Here's one cool tip for reducing the amount of code needed to create an if else check suppose you have some weather and you want to create a message depending on the weather that you have so if the weather is clear we'll make the message nice otherwise we'll make the message uh oh and all we want to do is print that message if we run it as it is we'll get nice back because right now the
weather is clear but this took four lines of code and we can actually reduce this to one by using Python's ternary operator.

weather: str = 'CLEAR'
weather: str = ''

if weather == 'CLEAR':
   message = 'Nice'
else:
   message = 'Uh oh...'

print(message)

so instead let's type message of type string it's going to equal nice if the weather is equal to clear else we'll type in uh oh so this reduced the same statement to a single line and if we run it we'll have the exact same result a simple way to look at this is do this if the Boolean is true else do this and that's the secret to using the ternary operator syntax in Python.

weather: str = 'CLEAR'
weather: str = ''

message: str = 'Nice!' if  weather == 'Clear' else 'Uh oh...'

print(message)

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Enumeration is the first step you have to take once you gain access to any system. You may have accessed the system by exploiting a critical vulnerability that resulted in root-level access or just found a way to send commands using a low privileged account. Penetration testing engagements, unlike CTF machines, don't end once you gain access to a specific system or user privilege level.
As you will see, enumeration is as important during the post-compromise phase as it is before.

hostname

The hostname command will return the hostname of the target machine. Although this value can easily be changed or have a
relatively meaningless string (e.g. Ubuntu-3487340239), in some cases, it can provide information about the target system’s
role within the corporate network (e.g. SQL-PROD-01 for a production SQL server).

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ hostname              
KumarAtulJaiswal
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

uname -a

Will print system information giving us additional detail about the kernel used by the system. This will be useful when searching for any potential kernel vulnerabilities that could lead to privilege escalation.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ uname -a
Linux KumarAtulJaiswal 5.18.0-kali2-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20) x86_64 GNU/Linux
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

/proc/version

The proc filesystem (procfs) provides information about the target system processes. You will find proc on many different Linux
flavours, making it an essential tool to have in your arsenal.


Looking at /proc/version may give you information on the kernel version and additional data such as whether a compiler (e.g. GCC)
is installed.

                                                                                                                                                             
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ cat /proc/version                                       
Linux version 5.18.0-kali2-amd64 (devel@kali.org) (gcc-11 (Debian 11.3.0-3) 11.3.0, GNU ld (GNU Binutils for Debian) 2.38) #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali1 (2022-06-20)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

/etc/issue

Systems can also be identified by looking at the /etc/issue file. This file usually contains some information about the operating system but can easily be customized or changes. While on the subject, any file containing system information can be customized or changed. For a clearer understanding of the system, it is always good to look at all of these.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ cat /etc/issue     
Kali GNU/Linux Rolling \n \l

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

ps Command

The ps command is an effective way to see the running processes on a Linux system. Typing ps on your terminal will show processes for the current shell.

The output of the ps (Process Status) will show the following:

• PID: The process ID (unique to the process)
• TTY: Terminal type used by the user
• Time: Amount of CPU time used by the process (this is NOT the time this process has been running for)
• CMD: The command or executable running (will NOT display any command line parameter)

The “ps” command provides a few useful options.

• ps -A: View all running processes
• ps axjf: View process tree (see the tree formation until ps axjf is run below)

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ ps aux                
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.2 167472  9832 ?        Ss   11:06   0:02 /sbin/init splash
root           2  0.0  0.0      0     0 ?        S    11:06   0:00 [kthreadd]
root           3  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_gp]
root           4  0.0  0.0      0     0 ?        I<   11:06   0:00 [rcu_par_gp]
root           5  0.0  0.0      0     0 ?        I<   11:06   0:00 [netns]
root           7  0.0  0.0      0     0 ?        I<   11:06   0:00 [kworker/0:0H-events_highpri]
root           9  0.0  0.0      0     0 ?        I<   11:06   0:02 [kworker/0:1H-events_highpri]
root          10  0.0  0.0      0     0 ?        I<   11:06   0:00 [mm_percpu_wq]
root          11  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_kthread]
root          12  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_rude_kthread]
root          13  0.0  0.0      0     0 ?        I    11:06   0:00 [rcu_tasks_trace_kthread]
root          14  0.0  0.0      0     0 ?        S    11:06   0:01 [ksoftirqd/0]
root          15  0.1  0.0      0     0 ?        I    11:06   0:22 [rcu_preempt]
root          16  0.0  0.0      0     0 ?        S    11:06   0:00 [migration/0]

env

The env command will show environmental variables.

