Enumeration is the first step you have to take once you gain access to any system. You may have accessed the system by exploiting a critical vulnerability that resulted in root-level access or just found a way to send commands using a low privileged account. Penetration testing engagements, unlike CTF machines, don't end once you gain access to a specific system or user privilege level.
As you will see, enumeration is as important during the post-compromise phase as it is before.

hostname

The hostname command will return the hostname of the target machine. Although this value can easily be changed or have a
relatively meaningless string (e.g. Ubuntu-3487340239), in some cases, it can provide information about the target system’s
role within the corporate network (e.g. SQL-PROD-01 for a production SQL server).

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ hostname              
KumarAtulJaiswal
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

uname -a

Will print system information giving us additional detail about the kernel used by the system. This will be useful when searching for any potential kernel vulnerabilities that could lead to privilege escalation.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ uname -a
Linux KumarAtulJaiswal 5.18.0-kali2-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20) x86_64 GNU/Linux
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

/proc/version

The proc filesystem (procfs) provides information about the target system processes. You will find proc on many different Linux
flavours, making it an essential tool to have in your arsenal.


Looking at /proc/version may give you information on the kernel version and additional data such as whether a compiler (e.g. GCC)
is installed.

                                                                                                                                                             
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ cat /proc/version                                       
Linux version 5.18.0-kali2-amd64 (devel@kali.org) (gcc-11 (Debian 11.3.0-3) 11.3.0, GNU ld (GNU Binutils for Debian) 2.38) #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

/etc/issue

Systems can also be identified by looking at the /etc/issue file. This file usually contains some information about the operating system but can easily be customized or changes. While on the subject, any file containing system information can be customized or changed. For a clearer understanding of the system, it is always good to look at all of these.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ cat /etc/issue     
Kali GNU/Linux Rolling \n \l

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

ps Command

The ps command is an effective way to see the running processes on a Linux system. Typing ps on your terminal will show processes for the current shell.

The output of the ps (Process Status) will show the following:

• PID: The process ID (unique to the process)
• TTY: Terminal type used by the user
• Time: Amount of CPU time used by the process (this is NOT the time this process has been running for)
• CMD: The command or executable running (will NOT display any command line parameter)

The “ps” command provides a few useful options.

• ps -A: View all running processes
• ps axjf: View process tree (see the tree formation until ps axjf is run below)

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ ps aux                
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.2 167472  9832 ?        Ss   11:06   0:02 /sbin/init splash
root           2  0.0  0.0      0     0 ?        S    11:06   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_gp]
root           4  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_par_gp]
root           5  0.0  0.0      0     0 ?        I<   11:06   0:00 [netns]
root           7  0.0  0.0      0     0 ?        I<   11:06   0:00 [kworker/0:0H-events_highpri]
root           9  0.0  0.0      0     0 ?        I<   11:06   0:02 [kworker/0:1H-events_highpri]
root          10  0.0  0.0      0     0 ?        I<   11:06   0:00 [mm_percpu_wq]
root          11  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_kthread]
root          12  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_rude_kthread]
root          13  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_trace_kthread]
root          14  0.0  0.0      0     0 ?        S    11:06   0:01 [ksoftirqd/0]
root          15  0.1  0.0      0     0 ?        I    11:06   0:22 [rcu_preempt]
root          16  0.0  0.0      0     0 ?        S    11:06   0:00 [migration/0]

env

The env command will show environmental variables.

 

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ env                                                                                                                      
COLORFGBG=15;0
COLORTERM=truecolor
COMMAND_NOT_FOUND_INSTALL_PROMPT=1
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
DESKTOP_SESSION=lightdm-xsession
DISPLAY=:0.0
DOTNET_CLI_TELEMETRY_OPTOUT=1
GDMSESSION=lightdm-xsession
GDM_LANG=en_IN.utf8
GTK_MODULES=gail:atk-bridge
HOME=/home/hackerboy
LANG=en_IN
LANGUAGE=en_IN:en
LOGNAME=hackerboy
PANEL_GDK_CORE_DEVICE_EVENTS=0
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
POWERSHELL_TELEMETRY_OPTOUT=1
POWERSHELL_UPDATECHECK=Off
PWD=/home/hackerboy
QT_ACCESSIBILITY=1
QT_AUTO_SCREEN_SCALE_FACTOR=0
QT_QPA_PLATFORMTHEME=qt5ct
SESSION_MANAGER=local/KumarAtulJaiswal:@/tmp/.ICE-unix/1092,unix/KumarAtulJaiswal:/tmp/.ICE-unix/1092
SHELL=/usr/bin/zsh
SSH_AGENT_PID=1147
SSH_AUTH_SOCK=/tmp/ssh-XXXXXXAg7KOV/agent.1092
TERM=xterm-256color
USER=hackerboy
WINDOWID=0
XAUTHORITY=/home/hackerboy/.Xauthority
XDG_CONFIG_DIRS=/etc/xdg
XDG_CURRENT_DESKTOP=XFCE
XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share
XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/hackerboy
XDG_MENU_PREFIX=xfce-
XDG_RUNTIME_DIR=/run/user/1000
XDG_SEAT=seat0
XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0
XDG_SESSION_CLASS=user
XDG_SESSION_DESKTOP=lightdm-xsession
XDG_SESSION_ID=3
XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0
XDG_SESSION_TYPE=x11
XDG_VTNR=7
_JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
SHLVL=1
OLDPWD=/home/hackerboy
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
LESS_TERMCAP_mb=
LESS_TERMCAP_md=                                                                                                                                                       
LESS_TERMCAP_me=                                                                                                                                                       
LESS_TERMCAP_so=
LESS_TERMCAP_se=                                                                                                                                                       
LESS_TERMCAP_us=
LESS_TERMCAP_ue=                                                                                                                                                       
_=/usr/bin/env
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

