[Asdethprime]

What would you say would be the best method to do a vulnerability test on a site? and once tested, if there are any XSS vulnerabilities found, how can I go about exploiting them?

Hi Rubixa,

I hope you don't mind me replying instead of Conners. The best way to go about discovering a vulnerability on a website is by running a vulnerability scanner.

The first thing I would recommend is getting a proxifier so you hide your identity while doing your scanning. The one I like using is proxychains-ng, its free.

Then run a network scanner to see what ports are open, what services are listening and what operating system it's using ($ symbol is used to show you are not using the root and # to show you are using root, you don't have to type the symbols that will be pre-displayed on the terminal):
$ sudo proxychains-ng nmap -sS -sC -A --os-guess --trace-route <website address>

For example:
$ sudo proxychains-ng nmap -sS -sC -A --os-guess --trace-route google.com

This should give you:
1) What ports are open
2) What services are running
3) What version of services are running
4) What operating system the target is using
5) If it can't find an exact operating system based on patterns it will try and guess which one it might be running
6) Show the path the packets you send towards the site took before reaching the server (very useful in finding out what proxies are running, or if there is another main server that intercepts before you reach the target)

Then you can run common vulnerability scanner that will tell you if the target as known vulnerability. Remember, nmap is free but not all vulnerability scanners are, but just use free ones.

1) Nikto <-its main job is to see if the server is misconfigured
2) w3af <- super easy and this will give you codes for any vulnerability that is discovered, these codes can be searched on Metasploit so you can get the entire vulnerability which is already pre-coded
3) Paros Proxy <- very good for checking SQL, XSS or CSRF vulnerabilities

This should give you a good idea of what vulnerabilities exists on the site. There are few frameworks that have everything built in and can be used as a stand alone too. These include:
1) Samurai Web Testing Framework
2) Ratproxy
3) Websecurify

There are a lot more.

Now the next thing you do is, figure out if the said vulnerability has a pre-coded exploit.If so you can use exploit framework (commonly metasploit or BeEF) to execute it; else you have to actually learn how to do it manually.

Cross Site Scripting (XSS) is very popular and has pre-coded exploits on metasploit you can use. Try going through this document as I feel its an excellent guide in understanding how to exploit a XSS vulnerability:
https://www.exploit-db.com/docs/18895.pdf

Hope this helps

=)

[stianonline]

What is the best silentminer? Have you used one? and whats the best to mine?

[Applier]

Hi,

First of all, apologies if this is a really basic question, but I've googled and haven't found a straight answer. I've just started fiddling around with this RAT (Pupy) for fun and I've gotten it running and functioning (on Kali Linux and android as the test subject).

I'm testing it on OSX now, and I can't figure out a way to make it persistent. Pupy's persistence module seems to support only Windows and Linux.

So, tl;dr Is there an easy way to make Pupy persistent on OSX or not? And if not, are there any other open source RATs with the persistence feature on OSX?

Thank you for reading the post. Any pointers are appreciated.

[Faith Connors]

What is the best silentminer? Have you used one? and whats the best to mine?

Well I can answer two of your questions. First of all, I haven't personally used any silent miners, so I can't really give you the "best" one, but I do know that ImminentMonitor has a Bitcoin miner built in and someone on here is selling a silent Monero miner which should also work.

Bitcoin is probably the least profitable coin to mine now because there isn't very much left, almost all of it has been already mined and what you would get back in 2011 is much larger than what you would get today for the same amount of work and power costs. I believe the best coin to mine now is Monero, XMR, so you should have a look into those. Just remember that installing a silent miner on a computer without the owner's knowledge is in fact illegal, so proceed with caution ;)

---

Hi,

First of all, apologies if this is a really basic question, but I've googled and haven't found a straight answer. I've just started fiddling around with this RAT (Pupy) for fun and I've gotten it running and functioning (on Kali Linux and android as the test subject).

I'm testing it on OSX now, and I can't figure out a way to make it persistent. Pupy's persistence module seems to support only Windows and Linux.

