Footprinting (Scan-Enum) Full
Phase 1: Protocol & Service Enumeration
Step 1: RDP Enumeration (Port 3389)
Enumerate Remote Desktop Protocol (RDP) services to identify encryption levels, vulnerabilities, and authentication details.
sudo nmap -p 3389 --script=rdp-enum-encryption,rdp-vuln-ms12-020,rdp-ntlm-info -Pn -n -iL live_hosts.txt -oA rdp_enumOutput: Encryption levels, MS12-020 vulnerability status, and NTLM details for RDP services.
Step 2: WinRM Enumeration (Ports 5985, 5986)
Enumerate Windows Remote Management (WinRM) services to identify Windows services and user accounts.
sudo nmap -p 5985,5986 --script=http-windows-enum,winrm-enum-users -Pn -n -iL live_hosts.txt -oA winrm_enumOutput: List of Windows services and WinRM user accounts.
Step 3: FTP Enumeration (Port 21)
Enumerate FTP services to identify versions, anonymous access, vulnerabilities, and configuration details.
3.1: Nmap Enumeration
sudo nmap -sV -p 21 -sC -A --script=ftp-anon,ftp-bounce,ftp-syst,ftp-vsftpd-backdoor,ftp-proftpd-backdoor,ftp-libopie -Pn -n -iL live_hosts.txt -oA ftp_enum3.2: Manual FTP Interaction
Manually connect to FTP to verify findings or interact with the service.
Alternative (Telnet):
Alternative (STARTTLS):
Test if FTP supports STARTTLS for encrypted connections.
FTP Commands:
Output: Service version, configuration details, anonymous access status, and vulnerability information.
Step 4: SSH Enumeration (Port 22)
Enumerate SSH services to identify host keys, authentication methods, and supported algorithms.
Output: SSH version, host keys, authentication methods, and algorithm details.
Step 5: Telnet Enumeration (Port 23)
Enumerate Telnet services to check for encryption and NTLM information.
Manual Interaction:
Output: Telnet version, encryption status, and NTLM details.
Step 6: SMTP Enumeration (Ports 25, 465, 587)
It is used for sending e-mail. POP3 or IMAP are used for receiving e-mail. Default ports are 25 (SMTP), 465 (SMTPS), 587 (SMTPS).
Enumeration
Enumerate SMTP services to identify commands, users, and open relay configurations.
MX Domains
Users
STARTTLS
Connect
Commands
Commands are not case sensitive.
HELO - Identify SMTP Server
Observe the server’s response for supported commands or banner details.
EHLO - List all supported enhanced functions
8BITMIME - allow to send 8-bit data
AUTH - authentication for the SMTP connection
CHUNKING - transfer chunks of data
DSN (Delivery Status Notifications) - notify delivery status
ENHANCEDSTATUSCODES - allow to show more details of the status
ETRN - process remote queue
EXPN - expand mailing list
HELP - help about commands
PIPELINING - allow the multiple commands
SIZE - maximum message size that can be received
SMTPUTF8 -
STARTTLS - communicate with TLS
SEND - send message to terminal
TURN - swap client and server
VRFY - check if the user exists in the SMTP server
Auth Login
The AUTH LOGIN command allows us to login. We need to input username/password in Base64.
Here is the example:
Messages
Others
Send Mails from External
Start SMTP Server
Overall Output: SMTP version, supported commands, user enumeration results, open relay status, and NTLM details.
Step 7: POP3 Enumeration (Ports 110, 995)
Enumerate POP3 services to identify server capabilities and attempt user enumeration.
Connect
Manual Interaction:
Replace target-ip with the target’s IP.
Send commands like CAPA to retrieve capabilities or USER username to test access. Output: POP3 version, server capabilities, and brute-force results (if applicable).
Commands
Step 8: IMAP Enumeration (Ports 143, 993)
Enumerate IMAP services to identify capabilities and attempt user enumeration.
Output: IMAP version, server capabilities, and brute-force results (if applicable).
Banner Grabbing
Connect
Commands
Step 9: DNS Enumeration (Port 53)
Enumerate DNS services to test for zone transfers, recursion, and service discovery.
Manual DNS Interaction:
Replace target-ip with the target’s IP and domain with the target domain (e.g., example.com).
Attempt a zone transfer to retrieve DNS records.
Output: DNS version, zone transfer results, recursion status, and service discovery details.