The PATH variable may have a compiler or a scripting language (e.g. Python) that could be used to run code on the target system or leveraged for privilege escalation.

sudo -l

The target system may be configured to allow users to run some (or all) commands with root privileges. The sudo -l command can be
used to list all commands your user can run using sudo.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ sudo -l                        
[sudo] password for hackerboy: 
Matching Defaults entries for hackerboy on KumarAtulJaiswal:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User hackerboy may run the following commands on KumarAtulJaiswal:
    (ALL : ALL) ALL
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

ls

One of the common commands used in Linux is probably ls.


While looking for potential privilege escalation vectors, please remember to always use the ls command with the -la parameter.
The example below shows how the “secret.txt” file can easily be missed using the ls or ls -l commands.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ls    
check.txt  id_rsa.txt
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ls -la
total 24
drwxr-xr-x   2 hackerboy hackerboy  4096 May 11  2022 .
drwxr-xr-x 138 hackerboy hackerboy 12288 Dec 27 14:35 ..
-rwxrwxrwx   1 hackerboy hackerboy   666 Oct 15  2020 check.txt
-rwxrwxrwx   1 hackerboy hackerboy  1674 Oct 15  2020 id_rsa.txt
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

Id

The id command will provide a general overview of the user’s privilege level and group memberships.
It is worth remembering that the id command can also be used to obtain the same information for another user as seen below.

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ id      
uid=1000(hackerboy) gid=1000(hackerboy) groups=1000(hackerboy),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),119(bluetooth),121(wireshark),134(scanner),142(kaboxer)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

/etc/passwd

Reading the /etc/passwd file can be an easy way to discover users on the system.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd
root:x:0:1:root:/root:/usr/bin/zsh
daemon:x:1:0:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:0:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync

While the output can be long and a bit intimidating, it can easily be cut and converted to a useful list for brute-force attacks.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd | cut -d ":" -f 1
root
daemon
bin
sys
sync
games
man
lp

Remember that this will return all users, some of which are system or service users that would not be very useful. Another approach could be to grep for “home” as real users will most likely have their folders under the “home” directory. 

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd | grep home       
hackerboy:x:1000:1000:hackerboy,,,:/home/hackerboy:/usr/bin/zsh
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

history

Looking at earlier commands with the history command can give us some idea about the target system and, albeit rarely,
have stored information such as passwords or usernames.

ifconfig

The target system may be a pivoting point to another network. The ifconfig command will give us information about the network
interfaces of the system. The example below shows the target system has three interfaces (eth0, tun0, and tun1). Our attacking
machine can reach the eth0 interface but can not directly access the two other networks.

This can be confirmed using the ip route command to see which network routes exist. 

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ip route
default via 192.168.13.125 dev usb0 proto dhcp src 192.168.13.51 metric 100 
192.168.13.0/24 dev usb0 proto kernel scope link src 192.168.13.51 metric 100 
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

netstat

Following an initial check for existing interfaces and network routes, it is worth looking into existing communications. The netstat command can be used with several different options to gather information on existing connections.

• netstat -a: shows all listening ports and established connections.
• netstat -at or netstat -au can also be used to list TCP or UDP protocols respectively.
• netstat -l: list ports in “listening” mode. These ports are open and ready to accept incoming connections. This can be used with the “t” option to list only ports that are listening using the TCP protocol (below).

