Skip to content

Latest commit

 

History

History
1034 lines (925 loc) · 36.5 KB

Service Methodology.md

File metadata and controls

1034 lines (925 loc) · 36.5 KB
Raw

The purpose of this network service methodology is to create a quick mind-map for useful tools associated with quick enumeration network services. It takes most of the recommended tooling from hacktricks and condeses in a single linked document with emphases on logical executions of tools in a "unorded psuedo-code" format. While the focus is on tools that can be implemented in automated scripts, it also provides links to manual methodology and information mainly featured in hacktricks. It also features additional network services obtained throughout my capstone research project Pentester Toolchain (https://github.com/ngimb64/Pentester-Toolchain) and will continue to be updated with custom scripts obtained on github or created myself. If your not familiar I also highly recommend checking out hacktricks (https://book.hacktricks.xyz/welcome/readme), considering it was incredibly helpful in putting together this document and the default configuration script for Pentester Toolchain and features lots of great information on offensive security beyond the scope of network penetration testing.

Other sources that provided valuable service informaton not found in hacktricks are found below:

Additional information on network pentesting methodology can be found here

Table of Contents

TCP

FTP (20, 21) SSH (22) Telnet (23) SMTP (25, 465, 587, 2525) Whois (43) TACACS+ (49) Finger (79) HTTP/HTTPS (80, 443, 8080, 8443) POP3/POP3 over TLS (110, 995) Ident (113) NNTP/NNTPS (119, 433) IMAP/IMAP over TLS (143, 993) SNMP Smux (199) Checkpoint Firewall (264) SMB (445) Modbus (502) Rexec (512) Rlogin (513) Rsh (514) Line Printer Daemon (515) Apple Filing Protocol (548) RTSP (554) Cups (631) Rsync (873) Java RMI (1050, 1098, 1099) Microsoft SQL Server (1433) Oracle Database Server (1521) Point-to-Point Tunneling Protocol (1723) Mosquito (1883) Oracle XML DB FTP (2100) Compaq/HP Insight Manager (2301, 2381) Docker (2375, 2376) Squid (3128) ISCSI (3260) SAPRouter (3299) MySQL (3306) RDP (3389) Distcc (3632) Subversion (3690) Erlang Port Mapper Daemon (4369) RSIP (4555) Cisco Smart Install (4786) Docker Registry (5000) Android Debug Bridge (5037, 5555) Postgresql (5432, 5433) Redshift (5439) VNC (5800, 5900) WinRM (5985, 5986) X11 (6000) Redis (6379) Java Debug Wire (8000) Apache Jserv (8009) InfluxDB (8086) Splunkd (8089) Bitcoin (8333, 18333, 18444, 38333) HyperSQL Database (9001) Apache Casandra (9042, 9160) Raw Printing (9100) Elasticsearch (9200) Network Data Management Protocol (10000) Memcache (11210) RabbitMQ Management (15672) GlusterFS (24007, 24008, 24009, 49152) MongoDB (27017, 27018) Tiller (44134) SAP 50000-8, 50010 Hadoop (50030, 50060, 50070, 50075, 50090)

UDP

DHCP (67) TFTP (69) Rusersd (1026) WS-Discovery (3702) mDNS (5353) BACNet (47808)

TCP/UDP

DNS (53) Kerberos (88) Rpcbind (111) NTP (123) MSRPC (135) Netbios (137, 138, 139) SNMP (161, 162, 10161, 10162) IRC (194, 529, 6667) LDAP (389, 636) IPsec / IKE VPN / Point-to-Point Tunnel Protocol (500, 1723) Intelligent Platform Management Interface (623) Windows domain (1030, 1032, 1033, 1038) Socks Proxy (1080) Oracle Intelligent Agent (1748, 1754, 1808, 1809) NFS (2049) RSIP (4555) Kibana (5601) RabbitMQ (5671, 5672) CouchDB (5984, 6984) EthernetIP (44818)

