SlideShare a Scribd company logo

Ethical hacking mind map

•
•
D
dasdwwe1

The document provides an overview of penetration testing techniques and strategies. It discusses initial reconnaissance activities like scanning and enumeration. It then covers exploitation, maintaining access, and post-exploitation tactics like credential dumping, privilege escalation, and pivoting. Defense strategies are also mentioned such as disabling unnecessary services, requiring strong passwords, and limiting local administrator rights.

1 of 1
Download to read offline
Penetration Testing Scanning & Enumeration Exploitation Reconaissance Scanning Nmap Netdiscover arp-scan Active Directory Brute Force Attacks Email Address Gathering Identify Target Hunter.io (Domain Search) bugcrowd.com Maintaining Access Persistence Scripts Scheduled Tasks Add a user Enumeration HTTP/HTTPS SMB SSH Crdential Stuffing Post-Exploitation Pivoting Covering Tracks Make the System/Network as it was when you entered it Remove executables, scripts, and added files Remove malware, rootkits, and added user accounts Set settings back to original configurations Breached Credentials OSINT Subdomains Sublist3r crt.sh OWASP Amass Identify Website Technologies Information Gathering with Burp Suite Google Fu Social Media Overview Target Validation Finding Subdomains Fingerprinting Data Breaches WHOIS nslookup dnsrecon Google Fu dig Nmap Sublist3r Bluto crt.sh Nmap Wappalyzer WhatWeb BuiltWith Netcat HaveIbeenPwned Breach-Parse WeLeakInfo Breach-Parse Tomnomnom HTTPprobe BuiltWith Wappalizer whatweb LinkedIn Twitter The Harvester Masscan Metasploit Nessus Nikto Dirbuster Dirb Gobuster Source Code Burp Suite Msfconsole - smb_version smbclient enum4linux (not working properly) Connection attempt Vulnerability Research Google Searchsploit Exploit Database Metasploit - search Password Spraying Metasploit Hydra Hashes Dumping / Cracking SAM SAM SECURITY SYSTEM secretsdump John Hashcat crackmapexec psexec Pass-The-Hash Pass-The-Hash Eternal Blue MS17_010 Metasploit smb_ms17_010 AutoBlue alternative to metasploit smbclient Credentials Kiwi Metasploit Mimikats Tokens Stealing & Manipulation Metasploit Incognito FTP Password dumping Hash dumping Golden Tickets Password dumping in memory Password dumping Password dumping in memory Hash dumping Golden Tickets Default Creds Common Bad Password List Word List Generator CEWL Buffer Overflow Spiking Fuzzing Finding the Offset Overwriting the EIP Finding Bad Characters Finding the Right Module Generating Shellcode / Getting Root LLMNR Poisoning Capturing NTLMv2 Hashes Password Cracking (Hashcat) Defences SMB Relay Attacks Host Discovery SMB Signing Disabled Disable LLMNR and NBT-NS Require Network Access Control Require Strong User Passwords LLMNR NBT-NS DNS/MDNS Responder Responder Nessus Gain Shell Access Responder ntlmrelayx Nmap script Privilege Escalation anonymous access binary Network ipconfig /all arp -a route print netstat -ano Davtest Test Server upload WEB Web Applications Finding Subdomains Find Alive Domains SQL Injection XXS https://github.com/danielmiessler/SecLists https://github.com/initstring/passphrase-wordlist SAM Hashes Dump Interactive shell -i Command execute -c Execute .exe file -e Crack offline Pass-the-Hash HTTP Off SMB Off msfvenom Reverse shell Netcat Powershell msf web_delivery other meterpreter Defences Enable SMB signing on all devices Disable NTLM Authentication Account tiering It will completely stop the attack Performance issues with file copy Stops the attack If Kerberos stops working, back to NTLM Admin only logging into their accounts / servers / domain controllers Local Admin restriction No local Admin prevent lateral movement msfconsole psexec.py smbexec.py wmiexec.py exploit/windows/smb/psexec exploit/windows/smb/psexec_psh AV noisy Less noisy / Half-shell Less noisy / Half-shell IPv6 Attacks LDAP Relay mitm6 ntlmrelayx aclpwn restore info dump (loot folder) new user creation on DC delegate access Defenses Other Attack Vectors and Strategies Disable IPv6 Disable wpad if not in use Enable LDAP signing and channel binding Put admin users into the protected users group Possible unwanted side effects Define Block Rules / instead of Allow Rules usually not enabled prevent impersonation or delegation Day begins with Early morning Lunch time mitm6 Responder Early morning Lunch time Easy win See how the network responds Are they giving us hashes ? Are those hashes easy to crack ? Easy win If LMNR is disabled might have had Pentest before might know common attacks Nessus scan Nmap scan HTTP_Version (Metasploit) Use this if scans are taking too long Sweep entire network for websites Less likely to be picked-up Loot at logins Check for default creds Look for printers might get domain admin off Scan-to-computer feature Is user domain admin on that printer ? dump creds in clear text get passwords for SMB user using individual user accounts Lot of people don't secure their printers Jenkins Instances Often wide open Check for Vulns Looking for hashes Get loot back Get account created on Domain Controller Try all possible ways in Look for SMB open / signing disbled Pickup targets / hashes for SMB Relay attacks Morning Afternoon Relay hashes Search for low hanging fruits Think outside the box Enumerate as much as you can Don't just focus on the exploit Initial Attack Vectors Post-Compromise Attack Enumeration PowerView Bloodhound Pass-the-Hash Pass-the-Password Dump the Hashes crackmapexec Pwn3d! crackmapexec Metasploit psexec meterpreter hashdump no cracking needed secretsdump Crack NTLM Hashes Hashcat SAM Dumping get a shell not Pwn3d! Try get a shell with Psexec Dump local SAM hashes no SMB access Pwn3d! or green [+] Try to authenticate with Psexec not Pwn3d! no SMB access LSA Secrets Dumping DPAPI_SYSTEM KEY Pass Attack Limit account re-use Utilize strong passwords Privilege Access Management (PAM) Avoid re-using local admin password Disable Guest and Administrator accounts Limit who is a local administrator The longer the better (>14 characters) Avoid using common words I like long sentences Check out/in sensitive accounts when needed Automatically rotate passwords on check out and check in Limits pass attacks as hash/password is strong and costantly rotated Mitigation Token Impersonation Token Impersonation Cannot pass NTLMv2 Mimikatz Meterpreter - Incognito Limit user/group token creation permissions Account tiering Local admin restriction Kerberoasting GPP / cPassword Mimikatz Kerberoasting Strong Passwords Least privilege Request TGT, provide NTLM hash Receive TGT encrypted with krbtgt hash Request TGS for Server (Presents TGT) Receive TGS encrypted with Server's account hash Crack the hash GetUserSPNs.py smb_enum_gpp module in Metasploit gpp_decrypt Groups.xml Invoke-GPP smbclient prompt off recurse on mget * cpassword Golden Ticket Credential Dumping Pass-the-Hash Over-Pass-the-Hash Pass-the-Ticket Silver Ticket privilege::debug LSA dump sekurlsa::logonpasswords ntds.dit Usernames NTLM Logged in accounts wdigest lsadump::sam lsadump::sam /patch lsadump::lsa /patch SAM dump sam dump not working shell with Metasploit secretsdump.py just download the SAM Passwords Why do we dump ? Crack passwords offline