hacknotes

This is a basic note for Red Teamers, Pentesters, Offsec Enthusiast, CTF Players etc

For Activity Directory notes check Active Directory.

You can use my script Hackify to install tools and wordlist on your linux system.

CTF Box Solving Manual

• Recon Tools and Commands
• Linux Priviledge Escalation
• Windows Priviledge Escalation

Recon Tools and Commands

• Autorecon
  • https://github.com/21y4d/nmapAutomator
  • https://github.com/Tib3rius/AutoRecon/
• Port Scan
  • naabu
    • tcp all naabu -p - -host <target>
  • rustscan
    • tcp rustscan -a <target>
    • udp rustscan --udp -a <target>
  • nmap
    • Basic All port nnmap -Pn -T5 -A -sS -sU -p- -oN nmapfull.txt -oX nmapfull.xml <target>
    • All port with vuln scripts nmap --script vuln -Pn -p- -T5 -A -oN nmapvuln.txt <target>
    • Windows AD Specific nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,49152-65535 --script smb-enum-shares,smb-enum-users,ldap-rootdse,ldap-search,krb5-enum-users,smb-os-discovery,smb-vuln-ms17-010,smb-enum-domains,smb-enum-sessions,smb-enum-processes,smb2-security-mode,smb2-capabilities,smb-system-info,msrpc-enum,smb-brute,rdp-enum-encryption,rdp-vuln-ms12-020,rdp-ntlm-info,ssl-cert,ssl-enum-ciphers,smb-protocols,ms-sql-info,smb-vuln-regsvc-dos -oN nmapAD.txt <target>
• Domain or IP Recon
  • dig dig axfr @<ip_address> target.tld

• Wordlist generator cewl http://domain.tld/ | grep -v CeWL > custom-wordlist.txt

• Subdomain Enumeration
  • Gobuster gobuster vhost -u http://monitorsthree.htb --append-domain -w /opt/wordlists/SecLists/Discovery/DNS/namelist.txt -r
  • ffuf ffuf -w /opt/wordlists/SecLists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -fw 18 -mc all -ac -u http://domain.tld -H 'Host: FUZZ.domain.tld' [For vpn file and ctf]
  • ffuf ffuf -w /opt/wordlists/SecLists/Discovery/DNS/dns-Jhaddix.txt:FUZZ -fw 18 -mc all -ac -u http://FUZZ.domain.tld [For Real World]
  • subauto [Use Hackify to install] subauto domain.tld [Very useful for real world subdomain enumeration.]

• BruteForce: ssh, kerbrute or any other service using hydra, medusa or any specific tool like kerbrute etc.

• Check outdated or vulnerable version for any service or software using exploitdb and google

• Default Crecdentials, Check any software or service is using default credential or easy to crack username password

This site is open source. Improve this page.