Reconnaissance and Network Mapping

Reconnaissance Tools | Methods

• Introduction - Topology - Features
  • Enumerate important Nmap features
  • Explore network topology
  • Identify key systems to be used
•  
• Nmap Installation
  • Identify target platforms
  • Import P/GPG signatures
  • Obtain sources and checksums
  • Confirm P/GPG signatures and checksums
  • Install Nmap on multiple platforms
•  
• Host Discovery
  • Discuss features and benefits
  • Evaluate various discovery methods
  • Survey topology
  • Identify targets
  • Compare & contrast findings
•  
• TCP | UDP Scans
  • Explore common scan techniques
  • Identify available services
  • Confirm Nmap findings
  • Tweak scans accordingly
  • Evaluate results
•  
• Operating System | Service Detection | Versioning
  • Discuss features and benefits
  • Identify available operating systems
  • Pinpoint interesting services
  • Define baseline scans
  • Evaluate results
•  
• ZenMap
  • Explore interface
  • Perform common scans
  • Compare & contrast findings
  • Evaluate on multiple platforms
•  
• Reporting | Compliance | ndiff
  • Highlight rationale
  • Generate usage reports
  • Detect toplogical changes
  • Compare results with 'ndiff'
  • Evaluate results
•  
• Nmap Scripting Engine (NSE)
  • Explore Nmap extensions
  • Discuss usage
  • Ascertain NSE-provided data from targets
  • Evaluate various NSE scripts
•  
• Timing | Performance
  • Explore timing | performance options
  • Tweak Nmap's responsiveness
  • Evaluate efficacy
•  
• Useful | Interactive Options
  • Evaluate miscellaneous Nmap options
  • Interact with Nmap scans accordingly
  • Evaluate results
•  
• NMap Version 6x
  • Obtain and Install from Sources
  • Upgrade on various systems
  • Identify key improvements
  • Perform scans and evaluate
  • Peruse ZenMap version 6x GUI
  • Contrast accordingly
  • Evaluate results
•  

• 'acccheck'
  • Discuss applicability
  • Find SMB Targets
  • Build sample profile files
  • Checks hosts for BLANK credentials
  • Change credentials for user
  • Confirm ability to connect
•  
• 'automater'
  • Discuss features
  • Query target domain for useful details
  • Query IP
  • Explore results
•  
• 'cisco-torch'
  • Discuss applicability
  • Scan network using all fingerprints
  • Search for specific protocols on devices
  • Log results
  • Search for useful SNMP details
•  
• 'dnsenum'
  • Discuss features
  • Enumerate target domain details
  • Brute-force scan target domain
  • Store located subdomains for reference
  • Expedite queries
•  
• 'dnsrecon'
  • Discuss features
  • Compare with 'dnsenum'
  • Find: SOA, NS, A, AAAA, TXT Records
  • Check if DNS server supports unauthorized AXFR
  • Query Google to enumerate unlisted subdomains
  • Perform Whois analysis to learn more about domain
  • Brute-force attack DNS server
  • Use different source list to attack DNS server
•  
• 'dnswalk'
  • Discuss features
  • Contrast with: 'dns(enum|recon)'
  • Query AXFR-disabled DNS server and Evaluate
  • Enable AXFR on internal DNS server and target
  • Fix errors disclosed by 'dnswalk' in DNS setup
  • Break DNS setup with bogus DNS server
  • Use: 'dnswalk' to query and discuss
•  
• 'hping3'
  • Discuss features
  • Contrast with 'ping', 'nmap', 'traceroute'
  • Basic TCP | ICMP usage
  • Generate various rates of packets and tweak
  • Quickly scan target ports
•  
• '0trace.sh'
  • Discuss applicability
  • Trace connection within broadcast domain
  • Connect to server multiple hops away
  • Generate packets and trace route to target
•  
• 'intrace'
  • Discuss features
  • Contrast with: '0trace.sh'
  • Generate local and remote connections
  • Trace routes between endpoints
  • Reverse trace route from server to endpoint
•  
• 'lbd'
  • Discuss features
  • Query various domains
  • Identify presence of load balancer
•  
• 'p0f'
  • Discuss features
  • Launch in promiscuous mode
  • Generate packets with 'hping3'
  • Analyze passively-detected system attributes
  • Vary input and examine new details
  • Apply BPF to target interesting node
  • Log output and daemonize
  • Explore captured data
•  
• 'masscan'
  • Discuss features
  • Generate ICMP and SSH scan
  • Scan network for hosts with target ports
  • Vary scan rate to expedite results-delivery
  • Grab banners from targets
  • Pause | Resume scans
  • Log output
•  
• 'sslyze'
  • Discuss features
  • Perform normal SSL scan of target
  • Review and discuss results
  • Scan targets for specific cipher suites
  • Contrast with 'nmap' scans
•  
• 'sslscan'
  • Discuss features
  • Compare with 'sslyze' and 'nmap'
  • Check targets for OCSP Stapling
  • Query RDP Windows host's SSL details
•  
• 'theharvester'
  • Discuss features
  • Find info from google about target domain
  • Search PGP database for listings
  • Check LinkedIn references to domain
  • Query various domains for outdated info
•  
• 'urlcrazy'
  • Discuss features
  • Discuss use-cases
  • Search for domain variants
  • Identify possible conflicts | squats
  • Search for market-confusing registrations
•  
• 'cewl'
  • Discuss features
  • Scrape target domain for interesting words
  • Reduce set to likely passwords
  • Extract e-mail addresses - if stored
  • Discuss benefits
•  
• 'recon-ng'
  • Discuss features
  • Explore common Global commands
  • Search for relevant modules
  • Brute-force domain suffix of target
  • PGP-search domain contacts
  • Search for Remote Access vectors @ target
•  
• NMap 7x
  • Discuss features
  • Perform Protocol Scans on Target
  • Traceroute to target
  • Display reason for port state
  • Execute in unprivileged mode
  • Trace packets between NMap and target
  • Generate various LOGs
  • Query Whois for public details
  • Check for HTTP vulnerabilities
  • Return useful SSL details
•  
• 'sparta' - Reconnaissance
  • Launch
  • Explore interface
  • Discuss features
  • Improve Session-Cookie security
  • Remove unwanted DocumentRoot entries
  • Explore other findings
•  
• 'netdiscover' - Reconnaissance
  • Disable L3 configuration
  • Passive reconnaissance
  • Targeted reconnaissance
  • Sniff ARP requests
  • Enable L3 configuration
•  

