    The example below shows how the “secret.txt” file can easily be missed using the ls or ls -l commands.



    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ ls    
    check.txt  id_rsa.txt
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ ls -la
    total 24
    drwxr-xr-x   2 hackerboy hackerboy  4096 May 11  2022 .
    drwxr-xr-x 138 hackerboy hackerboy 12288 Dec 27 14:35 ..
    -rwxrwxrwx   1 hackerboy hackerboy   666 Oct 15  2020 check.txt
    -rwxrwxrwx   1 hackerboy hackerboy  1674 Oct 15  2020 id_rsa.txt
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    
    
    
    
    

    Id


    The id command will provide a general overview of the user’s privilege level and group memberships.
    It is worth remembering that the id command can also be used to obtain the same information for another user as seen below.


                                                                                                                                                                          
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ id      
    uid=1000(hackerboy) gid=1000(hackerboy) groups=1000(hackerboy),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),119(bluetooth),121(wireshark),134(scanner),142(kaboxer)
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    
    
    

    /etc/passwd


    Reading the /etc/passwd file can be an easy way to discover users on the system.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ cat /etc/passwd
    root:x:0:1:root:/root:/usr/bin/zsh
    daemon:x:1:0:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:0:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    sync:x:4:65534:sync:/bin:/bin/sync
    
    


    While the output can be long and a bit intimidating, it can easily be cut and converted to a useful list for brute-force attacks.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ cat /etc/passwd | cut -d ":" -f 1
    root
    daemon
    bin
    sys
    sync
    games
    man
    lp
    
    


    Remember that this will return all users, some of which are system or service users that would not be very useful. Another approach could be to grep for “home” as real users will most likely have their folders under the “home” directory. 


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ cat /etc/passwd | grep home       
    hackerboy:x:1000:1000:hackerboy,,,:/home/hackerboy:/usr/bin/zsh
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    



    history


    Looking at earlier commands with the history command can give us some idea about the target system and, albeit rarely,
    have stored information such as passwords or usernames.



    ifconfig


    The target system may be a pivoting point to another network. The ifconfig command will give us information about the network
    interfaces of the system. The example below shows the target system has three interfaces (eth0, tun0, and tun1). Our attacking
    machine can reach the eth0 interface but can not directly access the two other networks.


    This can be confirmed using the ip route command to see which network routes exist. 


                                                                                                                                                                          
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ ip route
    default via 192.168.13.125 dev usb0 proto dhcp src 192.168.13.51 metric 100 
    192.168.13.0/24 dev usb0 proto kernel scope link src 192.168.13.51 metric 100 
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
    └─$ 
    
    
    
    

    netstat



    Following an initial check for existing interfaces and network routes, it is worth looking into existing communications. The netstat command can be used with several different options to gather information on existing connections.


    • netstat -a: shows all listening ports and established connections.
    • netstat -at or netstat -au can also be used to list TCP or UDP protocols respectively.
    • netstat -l: list ports in “listening” mode. These ports are open and ready to accept incoming connections. This can be used with the “t” option to list only ports that are listening using the TCP protocol (below).


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -lt
    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State      
    tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
    tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    netstat -s: list network usage statistics by protocol (below) This can also be used with the -t or -u options to limit the output to a specific protocol.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -s 
    Ip:
        Forwarding: 2
        32791 total packets received
        2 with invalid addresses
        0 forwarded
        0 incoming packets discarded
        32782 incoming packets delivered
        29047 requests sent out
    Icmp:
        0 ICMP messages received
        0 input ICMP message failed
        ICMP input histogram:
        0 ICMP messages sent
        0 ICMP messages failed
        ICMP output histogram:
    Tcp:
        423 active connection openings
        0 passive connection openings
        2 failed connection attempts
        2 connection resets received
        10 connections established
        21178 segments received
        20463 segments sent out
        94 segments retransmitted
        4 bad segments received
        674 resets sent
    Udp:
        11606 packets received
        0 packets to unknown port received
        0 packet receive errors
        10177 packets sent
        0 receive buffer errors
        0 send buffer errors
    UdpLite:
    TcpExt:
        184 TCP sockets finished time wait in fast timer
        2 packetes rejected in established connections because of timestamp
        213 delayed acks sent
        Quick ack mode was activated 33 times
        9166 packet headers predicted
        1752 acknowledgments not containing data payload received
        1803 predicted acknowledgments
        TCPSackRecovery: 3
        Detected reordering 14 times using SACK
        1 congestion windows fully recovered without slow start
        TCPDSACKUndo: 2
        TCPLostRetransmit: 1
        3 fast retransmits
        TCPTimeouts: 11
        TCPLossProbes: 82
        TCPLossProbeRecovery: 10
        TCPDSACKOldSent: 33
        TCPDSACKOfoSent: 12
        TCPDSACKRecv: 45
        94 connections reset due to unexpected data
        2 connections reset due to early user close
        TCPDSACKIgnoredNoUndo: 24
        TCPSackShiftFallback: 31
        TCPRcvCoalesce: 4786
        TCPOFOQueue: 5029
        TCPOFOMerge: 12
        TCPChallengeACK: 4
        TCPSYNChallenge: 4
        TCPAutoCorking: 38
        TCPSynRetrans: 9
        TCPOrigDataSent: 5683
        TCPHystartDelayDetect: 1
        TCPHystartDelayCwnd: 320
        TCPACKSkippedPAWS: 1
        TCPKeepAlive: 292
        TCPDelivered: 5862
        TCPAckCompressed: 1018
        TCPDSACKRecvSegs: 45
    IpExt:
        InOctets: 34605350
        OutOctets: 14722497
        InNoECTPkts: 32749
        InECT0Pkts: 42
    MPTcpExt:
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    