Golden Ticket attack % we are able to crack weak password policy strong password policy Kerberos Ticket Granting Ticket crackmapexec crack with secretsdump.py windows/system32/config/SAM windows/system32/config/SECURITY windows/system32/config/SYSTEM Pull down krbtgt account SID NTLM lsadump::lsa /inject /name:krbtgt Golden Ticket Pass-the-Ticket Silver Ticket opens cmd prompt Access any computer dir THEPUNISHERc$ PsExec64.exe -accepteula THEPUNISHER cmd.exe shell psexec.exe misc::cmd Stealthier Features Persistence net user hacker password123 /add run scheduleme run schtaskabuse run persistence -h exploit/windows/local/persistence exploit/windows/local/registry_persistence Metasploit proxychains SSH Pivoting psexec run autoroute -s 169.254.0.0/24 run autoroute -p connect to target route print ipconfig arp -a use auxiliary/scanner/portscan/tcp poc Wi-Fi WPA2 PSK WPA2 Enterprise Assetfinder Amass ./run.sh tesla.com HTTProbe Screenshot Websites GoWitness Subdomain takeover Subjack Scraping Wayback data Waybackurls Enumeration Users Enumeration nmap --script=smb-enum-users.nse GetADUsers.py -dc-ip 10.10.10.161 htb.local/ kerbrute userenum --dc 10.10.222.155 -d spookysec.local usernames.txt -t 100 Attempt to list and get TGTs for those users that have the property “D o not requi re Kerberos preauthenti cati on” set (UF_D O N T_REQ U I R E_PR EA UTH ) GetNPUsers.py -dc-ip 10.10.10.161 htb.local/ Get TGT hash, for those users with such configuration GetNPUsers.py -request -dc-ip 10.10.10.161 htb.local/ Hashcat John the Ripper Get a shell Evil-winrm psexec Brute force discovery of users, passwords and password spray Kerbrute Metasploit auxiliary/gather/kerberos_enumusers Exploiting Kerberos GetNPUsers.py ASREPRoasting Get Hashes Shares Enum smbclient Crack the hashes Elevate Privileges Secretsdump NTDS.DIT secrets dump Pass-the-Hash psexec evil-winrm Get system shell Easy-win Strategy crackmapexec check where you can authenticate Abuse WriteDACL permissions ntlmrelayx PowerView SQL Injection Broken Authentication Cross-Site Scripting (XSS) XML External Entities (XXE) Security Misconfiguration OWASP Top Ten Sensitive Data Exposure Broken Access Control Insecure Deserialization Using Components with Known Vulnerabilities Insufficient Logging & Monitoring dirbuster BurpSuite nmap Search for 'key' 'keys' 'password' 'passw' Response tab navigate all directories Response Headers HTTP Strict Transport Security (HSTS) https://securityheaders.com nmap --script=ssl-enum-ciphers -p 443 tesla.com Session Fixation Credential Stuffing Brute Forcing or other automated attacks Weak or well-known Passwords Weak or Ineffective Credential Recovery Weak forgot-password processes Missing or Ineffective two-factor authentication Session ID exposed in URL knowledge-based answers Does not rotate Session ID after successful login Dows not properly invalidate Session IDs during logout or inactivity User Sessions or Authentication Tokens Find all directories Parameterized Statements Sanitized Input Blind SQL Injection Attacking Systems that parse XML Input Abuse SYSTEM entity and get malitious dos, local file disclosure, remote code execution, and more User gets access to somewhere they shouldn't Are you able to bypass access ? unauthenticated, authenticated, admin Can you access admin areas or even other user areas from an account ? IDOR - Insecure Direct Object Reference Default Credentials Stack Traces - Error Handling Unnecessary features Out-of-date Software Unnecessary ports open, activated accounts Disclosure of Sensitive Information Application should not throw errors Left behind applications Default features not in use Deprecated Interface File upload Left behind directories Reflected XSS Stored XSS DOM XSS Client-side Server-side Preventing XSS Encoding Filtering Validating Sanitization Serialization Deserialization ysoserial No Patching, no fix, no update Software is vulnerable, unsuported, or out of date No frequent scan for vulnerabilities Have Logs, Auditable Events Track anyone logging into the application Track failed login attempts Monitor if anyine is attacking your application Serialization Walk around Rogue Devices Guest Network No password Separation of networks Reduced funtionalities Access Employs' things / IPs / servers How well is the network segmented Hacking Process Place wireless card in monitor mode Discover info about network Select network and capture data Perform Deauth attack Capture WPA handshake Attempt to crack the handshake Strength evaluation Channel BSSID Speed-up the process WPS Company Name Phone numbers Street address Create a wordlist from thei website WPA2 PSK Substitute 1 with i. 0 with O Many companies use something familiar to them CEWL Weak Passwords rockyou.txt Channel 1, 6 and 11 are the most used (no overlap) SSID Open network Hidden networks Evaluate what networks are around Legal Documents and Report Writing Sales https://www.youtube.com/watch?v=EOoBAq6z4Zk 'How to' video on writing a pentest report https://github.com/hmaverickadams/TCM-Security-Sample-Pentest-Report Sample Pentest Report https://github.com/trustedsec/physical-docs Legal Documentation for Physical Security Testing scylla.sh leakedsource.ru scylla.sh email:*bbc.co.uk email:username* Before you test After you test Rules of Engagement (ROE) Findings Report Mutual Non-Disclosure Agreement (NDA) Master Service Agreement (MSA) Statement of Work (SOW) Others: Sample Report, Recommendation Letters etc.. Common Legal Documents Performance Objectives Outline the Responsabilities Rapid7 MSA example https://www.rapid7.com/legal/msa/ Activities Deliverables Timelines Quotation What we can and can't do What we can and can't attack (IP addresses) Will cover specifics of you testing Common 'don'ts' Denial of Service Social Engineering often set aside as its own assessment unless that's a specific thing the client wants to test You can not start your penetration test until the Rules of Engagement document is signed It's Snapshot in time Assessment Overview (high level) Assessments Components We are not responsible for anything happening after We are under a time limited engagement We are targeting what we can in that period of time What we are attacking What type of penetration test it is Timeframe Guidelines Phases of Pentest Planning Discovery Attacking Reporting Findings Severity Ratings Scope Scope Exclusions No Denial of Service attacks IPs Client Allowances Executive Summary Technical Summary Did the client had to assist us in any way ? C-level executive CISO CEO Intended for people with no technical background Share technical details Intended for technical people Attack Summary Quick summary about vulnerabilities you found, and what they could lead to Actions Recommendations What you managed to do Security Strengths Security Weaknesses Give them kudos where they need it We were scanning they identified and blocked us Missing Multi-Factor Authentication Weak Password Policy Unrestricted Logon Attempts Identify weaknesses at a high level No-technical people will understand Charts Vulnerabilities by Impact Exploitation Proof of Concept Chained exploit of attacks References Remediation Who Vector Action Additional Reports and Scans (Informational)