Step 10: Post-Enumeration Analysis
Parse Outputs: Review .gnmap, .xml, or .nmap files for service details and vulnerabilities.
Use grep "open" rdp_enum.gnmap (or similar) to list open ports and services.
Import .xml files into tools like Metasploit or custom scripts for further analysis.
Correlate Findings: Match service versions and configurations to known vulnerabilities (e.g., via CVE or Exploit-DB).
Validate Manually: Use nc, telnet, or dig to confirm Nmap findings (e.g., banners, responses).
Prioritize Results: Focus on critical findings, such as:
RDP: MS12-020 vulnerabilities or weak encryption.
FTP: Anonymous access or backdoors (e.g., vsftpd).
SMTP: Open relays or enumerated users.
DNS: Successful zone transfers or open recursion.
Example Workflow Execution
Phase 2
1. Kerberos Enumeration (Port 88)
Phase 1: Footprinting and Service Discovery
Objective: Identify Kerberos services, realms, and basic configurations on the target.
Tools: Nmap, kerbrute, Impacket
Steps: Scan for Kerberos Services:
Use Nmap to detect open Kerberos port (88) and gather service information.
Gather Kerberos Server Information:
Run Nmap script to collect details about the Kerberos server.
Phase 2: Enumerating Users and Realms
Objective: Identify valid Kerberos users and verify domain/realm information.
Tools: Nmap, kerbrute, Impacket
Steps: Enumerate Valid Kerberos Users:
Use Nmap to enumerate users in a specified Kerberos realm.
User Enumeration with Kerbrute:
Use kerbrute to enumerate valid users against a domain controller using a user list.
Check for ASREPRoastable Users:
Use Impacket’s GetNPUsers to identify accounts that don’t require pre-authentication (vulnerable to ASREPRoast).
Phase 3: Exploitation and Next Steps
Objective: Leverage findings (e.g., valid users, ASREPRoast vulnerabilities) for further attacks.
Steps: Exploit ASREPRoast:
If ASREPRoastable users are found, extract their TGT hashes and attempt offline cracking with tools like Hashcat.
Brute-Force or Password Spray:
Use enumerated usernames with kerbrute or other tools to perform password spraying (e.g., common passwords like Password123). Pivot to Other Services:
Use discovered credentials to authenticate to other services (e.g., SMB, LDAP) on the domain. Document Findings:
Record enumerated users, realms, and vulnerabilities for the pentest report.
Notes:
Realm Specification: Ensure the correct domain (e.g., DOMAIN.LOCAL) is used in scripts like krb5-enum-users or kerbrute.
User Lists: Prepare a users.txt file with potential usernames (e.g., from OSINT or common names) for enumeration.
Scope: Avoid aggressive brute-forcing to prevent account lockouts unless explicitly permitted.
2. NetBIOS Enumeration (Ports 137, 139)
Phase 1: Footprinting and Service Discovery
Objective: Identify NetBIOS services, names, and associated SMB details.
Tools: Nmap, nmblookup, nbtscan, smbclient
Steps: Scan for NetBIOS Services:
Use Nmap to detect open NetBIOS ports (137, 139) and gather service, OS, and share information.
Query NetBIOS Names:
Use nmblookup to retrieve NetBIOS name table information.
Scan NetBIOS Information:
Use nbtscan to enumerate NetBIOS names, workgroups, and MAC addresses.
Phase 2: Enumerating Shares and Access
Objective: Identify accessible shares and attempt null session connections.
Tools: smbclient
Steps: List Available Shares (Null Session):
Use smbclient with legacy protocol support to list shares without credentials.
Phase 3: Exploitation and Next Steps
Objective: Leverage findings (e.g., accessible shares, enumerated users) for further access.
Steps: Access Shares:
If shares are accessible, connect using smbclient to inspect contents (as described in the SMB flow).
Exploit Misconfigurations:
If null sessions reveal sensitive shares or user data, attempt to extract or manipulate files. Pivot to SMB:
Use NetBIOS findings (e.g., domain names, users) to inform SMB enumeration on port 445. Document Findings:
Record NetBIOS names, workgroups, shares, and users for the pentest report.
Notes:
Legacy Protocols: The --option='client min protocol=LANMAN1' flag ensures compatibility with older systems; adjust if modern protocols are required.