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

netstat -s: list network usage statistics by protocol (below) This can also be used with the -t or -u options to limit the output to a specific protocol.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -s 
Ip:
    Forwarding: 2
    32791 total packets received
    2 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    32782 incoming packets delivered
    29047 requests sent out
Icmp:
    0 ICMP messages received
    0 input ICMP message failed
    ICMP input histogram:
    0 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
Tcp:
    423 active connection openings
    0 passive connection openings
    2 failed connection attempts
    2 connection resets received
    10 connections established
    21178 segments received
    20463 segments sent out
    94 segments retransmitted
    4 bad segments received
    674 resets sent
Udp:
    11606 packets received
    0 packets to unknown port received
    0 packet receive errors
    10177 packets sent
    0 receive buffer errors
    0 send buffer errors
UdpLite:
TcpExt:
    184 TCP sockets finished time wait in fast timer
    2 packetes rejected in established connections because of timestamp
    213 delayed acks sent
    Quick ack mode was activated 33 times
    9166 packet headers predicted
    1752 acknowledgments not containing data payload received
    1803 predicted acknowledgments
    TCPSackRecovery: 3
    Detected reordering 14 times using SACK
    1 congestion windows fully recovered without slow start
    TCPDSACKUndo: 2
    TCPLostRetransmit: 1
    3 fast retransmits
    TCPTimeouts: 11
    TCPLossProbes: 82
    TCPLossProbeRecovery: 10
    TCPDSACKOldSent: 33
    TCPDSACKOfoSent: 12
    TCPDSACKRecv: 45
    94 connections reset due to unexpected data
    2 connections reset due to early user close
    TCPDSACKIgnoredNoUndo: 24
    TCPSackShiftFallback: 31
    TCPRcvCoalesce: 4786
    TCPOFOQueue: 5029
    TCPOFOMerge: 12
    TCPChallengeACK: 4
    TCPSYNChallenge: 4
    TCPAutoCorking: 38
    TCPSynRetrans: 9
    TCPOrigDataSent: 5683
    TCPHystartDelayDetect: 1
    TCPHystartDelayCwnd: 320
    TCPACKSkippedPAWS: 1
    TCPKeepAlive: 292
    TCPDelivered: 5862
    TCPAckCompressed: 1018
    TCPDSACKRecvSegs: 45
IpExt:
    InOctets: 34605350
    OutOctets: 14722497
    InNoECTPkts: 32749
    InECT0Pkts: 42
MPTcpExt:
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

netstat -tp: list connections with the service name and PID information.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -tp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 192.168.63.167:34046    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:50054    server-18-161-111:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:55010    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:48406    233.90.160.34.bc.:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:38404    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:43460    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:32888    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:43446    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:44862    ec2-3-225-70-247.:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:38596    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:36350    ec2-100-20-114-17:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:57030    201.181.244.35.bc:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:50894    23.58.120.34.bc.g:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:58606    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:34198    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

This can also be used with the -l option to list listening ports (below)

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -ltp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      -                   
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -                   
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

We can see the “PID/Program name” column is empty as this process is owned by another user.

Below is the same command run with root privileges and reveals this information as 2641/nc (netcat)

netstat -i: Shows interface statistics. We see below that “eth0” and “tun0” are more active than “tun1”

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -i   
Kernel Interface table
Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0      1500        0      0      0 0             0      0      0      0 BMU
lo       65536        4      0      0 0             4      0      0      0 LRU
usb0      1500    36151      0      0 0         38299      0      0      0 BMRU
wlan0     1500        0      0      0 0             0      0      0      0 BMU
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

The netstat usage you will probably see most often in blog posts, write-ups, and courses is netstat -ano which could be broken down as follows;

•     -a: Display all sockets
•     -n: Do not resolve names
•     -o: Display timers

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -ano
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 192.168.63.167:50054    18.161.111.125:443      TIME_WAIT   timewait (4.61/0/0)
tcp        0      0 192.168.63.167:55010    142.251.42.41:443       ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.63.167:48406    34.160.90.233:443       TIME_WAIT   timewait (5.55/0/0)

find Command

Searching the target system for important information and potential privilege escalation vectors can be fruitful. The built-in “find” command is useful and worth keeping in your arsenal.

Below are some useful examples for the “find” command.

Find files:

•     find . -name flag1.txt: find the file named “flag1.txt” in the current directory
•     find /home -name flag1.txt: find the file names “flag1.txt” in the /home directory
•     find / -type d -name config: find the directory named config under “/”
•     find / -type f -perm 0777: find files with the 777 permissions (files readable, writable, and executable by all users)
•     find / -perm a=x: find executable files
•     find /home -user frank: find all files for user “frank” under “/home”
•     find / -mtime 10: find files that were modified in the last 10 days
•     find / -atime 10: find files that were accessed in the last 10 day
•     find / -cmin -60: find files changed within the last hour (60 minutes)
•     find / -amin -60: find files accesses within the last hour (60 minutes)
•     find / -size 50M: find files with a 50 MB size

This command can also be used with (+) and (-) signs to specify a file that is larger or smaller than the given size.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ find / -size +100M                
/home/hackerboy/Videos/3.mp4
/home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
/home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
/home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
/home/hackerboy/Documents/sql/rockyou.txt
/home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
/home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
find: ‘/proc/3159/ns’: Permission denied
find: ‘/proc/3166/task/3166/fd’: Permission denied
find: ‘/proc/3166/task/3166/fdinfo’: Permission denied
find: ‘/proc/3166/task/3166/ns’: Permission denied
find: ‘/proc/3166/fd’: Permission denied
find: ‘/proc/3166/map_files’: Permission denied
find: ‘/proc/3166/fdinfo’: Permission denied
find: ‘/proc/3166/ns’: Permission denied
find: ‘/proc/3221/task/3221/fd’: Permission denied
find: ‘/proc/3221/task/3221/fdinfo’: Permission denied
find: ‘/proc/3221/task/3221/ns’: Permission denied
find: ‘/proc/3221/fd’: Permission denied
find: ‘/proc/3221/map_files’: Permission denied
find: ‘/proc/3221/fdinfo’: Permission denied
find: ‘/proc/3221/ns’: Permission denied
find: ‘/proc/3222/task/3222/fd’: Permission denied
find: ‘/proc/3222/task/3222/fdinfo’: Permission denied
find: ‘/proc/3222/task/3222/ns’: Permission denied
find: ‘/proc/3222/fd’: Permission denied
find: ‘/proc/3222/map_files’: Permission denied
find: ‘/proc/3222/fdinfo’: Permission denied
find: ‘/proc/3222/ns’: Permission denied
find: ‘/proc/3316/task/3316/fd/5’: No such file or directory
find: ‘/proc/3316/task/3316/fdinfo/5’: No such file or directory
find: ‘/proc/3316/fd/6’: No such file or directory
find: ‘/proc/3316/fdinfo/6’: No such file or directory
find: ‘/.cache’: Permission denied
/usr/share/burpsuite/burpsuite.jar