Recommended

Requirement for creating a Penetration Testing Lab
Requirement for creating a Penetration Testing LabRequirement for creating a Penetration Testing Lab
Requirement for creating a Penetration Testing Lab
Syed Ubaid Ali Jafri
 
Protecting web aplications with machine learning and security fabric
Protecting web aplications with machine learning and security fabricProtecting web aplications with machine learning and security fabric
Protecting web aplications with machine learning and security fabric
DATA SECURITY SOLUTIONS
 
Introduction To OWASP
Introduction To OWASPIntroduction To OWASP
Introduction To OWASP
Marco Morana
 
Spring Security 3
Spring Security 3Spring Security 3
Spring Security 3
Jason Ferguson
 
OTG - Practical Hands on VAPT
OTG - Practical Hands on VAPTOTG - Practical Hands on VAPT
OTG - Practical Hands on VAPT
shiriskumar
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testing
Amine SAIGHI
 
Forti web
Forti webForti web
Forti web
Lan & Wan Solutions
 
Presentation f5 – beyond load balancer
Presentation f5 – beyond load balancerPresentation f5 – beyond load balancer
Presentation f5 – beyond load balancer
xKinAnx
 

Recommended

Requirement for creating a Penetration Testing Lab
Requirement for creating a Penetration Testing LabRequirement for creating a Penetration Testing Lab
Requirement for creating a Penetration Testing Lab
Syed Ubaid Ali Jafri
 
Protecting web aplications with machine learning and security fabric
Protecting web aplications with machine learning and security fabricProtecting web aplications with machine learning and security fabric
Protecting web aplications with machine learning and security fabric
DATA SECURITY SOLUTIONS
 
Introduction To OWASP
Introduction To OWASPIntroduction To OWASP
Introduction To OWASP
Marco Morana
 
Spring Security 3
Spring Security 3Spring Security 3
Spring Security 3
Jason Ferguson
 
OTG - Practical Hands on VAPT
OTG - Practical Hands on VAPTOTG - Practical Hands on VAPT
OTG - Practical Hands on VAPT
shiriskumar
 
Introduction to penetration testing
Introduction to penetration testingIntroduction to penetration testing
Introduction to penetration testing
Amine SAIGHI
 
Forti web
Forti webForti web
Forti web
Lan & Wan Solutions
 
Presentation f5 – beyond load balancer
Presentation f5 – beyond load balancerPresentation f5 – beyond load balancer
Presentation f5 – beyond load balancer
xKinAnx
 
Nikto
NiktoNikto
Nikto
Sorina Chirilă
 
Kali linux useful tools
Kali linux useful toolsKali linux useful tools
Kali linux useful tools
milad mahdavi
 
Owasp zap
Owasp zapOwasp zap
Owasp zap
ColdFusionConference
 
Burp suite
Burp suiteBurp suite
Burp suite
SOURABH DESHMUKH
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineering
intertelinvestigations
 
SOC and SIEM.pptx
SOC and SIEM.pptxSOC and SIEM.pptx
SOC and SIEM.pptx
SandeshUprety4
 
Owasp zap
Owasp zapOwasp zap
Owasp zap
penetration Tester
 
How to hack wireless internet connections using aircrack-ng
How to hack wireless internet connections using aircrack-ngHow to hack wireless internet connections using aircrack-ng
How to hack wireless internet connections using aircrack-ng
Open Knowledge Nepal
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Networking and penetration testing
Networking and penetration testingNetworking and penetration testing
Networking and penetration testing
Mohit Belwal
 
OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)
TzahiArabov
 
DCSF19 Container Security: Theory & Practice at Netflix
DCSF19 Container Security: Theory & Practice at NetflixDCSF19 Container Security: Theory & Practice at Netflix
DCSF19 Container Security: Theory & Practice at Netflix
Docker, Inc.
 
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowdCVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
Casey Ellis
 
Introduction to burp suite
Introduction to burp suiteIntroduction to burp suite
Introduction to burp suite
Utkarsh Bhargava
 
Static Analysis Security Testing for Dummies... and You
Static Analysis Security Testing for Dummies... and YouStatic Analysis Security Testing for Dummies... and You
Static Analysis Security Testing for Dummies... and You
Kevin Fealey
 
Evil Twin Demonstration
Evil Twin DemonstrationEvil Twin Demonstration
Evil Twin Demonstration
Eric Goldman
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jain
Suvrat Jain
 
CNIT 124 Ch 13: Post Exploitation (Part 1)
CNIT 124 Ch 13: Post Exploitation (Part 1)CNIT 124 Ch 13: Post Exploitation (Part 1)
CNIT 124 Ch 13: Post Exploitation (Part 1)
Sam Bowne
 
Security testing fundamentals
Security testing fundamentalsSecurity testing fundamentals
Security testing fundamentals
Cygnet Infotech
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
Kangaroot
 
Understanding Active Directory Enumeration
Understanding Active Directory EnumerationUnderstanding Active Directory Enumeration
Understanding Active Directory Enumeration
Daniel López Jiménez
 
Intro To Hacking
Intro To HackingIntro To Hacking
Intro To Hacking
nayakslideshare
 

More Related Content

What's hot

Nikto
NiktoNikto
Nikto
Sorina Chirilă
 
Kali linux useful tools
Kali linux useful toolsKali linux useful tools
Kali linux useful tools
milad mahdavi
 
Owasp zap
Owasp zapOwasp zap
Owasp zap
ColdFusionConference
 
Burp suite
Burp suiteBurp suite
Burp suite
SOURABH DESHMUKH
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineering
intertelinvestigations
 
SOC and SIEM.pptx
SOC and SIEM.pptxSOC and SIEM.pptx
SOC and SIEM.pptx
SandeshUprety4
 
Owasp zap
Owasp zapOwasp zap
Owasp zap
penetration Tester
 
How to hack wireless internet connections using aircrack-ng
How to hack wireless internet connections using aircrack-ngHow to hack wireless internet connections using aircrack-ng
How to hack wireless internet connections using aircrack-ng
Open Knowledge Nepal
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
Michael Nickle
 
Networking and penetration testing
Networking and penetration testingNetworking and penetration testing
Networking and penetration testing
Mohit Belwal
 
OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)
TzahiArabov
 
DCSF19 Container Security: Theory & Practice at Netflix
DCSF19 Container Security: Theory & Practice at NetflixDCSF19 Container Security: Theory & Practice at Netflix
DCSF19 Container Security: Theory & Practice at Netflix
Docker, Inc.
 