 

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ env                                                                                                                      
COLORFGBG=15;0
COLORTERM=truecolor
COMMAND_NOT_FOUND_INSTALL_PROMPT=1
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
DESKTOP_SESSION=lightdm-xsession
DISPLAY=:0.0
DOTNET_CLI_TELEMETRY_OPTOUT=1
GDMSESSION=lightdm-xsession
GDM_LANG=en_IN.utf8
GTK_MODULES=gail:atk-bridge
HOME=/home/hackerboy
LANG=en_IN
LANGUAGE=en_IN:en
LOGNAME=hackerboy
PANEL_GDK_CORE_DEVICE_EVENTS=0
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games
POWERSHELL_TELEMETRY_OPTOUT=1
POWERSHELL_UPDATECHECK=Off
PWD=/home/hackerboy
QT_ACCESSIBILITY=1
QT_AUTO_SCREEN_SCALE_FACTOR=0
QT_QPA_PLATFORMTHEME=qt5ct
SESSION_MANAGER=local/KumarAtulJaiswal:@/tmp/.ICE-unix/1092,unix/KumarAtulJaiswal:/tmp/.ICE-unix/1092
SHELL=/usr/bin/zsh
SSH_AGENT_PID=1147
SSH_AUTH_SOCK=/tmp/ssh-XXXXXXAg7KOV/agent.1092
TERM=xterm-256color
USER=hackerboy
WINDOWID=0
XAUTHORITY=/home/hackerboy/.Xauthority
XDG_CONFIG_DIRS=/etc/xdg
XDG_CURRENT_DESKTOP=XFCE
XDG_DATA_DIRS=/usr/share/xfce4:/usr/local/share/:/usr/share/:/usr/share
XDG_GREETER_DATA_DIR=/var/lib/lightdm/data/hackerboy
XDG_MENU_PREFIX=xfce-
XDG_RUNTIME_DIR=/run/user/1000
XDG_SEAT=seat0
XDG_SEAT_PATH=/org/freedesktop/DisplayManager/Seat0
XDG_SESSION_CLASS=user
XDG_SESSION_DESKTOP=lightdm-xsession
XDG_SESSION_ID=3
XDG_SESSION_PATH=/org/freedesktop/DisplayManager/Session0
XDG_SESSION_TYPE=x11
XDG_VTNR=7
_JAVA_OPTIONS=-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
SHLVL=1
OLDPWD=/home/hackerboy
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
LESS_TERMCAP_mb=
LESS_TERMCAP_md=                                                                                                                                                       
LESS_TERMCAP_me=                                                                                                                                                       
LESS_TERMCAP_so=
LESS_TERMCAP_se=                                                                                                                                                       
LESS_TERMCAP_us=
LESS_TERMCAP_ue=                                                                                                                                                       
_=/usr/bin/env
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

The PATH variable may have a compiler or a scripting language (e.g. Python) that could be used to run code on the target system or leveraged for privilege escalation.

sudo -l

The target system may be configured to allow users to run some (or all) commands with root privileges. The sudo -l command can be
used to list all commands your user can run using sudo.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ sudo -l                        
[sudo] password for hackerboy: 
Matching Defaults entries for hackerboy on KumarAtulJaiswal:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User hackerboy may run the following commands on KumarAtulJaiswal:
    (ALL : ALL) ALL
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

ls

One of the common commands used in Linux is probably ls.


While looking for potential privilege escalation vectors, please remember to always use the ls command with the -la parameter.
The example below shows how the “secret.txt” file can easily be missed using the ls or ls -l commands.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ls    
check.txt  id_rsa.txt
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ls -la
total 24
drwxr-xr-x   2 hackerboy hackerboy  4096 May 11  2022 .
drwxr-xr-x 138 hackerboy hackerboy 12288 Dec 27 14:35 ..
-rwxrwxrwx   1 hackerboy hackerboy   666 Oct 15  2020 check.txt
-rwxrwxrwx   1 hackerboy hackerboy  1674 Oct 15  2020 id_rsa.txt
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

Id

The id command will provide a general overview of the user’s privilege level and group memberships.
It is worth remembering that the id command can also be used to obtain the same information for another user as seen below.

