Penetration Testing_ From Reconnaissance to Reporting başlıklı kaynağın profesyonel teknik özetidir. Aşağıda belgenin ana başlık ve içerik yapısı Türkçe açıklamalarla sunulmuştur.
1 Penetration Testing Methodology --------------------------------------------------------------------------------- Prepared By / Mohamed Nabil Diab https://www.linkedin.com/in/mohamed-nabil-diab/ --------------------------------------------------------------------------------- Content 1. Information Gathering • OSINT & Public resources • Host Discovery • Port Scanning • Services & OS Detection 2. Enumeration • Service Enumeration 3. Vulnerability Assessment • Detect Vulnerable Services • Search for Relative Exploits 4. Exploitation • Starting MSF • Windows Exploitation • Linux Exploitation • ...
Network Exploitation 5. Post Exploitation • Pre Post Exploitation • Windows Post Exploitation • Linux Post Exploitation 6. Web Application Pen testing 2 Passive Information Gathering Description Syntax Type Tool بتعملname resolution $ host in/Ip> command website command dnsrecon dnsdumpster dnsenum بتتشك لو فيه firewall $ wafw00f ution. • -Pn ➔ scan without ping. b) Scanning Types • -sS ➔ TCP SYN scan. • -sT ➔ TCP connect scan. • -sA ➔ TCP ACK scan. • -sU ➔ UDP port scan. c) Port Specification • -p ➔ specify a port number or range. • -p- ➔ scan for all 65535 ports • -F ➔ fast scan for most common ports d) Service & OS Detection • -sV ➔ detect the versions of the running services. • -sC ➔ run some scripts. • -O ➔ detect the running OS. • -A ➔detect OS and versions, perform script scanning. e) Output Formats • -oN ➔ normal output format. • -oX ➔ xml output format. • -oG ➔ greppable output format. • -oA ➔ all output forma... t. f) Detection Evasion • -f ➔ scan fragment packets. • -D ➔ use multiple Ips with my Ip to scan. • -sI ➔ use zombie Ip to scan. • -source-port ➔ specify a source port. • -T0,1,2,3,4,5 ➔ manipulate scan timing (the slowest=0). g) Nmap Scripts 4 • ls /usr/share/nmap/scripts (directory of nmap scripts) Vuln, smb-protocols, smb-security-mode, smb-enum-groups, smb- enum-sessions, smb-enum-domains, smb-enum-users, smb-enum- shares, smb-os-discovery /// http-enum, http-title /// banner. • nmap -A nto MSF • nmap -oX result.xml t وكمان الservices والOS. وهنا بتنتهي مرحلة الInformation gathering وتبدأ مرحلة ال Enumeration . ------------------------------------------------------------------------------------ ندخل بقا علىphase 2 وهي الEnumeration. 7 Enumeration Utilities MSF modules Port --script ftp-anon ftp target 21 auxiliary/scanner/ftp/ftp_version auxiliary/scanner/ftp/ftp-login use auxiliary/scanner/ftp/anonymous 21 nmap -sU --top-ports 25 nmblookup -A in shre) rpcclient -U "" -N uxiliary/scanner/http/http_put auxiliary/scanner/http/files_dir auxiliary/scanner/http/http_login auxiliary/scanner/http/http_header auxiliary/scanner/http/http_version auxiliary/scanner/http/robots_txt 80 8 mysql -u username -p -h target show databases; use DBname; show tables; select * from tablename update tablename set passfield = MD5 (‘newpasswprd’) where userfield = ‘username’ auxiliary/scanner/mysql/mysql_version auxiliary/scanner/mysql/mysql_login auxiliary/admin/mysql/mysql_enum auxiliary/admin/mysql/mysql_sql auxiliary/scanner/mysql/mysql_file_enum auxiliary/scanner/mysql/mysql_hashd... ump auxiliary/scanner/mysql/mysql_schemadump auxiliary/scanner/mysql/mysql_writable_dirs 3306 auxiliary/scanner/ssh/ssh_version auxiliary/scanner/ssh/ssh_login 22 --script banner nc target 25 > VRFY admin@openmailbox.xyz (check user admin existence) smtp-user-enum -U file -t target (check users on the server) sendemail -f sender -t recpient -s Ip -u Fakemail -m "Hi root, a fake from admin" -o tls=no (send email) auxiliary/scanner/smtp/smtp_enum 25 25 ------------------------------------------------------------------------------------ ------------------------------------------------------------... ------------------------ بعد ما بنخلصEnumeration ونجمع كل التفاصيل بنبدأ مرحلة جديدة وهي ال Vulnerability Assessment وهنا ببدأ اعملcheck على الservices اللي شغالة اذا كانت حاجة منهم vulnerable او لهاexploit. بعملscanning على كل الports والservices واسيرش عليهم كلهم بحثا عن أي طريقة اعمل بها exploitation وأتأكد من الversions اذا كانت vulnerable وpatched ومش هتنفع معايا 9 Most Common Vulnerabilitites WebDA V (when we find a WebDA V extension in the web server) ▪ davtest -auth bob:password_123321 -url http://demo.ine.local/webdav ---------------------------------------------------------------... --------------------- Shellshock (when we find cgi script running on the website) ▪ nmap --script http-shellshock --script-args "http- shellshock.uri=/gettime.cgi" Belge toplam 15 paragraf içermektedir; tam metin /root/pdf klasöründeki kaynak dosyasında mevcuttur.