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowdCVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
Casey Ellis
 
Introduction to burp suite
Introduction to burp suiteIntroduction to burp suite
Introduction to burp suite
Utkarsh Bhargava
 
Static Analysis Security Testing for Dummies... and You
Static Analysis Security Testing for Dummies... and YouStatic Analysis Security Testing for Dummies... and You
Static Analysis Security Testing for Dummies... and You
Kevin Fealey
 
Evil Twin Demonstration
Evil Twin DemonstrationEvil Twin Demonstration
Evil Twin Demonstration
Eric Goldman
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jain
Suvrat Jain
 
CNIT 124 Ch 13: Post Exploitation (Part 1)
CNIT 124 Ch 13: Post Exploitation (Part 1)CNIT 124 Ch 13: Post Exploitation (Part 1)
CNIT 124 Ch 13: Post Exploitation (Part 1)
Sam Bowne
 
Security testing fundamentals
Security testing fundamentalsSecurity testing fundamentals
Security testing fundamentals
Cygnet Infotech
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
Kangaroot
 

What's hot (20)

Nikto
NiktoNikto
Nikto
 
Kali linux useful tools
Kali linux useful toolsKali linux useful tools
Kali linux useful tools
 
Owasp zap
Owasp zapOwasp zap
Owasp zap
 
Burp suite
Burp suiteBurp suite
Burp suite
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineering
 
SOC and SIEM.pptx
SOC and SIEM.pptxSOC and SIEM.pptx
SOC and SIEM.pptx
 
Owasp zap
Owasp zapOwasp zap
Owasp zap
 
How to hack wireless internet connections using aircrack-ng
How to hack wireless internet connections using aircrack-ngHow to hack wireless internet connections using aircrack-ng
How to hack wireless internet connections using aircrack-ng
 
SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Networking and penetration testing
Networking and penetration testingNetworking and penetration testing
Networking and penetration testing
 
OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)OWASP Top 10 2021 Presentation (Jul 2022)
OWASP Top 10 2021 Presentation (Jul 2022)
 
DCSF19 Container Security: Theory & Practice at Netflix
DCSF19 Container Security: Theory & Practice at NetflixDCSF19 Container Security: Theory & Practice at Netflix
DCSF19 Container Security: Theory & Practice at Netflix
 
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowdCVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
CVE-2021-44228 Log4j (and Log4Shell) Executive Explainer by cje@bugcrowd
 
Introduction to burp suite
Introduction to burp suiteIntroduction to burp suite
Introduction to burp suite
 
Static Analysis Security Testing for Dummies... and You
Static Analysis Security Testing for Dummies... and YouStatic Analysis Security Testing for Dummies... and You
Static Analysis Security Testing for Dummies... and You
 
Evil Twin Demonstration
Evil Twin DemonstrationEvil Twin Demonstration
Evil Twin Demonstration
 
Ethical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jainEthical Hacking n VAPT presentation by Suvrat jain
Ethical Hacking n VAPT presentation by Suvrat jain
 
CNIT 124 Ch 13: Post Exploitation (Part 1)
CNIT 124 Ch 13: Post Exploitation (Part 1)CNIT 124 Ch 13: Post Exploitation (Part 1)
CNIT 124 Ch 13: Post Exploitation (Part 1)
 
Security testing fundamentals
Security testing fundamentalsSecurity testing fundamentals
Security testing fundamentals
 
Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)Elastic SIEM (Endpoint Security)
Elastic SIEM (Endpoint Security)
 

Similar to Ethical hacking mind map

Understanding Active Directory Enumeration
Understanding Active Directory EnumerationUnderstanding Active Directory Enumeration
Understanding Active Directory Enumeration
Daniel López Jiménez
 
Intro To Hacking
Intro To HackingIntro To Hacking
Intro To Hacking
nayakslideshare
 
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
Priyanka Aash
 
Server hardening
Server hardeningServer hardening
Server hardening
Teja Babu
 
Low Hanging Fruit, Making Your Basic MongoDB Installation More Secure
Low Hanging Fruit, Making Your Basic MongoDB Installation More SecureLow Hanging Fruit, Making Your Basic MongoDB Installation More Secure
Low Hanging Fruit, Making Your Basic MongoDB Installation More Secure
MongoDB
 
Windows network
Windows networkWindows network
Windows network
Jithesh Nair
 
Module 8 System Hacking
Module 8 System HackingModule 8 System Hacking
Module 8 System Hacking
leminhvuong
 
Dear Hacker: Infrastructure Security Reality Check
Dear Hacker: Infrastructure Security Reality CheckDear Hacker: Infrastructure Security Reality Check
Dear Hacker: Infrastructure Security Reality Check
Paula Januszkiewicz
 
Install ldap server
Install ldap serverInstall ldap server
Install ldap server
Mawardi 12
 
Install ldap server
Install ldap serverInstall ldap server
Install ldap server
Mawardi 12
 
Linux advanced privilege escalation
Linux advanced privilege escalationLinux advanced privilege escalation
Linux advanced privilege escalation
Jameel Nabbo
 
The Infosec Revival
The Infosec RevivalThe Infosec Revival
The Infosec Revival
scriptjunkie
 
The Infosec Revival
The Infosec RevivalThe Infosec Revival
The Infosec Revival
scriptjunkie
 
Null bhopal Sep 2016: What it Takes to Secure a Web Application
Null bhopal Sep 2016: What it Takes to Secure a Web ApplicationNull bhopal Sep 2016: What it Takes to Secure a Web Application
Null bhopal Sep 2016: What it Takes to Secure a Web Application
Anant Shrivastava
 
InSecure Remote Operations - NullCon 2023 by Yossi Sassi
InSecure Remote Operations - NullCon 2023 by Yossi SassiInSecure Remote Operations - NullCon 2023 by Yossi Sassi
InSecure Remote Operations - NullCon 2023 by Yossi Sassi
Yossi Sassi
 