So, tl;dr Is there an easy way to make Pupy persistent on OSX or not? And if not, are there any other open source RATs with the persistence feature on OSX?

Thank you for reading the post. Any pointers are appreciated.

I haven't really played a lot with Pupy, neither do I with OS X so again I can't give a very straight answer. The wiki doesn't have any mention of it, so maybe on the GitHub you can add a bug to the repository in hopes the creator, n1nj4sec sees it, or you could try emailing him about it, he has a contact form at the bottom of the README.md.
It does say in the README.md that persistence works on all platforms, so I would think it's a bug.

[Applier]

I haven't really played a lot with Pupy, neither do I with OS X so again I can't give a very straight answer. The wiki doesn't have any mention of it, so maybe on the GitHub you can add a bug to the repository in hopes the creator, n1nj4sec sees it, or you could try emailing him about it, he has a contact form at the bottom of the README.md.
It does say in the README.md that persistence works on all platforms, so I would think it's a bug.

Thank you, I'll open a bug report then. Didn't want to bother the author without first checking whether it was a problem at my end.

[Rubixa]

-snip-

I was merely questioning how OP would go about it and seeing how good this help desk is buddy, but +3 for you for such a long detailed reply, unfortunately it was a waste of your time to reply that to me but I'm sure someone who needs it will see it and benefit. :)

[Faith Connors]

I was merely questioning how OP would go about it and seeing how good this help desk is buddy, but +3 for you for such a long detailed reply, unfortunately it was a waste of your time to reply that to me but I'm sure someone who needs it will see it and benefit. :)

Yeah I felt like you were testing it and I was good man reply later but when I got back it was already answered lmao

Admittedly I wouldn't have a specific nmap command and all that, or link to an exploit-db paper either, but it's also pretty well written as well, so guess I'm still learning stuff too lol

[Rubixa]

Yeah I felt like you were testing it and I was good man reply later but when I got back it was already answered lmao

Admittedly I wouldn't have a specific nmap command and all that, or link to an exploit-db paper either, but it's also pretty well written as well, so guess I'm still learning stuff too lol

All good mate haha :)

I'll jump in here from time to time and help out

[Asdethprime]

I was merely questioning how OP would go about it and seeing how good this help desk is buddy, but +3 for you for such a long detailed reply, unfortunately it was a waste of your time to reply that to me but I'm sure someone who needs it will see it and benefit. :)

Well you got me there =)

That being said yeah I am hoping at least someone will benefit from it =)

[TheSploit]

What language do I need to learn to make viruses for windows? C probably.

[semendaemon]

[deleted to save char space]

You can block out whatever "Microsoft" is getting out of your PC.
Windows does not "limit" you, it's designed for different usage scenarios. For WebSec, Windows is absolutely fine. For malware development, Windows is absolutely fine. For Win-based Driver development, CheatDev, and a lot of other security aspects - Windows is still fine. Stop enforcing the hivemind.

The rest is kinda shit as well but not as glaring.

---

What language do I need to learn to make viruses for windows? C probably.

C\++ ("The C Programming Language By K&R") & WinAPI ("Programming Windows via C/C++", First Edition). Assembly is not mandatory, however if you'll be any good you'll pick it up just to actually understand what your malware is doing. Pre-calling functions with __fastcall doesn't mean shit if you don't know what the fuck is going on at the memory formation. Any decent malware developer can read assembly, writing it isn't as popular and has no real justification (Unless you're into manual anti-debugging).

You'll also want a decent amount of networking knowledge (TCP/IP Illustrated, 2nd edition, The Protocols), Windows knowledge (Windows Internals, 6th Edition) and you should read Practical Malware Analysis, Rootkit Arsenal and Subverting The Windows Kernel when you actually get good with APT development.

Get into rootkits, the only actually worthwhile type of malware. Don't skid it out.

---

The best way to go about discovering a vulnerability on a website is by running a vulnerability scanner.

