RECONNAISSANCE & ENUMERATION WEEK 2 RECONNAISSANCE & ENUMERATION

Admin Buy yourself an official DISC hoodie for only $30! https://dischoodies.getqpay.com/ Register for the CySCA competition https://docs.google.com/forms/d/e/1FAIpQLSfQ4zclfAckaCJ6I4NzOHhHuQfCi CZ3GPJoIq8MjrKG61FIkA/viewform New to CTF’s? Have a go at angstromCTF. It’s a beginner friendly ctf at a highschool level. Check out #ctfs on Slack Interested in Locksport? Join the Locksport Slack channel locksport.slack.com

Don’t miss out on CySCA!

Pre-reading/assumed knowledge Have a Kali Virtual Machine setup on your computer https://www.deakininfosec.com.au/blog/getting-started Understand the TCP/IP Model http://www.omnisecu.com/tcpip/tcpip-model.php Familiarize yourself with the Linux console https://linuxjourney.com/lesson/the-shell https://overthewire.org/wargames/bandit/

Using Linux https://highon.coffee/blog/linux-commands-cheat-sheet/ If you’re unsure about a command or how to use it, it’s as simple as typing: For a little help <command> -h <command> --help For mucho information: man <command>

Common Ports and Protocols Port 20/21: FTP FTP clients connect to port 21 on remote FTP servers to initiate file transfer operations. FTP servers run default on port 21, however like many other services, the listening port(s) can be customized to make it harder to find for an attacker. Port 23: Telnet A machine offering Telnet services is essentially offering to accept an "across the Internet" remote console terminal connection from any client device. This makes Telnet quite powerful and, without proper security, a significant security concern. An open telnet port is a massive vulnerability since it is not able to use public-key encryption like SSH. Port 22: SSH Secure shell remote login protocol provides a secure, encrypted channel to operate network services.

Common Protocols Port 80/443: HTTP/HTTPS GET - “Give me this webpage” HEAD - “Give me the page’s Headers” Headers are {key: value} pairs that define operating parameters POST - “Take this data that I’m sending you” Multiple tools that can be used to send/receive HTTP requests Burpsuite - GUI tool that can do everything web-related Netcat - Send custom raw data to any sockets cURL - Send custom HTTP requests

Passive Enumeration

OSINT (Open-Source Intelligence) Whois A browser based query and response tool that searches a domain name's publicly available registration and delegation details across the various public WHOIS databases. Dig (Domain information groper) Netcraft https://searchdns.netcraft.com/

Email Harvesting theharvester haveibeenpwned.com recon-ng Kali tool that scrapes the web for juicy emails. haveibeenpwned.com Lookup emails to see if they are contained in any major data breaches. recon-ng

Google Dorking The art of using the incredible hacking tool sometimes referred to as ‘Google’. At its simplest, searching web pages indexed by Google for information that may uncover vulnerabilities or lead to further compromise. https://www.sans.org/security-resources/GoogleCheatSheet.pdf https://www.exploit-db.com/google-hacking-database/

Other tools: Bettercap A powerful, modular, portable MiTM framework that allows you to perform various types of Man-In-The-Middle attacks against the network. It can also help to manipulate HTTP and HTTPS traffic in real-time

Other tools: Wireshark An open source network packet analyser (sniffer) Used to profile network traffic

Active Enumeration

NMap The go-to network security scanner Reference guide - https://highon.coffee/blog/nmap-cheat-sheet/ Host identification Port enumeration Enumerating services Powerful scripts The famous-test tool of all - https://nmap.org/movies/

Netcat Listening: nc -l -p port [-options] [hostname] [port] Connecting: nc [-options] hostname port[s] [ports] https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf

TCP/UDP Shells Reverse shell/Bind shell: Bind Shell - Shell sits on target and listens for incoming connections Reverse Shell - An open port on your machine listens for incoming connections from the target. Firewall rules are generally tighter on incoming connections, and allow more outgoing connections. https://highon.coffee/blog/reverse-shell-cheat-sheet/

Banner Grabbing telnet netcat nmap -sV --script=banner <target>