Reconnaissance - For pentesting and user awareness
Reconnaissance - For pentesting and user awarenessReconnaissance - For pentesting and user awareness
Reconnaissance - For pentesting and user awareness
Leon Teale
 
Windows network security
Windows network securityWindows network security
Windows network security
Information Technology
 
13. Neville Varnham - PeopleSoft Cyber Security
13. Neville Varnham - PeopleSoft Cyber Security13. Neville Varnham - PeopleSoft Cyber Security
13. Neville Varnham - PeopleSoft Cyber Security
Cedar Consulting
 
MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ LandMongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
MongoDB
 
Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]
RootedCON
 

Similar to Ethical hacking mind map (20)

Understanding Active Directory Enumeration
Understanding Active Directory EnumerationUnderstanding Active Directory Enumeration
Understanding Active Directory Enumeration
 
Intro To Hacking
Intro To HackingIntro To Hacking
Intro To Hacking
 
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
(SACON) Sudarshan Pisupati & Sahir Hidayatullah - active deception sacon
 
Server hardening
Server hardeningServer hardening
Server hardening
 
Low Hanging Fruit, Making Your Basic MongoDB Installation More Secure
Low Hanging Fruit, Making Your Basic MongoDB Installation More SecureLow Hanging Fruit, Making Your Basic MongoDB Installation More Secure
Low Hanging Fruit, Making Your Basic MongoDB Installation More Secure
 
Windows network
Windows networkWindows network
Windows network
 
Module 8 System Hacking
Module 8 System HackingModule 8 System Hacking
Module 8 System Hacking
 
Dear Hacker: Infrastructure Security Reality Check
Dear Hacker: Infrastructure Security Reality CheckDear Hacker: Infrastructure Security Reality Check
Dear Hacker: Infrastructure Security Reality Check
 
Install ldap server
Install ldap serverInstall ldap server
Install ldap server
 
Install ldap server
Install ldap serverInstall ldap server
Install ldap server
 
Linux advanced privilege escalation
Linux advanced privilege escalationLinux advanced privilege escalation
Linux advanced privilege escalation
 
The Infosec Revival
The Infosec RevivalThe Infosec Revival
The Infosec Revival
 
The Infosec Revival
The Infosec RevivalThe Infosec Revival
The Infosec Revival
 
Null bhopal Sep 2016: What it Takes to Secure a Web Application
Null bhopal Sep 2016: What it Takes to Secure a Web ApplicationNull bhopal Sep 2016: What it Takes to Secure a Web Application
Null bhopal Sep 2016: What it Takes to Secure a Web Application
 
InSecure Remote Operations - NullCon 2023 by Yossi Sassi
InSecure Remote Operations - NullCon 2023 by Yossi SassiInSecure Remote Operations - NullCon 2023 by Yossi Sassi
InSecure Remote Operations - NullCon 2023 by Yossi Sassi
 
Reconnaissance - For pentesting and user awareness
Reconnaissance - For pentesting and user awarenessReconnaissance - For pentesting and user awareness
Reconnaissance - For pentesting and user awareness
 
Windows network security
Windows network securityWindows network security
Windows network security
 
13. Neville Varnham - PeopleSoft Cyber Security
13. Neville Varnham - PeopleSoft Cyber Security13. Neville Varnham - PeopleSoft Cyber Security
13. Neville Varnham - PeopleSoft Cyber Security
 
MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ LandMongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
MongoDB World 2019: Tutorial: A Journey to Magical Security Creatures’ Land
 
Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]Carlos García - Pentesting Active Directory [rooted2018]
Carlos García - Pentesting Active Directory [rooted2018]
 

Recently uploaded

Game Concept Presentation for Ukrainian Mythology Based Game With Designs
Game Concept Presentation for Ukrainian Mythology Based Game With DesignsGame Concept Presentation for Ukrainian Mythology Based Game With Designs
Game Concept Presentation for Ukrainian Mythology Based Game With Designs
184804
 
Storytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design ProcessStorytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design Process
Chiara Aliotta
 
Top Interior Designers in Bangalore.pdf1
Top Interior Designers in Bangalore.pdf1Top Interior Designers in Bangalore.pdf1
Top Interior Designers in Bangalore.pdf1
Decomart Studio
 
International Upcycling Research Network advisory board meeting 4
International Upcycling Research Network advisory board meeting 4International Upcycling Research Network advisory board meeting 4
International Upcycling Research Network advisory board meeting 4
Kyungeun Sung
 
AHMED TALAAT ARCHITECTURE PORTFOLIO .pdf
AHMED TALAAT ARCHITECTURE PORTFOLIO .pdfAHMED TALAAT ARCHITECTURE PORTFOLIO .pdf
AHMED TALAAT ARCHITECTURE PORTFOLIO .pdf
talaatahm
 
Practical eLearning Makeovers for Everyone
Practical eLearning Makeovers for EveryonePractical eLearning Makeovers for Everyone
Practical eLearning Makeovers for Everyone
Bianca Woods
 
UNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptx
UNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptxUNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptx
UNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptx
GOWSIKRAJA PALANISAMY
 
Heuristics Evaluation - How to Guide.pdf
Heuristics Evaluation - How to Guide.pdfHeuristics Evaluation - How to Guide.pdf
Heuristics Evaluation - How to Guide.pdf
Jaime Brown
 
Timeless Principles of Good Design
Timeless Principles of Good DesignTimeless Principles of Good Design
Timeless Principles of Good Design
Carolina de Bartolo
 
Graphic Design Tools and Software .pptx
Graphic Design Tools and Software .pptxGraphic Design Tools and Software .pptx
Graphic Design Tools and Software .pptx
Virtual Real Design
 
Connect Conference 2022: Passive House - Economic and Environmental Solution...
Connect Conference 2022: Passive House - Economic and Environmental Solution...Connect Conference 2022: Passive House - Economic and Environmental Solution...
Connect Conference 2022: Passive House - Economic and Environmental Solution...
TE Studio
 
EASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANE
EASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANEEASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANE
EASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANE
Febless Hernane
 
CocaCola_Brand_equity_package_2012__.pdf
CocaCola_Brand_equity_package_2012__.pdfCocaCola_Brand_equity_package_2012__.pdf
CocaCola_Brand_equity_package_2012__.pdf
PabloMartelLpez
 
NHR Engineers Portfolio 2023 2024 NISHANT RATHI
NHR Engineers Portfolio 2023 2024 NISHANT RATHINHR Engineers Portfolio 2023 2024 NISHANT RATHI
NHR Engineers Portfolio 2023 2024 NISHANT RATHI
NishantRathi18
 
UNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptx
UNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptxUNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptx
UNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptx
GOWSIKRAJA PALANISAMY
 
Revolutionizing the Digital Landscape: Web Development Companies in India
Revolutionizing the Digital Landscape: Web Development Companies in IndiaRevolutionizing the Digital Landscape: Web Development Companies in India
Revolutionizing the Digital Landscape: Web Development Companies in India
amrsoftec1
 
一比一原版(BU毕业证)波士顿大学毕业证如何办理
一比一原版(BU毕业证)波士顿大学毕业证如何办理一比一原版(BU毕业证)波士顿大学毕业证如何办理
一比一原版(BU毕业证)波士顿大学毕业证如何办理
peuce
 
Virtual Tour Application Powerpoint for museum of edinburgh
Virtual Tour Application Powerpoint for museum of edinburghVirtual Tour Application Powerpoint for museum of edinburgh
Virtual Tour Application Powerpoint for museum of edinburgh
millarj46
 
SECURING BUILDING PERMIT CITY OF CALOOCAN.pdf
SECURING BUILDING PERMIT CITY OF CALOOCAN.pdfSECURING BUILDING PERMIT CITY OF CALOOCAN.pdf
SECURING BUILDING PERMIT CITY OF CALOOCAN.pdf
eloprejohn333
 
Technoblade The Legacy of a Minecraft Legend.
Technoblade The Legacy of a Minecraft Legend.Technoblade The Legacy of a Minecraft Legend.
Technoblade The Legacy of a Minecraft Legend.
Techno Merch
 

Recently uploaded (20)

Game Concept Presentation for Ukrainian Mythology Based Game With Designs
Game Concept Presentation for Ukrainian Mythology Based Game With DesignsGame Concept Presentation for Ukrainian Mythology Based Game With Designs
Game Concept Presentation for Ukrainian Mythology Based Game With Designs
 
Storytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design ProcessStorytelling For The Web: Integrate Storytelling in your Design Process
Storytelling For The Web: Integrate Storytelling in your Design Process
 
Top Interior Designers in Bangalore.pdf1
Top Interior Designers in Bangalore.pdf1Top Interior Designers in Bangalore.pdf1
Top Interior Designers in Bangalore.pdf1
 
International Upcycling Research Network advisory board meeting 4
International Upcycling Research Network advisory board meeting 4International Upcycling Research Network advisory board meeting 4
International Upcycling Research Network advisory board meeting 4
 
AHMED TALAAT ARCHITECTURE PORTFOLIO .pdf
AHMED TALAAT ARCHITECTURE PORTFOLIO .pdfAHMED TALAAT ARCHITECTURE PORTFOLIO .pdf
AHMED TALAAT ARCHITECTURE PORTFOLIO .pdf
 
Practical eLearning Makeovers for Everyone
Practical eLearning Makeovers for EveryonePractical eLearning Makeovers for Everyone
Practical eLearning Makeovers for Everyone
 
UNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptx
UNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptxUNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptx
UNIT V ACTIONS AND COMMANDS, FORMS AND CONTROLS.pptx
 
Heuristics Evaluation - How to Guide.pdf
Heuristics Evaluation - How to Guide.pdfHeuristics Evaluation - How to Guide.pdf
Heuristics Evaluation - How to Guide.pdf
 
Timeless Principles of Good Design
Timeless Principles of Good DesignTimeless Principles of Good Design
Timeless Principles of Good Design
 
Graphic Design Tools and Software .pptx
Graphic Design Tools and Software .pptxGraphic Design Tools and Software .pptx
Graphic Design Tools and Software .pptx
 
Connect Conference 2022: Passive House - Economic and Environmental Solution...
Connect Conference 2022: Passive House - Economic and Environmental Solution...Connect Conference 2022: Passive House - Economic and Environmental Solution...
Connect Conference 2022: Passive House - Economic and Environmental Solution...
 
EASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANE
EASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANEEASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANE
EASY TUTORIAL OF HOW TO USE CAPCUT BY: FEBLESS HERNANE
 
CocaCola_Brand_equity_package_2012__.pdf
CocaCola_Brand_equity_package_2012__.pdfCocaCola_Brand_equity_package_2012__.pdf
CocaCola_Brand_equity_package_2012__.pdf
 
NHR Engineers Portfolio 2023 2024 NISHANT RATHI
NHR Engineers Portfolio 2023 2024 NISHANT RATHINHR Engineers Portfolio 2023 2024 NISHANT RATHI
NHR Engineers Portfolio 2023 2024 NISHANT RATHI
 
UNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptx
UNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptxUNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptx
UNIT IV-VISUAL STYLE AND MOBILE INTERFACES.pptx
 
Revolutionizing the Digital Landscape: Web Development Companies in India
Revolutionizing the Digital Landscape: Web Development Companies in IndiaRevolutionizing the Digital Landscape: Web Development Companies in India
Revolutionizing the Digital Landscape: Web Development Companies in India
 
一比一原版(BU毕业证)波士顿大学毕业证如何办理
一比一原版(BU毕业证)波士顿大学毕业证如何办理一比一原版(BU毕业证)波士顿大学毕业证如何办理
一比一原版(BU毕业证)波士顿大学毕业证如何办理
 
Virtual Tour Application Powerpoint for museum of edinburgh
Virtual Tour Application Powerpoint for museum of edinburghVirtual Tour Application Powerpoint for museum of edinburgh
Virtual Tour Application Powerpoint for museum of edinburgh
 
SECURING BUILDING PERMIT CITY OF CALOOCAN.pdf
SECURING BUILDING PERMIT CITY OF CALOOCAN.pdfSECURING BUILDING PERMIT CITY OF CALOOCAN.pdf
SECURING BUILDING PERMIT CITY OF CALOOCAN.pdf
 
Technoblade The Legacy of a Minecraft Legend.
Technoblade The Legacy of a Minecraft Legend.Technoblade The Legacy of a Minecraft Legend.
Technoblade The Legacy of a Minecraft Legend.
 