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ id      
uid=1000(hackerboy) gid=1000(hackerboy) groups=1000(hackerboy),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),119(bluetooth),121(wireshark),134(scanner),142(kaboxer)
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

/etc/passwd

Reading the /etc/passwd file can be an easy way to discover users on the system.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd
root:x:0:1:root:/root:/usr/bin/zsh
daemon:x:1:0:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:0:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync

While the output can be long and a bit intimidating, it can easily be cut and converted to a useful list for brute-force attacks.

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd | cut -d ":" -f 1
root
daemon
bin
sys
sync
games
man
lp

Remember that this will return all users, some of which are system or service users that would not be very useful. Another approach could be to grep for “home” as real users will most likely have their folders under the “home” directory. 

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ cat /etc/passwd | grep home       
hackerboy:x:1000:1000:hackerboy,,,:/home/hackerboy:/usr/bin/zsh
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

history

Looking at earlier commands with the history command can give us some idea about the target system and, albeit rarely,
have stored information such as passwords or usernames.

ifconfig

The target system may be a pivoting point to another network. The ifconfig command will give us information about the network
interfaces of the system. The example below shows the target system has three interfaces (eth0, tun0, and tun1). Our attacking
machine can reach the eth0 interface but can not directly access the two other networks.

This can be confirmed using the ip route command to see which network routes exist. 

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ ip route
default via 192.168.13.125 dev usb0 proto dhcp src 192.168.13.51 metric 100 
192.168.13.0/24 dev usb0 proto kernel scope link src 192.168.13.51 metric 100 
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/wgel]
└─$ 

netstat

Following an initial check for existing interfaces and network routes, it is worth looking into existing communications. The netstat command can be used with several different options to gather information on existing connections.

• netstat -a: shows all listening ports and established connections.
• netstat -at or netstat -au can also be used to list TCP or UDP protocols respectively.
• netstat -l: list ports in “listening” mode. These ports are open and ready to accept incoming connections. This can be used with the “t” option to list only ports that are listening using the TCP protocol (below).

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

netstat -s: list network usage statistics by protocol (below) This can also be used with the -t or -u options to limit the output to a specific protocol.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -s 
Ip:
    Forwarding: 2
    32791 total packets received
    2 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    32782 incoming packets delivered
    29047 requests sent out
Icmp:
    0 ICMP messages received
    0 input ICMP message failed
    ICMP input histogram:
    0 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
Tcp:
    423 active connection openings
    0 passive connection openings
    2 failed connection attempts
    2 connection resets received
    10 connections established
    21178 segments received
    20463 segments sent out
    94 segments retransmitted
    4 bad segments received
    674 resets sent
Udp:
    11606 packets received
    0 packets to unknown port received
    0 packet receive errors
    10177 packets sent
    0 receive buffer errors
    0 send buffer errors
UdpLite:
TcpExt:
    184 TCP sockets finished time wait in fast timer
    2 packetes rejected in established connections because of timestamp
    213 delayed acks sent
    Quick ack mode was activated 33 times
    9166 packet headers predicted
    1752 acknowledgments not containing data payload received
    1803 predicted acknowledgments
    TCPSackRecovery: 3
    Detected reordering 14 times using SACK
    1 congestion windows fully recovered without slow start
    TCPDSACKUndo: 2
    TCPLostRetransmit: 1
    3 fast retransmits
    TCPTimeouts: 11
    TCPLossProbes: 82
    TCPLossProbeRecovery: 10
    TCPDSACKOldSent: 33
    TCPDSACKOfoSent: 12
    TCPDSACKRecv: 45
    94 connections reset due to unexpected data
    2 connections reset due to early user close
    TCPDSACKIgnoredNoUndo: 24
    TCPSackShiftFallback: 31
    TCPRcvCoalesce: 4786
    TCPOFOQueue: 5029
    TCPOFOMerge: 12
    TCPChallengeACK: 4
    TCPSYNChallenge: 4
    TCPAutoCorking: 38
    TCPSynRetrans: 9
    TCPOrigDataSent: 5683
    TCPHystartDelayDetect: 1
    TCPHystartDelayCwnd: 320
    TCPACKSkippedPAWS: 1
    TCPKeepAlive: 292
    TCPDelivered: 5862
    TCPAckCompressed: 1018
    TCPDSACKRecvSegs: 45
IpExt:
    InOctets: 34605350
    OutOctets: 14722497
    InNoECTPkts: 32749
    InECT0Pkts: 42
MPTcpExt:
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

netstat -tp: list connections with the service name and PID information.

┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -tp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 192.168.63.167:34046    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:50054    server-18-161-111:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:55010    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:48406    233.90.160.34.bc.:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:38404    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:43460    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:32888    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:43446    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:44862    ec2-3-225-70-247.:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:38596    bom12s20-in-f9.1e:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:36350    ec2-100-20-114-17:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:57030    201.181.244.35.bc:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:50894    23.58.120.34.bc.g:https ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:58606    104.22.54.228:https     ESTABLISHED 1803/firefox-esr    
tcp        0      0 192.168.63.167:34198    ec2-35-174-127-31:https ESTABLISHED 1803/firefox-esr    
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

This can also be used with the -l option to list listening ports (below)

                                                                                                                                                                      
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -ltp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      -                   
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      -                   
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

We can see the “PID/Program name” column is empty as this process is owned by another user.

Below is the same command run with root privileges and reveals this information as 2641/nc (netcat)

netstat -i: Shows interface statistics. We see below that “eth0” and “tun0” are more active than “tun1”

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -i   
Kernel Interface table
Iface      MTU    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0      1500        0      0      0 0             0      0      0      0 BMU
lo       65536        4      0      0 0             4      0      0      0 LRU
usb0      1500    36151      0      0 0         38299      0      0      0 BMRU
wlan0     1500        0      0      0 0             0      0      0      0 BMU
                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ 

The netstat usage you will probably see most often in blog posts, write-ups, and courses is netstat -ano which could be broken down as follows;

•     -a: Display all sockets
•     -n: Do not resolve names
•     -o: Display timers

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ netstat -ano
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       Timer
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 192.168.63.167:50054    18.161.111.125:443      TIME_WAIT   timewait (4.61/0/0)
tcp        0      0 192.168.63.167:55010    142.251.42.41:443       ESTABLISHED off (0.00/0/0)
tcp        0      0 192.168.63.167:48406    34.160.90.233:443       TIME_WAIT   timewait (5.55/0/0)

find Command

Searching the target system for important information and potential privilege escalation vectors can be fruitful. The built-in “find” command is useful and worth keeping in your arsenal.

Below are some useful examples for the “find” command.

Find files:

•     find . -name flag1.txt: find the file named “flag1.txt” in the current directory
•     find /home -name flag1.txt: find the file names “flag1.txt” in the /home directory
•     find / -type d -name config: find the directory named config under “/”
•     find / -type f -perm 0777: find files with the 777 permissions (files readable, writable, and executable by all users)
•     find / -perm a=x: find executable files
•     find /home -user frank: find all files for user “frank” under “/home”
•     find / -mtime 10: find files that were modified in the last 10 days
•     find / -atime 10: find files that were accessed in the last 10 day
•     find / -cmin -60: find files changed within the last hour (60 minutes)
•     find / -amin -60: find files accesses within the last hour (60 minutes)
•     find / -size 50M: find files with a 50 MB size

This command can also be used with (+) and (-) signs to specify a file that is larger or smaller than the given size.

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ find / -size +100M                
/home/hackerboy/Videos/3.mp4
/home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
/home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
/home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
/home/hackerboy/Documents/sql/rockyou.txt
/home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
/home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
find: ‘/proc/3159/ns’: Permission denied
find: ‘/proc/3166/task/3166/fd’: Permission denied
find: ‘/proc/3166/task/3166/fdinfo’: Permission denied
find: ‘/proc/3166/task/3166/ns’: Permission denied
find: ‘/proc/3166/fd’: Permission denied
find: ‘/proc/3166/map_files’: Permission denied
find: ‘/proc/3166/fdinfo’: Permission denied
find: ‘/proc/3166/ns’: Permission denied
find: ‘/proc/3221/task/3221/fd’: Permission denied
find: ‘/proc/3221/task/3221/fdinfo’: Permission denied
find: ‘/proc/3221/task/3221/ns’: Permission denied
find: ‘/proc/3221/fd’: Permission denied
find: ‘/proc/3221/map_files’: Permission denied
find: ‘/proc/3221/fdinfo’: Permission denied
find: ‘/proc/3221/ns’: Permission denied
find: ‘/proc/3222/task/3222/fd’: Permission denied
find: ‘/proc/3222/task/3222/fdinfo’: Permission denied
find: ‘/proc/3222/task/3222/ns’: Permission denied
find: ‘/proc/3222/fd’: Permission denied
find: ‘/proc/3222/map_files’: Permission denied
find: ‘/proc/3222/fdinfo’: Permission denied
find: ‘/proc/3222/ns’: Permission denied
find: ‘/proc/3316/task/3316/fd/5’: No such file or directory
find: ‘/proc/3316/task/3316/fdinfo/5’: No such file or directory
find: ‘/proc/3316/fd/6’: No such file or directory
find: ‘/proc/3316/fdinfo/6’: No such file or directory
find: ‘/.cache’: Permission denied
/usr/share/burpsuite/burpsuite.jar