Null Sessions: Test for null session access cautiously, as it may indicate a misconfiguration.
Cross-Service: NetBIOS often complements SMB enumeration; combine findings for a comprehensive attack.
3. RPC Enumeration (Port 135)
Phase 1: Footprinting and Service Discovery
Objective: Identify RPC services and available endpoints on the target.
Tools: Nmap, rpcinfo, rpcclient
Steps: Scan for RPC Services:
Use Nmap to detect open RPC port (135) and enumerate available services.
Query RPC Services:
Use rpcinfo to list available RPC services and their program numbers.
Phase 2: Enumerating RPC Details
Objective: Gather detailed information about users, groups, or shares via RPC.
Tools: rpcclient
Steps: Connect to RPC (Null Session):
Attempt to connect without credentials to enumerate information.
Enumerate RPC Details:
Within rpcclient, run commands like:
Phase 3: Exploitation and Next Steps
Objective: Leverage enumerated data for further attacks or privilege escalation.
Steps: Exploit RPC Vulnerabilities:
If specific RPC services (e.g., MS-RPC endpoints) are identified, check for vulnerabilities like MS17-010 (EternalBlue) using Metasploit. User Enumeration:
Use enumerated users for password spraying or brute-forcing on other services (e.g., SMB, Kerberos). Document Findings:
Record RPC services, endpoints, and enumerated data for the pentest report.
Notes:
Null Sessions: RPC often allows null session enumeration; test cautiously to avoid detection.
Complex Enumeration: Combine RPC findings with SMB or Kerberos for a fuller picture of the domain.
Scope: Ensure permission to interact with RPC services, as some actions may disrupt the target.
4. RPCBind Enumeration (Port 111)
Phase 1: Footprinting and Service Discovery
Objective: Identify RPCBind services and enumerate available RPC programs.
Tools: Nmap
Steps: Scan for RPCBind Services:
Use Nmap to detect open RPCBind port (111) over TCP and UDP, and enumerate services.
Phase 2: Enumerating RPC Programs
Objective: Identify specific RPC services exposed via RPCBind (e.g., NFS, mountd).
Tools: rpcinfo
Steps: List RPC Programs:
Use rpcinfo to query RPCBind for registered programs and their ports.
Phase 3: Exploitation and Next Steps
Objective: Leverage enumerated RPC services for further enumeration or exploitation.
Steps: Pivot to Identified Services:
If RPCBind reveals services like NFS (port 2049), proceed with NFS enumeration (as described in the NFS flow). Check for Vulnerabilities:
Research CVEs for identified RPC services or versions (e.g., outdated NFS or mountd). Document Findings:
Record RPC programs, their ports, and associated services for the pentest report.
Notes:
TCP and UDP: RPCBind operates on both TCP and UDP; ensure Nmap scans both with -sU -sT.
Service Pivoting: RPCBind often points to other services (e.g., NFS); follow up on these for deeper enumeration.
Caution: Avoid disrupting RPCBind services, as they may support critical network functions.
5. LDAP Enumeration (Ports 389, 636, 3268, 3269)
Phase 1: Footprinting and Service Discovery
Objective: Identify LDAP services and gather basic configuration details.
Tools: Nmap
Steps: Scan for LDAP Services:
Use Nmap to detect open LDAP ports (389, 636, 3268, 3269) and gather service/version information.
Run LDAP-Specific Scripts:
Execute all LDAP-related Nmap scripts to enumerate directory information.
Phase 2: Enumerating LDAP Directory
Objective: Extract information about users, groups, and domain structure from LDAP.
Tools: Nmap
Steps: Enumerate Without Brute-Forcing:
Run LDAP scripts, excluding brute-force attempts, to gather directory details.
Query LDAP Directory and Root DSE:
Use Nmap scripts to query the LDAP directory and root DSE for domain information (secure port 636).
Phase 3: Exploitation and Next Steps
Objective: Leverage LDAP findings (e.g., user lists, misconfigurations) for further attacks.
Steps: Enumerate Users and Groups:
If LDAP allows anonymous binds, extract user lists, group memberships, or domain policies. Exploit Misconfigurations:
Check for weak LDAP permissions (e.g., anonymous access) or outdated software vulnerabilities.
Use tools like ldapsearch for manual queries if credentials are obtained.
