Linux

All posts tagged Linux

Good evening everybody. Sometime back, I wrote an article on how to set up a virtual penetration testing lab using Vmware Workstation. But Vmware Workstation is a commercial product.

Today I am going to show you how to create a pentest lab in VirtualBox absolutely free of cost. I hope this tutorial will be helpful for many beginners into cyber security domain.

What do we need?

1. Oracle VirtualBox. (Download)

2. Kali Linux. (Download)

3. Metasploitable 2. (Download)

Oracle VirtualBox is the virtualization software we will be using to create our lab. We will be using Kali Linux as the attacker machine and Metasploitable 2 as the victim machine. Install Kali Linux and Metasploitable 2 in VirtualBox.

See how to install Kali Linux in VirtualBox.

See how to install Metasploitable in VirtualBox.

pentestlab1

 

Select Kali Linux, Go to settings > network. Enable “network adapter 1″. Set the “Attached to” option to “internal network”. Set the name of the network adapter to “intnet”. Click on “OK” to save the settings.

pentestlab2

 

Do the same for Metasploitable virtual machine.

pentestlab3

 

Power on the metasploitable VM. Log into the system. Default username and password are “msfadmin”.

pentestlab4

 

Type the command “ifconfig” to see the IP addresses of interfaces.

pentestlab5

 

The ‘lo’ interface is the loopback. Now we are going to set the IP address on the interface “eth0”. Type the command “sudo ifconfig eth0 10.10.10.2 netmask 255.0.0.0 up”. The sudo password is “msfadmin. Verify that the IP address is set by typing command “ifconfig”.

pentestlab6

 

Power on Kali Linux. In the terminal, type command “ifconfig eth0 10.10.10.1 netmask 255.0.0.0 up”. Verify if the IP address is set by typing command “ifconfig”.

pentestlab7

 

Test whether this system can communicate with victim system by pinging the victim machine as shown below.

pentestlab8

 

The connection is successful. Our penetration testing lab is ready. Happy practising.


Today I’m gonna show you how to install metasploitable in VirtualBox. Metasploitable is a Linux virtual machine made vulnerable intentionally for testing purposes. This virtual machine can be used to conduct security training, test security tools, and practice common penetration testing techniques.  For this i am going to use Metasploitable 2 which can be downloaded from here. After downloading the zip archive, extract the files into a folder. The file contents look like below.

metasploitable1

Open VirtualBox and click on “New Virtual machine wizard”. Type the name of your choice. I am using ‘Metasploitable-2‘. Choose ‘Type’ as Linux and ‘version’ as Ubuntu. Click on “Next”.

metasploitable2

Choose the memory size appropriate to the availability of RAM on your host machine although 512MB is more than enough. Click on “Next”.

metasploitable3

In the hard drive creation window, select option “Use an existing virtual hard drive”, browse to the folder where we have extracted our zip files and select the ‘vmdk’ file available. Click on “Create”.

metasploitable4

Then you are automatically booted into the metasploitable OS. The default username and password are “msfadmin”.

metasploitable5

NOTE : Kali Linux version 2017.1 has been released and I decided to update this howto. Ofcourse,  this guide also works with previous releases of Kali Linux. 

Hi Friends. as you already know, the latest version of Kali, Kali rolling edition 2017.1 has been released. The rolling edition of Kali Linux gives users the best of all worlds – the stability of Debian, together with the latest versions of the many outstanding penetration testing tools created and shared by the information security community. The best feature I like in this version is constantly updated tools. Now let us see how to install this latest version of Kali linux in virtualbox and I assure you, this will be the easiest guide.

For this howto, I am using the latest version of Oracle Virtualbox, i.e version 5.1.22. Ever since Sana has been released, the makers of Kali Linux have also released Pre-built virtual images for virtualbox and Vmware. We will use that virtualbox image in this howto. Go here and download the Pre-built virtualbox image. They are as shown below (Download the latest version).

sanarvb0

This howto is using the Kali Linux 32bit VBox PAE . Your downloaded contents should look like below. As you can see, we have an ova file.

