level1 dojo1 shortcutFoo command line

Off topic subject

okay okay, I know its totally unrelated, never the less, you can get the awesome oddworld munches oddysee from the google play store for none other than 10p

Google Play Store

not sure how long this has been at this price or even how much longer it will stay at this price

ps I was given £1 to spend in the play store a few weeks ago from google, which had about a 6 week expiry so check your emails and see if you've got anything if not check the google rewards app

Back & refreshed

So after a short hiatus I'm back, hope you all are well! I can only apologise for a lack of content or updates but I just needed a break, so over the last 3 or 4 months I've not read any emails at all. NIL. In fact this device hasn't been on since around May, so I've got an absolute shitload of catching up to do and will report back mid week

Peace

Linux+ chapter 1 Understanding command line basics UNAME

OK, so my test version of linux is up and running, in reality I'm using kali linux not for the entire project but just because i using my kali box for some other stuff at the time of writing.

First up the uname command.

As you begin using linux regularly you quickly realise linux uses some extremly powerful commands and there are many many ways to achieve a particular objective.

the difficult thing for me initially with linux is remembering what command does what. This is why getting practical practise is critical in retaining the knowledge who have learned; consider the following problems that need solving,

how do you ?

• print the kernel name
• print the network node hostname
• print the kernel release
• print the kernel version
• print the machine hardware name
• print the processor type
• print the hardware platform
• print all of the above

well this is what i love about linux all of the above can be done with a single command uname 
while the uname command alone doesn't reveal all of the above you need to use switches, for example.

uname -r prints the kernel release -r been the switch

uname --kernel-release does exactly the same thing --kernel-release is the switch used this time.

to get info on nearly all commands in linux use either the man or info command

• man uname
• info uname

if you anticipate doing the linux+ exams you'd certainly will need to start making mental notes of these switches and what they do, to aid us we can create our own custom quiz questions to aid us, but remember everybody learns very differently 
 

overthewire.org BANDIT level13-14

An interesting challenge this. For the first time we move away from file commands and begin making use of commands more a kin to use within network operations

The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. Note: localhost is a hostname that refers to the machine you are working on

Commands you may need to solve this level

ssh, telnet, nc, openssl, s_client, nmap

as ever with the beauty of *nix there is always more than one way to skin a cat, I simply chose the method that i know.
The full spoiler can be found at youtube

Hacking via wargames with Overthewire.org

I understand why military and security services are constantly wargaming, getting there units prepared for events before they happen, while there can be no substitute for the real thing, failing to prepare is preparing to fail. The same applies when it comes to pentesting, you need to constantly put into practice the skills you learn, one way to do this is via deliberatly vulnerable virtual machines like DVWA or Metasploitable, of which there are many some offline some online these are getting learning/teaching tools for anybody remotely insteresed in any aspect of computer security.
In the previous post I mentioned how I struggle badly with sticking to a project right through to the end, well this is another example. I'd like to introduce an awesome site I first started using back in 2014 that site is
http://overthewire.org/wargames they over a wide varitey of hacking wargames (online) they vary greatly in the skills you will need and the skills you will acquire, as I've now set myself a schedule to aid with all the learning i'm doing i will be updating (well at the very least uploading my videos) as I go along.

When i started on overthewire in 2014 I'd already begun uploading some videos to youtube only in the last week did i notice  something saying PLEASE DON'T UPLOAD SPOILERS, i have 2 issues with that

•  well i have to disagree with that, if people want to not learn anything by reading spoilers that has to be option they are allowed to take if they choose
• after not using overthewire for over 2 years i needed to to get back to the point i was last at on OTW, by looking at my youtube videos i could immediately see where i was last upto.

the latter actually saved me the rig-moral of relearning the techniques i learned the first time i started with OTW, essentially the videos acted as a prompt to quickly bring me upto speed.

When i initially started using overthewire.org i immediately noticed a page called wechall scoring. The top of the page read the following

OverTheWire makes use of a scoreboard provided by WeChall to allow players to track their own progress and promote some healthy competition between players. To make use of this scoreboard for OverTheWire games, you need to follow these steps:

awesome there is a way for me to keep  track of the progress of my activities on overthewire. the first thing i need to do was

1. First, go to WeChall and register for an account.

why the need to register an account at another website i grumbled at first but on the first visit to wechall.net I realised just how many different wargame sites there is out there. Currently at the time of posting there are 58 different wargame/hack sites that incorporates the wechall scoring system.

I've currently only used overthewire although i've briefly had a look at a few of the other sites but I cant recommend this type of practice highly enough, while i'm putting most of my focus into web application security this will help fine tune a lot of other core skills. certainly while hacking on overthewire I've learned a lot of advanced features on some of the basic linux commands like

ls,grep,cat,file,du,type,sort,uniq,strings,gzip

and lots and lots more commands i only ever used for very basic things anyway the bottom line get onto overthewire.org setup wechall scoring on your machine and hack away every day
for now you keep an eye on my overthewire playlist over at youtube which i'll most likely update in batches

PEACE

CompTIA Linux+ LX0-103/LX0-104 Initial assessment

Something that happens quite often for more, is not finishing shit off, its annoying so I m gonna use this blog as i intended it, basically as a note keeper. Truth is while beginning my bug hunting journey I quickly realized there was/is a lot of missing skill sets. They all relate to projects I started previously and never finished, namely

• learning python
• mastering the linux command line

both of which in my eyes are crucial to the bug bounty efforts, so ill keep all my  project notes here, these will be in (note to self format) and is not intended to mean anything to anyone other than myself all though others that may stumble across this blog at some point, it might be relevant to them.

Starting with the introduction assessment test, this test is solely aimed at testing your immediate knowledge of the linux system and potentially help discover any areas of work that need focusing on. so here goes........

--------------------------------------------------------------------------------------------------------------------------- 

1. option D  wrong option B
2. options A & C correct
3. B wrong option D
4. C Correct
5. C & D correct
6. E correct
7. A wrong option C
8. E Correct
9. B Correct
10. B,C,D wrong B,D,E
11. A Correct
12. C,D wrong A,D
13. C Correct
14. B Correct
15. E Correct
16. A Wrong option D
17. B,C Correct
18. D wrong C
19. D Correct
20. B Correct
21. A,B correct
22. B correct
23. A correct
24. B,D Correct
25. A,C correct
26. D correct
27. C wrong B & E
28. E correct
29. A,B wrong B & E
30. C correct

----------------------------------------------------------------------------------------------
 This answer for these are contained within the book, not only do they give you the correct answer but allows tells why the other answers are also wrong, this is an excellent way for my learning, as reading the the wrong answers helps provide possible answers for other questions, for example heres the first answer in full

1. B. The Monitor section defies the monitor options and settings but not doesn't combine it with the video card, so option A is incorrect. The Modeline line defies the available video modes in the Monitor section, but it doesn't define video cards, so option C is incorrect. Option D, the device section is also incorrect; it defines the video card but doesn't match it with a monitor on the system. Option E is incorrect because the module section defines which X server modules (or drivers) are loaded but it doesn't match monitors and video cards. Option B, the screen section, tells the X server about the combination of video cards and monitors that you're using, so it's the correct answer.

Clearly there is a lot of info here and it goes beyond simply explaining the correct answer. I highlight the key parts in the book to aid me.

for the benefit of time and this blog and as this is an initial assessment ill simply post the answers here without the details just to log how many i got right/wrong. I'm quite pleased with the results of the initial assessment test, the key thing here is learning what the wrong answers do