Pivot to Kerberos or SMB:
Use enumerated users or credentials for Kerberos (ASREPRoast, Kerberoasting) or SMB attacks. Document Findings:
Record LDAP directory details, users, groups, and misconfigurations for the pentest report.
Phase 3
1. Oracle Enumeration (Port 1521)
Phase 1: Footprinting and Service Discovery
Objective: Identify Oracle database services, versions, and Service Identifiers (SIDs).
Tools: Nmap, tnscmd10g, odat
Steps: Scan for Oracle Services:
Use Nmap to detect open Oracle port (1521) and gather service/version information.
Enumerate Oracle Version and SIDs:
Run Nmap scripts to identify Oracle TNS version and brute-force SIDs.
Probe Oracle TNS Listener:
Use tnscmd10g to query the TNS listener for version information.
Phase 2: Enumerating SIDs and Configurations
Objective: Gather detailed information about Oracle SIDs and database configurations.
Tools: odat
Steps: Ping Oracle Service:
Use odat to verify the Oracle TNS listener is reachable.
Enumerate SIDs:
Use odat’s sidguesser module to brute-force valid Oracle SIDs.
Comprehensive Enumeration:
Run odat’s all module to perform extensive enumeration of Oracle configurations.
Phase 3: Exploitation and Next Steps
Objective: Leverage findings (e.g., valid SIDs, weak configurations) for further access.
Steps: Test Default Credentials:
Use odat or sqlplus to test default credentials (e.g., sys:change_on_install, scott:tiger) against discovered SIDs.
Exploit Vulnerabilities:
If an outdated Oracle version is identified, research CVEs (e.g., TNS listener vulnerabilities) and use tools like Metasploit or odat for exploitation.
Extract Data:
If access is gained, query sensitive data (e.g., user tables, credentials) using SQL queries. Document Findings:
Record Oracle version, SIDs, and vulnerabilities for the pentest report.
Notes:
Default Credentials: Common Oracle credentials include sys:change_on_install, scott:tiger, or system:manager. Test cautiously to avoid lockouts.
TNS Listener: Misconfigured TNS listeners may allow unauthenticated access or information leakage.
Scope: Ensure permission to test Oracle databases, as aggressive actions may disrupt services.
2. MySQL Enumeration (Port 3306)
Phase 1: Footprinting and Service Discovery
Objective: Identify MySQL services, versions, and basic configurations.
Tools: Nmap, mysql client
Steps: Scan for MySQL Services:
Use Nmap to detect open MySQL port (3306) and gather service/version information.
Enumerate MySQL Details:
Run Nmap scripts to gather information about MySQL users, databases, and credentials.
Phase 2: Accessing and Enumerating MySQL
Objective: Attempt to connect to the MySQL server and enumerate databases or users.
Tools: mysql client, Hydra
Steps: Test Default/Empty Credentials:
Attempt to connect as the root user with no password or default credentials.
Brute-Force Credentials:
Use Hydra to brute-force MySQL credentials with user and password lists.
Phase 3: Exploitation and Next Steps
Objective: Leverage access or findings (e.g., credentials, misconfigurations) for further attacks.
Steps: Access Databases:
If credentials are obtained, connect to MySQL and enumerate databases, tables, or sensitive data.
Exploit Vulnerabilities:
If an outdated MySQL version is identified, research CVEs (e.g., CVE-2012-2122) and use Metasploit or custom exploits. Extract Hashes:
If mysql-dump-hashes reveals password hashes, attempt offline cracking with tools like Hashcat. Document Findings: - Record MySQL version, databases, users, and vulnerabilities for the pentest report.
Notes:
Empty Passwords: The mysql-empty-password script checks for unauthenticated access; this is a common misconfiguration.
Brute-Forcing: Use Hydra cautiously to avoid account lockouts or detection.
Scope: Ensure permission to test MySQL, as brute-forcing or querying may disrupt services.
3. MSSQL Enumeration (Ports 1433, 1434, 2433)
Phase 1: Footprinting and Service Discovery
Objective: Identify MSSQL services, versions, and configurations.
Tools: Nmap
Steps: Scan for MSSQL Services:
Use Nmap to detect open MSSQL ports (1433, 1434, 2433) and gather service/version information.
Enumerate MSSQL Details:
Run Nmap scripts to gather server info, configurations, and credentials.
Phase 2: Accessing and Enumerating MSSQL
Objective: Attempt to connect to the MSSQL server and enumerate databases or users.
