Posted on 1 Comment

Upload shell and hack a website:Part 2-web shells in kali linux

Good morning everybody. In Part 1 of this series, we saw how one of the most popular shells can be used to hack a website. However popularity has its own disadvantages, at the least in the field of cyber security. The C99 php shell is very well known among the antivirus. Any common antivirus will easily detect it as malware. Although it is unlikely that web servers will be installed with antivirus, still it is good to stay one step ahead. So today we will see some of the least popular but still effective web shells.

As you all know, Kali Linux is one of the best pentesting distros available. It would be very disappointing if it didn’t have web shells in its arsenal. Open a terminal and navigate to the directory “/usr/share/webshells” as shown below. As you can see, web shells are classified according to the language of the website we are trying to hack. Today we will see about PHP shells. So go into that directory and do an “ls”. You can see the shells below.

Now let us see their features by uploading each one them into web server we want to hack. See how to upload the shells.

  1. simple-backdoor.php

As the name clearly tells, the functioning of this shell is very simple. It is used to execute some commands on the target web server. Let us go to the shell’s link after uploading and execute the “net user” command as shown below. As already used in Part 1, this command gives us all the users present on the Window’s system.

Similarly let us execute another powerful command “systeminfo” to get the web server’s whole information as shown below. Sorry about the censor.

php-backdoor.php

The php-backdoor, as the name implies  is file upload shell just used to add more backdoors. It helps us in the case where we can’t easily upload any additional files we want.

I works akin to file upload function in our Part 1. As you can see below, it has upload form and a function to execute commands. We can also connect to the database.

php-reverse-shell.php

Every shell doesn’t require us to visit the web server. In fact we can make the webserver visit us. Enter the php-reverse-shell. As its name says, it makes a reverse connection to our attacker system. In order for this shell to make a reverse connection, it needs an IP address. So before uploading this shell we need to change the IP address in the script to our IP address ( Kali Linux ) as shown below. Save it and close it.

Next, let us start a netcat listener in one of the terminal. If you are new to netcat the command “nc -v -n -l -p 1234” tells netcat to listen verbosely on port 1234. Remember the port number should be same as we specified above.

Now when we upload the shell, On kali linux we will get a terminal as shown below. Hit “ls” to see the contents of the directory.

qsd-php-backdoor.php

The qsd-php-backdoor is compatible with both Linux and Windows web servers. As we upload it, it will detect whether the web server is Windows or Linux and then acts accordingly. The screenshot is shown below. As you can see we can move to the root directory of web server and come back, execute shell commands and SQL queries.

You already know what happens when we execute “systeminfo” command as shown below.

That’s about web shells in Kali Linux. Hope it was helpful.

Posted on 2 Comments

How to install Veil Evasion in Kali Linux

Good evening Friends. Today we will see how to install Veil Evasion in Kali Linux. Although this howto is made on Kali Linux Sana, it is same for all the versions of Kali. For the novices, Veil-Evasion is a tool to generate payload executables that bypass common antivirus solutions. First of all download and save the zip file of veil evasion as shown below from here.

Next, Open terminal and go to the directory where the zip has been downloaded. Commonly it is root or Downloads. Mine is in root. Next unzip the contents of the zip file by using command unzip “Veil-Evasion-master.zip” as shown below.

When unzipping is finished, type “ls” command once again. You will see a new directory “Veil-Evasion-master”. Change into that directory as shown below and type “ls” to see the contents of that directory.

There will be a dircetory named “setup”. Change into that directory. You will see a file named “setup.sh”. Execute that file using command  “./setup.sh

It will prompt you a question whether you want to continue with the installation or not. Type “y”.

The installation will start. It will ask you whether to install Wine. Click on “Install”.

Next it will install Python. Click on “Next”.

Click on “Next”.

If it asks you to overwrite existing files of any Python, select “yes”.

Click on “Next” for the below window.

Finsih the installation by clicking on “finish”.

Next, the system will ask you to install pywin32. Pywin32 is a set of extension modules that provides access to many of the Windows API functions. Click on “Next”.

Click on “Next”.

Click on “Next”.

Click on “Finish” the script.

Next it will install pycrypto. Click on “Next”.

Click On “Next”.

