How to install arachni_web in kali linux 2017

I was having an issue with installing arachni_web via git clone, (actually i was running into all kinds of dependency issues with ruby) so I figured another way to do it

first i changed into the Downloads directory

pentestblack@kali:~$ cd Downloads/

then visit the arachni download page 

and choose either the 32-bit or 64-bit download if your not sure what you have grab the 32-bit one, for this demo we are using the 32-bit download, so now we need to get wget to fetch the file

pentestblack@kali:~/Downloads$ wget https://github.com/Arachni/arachni/releases/download/v1.4/arachni-1.4-0.5.10-linux-i686.tar.gz

we also want the SHA1 checksum (this is to check the integrity of the file you download ensuring it hasn't been tampered with)

pentestblack@kali:~/Downloads$ wget https://github.com/Arachni/arachni/releases/download/v1.4/arachni-1.4-0.5.10-linux-i686.tar.gz.sha1

Once they have both downloaded verify the download

pentestblack@kali:~/Downloads$ cat arachni-1.4-0.5.10-linux-i686.tar.gz.sha1 
This will give us the SHA1 checksum which is (at time of writing)
b0979003bae7d05020c9388e40113775df11d03a

copy this number by highlighting it, right click and select copy, next command

pentestblack@kali:~/Downloads$ echo b0979003bae7d05020c9388e40113775df11d03a arachni-1.4-0.5.10-linux-i686.tar.gz | sha1sum -c

you should see

arachni-1.4-0.5.10-linux-i686.tar.gz: OK 




if you see ANYTHING other than this line do not proceed as it would mean the file you have download has most likely been tampered with and any installation of the files may lead to security issues and/or compromise of your system, for example


arachni-1.4-0.5.10-linux-i686.tar.gz: FAILED
sha1sum: WARNING: 1 computed checksum did NOT match

 Once have verified the download we can now complete the next few steps quickly 

pentestblack@kali:~/Downloads$ tar -zxvf arachni-1.4-0.5.10-linux-i686.tar.gz 


This will create a new folder called arachni-1.4-0.5.10 and we now need to change into this directory 


pentestblack@kali:~/Downloads$ cd arachni-1.4-0.5.10/

now we are in that directory we need to change into the bin directory 

pentestblack@kali:~/Downloads/arachni-1.4-0.5.10$ cd bin

now we are ready to launch arachni_web, to do this simply run

pentestblack@kali:~/Downloads/arachni-1.4-0.5.10/bin$ ./arachni_web 






after a few seconds you will see the following output 

Puma 2.14.0 starting...
* Min threads: 0, max threads: 16
* Environment: development
* Listening on tcp://localhost:9292 

now open a web browser and enter 

localhost:9292
and you will see the arachni_web login page (as shown below)

 

default credentials are 














username: admin@admin.admin
password: administrator



you will now be logged into the arachni_web (as shown below)

congratulations you have now installed arachni_web on kali linux

you can check the video on youtube

 

How to Bypass the Twitter Phone Verification without using your real phone number

Twitter often and quite easily locks accounts and the only apparent way is to give them your phone number.... OR more reasonably "a number" and I have 2 problems

• I don't want to directly give them my actual real day to day number I mean who the fuck does ?
• I  do have a seperate sim i often use for these annoying kind of things - BUT - that number is tied to another account that got locked so no can use that  (as show below)

 
So this time i was stuck... a little

This is quite a common problem any pentester will atest to that, and any serious internet user will too. Those that live in the US (not sure about canada) can use google voice but that involves adding a phone number to google voice to forward your calls too.

• I dont want to to give google my number (although they most likely have it already, with all the piss poor app permissions out there unwary friends and family will most definitely have inadvertently uploaded the contacts of their phonebook to fuck knows who)  

So what options have us good old brits got?

Its quite simple really

Ideal but not required - have a secondary device that only uses wifi and has no phone number attached to it (tablet, second phone thats old or BLOCKED) the more privacy conscious of us will recognize the cost of this

Install an app called dingtone - there may be other apps that do this but I have used dingtone several times in the past where I have needed a landline number with a new account you will need to build your credits up, 60 credits required to get a free landline number this can be achieved easily by completing offers **best and fastest way is to complete the offers where you need to install and run an app ** simply uninstall them once installed and you collect your credits. This can easily be done within 30 mins Stay away from survey apps they take long and are annoying

once you have your 60 credits you can choose a landline from

• CANADA
• UNITED STATES
• GREAT BRITAIN
• you can choose many many numbers from many cities within those countries

The greatest thing is this works over WIFI **so dingtone themselves dont require ANY number from you at all and this is exactly what I need now choose a number enter it on twitter and  almost instantly twitter calls with a  verification code - result

 Download dingtone from http://dingtone.me/d?i=n1Qgdo and use my invitation code to get a gift: kse7ue.

So what do you guys think is there an easier way to do this ?

I'm sure once twitter is aware of this they'll take extra measures to prevent it so get on it while you can

overthewire.org [SPOLIER] BANDIT level 14-15 hacking wargame

The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.

Thankfully this is one of the easier tasks. First you need to have the password for the previous level which you can watch get by watching the video below (best watched full screen)

Now with a few commands and we will have the next password, commands are in bold

bandit14@melinda:~$ telnet
telnet> open
(to) localhost:30000
telnet: could not resolve localhost:30000/telnet: Name or service not known
telnet> open
(to) localhost 30000
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e
Correct!
[THE PASSWORD WILL BE DISPLAYED HERE IN YOUR TERMINAL]


watch the video here

What happens after we are inside the network | Post Exploitation Wizardary

What happens when you have you have gained access? what next?
well to help you out there is some sorcery we can perform to further pivot inside the network possibly going from a low level user to root access with admin privileges.
 

Well thanks to +Rob Fuller  aka @mubix who has put together some advanced post exploit techniques which amounts to shear awesomeness from the command line simply enter.

git clone https://github.com/mubix/post-exploitation-wiki.git

[this will download and create a folder called  post-exploitation-wiki in whatever directory you run the above command from]

congratulations - you know have access to some really useful stuff  for example

• useful commands (how do i see whose logged in again)
• important file locations (where are those pesky passwords stored)
• all kinds of other shit
• I'm sure you get the hint

Liveatc.net shannon high control ATC - Virtual Radar Server - FlightRada...

Liveatc.net shannon high control ATC - Virtual Radar Server - FlightRada...

level1 dojo1 shortcutFoo command line

Off topic subject

okay okay, I know its totally unrelated, never the less, you can get the awesome oddworld munches oddysee from the google play store for none other than 10p

Google Play Store

not sure how long this has been at this price or even how much longer it will stay at this price

ps I was given £1 to spend in the play store a few weeks ago from google, which had about a 6 week expiry so check your emails and see if you've got anything if not check the google rewards app