• 88 Kerberos

    Enumeration Tools ker­brutepython3 /opt/kerbrute/kerbrute.py -domain thinc.local -users /usr/share/seclists/Usernames/Names/names.txt -dc-ip $target Alter­na­tive https://github.com/ropnop/kerbrute msf> use auxiliary/gather/kerberos_enumusers Per­form ASRE­PRoast

  • 23 Telnet

    Enumeration Mandatory Grab the banner. Tools Pata­tor (brute force)

  • 22 SSH

    Enumeration Mandatory Try to access ssh ‑v $target Optional Reuse exist­ing credentials Brute-force with exist­ing user­names (Pass­word-spray­ing) Try ssh-audit $target Try known user­naes with user­name as pass­word or oth­er found strings. Privilege Escalation Find .ssh direc­to­ry on the file sys­tem and check all files within. Check sshd_config file. Check SSH ver­sion for exploits.

  • 443 HTTPS

    Enumeration Check the certificate Per­form SSL-Scan Go to Check­list 80 HTTP Optional if vul­ner­a­ble against heart­bleed, use msf> use openssl_heartbleed. Don’t for­get to use set ACTION KEYS or sim­i­lar (see info)

  • 21 FTP

    Enumeration Mandatory Check anony­mous login Try to cre­ate AND upload a file:  mkdir test put /tmp/test test Check login with at least the fol­low­ing credentials:  admin / admin admin / password Optional Down­load every­thing with wget and look for .dot files! Check login with new­ly found users Brute-force login Make sure to check admin / admin and oth­er usu­al com­bi­na­tions…

  • 631 IPP

    Enumeration Mandatory Open the site in a Brows­er. Maybe a CUPS inter­face is available. Per­formnmap -p 631 $target --script cups-info Try the PRET Print­er Exploita­tion Toolk­it is use­ful for print­er hack­ing. See also HTB Laser (ippsec)python pret.py $target pcl

  • 80 HTTP

    Enumeration Mandatory Optional Tools

  • 25 SMTP

    Enumeration Mandatory Optional On Windows