Tools: mssqlclient.py (Impacket), sqsh
Steps: Test Default/Empty Credentials:
Attempt to connect with default credentials (e.g., sa:sa) or empty passwords using Impacket.
Enumerate Databases and Users:
If access is gained, query databases, users, or configurations.
Phase 3: Exploitation and Next Steps
Objective: Leverage access or findings (e.g., credentials, misconfigurations) for further attacks.
Steps: Exploit Weak Credentials:
If credentials are obtained, use them to execute commands (e.g., via xp_cmdshell) for system access.
Extract Hashes:
If ms-sql-dump-hashes reveals password hashes, attempt offline cracking with Hashcat. Exploit Vulnerabilities:
If an outdated MSSQL version is identified, research CVEs and use Metasploit (e.g., exploit/windows/mssql/mssql_payload). Document Findings:
Record MSSQL version, databases, users, and vulnerabilities for the pentest report.
Notes:
Default Accounts: The sa account is a common target; test default or weak passwords cautiously.
Command Execution: MSSQL’s xp_cmdshell is a powerful feature if enabled; use it for privilege escalation.
Scope: Ensure permission to test MSSQL, as brute-forcing or command execution may disrupt services.
4. PostgreSQL Enumeration (Ports 5432, 5433)
Phase 1: Footprinting and Service Discovery
Objective: Identify PostgreSQL services, versions, and configurations.
Tools: Nmap
Steps: Scan for PostgreSQL Services:
Use Nmap to detect open PostgreSQL ports (5432, 5433) and gather service/version information.
Enumerate PostgreSQL Details:
Run Nmap scripts to gather information about databases, users, and configurations.
Gather Info on Secure Port:
Query the secure PostgreSQL port (5433) for additional details.
Phase 2: Accessing and Enumerating PostgreSQL
Objective: Attempt to connect to the PostgreSQL server and enumerate databases or users.
Tools: psql
Steps: Test Default/Empty Credentials:
Attempt to connect as the postgres user with no password or default credentials.
Enumerate Databases and Users:
If access is gained, query databases and users.
Phase 3: Exploitation and Next Steps
Objective: Leverage access or findings (e.g., credentials, misconfigurations) for further attacks.
Steps: Exploit Weak Credentials:
If credentials are obtained, extract sensitive data or attempt privilege escalation within the database.
Exploit Vulnerabilities:
If an outdated PostgreSQL version is identified, research CVEs and use Metasploit or custom exploits. Brute-Force Credentials:
If pgsql-brute identifies weak credentials, use them to access restricted databases. Document Findings:
Record PostgreSQL version, databases, users, and vulnerabilities for the pentest report.
5. SMB Enumeration
Phase 1: Footprinting and Service Discovery
Objective: Identify SMB services, versions, and basic configuration on the target.
Steps: Scan for SMB Services Use Nmap to detect open SMB ports (139, 445) and gather service/version information.
Enumerate Shares, Users, OS, and Security Settings: Run Nmap scripts to gather details about shares, users, OS, and SMB security configurations.
Check for SMB Vulnerabilities:
Scan for known SMB vulnerabilities (e.g., EternalBlue) to identify potential exploits.
Phase 2: Enumerating Shares and Permissions
Objective: Identify available shares, their permissions, and potential access points (e.g., null sessions).
Tools: smbclient, smbmap, CrackMapExec, enum4linux-ng
Steps: List Available Shares (Null Session):
Use smbclient to list shares without credentials.
Use CrackMapExec to enumerate shares with null credentials.
Use smbmap to list shares without credentials.
Recursively List Files in Shares:
Use smbmap to explore share contents recursively.
Comprehensive Enumeration with Enum4linux-ng:
Perform detailed enumeration of shares, users, and configurations.
Phase 3: Connecting to Shares
Objective: Access shares to inspect contents, check permissions, and download/upload files.
Tools: smbclient, smbmap
Steps: Connect to Shares (Null Session):
Attempt to connect to a share without credentials.
Connect to a specific share (e.g., "notes") for inspection.
Check Share Permissions:
Within smbclient, view permissions and list contents.
Download Files from Shares:
Download files or directories from a share.
Alternatively, use smbmap to download specific files.
If specific files are found (e.g., flag.txt), download and inspect them.
