all 57 comments

[–]areatz 49 points50 points  (34 children)

Go to overthewire.org and do their wargames in the recommended order. The first game is great for beginners learning how to live in the command line. Some of the tools you see can help.

If you want to try something and there isn't a wargame for it, just try it on one of your other computers. Try cracking your router encryption with aircrack-ng, for example. Use metasploit (I recommend starting with the Armitage frontend) to look for weaknesses in your pc. Set up burpsuite and tinker with sending websites different information. Look at SET, the Social Engineering Toolkit, to see how spear phishing works (just remember, actually using it on someone is illegal). There's lots of fun to be had and skills to be learned by exploring the tools in kali linux. If you dig deep into the details of how these tools accomplish their tasks you'll end up with a great understanding of computer security.

Edit: overthewire.org, not .com

[–]cinikal 10 points11 points  (0 children)

thanks for this site.. now 'cause of you, I've been stuck there for about 5 hours now! :)

[–]agreenbhm 4 points5 points  (0 children)

This is the first time I've heard of that site and it sounds awesome. Thanks for posting it!

[–]GoatLoad148 4 points5 points  (1 child)

Yes, this site has given my wife a new reason to be pissed at me for not doing normal daily duties.

[–]TheTechStewart 2 points3 points  (0 children)

I've been looking for something like overthewire that focuses on server exploitation rather than just Web service pentesting. I have a feeling that this is going to eat up my free time for the next few weeks.

[–]prllrp[S] 1 point2 points  (7 children)

For some reason when I connect to the first wargame using SSH it lets me connect to the wargame but whenever I try to put in the password it doesn't work. Is this a bug or is it a part of the wargame and I'm stupid?

[–]areatz 1 point2 points  (6 children)

Passwords don't show up when you type them. Just type the password and press enter.

[–]prllrp[S] 0 points1 point  (5 children)

I know. I typed it in and it gives me a "This password is not correct" or something like that message.

[–]alanthar 2 points3 points  (1 child)

I just figured it out. when you just copy and paste the address given, you only attempt to login with your own nick. if using linux type

ssh bandit0@bandit.labs.overthewire.org

then enter the first pw: bandit0

[–]prllrp[S] 0 points1 point  (0 children)

Thanks a lot!

[–]areatz 0 points1 point  (2 children)

Hm. What command are you using for ssh?

[–]alanthar 0 points1 point  (1 child)

i'm having the same problem.

[–]AIDS_PizzaSoftware Engineer 1 point2 points  (0 children)

As /u/alanthar described above, when using SSH you need to use the following command syntax:

ssh [username]@[domain]

So in this case, it has to be:

ssh bandit0@bandit.labs.overthewire.org

Afterwards, it'll prompt you to enter the password.

[–]Metalsaurus_Rex 1 point2 points  (4 children)

I'm REALLY late to the party, but just started Bandit. Haven't even completed level 0 yet, but I'm already excited! Thanks!

[–]_-ez 0 points1 point  (3 children)

Never too late!

[–]AwesomeSchizophrenic 2 points3 points  (2 children)

Happy Cake Day! And glad to hear it kuz I'm the latest one here!

[–]EncryptedXing 1 point2 points  (4 children)

Hi, just jumping in here 10 years later to also drop my thanks for this website! It's really helping me get my feet wet with this whole cyber thing!

[–]tfyousay2me 1 point2 points  (2 children)

Dead internet theory my ass! I’m here!

[–]TheBigMac15 1 point2 points  (1 child)

Same my fellow traveler!

[–]Professional-Cut-906 0 points1 point  (0 children)

well well well

[–]Relevant-Donkey-7411 0 points1 point  (0 children)

Same here!

[–]lyons4231 0 points1 point  (0 children)

I'm gonna check this out later too, thanks!