Seeing this saddens me a bit. Just a bit, because I'm as cynical as it gets yet already this one sentence hits me deep. This is where we've come to. This is it.
This is what you radiate to this thread, hell, to this section. "WANNA HACK!? WITH THESE 5 LITTLE STEPS YOU CAN START!!".
Hacking isn't about downloading linux, or launching a meterpreter. Hacking is about creating art and beauty with a computer. It can be pentesting, and it can be 101 different other things. You can't destory the definition with your pre-built download list (and fuck you for trying) and I'll forever quote you and tear down your replies until you stop this shit.

Hacking can be scanning an IP, finding a vulnerable service, launching armitage, popping /bin/sh and the giggling out of control as you're defacing the website, or installing some shit DoS endpoint or whatever.
It can also be finding out that service is not vulnerable, and instead of giving out and continuing - You go and learn Ruby, open the module script, find out it's poorly written in one regard or another (OS Specific, CPU Arch specific, w/e) and write a better one. Or you figure out why it's not working - Are we being filtered out by the IPS noticing out default packet signature, recognizing it and terminating it? Maybe the script doesn't target all Linux platforms, Maybe it doesn't adapt or you're cached out - 1001 scenarios can happen that disable your payload from executing. I hate the mindset that tells you to first use the tools, then figure out what's wrong. Scratch that, I hate the mindset of strictly defining what hacking is - Hacking == Pentesting, however hacking !== Pentesting. Hacking can be pentesting, but it's also so much and you're pretty much fucking everything up when you comment terribad advice.

And it actually pisses me off, because nobody knows about cheat development. Or memory corruption exploitation. Or malware development, whether it's filthy userland keyloggers, VNC based malware such as RATs, Trojans or something actually cool like Rootkits and low ring attacks. Or Operation Systems security, like hardening the kernel of your server against everything that can come at it. Hell, there's a whole new field developing in the shadows called IoT exploitation. Embedded Security is on the rise and beyond niche, closed forums on the darknet there is absolutely no community about this online. Reverse Engineering Router firmware to find OS-implemented vulnerabilities, doesn't that at least strike you off as something worth mentioning? Hell, just any type of reverse engineering.

Pentesting is the lowest, most common ground form of hacking. It's when you do the most and think the little-est. The overwhelming majority of them just don't know shit. It's literally ground zero for everybody. Everybody and their tits runs to it, because just like you showed the only solid background you need is literally a little bit of Linux and some Networking and I'll argue both aren't even needed if somebody can actually read things online. Pentesting is the only field within Security you can actually do shit without knowing anything at all. Why do you point people to the lowest common denominator? Why aren't you showing them everything that exists? There's more to that. Rant off or something.

Also, fuck you for that sentence alone. I'll do in 20 minutes what your scanner does in 2, but I'll find thrice as many things. You know why? Because like your brain, a scanner lacks creativity.
What happens to a scanner if every single status code returns 404 as a defensive obsecurity measure? It dies.
What happens to a scanner if a single hint of a WAF shows up? It dies.
What happens to a scanner if your target is CRUD / REST / any other methodology that isn't ancient with mod_rewrite to kill off traditional URI schemes? It dies.
What happens to a scanner if the site isn't using HTML? it dies.
Scanners cannot think. Scanners cannot develop theories, test them out via fuzzing, and make conclusions. Scanners will never find you 0days in your journay to hack the website. Besides the fact that assuming you're black-boxing the test without conset, scanners will leave a diarrhea on the http logs, showing just how idiotic they are, brute forcing every single thing to check if it works even though they could've tested X-HTTP-Powered-By and finding out shit's Nginx so why the fuck Nikto are you testing for Apache based CGI directories? Oh shit, if I just faked out the server header response that would be misleading. Maybe edit out the default error pages to avoid httpd fingerprinting? But I can fake those too as the sysadmin. Don't you get it? A decent security engineer on blue-team should be able to perform Anti Heuristic techniques in a breeze. Everything can be fooled, spoofed, faked out and scrambled to get your tool breaking down and giving false positivies.

Don't believe me about the logs? Make a website, open logs and see how god-fucking-retarded Nikto is. It was last updated 4 years ago, but it looks like 20.
Don't let tools replace your mind. Actually you specifically I don't care about, but don't let others have their brain replaced. We are so much more than that. All of us, all of you. Whoever reads this deserves to reach a much higher skill ceiling rather than simply calling tools with arguments.