     

    netstat -tp: list connections with the service name and PID information.


    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -tp
    (Not all processes could be identified, non-owned process info
     will not be shown, you would have to be root to see it all.)
    Active Internet connections (w/o servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
    tcp        0      0 192.168.63.167:34046    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:50054    server-18-161-111:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:55010    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:48406    233.90.160.34.bc.:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:38404    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:43460    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:32888    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:43446    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:44862    ec2-3-225-70-247.:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:38596    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:36350    ec2-100-20-114-17:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:57030    201.181.244.35.bc:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:50894    23.58.120.34.bc.g:https ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:58606    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
    tcp        0      0 192.168.63.167:34198    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    This can also be used with the -l option to list listening ports (below)


                                                                                                                                                                          
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -ltp
    (Not all processes could be identified, non-owned process info
     will not be shown, you would have to be root to see it all.)
    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
    tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      -                   
    tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -                   
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    
    
    


    We can see the “PID/Program name” column is empty as this process is owned by another user.

    Below is the same command run with root privileges and reveals this information as 2641/nc (netcat)


    netstat -i: Shows interface statistics. We see below that “eth0” and “tun0” are more active than “tun1


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -i   
    Kernel Interface table
    Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
    eth0      1500        0      0      0 0             0      0      0      0 BMU
    lo       65536        4      0      0 0             4      0      0      0 LRU
    usb0      1500    36151      0      0 0         38299      0      0      0 BMRU
    wlan0     1500        0      0      0 0             0      0      0      0 BMU
                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ 
    



    The netstat usage you will probably see most often in blog posts, write-ups, and courses is netstat -ano which could be broken down as follows;

    •     -a: Display all sockets
    •     -n: Do not resolve names
    •     -o: Display timers


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ netstat -ano
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
    tcp        0      0 192.168.63.167:50054    18.161.111.125:443      TIME_WAIT   timewait (4.61/0/0)
    tcp        0      0 192.168.63.167:55010    142.251.42.41:443       ESTABLISHED off (0.00/0/0)
    tcp        0      0 192.168.63.167:48406    34.160.90.233:443       TIME_WAIT   timewait (5.55/0/0)
    
    



     

    find Command


    Searching the target system for important information and potential privilege escalation vectors can be fruitful. The built-in “find” command is useful and worth keeping in your arsenal.

    Below are some useful examples for the “find” command.



    Find files:

    •     find . -name flag1.txt: find the file named “flag1.txt” in the current directory
    •     find /home -name flag1.txt: find the file names “flag1.txt” in the /home directory
    •     find / -type d -name config: find the directory named config under “/”
    •     find / -type f -perm 0777: find files with the 777 permissions (files readable, writable, and executable by all users)
    •     find / -perm a=x: find executable files
    •     find /home -user frank: find all files for user “frank” under “/home”
    •     find / -mtime 10: find files that were modified in the last 10 days
    •     find / -atime 10: find files that were accessed in the last 10 day
    •     find / -cmin -60: find files changed within the last hour (60 minutes)
    •     find / -amin -60: find files accesses within the last hour (60 minutes)
    •     find / -size 50M: find files with a 50 MB size


    This command can also be used with (+) and (-) signs to specify a file that is larger or smaller than the given size.