Select language as “English” and click on “OK”.

Next it prompt you to install Ruby. Accept the license and click on “Next”.

Click on Install.

Click on Finish to to finish the installation of Ruby.

You will see the below screen as the installation finishes.

Now let us see if our installation has been successful by starting the program. Go to the “Veil-Evasion-master” directory in which there is a python script called “Veil-Evasion.py”. Execute this script by typing command “./Veil-Evasion.py”.

This is how Veil-Evasion looks when started.

Posted on 1 Comment

How to make live usb of kali linux

Hi Everybody, today we are going to see how to make live USB of Kali Linux. Live USB installation has many advantages like system administation, forensics and testing of the OS before making a hard drive installation. However what prompted me to make kali live USB  was wifi hacking. My laptop has a compatible adapter for wifi hacking but Kali Linux in Vmware Workstation recognizes your host’s wifi adapter as a ethernet adapter. So I thought I could postpone buying a usb wifi adapter for some time by making a live usb installation of kali linux.

Whatever, let’s get to how to make Kali Live USB. First we need to download software called win32diskimager from here,  Install the software and launch it. It will look like below.

Plug a USB drive into your laptop. Make sure it is atleast 4 GB.  In the “device” tab, select your USB drive. In the “image file” tab, browse to the iso image of Kali Linux as shown below.

Click on “Write”. That’s it you have successfully made a live USB of Kali linux. Hope that was helpful.

Posted on 6 Comments

How to spoof your IP address in Kali Linux

Kali Linux is the most advanced penetration testing distribution with a number of tools. While using these tools a measure of anonymity is required. Today we are going to see how to spoof your IP address in Kali Linux. First, check your IP address by visiting any website which shows your IP address ( http://www.whatismyip.com ). Then go to the site www.vpnbook.com.

Download the Euro1 Server OpenVPN certificate bundle as shown below. Note down the username and password given. We will need it in later steps.

When you click on the download link, the following window opens. Since it is a zip package, system will prompt whether to open it with unzip ( the default option ). Click on “OK”.

Open the terminal and navigate to the directory where the contents of the zip archive have been unzipped. Type the command “ls” to see the unzipped files. We are going to use the vpnbook-euro1-udp53.ovpn package.

OpenVPN has been installed by default in the Kali Linux distribution. Type the command “openvpn vpnbook-euro1-udp53.ovpn” to start the process.

The installation starts.  Enter the username and password we noted above when prompted.

After a short time, the process is completed. Check your IP address again. If everything goes well, your IP address will be changed.

Posted on 26 Comments

How to create pen testing lab in VirtualBox.

Good evening everybody. Sometime back, I wrote an article on how to set up a virtual penetration testing lab using Vmware Workstation. But Vmware Workstation is a commercial product.

Today I am going to show you how to create a pen test lab in VirtualBox absolutely free of cost. I hope this tutorial will be helpful for many beginners into cyber security domain.

What do we need?

1. Oracle VirtualBox. (Download)

2. Kali Linux. (Download)

3. Metasploitable 2. (Download)

Oracle VirtualBox is the virtualization software we will be using to create our lab. We will be using Kali Linux as the attacker machine and Metasploitable 2 as the victim machine. Install Kali Linux and Metasploitable 2 in VirtualBox.

See how to install Kali Linux in VirtualBox.

See how to install Metasploitable in VirtualBox.

Select Kali Linux, Go to settings > network. Enable “network adapter 1″. Set the “Attached to” option to “internal network”. Set the name of the network adapter to “intnet”. Click on “OK” to save the settings.

Do the same for Metasploitable virtual machine.

Power on the metasploitable VM. Log into the system. Default username and password are “msfadmin”.

Type the command “ifconfig” to see the IP addresses of interfaces.

The ‘lo’ interface is the loopback. Now we are going to set the IP address on the interface “eth0”. Type the command “sudo ifconfig eth0 10.10.10.2 netmask 255.0.0.0 up”. The sudo password is “msfadmin. Verify that the IP address is set by typing command “ifconfig”.

Power on Kali Linux. In the terminal, type command “ifconfig eth0 10.10.10.1 netmask 255.0.0.0 up”. Verify if the IP address is set by typing command “ifconfig”.

