Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- nmap
  - Scan Types
  - Port States
  - Usage
    - combo with searchsploit
    - Wordpress Enumeration
    - Use List of Hosts
    - ARP Scan Local Network
    - ICMP Scans
    - TCP Scans
      - TCP Scan Types
    - UDP SCans
    - DNS Scan
    - Spoofing
    - Service Detection
  - Scripts
  - Tips & Tricks

# nmap

## Scan Types

- ARP
- ICMP
- TCP
- UDP

## Port States

1. Open
2. Closed
3. Filtered
4. Unfiltered
5. Open|Filtered
6. Close|Filtered

## Usage

    nmap -oA nmap-full -Pn -sS  -T4  -p- --defeat-rst-ratelimit <IP>

    nmap  -oA  nmap-vuln -Pn  -script vuln  -p <Port,Port,Port,...> <IP>

### combo with searchsploit

- nmap-full scan

    sudo nmap -oA --nmap-full -sS -sC -sV -p- --defeat-rst-ratelimit <target-IP>
    searchsploit --nmap ./nmap-full.xml --verbose

### Wordpress Enumeration

    nmap --script http-wordpress-enum --scripts-args check-latest=true,search-limit=1500 -p 80 test.com

### Use List of Hosts

    nmap -iL <ListofHosts>

- Show hosts, dns resolution included

    nmap -sL -n 10.10.0.0/16

### ARP Scan Local Network

    nmap -PR -sn 192.168.0.0/24

### ICMP Scans

- Type 8 (Ping Request)

    nmap -PE -sn 10.10.0.0/16

- Type 13 (Timestamp Request)

    nmap -PP -sn 10.10.0.0/16

- Type 17 (Address Mask Queries)

    nmap -PM -sn 10.10.0.0/16

### TCP Scans

- `-PS23` Syn on port 23
- `-PA80-8080` ACK on port range 80-8080

#### TCP Scan Types

- Null Scan `-sN`, port is open when there is no response. Otherwise the response is `RST/ACK`
- FIN Scan `-sF` , same procedure as null scan.
- Xmas Scan `-sX`, `FIN/PSH/URG` is sent. `RST/ACK` when port is closed.
- Maimon Scan `-sM`, sends `FIN/ACK`. Packet is dropped when port is open. Only viable on old BSD networks.
- ACK Scan `-sA`, sends `ACK`. Receives `RST` regardless of the state of the port. May be used to explore firewall rules.
- Window Scan `-sW`, sends `ACK`, and receives `RST` as well. Inspects the window part of the response. Used to expose firewall rules.
- Custom Scan `--scanflags RSTACKFIN`, set flags randomly.

### UDP SCans

- `-PU`
- May be answered by ICMP Type 3 if the port is not reachable

### DNS Scan

- No lookup `-n`
- Reverse lookup for every host `-R`
- Host discovery only `-sn`

### Spoofing

- IP `-S <spoofed-IP>`
- MAC `--spoof-mac <spoofed-MAC>`
- Disable ping scan `-Pn`
- Decoy addresses `-D <decoy-IP>,<decoy-IP>,<decoy-IP>,RND,RND,ME`

### Service Detection

- `-sV`
- `--version-intensity <level 0-9>`
- Intensity 2 `--version-light`
- Intensity 9 `--version-all`

## Scripts

Installed at `/usr/share/nmap/scripts` * auth Authentication related scripts * broadcast Discover hosts by sending broadcast messages * brute Performs brute-force password auditing against logins * default Default scripts, same as -sC * discovery Retrieve accessible information, such as database tables and DNS names * dos Detects servers vulnerable to Denial of Service (DoS) * exploit Attempts to exploit various vulnerable services * external Checks using a third-party service, such as Geoplugin and Virustotal * fuzzer Launch fuzzing attacks * intrusive Intrusive scripts such as brute-force attacks and exploitation * malware Scans for backdoors * safe Safe scripts that won’t crash the target * version Retrieve service versions * vuln Checks for vulnerabilities or exploit vulnerable services

## Tips & Tricks

- Scan the 100 most interesting ports via `-F`
- `--top-ports 100`
- One probe every 5 minutes via `-T0`
- A closed port responds with `RST/ACK` to a initial `SYN`
- Scan ports iteratively by using `-r`, not random
- Closed Port
- Control packet rate via `--min-rate` and `--max-rate`
- Control parallel probes via `--min-parallelism` and `--max-parallelism`
- Fragment packets `-f` 8 bytes, `-ff` 16 bytes or `--mtu`
- Zombie Scan `-sI <pwnd-device-IP>` via pwnd host inside the targets network
- `--reason`, `-d`, `-vv`
- `--traceroute`