Enumeration¶
TCP¶
nmap -sS -sV -sC -n [IP]
nmap -vv -Pn -A -sC -sS -T 4 -p- 10.0.0.1
UDP¶
nmap -sU -sV -n --top-ports 200 [IP]
SNMP (UDP 161)¶
snmp-check -t [IP] -c public
SMTP¶
nmap –script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 10.0.0.1
SNMP¶
snmpwalk -c public -v1 10.0.0.0
SMB (TCP 139/TCP 445)¶
enum4linux [IP]
WebDav¶
davtest -url http(s)://[IP]
FTP:¶
ftp [IP]
Username: anonymous Password: anonymous
nmap –script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 10.0.0.1
SMB (anonymous)¶
smbclient -L \\[IP]
Username: root Password: None
enum4linux 10.0.0.1
nmap –script=smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse,smbv2-enabled.nse 10.0.0.1
MySQL¶
nmap -sV -Pn -vv –script=mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.0.1 -p 3306
Web Applications¶
Structure Discovery¶
dirb http://10.0.0.1 /usr/share/wordlists/dirb/common.txt
Vulnerability Discovery¶
nikto -h http(s)://[IP]:[PORT]/[DIRECTORY]
Password Attacks¶
john hashes.txt
hashcat -m 500 -a 0 -o output.txt –remove hashes.txt /usr/share/wordlists/rockyou.txt
hydra 10.0.0.1 http-post-form “/admin.php:target=auth&mode=login&user=^USER^&password=^PASS^:invalid” -P /usr/share/wordlists/rockyou.txt -l admin
hydra -l admin -P /usr/share/wordlists/rockyou.txt -o results.txt ssh://10.0.0.1
Tunneling¶
Tunnels traffic through 10.0.0.1 and makes a route for all traffic destined for 10.10.10.0/24 through your sshuttle tunnel.
sshuttle -r root@10.0.0.1 10.10.10.0/24
sshuttle -l (any port) -r root@10.10.0.1 10.10.0.0/24
AV Bypassing¶
root@kali:~/Hyperion-1.0# wine hyperion.exe ../backdoor.exe ../backdoor_mutation.exe
https://github.com/furrukhtaj/Enumerator