2 min read
Infrastructure-based Enumeration
| Command | Description |
|---|---|
curl -s https://crt.sh/\?q\=<target-domain>\&output\=json | jq . | Certificate transparency. |
for i in $(cat ip-addresses.txt);do shodan host $i;done | Scan each IP address in a list using Shodan. |
Host-based Enumeration
FTP
| Command | Description |
|---|---|
ftp <FQDN/IP> | Interact with the FTP service on the target. |
nc -nv <FQDN/IP> 21 | Interact with the FTP service on the target. |
telnet <FQDN/IP> 21 | Interact with the FTP service on the target. |
openssl s_client -connect <FQDN/IP>:21 -starttls ftp | Interact with the FTP service on the target using encrypted connection. |
wget -m --no-passive ftp://anonymous:anonymous@<target> | Download all available files on the target FTP server. |
SMB
| Command | Description |
|---|---|
smbclient -N -L //<FQDN/IP> | Null session authentication on SMB. |
smbclient //<FQDN/IP>/<share> | Connect to a specific SMB share. |
rpcclient -U "" <FQDN/IP> | Interaction with the target using RPC. |
samrdump.py <FQDN/IP> | Username enumeration using Impacket scripts. |
smbmap -H <FQDN/IP> | Enumerating SMB shares. |
crackmapexec smb <FQDN/IP> --shares -u '' -p '' | Enumerating SMB shares using null session authentication. |
enum4linux-ng.py <FQDN/IP> -A | SMB enumeration using enum4linux. |
NFS
| Command | Description |
|---|---|
showmount -e <FQDN/IP> | Show available NFS shares. |
mount -t nfs <FQDN/IP>:/<share> ./target-NFS/ -o nolock | Mount the specific NFS share.umount ./target-NFS |
umount ./target-NFS | Unmount the specific NFS share. |
DNS
| Command | Description |
|---|---|
dig ns <domain.tld> @<nameserver> | NS request to the specific nameserver. |
dig any <domain.tld> @<nameserver> | ANY request to the specific nameserver. |
dig axfr <domain.tld> @<nameserver> | AXFR request to the specific nameserver. |
dnsenum --dnsserver <nameserver> --enum -p 0 -s 0 -o found_subdomains.txt -f ~/subdomains.list <domain.tld> | Subdomain brute forcing. |
SMTP
| Command | Description |
|---|---|
telnet <FQDN/IP> 25 |
IMAP/POP3
| Command | Description |
|---|---|
curl -k 'imaps://<FQDN/IP>' --user <user>:<password> | Log in to the IMAPS service using cURL. |
openssl s_client -connect <FQDN/IP>:imaps | Connect to the IMAPS service. |
openssl s_client -connect <FQDN/IP>:pop3s | Connect to the POP3s service. |
SNMP
| Command | Description |
|---|---|
snmpwalk -v2c -c <community string> <FQDN/IP> | Querying OIDs using snmpwalk. |
onesixtyone -c community-strings.list <FQDN/IP> | Bruteforcing community strings of the SNMP service. |
braa <community string>@<FQDN/IP>:.1.* | Bruteforcing SNMP service OIDs. |
MySQL
| Command | Description |
|---|---|
mysql -u <user> -p<password> -h <FQDN/IP> | Login to the MySQL server. |
MSSQL
| Command | Description |
|---|---|
mssqlclient.py <user>@<FQDN/IP> -windows-auth | Log in to the MSSQL server using Windows authentication. |
IPMI
| Command | Description |
|---|---|
msf6 auxiliary(scanner/ipmi/ipmi_version) | IPMI version detection. |
msf6 auxiliary(scanner/ipmi/ipmi_dumphashes) | Dump IPMI hashes. |
Linux Remote Management
| Command | Description |
|---|---|
ssh-audit.py <FQDN/IP> | Remote security audit against the target SSH service. |
ssh <user>@<FQDN/IP> | Log in to the SSH server using the SSH client. |
ssh -i private.key <user>@<FQDN/IP> | Log in to the SSH server using private key. |
ssh <user>@<FQDN/IP> -o PreferredAuthentications=password | Enforce password-based authentication. |
Windows Remote Management
| Command | Description |
|---|---|
rdp-sec-check.pl <FQDN/IP> | Check the security settings of the RDP service. |
xfreerdp /u:<user> /p:"<password>" /v:<FQDN/IP> | Log in to the RDP server from Linux. |
evil-winrm -i <FQDN/IP> -u <user> -p <password> | Log in to the WinRM server. |
wmiexec.py <user>:"<password>"@<FQDN/IP> "<system command>" | Execute command using the WMI service. |
Oracle TNS
| Command | Description |
|---|---|
./odat.py all -s <FQDN/IP> | Perform a variety of scans to gather information about the Oracle database services and its components. |
sqlplus <user>/<pass>@<FQDN/IP>/<db> | Log in to the Oracle database. |
./odat.py utlfile -s <FQDN/IP> -d <db> -U <user> -P <pass> --sysdba --putFile C:\\insert\\path file.txt ./file.txt | Upload a file with Oracle RDBMS. |