Useful Commands in Linux

A comprehensive list of commands needed when using Linux:

Command privileges.

    sudo command - run command as root
    sudo su – root shell open
    sudo su user – open shell as a user
    sudo -k – forget your password sudo
    gksudo command – sudo visual dialog (GNOME)
    kdesudo command – sudo visual dialog (KDE)
    sudo visudo – edit / etc / sudoers
    gksudo nautilus – root file manager (GNOME)
    kdesudo konqueror – root file manager (KDE)
    passwd – change your password 

Command Network

    ifconfig – displays information network
    iwconfig – displays information from wireless
    sudo iwlist scan – scan wireless networks
    sudo /etc/init.d/networking restart – reset the network
    (file) /etc/network/interfaces – manual configuration
    ifup interface – bring online interface
    ifdown interface – disable interface 

Commands Display

    sudo /etc/init.d/gdm restart – reset X (Gnome)
    sudo /etc/init.d/kdm restart – reset X (KDE)
    (file) /etc/X11/xorg.conf – show Configuration
    sudo dpkg-reconfigure - reconfigure xserver-xorg-phigh - reset configuration X
    Ctrl+Alt+Bksp – X display reset if frozen
    Ctrl+Alt+FN – switch to tty N
    Ctrl+Alt+F7 – switch back to X display 

Commands Service System.

    start service – service to start work (Upstart)
    stop service – service to stop working (Upstart)
    status service – check if service is running (Upstart)
    /etc/init.d/service start – start service (SysV)
    /etc/init.d/service stop – stop service (SysV)
    /etc/init.d/service status – check service (SysV)
    /etc/init.d/service restart – reset service (SysV)
    runlevel – get current runlevel 

Commands for Firewall.

    ufw enable – turn on the firewall
    ufw disable – turn off the firewall
    ufw default allow – allow all connections by default
    ufw default deny – drop all connections by default
    ufw status – current rules and
    ufw allow port – to allow traffic on port
    ufw deny port – port block
    ufw deny from ip – ip block 

Command System.

    lsb_release -a – get the version of Ubuntu
    uname -r – get kernel version
    uname -a – get all the information kernel 

Commands for Package Manager.

    apt-get update – refresh updates available
    apt-get upgrade – update all packages
    apt-get dist-upgrade – version update
    apt-get install pkg – installing pkg
    apt-get remove pkg – uninstall pkg
    apt-get autoremove – removing packages obsotletos
    apt-get -f install – try to fix packages
    dpkg –configure -a – try to fix a broken package
    dpkg -i pkg.deb – install file pkg.deb
    (file) /etc/apt/sources.list – list of repositories APT 

Special Packages For commands.

    ubuntu-desktop – Setting the standard Ubuntu
    kubuntu-desktop – KDE Desktop
    xubuntu-desktop – desktop XFCE
    ubuntu-minimal – core earnings Ubuntu
    ubuntu-standard – the standard utilities Ubuntu
    ubuntu-restricted-extras – not free, but useful
    kubuntu-restricted-extras – ditto KDE
    xubuntu-restricted-extras – ditto XFCE
    build-essential – packages used to compile
    linux-image-generic – latest generic kernel image
    linux-headers-generic – latest headlines 

Applications commands.

    nautilus – File Manager (GNOME)
    dolphin – File Manager (KDE)
    konqueror – Web browser (KDE)
    kate – text editor (KDE)
    gedit – text editor (GNOME)

How To Not Get Traced

First you are going to want to know what you need, right?

VPN

PuTTY

Tor

RDP

Proxy

RAT

SMAC

TrueCrypt

Magnet


---------------------------------------------------------------------------

First you want to buy a VPN, free VPNs are always shitty and raped
by the NSA. I sugget Private Internet Access as a good VPN,
They have no logs, offshore location and private IPs.
If you want to cut a little bit by about $2 go a head and buy nVPN.

These are VPNs that use the OpenVPN protocol so you are going to
have to need OpenVPN.

You will need to use a VPN whilst on skype or you will be easily doxed.

---------------------------------------------------------------------------

PuTTY is essential for setting up a SSH/VPS network. If someone DDoS's your
VPN you can fall back to you SSH/VPS untill your VPN comes back up.
SSH is also a good layer to your chain (will speak about soon)

---------------------------------------------------------------------------

Tor Browser is a brilliant browser that is designed to stop internet spying.
Tor has 3 Nodes, Entry Node, Middle Node and the Exit node which are good
layers to your chain.
These nodes act as 3 different IPs that help reinfource your anonymity.

----------------------------------------------------------------------
-----
A RDP (Remote Desktop Protocol) works like a SOCKS5 Proxy, it is hosted
by another computer network. There are many free RDP's but some cost money,
You can easily hack RDPs. This is also a vital layer to your chain.