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ find / -size +100M                
    /home/hackerboy/Videos/3.mp4
    /home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
    /home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
    /home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
    /home/hackerboy/Documents/sql/rockyou.txt
    /home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
    /home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    find: ‘/proc/3159/ns’: Permission denied
    find: ‘/proc/3166/task/3166/fd’: Permission denied
    find: ‘/proc/3166/task/3166/fdinfo’: Permission denied
    find: ‘/proc/3166/task/3166/ns’: Permission denied
    find: ‘/proc/3166/fd’: Permission denied
    find: ‘/proc/3166/map_files’: Permission denied
    find: ‘/proc/3166/fdinfo’: Permission denied
    find: ‘/proc/3166/ns’: Permission denied
    find: ‘/proc/3221/task/3221/fd’: Permission denied
    find: ‘/proc/3221/task/3221/fdinfo’: Permission denied
    find: ‘/proc/3221/task/3221/ns’: Permission denied
    find: ‘/proc/3221/fd’: Permission denied
    find: ‘/proc/3221/map_files’: Permission denied
    find: ‘/proc/3221/fdinfo’: Permission denied
    find: ‘/proc/3221/ns’: Permission denied
    find: ‘/proc/3222/task/3222/fd’: Permission denied
    find: ‘/proc/3222/task/3222/fdinfo’: Permission denied
    find: ‘/proc/3222/task/3222/ns’: Permission denied
    find: ‘/proc/3222/fd’: Permission denied
    find: ‘/proc/3222/map_files’: Permission denied
    find: ‘/proc/3222/fdinfo’: Permission denied
    find: ‘/proc/3222/ns’: Permission denied
    find: ‘/proc/3316/task/3316/fd/5’: No such file or directory
    find: ‘/proc/3316/task/3316/fdinfo/5’: No such file or directory
    find: ‘/proc/3316/fd/6’: No such file or directory
    find: ‘/proc/3316/fdinfo/6’: No such file or directory
    find: ‘/.cache’: Permission denied
    /usr/share/burpsuite/burpsuite.jar
    
    
    


    The example above returns files that are larger than 100 MB. It is important to note that the “find” command tends to generate errors which sometimes makes the output hard to read. This is why it would be wise to use the “find” command with “-type f 2>/dev/null” to redirect errors to “/dev/null” and have a cleaner output (below).


                                                                                                                                                                           
    ┌──(hackerboy㉿KumarAtulJaiswal)-[~]
    └─$ find / -size +100M -type f 2>/dev/null
    /home/hackerboy/Videos/3.mp4
    /home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
    /home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
    /home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
    /home/hackerboy/Documents/sql/rockyou.txt
    /home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
    /home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    /home/hackerboy/Documents/iMaHackerBoY/new/kali/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    /home/hackerboy/Documents/rockyou.txt
    /home/hackerboy/Documents/import/rainbow table/winrtgen/md5_alpha-numeric#1-7_0_2400x40000000_oxid#000.rt
    /home/hackerboy/Documents/import/cerified website for CEH/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
    
    


    Folders and files that can be written to or executed from:

    •     find / -writable -type d 2>/dev/null : Find world-writeable folders
    •     find / -perm -222 -type d 2>/dev/null: Find world-writeable folders
    •     find / -perm -o w -type d 2>/dev/null: Find world-writeable folders


    The reason we see three different “find” commands that could potentially lead to the same result can be seen in the manual document. As you can see below, the perm parameter affects the way “find” works.

    •     find / -perm -o x -type d 2>/dev/null : Find world-executable folders


    Find development tools and supported languages:

    •     find / -name perl*
    •     find / -name python*
    •     find / -name gcc*


    Find specific file permissions:

    Below is a short example used to find files that have the SUID bit set. The SUID bit allows the file to run with the privilege level of the account that owns it, rather than the account which runs it. This allows for an interesting privilege escalation path,we will see in more details on task 6. The example below is given to complete the subject on the “find” command.

    •     find / -perm -u=s -type f 2>/dev/null: Find files with the SUID bit, which allows us to run the file with a higher privilege level than the current user.


    General Linux Commands


    As we are in the Linux realm, familiarity with Linux commands, in general, will be very useful. Please spend some time getting comfortable with commands such as find, locate, grep, cut, sort, etc.




    Disclaimer

     

    All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

     

  • WHAT WE DO

    We've been developing corporate tailored services for clients for 30 years.

    CONTACT US

    For enquiries you can contact us in several different ways. Contact details are below.

    Hacking Truth.in

    • Street :Road Street 00
    • Person :Person
    • Phone :+045 123 755 755
    • Country :POLAND
    • Email :contact@heaven.com

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

    Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.