The example above returns files that are larger than 100 MB. It is important to note that the “find” command tends to generate errors which sometimes makes the output hard to read. This is why it would be wise to use the “find” command with “-type f 2>/dev/null” to redirect errors to “/dev/null” and have a cleaner output (below).

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ find / -size +100M -type f 2>/dev/null
/home/hackerboy/Videos/3.mp4
/home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
/home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
/home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
/home/hackerboy/Documents/sql/rockyou.txt
/home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
/home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
/home/hackerboy/Documents/iMaHackerBoY/new/kali/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
/home/hackerboy/Documents/rockyou.txt
/home/hackerboy/Documents/import/rainbow table/winrtgen/md5_alpha-numeric#1-7_0_2400x40000000_oxid#000.rt
/home/hackerboy/Documents/import/cerified website for CEH/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf

Folders and files that can be written to or executed from:

•     find / -writable -type d 2>/dev/null : Find world-writeable folders
•     find / -perm -222 -type d 2>/dev/null: Find world-writeable folders
•     find / -perm -o w -type d 2>/dev/null: Find world-writeable folders

The reason we see three different “find” commands that could potentially lead to the same result can be seen in the manual document. As you can see below, the perm parameter affects the way “find” works.

•     find / -perm -o x -type d 2>/dev/null : Find world-executable folders

Find development tools and supported languages:

•     find / -name perl*
•     find / -name python*
•     find / -name gcc*

Find specific file permissions:

Below is a short example used to find files that have the SUID bit set. The SUID bit allows the file to run with the privilege level of the account that owns it, rather than the account which runs it. This allows for an interesting privilege escalation path,we will see in more details on task 6. The example below is given to complete the subject on the “find” command.

•     find / -perm -u=s -type f 2>/dev/null: Find files with the SUID bit, which allows us to run the file with a higher privilege level than the current user.

General Linux Commands

As we are in the Linux realm, familiarity with Linux commands, in general, will be very useful. Please spend some time getting comfortable with commands such as find, locate, grep, cut, sort, etc.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

HACK Your Offensive Security Side

In short, offensive security is the process of breaking into computer systems, exploiting software bugs, and finding loopholes in applications to gain unauthorized access to them.


To beat a hacker, you need to behave like a hacker, finding vulnerabilities and recommending patches before a cybercriminal does.

On the flip side, there is also defensive security, which is the process of protecting an organization's network and computer systems by analyzing and securing any potential digital threats; learn more in the digital forensics room.

In a defensive cyber role, you could be investigating infected computers or devices to understand how it was hacked, tracking down cybercriminals, or monitoring infrastructure for malicious activity.

Practical

First of for your kind information all kinds of things which is used here all exercises are fake simulations so don't panic and don't go dark side okay!!.


Find hidden website pages


Most companies will have an admin portal page, giving their staff access to basic admin controls for day-to-day operations. For a bank, an employee might need to transfer money to and from client accounts. Often these pages are not made private, allowing attackers to find hidden pages that show, or give access to, admin controls or sensitive data.

Type the following command into the terminal to find potentially hidden pages on FakeBank's website using GoBuster (a command-line security application).


gobuster -u http://420fakebank.co.uk -w wordlist.txt dir

In the command above, -u is used to state the website we're scanning, -w takes a list of words to iterate through to find hidden pages.

You will see that GoBuster scans the website with each word in the list, finding pages that exist on the site. GoBuster will have told you the pages it found in the list of page /directory names (indicated by Status: 200).

Hack the bank

You should have found a secret bank transfer page that allows you to transfer money between accounts at the bank (/bank-transfer). Type the hidden page into the FakeBank website on the machine.

Transfer $2000 from the bank account 2276, to your account (account number 8881).

How can I start learning?

People often wonder how others become hackers (security consultants) or defenders (security analysts fighting cybercrime), and the answer is simple. Break it down, learn an area of cyber security you're interested in, and regularly practice using hands-on exercises. Build a habit of learning a little bit each day on differnt types of website, and you'll acquire the knowledge to get your first job in the industry.

Disclaimer

Apart from usual read, write, and execute file permissions, Linux documents (files) have another set of attribute that control other characteristics of the file.

Permissions and Attributes

In Linux, who can access a file and what they can do with it is controlled by a user-centric set of permissions. Whether you can read the contents of a file, write new data into the file, or execute a file if it is a script or a program, is all governed by that set of permissions. The permissions are applied to the file, but they define the restrictions and capabilities for different categories of user.

