Skip to main content

using hping to iterate through an address space

# for i in 'seq 1 255'; do hping3 --count 1 x.x.x.$i; done [hping_an_address_space]
# for i in 'seq 1 255'; do hping3 --count 1 x.x.x.$i 2>/dev/null | grep ip=; done [list those that repond, grep output for "ip="; taking the standard rror message and throwing them away ]
# hping3 target_IP_address <--
# tcpdump -nn host your_IP_address and host target_IP_address -p -i tap0 <-- (possibly stop iptables on the source linux machine
# hping3 -icmp -data 40 -file text.txt target_IP_address -p -i tap0 <-- (payload size of 40 bytes populated with a file called test.txt)
# hping3 --icmp --interval 10 --beep target_IP_addres <-- (will continue to beep when  the source could ping the target_IP_address. beep will stop as soon as the network is disconnected)



#!/bin/bash

if [ "$1" == "" ]
then
echo "Uaage  /pingweeps.sh [network]"
echo "E.g :/pingsweep.sh 102.168.1"
else
for ip in  `seq 1 254` ; do
ping  -c 1  $1.$ip | grep "64 bytes" | cut -d " " -f 4 | sed 's/://' &
done
fi

Oneliner ping from powershell. Will ping first 20 ip of 192.168.1
ps>1..20 | % {"192.168.1.$($_): $(Test-Connection -count 1 -comp 192.168.1.$($_) -quiet)"}

From <https://learn-powershell.net/2011/01/31/quick-hits-ping-sweep-one-liner/>

Oneliner ping from cmd line
FOR /L %i in (1,1,255) do @ping -n 1 192.168.100.%i | find "Reply"



cat ping3.txt | sort -u

for ip in $(cat iplist.txt); do nmap -Pn $ip; done

Comments

Popular posts from this blog

VM 13 : Basic Pentest 1 csec

Notes: Walkthru: 1. https://medium.com/@evire/basic-pentesting-1-7251fb3e3f9e [ w/metasploi t using Wordpress t] 2. https://prasannakumar.in/infosec/vulnhub-basic-pentesting-1-writeup/ [ w/metasploit using ftp ] 3.  https://www.ceos3c.com/hacking/basic-pentesting-1-walkthrough/ [ by uploading php-reverse-shell in wordpress ] 4. http://k3ramas.blogspot.com/2018/02/basic-pentesting-1-walkthrough.html [  access wordpress config file to get pwd and access the DB ] 5.  https://cowsayroot.com/walkthrough-basic-pentesting-1/ [ Wpscan, ftp metasploit vulnerability, phpbash ] 6.   http://www.hackingarticles.in/hack-the-basic-penetration-vm-boot2root-challenge/    [use msfvenom to create  to create php shell to be uploaded in Wordpress ] 7.   https://d7x.promiselabs.net/2018/01/30/ctf-basic-pentesting-a-guide-for-beginners/ [adding command using using PHP] Notes:  Ports - 21...ProFTPD 1.3.3c - 22 openSSH 7.2p2 ubuntu ...

VM: pWnOS 2.0

Walkthru A. http://defsecurityjam.blogspot.co.uk/2015/07/pwnos-version-2-walkthrough.html [reading source page, Simple PHP Blog Perl exploit, Python revershell using oneliner, looking around ] b. https://blog.g0tmi1k.com/2012/09/pwnos-2-php-web-application/ [metasploit using PHP Blog exploit] c. http://netsec.ws/?p=430 [burpsuite, sql porxy] d. https://blog.g0tmi1k.com/2012/09/pwnos-2-sql-injection/ [sql injection, union. Very good explanation of the process of what is being done. Didnt try cmds] e. https://www.youtube.com/watch?v=ytzZfI27ueU [sql injection, sqlmap read file and upload reverse shell using sqlmap] f. https://ub3rsec.github.io/pages/2016/pwnosv2-sqli.html [sql injection, union using burp Very good . It list all email field that we are passing and modifying thru burp suite/proxy/intercept. One could enter those union statements in the email field but in this case, the field truncates and remove the later part of union statment which is why we...

38 VM : d0not5top: 1.2

https://www.vulnhub.com/?q=D0Not5top&sort=date-des&type=vm Walkthru: A. https://github.com/Hamza-Megahed/CTFs/blob/master/d0not5top/README [  burp proxy, adding hostnames to /etc/host shows following but not working for me. Not showing localhost stuff, $ dirb http://172.16.34.163/control/ -X .txt,.php,.html     + http://172.16.34.163/control/hosts.txt     127.0.0.1 localhost     127.0.0.1 D0Not5top.ctf     #127.0.0.1       MadBroAdN1n.ctf ## AD105 M0F05] B. https://adaywithtape.blogspot.com/2017/04/vulnhub-d0not5top-writeup.html [use nc cmd to get the flag and echo cmd to decode the flag, wfuzz, virtualhost, partially binary string, google language translate, curl  -header  host request, additional domains, OWSAP ZAP, exiftool, HD, hash64,] wfuzz -c -w /usr/share/seclists/Discovery/Web_Content/common.txt --hc 404 192.168.56.102/FUZZ Changing the syntax just a tad to only show html 200...