Nmap Nikto Scan. Scans for http (Web) servers on port 80 and pipes into Nikto for scanning. Nmap -p80 10.0.1.0/24 -oG - nikto.pl -h - Scans for http/https servers on port 80 & 443 and pipes into Nikto. April 8, 2014 Enumeration Masscan (local): masscan -p1-65534 -rate=10000 -oG name.masscan 10.10.10.10. Netdiscover: netdiscover -i eth0.
port scanning
Nmap
Network exploration tool and security/ port scanner
Unicornscan
A port scanner that utilizes its own userland TCP/IP stack, which allows it to run asynchronous scans. It can scan 65,535 ports in a relatively short time frame.
Netcat
Netcat might not be the best tool to use for port scanning, but it can be used quickly. While Netcat scans TCP ports by default it can perform UDP scans as well.
1.1.3 TCP Scan
For a TCP scan, the format is:
1.1.4 UDP Scan
For a UDP Port Scan, we need to add -u flag which makes the format:
Amap - Application mapper
identify which services are running on a given port Adobe acrobat xi pro for mac rapidgator.
DNS enumeration
DNS Server
If the targeted machine is running a DNS Server and we have a possible domain name, we may try to figure out A, MX, AAAA records or try zone-transfer to figure out other possible domain names.
Example:
SSL Certificate
If the targeted machine is running an https server and we are getting an apache default webpage on hitting the https://IPAddress, virtual hosts would be probably in use. Check the alt-dns-name on the ssl-certificate, create an entry in hosts file (/etc/hosts) and check what is being hosted on these domain names by surfing to https://alt-dns-name.
nmap service scan result for port 443 (sample)
Scanning Structure
Google-Vulns
It is suggested that whenever you are googling something, you add words such as vulnerability, exploit, ctf, github, python, tool etc. to your search term. For example. Let's say, you are stuck in a docker or on a specific cms search for docker ctf or ctf/ github etc.
Webservices
Utilize whatweb to find what software stack a server is running.
DNS Server
If the targeted machine is running a DNS Server and we have a possible domain name, we may try to figure out A, MX, AAAA records or try zone-transfer to figure out other possible domain names.
Example:
SSL Certificate
If the targeted machine is running an https server and we are getting an apache default webpage on hitting the https://IPAddress, virtual hosts would be probably in use. Check the alt-dns-name on the ssl-certificate, create an entry in hosts file (/etc/hosts) and check what is being hosted on these domain names by surfing to https://alt-dns-name.
nmap service scan result for port 443 (sample)
Scanning Structure
Google-Vulns
It is suggested that whenever you are googling something, you add words such as vulnerability, exploit, ctf, github, python, tool etc. to your search term. For example. Let's say, you are stuck in a docker or on a specific cms search for docker ctf or ctf/ github etc.
Webservices
Utilize whatweb to find what software stack a server is running.
1.3.3 nikto
nikto - Scans a web server for known vulnerabilities.
It will examine a web server to find potential problems and security vulnerabilities, including:
- Server and software misconfigurations
- Default files and programs
- Insecure files and programs
- Outdated servers and programs
1.3.4 dirb, wfuzz, dirbuster
Furthermore, we can run the following programs to find any hidden directories.
- DIRB is a Web Content Scanner. It looks for existing (and/ or hidden) Web Objects. It basically works by launching a dictionary based attack against a web server and analysing the response.
- wfuzz - a web application bruteforcer. Wfuzz might be useful when you are looking for webpage of a certain size. For example: Let's say, when we dirb we get 50 directories. Each directory containing an image. Often, we then need to figure out which image is different. In this case, we would figure out what's the size of the normal image and hide that particular response with wfuzz.
- Dirbuster : DirBuster is a multi threaded java application designed to brute force directories and files names on web/ application servers.
- gobuster : Gobuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (with wildcard support). (golang can be installed using apt-get).
1.3.5 BurpSuite Spider
There will be some cases when dirb/ dirbuster doesn't find anything. This happened with us on a Node.js web application. Burpsuite's spider helped in finding extra-pages which contained the credentials.
Nikto Cheat Sheet
1.3.6 PUT Method
Sometimes, it is also a good idea to check the various HTTP verbs that are available such as GET, PUT, DELETE, etc. This can be done by making an OPTIONS request.Curl can be used to check the available options (supported http verbs):
The PUT method allows you to upload a file which can help us to get a shell on the machine. There are multiple methods available for uploading a file with the PUT method mentioned on Detecting and exploiting the HTTP Put Method
A few are:
- Nmap:
- curl:
or
1.3.7 Wordpress
When faced with a website that makes use of the wordpress CMS one can run wpscan. Make sure you run –enumerate u for enumerating usernames because by default wpscan doesn't run it. Also, scan for plugins
We can also use wpscan to bruteforce passwords for a given username
Secploit Terminal Search Engine
it is web tool made to make it easy to query search using tags search or with exploit name
or we can search for specific vulnerability on specific software easily ,using tags support
searchsploit
Exploit Database offline Archive Search for vulnerable software , shells , papers
Once we have figured out which exploit to check we can read about it by using the file-number. For example: 1997, 2017, 24574 in the above case.
Searchsploit provides an option to read the nmap XML file and suggest vulnerabilities (Requires nmap -sV -x xmlfile).
PHP Web Shell
or
or
which can then be accessed by
If there's a webpage which accepts phpcode to be executed, we can use curl to urlencode the payload and run it.
- PHP Meterpreter
We can set the multi-handler in metasploit by
PHP Reverse Shell
The code below assumes that the TCP connection uses file descriptor 3. This worked on my test system. If it doesn't work, try 4 or 5 or 6.
Ruby
Perl
Python
TCP
UDP
Java
JSP
Bash
If a server (attacker machine) is listening on a port:
then we can use the below to connect
Method 1:
Method 2:
Nikto Cheat Sheet Pdf
Method 3:
Telnet Reverse Shell
XTerm
To catch the incoming xterm, start an X-Server:
You'll need to authorize the target to connect to you (command also run on your host):
Nikto Cheat Sheet Free
Lynx
MYSQL
- If we have MYSQL Shell via sqlmap or phpmyadmin, we can use mysql outfile/ dumpfile function to upload a shell.
or
- If you have sql-shell from sqlmap/ phpmyadmin, we can read files by using the load_file function.
Reverse Shell from Windows
Executable Meterpreter Payloads
Secploit Online reverse Shells Generator
you can also generate any type by choosing bash or python , ruby .etc