There are permissions for the owner of the file, for the group of the file, and for others—that is, users who are not in the first two categories. You can use the ls command with the -l (long listing) option to see the permissions on a file or directory.

We can see that file permissions are user-centeric because they have choices to remove permissions at the user level. By contrast, the attributes of a file system centric. Like persmissions, they're set on the file or directory. But once they're set, they're the same for all users.

Attrbiutes are a separate collection of settings from permissions. Attributes control characteristics such as immutability and other file system-level behaviors. To see the attributes of a file or directory we use the lsattr command. To set the attributes we use the chattr command.

Inode File system 

Permissions and attributes are stored inside inodes. An inode is a file system structure that holds information about file system objects such as files and directories. A file’s location on the hard drive, its creation date, its permissions, and its attributes are all stored within its inode.

Because different file systems have different underlying structures and capabilities, attributes can behave differently—or be completely ignored—by some file systems. In this article, we’re using ext4 which is the default file system for many Linux distributions.

Looking at a File’s Attributes

The chattr and lsattr commands will already be present on your computer so there’s no need to install anything.

To check the attributes on the files in the current directory, use lsattr:

lsattr

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr 
--------------e------- ./f.txt
--------------e------- ./a.txt
--------------e------- ./e.txt
--------------e------- ./g.txt
--------------e------- ./b.txt
--------------e------- ./atul.txt
--------------e------- ./hackingtruth.txt
--------------e------- ./c.txt
--------------e------- ./d.txt
--------------e------- ./atulkumar.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ 

 The dashed lines are placeholders for attributes that are not set. The only attribute that is set is the e (extents) attribute. This shows that the file system inodes are using—or will use if required—extents to point to all portions of the file on the hard drive.

If the file is held in one contiguous sequence of hard drive blocks, its inode only has to record the first and last blocks used to store the file. If the file is fragmented, the inode has to record the number of the first and last block of each piece of the file. These pairs of hard drive block numbers are called extents.



This is the list of the most commonly used attributes.


a: Append only. A file with this attribute can only be appended to. It can still be written to, but only at the end of the file. It is not possible to overwrite any of the existing data within the file.


c: Compressed. The file is automatically compressed on the hard drive and uncompressed when it is read. Data written to the files is compressed before it is written to the hard drive.


A: No atime updates. The atime is a value in an inode that records the last time a file was accessed.


C: No copy-on-write. If two processes request access to a file, they can be given pointers to the same file. They are only given their own unique copy of the file if they try to write to the file, making it unique to that process.


d: No dump. The Linux dump command is used to write copies of entire file systems to backup media. This attribute makes dump ignore the file. It is excluded from the backup.


D: Synchronous directory updates. When this attribute is turned on for a directory, all changes to that directory are written synchronously—that is, immediately—on the hard drive. Data operations can be buffered.


e: Extent format. The e attribute indicates that the file system is using extents to map the location of the file on the hard drive. You cannot change this with chattr. It is a function of the operation of the file system.


i: Immutable. An immutable file cannot be modified, including renaming and deleting. The root user is the only person who can set or unset this attribute.


s: Secure deletion. When a file with this attribute set is deleted, the hard drive blocks that held the file data are overwritten with bytes containing zeroes. Note that this is not honored by the ext4 file system.


S: Synchronous updates. Changes to a file with its S attribute set are written to the file synchronously.


u: Deleting a file that has its u attribute set causes a copy of the file to be made. This can be beneficial to file recovery if the file was removed in error.

Changing a File’s Attributes

The chattr command lets us change the attributes of a file or directory. We can use the + (set) and - (unset) operators to apply or remove an attribute, similar to the chmod command and permissions.

The chattr command also has an = (set only) operator. This sets the attributes of a file or directory to only the attributes that are specified in the command. That is, all attributes not listed on the command line are unset.

Setting the Append Only Attribute

If you want use a: append attributes then if you want to change the overwrite the file and add something, but it is not possible because A file with this attribute can only be appended to. It can still be written to, but only at the end of the file. It is not possible to overwrite any of the existing data within the file.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ echo "Qm9iIC0gIVBAJCRXMHJEITEyMw== | base64 -d" > atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ cat atul.txt      
Qm9iIC0gIVBAJCRXMHJEITEyMw== | base64 -d
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ 
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ sudo chattr +a atul.txt                                   
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr
--------------e------- ./f.txt
--------------e------- ./a.txt
--------------e------- ./e.txt
--------------e------- ./g.txt
--------------e------- ./b.txt
-----a--------e------- ./atul.txt
--------------e------- ./hackingtruth.txt
--------------e------- ./c.txt
--------------e------- ./d.txt
--------------e------- ./atulkumar.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ echo "Qm" > atul.txt 
zsh: operation not permitted: atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$               

We’ll redirect the output from ls into the file:

ls -l > text-file.txt

sudo ls -l > text-file.txt

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr atul.txt
-----a--------e------- atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ ls -la > atul.txt 
zsh: operation not permitted: atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ sudo ls -la > atul.txt                                                                                                                              1 ⨯
zsh: operation not permitted: atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$                                                                                                                                                     1 ⨯

The operation is not permitted, even if we use the sudo command.

