Network Penetration Testing
Pentest Methodology
2
Open Source Intelligence Gathering (OSINT)
3
General Enumeration
dig +noall +answer [Link] NS
●
dig +noall +answer [Link] A
●
dig +noall +answer [Link] MX
●
dig +noall +answer [Link] ANY
●
dig +noall +answer [Link] ANY
●
dig +noall +answer @[Link] [Link] ANY
●
dig +noall +answer +norecurse [Link] A
●
dig +noall +answer [Link] A
●
dnsrecon -d [Link]
●
dnsrecon -d [Link] -n “[Link] | [Link]”
●
4
Recursive vs No-Recursive
5
Zone Transfer
●
dig +noall +answer [Link] NS
●
dig +noall +answer @[Link] [Link] AXFR
●
dig +noall +answer @[Link] [Link] AXFR
●
dig +noall +answer @[Link] [Link] AXFR
●
dig +noall +answer @[Link] [Link] AXFR
●
dig +noall +answer [Link] NS
●
dig +noall +answer @[Link] [Link] AXFR
●
dig +noall +answer @[Link] [Link] AXFR
●
dnsrecon -d [Link] -t axfr
●
dnsrecon -d [Link] -t axfr
6
Find Sub-Domains
Google Dorks
●
–site:[Link] -[Link]
TheHarvester
●
–theHarvester -d [Link] -b
bing,yahoo,netcraft,virustotal
FindSubDomains
●
–[Link]
7
Find Sub-Domains
Recon-NG Modules
●
–recon/domains-hosts/bing_domain_web
–recon/domains-hosts/findsubdomains
–recon/domains-hosts/google_site_web
–recon/domains-hosts/netcraft
–recon/domains-hosts/bing_domain_api
Get Bing API Key
●
–[Link]
–keys add bing_api 2544912284b14896950812a95d030a26
–Show keys
8
Recon-NG
Recon-NG Commands
●
–show modules
–use recon/domains-hosts/findsubdomains
–show info
–set source [Link]
–run
–show hosts
–back
9
Reverse Lookup
●
Get Network Ranges
–[Link]
–[Link]
●
dnsrecon -r [Link]-[Link]
●
dnsrecon -r [Link]/16
●
dig +noall +answer -x [Link] #Microsoft IP
●
dig +noall +answer -x [Link] #Google IP
●
dig +noall +answer -x [Link] #Microsoft IP
●
curl [Link]/[Link]
●
curl [Link]/[Link]
10
Brute Force
DNSRecon
●
–dnsrecon -t brt -d [Link] -D
/usr/share/dnsrecon/[Link]
Recon-NG
●
–recon/domains-hosts/brute_hosts
Resolve and Extract Sub-Domains
●
–recon/hosts-hosts/resolve
–reporting/list
11
Find Emails and Users
Find Emails
●
–theharvester -d [Link] -b hunter > [Link]
Get Hunter API Key
●
–[Link]
–nano /usr/share/theharvester/discovery/[Link]
Find Users
●
–theharvester -d [Link] -b linkedin
–theharvester -d [Link] -b twitter
Google Dorks
●
–inurl:"[Link]/in/" "[Link]"
12
Metadata Analysis
●
Metagoofil
–apt-get install metagoofil
–metagoofil -d [Link] -t pdf,doc,xls,ppt -l 100 -n 10 -o
metapdf -f [Link]
●
Exiftool
–apt-get install exiftool
–exiftool [Link]
●
Google Dorks (Collect Files)
–site:[Link] filetype:pdf
●
Recon-NG (Find Antivirus Programs)
–discovery/info_disclosure/cache_snoop
13
Hacked Emails
14
Google Dorks
●
Find Sub-Domains
–site:[Link] -[Link]
●
Collect Files
–site:[Link] filetype:pdf
●
Search For Specific Word
–site:[Link] "hackers"
●
Search For Specific Files
–site:[Link] intitle:"index of"
–site:[Link] inurl:phpinfo
–site:[Link] intext:password
●
Search For Company Users
–inurl:"[Link]/in/" "[Link]"
●
Google Hacking Database
–[Link]
15
Shodan
●
Search -> webcams
●
Search -> webcams product:"webcamXP httpd"
–[Link]
–[Link]
–[Link]
–[Link]
–[Link]
–[Link]
–[Link]
●
Search -> port:3389
–[Link]
–[Link]
●
Search -> os:"windows xp"
●
Search -> os:"windows xp" port:3389
●
Search -> os:"windows xp" port:3389 country:eg
●
In Our Case
–Search -> org:microsoft
–Search -> org:microsoft port:3389
–Search -> org:microsoft webcams
16
–Search -> org:microsoft port:22