Test whether this system can communicate with victim system by pinging the victim machine as shown below.

The connection is successful. Our penetration testing lab is ready. Happy practicing.

Posted on 222 Comments

Install Kali in Virtualbox (Update to kali 2020.4)

The makers of Kali Linux have a released the second version (2020.2) of Kali Linux for the year 2020.  Since many versions have been released since we last wrote this article, we decided to update this article on how to install Kali in Virtualbox.

Kali Linux 2020.2 has many brand new features.  With xfce and gnome given Kali Linux feel, this release has given themes for KDE Plasma. This is like going back to its roots as Backtrack used to have this desktop environment. The login screen also has been given new graphics along with a new layout. Also now you can install Powershell by default by selecting the meta package while installing. This release also updated gnome to 3.36. The new tools included in this release include NextNet, the pivot point discovery tool and SpiderFoot  the OSINT tool.

The makers also included python2-pip once again to add support to some tools still depending on python2 although overall it upgraded to Python 3.8. This release also replaces CherryTree, the note taking application with Joplin. Now, let us see the simplest process  to install Kali in Virtualbox. For this download the virtualbox image of Kali Linux 2020.2 from here. We have performed this installation in the Oracle Virtualbox 6.

This howto is using the Kali Linux 32bit OVA . Your downloaded contents should look like below. As you can see, we have an ova file.

Now open Virtualbox and go to File Menu > Import Appliance as shown below. It can also be accessed using shortcut CTRL+ I.

A window like below will open. Browse to the OVA file we downloaded.

After selecting the OVA file, click on “Next”.  If you want to make any changes to the virtual machine settings like RAM, name etc, you can do it here. You can also leave it to default values if you want. Click on “Import”.

Click “Agree” when the software license agreement pops up as shown below. The import process starts.

After the import process is completed, Power On the virtual machine. You will see a login screen prompt. Login using the credentials kali:kali.

Here is the final look of the Kali Linux virtual machine we installed.

Posted on 4 Comments

How to install Nessus in Kali linux

Nessus is a vulnerability scanner. My first disappointment  with Kali is that it excluded nessus from its vulnerability scanning tools. However it can be installed. Let us see how to install Nessus in Kali Linux. This guide works for all versions of Kali Linux. First download the nessus Debian package from the website ( here ). Go to the directory into which the package has been downloaded. It should normally be in the Downloads directory in root directory.  Open a terminal, navigate to the “Downloads” folder and type “ls“. You can see the debian package of Nessus. Then type the command “dpkg -i  package name” as shown below.

Then type command “service nessusd start” to start the service.

Open a browser and type “https://kali:8834/” to see the web interface of nessus. You will see the below warning that the connection is untrusted.  Click on “I understand the risks” option.

You will get a popup to confirm the security exception. Click on that option.

Then you will get a welcome screen of nessus as shown below. Click on “Continue”.

Its time to create our initial account. Type the username and password you want to set up for the account. Click on Continue.

Its time to enter the activation code for Nessus. You can get the activation code from here. After entering activation code, click on Continue.

After activation is completed, it will download the nessus packages required. It may take a bit long time.

Then we need to wait some more time while the program initializes.

After the initialization is over, you will see the Nessus scan page as below.

Congrats, you have successfully installed Nessus in Kali Linux.

Posted on Leave a comment

How to configure armitage on Kali Linux

If you tried to start armitage on Kali Linux, it will show you the following error.

The error says that the service cannot connect to the database. Now let’s see how to configure armitage on Kali Linux. First, lets check if armitage is installed on our machine or not. Open terminal and type the command “apt-cache search armitage”Then type the command “apt-get install armitage”. If everything is right, it tells you that armitage is already installed.

Now let’s rectify the database connection problem. Type the command “service postgresql start”. This will start our database service. Then start metasploit service by typing the command “service metasploit start”

Then type the command “armitage”. You should successfully see armitage working.

Posted on 4 Comments

Setup a virtual pen testing lab : Step by Step guide

Virtual penetration testing lab is a lab created on a single system using any virtualization software. It can be very helpful for people practicing for CEH or similar certification. Any penetration testing lab has two machines, attacker and victim. In this lab we will set up Kali Linux as the attacker and Windows XP( most favorite victim machine ) as the victim. I am going to set up this lab in Vmware Workstation 9. Hope this will be helpful.

