kali

burp web penetration testing guide

Learn Burp Suite on Kali Linux: Part 3

by

brute force test penetration web kali burp

Introduction

In this third part of the Burp Suite series, you will learn how to actually collect proxied traffic with Burp Suite and use it launch and actual brute force attack. It will run somewhat parallel to our guide on Testing WordPress Logins with Hydra. In this case, though, you will use Burp Suite to gather information on WordPress.

The purpose of this guide is to illustrate how the information gathered by Burp Suite’s proxy can be used to conduct a penetration test. Do Not use this on any machines or networks that you do not own.

For this guide, you will also need Hydra installed. It’s not going to go into depth on how to use Hydra, you can check out our Hydra SSH guide for that. Kali Linux already has Hydra installed by default, so if you’re using Kali, don’t worry. Otherwise, Hydra should be in your distro’s repositories.

Read more

burp web penetration testing guide

Learn Burp Suite on Kali Linux: Part 4

by

burp web penetration testing guide

Introduction

It’s important to remember that Burp Suite is a software suite, and that’s why a whole series was needed to cover even just the basics. Because it is a suite, there are also more tools bundled in that work in conjunction with one another and the proxy that you’re already familiar with. These tools can make testing any number of aspects of a web application much simpler.

This guide isn’t going to go into every tool, and it isn’t going into too much depth. Some of the tools in Burp Suite are only available with the paid version of the suite. Others generally aren’t used as frequently. As a result, some of the more commonly used ones were selected to give you the best practical overview possible.

All of these tools can be found on the top row of tabs in Burp Suite. Like the proxy, many of them has sub-tabs and sub-menus. Feel free to explore before getting into the individual tools.

Read more

wordpress login test penetration test

Test WordPress Logins With Hydra on Kali Linux

by

wordpress login test penetration test

Introduction

There are web forms all over the Internet. Even sites that don’t usually allow regular users to log in probably have an admin area. It’s important when running and deploying a site to make sure that the passwords gating access to sensitive controls and admin panels are as secure as possible.

There are different ways to attack a web application, but this guide is going to cover using Hydra to perform a brute force attack on a log in form. The target platform of choice is WordPress. It is easily the most popular CMS platform in the world, and it is also notorious for being managed poorly.

Remember, this guide is intended to help you protect your WordPress or other website. Use on a site that you don’t own or have written permission to test is illegal.

Read more

How to change MAC address using macchanger on Kali Linux

by

Objective

The objective is to change or fake an original network card’s hardware MAC address. The following article will show how to change MAC address using macchanger on Kali Linux.

Requirements

Privileged access to you Kali Linux system.

Difficulty

EASY

Conventions

  • # – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command
  • $ – requires given linux commands to be executed as a regular non-privileged user

Instructions

Change to a Random MAC address

First, let’s see how we can use macchanger to change network card’s hardware MAC address to a random address. We can start by investigating our current MAC address of eg eth0 network interface. To do this we execute macchanger with an option -s and an argument eth0.

Read more

Kali Linux Burp Suite Tutorial

by

When it comes to testing the security of web applications, you’d have a hard time finding a set of tools better than Burp Suite from Portswigger web security. It allows you to intercept and monitor web traffic along with detailed information about the requests and responses to and from a server.

This tutorial covers setting up Burp Suite and using it as a proxy for Firefox, how to gather information and use the Burp Suite proxy, a realistic testing scenario using information gathered through the Burp Suite proxy and many of the other features that Burp Suite has to offer.

Read more

Kali Linux Install Boot Menu

How to install Kali Linux

by

Objective

Install Kali Linux

Distributions

You’ll just need a working install of something to make the install USB

Requirements

A free hard drive to install Kali

Difficulty

Easy

Conventions

  • # – requires given linux command to be executed with root privileges either directly as a root user or by use of sudo command
  • $ – given linux command to be executed as a regular non-privileged user

Introduction

Kali Linux is a powerful toolkit for security testing. In most cases, you can simply run it temporarily from a USB drive, but there are occasions when you want a dedicated Kali install for longer term testing.

Please keep in mind that Kali is not a general purpose Linux distribution. It is not intended for daily use and may(ironically) prove insecure.

Read more

password attack hydra kali linux

SSH Password Testing With Hydra on Kali Linux

by

password attack hydra kali linux

Introduction

Hail Hydra! Okay, so we’re not talking about the Marvel villains here, but we are talking about a tool that can definitely do some damage. Hydra is a popular tool for launching brute force attacks on login credentials.

Hydra has options for attacking logins on a variety of different protocols, but in this instance, you will learn about testing the strength of your SSH passwords. SSH is present on any Linux or Unix server and is usually the primary way admins use to access and manage their systems. Sure, cPanel is a thing, but SSH is still there even when cPanel is being used.

This guide makes use of wordlists to provide Hydra with passwords to test. If you aren’t familiar with wordlists yet, go check out our Crunch guide.

Warning: Hydra is a tool for attacking. Only use it on your own systems and networks unless you have the written permission of the owner. Otherwise, it is illegal.

Read more