> For the complete documentation index, see [llms.txt](https://jackmeister.gitbook.io/jackmeister-playbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jackmeister.gitbook.io/jackmeister-playbook/network-pentest.md). # Network Pentest ## arp-scan scan local network ips ``` arp-scan --localnet 192.168.1.0/24 ``` ## netdiscovery ``` netdiscovery -r 172.20.0.0/24 ``` ## BruteSpray **Using Custom Wordlists:** ```bash python brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5 ``` **Brute-Forcing Specific Services:** ```bash python brutespray.py --file nmap.gnmap --service ftp,ssh,telnet --threads 5 --hosts 5 ``` **Specific Credentials:** ```bash python brutespray.py --file nmap.gnmap -u admin -p password --threads 5 --hosts 5 ``` **Continue After Success:** ```bash python brutespray.py --file nmap.gnmap --threads 5 --hosts 5 -c ``` **Use Nmap XML Output** ```bash python brutespray.py --file nmap.xml --threads 5 --hosts 5 ``` **Use JSON Output** ```bash python brutespray.py --file out.json --threads 5 --hosts 5 ``` **Interactive Mode** ```bash python brutespray.py --file nmap.xml -i ``` Supported Services * ssh * ftp * telnet * vnc * mssql * mysql * postgresql * rsh * imap * nntp * pcanywhere * pop3 * rexec * rlogin * smbnt * smtp * svn * vmauthd * snmp ## IMCP SCAN ```bash # 1 echo request to a host ping -c 1 199.66.11.4 # Send echo requests to ranges fping -g 199.66.11.0/24 #Send echo, timestamp requests and subnet mask requests nmap -PEPM -sP -n 199.66.11.0/24 ``` ## TCP LARGE SCAN ```bash #Using masscan to scan top20ports of nmap in a /24 range (less than 5min) masscan -p20,21-23,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080 199.66.11.0/24 ``` ## HTTP PORT SCAN ```bash masscan -p80,443,8000-8100,8443 199.66.11.0/24 ``` ## UDP SCAN ```bash nmap -sU -sV --version-intensity 0 -F -n 199.66.11.53/24 # The -sV will make nmap test each possible known UDP service packet # The "--version-intensity 0" will make nmap only test the most probable # wget https://raw.githubusercontent.com/CiscoCXSecurity/udp-proto-scanner/master/udp-proto-scanner.pl #chmod +x udp-proto-scanner.pl ./udp-proto-scanner.pl 199.66.11.53/24 It looks for : - DNS - TFTP - NTP - NBT - SunRPC - MS SQL - DB2 - SNMPv3 ``` ## SCTP SCAN ```bash #Probably useless, but it's pretty fast, why not trying? nmap -T4 -sY -n --open -Pn ``` ## Internal/On-Site Scan ## Passsive wardriving ```bash netdiscover -p p0f -i eth0 -p -o /tmp/p0f.log # Bettercap sudo bettercap net.recon on/off #Read local ARP cache periodically net.show set net.show.meta true #more info ``` * `-p` = Passive mode : only sniff ## Active wardriving ```bash #ARP discovery nmap -sn #ARP Requests (Discover IPs) netdiscover -r 192.168.63.0/24 #ARP requests (Discover IPs) #NBT discovery nbtscan -r 192.168.0.1/24 #Search in Domain # Bettercap net.probe on/off #Discover hosts on current subnet by probing with ARP, mDNS, NBNS, UPNP, and/or WSD set net.probe.mdns true/false #Enable mDNS discovery probes (default=true) set net.probe.nbns true/false #Enable NetBIOS name service discovery probes (default=true) set net.probe.upnp true/false #Enable UPNP discovery probes (default=true) set net.probe.wsd true/false #Enable WSD discovery probes (default=true) set net.probe.throttle 10 #10ms between probes sent (default=10) #IPv6 alive6 # Send a pingv6 to multicast. ``` ## Normal Network scan #### 1. Nmap: ```bash nmap -p 1-1000 192.168.1.1 ``` ## Large Network Scan #### 1. Masscan: ``` masscan -p 1-65535 192.168.1.0/24 ``` #### 2. Zmap: ``` zmap -p 80,443 192.168.0.0/16 ``` #### 3. Unicornscan : ``` unicornscan -mU -p 161 192.168.1.1 ``` #### 4. hping : ``` hping3 -S -p 80 192.168.1.1 ``` ### Nmap Basics #### Default Scripts + Server Version check ``` nmap -sC -sV IP_ADDRESS -oN ``` #### If cannot ping , just scan all port ``` nmap -Pn -p- ``` #### Check for subnets ``` nmap -sn 10.10.10.0/24 nmap -sn 10.10.0.0/16 nmap -sn 10.0.0.0/8 ``` #### Check for SMB vulnerability ``` nmap --script smb-vuln* ``` #### Check for SSL ``` nmap --script ssl-enum-ciphers nmap --script ssl-* ``` #### Check all scripts ``` ls -l /usr/share/nmap/scripts/ ``` #### Check for subdomain ``` nmap --script dns-brute -sn google.com ``` ### Bypass Firewall Techniques **Fragmentation : `Bypass firewall packet inspection`** ``` nmap -f 192.168.0.1 ``` **Resizing MTU : Confuse firewall packet size inspection** ``` nmap --mtu 24 192.168.0.1 ``` **Using decoy address : spoof packets from other hosts to confuse or obfuscate the target system** ``` nmap -D RND:10 192.168.0.1 nmap -D decoy-ip-1,decoy-ip-2,decoy-ip-3 192.168.0.1 ``` * RND: 10 = Fake IP up to 10 **Idle Zombie Scan : using other host to scan** ``` nmap -sI 192.168.0.1 192.168.0.40 ``` **Source Port Number Specification : for firewall that only allow certain ports** ``` nmap --source-port 80 192.168.0.1 ``` **Append Random Data : add more data to packet to confuse firewall** ``` nmap --data-length 1024 192.168.0.1 ``` **Scan with Random Order : avoid behaviour detection** ``` nmap --randomize-hosts 192.168.0.1 ``` #### #### MAC Address Spoofing : change mac address to bypass MAC address-based filters ``` nmap --spoof-mac 00:11:22:33:44:55 192.168.0.1 ``` **Send Bad Checksums : abuse firewall that only check badsum** ``` nmap --badsum 192.168.0.1 ``` **TCP/IP Fragmentation : bypass firewall rules that are based on packet contents** ``` nmap --mtu 16 --max-rtt-timeout 10 192.168.0.1 ``` #### #### Advanced one-liner : ``` nmap -sS --max-retries 5 --max-scan-delay 500ms --scan-delay 500ms -T2 -r -D RND:10 -f --source-port 53,80,443,8080 -Pn -vv [TARGET_IP] -oX /root/results.xml ``` ``` nmap --script-args http.useragent='' -vv --open -sU -sS --script/usr/share/nmap/scripts/vulners.nse -oX /root/results.xml -p T:1-65535,U:53,U:67,U:68,U:69,U:88,U:161,U:162,U:137,U:138,U:139,U:389,U:500,:U:520,U:2049 [TARGET_IP] ``` ### Threader3000 ``` git clone https://github.com/dievus/threader3000.git ./threader3000.py Enter IP ```