First of all install Kali Linux and Windows XP in Vmware Workstation.

Shut them down. In the Vmware Workstation menu, Select Edit” and click on Virtual Network editor.

The window below will open showing the virtual network adapters. Click on “Add network”.

Vmware provides nine virtual networks from 0 to 9. Vmnet0, Vmnet1 and Vmnet8 are automatically assigned for  bridged, Host-only and NAT types of network respectively. Select the network “Vmnet3″.

We can see that our network is added as Host-Type with a automatically assigned subnet IP.

Click on our network. We can see its settings below.

Deselect the option ‘Connect a host virtual adapter to the network’. This’. This‘.This will make our network a custom type. Change the subnet IP to 10.10.10.0( choice is yours).  Select the ‘Use local DHCP service to distribute IP address to VMs‘ option. This will automatically assign IP addresses to our machines. Click on ‘DHCP settings‘.

You will see the below window. Make changes if you like. I am going to leave it default. Click OK twice to exit.

We have successfully created our custom network. Now let’s add our machines to the network. Open the tab of Kali Linux and click on ‘network adapter‘ setting.

In the settings, select the ‘custom radio button and select the network Vmnet3 from the dropdown menu. Click on OK.

Do the same for Windows XP. Then let’s boot up our victim machine and check it’s IP address by typing ‘ipconfig‘ in the command line. The DHCP server has automatically assigned it the IP address 10.10.10.129.

Boot the attacker machine and check it’s IP address by typing ‘ifconfig’ in the terminal. It has been assigned the address 10.10.10.128.

Ping the victim IP machine (10.10.10.129) to see whether the two machines can communicate.

We have successfully created a virtual penetration testing lab. Happy testing.

Posted on 2 Comments

Nmap – Target Specification

Nmap is a popular port scanner. Today we are going to see target specification in nmap. In Nmap target can be specified in six different ways. We are going to look at each one of them. For this, I am using Kali Linux connected internally with IP address 10.10.10.2.

1. nmap -iL <input filename>

This option reads targets from a specific file. Let’s create a file named alpha with a few   newline separated or tab-limited or space separated IP addresses using vi on Desktop.

Then, move to Desktop directory and type the command “nmap -iL alpha” as shown below. It scans the four IP addresses listed in our file.

2. nmap -iR <number of hosts>

This option is used to specify random hosts to scan. Nmap generates its own targets to scan. The <number of hosts> argument tells nmap the number of IP’s to generate. Let’s type command “nmap -iR 5″. We can see that nmap generated five random targets to scan. The scan failed to determine route to the generated IP addresses because my system is not connected to Internet. Why didn’t it generate any internal IP addresses? Because in this scan private, multicast and unallocated address ranges are automatically skipped.

3. nmap <IP address/dir>

This option is used to scan the entire subnet.  Assuming you know CIDR let’s type the command nmap 10.10.10.1/29 to scan eight IP addresses from 10.10.10.1 to 10.10.10.8 and see the result below.

4. nmap [targets] -exclude[targets]

This option specifies a comma separated list of targets to be excluded from the scan even if they are part of overall network range we specify. For example, in our previous scan we saw that one host 10.10.10.2( which is the system I am working on) is alive. Now I decided to exclude that host and another host from the scan. So I type the command “nmap 10.10.10.0/29 -exclude 10.10.10.2,10.10.10.7″ and press “Enter”. We can see that nmap has only scanned six IP addresses.

5. nmap [targets] -excludefile[file name]

Now what if the subnet was very big and there are more number of hosts to be excluded from the scan. The above option helps us to achieve this. Remember the file “alpha”( with four IP addresses) we created. Now let’s specify nmap to quit scanning the hosts listed in the file. Type command “nmap 10.10.10.0/29 -excludefile alpha”. We can see that nmap scanned only four hosts in the subnet.

6. nmap [target1 target2  target3]

This option specifies nmap to scan multiple targets separated by space. Type the command  “nmap 10.10.10.1 10.10.10.2″. We can see the result below.

Hope this was helpful.