 

Now open Virtualbox and click on File>Import Appliance as shown below.

sanarvb3

A window like below will open.

sanarvb4

Now browse to the location of the ova file we just downloaded as shown below and  click on Next.

 

The system will present you a summary of settings used for  thsi VM. If you want to make any changes, change and click on Import.

The importing process will start as shown below. It will take some time, but it will be worth the wait.

 

After import is completed, a new virtual machine is automatically created as shown below.

 

Power on the machine. As the virtual machine powers up, it will prompt for username and password. The default username is “root” and password is “toor”.

Given below is our Kali Linux rolling 2017.1 successfully installed in Virtualbox. No need of installing guest additions. If you face any problems during installation, please comment. I will be happy to help you.

sanarvb12

 

 

 

If you tried to start armitage on Kali Linux, it will show you the following error.

armitage1

 

The error says that the service cannot connect to the database. Now let’s see how to configure armitage on Kali Linux. First, lets check if armitage is installed on our machine or not. Open terminal and type the command “apt-cache search armitage”Then type the command “apt-get install armitage”. If everything is right, it tells you that armitage is already installed.

 

armitage2

Now let’s rectify the database connection problem. Type the command “service postgresql start”. This will start our database service. Then start metasploit service by typing the command “service metasploit start”

armitage3

Then type the command “armitage”. You should successfully see armitage working.

armitage4

 

 

Ubuntu server comes default with a Command line interface. Of course we can install GUI in Ubuntu Server if we find command line troublesome. Here are the steps.

First navigate to the “etc/apt” directory and open a file named “sources.list.d” using the command “vi sources.list.d”. 

ugui1

Then check whether software from “universe” ad “multiverse” repositories are allowed.

ugui2

Then type the command “sudo apt-get update” to update all repositories.

ugui3

 

After updating is finished, type the command “sudo apt-get upgrade”.

ugui4

 

Then type the command “sudo apt-get install ubuntu-desktop”. It will take some time to finish all the processes.

ugui5

 

After the installation is finished, restart the server to see your GUI interface.

ugui6

 

Nmap is a popular port scanner. Today we are going to see target specification in nmap. In Nmap target can be specified in six different ways. We are going to look at each one of them. For this, I am using Kali Linux connected internally with IP address 10.10.10.2.

1. nmap -iL <input filename>

This option reads targets from a specific file. Let’s create a file named alpha with a few   newline separated or tab-limited or space separated IP addresses using vi on Desktop.

nt1

 

Then, move to Desktop directory and type the command “nmap -iL alpha” as shown below. It scans the four IP addresses listed in our file.

nts2

2. nmap -iR <number of hosts>

This option is used to specify random hosts to scan. Nmap generates its own targets to scan. The <number of hosts> argument tells nmap the number of IP’s to generate. Let’s type command “nmap -iR 5″. We can see that nmap generated five random targets to scan. The scan failed to determine route to the generated IP addresses because my system is not connected to Internet. Why didn’t it generate any internal IP addresses? Because in this scan private, multicast and unallocated address ranges are automatically skipped.

nts3

 

3. nmap <IP address/dir>

This option is used to scan the entire subnet.  Assuming you know CIDR let’s type the command nmap 10.10.10.1/29 to scan eight IP addresses from 10.10.10.1 to 10.10.10.8 and see the result below.

nts4

 

4. nmap [targets] -exclude[targets]

This option specifies a comma separated list of targets to be excluded from the scan even if they are part of overall network range we specify. For example, in our previous scan we saw that one host 10.10.10.2( which is the system I am working on) is alive. Now I decided to exclude that host and another host from the scan. So I type the command “nmap 10.10.10.0/29 -exclude 10.10.10.2,10.10.10.7″ and press “Enter”. We can see that nmap has only scanned six IP addresses.

nts5

 

5. nmap [targets] -excludefile[file name]

Now what if the subnet was very big and there are more number of hosts to be excluded from the scan. The above option helps us to achieve this. Remember the file “alpha”( with four IP addresses) we created. Now let’s specify nmap to quit scanning the hosts listed in the file. Type command “nmap 10.10.10.0/29 -excludefile alpha”. We can see that nmap scanned only four hosts in the subnet.

nts6

 

6. nmap [target1 target2  target3]

This option specfies nmap to scan multiple targets separated by space. Type the command  “nmap 10.10.10.1 10.10.10.2″. We can see the result below.

nts7

 

Hope this was helpful.