If we use two angle brackets  “>>” to redirect output it is appended to the existing data in the file. That should be acceptable to our append-only text file.

sudo ls -l >> text-file.txt

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr atul.txt     
-----a--------e------- atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ cat  atul.txt 
Qm9iIC0gIVBAJCRXMHJEITEyMw== | base64 -d
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ sudo ls -l >> atul.txt 
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ cat  atul.txt
Qm9iIC0gIVBAJCRXMHJEITEyMw== | base64 -d
total 8
-rwxrwxrwx 1 root      1006  0 May  2 08:57 atulkumar.txt
-rw-r--r-- 1 hackerboy root 41 May  3 12:59 atul.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 a.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 b.txt
-rwxrwxrwx 1 hackerboy root 40 May  3 13:01 c.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 d.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 e.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 f.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 g.txt
-rwxrwxrwx 1 root      1006  0 May  2 08:57 hackingtruth.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ 

Although we can append data to the file, that is the only change we can make to it. We can’t delete it and neither can root.

rm text-file.txt

sudo rm text-file.txt

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr atul.txt       
-----a--------e------- atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ rm atul.txt         
rm: cannot remove 'atul.txt': Operation not permitted
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ sudo rm atul.txt                                                                                                                                    1 ⨯
rm: cannot remove 'atul.txt': Operation not permitted
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$                                                                                                                                                     1 ⨯

Don’t Rely on Secure Deletion on ext4

As we pointed out, some operating systems do not support all of the attributes. The secure delete attribute is not honored by the ext family of file systems, including ext4. Don’t rely on this for the secure deletion of files.

It’s easy to see that this doesn’t work in ext4. We’ll set the s (secure deletion) attribute on a text file.

sudo chattr +s atul.txt

What we’re going to do is find out the inode that holds the metadata about this file. The inode holds the first hard drive block occupied by the file. The file contains some lorem ipsum placeholder text.
Advertisement

We’ll read that block directly from the hard drive to verify we’re reading the correct hard drive location. We’ll delete the file and then read that same hard dive block once more. If the secure deletion attribute is being honored, we should read zeroed bytes.

We can find the inode of the file by using the hdparm command with the --fibmap (file block map) option.

sudo hdparm --fibmap third-file.txt

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr atul.txt          
-----a--------e------- atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ chattr +s atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr atul.txt   
s----a--------e------- atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ 
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ sudo hdparm --fibmap  atul.txt

atul.txt:
 filesystem blocksize 4096, begins at LBA 872241152; assuming 512 byte sectors.
 byte_offset  begin_LBA    end_LBA    sectors
           0  931425384  931425391          8
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ 

The first hard drive block is 18100656. We’ll use the dd command to read it.

The options are:
 

• if=/dev/sda: Read from the first hard drive on this computer. 
• bs=512: Use a hard drive block size of 512 bytes.
• skip=18100656: Skip all blocks before block 18100656. In other words, start reading at block 18100656.
• count=1: Read one block of data.

sudo dd if=/dev/sda bs=512 skip=18100656 count=1

As expected we see the lorem ipsum placeholder text. We’re reading the correct block on the hard drive.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ sudo dd if=/dev/sda bs=512 skip=931425384 count=1
Qm9iIC0gIVBAJCRXMHJEITEyMw== | base64 -d
total 8
-rwxrwxrwx 1 root      1006  0 May  2 08:57 atulkumar.txt
-rw-r--r-- 1 hackerboy root 41 May  3 12:59 atul.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 a.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 b.txt
-rwxrwxrwx 1 hackerboy root 40 May  3 13:01 c.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 d.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 e.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 f.txt
-rwxrwxrwx 1 hackerboy root  0 May  2 08:56 g.txt
-r1+0 records in
1+0 records out
512 bytes copied, 0.0237929 s, 21.5 kB/s
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ 
                  

Now we’ll delete the file.

rm third-file.txt

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ lsattr atul.txt
                                                                                                                                   1 ⨯
s--------------------- atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ 

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$ rm atul.txt
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/hackingtruth.org]
└─$                        

Again, don’t depend on this for secure deletion on ext4.There are better methods available to delete files so that they can’t be recovered.

Disclaimer

Display a ASCII Message After SSH Login

Sometimes when you want to provide remote access to your system via SSH, you want to display a customized message on the terminal for the remotely logged-in user. In this tutorial, I will show you how to display a custom ASCII text and text message upon SSH login to your Linux server.

Requirement

You need to have installed SSH

Let's Displaying a Message

For displaying a ASCII text or normal text in linux or any other distro ,you will to perform the following steps:

Step 1 :- First you need to open a MOTD or create a file on your system with the COMMAND shown below.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ sudo nano /etc/motd
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$

and once this file is created or open (as you can see i have already this file in our linux system ), you can type in any messages or ASCII text as of your choice just like we did. After that, you can save this file and exit.

ASCII Creator - CLICK HERE

Step 2 :- Check your system IP

Step 3 :- Log into your machine through SSH to Display the message.

