[VipVince]

In this tutorial I want to demonstrate some of the ways to better your skills and knowledge imo. I am sure a lot of you like me are tired of seeing tutorials on how to use sqlmap.py. First of, I would advice learning the Unix environment. Even on a basic level so you are able to browse the file system with relative ease. I will demonstrate some of the most common commands and their uses. I used Ubuntu in this example, its user friendly and does what you need.

The cd command basically changes directory, once we are within it we can run the files hosted there.

Here we cd to our Desktop, and then use cat to view the content within the hi.txt file.
[img]http://#/uUiCVD.png[/img]

As simple as that.

To view the contents within a directory we use the ls command, this shows us the files in a list format. Here is an example:

[img]http://#/I8fjf5.png[/img]

Next we demonstrate the mv and the rm command, you may have guessed, mv stands for move, and rm stands for remove. We first move the hi.txt file to /home/vipvince and use ls
to see that it has been moved there successfully. Then to remove it again we rm it and issue ls to see that it has been removed.

[img]http://#/ReTt4t.png[/img]

To change file permissions, for instance if it only has read access and you want to write to it, you use the chmod command.

[img]http://#/9XTfHj.png[/img]

Some people download Backtrack/Kali which comes bundled with tools and have no idea how to actually install files on their system. In this example, I will use the sudo command which runs as root/super user to carry out an operation, in this case it will download and install wireshark via the apt-get command and I navigate to it for usage.

[img]http://#/DZaJsw.png[/img]

Once it has downloaded, cd to the /usr/bin directory and run the file.

[img]http://#/KGOeaQ.png[/img]

To create a directory we use the mkdir command followed by the directory name. Below we make a directory called blahdir and chmod 777 it so we are able to move files there with appropriate permissions. I then navigate to our Desktop directory and copied (cp) a file from there to our newly created blahdir and finally typed ls to see if it was successfully placed and residing there.

[img]http://#/85C8kw.png[/img]

Using SSH:

Wargames, these are a lot of fun and can really test and broaden your skills. Below we use SSH to connect a shell hosting them. Here is an online explanation of SSH

PHP Code


<?php 
Secure Shell (SSH) is a UNIX-based command interface and protocol for
securely getting access to a remote computer. 


This is how it should look:

[img]http://#/ZovJmq.png[/img]

You can have a lot of fun participating in these.

Programming on Linux.

I personally lean towards PHP as I enjoy the web-app side of things, in this case I wanted to install Apache and PHP accordingly so I could run my scripts via localhost. This is the command I issued:

PHP Code


<?php 
sudo apt-get install apache2 


This will install your Apache server, after it has finished installing type localhost into your browser. If successful you

should see this:

[img]http://#/M7otqa.png[/img]

Now you need install PHP 5 to work with the Apache server running on localhost.

Issue this command:

PHP Code


<?php 
sudo apt-get install php5 libapache2-mod-php5 


Then you must restart Apache for the changes to take effect.

PHP Code


<?php 
sudo /etc/init.d/apache2 restart 


To test if it works, write a simple php script and place it in the /var/www folder. This can be done with

sudo gedit /var/www/helloworld.php add the below code to the file and save.

PHP Code


<?php
echo "Hello World!";
?>

Now navigate to the file via localhost like so:

[img]http://#/NWJgIS.png[/img]

Writing your code:

I use a text editor called gPHPEdit, it allows for clean code and performs automated syntax checks etc. Its simple but it does what I require.

Here you can see the source of the helloworld.php script within it.

[img]http://#/tEuKAB.png[/img]

Find and code exploits.

Myself like a lot of you like to keep up with the latest releases, one website I frequent is exploit-db.
[img]http://#/y7I084.jpg[/img]

Looking at exploits and the code that led them to be exploitable is a sure way of improving your skills and programming understanding.

Here is a few snippet examples of vulnerable code in its simpliest form.

XSS:

PHP Code


<?php 
<html>
<head>
<title>blah</title>
</head>
<body>

<h1>What is your name:</h1>

<form method="post" action="">
<input type="text" name="name">
<input type="submit">
</form>

<?php

echo "<h1>Your name is: " . $_POST["name"] . "</h1>";

?>

</body>
</html> 


SQL injection.