Brute force resources

FTP

  • attempt anonymous connection or connection via browser ftp <ip>
  • attempt to download all files wget -m ftp://anonymous:anonymous@<ip> wget -m --no-passive ftp://anonymous:anonymous@<ip>
  • banner grab nc -vn <ip> <port> OR telnet -n <ip> <port>
  • certificate grab openssl s_client -connect <ip>:<port> -starttls ftp
  • nmap nse scripts / metasploit options
  • if further brute forcing
    • use hydra hydra -t 1 -l <username> -P <password wordlist> -vV <ip> ftp OR
    • use ncrack ncrack -T 5 -p 21 --user <username> -P <password wordlist> <ip> OR
    • use medusa medusa -u <username> -P <password wordlist> -h <ip> -M ftp
  • for additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-ftp

SSH

  • banner grab nc -vn <ip> <port>
  • nmap nse scripts / metasploit options
  • If brute forcing
    • use hydra hydra -v -V -u -l <username> -P <password wordlist> -t 1 -u <ip> ssh OR
    • use ncrack ncrack -T 5 -p 22 --user <username> -P <password wordlist> <ip> OR
    • use medusa medusa -u <username> -P <password wordlist> -h <ip> -M ssh OR
    • use patador patator ssh_login host=<ip> port=22 user=<username> 0=<password wordlist> password=FILE0 -x ignore:mesg='Authentication failed'
  • once access is gained, keys can be generated for persistence or existing keys can used to pivot
  • for additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-ssh

Telnet

  • banner grab nc -vn <ip> 23
  • nmap nse scripts / metaspoit options
  • if brute forcing
    • use hydra hydra -l <username> -P <password wordlist> -t 32 <ip> telnet OR
    • use ncrack ncrack -T 5 -p 23 --user <username> -P <password wordlist> <ip> OR
    • use medusa medusa -u <username> -P <password wordlist> -h <ip> -M telnet

SMTP

  • banner grab nc -vn <ip> 25
  • nmap nse scripts / metasploit options
  • if SMTPS (secure connection) openssl s_client -crlf -connect smtp.<domain>:465 openssl s_client -starttls smtp -crlf -connect smtp.<domain>:587
  • finding mx servers dig +short mx <domain>
  • if initial enum shows allowed VRFY method, connect
  • use hydra if brute forcing hydra -l <username> -P <password wordlist> <ip> smtp -v with SSL: hydra -l <username> -P <password wordlist> -s 587 <ip> -S -v -V
  • use mailspoof (https://github.com/serain/mailspoof) to identify weak SPF and DMARC policies
  • if credentials are already obtained, evolution can be used to extract user email data from server
  • for manual enumeration and addional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-smtp

Whois

  • run whois and pipe the echoed domain name to netcat banner grab: whois -h <ip> -p 43 <domain> && echo <domain> | nc -vn <ip> 43
  • the WHOIS service always needs to use a database to store and extract the information. So, a possible SQLInjection could be present when querying the database from some information provided by the user. For example doing: whois -h <ip> -p 43 "a') or 1=1#" you could be able to extract all the information saved in the database.

Tacacs+

Finger

HTTP/HTTPS

  • banner grab nc -v <domain>
  • cert grab openssl s_client -connect <domain>:443
  • vuln check with analyzer tools stealthy - whatweb -a 1 <url> aggresive - whatweb -a 3 <url> webtech -u <url> webanalyze -host <url> -crawl 2
  • nmap nse scripts / metasploit options
  • automatic scanners nikto -host <url> whatweb -a 4 <url> wapiti -u <url> W3af nuclei -ut && nuclei -target
  • CMS scanners cmsmap -F -d <url> wpscan --force update -e --url <url> joomscan --ec -u <url> joomlavs.rb (https://github.com/rastating/joomlavs)
  • initial checks (pages of interest)
    • /robots.txt
    • /sitemap.xml
    • /crossdomain.xml
    • /clientaccesspolicy.xml
    • /.well-known/
    • Check out comments in main/secondary pages for information leakage
  • SSL/TLS Vulnerabilities ./testssl.sh <ip>:<port> (https://github.com/drwetter/testssl.sh)
  • if brute forcing

