Methodology

NMAP:-

1. Nmap default scan: nmap -sC -sV -Pn -oA initial IP

2. Nmap fullscan: nmap -p- -Pn -sT -oN full.txt IP

3. Nmap fullserv scan: nmap -Pn -sV -p IP

4. Nmap scripts: nmap --script vuln -p IP

5. Nmap UDP scan: nmap -sU -Pn IP

6. Nmap UDP fullscan: nmap -sU -p- -Pn IP

7. Nmap Aggresive scan: nmap -A -Pn IP

8. Re-run the nmap full port scan again after 1-2hrs to check if all the ports were discovered.

9. Nmap Scripts: /usr/share/nmap/scripts/

10. nmap IP --script=... --script-args uri=/cgi-bin/admin.cgi --script-args uri=/cgi-bin/test.cgi

11. nikto -o nikto.txt -host IP

FINGERPRINTING:

1. Connect ports with netcat and grab the banner for version and OS info.

2. Confirm the OS from the official website.

HTTP/HTTPS:-

1. Grab the header: curl -i IP

2. Check robots.txt

3. Run gobuster, dirbuster and nikto. (Also run gobuster on already found URLs. Also on 403)

4. Check the source code of each page

5. If you find Wordpress, Drupal, Joomla, October, Tomcat, phpMyAdmin website, then go here
6. Check the Webapps/CMS source code online. Maybe GitHub. Check if you can find config files, README files etc which can give sensitive information.

7. If you find SQLi then go here
8. If you find LFI/RFI then go here
9. If you find File Uploads then go here
10. Collect usernames and keywords from webpages and source code and note them.

11. If you don't get success with anything then bruteforce the already found directories again. Check for application specific wordlists to save time.

12. Find exploits related to a keyword/application: "keyword exploit", "keyword exploitdb", "keyword exploit github", "keyword exploit github python", "keyword hackthebox", "keyword vulnhub", "keyword tryhackme".

13. Note down the Webserver, webapplication version. It will be useful to understand the machine and also find exploits regarding the same.

14. If webapp is misconfigured, you can guess the URL after authentication and bypass the authentcation completely.

15. If you don't get shell then try to URL encode or Base64enocde:

If you find a Login/Signup page then do the following:-

1. Check for weak credentials.

2. admin
   admin    admin
   admin    password
   administrator
   administrator    administrator
   administrator    password
   root
   root    root
   root    password   

3. Check for default credentials.

4. Check for valid usernames by checking the error message of incorrect login/forgot password.

5. Guess the credentials by using the name of software/keywords. Use cewl.

6. Try bypassing using SQLi
7. Bruteforce password using Hydra

SMB:-

1. Run smbmap, smbclient, enum4linux.

2. Note down the version and check if there are exploits associated with it.

3. If it hosts the webpages then try to get a code execution/reverse shell using FileUpload.

SMTP:- (Used to send emails)

1. Check for valid user using the VRFY command

2. Check for version and find an exploit for it.

3. Check for shellshock.

4. Bruteforce smtp-user-enum -M VRFY -U /usr/share/metasploit-framework/data/wordlists/unix_users.txt -t 192.168.1.72

POP3:- (Used to receive emails)

1. Login using USER user, PASS pass

2. Use LIST to list the emails

3. Use RETR 1 to read the email

FTP:-

1. Try anonymous login

2. Check version and exploits

3. Try bruteforce: hydra -L -P IP ftp

SSH:-

1. Connect with SSH to grab the banner.

2. Check if it is requesting for a password prompt. If not, then it is to be authenticated via keys.

3. Scripts: ls -la /usr/share/nmap/scripts/*ssh*

4. Bruteforce with the intel found.

RPC:-

1. rpcinfo -s IP

NNTP (119):- (Used to read and write articles to NNTP server)

1. nc -nvC IP 119

2. HELP

3. LIST (If it shows 0 0 then there are no articles present.)

NFS:-

1. showmount -a IP

2. showmount -d IP

3. showmount -e IP

SEARCHSPLOIT:

#Basic
searchsploit <name>
#Remove dos exploits
searchsploit <name> | grep -v '/dos/'
#Search in title and remove dos exploits
searchsploit -t <name> | grep -v '/dos/'
#Remove a specific thing from PATH. (Ex: remove .php)
searchsploit --colour -t php 5.x | grep -v '/dos/' | grep -vi '\.php '