Search Port Names and Numbers using whatportis

Whatportis is a utility command to search port numbers and/or names. It often happens that we need to find the default port number for a specific service, or what service is normally listening on a given port.

Many a times what happens is while running an nmap command, we encounter various ports whose information are missing or we couldn’t recognize the port. At that time, whatportis will be helpful.

To run the command, we first need to download the utility from github. To install whatportis from github, we type the following command:

>pip install whatportis

If the dependencies of the utility are already installed on your pc, it will take less time to install; else the installation time will depend on your connection speed.

Once, the utility is installed, we can run the command, ‘whatportis’.
For example, I want to check what all port names are there for the port number 80, so I type:

>whatportis 80

As we can see that all the port names associated with the port 80 is displayed on the screen.
Another example could be:

>whatportis 3389

And whatportis displays 3389 successfully, which is a Microsoft WBT Server port.
Yet another example is:

>whatportis 445

Where, 445 is a Microsoft-ds port. We can confirm the result on internet or consulting any good book.

Hack Remote Windows 10 PC using HTA Web Server

Exploit Targets
Windows All Versions

Attacker: kali Linux
Victim PC: Windows 10

Open Kali terminal type msfconsole

Send the link of the server to the victim via chat or email or any social engineering technique. 
When Victim Machine browsing to your link it will download anything.hta file when victim click on it you will get the meterpreter session

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID

Hack the SpyderSec VM (CTF Challenge)

You are looking for two flags. Using discovered pointers in various elements of the running web application you can deduce the first flag (a downloadable file) which is required to find the second flag (a text file). Look, read and maybe even listen. You will need to use basic web application recon skills as well as some forensics to find both flags.
Level: Intermediate
Let’s locate our target first.


Our target is Now let’s fire up the nmap to know their services.
Nmap –A –p-

There are only two ports open i.e. 22 and 80 for SSH and HTTPS respectively. Next, I opened this page in browser.

There was nothing major on the page except for two images. There is a possibility about metadata behind these images. Therefore, I read these images with exif tool. One of the images which were saved by the name of “challenge” had a comment behind it. To read it type:
exiftool Challenge.png

If you observe closely the comment is in hexadecimal form. We need to convert it into readable form. No third party tool is required just go online to copy the string and paste it in the text box and then click the convert button.

After converting we again have hexadecimal string. No problem. Let’s convert it again as we did earlier.

This time we have base64 string. We convert it into non-cipher text by using HackBar. Paste the string and select Bsae64 decode option from the Encoding drop down menu.

Now finally we have a readable string. This can be a password or a directory. Note it down for future use. Moving on if you go through the source code of the page you will that evil function is quite unusual.

I searched about eval function on google and found that it is a java script. There can be code hidden behind it. So let’s unpack it with the javascript unpacker.

After unpacking you will again come face to face with a hexadecimal string. Convert this string just like before.

After conversion the string became “alert(‘mulder.fbi);” .  I explored a lot and found a lot found nothing about it so decided to capture its cookies through BurpSuite. Now we are going to use Burpsuite that means we have to turn on manual proxy. And then turn on the interception on Burpsuite and then simply refresh the page and then with not much hard work cookies will be captured.

In cookies I found a URI that means it’s a part of a link. Go to the params tab to see the proper link.

From here copy the link and open it in the browser

Now when I opened it there was an error.  Then I explored a d bit and remembered that there was a mulder.fbi so I added that to the link.

After adding mulder.fbi to the link it asked me to download a file. Save it.

When you open the file that you just saved then it will play a video with different quotes. Now I was clueless about this so I started searching about it on google. And I found out that it was a truecrypt file. So to see what is hidden type:
python mulder.fbi

There was a whole drive hidden behind it. And using veracrypt you can see and open the drive.

When you open it will ask for a password and we have found the password beforehand. So give the password there.

Hence the drive will be unlcocked. Now open the drive. And you will find flag there.

VOILAA!! The flag is captured!!! Enjoy!! 

Hack the VulOS 1.1 VM (CTF Challenge)

“Your assignment is to pentest a company website, get root of the system and read the final flag” is the only thing we know about this VM other than that is it a smaller one. Therefore without any further ado lets starts by finding our target aka victim.


And now we will run nmap to determine what services are running.

So, the services that running is SSH on 22 ports, HTTP on 80 ports, IRC on 6667.
As port 80 is open that means we can open it in browser.

Now there is link on this webpage. Let’s open it and it will link to the following page.

In this webpage there are various tabs and I explored each tab including their page source and I found nothing except for the last tab i.e. Document. When you look into the page source there will be line saying “jabd0cs/ on the server. Just log in with guest/guest.”

So, I opened the directory and logged in with guest:guest as username:password respectively. And there was an upload option but there was a restriction that you can only upload .doc file so it was pretty useless.
If you observe the log in page there is a cms opendocman v1.2.7. this version of opendocman is vulnerable.

Let’s search metasploit for the exploits to be use against opendocman. And for that type:
searchsploit OpenDocMan 1.2.7

Above is the exploit’s detail. Now we will use sqlmap to find out database of usernames and passwords and for that type:
sqlmap –u ‘’ –dbs

The sqlmap command will show us all the tables in the database.

Including the username and passwords as shown below.

As you can see that the password is in MD5 hash value. We can crack it online no third party tool is needed. Simply go to

Password turns outs to be webmin1980 with the username of webmin. As we have username and password we can log in through SSH port. And to log in through SSH open a new terminal in kali anfd type:
And then give the password when asked and you will have a session. Let’s check the version of kernel to see if it vulnerable or not.
lsb_release -a

The version is 14.04 that means it can be exploited and we only need to download its exploit from

Type the following command to download it :
As the exploit is downloaded, now as always we need to move it then compile it and then run it. And for that the set of commands is :
mv 37292 shell.c
gcc –o shell shell.c
And voila you have reached root but our challenge is not completed here. We still have to find the flag. Once you have reached root then go into the /root directory :
cd /root
Lets check what files and folders it is holding.
And here you will a flag.txt. Read it!
cat flag.txt

Hack any Android Phone using Spade APK Backdoor

In this article we will learn yet another method hack android authentically. This is the most uncontrived way of hacking an android user as you are binding your maligant file with the original one just like we did with apk.
Firstly, we will download ccleaner from as we will bind our payload file with it.
Our next step will be downloading the software is Spade. To download it go to the terminal in your Kali and type:

The enactment of the above command with installs the software successfully. Next, type:
./ /root/Desktop/ccleaner.apk
When you run the above command it will ask you the information about payload, lhost, lport. For payload select option 3 that means type 3. And the give lhost and lport :

Lhost >

Previous rendition of the commands helps us bind an original file with our personalized malign file.

After it has all been done successfully, it will ask us to set the listener. Type’y’ here now a new apk will save in spade folder

Now, you can go ahead and send the victim the link so that he can download it.

As the victim will click on install, the application will start downloading along with our malicious file.

And when the application will be opened you will have victim session.

As you remember you typed ‘y’ before to create listener and the listener is created automatically on the all the details you had given previously. And then to simple have the session type:

sessions –i 1