The example above returns files that are larger than 100 MB. It is important to note that the “find” command tends to generate errors which sometimes makes the output hard to read. This is why it would be wise to use the “find” command with “-type f 2>/dev/null” to redirect errors to “/dev/null” and have a cleaner output (below).

                                                                                                                                                                       
┌──(hackerboy㉿KumarAtulJaiswal)-[~]
└─$ find / -size +100M -type f 2>/dev/null
/home/hackerboy/Videos/3.mp4
/home/hackerboy/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/libxul.so
/home/hackerboy/Documents/OSCP-machine/Hack_Me_Please.rar
/home/hackerboy/Documents/OSCP-machine/Ubuntu_CTF.ova
/home/hackerboy/Documents/sql/rockyou.txt
/home/hackerboy/Documents/iMaHackerBoY/new/osf.exe
/home/hackerboy/Documents/iMaHackerBoY/new/Hacking-All-books-PDF/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
/home/hackerboy/Documents/iMaHackerBoY/new/kali/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf
/home/hackerboy/Documents/rockyou.txt
/home/hackerboy/Documents/import/rainbow table/winrtgen/md5_alpha-numeric#1-7_0_2400x40000000_oxid#000.rt
/home/hackerboy/Documents/import/cerified website for CEH/Nmap Network Scanning_ The Official Nmap Project Guide to Network Discovery and Security Scanning ( PDFDrive.com ).pdf

Folders and files that can be written to or executed from:

•     find / -writable -type d 2>/dev/null : Find world-writeable folders
•     find / -perm -222 -type d 2>/dev/null: Find world-writeable folders
•     find / -perm -o w -type d 2>/dev/null: Find world-writeable folders

The reason we see three different “find” commands that could potentially lead to the same result can be seen in the manual document. As you can see below, the perm parameter affects the way “find” works.

•     find / -perm -o x -type d 2>/dev/null : Find world-executable folders

Find development tools and supported languages:

•     find / -name perl*
•     find / -name python*
•     find / -name gcc*

Find specific file permissions:

Below is a short example used to find files that have the SUID bit set. The SUID bit allows the file to run with the privilege level of the account that owns it, rather than the account which runs it. This allows for an interesting privilege escalation path,we will see in more details on task 6. The example below is given to complete the subject on the “find” command.

•     find / -perm -u=s -type f 2>/dev/null: Find files with the SUID bit, which allows us to run the file with a higher privilege level than the current user.

General Linux Commands

As we are in the Linux realm, familiarity with Linux commands, in general, will be very useful. Please spend some time getting comfortable with commands such as find, locate, grep, cut, sort, etc.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

In a brute-force attack, the advisory attempts to decrypt the ciphertext by using every possible key. If the key is small enough, a brute-force attack can be successful in a matter of minutes. In fact, if the keys are around 222, we can write a Python script to crack the password utilizing brute force. For your estimation purposes, when it comes to brute-force attacks, the following helps you ballpark
the amount of security you get for various size problems:

• A key space/message space of 264 is enough for a couple hours of security.
• A key space/message space of 2128 is enough for several decades of pre- quantum security.
• A key space/message space of 2256 is enough for several decades of post- quantum security.