---------------------------------------------------------------------------

A proxy is similar to a VPN but a VPN encrypts all network access, A proxy
will only encrypt your browser network. You can set up as many proxies as
you want by using a open source tool called 'Proxifier'

I have my own project coming along called SkypeGhost, Which is a skype
configuration file which acts as a proxy of your choice. (Out soon!)

---------------------------------------------------------------------------

You will need a RAT for its Reverse Socks5 feature, this enables your current
IP to be you victims IP and you will be Doxed/Traced to him.
Most RATs have this feature, If you dont want to set up portwarding you need
to use a PHP Rat.

---------------------------------------------------------------------------

SMAC is a tool like a VPN but for your MAC address, it works too spoof your
MAC address making it harder to trace you. Their are other alternatives
to SMAC but I think this is the best for me.

---------------------------------------------------------------------------

TrueCrypt is a tool for encrypting your hard drive from pentesters,
you can choose which HDD's to encrypt as you go!

---------------------------------------------------------------------------

A Magnet is used for rolling along your HDD if the cops come to
destroy the drive.

---------------------------------------------------------------------------

Your chain should look like this;

RDP>>VPS/SSH>>VPN>>Reverse SOCS5>>Your Proxy Chain>>Tor Entry Node>>
Tor Middle Node>> Tor Exit Node

Information Gathering With dnsrecon Kali Linux

DNSRecon is a tool for enumeration, coded in python.

DNSRecon provides the ability to perform:

• Check all NS Records for Zone Transfers
• Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT)
• Perform common SRV Record Enumeration. Top Level Domain (TLD) Expansion
• Check for Wildcard Resolution
• Brute Force subdomain and host A and AAAA records given a domain and a wordlist
• Perform a PTR Record lookup for a given IP Range or CIDR
• Check a DNS Server Cached records for A, AAAA and CNAME Records provided a list of host records in a text file to check
• Enumerate Common mDNS records in the Local Network Enumerate Hosts and Subdomains using Google

So Lets begin:-

      

                                     Open dnsrecon through Kali Linux >> Information Gathering >>  Dns Analysis >> dnsrecon

For std, type: dnsrecon -t std -d youtube.com

For SRV type : dnsrecon -t srv -d gmail.com

 For axfr, type:-dnsrecon -t axfr -d saintangelos.com

 For tld, type: dnsrecon -t tld -d saintangelos.com

Enumerating DNS records with DNSenum Tool in Kali Linux

Multithreaded perl script to enumerate DNS information of a domain and to discover non-contiguous ip blocks.

OPERATIONS:

• Get the host’s addresse (A record).
• Get the namservers (threaded).
• Get the MX record (threaded).
• Perform axfr queries on nameservers and get BIND VERSION (threaded).
• Get extra names and subdomains via google scraping (google query = “allinurl: -www site:domain”).
• Brute force subdomains from file, can also perform recursion on subdomain that have NS records (all threaded).
• Calculate C class domain network ranges and perform whois queries on them (threaded).
• Perform reverse lookups on netranges ( C class or/and whois netranges) (threaded).
• Write to domain_ips.txt file ip-blocks.

Source: https://github.com/fwaeytens/dnsenum

DNS enumeration is the process of locating all DNS servers and DNS entries for an organization. DNS enumeration will allow us to gather critical information about the organization such as usernames, computer names, IP addresses, and so on. To achieve this task, we will use DNSenum

and enter the following command

root@Kali:~# dnsenum - - enum example.com

It Will Show you Host address , Name Servers address , Mail ( MX) Server and Zone Trabsfer Information.

Enumerate DNS Records using dnsdict6

                                            *INTRODUCTION*

If you want to gather information about a target’s DNS, you should probably use a tool like dnsdict6 to help you to enumerate many of the details which are not easily apparent for your average user or websurfer.

With dnsdict6 you find information such as:

·      Subdomain info

·      Enumerate all ipv4 and ipv6 addresses.

·      You can also enumerate details of srv records.

·      Also you can enumerate details of Name Server and Mail Exchanger records.

So, now we will jump into dnsdict6 on Kali Linux, your best option for a penetration testing distribution.

HOW TO OPEN DNSDICT6 ON KALI LINUX

To open dnsdict6 goto > Kali Linux > Information Gathering > DNS Analysis > dnsdict6
See the below image:

DNSDICT6 OPENED

Once you opened dnsdict6, you will find various options on your screen.
A good Pen Tester will always read and understand all options at his disposal.
So lets see what kind of options we have, and some examples:

• -4 : dump ipv4 addresses : Try this example on your terminal > Example > dnsdict6 -4 [url]
• -t [#] : specify the number of threads.  Remember default is set to 8 and max threads you can use is 32. Ex : dnsdict6 -d -t 18 [url]
• -d : it displays ipv6 info on NS, MX DNS domain information. Example : dnsdict6 -d [url]
• -S : perform SRV service records. Example : dnsdict6 -S -t 21 [url]
• -[smlx] : This options is for choose size of the inbuilt dictionary -s : small, -m medium, -l : large, -x: xtreme

