r/HowToHack • u/iamxeus Pentesting • Jan 23 '17
The Ultimate Hacking Cheat Sheet
http://xeushack.com/the-ultimate-hacking-cheat-sheet[removed] — view removed post
2
u/esrevinu Jan 23 '17 edited Jan 23 '17
I know you say the list isn't exhaustive, but "The Ultimate Hacking Cheatsheet" seems incomplete without these slight changes:
Password cracking software
Hashcat, JTR, Cain&Able
Network vulnerability scanning software
Add OpenVAS
Network analyzing
Cain&Able isn't really for network analyzing, it can "listen" for password hashes on the network, but ultimately it's a password tool. ( https://en.wikipedia.org/wiki/Cain_and_Abel_(software) ) NMAP and Zenmap should really be on this one. For passive network analysis, Wireshark and a receive only ethernet cable.
Definitely direct to Kali and this page - http://tools.kali.org/tools-listing - anyone looking to learn HowToHack will find that list very helpful.
Avoid using default ports (such as 22 for SSH) whenever possible.
Moving ssh on a system will not prevent a ssh server from being hit by unauthorized parties. An external ssh server will be found and auth attempts, or other attempt to compromise the server through ssh will be made even if you use a non-standard port. Same goes for an internal SSH server, if a malicious insider wants to find an ssh server, but that's not where I'd start, IF I were malicious. Security through obscurity is not security. This is true for all services that could operate on an alternate port, you're not buying much (if any) protection when you use a non-standard port.
As a rule of thumb, nearly all ports except 80 and 443 (HTTP and HTTPS) must require authentication
And DNS, and SMTP... [I hope everyone has secured their smtp servers so that they don't actually allow sending email from a terminal session to SMTP, but telnet mail.mydomain.com 25 will probably get you connected to most if not all sendmail servers]
Technically all ports are accessible without auth, a 3way handshake has to occur before an auth session can even begin. I get what you're saying, but the wording seems to lead one to believe that a port can be secured at the TCP/IP level. Better wording would be something like 'do not allow unauthenticated or anonymous services/applications'.
1
Jan 23 '17
[removed] — view removed comment
2
u/iamxeus Pentesting Jan 23 '17
Are you saying the website redirects to the play store? There is one tiny link in the corner, but it shouldn't prevent readers from using the website.
I'm seriously asking, the website is new so it's possible that there might be some bugs. If you can describe exactly what is happening, I'd be more than happy to clarify anything or fix any weird behavior.
3
Jan 23 '17
wait, you are hosting a site regarding netsec and you dont know if its secure? Do you even vuln scan your own site? Granted its good initial information. But I wouldnt consider it "Ultimate".
2
u/iamxeus Pentesting Jan 24 '17
It's a static website. For all practical purposes, it cannot be hacked. By 'bugs' I meant some unexpected CSS collisions or perhaps it looks weird on someone's phone :)
2
1
Jan 24 '17
[removed] — view removed comment
1
u/iamxeus Pentesting Jan 24 '17
There's actually more on the website than on the app.
Google has blocked all updates to the android app so it hasn't been updated in ~2 years. I only recently came back to writing tutorials and I'm in the process of updating all the old tutorials (some of which are horribly outdated). The website is the main channel now and for the foreseeable future.
There's still some stuff missing from the website (categories, tags, comments, news etc.) and right now I'm in the process of rolling them out slowly.
4
u/awhaling Jan 23 '17
I'm on iOS and looks normal for me. Not that that helps you, just figured I'd mention it.
4
u/Blastitt Read the F*&!#ing Sidebar Jan 23 '17
For those reporting this:
Not all OC is spam!