It has been a long time since I blogged on this. I have been learning the eCPPT, which I have finally passed. The goal is to change this blog to write ups for cybersecurity. I will be doing academy hack the box, try hack me, and INE.
Looking at my previous posts, I feel as I was more passionate about Cybersecurity. I will bring that back to this blog.
These will be my two primary learning applications to see if this helps me out.
I just completed the ITPro.TV course, and it helped me a lot in answering some of the questions that I had on python. Now it is time to practice.
Somehow I went on HTB after watching a Youtuber, The Cyber Mentor, Pentesting for n00bs: Episode 2 - Lame (14) Pentesting for n00bs: Episode 2 - Lame - YouTube to the box lame which is supposed to be an easy box. As I haven't done any practical in a while. As I said in my other post, I have a subscription. I did use YouTube to find the answer to get in, when I first started. This led me to tryhackme.com, as I knew I wouldn't understand anything. This was over a year ago. Now I am back, and I went to look up the video, keep in mind that I am studying for my OSCP. My question was how can I use an exploit on exploit-db manually. And this is where the rabbit hole came from. I have been learning and getting exposed to everything dealing with python. As of now I am watching ITPro.Tv, to learn more. I have searched through Youtube, Google, and many other websites. I haven't grasped the knowledge yet, it hasn't dawned on me yet. So I will keep studying asnd learning as much as I can to learn how to use code to get a shell. The Metasploit I have hands on, but I want to know how it works.
Just went into a rabbit hole while doing the PWK. I am trying to learn how to do backdoor execution on a instead of using the msfconsole. I am practicing with HTB Lame box. this box is beginner friendly. I have the subscription to HTB, but I want to make sure I know how to use the python script to look at the vulnerability of vsftpd, Very Secure File Transfer Protocol Daemon. On Youtube, this led me to Filezilla, a GUI, finally saw it in action without just cli. So there, I was viewing a video about python3, which made me seem that it was more focused on the deprecated python2. I will keep you posted. Major thing i learned, was about module and the shebang for python3.
I have been studying Chapter 1 through 4 in the OSCP. Getting sidelined figuring out how to run code through Python3 and manual code. This is getting fun, I have something intriguing to learn. Anyone can use msfconsole, but I need to learn manual ways.
I have been working at my job as a NetOps Specialist. I am currently in learning the PWK. I have been in the course for about three weeks. I will be getting more actively back involved in the blogs.
I have been struggling hard in this area. I am trying to find a new certification to go into. It do not have to be the prettiest on paper. It does not need to be a HR filter, I am passionate about becoming a pentester. In my opinion, becoming a penetration tester (pentester), does not mean get a pentester job. I want to become as a goal. This in reality will help, in my situation, my employers. I am trying to better myself for the company that I will work for. I am not rich, but I do not need a job. This in an essence, from the outside looking in shows that I am arrogant. In reality, I am the opposite, I want to learn as much as I can so I can wear different hats in the community. Of course, I want to get the Offensive Security Certified Professional certificate, but at the same time I need to learn. Would you, as an employer want someone to get all the certificates just to get a job. Or would you want a perspective employee to get no name certificates and the certificates they need. In my opinion, if I was a boss, I would hire that candidate immediately. When I was a United States Martial Arts Instructor, we had a saying, "Become an eternal student." This means that you are always learning. If you are trying to get into the cybersecurity field as I am, just keep studying, give back to you future community, and stay positive. As of now, I will never know, but this post might just help somebody out. Also, after binge watching YouTube, if you work for Facebook, Alphabet, Amazon, Netflix, Google(FAANG) don't have a YouTube channel. Always make sure you follow company's policies, meaning ask on you first day of your new job.
What my next certificate that I will be attempting is the eLearnSecurity Penetration Testing Professional. I bought the INE Premium pass, and their prices are significantly lowered from the beginning when eLearnSecurity got bought out. After this certificate, I will have a big dilemma, OSCP or ePTX. Only time will tell. I have transitioned from ITPRO.TV for now to focus on eLearnSecuirty Certificates, but I do also have a learning O'Reilly pass. I have so many options, that I get into information overload. I have been reading about getting burnout on the field that I am not even in, yet. I say to that I ate the same dinner for 2 years, it will take more than that.
I just bought the INE Premium subscription pass. Now I will have the chance to learn more about penetration testing. My goal is to study and take the eCPPtv2 by the end of the month. While doing this, I am also steadily learning about Python3, since Python2 is deprecated. Just letting everyone know that I am back.
I have moved to Yuma, Arizona. I finally got my laptop and settled in. Now I can start blogging again. The first post I will be making as I am getting back into the network is going on THM doing a Nmap room. After that it is on to figuring out what certification I want to obtain. I have also obtained my CCNA. Now on to studying.