When data is being inserted into a database and the input it not being escaped, it is possible to use custom grafted SQL query's to manipulate the database to spit out sensitive information. Here is code that is vulnerable to SQL injection:

PHP Code


<?php 
$id = $_GET['id'];
$news = mysql_query( "SELECT * FROM `news` WHERE `id` = $id ORDER BY `id` DESC LIMIT 0,3" );
?>

This would be exploited like so:

http://www.vulnsite.com/news.php?id=1'

This can be prevented via the use of PDO (PHP Data Objects). These statements are all prepared, and binded before execution takes place on the database. If you are still using the deprecated mysql, you can accomplish similar security via the mysql_real_escape_string() function.

Local file download:

PHP Code


<?php
$file = $_GET['file'];

if (file_exists($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename='.basename($file));
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($file));
ob_clean();
flush();
readfile($file);
exit;
}
?>

Here we are allowed to upload a file, however it does not specify a particular path or file-name or any form of security and the user effectively has the opportunity to download anything on the file system, perhaps with some directory traversal required.

I also advising working with databases.

[img]http://#/V9cCSH.jpg[/img]

Make register/login programs, hash passwords, create secure sessions, learn how to INSERT data to tables etc. You will learn a lot practicing this way, and it will help you in the security field. You will learn a hell of a lot more working with this than you will with sqlmap and running another persons code without having the foggiest idea of what is actually going on. I am sure you have your own preferences and interests whether it be in the field of networking or reverse engineering or cryptography.

I hope you enjoyed reading, until next time. VV. 🤝

[Dyme‎‎‎‎‎‎‎‎‎‎‎‎]

Spoiler (Click to View)[img]http://#/ZovJmq.png[/img]

You can have a lot of fun participating in these.

Lol let's not get ahead of ourselves Vince...

[VipVince]

One comment, for some reason that does not surprise me.

[grady]

Very nice thread, bookmarked for further usage later, I've only been able to skim it so far.
I'm 100% sure that this will come in handy later on.

[SIM-1241186]

One comment, for some reason that does not surprise me.

Three.
This interests me very much. I'm always trying to learn more and more, and with the help of these HQ tutorials I can continue to do so.

This tutorial is the defining line on what separates the real users who're wanting to learn how things work, and execute manually rather than pressing a button, from all those others who request help using Havij to upload a deface.

Definitely sparked my interests. The unix commands were most helpful. 🤝

[Zapu]

Really nice tutorial VIPVince, learned some new things ^-^

[helloworld90]

this was very interesting thank you very much mate

[pashabiceps]

apt-get is only available for debian-based systems.

What happens when one is using a Red Hat based system, or even *BSD?

Red Hat

yum install package

*BSD

pkg_add -r package

For "chmod 777" i prefer "chmod +x" which does the same, and the "x" refers to executable... I guess it's easier to remember.

As for the first part of the thread, it's just basic unix knowledge, if one wants to learn, there are already thousands of tutorials here, incluiding the GNU/Linux, FreeBSD, etc section.

Still, nice post and it encourages begginers to learn. I guess we all really appreciate your effort!

[Canonsx130]

Took my time to read this entirely and I can surely see the effort put into the text. To people who wants to start out with Linux, I can see how useful this will be. If I could add one thing, it would be 1337day.com along with exploit-db. Though the site has turned out to be more of a marketplace with the introduction of coins, it still is a very good resource.

[BeggFoMercy]

Awesome tutorial my man keep up the good work.

[VipVince]

Thanks for the feedback guys. Hopefully this inspires some to not jump on the havij bandwagon.

[#R00T~]

Great tutorial, thanks for sharing OP.

[๖ۣۜXilluX]

Nice Tutorial ! Thanks for the share :)

[Pseudonym]

Thx. Cool, very helpful guide. Noobs like I can learn lot of stuff from great tutors like you. 👍

Could you please also explain why did you delete the fingerprint from the picture? Should we keep it secret? (Maybe you should also mention that in the tutorial). Spoiler (Click to View)

[img]http://#/ZovJmq.png[/img]

EDIT: Ok, enough trolling. Why did you remove the fingerprint? It doesn't make any fucking sense, and if you think it does, you should improve your security knowledge instead of writing tutorials like this..

[Im gone brah]

Vipvince I know you love me, Good tutorial.