akde/infosec

Click Here

  • Cloud Enumeration

    Initial (network) enumeration Check where a ser­vice is host­ed by quer­ing the name­serv­er records for our tar­get domain: host -t ns $domain Get more infor­ma­tion / con­fir­ma­tion via a whois query to one pre­vi­ous­ly found domain. whois $previouslyFoundDomain Check where a host is running: host $domainhost $ipFromTheDomain Check more domains of this organ­i­sa­tion / of…

  • Scanning and downloading Git repositories

    Mir­ror­ing git­tyleaks: Exe­cute with­in a local repos­i­to­ry the com­mand gittyleaks --find-anything. git-secrets: Scans (only) com­mit mes­sages for sen­si­tive infor­ma­tion with git secrets --scan-history. truf­fle­Hog: Scans repos and prints out infor­ma­tion with a high entropy: Exe­cute it with trufflehog $repo_dir. git-secret-scan­ner: Scans a repo with git-secret-scanner scan -d $git_repo. Oth­er tools

  • Responder

    respon­der: Lis­ten with respon­der on a net­work and wait for AD sys­tems to ask for a DC. This can reveal a NTLM hash. (Source) Start respon­der on the own system: sudo responder -I tun0 --wpad Con­nect from the tar­get sys­tem to this sys­tem via smb. In the Win­dows explor­er, or in the com­mand line via dir…

  • Passive enumeration

    General objectives Organizing template Web ressources Tools Notes

  • finger

    Enumeration Aktuell angemeldete Benutzer anzeigen finger @ip Benutzer-Enu­mer­a­tion for username in $(cat cirt-default-usernames.txt); do finger $username@10.10.10.76 >> /tmp/finger; done Enu­mer­a­tion mit Metasploit: msf5 > use auxiliary/scanner/finger/finger_users msf5 auxiliary(scanner/finger/finger_users) > set rhosts 10.10.10.76 rhosts => 10.10.10.76 msf5 auxiliary(scanner/finger/finger_users) > run Exploits Auf sehr alten Sys­te­men kon­nte man https://insecure.org/sploits_all.html zufolge Befehle aus­führen, etwa mit finger "|/bin/id@host'

  • Sniffing network traffic (tcpdump)

    tcpdump Get incom­ing ICMP packets: sudo tcpdump -i any icmp and src host $target Nützliche Parameter Domains nicht auflösen, IPs anzeigen -n Dump der Dat­en anzeigen -X Paket in ASCII anzeigen -A Umgang mit Dateien Dump in Datei schreiben tcpdump -w file Dump aus Datei lesen tcpdump -r file Standard-Abfragen tcpdump -n src|dst 10.10.10.10 and port…

  • Wireshark

    See a pack­et in its context Kontextmenü, Follow auswählen Show only ICMP pack­ets from a host tcpdump host 10.11.1.128 and icmp -i tun0 Show oth­er sys­tems com­mu­ni­cat­ing out­side the own address ip.addr == 10.11.1.0/24 && !(ip.addr == 192.168.119.0/24) && ! dns && !browser && !ssdp && !nbns && !llmnr Record audio Wire­shark can trans­form cap­tured audio…

  • netstat

    Rout­ing-Tabelle ansehen netstat -r Schnelle Aus­gabe ohne DNS-Auflö­sung, nur IPs: netstat -n Nur TCP-Verbindun­gen anzeigen netstat -t Nur UDP-Verbindun­gen anzeigen netstat -u Pro­gramm anzeigen, dass offene Verbindung benutzt netstat -p Net­zw­erk­sta­tis­tik anzeigen netstat -s

  • Sniffing and Traffic/Packet analysis / IDS Intrusion Detection

    See also the Wire­shark post PSnuffle Metas­ploit mod­ule; analyse the live traf­fic for cre­den­tials of var­i­ous protocols. msf > use auxiliary/sniffer/psnuffle PCredz PCredz uses a PCAP file and extracts hash­es and oth­er credentials. pcredz -f dump.pcap Zeek GitHub — zeek/zeek: Zeek is a pow­er­ful net­work analy­sis frame­work that is much dif­fer­ent from the typ­i­cal IDS you…

  • Ettercap

    Sniff­ing and live con­tent fil­ter­ing. Oper­a­tion modes: Uni­fied:  sniffs all pack­ets from one inter­face. Pack­ets for an attack host are end­ing here, but are direct­ly for­ward­ed after receiving Brid­get: For­wards traf­fic from one inter­face to anoth­er. Absolute­ly secret because there is real­ly no one “between the cable” Usage ettercap OPTIONS TARGET1 TARGET2 Tar­gets are defined as MAC/IPv4s/IPv6s/PORT…

  • p0f

    Pas­sive OS fingerprinting http://tools.kali.org/information-gathering/p0f

  • dmitry

    Active Infor­ma­tion Gath­er­ing tool. See http://tools.kali.org/information-gathering/dmitry

  • Information gathering

    => https://www.exploit-db.com/google-hacking-database => https://ahrefs.com/blog/google-advanced-search-operators/ => https://searchdns.netcraft.com/ Github Search for file names with­in repos of users: user:megacorpone filename:users Tools Google Look­ing for direc­to­ry listings: site:URL intitle:index.of Look­ing for con­fig­u­ra­tion files: site:URL ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini Look­ing for date­base files: site:URL ext:sql | ext:dbf |…