[Tutorial] Improve your security knowledge. Basic Unix and programming.

In this tutorial I want to demonstrate some of the ways to better your skills and knowledge imo. I am sure a lot of you like me are tired of seeing tutorials on how to use sqlmap.py. First of, I would advice learning the Unix environment. Even on a basic level so you are able to browse the file system with relative ease. I will demonstrate some of the most common commands and their uses. I used Ubuntu in this example, its user friendly and does what you need.

The cd command basically changes directory, once we are within it we can run the files hosted there.

Here we cd to our Desktop, and then use cat to view the content within the hi.txt file.
[img]http://#/uUiCVD.png[/img]

As simple as that.

To view the contents within a directory we use the ls command, this shows us the files in a list format. Here is an example:

[img]http://#/I8fjf5.png[/img]

Next we demonstrate the mv and the rm command, you may have guessed, mv stands for move, and rm stands for remove. We first move the hi.txt file to /home/vipvince and use ls
to see that it has been moved there successfully. Then to remove it again we rm it and issue ls to see that it has been removed.

[img]http://#/ReTt4t.png[/img]

To change file permissions, for instance if it only has read access and you want to write to it, you use the chmod command.

[img]http://#/9XTfHj.png[/img]

Some people download Backtrack/Kali which comes bundled with tools and have no idea how to actually install files on their system. In this example, I will use the sudo command which runs as root/super user to carry out an operation, in this case it will download and install wireshark via the apt-get command and I navigate to it for usage.

[img]http://#/DZaJsw.png[/img]

Once it has downloaded, cd to the /usr/bin directory and run the file.

[img]http://#/KGOeaQ.png[/img]

To create a directory we use the mkdir command followed by the directory name. Below we make a directory called blahdir and chmod 777 it so we are able to move files there with appropriate permissions. I then navigate to our Desktop directory and copied (cp) a file from there to our newly created blahdir and finally typed ls to see if it was successfully placed and residing there.

[img]http://#/85C8kw.png[/img]

Using SSH:

Wargames, these are a lot of fun and can really test and broaden your skills. Below we use SSH to connect a shell hosting them. Here is an online explanation of SSH

PHP Code 


<?php 
Secure Shell (SSH) is a UNIX-based command interface and protocol for
securely getting access to a remote computer. 

This is how it should look:

[img]http://#/ZovJmq.png[/img]

You can have a lot of fun participating in these.

Programming on Linux.

I personally lean towards PHP as I enjoy the web-app side of things, in this case I wanted to install Apache and PHP accordingly so I could run my scripts via localhost. This is the command I issued:

PHP Code 


<?php 
sudo apt-get install apache2 

This will install your Apache server, after it has finished installing type localhost into your browser. If successful you

should see this:

[img]http://#/M7otqa.png[/img]

Now you need install PHP 5 to work with the Apache server running on localhost.

Issue this command:

PHP Code 


<?php 
sudo apt-get install php5 libapache2-mod-php5 

Then you must restart Apache for the changes to take effect.

PHP Code 


<?php 
sudo /etc/init.d/apache2 restart 

To test if it works, write a simple php script and place it in the /var/www folder. This can be done with

sudo gedit /var/www/helloworld.php add the below code to the file and save.

PHP Code 


<?php
echo "Hello World!";
?>

Now navigate to the file via localhost like so:

[img]http://#/NWJgIS.png[/img]

Writing your code:

I use a text editor called gPHPEdit, it allows for clean code and performs automated syntax checks etc. Its simple but it does what I require.

Here you can see the source of the helloworld.php script within it.

[img]http://#/tEuKAB.png[/img]

Find and code exploits.

Myself like a lot of you like to keep up with the latest releases, one website I frequent is exploit-db.
[img]http://#/y7I084.jpg[/img]

Looking at exploits and the code that led them to be exploitable is a sure way of improving your skills and programming understanding.

Here is a few snippet examples of vulnerable code in its simpliest form.

XSS:

PHP Code 


<?php 
<html>
<head>
<title>blah</title>
</head>
<body>

<h1>What is your name:</h1>

<form method="post" action="">
<input type="text" name="name">
<input type="submit">
</form>

<?php

echo "<h1>Your name is: " . $_POST["name"] . "</h1>";

?>

</body>
</html> 

SQL injection.

When data is being inserted into a database and the input it not being escaped, it is possible to use custom grafted SQL query's to manipulate the database to spit out sensitive information. Here is code that is vulnerable to SQL injection:

PHP Code 


<?php 
$id = $_GET['id'];
$news = mysql_query( "SELECT * FROM `news` WHERE `id` = $id ORDER BY `id` DESC LIMIT 0,3" );
?>

This would be exploited like so:

http://www.vulnsite.com/news.php?id=1'

This can be prevented via the use of PDO (PHP Data Objects). These statements are all prepared, and binded before execution takes place on the database. If you are still using the deprecated mysql, you can accomplish similar security via the mysql_real_escape_string() function.

Local file download:

PHP Code 


<?php
$file = $_GET['file'];

if (file_exists($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename='.basename($file));
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($file));
ob_clean();
flush();
readfile($file);
exit;
}
?>

Here we are allowed to upload a file, however it does not specify a particular path or file-name or any form of security and the user effectively has the opportunity to download anything on the file system, perhaps with some directory traversal required.

I also advising working with databases.

[img]http://#/V9cCSH.jpg[/img]

Make register/login programs, hash passwords, create secure sessions, learn how to INSERT data to tables etc. You will learn a lot practicing this way, and it will help you in the security field. You will learn a hell of a lot more working with this than you will with sqlmap and running another persons code without having the foggiest idea of what is actually going on. I am sure you have your own preferences and interests whether it be in the field of networking or reverse engineering or cryptography.

I hope you enjoyed reading, until next time. VV. 🤝