Avi's blog

 Linux incident response cheat sheet... Download link of uac tool: https://github.com/tclahr/uac https://github.com/tclahr/uac/releases Please download the latest release of the tool from the above link. You will get the tool under Assets section for example named as: uac-3.3.0.tar.gz Setting up uac tool: Taking the tool to the victim/compromised machine: scp uac-3.3.0.tar.gz lab@192.168.10.135:/tmp scp uac-3.3.0.tar.gz lab@192.168.10.135: (if you do not give /tmp then the tool will be placed under that lab user home directory. Now provide the password of the target system) ssh lab@192.168.10.135 (Access the target system with creds) cd /tmp tar zxf uac-3.3.0.tar.gz cd uac-3.3.0/ sudo ./uac -p ir_triage /root (Run the tool using root user or with sudo privilege. -p for profile. Captured artifacts will be saved on /root directory)  Avi

 Turning off windows update that leads windows 11 system auto restart. Open run dialog box in your windows system and type gpedit.msc If nothing comes then you need to enable it. Follow Avi's google blog https://mahimfiroj.blogspot.com/2024/07/how-to-enable-gpeditmsc-on-windows-11.html or follow this link: https://www.thewindowsclub.com/local-security-policy-missing-in-windows#google_vignette Then go to: Computer Configurations > Administrative Templates > Windows Components > Windows Update > Legacy Policies Now open the following policy or setting and Enabled it. No auto-restart with logged on users for scheduled automatic updates installations .  Now open command prompt with admin privilege and type: gpupdate /force Avi

Today we going to learn how to download nessus offline plugins. Before we proceed, we need to activate nessus with pro license key.  I am assuming that the nessus is activated via offline and the license key is not used anywhere else. Remember this offline plugins update will work only those nessus in where the license code is present. A combination of challenge id and license code is used to download the plugins. When you upload the plugins, then it checks whether the same license is present there or not. If not it will allow you to upload the plugins but actually it will not update the plugins .  Lets say, in windows server nessus is installed.  Navigate the below location from command prompt and run below command: C:\Program Files\Tenable\Nessus\nessuscli.exe fetch --challenge You will get the challenge id. Copy that. Now go to the below link: https://plugins.nessus.org/offline.php Provide the challenge id and license code. Once you submit, you will get Custom URL for ...

  Cloning is a nice feature of VMware Workstation Pro. Just right click of your vm > Manage > Clone > Then specify in which folder you want save the new cloned vm. Then start cloning. Use case: Say you need 4 windows 10 machines. Just setup one and then clone it to make it 4 Avi

 Probably the target host that you are scanning do not respond to icmp echo ping request. It may think that someone launch an attack against itself. So the host firewall on the target system may blocking what Nessus wants to do.  So here are the steps you can do: Go to nessus > select the host and choose configure. Select the scan type as custom instead of port scan (common or all ports). Now go to host discovery and turn off the ping the remote host. Hopefully your scan should work now. Thanks Mahim Avi.

Kali linux mouse disappear issue fix 1. Shut down the VM. 2. Select Upgrade this virtual machine (right under Edit virtual machine settings) 3. Choose Next. 4. For Hardware Compatibility, choose Workstation 17.5 or later. 5. Choose Alter this virtual machine. 6. Choose Finish. 7. Power on the VM. Problem solved. Avi

 Base64 decode command. Go to sans sift workstation: echo "base64 payload data" | base64 -d | iconv -f UTF-16LE -t UTF-8 iconv command is used to convert double-byte Unicode to single-byte Unicode or ascii, making the output easier to read.  Avi

 Setting up plaso on your own windows host using wsl distro- windows subsystem for linux. First go to your linux vm and run below commands: docker must be installed on your linux vm. docker run -t --name Plaso-v20230520 log2timeline/plaso:20230520 log2timeline.py --version Link for plaso tags: If you want to pull latest docker image then from the below link find the relative tags. Here we are pulling 20230520 plaso version.  https://hub.docker.com/r/log2timeline/plaso/tags Making the .tar file that will be moved to windows vm. docker export Plaso-v20230520 > /cases/Plaso-v20230520.tar Now you can remove it from linux vm. docker rm Plaso-v20230520 Now take it to windows vm. Then open command prompt in admin mode and run below commands: mkdir C:\SANS\Plaso-v20230520 wsl --import Plaso-v20230520 C:\SANS\Plaso-v20230520 .\Plaso-v20230520.tar Avi

 EvtxECmd - this tool will help us to convert event logs into csv format. Later we can use timeline analysis tool to analysis the csv data more efficiently.  This tool also help us to convert logs into json format.  Download the tool first. https://ericzimmerman.github.io/#!index.md Command : evtxecmd --sync evtxecmd -f E:\C\Windows\System32\winevt\logs\Security.evtx --csv g:\Labs\event-logs --csvf security.csv evtxecmd -f "e:\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%40Operational.evtx" --csv G:\Labs\event-logs --csvf taskscheduler.csv Windows have so many event logs and so many event id's. Not all the event id's are important. Of course you can use your own but Mark Hallman created a script that will parse all the important event id's that is discussed in SANS FOR508 course. You can use mark hallman's Process-EventLogs.ps1 tool that will parse important event id's from bulk event logs leveraging evtxecmd tool.  https://github.com/ma...