You need to log into your machine through SSH by executing the following command. You can either run this command on your own machine’s terminal or you can even use any other machine on the same network for serving the very same purpose.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ sudo su
KumarAtulJaiswal# ssh hackerboy@192.168.43.152
hackerboy@192.168.43.152's password: 
Linux KumarAtulJaiswal 5.10.0-kali8-amd64 #1 SMP Debian 5.10.40-1kali1 (2021-05-31) x86_64

The programs included with the Kali GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

WELCOME  TO
██   ██  █████   ██████ ██   ██ ██ ███    ██  ██████      ████████ ██████  ██    ██ ████████ ██   ██ 
██   ██ ██   ██ ██      ██  ██  ██ ████   ██ ██              ██    ██   ██ ██    ██    ██    ██   ██ 
███████ ███████ ██      █████   ██ ██ ██  ██ ██   ███        ██    ██████  ██    ██    ██    ███████ 
██   ██ ██   ██ ██      ██  ██  ██ ██  ██ ██ ██    ██        ██    ██   ██ ██    ██    ██    ██   ██ 
██   ██ ██   ██  ██████ ██   ██ ██ ██   ████  ██████         ██    ██   ██  ██████     ██    ██   ██ 
                                                                                 www.hackingtruth.in 



                                                                                                     
You have new mail.
Last login: Sun Jul 11 20:07:56 2021 from 192.168.43.152
┏━(Message from Kali developers)
┃
┃ This is a minimal installation of Kali Linux, you likely
┃ want to install supplementary tools. Learn how:
┃ ⇒ https://www.kali.org/docs/troubleshooting/common-minimum-setup/
┃
┃ We have kept /usr/bin/python pointing to Python 2 for backwards
┃ compatibility. Learn how to change this and avoid this message:
┃ ⇒ https://www.kali.org/docs/general-use/python3-transition/
┃
┗━(Run: “touch ~/.hushlogin” to hide this message)
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

Disclaimer

VSCode a.k.a

In this short tutorial shows how to install Visual Studio Code on Linux and the new version of kali linux 2021.2 version have alread installed visual studio code on that linux. visual studio code install in linux version 2021.2

Visual Studio Code is one of top IDEs for Python.

Visual Studio Code is an open source IDE developed by Microsoft which is available for Linux. It offers many interesting features like:

    Syntax highlight
    Code completion
    Version control
    IntelliSense
    marketplace
    Developer Community

Install Visual Studio Code

VSCode a.k.a. Visual Studio Code Open Source (“Code-OSS”) - Code editor

VSCode have been included into the kali-linux-large metapackage, so they are included on the installer image for people doing a fresh install. Otherwise you will need to upgrade Kali (if you already have the kali-linux-large install) or manually install them (if you want them!):

sudo apt update && sudo apt install -y code-oss
 

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop]
└─$ sudo apt update && sudo apt install -y code-oss
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop]
└─$ 

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ sudo apt-get install code-oss
[sudo] password for hackerboy: 
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  autopoint debugedit dh-autoreconf dh-strip-nondeterminism dwz kbuild libarchive-cpio-perl libdebhelper-perl
  libfile-stripnondeterminism-perl libmail-sendmail-perl librpmbuild9 librpmsign9 libsub-override-perl libsys-hostname-long-perl
  linux-headers-5.9.0-kali5-amd64 linux-headers-5.9.0-kali5-common linux-image-5.9.0-kali5-amd64 linux-kbuild-5.9
  python3-distro-info python3-software-properties rpm unattended-upgrades
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
  libjs-highlight.js libnode72 nodejs nodejs-doc
Suggested packages:
  npm
The following NEW packages will be installed:
  code-oss libjs-highlight.js libnode72 nodejs nodejs-doc
0 upgraded, 5 newly installed, 0 to remove and 3 not upgraded.
Need to get 85.9 MB of archives.
After this operation, 321 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 http://ftp.harukasan.org/kali kali-rolling/main amd64 libnode72 amd64 12.21.0~dfsg-3 [8,382 kB]
Get:2 http://ftp.harukasan.org/kali kali-rolling/main amd64 nodejs amd64 12.21.0~dfsg-3 [146 kB]                                     
Get:3 http://ftp.harukasan.org/kali kali-rolling/main amd64 code-oss amd64 1.56.1-0kali2 [74.4 MB]                                   
Get:4 http://ftp.harukasan.org/kali kali-rolling/main amd64 libjs-highlight.js all 9.18.5+dfsg1-1 [397 kB]                           
Get:5 http://ftp.harukasan.org/kali kali-rolling/main amd64 nodejs-doc all 12.21.0~dfsg-3 [2,538 kB]                                 
Fetched 85.9 MB in 7min 47s (184 kB/s)                                                                                               
Selecting previously unselected package libnode72:amd64.
(Reading database ... 416536 files and directories currently installed.)
Preparing to unpack .../libnode72_12.21.0~dfsg-3_amd64.deb ...
Unpacking libnode72:amd64 (12.21.0~dfsg-3) ...
Selecting previously unselected package nodejs.
Preparing to unpack .../nodejs_12.21.0~dfsg-3_amd64.deb ...
Unpacking nodejs (12.21.0~dfsg-3) ...
Selecting previously unselected package code-oss.
Preparing to unpack .../code-oss_1.56.1-0kali2_amd64.deb ...
Unpacking code-oss (1.56.1-0kali2) ...
Selecting previously unselected package libjs-highlight.js.
Preparing to unpack .../libjs-highlight.js_9.18.5+dfsg1-1_all.deb ...
Unpacking libjs-highlight.js (9.18.5+dfsg1-1) ...
Selecting previously unselected package nodejs-doc.
Preparing to unpack .../nodejs-doc_12.21.0~dfsg-3_all.deb ...
Unpacking nodejs-doc (12.21.0~dfsg-3) ...
Setting up libnode72:amd64 (12.21.0~dfsg-3) ...
Setting up libjs-highlight.js (9.18.5+dfsg1-1) ...
Setting up nodejs (12.21.0~dfsg-3) ...
update-alternatives: using /usr/bin/nodejs to provide /usr/bin/js (js) in auto mode
Setting up nodejs-doc (12.21.0~dfsg-3) ...
Setting up code-oss (1.56.1-0kali2) ...
Processing triggers for doc-base (0.11.1) ...
Processing 1 added doc-base file...
Processing triggers for libc-bin (2.31-12) ...
Processing triggers for man-db (2.9.4-2) ...
Processing triggers for shared-mime-info (2.0-1) ...
Processing triggers for mailcap (3.69) ...
Processing triggers for kali-menu (2021.2.3) ...
Processing triggers for desktop-file-utils (0.26-1) ...
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

