IT Security Stuff

Google hacking is a great way to do some recon using advanced operators in the google search engine. Heres some examples: google hacking lessons: * google queries are not case-sensitive   * google doesnt use wildcard like most, it sees it just as another character   * google ignores certain common words, characters, and single digits in a search, but you can force google into using them by including them in quotes. You can also precede the word with a + sign like +and with no spaces between the + and the word "and"   * google limits searches to 32 words, but we could use wildcards to omit common words and extend that limit. so a phrase like "we the people of the united states in order to form a more perfect union establish jusice" is 17 words, but if i omit the common words and replace with wildcards: we * people * * united states * order * form * more perfect * establish *  would be couonted as 9 words   * if i do a phrase search, which means ...

Its always good to know some common ports and protocol Ids that are used in attacks. Here is a list of some common ones: Protocols 1    ICMP 6    TCP 17  UDP 47  GRE 50  ESP 51  AH Ports 20 - 21      FTP 22             SSH 23             Telnet 25             SMTP 42             WINS 53             DNS 80, 81, 8080    HTTP 88              Kerberos 110            POP3 111            Portmapper (Linux) 119            NNTP 123            NTP 135            RPC-DCOM 137, 138, 139         SMB 143            IMAP 161, 162  ...

Netcat is known by most hackers as the swiss army knife of hacking. Its a great tool to setup backdoors or just plain and simple tcp or udp connections. Heres a few examples of how you can use netcat: Lets do some exercises with it in Kali linux. Our VMs today are a kali linux  and a windows 7. First start by looking at the help file nc -h  1. Lets check to see what ports are listening,(first start the apache2 service) type: nc -v 80  2. If you had started the apache service on kali linux you should see it shows there as open  3. You can also set up a listener port, type: nc -lvp 1234  4. The l here is for listen, the v is for verbose, the p is to specify the port to listen on  5. Lets open up a second terminal window and use netcat to connect to the listener  6. In the second terminal type: nc 10.0.0.100 1234 and hit enter  7. The first terminal should show you connected  8. Now lets chat from the second terminal b...

Nmap Nmap is the industry standard tool used mainly for port scanning. It also has scripting functionality using the LUA language to extend its capabilities into different types of port scans and exploits as well. Being cross platform, it is used as a major jumping point for exploiting machines that you have little information on outside of just an ip subnet or address. Below is a basic cheat sheet and examples for some common uses of it. Discovery Scans: Option    Description -------------------- -sP          Ping -sL          List Scan -sO         Protocol Scan -sV         Verify Common Switches: Option     Description -------------------------- -n        Skip DNS resolving -sn        Disable port scan -Pn        Skip host discovery -PO   ...

HPING   Although Hping 3 is no longer being developed, it has been forked over to nmap as nping, here are some commands and examples using hping 3. * TCP scan: hping 3 -V  --scan 1-100  -S  10.10.10.12  to scan the first 100 ports of the windows 2012 machine. (the  -S  is setting the syn flag). * Lets spoof an address to port 80 on the server 2008 machine.  Hping3  -I eth5  -a 1.2.3.4  -p 80  -S   -c 10  10.10.10.8   (-a for spoof) * Now lets do a syn flood with random source addresses:  Hping3  --flood  --rand-source   -p 80  -S 10.10.10.8 * Lets try sequence number prediction (will probably fail because windows implements alsr): Hping3  10.10.10.8  --seqnum  -p 139  -S  -i u1  -I eth5 * Lets do an icmp ping (remember hping default is tcp. We will have to choose number 1 as that is icmp mode): Hping3  -1  10.10.10.8 * Lets do an ...

  OSCP ROADMAP Enumeration Roadmap Step 1: Nmap basic scan Nmap -Pn -p- -vv <ip address> Nmap -Pn -p- -sU -vv <ip address> Step 2: Nmap version and vulnerability Scan: Nmap -Pn -sV -O -pT:{TCP ports found in step 1},U:{UDP ports found in step 1} -script *vuln* <ip address> Grab banners manually for more clarity: nc -nv <ip-address> <port> Step 3: Any web port(s) for further enumeration? Nikto -port {web ports} -host <ip address> -o <output file.txt> Dirb http{s}://<ip address>:<port> /usr/share/wordlist/dirb/{common/small/vulns}.txt Gobuster -u http://<ip-address> -w /usr/share/Seclists/Discovery/Web_Content/common.txt /usr/share/secLists/Discovery folder has some great word lists If only web port visible try a bigger list in dirb: /usr/share/wordlist/dirb/big.txt Use Burpsuite as needed Do you see any interesting directory containing sensitive data? Do you see any LFI/RFI vulnera...