akde/infosec

Click Here

  • fingerprintjs

    Fingerprintjs2 col­lects a vast amount of brows­er configurations. Vic­tims could be brought to vis­it a site which con­tains this JS which sends the infor­ma­tion back to the attacker. See OSCP 414ff

  • Passive enumeration

    General objectives Organizing template Web ressources Tools Notes

  • Network and port scans

    General notes NC / Netcat Try net­cat first on inter­est­ing ports or nar­row port ranges to be more silent Network scan Choose a port which is prob­a­bly open on sys­tems on this net­work. E.g. 445 for Win­dows hosts or 22 for Lin­ux hosts. for i in $(seq 1 254); do nc -zv -w 1 10.10.10.$i 445;…

  • IPv6 enumeration

    Linux Detect IPv6 hosts There is no arp table like in Ethernet/IPv4. But we can sim­u­late is as fol­lows to list all neight­bours / direct­ly reach­able hosts: ping6 -c 5 ff02::1%eth0 >/dev/null ip -6 neigh Bonus: ip neigh shows the IPv4 address res­o­lu­tion table like the arp com­mand does. Detect IPv6 addresses for known IPv4 addresses Sce­nario:…

  • p0f

    Pas­sive OS fingerprinting http://tools.kali.org/information-gathering/p0f

  • dnmap

    Dis­trib­uted port scan­ning. Install dnmap_client on many machines and install one dnsmap_server. The serv­er con­trols the clients to split port scans. http://tools.kali.org/information-gathering/dnmap

  • dmitry

    Active Infor­ma­tion Gath­er­ing tool. See http://tools.kali.org/information-gathering/dmitry

  • sslyze

    Analy­ses SSL https://github.com/nabla-c0d3/sslyze python ‑m sslyze –reg­u­lar URL

  • Information gathering

    => https://www.exploit-db.com/google-hacking-database => https://ahrefs.com/blog/google-advanced-search-operators/ => https://searchdns.netcraft.com/ Github Search for file names with­in repos of users: user:megacorpone filename:users Tools Google Look­ing for direc­to­ry listings: site:URL intitle:index.of Look­ing for con­fig­u­ra­tion files: site:URL ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini Look­ing for date­base files: site:URL ext:sql | ext:dbf |…