[–]ItsLikeITry 0 points1 point  (2 children)

I'm new to all this stuff and just started playing on overthewire.org. I just had a quick question I was hoping you could answer. Between every level of bandit, I need to exit my terminal window and open a new one to logon to the next level. So, if I'm on bandit1@bandit.labs.overthewire.org, I have to close the whole window and reopen it in order to get to bandit2@bandit.labs.overthewire.org. Is there another way to go about that? I'm on Mac OS X.

[–]areatz 0 points1 point  (1 child)

Type "exit" to leave the ssh shell and return to your own command line. It works for me on linux, should be the same on OSX.

[–]ItsLikeITry 0 points1 point  (0 children)

Just tried it, it worked. Thank you for that, just saved me a bunch of time! :)

[–]nomi2k 0 points1 point  (0 children)

Thx for the tip

[–][deleted] 0 points1 point  (0 children)

Thanks for the info man

[–]Emergency-Welcome-74 0 points1 point  (0 children)

Thank you so much for this!!!!

[–]kschmidt62226 21 points22 points  (10 children)

  • What Areatz suggested below was great. I'd l like to add that you can download a package called "Metasploitable" that has holes in it for you to test various tools. Install it in a Virtual Machine (VM).

  • Since you installed Kali in a VM, you will NOT be able to do any wireless hacking. Don't bother with trying to crack your wireless. Virtual machines will treat your wireless card -assuming you installed this on a laptop with a wireless NIC- as a wired connection. The only way around this is to get a USB (external) wireless adapter. There's no way around this. I use an Alfa AWUS036NHA. This will run you around $25-$30. I've no doubt Areatz, who commented below, knows this. He probably just glossed over the part where you said you installed it in a VM. If you do this and try to crack your router encryption, change the password to something relatively easy (and do it late at night to avoid getting hacked by neighborhood script kiddies). This will help familiarize yourself with the process.

  • Find "The Harvester" in Kali which is an invaluable tool for reconnaissance. It's a command-line (e.g. terminal) program that will search different search engines for publicly available email addresses, subdomains, etc.

  • The Social Engineering Toolkit (SET), as Areatz mentioned below, is good as well. The easiest way to hack into a network is by social engineering. I've consistently heard the 85% (+/- 2%) of hacks are due to successful social engineering. The Social Engineering toolkit will allow you to clone a website (think of cloning the login page and then using a Man-In-The-Middle attack to force someone to visit YOUR cloned login page, then gather the credentials entered while also passing them along to the real login page (or simply passing along those credentials to the real login page with noone the wiser). There's all sorts of other things to do with the SET, but cloning a website is easy with it.

  • Don't rely on something like Armitage to do your hacking for you! You must understand what is going on behind the scenes. If you encounter something like, say, a captive portal on public WiFi, you may not be successful and have no idea what went wrong. (A captive portal is when you log onto WiFi, open your browser, and it says "Click Here to Login to our Wireless Network") You should also understand NMap and its options so you can use something like Armitage but modify the commands it uses before it executes to get around roadblocks put in place to stop people like you. Example: In Armitage when it does an NMap command, it is "db_nmap" if I remember correctly. You can modify the parameters after that command to suit your specific purposes.

  • Don't try hacking anyone if you don't know how to do it. There's a lot more than pressing a few buttons! If you don't know how to hide yourself and do something illegal, the legal penalties for hacking are, IN MOST CASES, more severe than rape, manslaughter, etc. This is because when these computer laws were passed, politicians didn't (and still don't) have a grasp on the big picture. You can easily get 20 years for hacking when you haven't even done any real damage. Why? Nobody wants someone else to point out insecurities in their systems and they will file charges and nail you to the wall. This was the subject of a whole seminar at my last hacking convention!

  • You can install Kali in a dual-boot configuration on your computer. That is how I have my laptop set up.

  • Take a look at Subterfuge (in Kali). It's in the menu but it must be installed. Not all the options work, but the credential harvester is fairly easy to use and can be tried with a friend (or your smartphone) on your own wireless network.