Upload Files to Shares:
Upload a test file to a share to verify write access.
Mount Shares Locally:
Mount a share to a local directory for easier access.
Phase 4: User and Group Enumeration
Objective: Enumerate domain users, groups, and their details to identify potential targets for further attacks.
Tools: rpcclient, Impacket (samrdump.py)
Steps: Connect to RPC Service:
Access the target via rpcclient without credentials.
Enumerate General Information:
Gather server, domain, and share information.
Enumerate Users:
List all domain users and query specific user details.
Enumerate Groups:
Query group information for users.
Brute-Force User RIDs:
Iterate through possible user RIDs to enumerate users.
Use Impacket for User Enumeration:
Use samrdump.py to enumerate users and SIDs.
Additional Impacket tools for enumeration:
Phase 5: Credential-Based Enumeration
Objective: Use discovered or provided credentials to enumerate shares and permissions further.
Tools: smbmap, CrackMapExec
Steps: List Shares with Credentials:
Use smbmap with valid credentials to access restricted shares.
Enumerate Shares with CrackMapExec:
Use credentials to list shares and verify access.
Phase 6: Exploitation and Next Steps
Objective: Leverage findings (e.g., vulnerabilities, weak permissions, or credentials) for further exploitation.
Steps:
Analyse Vulnerabilities:
Review output from Nmap vulnerability scans (e.g., EternalBlue) and attempt exploitation using tools like Metasploit.
Exploit Weak Permissions:
If writeable shares are found, upload malicious files or scripts (e.g., for privilege escalation).
Use Enumerated Users/Credentials:
Attempt password spraying or brute-forcing with enumerated usernames using tools like CrackMapExec.
Document Findings:
Record accessible shares, users, permissions, and vulnerabilities for the pentest report.
6. Tomcat Enumeration (Ports 8080, 8443)
Phase 1: Footprinting and Service Discovery
Objective: Identify Tomcat services, versions, and basic configurations on the target.
Tools: Nmap
Steps: Scan for Tomcat Services:
Use Nmap to detect open Tomcat ports (8080, 8443) and gather service/version information.
Enumerate Tomcat Manager and Users:
Run Nmap scripts to identify Tomcat manager interfaces and user information.
Phase 2: Enumerating Tomcat Configurations
Objective: Gather details about Tomcat’s web applications, manager access, and potential vulnerabilities.
Tools: Nmap, Manual Inspection (e.g., browser, curl)
Steps: Check for Accessible Manager Interface:
Use a browser or curl to access common Tomcat paths (e.g., /manager/html, /host-manager/html).
Note: If authentication is required, attempt default credentials (e.g., admin:admin, tomcat:tomcat) or brute-force with tools like Hydra. Enumerate Web Applications:
Use Nmap or tools like dirb/gobuster to discover deployed web applications.
Check for Vulnerabilities:
Review Nmap script output for vulnerabilities in the Tomcat version or misconfigurations (e.g., exposed manager interface).
Optionally, use Metasploit modules (e.g., auxiliary/scanner/http/tomcat_mgr_login) to test for weak credentials.
Phase 3: Exploitation and Next Steps
Objective: Leverage findings (e.g., weak credentials, misconfigurations) for further access.
Steps: Exploit Manager Access:
If credentials are obtained, log into /manager/html to deploy a malicious WAR file for code execution.
Upload the WAR file via the manager interface. Check for Known Vulnerabilities:
If the Tomcat version is outdated, search for CVEs (e.g., CVE-2020-1938 Ghostcat) and exploit using Metasploit or custom scripts. Document Findings:
Record accessible interfaces, credentials, and vulnerabilities for the pentest report.
Notes:
Default Credentials: Common Tomcat credentials include admin:admin, tomcat:tomcat, or manager:manager. Test these carefully.
HTTPS (8443): If port 8443 is open, ensure tools use HTTPS (https://) and handle SSL/TLS appropriately.
Scope: Ensure permission to test the manager interface or deploy files to avoid legal issues.
7. NFS Enumeration (Ports 111, 2049)
Phase 1: Footprinting and Service Discovery
Objective: Identify NFS services, versions, and available shares.
Tools: Nmap, showmount
Steps: Scan for NFS Services:
Use Nmap to detect open NFS ports (111, 2049) and gather service/version information.
Enumerate NFS-Specific Information:
Run Nmap scripts to gather details about NFS shares, permissions, and configurations.
