[Phishing] URL Shorteners for Phishing

https://tinyurl.com/

https://bitly.com/

[Phishing] Bogus website service named Z Shadow for Phishing

 https://zshadow.info/

[TryHackMe] Linux Privilege Escalation

 

1) Through sudo find out executable applications:

$ sudo -l

After that, pinpoit the resolution at https://gtfobins.github.io/

2) Seek SUID and SGID:

$ find / -perm -4000 -o -perm -2000 -type f 2>/dev/null

Exploitation is located at https://gtfobins.github.io/#+suid

[TryHackMe] FireFox Add-ons

 HackBar (Hacking tools)

https://addons.mozilla.org/en-US/firefox/addon/hackbar-free/

Cookie Quick Manager (Manipulate Cookies)

https://addons.mozilla.org/en-US/firefox/addon/cookie-quick-manager/

FoxyProxy (Easily switch Proxy settings)

https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

User Agent String Switcher (Change Browser's User Agent property)

https://addons.mozilla.org/en-US/firefox/addon/user-agent-string-switcher/

Wappalyzer (Find out targets' platforms)

https://addons.mozilla.org/en-US/firefox/addon/wappalyzer/

[TryHackMe] DNS Inspection and Reconnaissance Takeaway

 1) Manual Discovery

whois (whois tryhackme.com)

nslookup (nslookup -type=MX tryhackme.com 8.8.4.4)

dig (dig @8.8.4.4 tryhackme.com MX)

2) Automated Discovery

gobuster (gobuster dns -d DOMAIN -w /usr/share/seclists/Discovery/DNS/namelist.txt)

3) OSINT

DNS Dumpster (https://dnsdumpster.com/)

Shodan (https://www.shodan.io/)

[TryHackMe] Web Security Inspection and Reconnaissance Takeaway

 1) Manual Discovery

Robots.txt

Sitemap.xml

Favicon (https://wiki.owasp.org/index.php/OWASP_favicon_database)

HTTP Header (curl $URL -v)

2) OSINT

Google Hacking

Wappalyzer (https://www.wappalyzer.com/)

WayBackMachine (https://archive.org/web/)

GitHub

S3 Bucket

3) Automated Discovery

Seclists

ffuf (ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u http://URL/FUZZ)

dirb (dirb http://URL/ /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt)

gobuster (gobuster dir -u http://URL/ -w /usr/share/seclists/Discovery/Web-Content/common.txt)

[wifi][wireless][802.11] Conversion between Monitor Mode and Managed Mode in Kali

 Check the status of wireless adapters:

# iw dev

Turn Managed Mode into Monitor Mode assume the wireless adapter is named wlan1:

# ip link set wlan1 down

# iw wlan1 set monitor control

# ip link set wlan1 up

Turn back to Managed Mode:

# ip link set wlan1 down

# iw wlan1 set type managed

# ip link set wlan1 up