Knowledge Base for Penetration Testing
Metasploit is an open source platform for vulnerability research, exploit development, and the creation of custom security tools. In this lab, we’re going to be using Metasploit to attack the Metasploitable2 VM. Preqreq – have a local Kali instance and Measploitable2 VM running. https://hack.technoherder.com/vm-setup-kali-metasploitable2/ Activities Part 1 – Getting Started Update Kali: Start the Kali […]
Login into postgres -U user-h host-d database \l – list databases\c [DataNase Name] – connect to database\dt – list datatables\q – quit/exit program\du – list users List of roles Role name Attributes postgres Superuser, Create role, Create DB, Replication, Bypass RLS webapp Superuser SELECT current_setting(‘is_superuser’); Auth Trust Open the file […]
SharpSystemTriggers SharpSystemTriggers is a collection of remote authentication triggers coded in C# using MIDL compiler for avoiding 3rd party dependencies. Spooler Service Abuse If the Print Spooler service is enabled, you can use some already known AD credentials to request to the Domain Controller’s print server an update on new print jobs and just tell […]
Network protocols LLMNR, NBT-NS, and mDNS Microsoft systems use Link-Local Multicast Name Resolution (LLMNR) and the NetBIOS Name Service (NBT-NS) for local host resolution when DNS lookups fail. Apple Bonjour and Linux zero-configuration implementations use Multicast DNS (mDNS) to discover systems within a network. These protocols are unauthenticated and broadcast messages over UDP; thus, attackers […]
Basic Information SSH or Secure Shell or Secure Socket Shell, is a network protocol that gives users a secure way to access a computer over an unsecured network.Default port: 22 SSH servers: SSH libraries (implementing server-side): Enumeration Banner Grabbing Automated ssh-audit ssh-audit is a tool for ssh server & client configuration auditing. https://github.com/jtesta/ssh-audit is an […]
What is a RID A Relative Identifier (RID) is a unique identifier (represented in hexadecimal format) utilized by Windows to track and identify objects. To explain how this fits in, let’s look at the examples below: Definition from here. Enumeration with rpcclient Pat of this section was extracted from book “Network Security Assesment 3rd Edition“You […]
Enumeration Vulnerability – Supermicro IPMI UPnP Supermicro includes a UPnP SSDP listener running on UDP port 1900 on the IPMI firmware of many of its recent motherboards. On versions prior to SMT_X9_218 this service was running the Intel SDK for UPnP Devices, version 1.3.1. This version is vulnerable to the issues Rapid7 disclosed in February […]
Post Office Protocol version 3 (POP3) is an mail protocol used to retrieve mail from a remote server to a local email client. POP3 copies the mail from the remote server into the local mail client. Optionally, mail is deleted after it is downloaded from the server. This saves space on the server. If you […]
Hardware and software should be hardened as much as possible before it is added to a network. Organizations should make the assumption that the device or application is not safe when they receive it. The client should research and identify any issues that the manufacturer or publisher are already aware of. All known vulnerabilities should […]
SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and receiving e-mail. However, since it is limited in its ability to queue messages at the receiving end, it is usually used with one of two other protocols, POP3 or IMAP, that let the user save messages in a server mailbox and download […]
by 