Sums

• Various Tools
• Remote Confirmations
• File Metadata
• File Fragments
• Compress Content
• Archive Content
• DIR Hierarchy
• Password Sums
• Shared Secret
• Restrict History
• Downloaded Content
• Encrypt Content
• Site Credentials
• Site COOKIE
• Site COOKIE - Unique

CentOS9x Stream Administration

• Initial Environment
• ls, pwd, cd, cp, mv, rm, mkdir, rmdir, whoami
• alias, cat, file, chmod, chown, history
• STD(IN|OUT), Pipes, Redirection, Command Chaining
• ps, df, top, free
• Pagers, W-Commands
• Checksums
• Awk | Sed | Grep Usage
• BASH SHELL Environment
• Compression | Archival Tools
• SSH Equivalence
• SHELL Quoting
• Propagate Environment
• Secure Clients

• Identify Standard File Types
• Standard File Permissions
• Symbolic Links
• Transfer Permissions

• Identify SWAP environment
• Provision dedicated SWAP partitions
• Add | Remove SWAP from pool as needed
• Provision File System-based SWAP
• SWAP Share
• SWAP Persistence
• Identify default storage configuration
• Provision new storage as needed
• XFS - File System
• XFS - Grow File System
• Identify LVM defaults
• Add new partitions to LVM management
• Allocate storage to LVM Volume Groups
• Create Logical Volumes (LVs) as needed
• Overlay File System and mount where applicables
• LVM - Resize
• LVM - Mixed FS
• LVM - SWAP

• Features
• Install
• Defaults
• General Usage
• Update Accounts

• Defaults
• Shared PASS Gen
• Unique PASS Gen
• Encrypted PASS Gen
• Update Accounts
• Groups

• Discuss features | limitations
• Identify default system-wide schedule
• Peruse various default Cron Jobs
• Schedule simple job and monitor recurrence
• Evaluate results

• Peruse Default CONF
• Discuss Syslog Rules
• Explore Log Rotate defaults
• Ensure rotated logs are compressed
• Extend default retention scheme
• Force Log Rotation as needed