 Kape is a triage collection and post-processing application written by Eric Zimmerman. Remember its just the triage collection tool ok? We will analyze the collection later.  https://github.com/EricZimmerman/KapeFiles Kape download: Kroll Artifact Parser And Extractor (KAPE) | Cyber Risk | Kroll Besides full disk image/acquired disk image, this tool allows us to create smaller triage image where important forensic data is present . In case the scenario is divide and conquer , meaning if you want smaller triage image from big size disk image then you can use this and share with your DFIR team to investigate together. The main reason of using kape is now you don't need to wading or sift through into the full image where 10% actual artifacts are present. Kape will allow you to collect those 10% before taking full image. Now you can analysis those 10% of data.  If you want to learn more, please open for508 workbook and labs section 1-2.pdf file and look for page 28. This is...

 Kansa is an IR framework. https://github.com/davehull/Kansa For enterprise data collection, you need to do this first from the admin system: Set-NetConnectionProfile -NetworkCategory Private (In private network) Enable-PSRemoting  from powershell on the system where you want to run this tool. This will enable winrm service with port 5985 and 5986. Check: netstat -naob | findstr "5985"   Also allow tcp port 5985 and 5986 for winrm through the network. You can use  GPO. Though winrm is communicating over http and https but authentication will be happened using kerberos in domain environment.  After downloading it  from the github and unzip it, you need to unlock it using powershell. Need powershell v3 or later. ls -r *.ps1 | Unblock-File Powershell policy bypass: Set-ExecutionPolicy AllSigned | RemoteSigned | Unrestricted From FOR508 course: .\kansa.ps1 -OutputPath .\Output\ -TargetList .\hostlist -TargetCount 250 -Verbose -Pushbin -Pushbin is requir...

  Perform the following steps from a non-root user. We will go for manual installation.  https://github.com/scnr/installer?tab=readme-ov-file#manual-installation https://github.com/scnr/installer/releases wget https://github.com/scnr/installer/releases/download/v1.7.3/scnr-v1.7.3-linux-x86_64.tar.gz   (Download using normal user) tar -xvzf scnr-v1.7.3-linux-x86_64.tar.gz cd scnr-v1.7.3 cd bin Now go to their website ( https://ecsypno.com/products/scnr ) and subscribe for community edition license from your official email.  ./scnr_activate 6XQ97FW3LVBECD0UJ5H214 ./scnr https://www.example.net/Login.aspx --system-slots-override Now they generate .ser format report after testing the application by default which is hard to read. We need html report. So for example, to generate an HTML report: ./scnr_reporter --report=html:outfile=my_report.html.zip /home/user/.scnr/reports/report.ser Avi

  https://gist.github.com/mndambuki/bf3b6a1de33dd84dc4f59dcf8e111618 From the above link you will get below codes .bat version.  Run the below commands as per instructions.  1. Open powershell ise with admin privilege and paste the below powershell script commands: Write-Host "Activating Microsoft Office 2019..." # Office installation path detection if (Test-Path "C:\Program Files\Microsoft Office\Office16\ospp.vbs") {     cd "C:\Program Files\Microsoft Office\Office16" } elseif (Test-Path "C:\Program Files (x86)\Microsoft Office\Office16\ospp.vbs") {     cd "C:\Program Files (x86)\Microsoft Office\Office16" } else {     Write-Host "Office installation not found."     exit } # Remove previous KMS configuration cmd.exe /c "cscript //nologo slmgr.vbs /ckms" cmd.exe /c "cscript //nologo ospp.vbs /setprt:1688" cmd.exe /c "cscript //nologo ospp.vbs /unpkey:6MWKP" # Enter new product key cmd.exe /c ...

 Wapiti3 web application scanner installation.... The below is wapiti's github link. Please update your kali packages before using this tool. https://github.com/wapiti-scanner/wapiti git clone https://github.com/wapiti-scanner/wapiti cd wapiti cd bin wapiti -h wapiti -u https://domain.com Avi

 Follow the commands to install and configure API hacking lab: 1. Install kali linux and update all the packages.  apt update -y apt upgrade -y or apt dist-upgrade -y or apt full-upgrade -y If you face any problem regarding update, install cloud flare warp in the host machine, then again start updating packages in your kali vm.  2. Install and configure burpsuite professional.  After that open burpsuite and go to Extensions tab. Click on BAppStore. Search for Autorize extension, It will help us to automate authorization testing. Click on Download Jython from the right side. From Jython website click on Jython standalone JAR and save it. Go to Extensios > Extensions settings >  under Core extension settings find out Python environment on the right pane. Select the jython jar file that you just downloaded. Now again go to BAppStore and re-search for Autorize extension. You will see Install option this time after selecting Autorize extension. Install it. You ...