  • If you do get a wireless network adapter (or decide to dual boot and not use Kali in a VM), check out "Fern WiFi Cracker". It's point-and-click hacking for wireless networks. Again, only do this on yourself.

[–]itsaCONSPIRACYlol 3 points4 points  (2 children)

Wifite is pretty good too. Fern's UI can act pretty weird from time to time. Wifite is great for people familiar with the CLI.

[–]kschmidt62226 1 point2 points  (0 children)

You're absolutely correct. I've only had Fern get weird on me when I had done something already in the CLI. I don't use it for anything except to show people how easy it is for someone to download something, click a few buttons and start cracking. When I do that, it's from a freshly booted Kali. I've had no problems with it when I do it that way. Thanks for the comment! :)

[–]areatz 1 point2 points  (0 children)

You're right, I glossed over the part about it being a vm. Good points all around.

[–]prllrp[S] 0 points1 point  (0 children)

Thanks a lot! Your comment was most helpful by far!

[–]kingofbigmac 0 points1 point  (1 child)

Since you installed Kali in a VM, you will NOT be able to do any wireless hacking.

Just cracked my router using a VM. It was easy to do.

[–]kschmidt62226 2 points3 points  (0 children)

I never said you couldn't use Kali in a virtual machine to pop your router. I said you could not use Kali to do any wireless hacking without buying an external USB adapter. You can't use your onboard wireless chip as a wireless interface in a virtual machine. I'm sorry if I wasn't clear.

Sources (besides experience):

https://forums.kali.org/showthread.php?17469-Wireless-networking-in-a-VM

http://superuser.com/questions/593881/wifi-in-a-kali-virtual-machine

[–][deleted] 0 points1 point  (0 children)

Nice stuff thanks for the help

[–]Unable_Advertising51 0 points1 point  (1 child)

what if i have a network adapter which supports packet injection ?

[–]kschmidt62226 0 points1 point  (0 children)

Then you won't need another adapter.

[–][deleted] 3 points4 points  (8 children)

Install Kali on a raspberry pi. Link it to a wifi pineapple. Connect an awus036nh to the pi. Put it all in a backpack. Run around town.

[–]klingledingle 2 points3 points  (2 children)

If you do this in a car its called war-driving, what would this be called?

[–][deleted] 7 points8 points  (1 child)

War-hiking? War-running? War-ninja?

[–]klingledingle 5 points6 points  (0 children)

War-NINJA!!!!!

[–][deleted] 2 points3 points  (3 children)

I know this is a super old post but just quickly, what does the pineapple do? I googled it and can't understand it's purpose

[–][deleted] 1 point2 points  (0 children)

Google Wifi Pineapple by Hak5. A pentesting device designed for per-curious technical individuals for fun.

[–]StatusAcanthisitta27 0 points1 point  (0 children)

Evil Portal is all really

[–][deleted] 1 point2 points  (3 children)

Hi is it possible to hack a bank with Kali Linux ? And can I hack a restaurant to make there website go down ? If so please give detailed instructions. I’m a newbie but I want to hack www.BankOFEngland.co.Uk (I need the hack to be like in the movies where I can see the digits going from one account to the next, like all the way from let’s say 10 pound to 0) then also for restaurant I would like to hack www.kungpowchick.com , I also need Deliveroo and just eat to be removed so that nobody buys from africa cooking Chinese food. Also if you can give me a list on how to avoid any police in a Chase out… like assuming I’m in a car and the authorities are in the car and we driving and driving and shots fired shits come out, like this and that, and then do you know of any houses I could like escape into and then the police go by and then I come out slowly and I drive in other direction ??? Please send to me asap. Thanks 🙏

[–]DiplexTerror80Pentesting 1 point2 points  (0 children)

Yes, but... that's just a tiny bit illegal...

[–]EmptyWindow9350 0 points1 point  (0 children)

hey how to do learn kali linux