To answer that question: If somebody wants to scan a website, he should learn HTML CSS JS PHP SQL for start then delve into HTTP protocol, do challenges and read pentesting papers and not that shit book. Read reports, DO USE TOOLS BUT WITH A BRAIN, git gud with more challenges and then scan that website. Don't want to do that? Use the tool to get subpar results, or pay an actually serious lad a good amount of money (Better be out of HF though).
--
Wishing Faith good luck with this. You know what you're in for. My vacation ends tomorrow, even though I'd rather have you make a better usage of your time I still value what you're trying to do here. I mean, you did last longer than I expected. Onwards with the type-3 cancer, and bye :)

[Faith Connors]

You can block out whatever "Microsoft" is getting out of your PC.
Windows does not "limit" you, it's designed for different usage scenarios. For WebSec, Windows is absolutely fine. For malware development, Windows is absolutely fine. For Win-based Driver development, CheatDev, and a lot of other security aspects - Windows is still fine. Stop enforcing the hivemind.

The rest is kinda shit as well but not as glaring.

---

C\++ ("The C Programming Language By K&R") & WinAPI ("Programming Windows via C/C++", First Edition). Assembly is not mandatory, however if you'll be any good you'll pick it up just to actually understand what your malware is doing. Pre-calling functions with __fastcall doesn't mean shit if you don't know what the fuck is going on at the memory formation. Any decent malware developer can read assembly, writing it isn't as popular and has no real justification (Unless you're into manual anti-debugging).

You'll also want a decent amount of networking knowledge (TCP/IP Illustrated, 2nd edition, The Protocols), Windows knowledge (Windows Internals, 6th Edition) and you should read Practical Malware Analysis, Rootkit Arsenal and Subverting The Windows Kernel when you actually get good with APT development.

Get into rootkits, the only actually worthwhile type of malware. Don't skid it out.

---

Seeing this saddens me a bit. Just a bit, because I'm as cynical as it gets yet already this one sentence hits me deep. This is where we've come to. This is it.
This is what you radiate to this thread, hell, to this section. "WANNA HACK!? WITH THESE 5 LITTLE STEPS YOU CAN START!!".
Hacking isn't about downloading linux, or launching a meterpreter. Hacking is about creating art and beauty with a computer. It can be pentesting, and it can be 101 different other things. You can't destory the definition with your pre-built download list (and fuck you for trying) and I'll forever quote you and tear down your replies until you stop this shit.

Hacking can be scanning an IP, finding a vulnerable service, launching armitage, popping /bin/sh and the giggling out of control as you're defacing the website, or installing some shit DoS endpoint or whatever.
It can also be finding out that service is not vulnerable, and instead of giving out and continuing - You go and learn Ruby, open the module script, find out it's poorly written in one regard or another (OS Specific, CPU Arch specific, w/e) and write a better one. Or you figure out why it's not working - Are we being filtered out by the IPS noticing out default packet signature, recognizing it and terminating it? Maybe the script doesn't target all Linux platforms, Maybe it doesn't adapt or you're cached out - 1001 scenarios can happen that disable your payload from executing. I hate the mindset that tells you to first use the tools, then figure out what's wrong. Scratch that, I hate the mindset of strictly defining what hacking is - Hacking == Pentesting, however hacking !== Pentesting. Hacking can be pentesting, but it's also so much and you're pretty much fucking everything up when you comment terribad advice.

And it actually pisses me off, because nobody knows about cheat development. Or memory corruption exploitation. Or malware development, whether it's filthy userland keyloggers, VNC based malware such as RATs, Trojans or something actually cool like Rootkits and low ring attacks. Or Operation Systems security, like hardening the kernel of your server against everything that can come at it. Hell, there's a whole new field developing in the shadows called IoT exploitation. Embedded Security is on the rise and beyond niche, closed forums on the darknet there is absolutely no community about this online. Reverse Engineering Router firmware to find OS-implemented vulnerabilities, doesn't that at least strike you off as something worth mentioning? Hell, just any type of reverse engineering.

