sudo: super user do!
cat /etc/shadow
will be denied if you're not a super user
sudo su -
to switch user to root (super user)
root
is the userkali
is the hostpwd
print working directoryctrl L
clean terminalls
list folders and filesls -la
long all (hidden files) https://explainshell.com/explain?cmd=ls+-la orman ls
orls --help
cd /
to give absolute pathcd ~
to go homemkdir
create directoryrmdir
remove directoryecho 'hi!'
to print hi!echo 'hi!' > test.txt
to print hi! to a txt filecat test.txt
to print out the file hi!cp test.txt Downloads/
to copy file to a subfolderrm Downloads/test.txt
to remove a filemv test.txt Downloads/
to move a filefind / -name 'test.txt'
passwd
to update your password (password)
drwxr-xr-x
- d for directory
- rwx read, write, execute for the owner
- r-x group can read and execute (cannot write)
- r-x all other users can read and execute (cannot write)
for pentesting, we look for full access
temp directory: drwxrwxrwt (full access)
echo 'hello' > hello.txt
(read & write permissions by default)chmod
to change modechmod +rwx hello.txt
the file is now green (only for owner: -rwxr-xr-x)chmod 777 hello.txt
will give -rwxrwxrwx (7 for rwx), 644 rw for owner, read for the others
creating another user:
adduser john
(useradd)su john
cat /etc/passwd
at the bottom we can see the usercat /etc/shadow
to see the passwordscat /etc/sudoers
to see who has to sudogrep 'sudo' /etc/group
to see the users part of the group
best practice: we don't want to have a root password, to enforce people to log with their account and be granted the sudo privilege
windows: same hash for the same password, not the case on linux
ip a
to get your ip (colorful)ifconfig
(old way to do it)iwconfig
for wireless connectionsip n
for neighbors (colorful)arp -a
what ip address is associated with what mac address (old way to do it)ip r
routing table (colorful), can be different than ip a, we can discover routes to "open" to the external networkroute
(old way to do it)ping 192.168.138.2
ctrl C to stop on linux (loop), only 4 packets sent out on windows (ipconfig)ping WIKIHOW.COM
https://www.wikihow.com/Ping-an-IP-Addressping 127.0.0.1
ping yourselfnetstat
to see open ports
some machines doesn't allow icmp traffic, no response doesn't mean it's not online
echo "hello" > hey.txt
echo "hello again" >> hey.txt
will add to the text filetouch newfile.txt
nano newfile.txt
ctrl X when you're done editingcat newfile.txt
nano, vi, vim (impossible to quit vim jokes)
https://www.reddit.com/r/ProgrammerHumor/comments/oev9pl/im_tired_of_seeing_cant_exit_vim_jokes/
mousepad gui, gedit (old)
sudo service apache2 start
(old way to do it)- connect yourself to your ip in your browser, you will see a apache2 debian page, with the path where you can put files
sudo service apache2 stop
python3 -m http.server 80
python -m http.server
on windows, will work on http://localhost:8000/ (reference: https://developer.mozilla.org/fr/docs/Learn/Common_questions/Tools_and_setup/set_up_a_local_testing_server)sudo systemctl enable ssh
to enable it when launching the computer (keep it disablesudo systemctl disable ssh
, security best practice)
su ~
to go to the root
sudo apt update && apt upgrade
- update will check for packages we could update
- upgrade will do the actual update
- upgrading on kali linux can break things! always have a backup copy of your linux
apt install package
to install a package
brute force o365 github: the kind of search you can make to find tools available on github repos check the number of stars, forks and latest commit
pimpmykali.sh to fix some issues with the current kali distribution
- create a
opt
folder and clone the repo - run the script and enter
N
for a new installation - say yes to re-enable the ability to login as root, define a pwd
root
, no need to copy files from kali user.
ping 172.17.0.1 -c 1 > ip.txt
to ping oncecat ip.txt | grep "64 bytes"
to find the line starting with 64 bytescat ip.txt | grep "64 bytes" | cut -d " " -f 4 | tr -d ":"
cutting out the ip address, d stands for delimiter, we want the 4th field, translate to remove the semi-colonchmod +x ipsweep.sh
for ip in $(cat ips.txt); do nmap $ip & done
one line to explore all the IPs