    • HTTP basic auth

      • use hydra hydra -L <username wordlist> -P <password wordlist> <domain> http-get <auth web path> OR
      • use medusa medusa -h <ip> -u <username> -P <password wordlist> -M http -m DIR:<auth web path> -T 10

    • HTTP post form

      • use hydra hydra -L <username wordlist> -P <password wordlist> <domain> http-post-form "<auth web path>:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect" -V
  • if brute forcing cms cmsmap -f W/J/D/M -u a -p a <proto>://<domain>

for additional methodolgy details, check out https://book.hacktricks.xyz/network-services-pentesting/pentesting-web

POP3

  • banner grab nc -nv <ip> <port>
  • cert grab openssl s_client -connect <ip>:<port> -crlf -quiet
  • nmap nse scripts / metaspoit options
  • use hydra if further brute forcing hydra -l <username> -P <password wordlist> -f <ip> pop3 -V with SSL: hydra -S -v -l <username> -P <password wordlist> -s 995 -f <ip> pop3 -V

Ident

NNTP/NNTPS

IMAP

  • banner grab nc -nv <ip> <port>
  • cert grab openssl s_client -connect <ip>:><port> -quiet
  • nmap nse scripts / metaspoit options
  • if brute forcing
    • use hydra hydra -l <username> -P <password wordlist> -f <ip> imap -V with SSL: hydra -S -v -l -P -s 993 -f imap -V OR
    • use nmap nmap -sV --script imap-brute -p <port> <ip>
  • for additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-imap

Smux

  • run snmpwalk snmpwalk -c public -v1 -t 10 <ip>

Checkpoint-Firewall

  • Run metasploit script under auxilary/gather/checkpoint_hostname

SMB

  • nmap nse scripts / metaspoit options

  • without credentials nbtscan <ip> smbmap -H <ip> smbmap -H <ip> -u null -p null smbmap -H <ip> -u guest smbclient -N -L //<ip> smbclient -N //<ip>/ --option="client min protocol"=LANMAN1 rpcclient <ip> rpcclient -U "" <ip> crackmapexec smb <ip> crackmapexec smb <ip> --pass-pol -u "" -p "" crackmapexec smb <ip> --pass-pol -u "guest" -p "" GetADUsers.py -dc-ip <ip> "<domain>/" -all GetNPUsers.py -dc-ip <ip> -request "<domain>/" -format hashcat GetUserSPNs.py -dc-ip <ip> -request "<domain>/" getArch.py -target <ip>

  • with credentials smbmap -H <ip> -u <username> -p <password> smbclient "\\\\<ip>\\\" -U <username> -W <domain> -l <ip> smbclient "\\\\{IP}\\\" -U {Username} -W {Domain_Name} -l {IP} --pw-nt-hash <hash> crackmapexec smb <ip> -u <username> -p <password> --shares GetADUsers.py <domain>/<username>:<password> -all GetNPUsers.py <domain>/<username>:<password> -request -format hashcat GetUserSPNs.py <domain>/<username>:<password> -request

  • if brute forcing

    • use hydra hydra -t 1 -V -f -l <username> -P <password wordlist> <ip> smb OR
    • use nmap nmap --script smb-brute -p <port> <ip>

  • for additional information

Modbus

  • use nmap nse script / metasploit options nmap --script modbus-discover -p <port> <ip>

Rexec

  • if brute forcing
    • use hydra hydra -l <username> -P <password wordlist> rexec://<ip> -v -V OR
    • use nmap nmap --script rexec-brute -p <port> <ip> OR
    • use metasploit module auxiliary/scanner/rservices/rexec_login

Rlogin

  • attempt remote login rlogin <ip> -l <username>
  • if brute forcing
    • use hydra hydra -l <username> -P <password wordlist> rlogin://<ip> -v -V OR
    • use nmap nmap --script rlogin-brute -p <port> <ip> OR
    • metasploit module auxiliary/scanner/rservices/rlogin_login

Rsh

  • execute command on remote system rsh <ip> <command> rsh <ip> -l <domain>\<user> <command> rsh <domain>/<user>@<ip> <command> rsh <domain>\\<user>@<ip> <command>
  • if brute forcing
    • use hydra hydra -L <username wordlist> rsh://<ip> -v -V OR
    • use metasploit module auxiliary/scanner/rservices/rsh_login
  • for additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-rsh