For open visual studio code, it is simple, simply type vscode in terminal and hit enter but here is a problem if you exit the terminal your VS code will be terminated but how do fixed it!!! 

How to set VS code in Panel 

So now we will see some steps, with the help of which we will be able to set up VS Code in the Linux panel. 

Step 1 - Open panel preferences

Step 2 - add some launcher so click on add button

Step 3 - select launcher and add it..

Step 5 - As you can see the launcher has been created

Step 6 - Double click on the launcher, after that a box will open next to you, in which you have to click on the plus icon.

Step 7 -Then we find a VS code installation file, so simple type "locate vscode" and as you can see /home/hackerboy/.vscode file, copy this (There may be a different directory in your case). NOTE - this is optional. 

Step 8 - Then, add Name, command and working directory and add icon

Name - visual studio code ( you can change )

Command - vscode (not change)

Working Directory - /home/hackerboy/.vscode (There may be a different directory in your case).

Icon - Click Here 

Create.

Step 9 - You can easily open it whenever you want 

Customization 

Before running the program in Visual Code, we will do some setting which will help you a lot in automation means to run the code smoothly. for example

IDE :- python, c/c++ ✅

Code runner :- clear previous output ✅

Code runner :- run in terminal ✅

Code runner :- save file before run ✅

Click on extension section

Search code runner and install them

then go to setting option and in user simple search code runner

Then tick mark on -

clear previous output ✅

Code runner :- run in terminal ✅

Code runner :- save file before run ✅

so as you can after installing IDE (IDE already installed in VS code) as you can see our c++ program is running. 

Vola!!!

A few notes about code-oss (aka VSCode): (credit kali linux)

• We are compiling this from source, rather than using the pre-built binaries
•  
• The upside to this is that telemetry data is disabled by default
•  
• The downside is that some aspects of the marketplace may not work. If you find these limitations a problem, you may wish to uninstall the Kali package and switch to the VSCode pre-built binaries
  

You also may question why it was named code-oss, rather than code

• Code-OSS is what the source-code calls itself, which is used as the base before the configurations are applied for the pre-compiled binaries that gets distributed as “code”.
•  
• As we are using the source-code, we used the variables defined by it.
•  
• The two different names help to distinguish the differences between them (also prevents any clashes and conflicts!).
•  
• We also included various aliases in our package to help bridge between the two different versions. Meaning, calling vscode and code will use our package, code-oss, with a friendly notice (when installed).

Disclaimer

This was written for educational purpose and pentest only.
The author will not be responsible for any damage ..!
The author of this tool is not responsible for any misuse of the information.
You will not misuse the information to gain unauthorized access.
This information shall only be used to expand knowledge and not for causing  malicious or damaging attacks. Performing any hacks without written permission is illegal ..!


All video’s and tutorials are for informational and educational purposes only. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. We believe that it is impossible to defend yourself from hackers without knowing how hacking is done. The tutorials and videos provided on www.hackingtruth.in is only for those who are interested to learn about Ethical Hacking, Security, Penetration Testing and malware analysis. Hacking tutorials is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used.


All tutorials and videos have been made using our own routers, servers, websites and other resources, they do not contain any illegal activity. We do not promote, encourage, support or excite any illegal activity or hacking without written permission in general. We want to raise security awareness and inform our readers on how to prevent themselves from being a victim of hackers. If you plan to use the information for illegal purposes, please leave this website now. We cannot be held responsible for any misuse of the given information.



- Hacking Truth by Kumar Atul Jaiswal



I hope you liked this post, then you should not forget to share this post at all.
Thank you so much :-)