Rip 'em Out!

Been busy with report writing. Just wanna put some of these command and technique on how to restore interrupted session or aborted session in John The Ripper. 1. First step crack the hash with these commands : john --session=test --format=raw-sha --incremental=rockyou test.txt 2. To restore the abort /interrupted session that you wanted to resume just run these commands : john --restore=test Check the "test.log" Note:  Make sure that these file are not delete " .rec " and " .log " files if the file is deleted or missing it wont work. That's all happy cracking!

SQLMap will become in handy when you already discovery vulnerability on the database. Using SQLMap, we can automated the process and simply dumping the database will get much more easier compare with manual technique. Here I already setup a vulnerable box on my VMware and SQLMap install on your machine. You can download it here .  Note: For Windows machine you'll need to install python version 2.6 or 2.7 only else it might not work. For your convenience just use Kali Linux. What we can do here is analyze every URL and search for vulnerable parameter. We got SQL Error Send the vulnerable parameter to SQLMap using argument --banner --current-user --current-db --is-dba Tips: Use - help or -hh for more information about the SQLMap argument And the parameter is injectable! Dump the password hashes with --users & --passwords arguments You can either use dictionary attack with SQLMap or password cracker tool John the ripper Using John the

There are many vulnerable box that you might already heard, e.g. Metasploitable , OWASP Webgoat , PentesterLab  and etc. This boxes help you discover and understanding how does the application works discovering vulnerability and exploiting and learning how its work? How does the exploit trigger? What? How? Why? When? I'm gonna share with you one of the website that I found during on my study and research for Web Application. Then I found  VulHub ! Here you can download many vulnerable box that you wanted. There are a lot and different types of vulnerability that might wanted to gone through with. That's it! Use whatever skills and knowledge that you already know. Make sure read the   readme or the instruction manual before proceed. Have fun and happy hacking!

I been thinking and searching on how to export those harvested credentials in Metasploit into one file. Then I find a solutions for that. By using "db_export" command we can export those credential which is in the Metasploit Database. Metasploit db_export command There are two option with db_export command, -f and -a and two different format xml and pwdump. In my case, I want to save those credential with pwdump. And.... It's done!

Ok, I know nowadays people are begin to switch from Backtrack to Kali Linux , here I just wanna share a new tricks before you start using it. After that, you might wanna run an update and upgrade . Let's start with open up a new Terminal , go to " /etc/apt/sources.list" you can use any text editor you like gedit, nano, vi or vim. I'm using nano my personal favorite.  Edit the source.list file before running update and upgrade Here are the list of that you need to add to : deb http://http.kali.org/ /kali main contrib non-free deb http://http.kali.org/ /wheezy main contrib non-free deb http://http.kali.org/kali kali-dev main contrib non-free deb http://http.kali.org/kali kali-dev main/debian-installer deb-src http://http.kali.org/kali kali-dev main contrib non-free deb http://http.kali.org/kali kali main contrib non-free deb http://http.kali.org/kali kali main/debian-installer deb-src http://http.kali.org/kali kali main contrib non-free

Just wanted to share with you some trick on #HowTo to access or whatever protocol that you might wanted use. In this case I'm using SSH. First, you need to check and change the network setting on your VM machine setting. I'm running VMware Workstation v9 for this tutorial. VMware Workstation Machine Settings On the " Network Connection ", choose " Custom: Specific virtual network ". Click the drop down button and select VMnet8 (NAT) and click OK. After all the setting are well configure next we need to check whether the SSH service are running or not. Using command /etc/init.d/ssh status if the service are running no need to do anything just leave it.  Final step, try to SSH into the VM machine. You can using whatever tools that you wanted to use, PUTTY or whatever tools that suite your need. In this case I'm using Cygwin  terminal to connect into my VM. Now we are SSH into our VM and ready to rocks!

One of my personal favorite and the best platform to test your skill is PentesertLab . But before we begin there is some basic knowledge and skills you need to know before we start. PentesterLab Exercise! First thing first you must know : 1. Basic CLI (Command Line Interface) Linux 2. Some programming language skills, e.g HTML, PHP, Python or other language that are related with it. And the tools... 1. BackTrack Linux - One of the best penetration distribution among pentester and got a lot of tools. 2. Metasploit - Is most popular hacking tools that widely use among the pentester. 3. Nmap - Free tools for host discovery, port scanner and etc. There's a lot of exercises that we can do, forgot to mention you must either install VirtualBox or VMware player in order to run the platform is you already done that, then we ready to go. Also there is whitepaper for your reference before you begin the exercise. You might want to read this in case your forgot, might come in