For more information you can see the below image:

DNSDICT HELP OPTION

If you need help you can use the help option.
Command is :
dnsdict6 -h
See the result of this command in the below image:

EXAMPLE 1 : ENUMERATION WITH DEFAULT SETTINGS

This example shows the DNS entries of a given url.
Command is :
dnsdict6 google.com
When you run this command with options it automatically takes the default no of threads i.e 8 and dictionary size -m(eduim=796).
And in this command, it takes 1 – 2 minutes to complete this process.
See the below image:

This tool shows you big list of entries if you are enumerating a larger web domain, such as facebook, google, etc…

EXAMPLE 2: ENUMERATING DNS RECORDS

In this example, you will find the nameserver (NS) and Mail exchange (MX) records.
To see the NS & MX records, you have to use “-d ” option. As we have used in our example.
After running the command, it shows the dns records of google.com with ipv4 addresses.
Why Ipv4 addresses? Because we used the -4 option with the command which dump all the ipv4 addresses.
Remember: If we dont specified any threads and dictionary size, it takes it default threads(8) and dictionary size (medium).

EXAMPLE 3 : ENUMERATE  IPV4 IPV6, NAME SERVER, MAIL SERVER  WITH OPTIONS

This example is same as above in case of enumerating NS and MX records but the mail difference is we are going to set the number of threads and dictionary size manually.
Command is :
dnsdict6 -d46 -t 32  google.com
This command will display the NS and MX records with their ipv4 and ipv6 addresses and the number of threads we use is 32 and dictionary file size we used is xtreme.
So try this example and you will be able to gather as much information as you can

EXAMPLE 4 : ENUMERATE SRV SERVICE RECORDS

Finally, we will take a look at an SRV Record example.
First, we should understand what an SRV Record actually is: (according to Wikipedia)
A Service record (SRV record) is a specification of data in the Domain Name System defining the location, i.e. the hostname and port number, of servers for specified services.
It is defined inRFC 2782, and its type code is 33. Some Internet protocols such as the Session Initiation Protocol (SIP) and the Extensible Messaging and Presence Protocol (XMPP) often require SRV support by network elements.

CONCLUSION:-

This tool is used for enumerating DNS records.
Now that you have the basics, you can try more on your own!
This tool will help you better understand the workings and compartmentalization of domains as well as how a the target business network is organized. This information is for educational and legal Pen Testing utilization. Do not do things that are evil and bad.

Configure VPN In Kali Linux

VPN is not configure in Kali Linux. If u want to connect vpn in kali linux , first install pptp and network openvpn in kali linux using apt-get install.
Command :
apt-get install network-manager-openvpn-gnome
apt-get install network-manager-pptp
apt-get install network-manager-pptp-gnome
apt-get install network-manager-strongswan
apt-get install network-manager-vpnc
apt-get install network-manager-vpnc-gnome
/etc/init.d/network-manager restart

Metasploit Browser Autopwn

In nowadays due to firewall restrictions and patch management policies exploitation of systems has become much more difficult.However one of the most efficient way is the use of client-side attacks.Client side attacks requires the user interaction and in most of the cases can be used through social engineering engagements.An employee which will not have the necessary knowledge to understand the risks of opening untrusted links can help an attacker to exploit any internal systems.Also the fact that browsers are not patched as often as operating systems makes the problem bigger.

In this article we will examine the effectiveness of metasploit browser autopwn module.The basic idea behind that module is that it creates a web server in our local machine which will contain different kind of browser exploits.When the user will open the malicious link then the execution of the exploits will start against the browser of the user and if one of the exploits is successful a meterpreter session will open.

In order to use this attack we have to open the metasploit framework and to use the browser_autopwn module.In the next image you can see the available options and default settings for this module.

We will set up the LHOST with our IP address,the SRVPORT with the port 80 (otherwise the link that we have to send to the user must me in the format IP:8080) and the URIPATH with / in order to prevent metasploit to set up random URL’s.

After the execution of this module we will notice that different exploits for a variety of browsers will start loading to our web server

Now we can share the link through our email to our client employees.If any user opens the malicious link,the autopwn module will try all these exploits in order to see if it can break into the client.If the browser is vulnerable to any of these exploits meterpreter sessions will open.

Browser based attacks are not stable.This is because browsers can crash which means that the meterpreter session or the shell access will lost.For that reason the metasploit will try to migrate with a another process more stable as soon as possible.

Conclusion

Most of the organizations are behind proxy firewalls so only the port 80 is allowed.From the other hand many employees are using social networks these days for various reasons.An attacker can exploit that and send malicious links through the social networks to users so the use of this attack can be very effective against companies as it contains exploits for most of the popular browsers and it only requires the mistake of one person in order to be successful.Metasploit Browser Autopwn module is the proof of how dangerous is to open links that are coming from untrusted sources