Last updated
Last updated
Name:
Version:
Anonymous login:
Name:
Version:
Protocol:
RSA-key-fingerprint:
Takes-password:
If you have usernames test login with username:username
Name:
Version:
VRFY:
EXPN:
Name:
Version:
Some versions are vulnerable.
Exploit:
Name:
Version:
Domain/workgroup name:
Domain-sid:
Allows unauthenticated login:
Used by RPC to connect in domain network. Usually nothing.
Version:
If you have credentials look in metasploit for other modules.
Name: Version: Password protected:
Name:
Version:
Default logins:
Name:
Version:
Basic info about web service (apache, nginx, IIS)
Server:
Scripting language:
Apache Modules:
IP-address:
Domain-name address:
Test logging in to see what OS is running
Server:
Scripting language:
Apache Modules:
Domain-name address:
INSERTCURLHEADER
Web application
Name:
Version:
Nikto scan
INSERTNIKTOSCAN
Url brute force
INSERTDIRBSCAN
Default/Weak login
Google documentation for default passwords and test them:
LFI/RFI
SQL-Injection
Sql-login-bypass
Open Burp-suite
Make and intercept request
Send to intruder
Cluster attack
Attack
Check for response length variation
Heartbleed:
Now we have gathered information about the system. Now comes the part where we look for exploits and vulnerabilities and features.
Add possible exploits here:
Where there are many exploits for a software, use google. It will automatically sort it by popularity.
'''''''''''''''''''''''''''''''''' PRIVESC '''''''''''''''''''''''''''''''''
Now we start the whole enumeration-process over gain. This is a checklist. You need to check of every single one, in this order.
Kernel exploits
Cleartext password
Reconfigure service parameters
Inside service
Program running as root
Installed software
Scheduled tasks
Weak passwords
Here you will add all possible leads. What to try.
OS:
Version:
Architecture:
Current user:
Hotfixes:
Antivirus:
Users:
Localgroups:
Unquoted service paths
Check book for instructions
Weak service permissions
Check book for instructions
Check netstat to see what ports are open from outside and from inside. Look for ports only available on the inside.
Remote desktop
Add user and enable RDP
----------------------------- LOOT LOOT LOOT LOOT -------------------
Proof:
Network secret:
Password and hashes:
Dualhomed:
Tcpdump:
Interesting files:
Databases:
SSH-keys:
Browser:
Browser start-page:
Browser-history:
Saved passwords:
Can be accessed through ftp. Some default passwords here:
Paste in sqlibypass-list ()