Networking

Página 1

ip route - List routing tables for host PCs - Routers have their own routing table

ip addr - MAC addresses of network cards the PC can use

ip neighbour - ARP (Address Resolution Protocal) cache

netstat -tunp - View listening ports

nmap - probably stands for network map.. Give it a network ip and a range and it will ping addresses to find active ones.

Página 2

Routers work with IP addresses, switches work with MAC addresses

Forward tables bind MAC addresses to interfaces

HTTP response from servers may contain information about the server in the header - useful for pentests

Netcat doesn't support HTTPS, only HTTP. openssl can be used for HTTPS on cmdline

Página 3

nmap commands - Map machines on a network, find open ports of a machine

-sT : TCP connect scan, more detectable, completes handshake, will be logged

-sS : SYN scan, less detectable as it doesn't complete the 3 way handshake

-sn : Disables port scanning, just discover hosts

-sV : Version detection scan

-O : Operating systems scanning, more specific than just versions

-A : Full information scan

-iL list.txt : Scan using a list of hosts from file, separated by new lines

Página 4

sqlmap commands - find SQLi injection points

Not only GET params, use forms as well like login using burpsuite.

Boolean SQLi - param=a' or 1=1; -- -

-u : the host with the query param

-b : get the banner

-p : the param to test

--v3 : The query used that found successful injection point - verbose

--technique=U : Perform UNION based sqli, B=boolean based

--tables : get all tables

--current-db/-D : Use the supplied db to get columns, etc

--columns : Get all the columns of the db

-C : Get particular columns in the dump

--data='user=a' : Post request params to a url

--dump : Get all the data from the current db

--users : Get current user mysql

--dbs : Get the DBMS and schema

--flush-session : Clear the cache and previous logs

-r : Specify a file to use for the test, dumped from burp suite

Página 5

Hydra - Brute force services such as http,ssh,telnet, etc

Just type hydra to get a list commands

-U : Get information about serve, i.e hydra -U http-post-form

-V verbose

hydra http-post-form "/login.php:usernamefield=^USER^&passwordfield=^PASS^:invalid credentials" -L /usr/share/ncrack/minimal.usr -P /usr/share/seclists/Passwords/rockyou-15.txt -f -V

hydra ssh -L /usr/share/ncrack/minimal.usr -P /usr/share/seclists/Passwords/rockyou-10.txt -f -V

-o StrictHostKeyChecking=no

-o PreferredAuthentications=password

scp root@192.168.99.22:/path/to/file /local/path : This is ran OUTSIDE a ssh session..

Página 6

ports used for windows shares: 135, 139, 445

nmblookup - Used for finding exploits in shares on windows machines

-A : Find share groups the host belongs to

smbclient - Samba suite, used for finding windows shares exploiting. Finds hidden shares, not shown by standard windows tools - Can also explore the vulnerable machines (?)

-L // -N : Find share groups of host

///IPC$ -N : -N means don't ask for password. This command checks if IPC is vulnerable to a null session. Only IPC shares are vulnerable

smbclient \\\\<host ip>\\<Folder> -N : open a shell on the share

Use "get <remote source> <local dest>" to retrieve a file

enum4linux - Actually used for explioting null sessions

-n : Perform nmbstat lookup for shares - <20> means open shares

-P : Get the password policy - helps us get parameters for password brute forcing

-S : Enumerate the shares on the machine

-s /usr/share/enum4linux/share-list.txt : Brute force share enumeration

-a : Runs all the commands available

samrdump - /usr/share/doc/python-impacket/examples/samrdump.py

Gives information like password policies and uids

nmap also gives information -

nmap -script=smb-enum-shares : this gives us all the shares

nmap -script=smb-enum-users : this gives us all the users

nmap -script=smb-brute : Brute force username and passwords