Ethical hacking mind map

  • 1. Penetration Testing Scanning & Enumeration Exploitation Reconaissance Scanning Nmap Netdiscover arp-scan Active Directory Brute Force Attacks Email Address Gathering Identify Target Hunter.io (Domain Search) bugcrowd.com Maintaining Access Persistence Scripts Scheduled Tasks Add a user Enumeration HTTP/HTTPS SMB SSH Crdential Stuffing Post-Exploitation Pivoting Covering Tracks Make the System/Network as it was when you entered it Remove executables, scripts, and added files Remove malware, rootkits, and added user accounts Set settings back to original configurations Breached Credentials OSINT Subdomains Sublist3r crt.sh OWASP Amass Identify Website Technologies Information Gathering with Burp Suite Google Fu Social Media Overview Target Validation Finding Subdomains Fingerprinting Data Breaches WHOIS nslookup dnsrecon Google Fu dig Nmap Sublist3r Bluto crt.sh Nmap Wappalyzer WhatWeb BuiltWith Netcat HaveIbeenPwned Breach-Parse WeLeakInfo Breach-Parse Tomnomnom HTTPprobe BuiltWith Wappalizer whatweb LinkedIn Twitter The Harvester Masscan Metasploit Nessus Nikto Dirbuster Dirb Gobuster Source Code Burp Suite Msfconsole - smb_version smbclient enum4linux (not working properly) Connection attempt Vulnerability Research Google Searchsploit Exploit Database Metasploit - search Password Spraying Metasploit Hydra Hashes Dumping / Cracking SAM SAM SECURITY SYSTEM secretsdump John Hashcat crackmapexec psexec Pass-The-Hash Pass-The-Hash Eternal Blue MS17_010 Metasploit smb_ms17_010 AutoBlue alternative to metasploit smbclient Credentials Kiwi Metasploit Mimikats Tokens Stealing & Manipulation Metasploit Incognito FTP Password dumping Hash dumping Golden Tickets Password dumping in memory Password dumping Password dumping in memory Hash dumping Golden Tickets Default Creds Common Bad Password List Word List Generator CEWL Buffer Overflow Spiking Fuzzing Finding the Offset Overwriting the EIP Finding Bad Characters Finding the Right Module Generating Shellcode / Getting Root LLMNR Poisoning Capturing NTLMv2 Hashes Password Cracking (Hashcat) Defences SMB Relay Attacks Host Discovery SMB Signing Disabled Disable LLMNR and NBT-NS Require Network Access Control Require Strong User Passwords LLMNR NBT-NS DNS/MDNS Responder Responder Nessus Gain Shell Access Responder ntlmrelayx Nmap script Privilege Escalation anonymous access binary Network ipconfig /all arp -a route print netstat -ano Davtest Test Server upload WEB Web Applications Finding Subdomains Find Alive Domains SQL Injection XXS https://github.com/danielmiessler/SecLists https://github.com/initstring/passphrase-wordlist SAM Hashes Dump Interactive shell -i Command execute -c Execute .exe file -e Crack offline Pass-the-Hash HTTP Off SMB Off msfvenom Reverse shell Netcat Powershell msf web_delivery other meterpreter Defences Enable SMB signing on all devices Disable NTLM Authentication Account tiering It will completely stop the attack Performance issues with file copy Stops the attack If Kerberos stops working, back to NTLM Admin only logging into their accounts / servers / domain controllers Local Admin restriction No local Admin prevent lateral movement msfconsole psexec.py smbexec.py wmiexec.py exploit/windows/smb/psexec exploit/windows/smb/psexec_psh AV noisy Less noisy / Half-shell Less noisy / Half-shell IPv6 Attacks LDAP Relay mitm6 ntlmrelayx aclpwn restore info dump (loot folder) new user creation on DC delegate access Defenses Other Attack Vectors and Strategies Disable IPv6 Disable wpad if not in use Enable LDAP signing and channel binding Put admin users into the protected users group Possible unwanted side effects Define Block Rules / instead of Allow Rules usually not enabled prevent impersonation or delegation Day begins with Early morning Lunch time mitm6 Responder Early morning Lunch time Easy win See how the network responds Are they giving us hashes ? Are those hashes easy to crack ? Easy win If LMNR is disabled might have had Pentest before might know common attacks Nessus scan Nmap scan HTTP_Version (Metasploit) Use this if scans are taking too long Sweep entire network for websites Less likely to be picked-up Loot at logins Check for default creds Look for printers might get domain admin off Scan-to-computer feature Is user domain admin on that printer ? dump creds in clear text get passwords for SMB user using individual user accounts Lot of people don't secure their printers Jenkins Instances Often wide open Check for Vulns Looking for hashes Get loot back Get account created on Domain Controller Try all possible ways in Look for SMB open / signing disbled Pickup targets / hashes for SMB Relay attacks Morning Afternoon Relay hashes Search for low hanging fruits Think outside the box Enumerate as much as you can Don't just focus on the exploit Initial Attack Vectors Post-Compromise Attack Enumeration PowerView Bloodhound Pass-the-Hash Pass-the-Password Dump the Hashes crackmapexec Pwn3d! crackmapexec Metasploit psexec meterpreter hashdump no cracking needed secretsdump Crack NTLM Hashes Hashcat SAM Dumping get a shell not Pwn3d! Try get a shell with Psexec Dump local SAM hashes no SMB access Pwn3d! or green [+] Try to authenticate with Psexec not Pwn3d! no SMB access LSA Secrets Dumping DPAPI_SYSTEM KEY Pass Attack Limit account re-use Utilize strong passwords Privilege Access Management (PAM) Avoid re-using local admin password Disable Guest and Administrator accounts Limit who is a local administrator The longer the better (>14 characters) Avoid using common words I like long sentences Check out/in sensitive accounts when needed Automatically rotate passwords on check out and check in Limits pass attacks as hash/password is strong and costantly rotated Mitigation Token Impersonation Token Impersonation Cannot pass NTLMv2 Mimikatz Meterpreter - Incognito Limit user/group token creation permissions Account tiering Local admin restriction Kerberoasting GPP / cPassword Mimikatz Kerberoasting Strong Passwords Least privilege Request TGT, provide NTLM hash Receive TGT encrypted with krbtgt hash Request TGS for Server (Presents TGT) Receive TGS encrypted with Server's account hash Crack the hash GetUserSPNs.py smb_enum_gpp module in Metasploit gpp_decrypt Groups.xml Invoke-GPP smbclient prompt off recurse on mget * cpassword Golden Ticket Credential Dumping Pass-the-Hash Over-Pass-the-Hash Pass-the-Ticket Silver Ticket privilege::debug LSA dump sekurlsa::logonpasswords ntds.dit Usernames NTLM Logged in accounts wdigest lsadump::sam lsadump::sam /patch lsadump::lsa /patch SAM dump sam dump not working shell with Metasploit secretsdump.py just download the SAM Passwords Why do we dump ? Crack passwords offline Golden Ticket attack % we are able to crack weak password policy strong password policy Kerberos Ticket Granting Ticket crackmapexec crack with secretsdump.py windows/system32/config/SAM windows/system32/config/SECURITY windows/system32/config/SYSTEM Pull down