Pentesting is the lowest, most common ground form of hacking. It's when you do the most and think the little-est. The overwhelming majority of them just don't know shit. It's literally ground zero for everybody. Everybody and their tits runs to it, because just like you showed the only solid background you need is literally a little bit of Linux and some Networking and I'll argue both aren't even needed if somebody can actually read things online. Pentesting is the only field within Security you can actually do shit without knowing anything at all. Why do you point people to the lowest common denominator? Why aren't you showing them everything that exists? There's more to that. Rant off or something.

Also, fuck you for that sentence alone. I'll do in 20 minutes what your scanner does in 2, but I'll find thrice as many things. You know why? Because like your brain, a scanner lacks creativity.
What happens to a scanner if every single status code returns 404 as a defensive obsecurity measure? It dies.
What happens to a scanner if a single hint of a WAF shows up? It dies.
What happens to a scanner if your target is CRUD / REST / any other methodology that isn't ancient with mod_rewrite to kill off traditional URI schemes? It dies.
What happens to a scanner if the site isn't using HTML? it dies.
Scanners cannot think. Scanners cannot develop theories, test them out via fuzzing, and make conclusions. Scanners will never find you 0days in your journay to hack the website. Besides the fact that assuming you're black-boxing the test without conset, scanners will leave a diarrhea on the http logs, showing just how idiotic they are, brute forcing every single thing to check if it works even though they could've tested X-HTTP-Powered-By and finding out shit's Nginx so why the fuck Nikto are you testing for Apache based CGI directories? Oh shit, if I just faked out the server header response that would be misleading. Maybe edit out the default error pages to avoid httpd fingerprinting? But I can fake those too as the sysadmin. Don't you get it? A decent security engineer on blue-team should be able to perform Anti Heuristic techniques in a breeze. Everything can be fooled, spoofed, faked out and scrambled to get your tool breaking down and giving false positivies.

Don't believe me about the logs? Make a website, open logs and see how god-fucking-retarded Nikto is. It was last updated 4 years ago, but it looks like 20.
Don't let tools replace your mind. Actually you specifically I don't care about, but don't let others have their brain replaced. We are so much more than that. All of us, all of you. Whoever reads this deserves to reach a much higher skill ceiling rather than simply calling tools with arguments.

To answer that question: If somebody wants to scan a website, he should learn HTML CSS JS PHP SQL for start then delve into HTTP protocol, do challenges and read pentesting papers and not that shit book. Read reports, DO USE TOOLS BUT WITH A BRAIN, git gud with more challenges and then scan that website. Don't want to do that? Use the tool to get subpar results, or pay an actually serious lad a good amount of money (Better be out of HF though).
--
Wishing Faith good luck with this. You know what you're in for. My vacation ends tomorrow, even though I'd rather have you make a better usage of your time I still value what you're trying to do here. I mean, you did last longer than I expected. Onwards with the type-3 cancer, and bye :)

I feel like I know who you are. But that must be impossible because you are a new user ;^)

But very well explained. I learn something new every time we speak.

[Aakash_Choudhary]

I have a question

Which is best to choose among these :->
1. fuzzdb -> https://github.com/fuzzdb-project/fuzzdb
2. seclists -> https://github.com/danielmiessler/SecLists
3. intruderPayloads -> https://github.com/1N3/IntruderPayloads

[JumbleoJumbleo1]

what program would you say is easiest to learn off?

[Asdethprime]

Hi semendaemon,

I am a bit confused. First a whole long rant about how hacking is an art and not science is pretty nice and all but I am confused to why you decided to pour that out.

While yeah I absolutely agree that manually inspecting for vulnerabilities is a far better tactic than running a vulnerability scanner; how about you try within a reason bound to explain a new user how to search for every vulnerability manually?

Come on this is a BEGINNERS help desk. I have never asked people to shy away from creativity or learning programming. But while it is very easy to say I can spend 20 mins to find vulnerability on a website than what an automated software would do in 2 mins; but explaining exactly the steps you are going to take to find every single one of the vulnerabilities to a new user would most likely have their head explode.