The following is an example of code that will generate a four-digit PIN and then loop through the iterations using brute force to determine the password:

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/implementing-cryptography/cert]
└─$ cat brute-crypt.py     
#!/usr/bin/python3

import random
generated_password = str(random.randint(0, 9999))
#print(generated_password)

for i in range(10000):
    Trial = str(i)
    if Trial == generated_password:
       print('Found password: ' + generated_password)
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/implementing-cryptography/cert]
└─$ 

┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/implementing-cryptography/cert]
└─$ 
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/implementing-cryptography/cert]
└─$ python3 brute-crypt.py 
Found password: 8737
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/implementing-cryptography/cert]
└─$ python3 brute-crypt.py
Found password: 6227
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/implementing-cryptography/cert]
└─$ python3 brute-crypt.py
Found password: 433
                                                                                                                                                                        
┌──(hackerboy㉿KumarAtulJaiswal)-[~/Desktop/implementing-cryptography/cert]
└─$ 

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Basics features of java

# Java is simple
# Java is secure
# Java is portable
# Java is object-oriented
# Java is robust
# Java is multithreaded
# Java is architecture-neutral
# Java is interpreted
# Java’s performance
# Java is distributed
# Java is dynamic

Java is simple

Java is Easy to write and more readable and eye catching.
Java has a concise, cohesive set of features that makes it easy to learn and use.
Most of the concepts are drew from C++ thus making Java learning simpler.

Java is secure

Java program cannot harm other system thus making it secure.
Java provides a secure means of creating Internet applications.
Java provides secure way to access web applications.

Java is portable

Java programs can execute in any environment for which there is a Java run-time system.
(JVM) Java programs can be run on any platform (Linux,Window,Mac) Java programs can be transferred over world wide web (e.g applets)

Java is object-oriented

Java programming is object-oriented programming language.
Like C++ java provides most of the object oriented features.
Java is pure OOP. Language. (while C++ is semi object oriented)

Java is robust

Java encourages error-free programming by being strictly typed and performing run-time checks.

Java is multithreaded

Java provides integrated support for multithreaded programming.

Java is architecture-neutral

Java is not tied to a specific machine or operating system architecture.
Machine Independent i.e Java is independent of hardware .

Java is interpreted

Java supports cross-platform code through the use of Java bytecode.
Bytecode can be interpreted on any platform by JVM.

Java’s performance

Bytecodes are highly optimized.
JVM can executed them much faster

Java is distributed

Java was designed with the distributed environment.
Java can be transmit,run over internet.

Java is dynamic

Java programs carry with them substantial amounts of run-time type information that is used to verify and resolve accesses
to objects at run time.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Introduction

Customers have high expectations for the code we produce.

Users will use our programs in unexpected ways.

Due to design errors or coding errors, our programs may fail in unexpected ways during execution.

It is our responsibility to produce quality code that does not fail unexpectedly.

Consequently, we must design error handling into our programs. 

Errors and Error handling

An Error is any unexpected result obtained from a program during execution.

Unhandled errors may manifest themselves as incorrect results or behavior, or as abnormal program termination.

Errors should be handled by the programmer, to prevent them from reaching the user.


Memory errors (i.e memory incorrectly allocated, memory leaks…)

File system errors (i.e. disk is full…)

Network errors (i.e. network is down…)

Calculation errors (i.e. divide by 0)

Array errors (i.e. accessing element –1)

Types of Exceptions

Unchecked Exceptions

Checked Exceptions It is not required that these types Must either be caught by a of exceptions be caught or method or declared in
its declared on a method. signature.


Runtime exceptions can be

Placing exceptions in the generated by methods or by method signature harkens the JVM itself.

Errors are generated from deep within the JVM.

Keywords

• throws Describes the exceptions which can be raised by a method.
  

• throw Raises an exception to the first available handler in the call stack, unwinding the stack along the way.
  

• try Marks the start of a block associated with a set of exception handlers.
  

• catch If the block enclosed by the try generates an exception of this type, control moves here; watch out for implicit subsumption.
  

• finally Always called when the try block concludes, and after any necessary catch handler is complete.

There are two types of errors:

Compile time errors
Runtime error



Compile time errors

Instead of declaring int a; you mistakenly declared it as in a; for which compiler will throw an error.



Runtime Errors Example

A Runtime error is called an Exceptions error. It is any event that interrupts the normal flow of program execution.

Example for exceptions are, arithmetic exception, Nullpointer exception, Divide by zero exception, etc.

class JavaException {
   public static void main(String args[]){
      int d = 0;
      int n = 20;
      int fraction = n/d;
     System.out.println("End Of Main");
   }

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

Parallel Processing

A Parallel Processing system is able to perform concurrent data processing to achieve faster execution time.

Example: While an instruction is being executed in the ALU, the next instruction can be read from memory.

The system may have two or more ALUs and be able to execute two or more instructions at the same time. “So the purpose of
parallel processing is to speedup the computer processing capabilities.”