Cisco Certified Network Associate certification has become must for anybody who wishes to start  a career in networking. This certification validates that you have the ability to install,configure and troubleshoot a network. You need  lot of practice for achieving success in this exam. Apart from the labs where you are getting trained for CCNA what if you had a chance to practice at home. Or what if you want to self learn for CCNA? Well for both of the questions above, Cisco Packet Tracer is the perfect answer. To quote from Cisco’s official website,Packet tracer is

“a powerful network simulation program that allows students to experiment with network behavior and ask “what if” questions.”

It further says,

“The simulation-based learning environment helps students develop 21st century skills such as decision making, creative and critical thinking, and problem solving. Packet Tracer complements the Networking Academy curricula, allowing instructors to easily teach and demonstrate complex technical concepts and networking systems design.”

Nothing could have defined that better. This software is available for free from Cisco’s website provided you are a registered Networking Academy student, alumni, instructor, or administrator. Even if you are not one among the above you could still get hold of this software,just google it.

Now I’m gonna show you how to install packet tracer in Windows and Linux.

1.Windows

Any installation in Windows is just clicks and mouse and the same applies to Packet tracer. Click on the exe file downloaded. The below screen appears.Select “I accept the agreement” and click on “Next”.

pt1

Setup will show the folder in which the program’s shortcuts will be created. If you want to change the folder, you can change it. Click on “Next”.

pt2

 

Then the program will ask whether to create a Desktop icon and create a Quick Launch icon. Make your own choice and click on “Next”.

pt3

 

Then the summary of the settings we selected is displayed. Click on “Install”.

pt4

The installation starts as shown below.

pt5

 

In seconds,installation gets completed and the below screen is shown.Click on “Finish”.

pt6

 

Then the below popup appears asking you to close or restart your computer. Click on “OK”.

pt7

As we selected Launch option, Packet tracer is automatically launched.

pt8

2. Linux

To install Packet Tracer in Linux, we need a .deb package of Packet tracer which can be downloaded from here. Now I am going to install it in Ubuntu Precise Pangolin (12.04). Download the above file to the desktop.

pt9

 

Start the terminal and see your current working directory by typing “pwd”. If the current directory is not desktop move to the Desktop directory using “cd”. After reaching the Desktop directory, type “ls” to see if the packet tracer binary is there.

pt10

 

Left click on the packet tracer .bin file displayed after typing “ls” above,the entire word will be selected. Then right click and select copy. Now type “chmod +x” and then hit “CTRL+SHIFT+V “to paste the text we copied above. Our command should look like this.

                       chmod +x  PacketTracer533_i386_installer-deb.bin

What chmod +x command does is that it gives all users permission to execute.

pt11

 

Then type “./PacketTracer533_i386_installer-deb.bin” in the terminal.This will start extracting the binary package.

pt12

 

Then terminal prompts us to hit Enter to read the End User License Agreement.Hit Enter.

pt13

 

After displaying a rather long EULA, terminal asks us if we accept the terms of EULA. Type “Y”.

pt14

 

Then system asks us for the sudo password.Type the password and hit Enter.

pt15

 

When the installation is finished, close the terminal,go to Dashboard, if packet tracer is not seen,type ‘pac’ in the search box. When Packet Tracer is shown, click on it.

pt16

 

A messagebox shows up saying that we are starting packet tracer for the first time and our files will be stored in a specific folder. Click on “OK”.

pt17

 

Another message box pops up.Click on OK”.

pt18

 

Packet tracer is started.

pt19