List Available NFS Shares:
Use showmount to display exported NFS shares.
Phase 2: Accessing and Enumerating NFS Shares
Objective: Mount and inspect NFS shares to identify accessible files and permissions.
Tools: mount, ls
Steps: Mount NFS Share:
Create a local directory and mount the NFS share.
Alternative mount options for specific NFS versions or shares:
List Share Contents:
Navigate to the mounted directory and list contents with usernames/groups or UIDs/GIDs.
Unmount Share:
After inspection, unmount the share to clean up.
Phase 3: Exploitation and Next Steps
Objective: Leverage findings (e.g., misconfigured permissions, sensitive files) for further access.
Steps:
Analyse Permissions:
Check for world-readable/writeable shares or files with sensitive data (e.g., SSH keys, configuration files).
Exploit Write Access:
If the share is writeable, upload malicious files (e.g., scripts, backdoors) or modify existing ones.
User Impersonation:
If UIDs/GIDs match local users, manipulate files to escalate privileges (e.g., create a SUID binary).
Document Findings:
Record accessible shares, files, and permissions for the pentest report.
Notes:
No Lock Option: The -nolock flag avoids file locking issues; adjust based on target behaviour.
NFS Versions: Specify NFS version (vers=3 or nfs4) if the default mount fails.
Security Risks: Misconfigured NFS shares often expose sensitive data or allow unauthorised access. Test cautiously.
8. TFTP Enumeration (Port 69 UDP)
Phase 1: Footprinting and Service Discovery
Objective: Identify TFTP services and enumerate available files or directories.
Tools: Nmap, tftp, atftp
Steps: Scan for TFTP Services:
Use Nmap to detect open TFTP port (69 UDP) and gather service information.
Connect to TFTP Server:
Use tftp or atftp to interact with the TFTP service.
Phase 2: Enumerating Files and Directories
Objective: Identify and retrieve files from the TFTP server.
Tools: tftp, atftp
Steps: List or Retrieve Files:
Within the TFTP client, attempt to retrieve common files (e.g., config, backup, .txt files).
Note: TFTP does not support directory listing, so rely on Nmap’s tftp-enum script or guess common filenames. Test Write Access:
Attempt to upload a test file to check for write permissions.
Phase 3: Exploitation and Next Steps
Objective: Leverage findings (e.g., sensitive files, write access) for further access.
Steps: Analyse Retrieved Files:
Inspect downloaded files for sensitive information (e.g., credentials, configuration details).
Exploit Write Access:
If the TFTP server allows uploads, overwrite critical files (e.g., configuration files) or upload malicious scripts. Check for Known Vulnerabilities:
If the TFTP service version is identified (via Nmap), research CVEs for potential exploits. Document Findings:
Record accessible files, write permissions, and vulnerabilities for the pentest report.
Phase 4: Vulnerability & Advanced Enumeration
1. OS Detection & Aggressive Scan
Phase 1: Footprinting and Comprehensive Scanning
Objective: Identify the operating system, services, versions, and potential vulnerabilities on the target.
Tools: Nmap
Steps: Perform Aggressive Scan:
Use Nmap’s -A flag to enable OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute with a faster timing template (-T4).
Note: The -oA flag saves output in all formats (normal, XML, grepable) for later analysis.
Phase 2: Analysing Results
Objective: Review scan results to identify the operating system, open ports, services, and potential vulnerabilities.
Steps: Parse OS and Service Information:
Review the Nmap output to identify the operating system (e.g., Windows, Linux) and its version, as well as running services (e.g., HTTP, SMB).
Example output analysis:
OS: Windows Server 2016
Ports: 80 (HTTP), 445 (SMB), 3389 (RDP)
Services: Apache 2.4, Microsoft SMBv1 Identify Potential Vulnerabilities:
Check default script (-sC) results for misconfigurations or vulnerabilities (e.g., SMB null sessions, HTTP methods).
Note any outdated service versions that may be vulnerable to known exploits.
Phase 3: Exploitation and Next Steps
Objective: Leverage findings (e.g., OS version, service vulnerabilities) for further attacks.
Steps: Exploit OS Vulnerabilities:
If an outdated OS is detected (e.g., Windows XP, Server 2003), search for CVEs (e.g., MS08-067) and use Metasploit modules.