• Explore Default environment
• Install PKGs
• Dump important metadata from packages
• Apply Updates

• Default CONF
• Add | Confirm IPs as needed

• Install
• Copy Configuration
• SELinux - Confirm
• TLS | SSL Services
• cURL Client Tests
• Virtual Hosts
• ENC Sites Only

• SFTP Only USER
• SFTP Only USER - NOLOGIN
• SFTP Only Group - Control
• NMap Intro

SysLOG with rSysLogD

• Discuss Features
• Default Environment
• Kernel Firewall LOG
• Split LOGs by Priorities
• UDP | TCP Logging
• Dual L4 Logging
• Multiple Hosts
• Basic Queueing
• Reliable Event Logging Protocol (RELP)
• RELP - Remote Only
• RELP Only
• Traditional to RELP
• SysLOG Clear-Text - Confirm
• Property Filters
• Expression Filters
• Relay Chain

Netfilter Tables

• Features
• SSHGuard
• Ruleset Basics
• Persistence
• Sample Rules
• Inbound Filtering
• Dormant Table
• Manage Tables | Chains | Rules
• Counters
• Sets
• LOG Basics
• LOG with Sets
• Closed-Port LOGs
• LOG Options
• Re-Route LOGs
• Jump Targets
• Chain Jumping
• GoTo Chains
• Meta Selectors

Debian 12x Administration

• Features
• Download
• Graphical Install
• Text Install
• Post-Install Tweaks

• Explore usage of the following useful commands
• tty | /dev/pts | w | whoami | who
• set | env | export | unset
• cat | echo | touch | rm
• pwd | ls | cd | mkdir | alias | umask
• head | tail
• dd
• find
• history
• STDIN, STDOUT, STDERR, UNIX Pipes, Redirection, Command Chaining
• ps, df, free, top, dd
• stat, which, w, who
• tar | gzip | bzip2 | xz
• ZSH Setup

• Network Tools | IP Configuration
• Examine default IP configuration
• Extend IP configuration to facilitate additional addresses
• Static IP Config
• Dual: Dynamic | Static Config
• Multiple Interfaces
• Dual Network Services
• Confirm communications

PHP One-Liners

• General Usage
• Count Lines
• Word Count
• Count Chars
• Split Lines into ARRAY
• Count Instances of Fields
• Transform Delimiters
• Anonymize LOGs
• Extract Unique SRCs
• Lines by Error Code
• LOG By Code
• Summarize Error Codes
• Pre-Seed Error Codes
• Random Strings
• Varied Passwords
• Expose Undefined Passwords
• Outdated Passwords
• Hash | Un-Hash

Cloud Storage with GlusterFS

• Discuss Features:
• Default Volume Type
• Common Volume Types
• Transport Types
• File System Support
• Storage Model

• Features
• Provision Storage
• Allocate GlusterFS Brick
• Persistence
• Generate IO
• Multiple File Systems
• Various Sizes
• Stop | Remove Volume
• Reconstitute Volume
• Server Mount
• Evaluate

OpenPGP with GPG

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Signing | Verification

• Features
• General Usage
• Create Content
• Encrypt
• PassPhrase Protect
• Binary | Text Encryption
• Share
• Decrypt

SSL-TLS with OpenSSL

• Discuss Features:
• Primary Tool
• Private | Public Keys
• Certificate Signing Requests (CSRs)
• Self-Signed Certificates
• Public Key Cryptography Standards (PKCS)
• Encryption | Decryption
• Random String Generation
• Message Digests
• SSL-TLS Client

• Features
• General Usage
• Retrieve Site Certificates
• Determine OCSP Configuration
• Probe supported TLS Versions
• Extract Certificate for local usage
• Retrieve Certificate with NMap
• Retrieve Certificate Chain

• Discuss
• Generate Private Keys
• Generate Correlating CSRs
• Confirm Keys | CSRs
• Self-Signed Certificates

SSH Variables

• Discuss Features
• Bare VARs
• SSH Client
• Double Quotes
• Single Quotes
• SSH Environment

SHELL Variables

• Discuss Features
• Terminal (TTY)
• CLI Arguments
• Process ID
• Backgrounded
• SHELL Local
• Environment
• Persistence
• Aliases
• Command Substitution
• Increment | Decrement
• Dynamism