Pipelining Case: Laundry

• 4 loads of laundry that need to washed, dried, and folded.

– 30 minutes to wash, 40 min. to dry, and 20 min. to fold.
– We have 1 washer, 1 dryer, and 1 folding station.


• What’s the most efficient way to get the 4 loads of laundry done?

 


Non Pipelined Laundry • Takes a total of 6 hours; nothing is done in parallel


Pipelined Laundry • Using this method, the laundry would be done at 9:30.

Definition 

Pipelining is an speed up technique where multiple instructions are overlapped in execution on a processor.

Processors

Computers, like laundry, typically perform the exact same steps for every  instruction:–

• Fetch an instruction from memory
• Decode the instruction
• Execute the instruction
• Read memory to get input
• Write the result back to memory

Instruction Pipeline

Instruction execution process lends itself naturally to pipelining
overlap the subtasks of instruction fetch, decode and execute

• Fetch instruction (FI)
• Decode instruction (DI)
• Calculate operands (CO)
• Fetch operands (FO)
• Execute instructions (EI)
• Write result (WR) Overlap these operations

Instruction pipeline has six operations

Instructions Fetch • The IF stage is responsible for obtaining the requested instruction from memory. The instruction and
the program counter are stored in the register as temporary storage.

Decode Instruction • The DI stage is responsible for decoding the instruction and sending out the various control lines to
the other parts of the processor.

Calculate Operands • The CO stage is where any calculations are performed. The main component in this stage is the ALU.
The ALU is made up of arithmetic, logic and capabilities.

Fetch Operands and Execute Instruction • The FO and EI stages are responsible for storing and loading values to and from memory.
They also responsible for input and output from the processor respectively.

Write Operands • The WO stage is responsible for writing the result of a calculation, memory access or input into
the register file.

Six Stage Instruction Pipeline

Timing Diagram for Instruction Pipeline Operation

 

Pipeline Performance: Clock & Timing Si Si+1  m d Clock cycle of the pipeline :  Latch delay : d  = max {m } + d Pipeline
frequency : f f = 1 /  6


 

Pipeline Performance: Speedup & Efficiency k-stage pipeline processes n tasks in k + (n-1) clock cycles: k cycles for the first task and n-1 cycles for the remaining n-1 tasks Total time to process n tasks Tk = [ k + (n-1)]

For the non-pipelined processor T1 = n k Speedup factor Sk = T1 Tk = n k  [ k + (n-1)]  = n k k + (n-1) 7

Advantages

Pipelining makes efficient use of resources.
Quicker time of execution of large number of instructions
The parallelism is invisible to the programmer.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.

MySQL Transactions

What are transactions?

# Sequential group of DML statements, which is performed as if it were one single work unit.


# Will never complete unless each individual operation within the group is sucessful.If any operation within the transaction fails, the entire transaction will fail.

# Begins with the first executable SQL statement.

# Ends when it is committed or rolled back, either explicitly with a COMMIT or ROLLBACK statement or implicitly when a DDL statement
is issued.

Sample Scenario

Suppose a bank customer transfers money from his savings account (SB a/c) to his current account (CA a/c), the statement will be divided into four blocks:

# Debit SB a/c
# Credit CA a/c
# Record in Transaction Journal.
# End Transaction



The SQL statement to debit SB a/c is as follows:

UPDATE sb_accounts SET balance = balance - 500 WHERE account_no = 932656;



The SQL statement to credit CA a/c is as follows:

UPDATE ca_accounts SET balance = balance + 500 WHERE account_no = 933456;



The SQL statement for recording in the transaction journal is as follows:

INSERT INTO journal VALUES (100896, 'Transaction on Kumar Atul Jaiswal a/c', '28-NOV-11' 932656, 933456, 500);


The SQL statement for End Transaction is as follows:

COMMIT WORK;

 

Ensures that all operations within the work unit are completed successfully; otherwise, the transaction is aborted at the point of failure and previous operations are rolled back to their former state.

Disclaimer

All tutorials are for informational and educational purposes only and have been made using our own routers, servers, websites and other vulnerable free resources. we do not contain any illegal activity. We believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. Hacking Truth is against misuse of the information and we strongly suggest against it. Please regard the word hacking as ethical hacking or penetration testing every time this word is used. We do not promote, encourage, support or excite any illegal activity or hacking.