I have learned how to use WSL on Windows to get Kali Linux. It was bareboned so i had to use: sudo apt install kali-linux-everything
This is how to manually subnet IPv4 Class C addresses.
Class C:
Range: 192.0.0.0 to 223.255.255.255
Default Subnet Mask: 255.255.255.0
CIDR: /24
Question: You are assigned 192.168.8.0/24. I need 5 networks and 20 host per network.
Step 1:
Create Table (Sunny Subnetting Table)
Subnet 1 2 4 8 16 32 64 128 256
Host 256 128 64 32 16 8 4 2 1
Subnet Mask /24 /25 /26 /27 /28 /29 /30 /31 /32
Step 2:
Find 5 networks (subnet) closest but not under and write it down.
Subnet 8
Host 32 total hosts including network id and broadcast id
Subnet Mask /27 (new subnet mask)
Step 3:
Create second table and number by subnets from step 2.
Original Network ID: 192.168.8.0/24
# Network ID Subnet Mask Host ID Range # of Useable Hosts Broadcast
1
2
3
4
5
6
7
8
Step 4:
Add Original Network ID to the table
# Network ID Subnet Mask Host ID Range # of Useable Hosts Broadcast
1 192.168.8.0
2
3
4
5
6
7
8
Step 5:
Add Host from step 2 to the last network id octet
# Network ID Subnet Mask Host ID Range # of Useable Hosts Broadcast
1 192.168.8.0
2 192.168.8.32
3 192.168.8.64
4 192.168.8.96
5 192.168.8.128
6 192.168.8.160
7 192.168.8.0192
8 192.168.8.224
Step 6:
Put subnet mask from step 2 into subnet mask
# Network ID Subnet Mask Host ID Range # of Useable Hosts Broadcast
1 192.168.8.0 /27
2 192.168.8.32 /27
3 192.168.8.64 /27
4 192.168.8.96 /27
5 192.168.8.128 /27
6 192.168.8.160 /27
7 192.168.8.0192 /27
8 192.168.8.224 /27
Step 7:
Put Host from step 2 into # of useable hosts. You must subtract it by 2 for network id (first host) and broadcast id (last host)
# Network ID Subnet Mask Host ID Range # of Useable Hosts Broadcast
1 192.168.8.0 /27 30
2 192.168.8.32 /27 30
3 192.168.8.64 /27 30
4 192.168.8.96 /27 30
5 192.168.8.128 /27 30
6 192.168.8.160 /27 30
7 192.168.8.0192 /27 30
8 192.168.8.224 /27 30
Step 8:
Subtract 1 from last octet from network id and put in broadcat id and last broadcast is is .255
# Network ID Subnet Mask Host ID Range # of Useable Hosts Broadcast
1 192.168.8.0 /27 30 192.168.8.31
2 192.168.8.32 /27 30 192.168.8.63
3 192.168.8.64 /27 30 192.168.8.95
4 192.168.8.96 /27 30 192.168.8.127
5 192.168.8.128 /27 30 192.168.8.159
6 192.168.8.160 /27 30 192.168.8.191
7 192.168.8.0192 /27 30 192.168.8.223
8 192.168.8.224 /27 30 192.168.8.255
Step 9:
Input Host id range. Add 1 from network id and subtract 1 from broadcast id.
# Network ID Subnet Mask Host ID Range # of Useable Hosts Broadcast
1 192.168.8.0 /27 192.168.8.1 to 192.168.8.30 30 192.168.8.31
2 192.168.8.32 /27 192.168.8.33 to 192.168.8.62 30 192.168.8.63
3 192.168.8.64 /27 192.168.8.65 to 192.168.8.94 30 192.168.8.95
4 192.168.8.96 /27 192.168.8.97 to 192.168.8.126 30 192.168.8.127
5 192.168.8.128 /27 192.168.8.129 to 192.168.8.158 30 192.168.8.159
6 192.168.8.160 /27 192.168.8.161 to 192.168.8.190 30 192.168.8.191
7 192.168.8.0192 /27 192.168.8.193 to 192.168.8.222 30 192.168.8.223
8 192.168.8.224 /27 192.168.8.225 to 192.168.8.254 30 192.168.8.255
Step 10:
You can assign any 5 out of 8 subnets. 3 are going to waste.
Reference:
Youtube: Sunny Classroom subnetting is simple
ITPROTV IP Addressing: IPv4 Subnetting Class C
This is how you find a Spanning Tree Protocol Root Bridge Election.
This example is with three switches.
Step 1:
Lowest priority will become root bridge, if equal lowest MAC Address will become root bridge.
Step 1A:
If you want to manually make a switch root bridge, change its priority by multiples of 4096.
Step 2:
All root bridge ports will become forwarded and a designated port. There can only be one designated port per segment.
Step 3:
Find root port (the lowest cost going back to root bridge) root ports can't be blocked. There can only be one designated root port per segment (switch to switch.)