krbtgt account SID NTLM lsadump::lsa /inject /name:krbtgt Golden Ticket Pass-the-Ticket Silver Ticket opens cmd prompt Access any computer dir THEPUNISHERc$ PsExec64.exe -accepteula THEPUNISHER cmd.exe shell psexec.exe misc::cmd Stealthier Features Persistence net user hacker password123 /add run scheduleme run schtaskabuse run persistence -h exploit/windows/local/persistence exploit/windows/local/registry_persistence Metasploit proxychains SSH Pivoting psexec run autoroute -s 169.254.0.0/24 run autoroute -p connect to target route print ipconfig arp -a use auxiliary/scanner/portscan/tcp poc Wi-Fi WPA2 PSK WPA2 Enterprise Assetfinder Amass ./run.sh tesla.com HTTProbe Screenshot Websites GoWitness Subdomain takeover Subjack Scraping Wayback data Waybackurls Enumeration Users Enumeration nmap --script=smb-enum-users.nse GetADUsers.py -dc-ip 10.10.10.161 htb.local/ kerbrute userenum --dc 10.10.222.155 -d spookysec.local usernames.txt -t 100 Attempt to list and get TGTs for those users that have the property “D o not requi re Kerberos preauthenti cati on” set (UF_D O N T_REQ U I R E_PR EA UTH ) GetNPUsers.py -dc-ip 10.10.10.161 htb.local/ Get TGT hash, for those users with such configuration GetNPUsers.py -request -dc-ip 10.10.10.161 htb.local/ Hashcat John the Ripper Get a shell Evil-winrm psexec Brute force discovery of users, passwords and password spray Kerbrute Metasploit auxiliary/gather/kerberos_enumusers Exploiting Kerberos GetNPUsers.py ASREPRoasting Get Hashes Shares Enum smbclient Crack the hashes Elevate Privileges Secretsdump NTDS.DIT secrets dump Pass-the-Hash psexec evil-winrm Get system shell Easy-win Strategy crackmapexec check where you can authenticate Abuse WriteDACL permissions ntlmrelayx PowerView SQL Injection Broken Authentication Cross-Site Scripting (XSS) XML External Entities (XXE) Security Misconfiguration OWASP Top Ten Sensitive Data Exposure Broken Access Control Insecure Deserialization Using Components with Known Vulnerabilities Insufficient Logging & Monitoring dirbuster BurpSuite nmap Search for 'key' 'keys' 'password' 'passw' Response tab navigate all directories Response Headers HTTP Strict Transport Security (HSTS) https://securityheaders.com nmap --script=ssl-enum-ciphers -p 443 tesla.com Session Fixation Credential Stuffing Brute Forcing or other automated attacks Weak or well-known Passwords Weak or Ineffective Credential Recovery Weak forgot-password processes Missing or Ineffective two-factor authentication Session ID exposed in URL knowledge-based answers Does not rotate Session ID after successful login Dows not properly invalidate Session IDs during logout or inactivity User Sessions or Authentication Tokens Find all directories Parameterized Statements Sanitized Input Blind SQL Injection Attacking Systems that parse XML Input Abuse SYSTEM entity and get malitious dos, local file disclosure, remote code execution, and more User gets access to somewhere they shouldn't Are you able to bypass access ? unauthenticated, authenticated, admin Can you access admin areas or even other user areas from an account ? IDOR - Insecure Direct Object Reference Default Credentials Stack Traces - Error Handling Unnecessary features Out-of-date Software Unnecessary ports open, activated accounts Disclosure of Sensitive Information Application should not throw errors Left behind applications Default features not in use Deprecated Interface File upload Left behind directories Reflected XSS Stored XSS DOM XSS Client-side Server-side Preventing XSS Encoding Filtering Validating Sanitization Serialization Deserialization ysoserial No Patching, no fix, no update Software is vulnerable, unsuported, or out of date No frequent scan for vulnerabilities Have Logs, Auditable Events Track anyone logging into the application Track failed login attempts Monitor if anyine is attacking your application Serialization Walk around Rogue Devices Guest Network No password Separation of networks Reduced funtionalities Access Employs' things / IPs / servers How well is the network segmented Hacking Process Place wireless card in monitor mode Discover info about network Select network and capture data Perform Deauth attack Capture WPA handshake Attempt to crack the handshake Strength evaluation Channel BSSID Speed-up the process WPS Company Name Phone numbers Street address Create a wordlist from thei website WPA2 PSK Substitute 1 with i. 0 with O Many companies use something familiar to them CEWL Weak Passwords rockyou.txt Channel 1, 6 and 11 are the most used (no overlap) SSID Open network Hidden networks Evaluate what networks are around Legal Documents and Report Writing Sales https://www.youtube.com/watch?v=EOoBAq6z4Zk 'How to' video on writing a pentest report https://github.com/hmaverickadams/TCM-Security-Sample-Pentest-Report Sample Pentest Report https://github.com/trustedsec/physical-docs Legal Documentation for Physical Security Testing scylla.sh leakedsource.ru scylla.sh email:*bbc.co.uk email:username* Before you test After you test Rules of Engagement (ROE) Findings Report Mutual Non-Disclosure Agreement (NDA) Master Service Agreement (MSA) Statement of Work (SOW) Others: Sample Report, Recommendation Letters etc.. Common Legal Documents Performance Objectives Outline the Responsabilities Rapid7 MSA example https://www.rapid7.com/legal/msa/ Activities Deliverables Timelines Quotation What we can and can't do What we can and can't attack (IP addresses) Will cover specifics of you testing Common 'don'ts' Denial of Service Social Engineering often set aside as its own assessment unless that's a specific thing the client wants to test You can not start your penetration test until the Rules of Engagement document is signed It's Snapshot in time Assessment Overview (high level) Assessments Components We are not responsible for anything happening after We are under a time limited engagement We are targeting what we can in that period of time What we are attacking What type of penetration test it is Timeframe Guidelines Phases of Pentest Planning Discovery Attacking Reporting Findings Severity Ratings Scope Scope Exclusions No Denial of Service attacks IPs Client Allowances Executive Summary Technical Summary Did the client had to assist us in any way ? C-level executive CISO CEO Intended for people with no technical background Share technical details Intended for technical people Attack Summary Quick summary about vulnerabilities you found, and what they could lead to Actions Recommendations What you managed to do Security Strengths Security Weaknesses Give them kudos where they need it We were scanning they identified and blocked us Missing Multi-Factor Authentication Weak Password Policy Unrestricted Logon Attempts Identify weaknesses at a high level No-technical people will understand Charts Vulnerabilities by Impact Exploitation Proof of Concept Chained exploit of attacks References Remediation Who Vector Action Additional Reports and Scans (Informational)