Covers basics starting with enumeration.

There is a process to exposing vunerabilities. Not a linear process. Imposter syndrome is huge in this field, due to the complexity of the field, and how many domains it covers.

The anatomy of a hack (EEE); Enumeration, Exploitation, Escalation

There are multiple ways to do one thing, for example to figure out if the sshd daemon is running you could:

  • Check if port 22 is listening netstat -tlp
  • Check if the sshd process is running
  • Try to ssh connect to the daemon
  • List the running services through systemd

Tools⌗

Tools to grok:

  • nc
  • wireshark
  • nikto
  • nmap

nmap⌗

SAN’s Nmap Cheatsheet

Scan a subnet:

nmap -sP 192.168.0.0/24

Scan (fast) a host for open ports:

nmap -F 192.168.0.14

Verbose and detailed service analysis:

nmap -A -sV 192.168.0.62

netcat⌗

San’s netcat cheetsheet

Allows us to connect to network services to see if they’re accessible.

nc -nv 192.168.0.14 110

Allows us to establish network listeners.

nc -nvlp 4444

Transferring files:

nc -nvlp 4444 > program.exe
nc -nv 192.168.0.99 4444 < program.exe

Remote administration is possible, by binding a shell:

nc -nvlp 4444 -e /bin/bash
nc -nv 127.0.0.1 4444

Port scanning (randomise port enumeration and max wait time of 1s):

nc -z -v -r -w1 192.168.0.14 80-120

Wireshark⌗

Tip: Always capture first, and analyse later.

Can laer filter on MAC, IP, and other protocol specific features.

Follow TCP Stream, is a super handy feature.

tcpdump⌗

CLI version of wireshark, without dissectors and other features. Can be used to save pcap files for dissection later.

OpenVAS⌗

The world’s most advanced Open Source vulnerability scanner and manager

Open Source Intelligence⌗

Common OSINT sources; whois, linkedin, facebook, pastebin, breach dumps, shodan, internet archive (wayback machine), theharvester

http://www.exploit-db.com/google-hacking-database/

Google queries:

site:linkedin.com (inurl:com/pub | inurl:com/in) -inurl:pub/dir "Company"

Enumeration⌗

One of the most important aspects to invest in early. If incorrect assumptions are made, you can follow rabbit holes that waste significant amounts of time.

Port Scanning⌗

nmap TCP scanning (connect, syn). UDP scanning. NSE (nmap scripting engine) scripts, are useful for example running a SMB like client.

  • Firewalls and other network appliances can interfere with results. Try from another IP.

Port scanners generally target interesting ports. Specify ports explicitly.

Tip: Always scan for UDP services. They take a very long time, as datagrams are fired off, and may be filtered and never come back.

A SYN scan is simply a SYN/SYN-ACK shake, without the 3rd piece (ACK) of the handshake. Where a full CONNECT scan is a more realistic 3-way handshake, that mimics a real connection.

Flags⌗

  • -O identify OS based on response
  • -sV and -A will conduct service fingerprinting using service banners and eumeration scripts.
  • -sP scan hosts on a specified network e.g. nmap -sP 192.168.0.0/24

NSE (Scripting Engine)⌗

There are tons of scripts in /usr/share/nmap/scripts, everything from probes to exploits.

Categories of scripts are supported, for example:

  • nmap --script default
  • `nmap –script=smb 192.168.0.0/24

Exercises⌗

Conduct a TCP connect scan against HOST using netcat

Port scanning (randomise port enumeration and max wait time of 1s):

nc -z -v -r -w1 192.168.0.14 80-120

Conduct a TCP connect scan against HOST using nmap

nmap -sV 192.168.0.14

Conduct a TCP SYN scan against 192.168.0.14 using nmap

Conduct a UDP scan against 192.168.0.14 using nmap

Read the nmap man page. Try some other scan types and observe the differences in wireshark

DNS Enumeration⌗

Forward and reverse lookups:

dig mordoor.com
dig -x 192.168.0.14

Zone transfers:

dig axfr mordoor.com @ns1.mordoor.com

DNSrecon

dnsrecon -d mordoor.com -t axfr

DNSenum

dnsenum mordoor.com

SMTP Enumeration⌗

The protocol supports a bunch of commands to allow the sending of email. Checkout the SMTP RFCs.

Hook up to the SMTP server with netcat (nc -nv 192.168.0.1 25)

VRFY person@example.com
EXPN maillist@example.com

SMB enumeration⌗

Find hosts running SMB services

nmap -p 139,445 192.168.0.0/24

Interact with those services to gather information

nbtscan -r 192.168.0.0/24

Enumerate those SMB services

enum4linux -a 192.168.0.14

TODO: Do a nmap –script=smb scripting.

SNMP enumeration⌗

SNMP interacts via UDP port 161. The SNMP MIB contains information relating to network management. SNMP services require public and private community string to interact.

A real gold mine for discovering recon about a host, such as it physical location.

  • Scan for open UDP161 ports with nmap and use NSE (nmap scripting engine)
  • Scan and interact with UDP161 ports using onesixtyone
  • snmpwalk can dump out the entire MIB

onesixtyone is a really handy tool for probing SNMP community strings, and can be fed a word list to enumerate through. The following will test the public community string:

onesixtyone 192.168.0.123 public

Tip for snmpwalk help (such as the -m and -O switches), checkout the snmpcmd.

snmpwalk -mALL -OS -c public -v 192.168.0.61 2> /dev/null

Keep an eye out for particular MIB’s. For example, if snmpwalk dumped out iso-3.6.1.2.1.1.6, you could search the MIB on oid-info, and you would find this relates to the machines physical location.

Directory enumeration⌗

How do you know if a website has areas they don’t wish you to see? Checkout the robots.txt.

Tools such as gobuster to try visiting a huge amount of directories. Those that exist will return a HTTP 200, those that don’t a 404.

Checkout dirb, which throws a dictionary at the HTTP server, for example:

dirb http://192.168.0.60

Enumeration exercises⌗

  • What is the physical location of the box (according to its own records)?
  • What is the Linux kernel version in use?
  • What is the OS?
  • What is the SSH EdDSA hostkey?
  • What is the full email address of all employee’s at shoprite.com?