Step 3A:
When another switch has same priority, same MAC address, use the CLI to find root port.
enable <enter>
show spanning-tree <enter>
look at priority.nbr lowest will become root port.
Step 4:
For final designated port look at cost as if forwarding from that port to root bridge. If equal continue to priority, and then MAC Address. Lowest wins designated port.
Step 5:
If you have a root port on a switch complete it, and it must be a blocked alternate port.
enable <enter>
show spanning-tree <enter>
This bridge is the root
Reference: ITVPRO.TV Cisco CCNA - Cisco Switching: STP Operations
I have finished my exam and passed will write a spoiler-free guide today.
I am about to start my eJPT certification. I will write about it after it is complete and I pass.
I will be starting to start developing reports. This will be without pictures, proof of concept, for now to make sure my writing is getting better. The methodology I will be using is from eLearnSecurity which is:
1. Engagement
2.Information Gathering
3. Footprinting & Scanning
4. Vulnerability Assessment
5. Reporting
Note: This is from a lab. I will be using Kali Linux, if you want to know the version look below.
grep VERSION /etc/os-release <enter> search the OS version in the specified file
1. Engagement
I am going to VPN into the network. During this step, I will get information for the IP address that I will be going for. I will get a contract signed for the IP address that I will be knowing the rules of engagement. Since this is a VPN machine that I will be attacking I will be downloading the VPN filename.
cd Downloads <enter> to change to Downloads directory
ls <enter> list the files and folders in the directory I am in. I like to use the flags lash to get a long list of all files, folders, and hidden files, the size of the file, and finally have it human-readable.
sudo openvpn (filename) <enter> I wait until I see (Initialization Sequence Completed) to know that I am connected to the VPN.
2.Information Gathering
With gathering information and knowing that we are on the network. I will start with Network Config.
ip addr <enter> I will look for tap 0 inet
3. Footprinting & Scanning
I will use nmap and will have to use sudo to properly execute. I will find the ports that are opened. I check for telnet and ssh credentials using hydra. If you cant use rockyou-10.txt, remember to verify where it is. Now it is located at: /usr/share/SecLists/Passwords/Leaked-Databases/rockyou-10.txt
4. Vulnerability Assessment
I've gotten root's user and pass from hydra. I then SCP into my local directory users and pass.
sudo unshadow passwd shadow > Brute <enter> put the hash of the two files into one file named Brute
cat to Brute <enter> displays the Brute file
sudo john Brute <enter> crack the hashes of filename Brute with john
ex.) asd (Larry) {the parenthesis is the user}
pass (user)
5. Reporting
The tools I used are as follows:
Kali Linux
Command Line: telnet, ssh, scp
nmap
hydra
john
If you want to learn more or want more in-depth report, leave a comment. I purposely left out the CLI for nmap, hydra, loggin in to telnet, scp, and ssh.
I am steadily learning by doing labs on E-LearnSecurity. I am planning on taking the eJPT and passing it before November 1, 2020. I have completed some of the labs, and look forward to completing the final six so I can go find another certificate to conquer. I have been learning about Sqli, cross-site scripting, gobuster, and nmap to name a few. I am still contemplating on OSCP or PTP, I have more research still to do.
It feels like a long time since I have been on here. What have I been up to? I have not discarded this blog. I have finished my college course of Cultural Diversity, and now I am going to be in Introduction to Networking. I believe to be an eternal student, meaning always learning. As of now and in the past 3 weeks, i have been studying for Elearn Security's Junior Penetration Tester Student. I am doing this first to gain more knowledge and have structure than just going down a rabbit hole. As most know, when studying something new it is best practice to get in a course to keep your mind engage and a higher chance of learning on a clear path. If you have the money and people say that that any certification is not worth it, I beg to differ. Certificates in the long run helps you retain information better. Just think the week before your job interview, you cram to make sure that you knew everything that was on the job ad. Getting a certificate is the same thing, you strive to learn as much as you can. Even if you unfortunately failed a certificate, you are smarter and show that you are willing to learn. It shows your deficiencies, and help you try to increase it to the point of passing. If you are unsure if you are ready to take a course, I say study for it and see. It's better to attempt anything, than to not attempt anything at all. Make sure to push yourself and get out of your comfort zone, you might just like it. I will be attempting taking the exam by the end of the month. Biggest problem that I am contemplating OSCP or ECPPT. I just got to do more research. I will try to post at least weekly.
I am still learning, I have switch to learning more. I have been looking at Jason Dion Pen Test and today CySA+ videos. My goal is to get mopre information and then circle back around. This means that, I will be gaining more information then going back to lower level learning. For instance, trying to learn Calaculus while not knowing multiplication. This will help me in the long run.
I am trying to close my gap in learning. What I need to do after discovery, this will make me more proficient.