Line-Printer-Daemon

Apple-Filing-Protocol

  • nmap vuln script nmap -sV --script "afp-* and not brute" -p <port> <ip>
  • use metasploit afp_server_info script in auxiliary/scanner/afp
  • if brute forcing
    • use nmap nmap -p <port> --script afp-brute <ip> OR
    • use metasploit module auxiliary/scanner/afp/afp_login

RTSP

Cups

Rsync

  • run nmap nse scripts / metasploit options
  • manual enumeraton with netcat nc -vn <ip> <port>
    • return printed banner
    • enter #list to enumerate
    • retry process with enumerated share names insted of #list
  • if brute forcing use nmap nmap -sV --script rsync-brute --script-args userdb=<username wordlist>,passdb=<password wordlist> -p 873 <ip>
  • for additional information https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync

Java-RMI

Microsoft-SQL-Server

  • nmap nse scripts / metaspoit options
  • if brute forcing
    • use crackmapexec crackmapexec mssql <ip> -d <domain> -u <username wordlist> -p <password wordlist> OR
    • use hydra hydra -L <username wordlist> –P <password wordlist> <ip> mssql OR
    • use medusa medusa -h <ip> –U <username wordlist> –P <password wordlist> –M mssql OR
    • use nmap nmap -p 1433 --script ms-sql-brute --script-args mssql.domain=<domain>,userdb=<username wordlist>,passdb=<password wordlist>,ms-sql-brute.brute-windows-accounts <ip> OR
    • use metasploit module auxiliary/scanner/mssql/mssql_login
  • for manual methoodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server

Oracle-Database-Server

Mosquito

Oracle-XML-DB

  • metasploit options

Compaq/HP-Insight-Manager

Docker

  • nmap nse scripts / metaspoit options
  • test connection to container: docker -H <ip>:<port> ps -a
  • download kali image docker -H <ip>:<port> pull kalilinux/kali
  • double check if image was downloaded properly: docker -H <ip>:<port> images
  • running the container: docker -H <ip>:<port> run -itd --name <container name> -v /:/ mnt <image id>
  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/2375-pentesting-docker

Squid

ISCSI

  • nmap nse script nmap -sV --script=iscsi-info -p 3260 <ip>
  • run iscsiadm to attempt mount that would be located in /etc/iscsi/nodes/ iscsiadm -m discovery -t sendtargets -p <ip>:3260
  • if brute forcing use nmap nmap -sV --script iscsi-brute --script-args userdb=<username wordlist>,passdb=<password wordlist< -p 3260 <IP>
  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/3260-pentesting-iscsi

SAPRouter

MySQL

  • nmap nse scripts / metaspoit options
  • if brute forcing
    • use hydra hydra -L <usernames wordlist> -P <password wordlist> <ip> mysql OR
    • use medusa medusa -h <IP/Host> -u <username wordlist> -P <password wordlist> <-f | stop on first success attempt> -t <threads> -M mysql OR
    • use metasploit module auxiliary/scanner/mysql/mysql_login
  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-mysql

RDP

  • nmap nse scripts / metaspoit options
  • if brute forcing
    • use hydra hydra -V -f -L <username wordlist> -P <password wordlist> rdp://<ip> OR
    • use ncrack ncrack -vv --user <username wordlist> -P <password wordlist> rdp://<ip>
  • use crowbar or cain can also be used for brute forcing
  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-rdp

Distcc

Subversion

  • banner grab nc -vn <ip> <port>
  • metasploit options
  • enumeraiton svn ls svn://<ip> svn log svn://<ip> svn checkout svn://<ip> svn up -r 2
  • if brute forcing use nmap nmap --script svn-brute --script-args svn-brute.repo=/svn/ -p 3690 <host>