Target Service Vulnerabilities:
Use identified services (e.g., HTTP, SMB) to pivot to targeted vulnerability scans (see below). Document Findings:
Record OS details, service versions, open ports, and vulnerabilities for the pentest report.
Notes:
Aggressive Scanning: The -A flag is noisy and may trigger IDS/IPS; use with permission and caution.
Timing Template: -T4 balances speed and reliability; adjust to -T3 for stealth or -T5 for faster scans if needed.
Scope: Ensure explicit permission to perform aggressive scans, as they may disrupt services.
2. Targeted Vulnerability Scripting (Web & SMB)
Phase 1: Footprinting and Service Enumeration (Web)
Objective: Identify web server details, configurations, and potential vulnerabilities on ports 80 (HTTP) and 443 (HTTPS).
Tools: Nmap, curl, WhatWeb, Nikto, dirb, gobuster, ffuf, wfuzz, sslscan, wpscan, wappalyzer
Steps: Basic Web Service Scan:
Use Nmap with default scripts to enumerate web services.
Banner Grabbing and Basic Enumeration:
Gather web server banners, titles, methods, and robots.txt details.
Web Vulnerability Scanning:
Run Nmap scripts to detect common web vulnerabilities (e.g., SQL injection, XSS).
Fast Fingerprinting with WhatWeb:
Identify web technologies and frameworks.
Curl for Manual Inspection:
Retrieve HTTP headers and robots.txt to identify server details or hidden paths.
Directory and File Enumeration:
Use dirb, gobuster, ffuf, and wfuzz to enumerate directories and files.
Nikto Vulnerability Scan:
Perform a comprehensive web vulnerability scan.
CMS and Technology Fingerprinting:
Use Wappalyzer and Wpscan to identify CMS and plugins (e.g., WordPress).
SSL/TLS Enumeration:
Analyse SSL/TLS configurations for weaknesses.
Phase 2: Footprinting and Service Enumeration (SMB)
Objective: Identify SMB services and vulnerabilities on ports 139 and 445 (if applicable from aggressive scan).
Tools: Nmap
Steps: SMB Enumeration:
If the aggressive scan (-A) identified SMB services, run targeted SMB vulnerability scripts.
SMB Configuration and User Enumeration:
Enumerate shares, users, and configurations (as detailed in the SMB flow from previous responses).
Phase 3: Analysing Results
Objective: Review web and SMB scan results to identify vulnerabilities and misconfigurations.
Steps: Web Findings:
Analyse Nmap, Nikto, and directory enumeration outputs for:
Vulnerable software versions (e.g., outdated Apache, PHP).
Misconfigurations (e.g., exposed robots.txt, unsafe HTTP methods).
Potential injection points (e.g., SQL injection, XSS).
Review CMS-specific findings (e.g., WordPress plugins via wpscan) for known vulnerabilities. SMB Findings:
Check for vulnerabilities like EternalBlue (MS17-010) or weak share permissions.
Identify enumerated users or shares for further exploitation.
Phase 4: Exploitation and Next Steps
Objective: Leverage identified vulnerabilities or misconfigurations for further attacks.
Steps: Exploit Web Vulnerabilities:
If vulnerabilities like SQL injection or XSS are found, use tools like sqlmap or manual payloads.
Exploit outdated CMS plugins using Metasploit or custom exploits. Exploit SMB Vulnerabilities:
If SMB vulnerabilities (e.g., EternalBlue) are identified, use Metasploit.
Brute-Force Credentials:
If web authentication pages are found, use Hydra or Burp Suite to brute-force credentials.
Exploit SSL/TLS Weaknesses:
If weak ciphers or protocols are found, attempt man-in-the-middle attacks or downgrade attacks. Document Findings:
Record vulnerabilities, misconfigurations, and enumerated data (e.g., directories, users) for the pentest report.
Phase 5: Stealth & Evasion
Techniques for scanning when trying to avoid detection by firewalls or IDS. 11. Stealthy SYN Scan Use Case: The default and most popular scan. It's stealthier than a full TCP connect (-sT) because it doesn't complete the TCP handshake.
Advanced Firewall & IDS Evasion Use Case: When stealth is the top priority. This combines multiple techniques (decoys, packet fragmentation) to make the scan extremely difficult to detect.
SNMP - Port 161 (UDP)
VNC (Port 5900)
Last updated