There is nothing wrong with people suggesting use tools to begin to learn how to hack and regardless of what anyone says, I stand by my view. Though I will say, and have always said, you need to know:
1) What does it do?
2) How does it do it?
3) What does everything there mean?

Sure you eventually want to be a hacker who can make tools on your own; you eventually want to be a hacker who can manually look for vulnerability. A pro-hacker will not use an automated network scanner; no argument there.

But here's the thing I am surprised, you think a pro-hacked would log into hackforum.net into a beginner help desk to ask a question?

I mean come on.

As per you wanting to tear my arguments apart, you are most welcome to do so. I am myself learning. I am never pretended to be a super awesome badass hacker or whatever; I have always identified myself as someone relatively new to the hacking community though not a complete newbie by any stretch of imagination.

If you are going to say don't use Nikito manually find vulnerability I am going to ignore your reply. But if you go even further and say, don't use Nikito manually do this and this and this and this to check for these vulnerabilities, then I would simply tip my hat and thank you for the information. Should there be something you mention that I have no idea about, I would love that and go around learning more about it till I can get a good understanding of it and know how to do it properly that's how you learn.

ANY AND ALL POSITIVE CRITICISM ARE MOST WELCOME. Criticism is crucial for learning. I welcome every one of it. But just don't sit there and whine about how people are losing creativity. What do you think of hackforum member; do you see them as mere sheeps who would follow anyone blindly. Sure if you can suggest them a method that works better than someone else; I see no reason why everyone would not simply follow you.

But if all you do is whine about creativity, structural breakdown of required step etc, than that's not helpful. It's just what it is just you being a cry baby.

Don't be a cry baby, if you believe you are more knowledgeable than other member in the forum, don't go around calling them mean name, go around helping them learn. Share your ideas.

It's not always possible for someone who is new to hacking to magically be able to create every advance tactics off the bat. The process is learning, checking if something work and should it not doing more research to finding out something that works.

I am not creating a hive-mind, I believe you are a you are directly vindicating a different approach to learning, learning by attempt things.

Are you really telling me you can't learn how to hack by using tools, understanding how they work, seeing in any know vulnerability exists, then looking for other known vulnerabilities on exploit databases, learning programing to understand those vulnerabilities and doing research on a need to know basis.

It's tempting to say learn assembly language, learn programing language (c#, c , c++, java, python); then learn networking protocol (TCP, IP, UDP, TELNET, SMTP, ARP etc etc). But when will you stop. There are so many programming languages out there, and many many more protocols.

You really think you tell someone trying to learn hacking to spend the next 4/5 year learning protocols and programming language before you begin to hack; they aren't going to run away scared?

A better way let them use tools, let them learn how the tools work, let them see what they discover. If they find FTP , a particular version of VSFTPD, on a network and that's what they want to exploit, they would learn that particular protocol VSFTPD. When they come across another protocol they want to exploit they could learn.

When you know none of the common vulnerability exists, then you go around checking for known vulnerabilities in exploit databases, then you can learn what programming language the said exploit is written on. You can even minimize your learning task to learn only the command used.

I have NEVER discouraged people from learning new things; all i ask though is just don't try and learn EVERYTHING; let what you need as you come across it. If you never come across a TELNET port in your entire hacking journey, no point learning about it. You are not aiming to be a teacher, you are aiming to be a hacker.

That's my perspective and I stand by it. However if anyone is kind enough to give me a positive feedback in regards to my approach feel free to do so and I would thank you for it. I have nothing to hide, and I have no reason to fight someone trying to teach me. At the same time I have no reason paying attention to people who only like to point flaws but NOT OFFER A SOLUTION. Offer a pratical solution, I will listen to you. Subsequently, if anyone then asks me how you learn hacking, I will ALWAYS relay them the method t.hat I think works best. If you can change my mind in regards to what method works best; OR BETTER YET offer a feasble solution to other users they will listen to you. Don't just go on ranting and swearing, add productive feedback

Regards,
AsdethPrime