Erlang-Port-Mapper-Daemon

RSIP

Cisco-Smart-Install

Docker-Registry

Android-Debug-Bridge

Postgresql

  • metasploit options

  • if brute forcing

    • use hydra hydra -L <username wordlist> –P <password wordlist> <ip> postgres OR
    • use ncrack ncrack –v –U <username wordlist> –P <password wordlist> <ip>:<port> OR
    • use medusa medusa -h <ip> –U <username wordlist> –P <password wordlist> –M postgres OR
    • use nmap nmap -sV --script pgsql-brute --script-args userdb=<username wordlist>,passdb=<password wordlist> -p <port> <ip> OR
    • use metasploit module auxiliary/scanner/postgres/postgres_login

  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-postgresql

Redshift

VNC

  • nmap vuln scripts / metaspoit options
  • if brute forcing
    • use hydra hydra -L <username wordlist> –P <password wordlist> -s <port> <ip> vnc OR
    • use ncrack ncrack -V --user <username> -P <password wordlist> <ip>:<port> OR
    • use medusa medusa -h <ip> –u <username> -P <password wordlist> –M vnc OR
    • use nmap nmap -sV --script pgsql-brute --script-args userdb=<username wordlist>,passdb=<password wordlist> -p <port> <ip> OR
    • use metasploit module auxiliary/scanner/vnc/vnc_login
  • for additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-vnc

WinRM

X11

Redis

Java-Debug-Wire

Apache-Jserv

InfluxDB

Splunkd

Bitcoin

  • nmap nse scripts

HyperSQL-Database

Apache-Casandra

Raw-Printing

Elasticsearch

Network-Data-Management-Protocol

  • nmap nse scripts / metasploit options

Memcache

RabbitMQ-Management

GlusterFS

MongoDB

Tiller

SAP

for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-sap

Hadoop

DHCP

  • nmap nse scripts

TFTP

Rusersd

  • nmap nse scrips
  • rusers system tool rusers -l <ip>

WS-Discovery

mDNS

BACNet

DNS

  • run dns recon dnsrecon -r 127.0.0.0/24 -n <ip> -d <domain> dnsrecon -r 127.0.1.0/24 -n <ip> -d <domain> dnsrecon -r <network>/<CIDR> -n <ip> -d <domain>
  • run nslookup nslookup <ip> OR <domain>
  • dns zone transfer dig axfr @<ip> dig axfr @<ip> <domain> fierce -dns <domain>
  • run dig active directory enumeration dig -t _gc._<domain> && dig -t _ldap._<domain> && dig -t _kerberos._<domain> && dig -t _kpasswd._<domain>
  • run nmap nse scripts / metasploit options
  • for manual methodology and more information https://book.hacktricks.xyz/network-services-pentesting/pentesting-dns

Kerberos

Rpcbind

NTP

MSRPC

Netbios

SNMP

  • run snmp-check snmp-check <ip>
  • nmap nse scripts / metasploit modules
  • run snmpwalk snmpwalk -c public -v1 <ip> 1
  • if brute forcing
    • use hydra hydra -P <commmunity wordlist> <ip> snmp OR
    • use onesixtyone onesixtyone -c <community wordlist> <ip> OR
    • use nmap nmap -sU --script snmp-brute <ip> --script-args snmp-brute.communitiesdb=<community wordlist> OR
    • use metasploit module auxiliary/scanner/snmp/snmp_login
  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-snmp

IRC

  • banner grab nc -vn <ip> <port>
  • cert grab openssl s_client -connect <ip>:<port> -quiet
  • nmap nse scripts / metasploit options
  • if brute forcing use nmap nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=<username wordlist>,passdb=<password wordlist> -p <port> <ip>
  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-irc

LDAP

  • nmap nse scripts / metasploit options
  • run base ldapsearch ldapsearch -H ldap://<ip> -x
  • run ldapsearch naming context dump ldapsearch -H ldap://<ip> -x -s base namingcontexts
  • if brute forcing use nmap nmap --script ldap-brute -p <port> <IP>
  • for manual methodology and additional information https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap

IPsec/IKE-VPN/PPTP

Intelligent-Platform-Management-Interface

Socks-Proxy

NFS

RSIP

Kibana

RabbitMQ

CouchDB

EthernetIP