  Activating windows 11 Pro....Commands are given without quotes. Step 1.1: Open command prompt with admin privilege.  Step 1.2: Install KMS client key. Use the command “ slmgr /ipk kmsclientkeys ” to install a license key (kmsclientkey is the activation key that corresponds to your Windows edition). Command syntax : " slmgr /ipk  W269N-WFGWX-YVC9B-4J6C9-T83GX" The following are the list of  kmsclientkeys  for Windows 11 Volume license keys. Home: TX9XD-98N7V-6WMQ6-BX7FG-H8Q99 Home N: 3KHY7-WNT83-DGQKR-F7HPR-844BM Home Single Language: 7HNRX-D7KGG-3K4RQ-4WPJ4-YTDFH Home Country Specific: PVMJN-6DFY6-9CCP6-7BKTT-D3WVR Pro: W269N-WFGWX-YVC9B-4J6C9-T83GX Pro N: MH37W-N47XK-V7XM9-C7227-GCQG9 Education: NW6C2-QMPVW-D7KKK-3GKT6-VCFB2 Education N: 2WH4N-8QGBV-H22JP-CT43Q-MDWWJ Enterprise: NPPR9-FWDCX-D2C8J-H872K-2YT43 Enterprise N: DPH2V-TTNVB-4X9Q3-TJR4H-KHJW4 Step 1.3: Set KMS server. Use the command “ slmgr /skms kms8.msguides.com ” to connect to my KMS server. Step...

  https://github.com/c0dejump/HExHTTP Found that manually installing this tool will give you some pain in kali. So I choose docker option.  apt install docker.io -y git clone https://github.com/c0dejump/HExHTTP.git cd HExHTTP docker build -t hexhttp:latest . docker run --rm -it --net=host -v "$PWD:/hexhttp/" hexhttp:latest -u 'https://target.tld/' Avi

 Installation guide: https://github.com/owasp-amass/amass/blob/master/doc/install.md Usage: https://github.com/owasp-amass/amass/blob/master/doc/tutorial.md External Attack surface monitoring using Owasp Amass project. This is also called reconnaissance or information gathering phase to more than 80 sources. It an wonderful tool to use. Results are almost accurate. But you should check if you see a result that is not familiar to you. Because amass taking data from the third party db. So there is a possibility that, that of db giving amass fake data. Though amass apply dns enumeration for better result but still it is worth checking for weird informations.  Comes with 3 subcommands. amass intel|enum|db amass intel -- Discover target namespaces for enumerations i.e. target is associated with how many domains!!!! amass enum -- Perform enumerations and network mapping of those domains and sub-domains. amass db -- Manipulate the Amass graph database Amass Intel amass intel ...

Link to the repo:  https://github.com/Cybersecurity-Ethical-Hacker/xssdynagen?tab=readme-ov-file git clone https://github.com/Cybersecurity-Ethical-Hacker/xssdynagen.git cd xssdynagen The following 4 packages are needed for this tool to work and are already installed in kali.  pipx install aiohttp  pipx install colorama pipx install tqdm pipx install "uvloop>=0.17.0" You can always check the package existence: dpkg -l | grep packagename If not installed then use this command: pip/pip3 install -r requirements.txt If that also does not work then: apt install python3-aiohttp apt install python3-colorama apt install python3-tqdm apt install python3-uvloop In kali you need to install paramspider: apt install paramspider -y paramspider -d example.com   (Though this command in kali does not work) For ubuntu: git clone https://github.com/0xKayala/ParamSpider cd ParamSpider pip/pip3 install -r requirements.txt (If giving error then install the packages in above mentioned w...

This tool is perfectly works on ubuntu 24 system. And I found it is not working properly in kali linux 24 version.   https://github.com/blackhatethicalhacking/SQLMutant/tree/main This tool need to use along with sqlmap tool. Showing this cheat sheet for kali or debian based system.  This tool actually analyze everything and give you the vulnerable url where sql injection is possible. You just need to use then sqlmap to exploit that.   Prerequisite: apt install pipx -y (for ubuntu) pip3 install uro or pipx install uro pipx ensurepath pipx completions  (not needed)  source ~/.bashrc   or restart system If go tool is not installed then run the below two commands first ( golang-go ) or follow this link to install go (https://mahimfiroj.blogspot.com/2024/12/installing-nuclei-in-kali.html) otherwise skip this step.   dpkg -l | grep packagename (Using this command you can check package is installed or not) apt install gccgo-go -y or apt install gol...