### I. Domain ================ #### 1. Reverse DNS *Domain Name System* ``` ping curl http/https -vvvv nslookup dig ``` #### 2. Whois *get some info about ip, domain* - https://viewdns.info/reversewhois/ - https://domaineye.com/reverse-whois - https://www.reversewhois.io/ - https://www.whoxy.com/ #### 3. Subdomain *Bruteforce subdomain* - [ffuf](https://github.com/ffuf/ffuf) ``` ffuf -w -u http://FUZZ. ``` #### 4. URL *Bruteforce url, path, param* - [dirsearch](https://github.com/maurosoria/dirsearch) ``` python3 dirsearch.py -u http:// -w -e * ``` - [gobuster](https://github.com/OJ/gobuster) ``` gobuster dir -u https:// -t 30 -w -x .php,.html,.txt ``` - [Arjun](https://github.com/s0md3v/Arjun) ``` https://github.com/s0md3v/Arjun.git ``` ### II. Network ================ #### 1. Scan port - [nmap](https://github.com/nmap/nmap). ``` nmap -Pn -sV -O -T3 --max-retires 1 -oN nmap.txt nmap -sV --script vuln -iL hosts.txt -oN nmap.txt ``` - [rust scan](https://github.com/RustScan/RustScan) ``` rustscan -g -a -r 0-10000 rustscan --accessible -a -r 0-10000 ``` #### 2. SMB - SMB with password ``` smbclient -U '' -L \\10.10.10.1 smbclient -U '' \\10.10.10.1\C$ crackmapexec smb host -u "david" -p ``` - SMB with ntlm hash ``` crackmapexec smb host -u "david" -H ``` - SMB bruteforce ``` crackmapexec smb -u svcorp_found_users.txt -p svcorp_found_passwords.txt -d svcorp 10.11.1.24 --continue-on-success ``` #### 3. RDP - Bruteforce ``` ncrack -v -iL hosts.txt --user victim -P passes.txt -p rdp CL=1 ``` #### 4. NFS - Show list directory ``` showmount -e 10.10.10.1 ``` - mount ``` sudo mount -t nfs -o ver=2 10.10.10.1: mout_desc -o nolock ``` #### 5. FTP - FTP with `Anonymous` ``` ftp 10.10.10.1 # Default ftp mode is Ascii. When transfer binary file(exe, doc, docx, ...), set mode to binary ftp> mode binary ``` ### III. WEB ================ #### 1. Scan - [Niko](https://github.com/sullo/nikto) #### 2. Sql Injection - [SQL Map](https://github.com/sqlmapproject/sqlmap) #### 3. LDap Injection - [LDAP-injection](https://github.com/trapp3rhat/LDAP-injection) #### 4. Wordpress - [wpscan](https://github.com/wpscanteam/wpscan) #### 5. Broken Authentication - Brute force password [john](https://github.com/openwall/john) - Create dictionary [cewl](https://tools.kali.org/password-attacks/cewl) - GitDump [gitdumper](https://github.com/arthaud/git-dumper)

#whoami

Content