Pentester Night School homework and attack plan

----------------------------------------------------

Here is the class webinar link:
https://attendee.gotowebinar.com/rt/752149900055661826


Here is the virtual machine for the class:
https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
user:      infosecaddicts
pass:      infosecaddicts


Here is the Pastebin from class:
https://pastebin.com/qnmbj04m


Here are the videos from the first 3 classes:
https://s3.amazonaws.com/infosecaddictsvideos/2017-08-14+19.13+Network+Pentester+Night+School.mp4
https://s3.amazonaws.com/infosecaddictsvideos/2017-08-15+19.07+Network+Pentester+Night+School.mp4
https://s3.amazonaws.com/infosecaddictsvideos/2017-08-16+19.15+Network+Pentester+Night+School.mp4

Day 1 Homework task:
Pastebin lines 61 - 210

Day 2 Homework task:
Pastebin lines 219 - 402

Day 3 Homework task:
Pastebin lines 762 - 1460


Homework due date:
Midnight 27th Aug 2017

----------------------------------------------------


Point me at a network at say go (with no network vulnerability scanners).

1. Look for quick hits. Use propecia to service sweep for ports that I know I know I have exploits for.
	propecia 192.168.0 1433		<-- I know I have a ton of stuff for MS SQL Server


2. Break down really large networks by ports into simple services to scan for (again with propecia)
propecia 172.31.6 445 >> /tmp/customerAudit/internal/scan/services/windows_hosts
propecia 172.31.6 21 >> /tmp/customerAudit/internal/scan/services/ftp_hosts
propecia 172.31.6 111 >> /tmp/customerAudit/internal/scan/services/sunrpc_hosts
propecia 172.31.6 23 >> /tmp/customerAudit/internal/scan/services/telnet_hosts
propecia 172.31.6 9100 >> /tmp/customerAudit/internal/scan/services/printserver_hosts
propecia 172.31.6 1433 >> /tmp/customerAudit/internal/scan/services/mssql_hosts
propecia 172.31.6 1521 >> /tmp/customerAudit/internal/scan/services/oracle_hosts
propecia 172.31.6 3306 >> /tmp/customerAudit/internal/scan/services/mysql_hosts

3. Then run my nmap scans/nse scripts with all of the options against those IPs
for x in `cat /tmp/customerAudit/internal/scan/services/windows_hosts` ; do nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect $x > /tmp/customerAudit/internal/scan/windows/$x ; done

Look in Lee Baird's discover script for all of this nmap nse magic.
https://github.com/leebaird/discover/blob/master/discover.sh
Start on line 1930


4. Turn nmap into Nessus (New way to do it):
cd ~/toolz
git clone https://github.com/scipag/vulscan.git
cd vulscan/
sudo nmap -sV -p 135,445 --script=/home/infosecaddicts/toolz/vulscan/vulscan.nse -iL ip_list.txt


5. ACTUALLY run Nessus (wide open full scan - while you are doing this stuff).
The reason for this is this will generate the report info that you need to give to the customer.
While the Nessus scan is running you'll be doing the following steps so you don't have to wait for Nessus to finish.


In Nessus you can sort by "Exploit Publicly Available", Exploit-DB, Metasploit
- Look for Exploit-DB ID, Metasploit ID in your reports. You'll notice this gets rid of half or more of your findings.




Point me at a website at say go (with no web app vulnerability scanners).

1. Look for quick hits. I use Google dorks for SQL injection and LFIs
Google for generic Database errors

site:example.com "Microsoft OLE DB Provider for SQL Server"
site:example.com "Microsoft JET Database Engine"
site:example.com "Type mismatch"
site:example.com "You have an error in your SQL syntax"
site:example.com "Invalid SQL statement or JDBC"
site:example.com "DorisDuke error"
site:example.com "OleDbException"
site:example.com "JasperException"
site:example.com "Fatal Error"
site:example.com "supplied argument is not a valid MySQL"
site:example.com "mysql_"
site:example.com ODBC
site:example.com JDBC
site:example.com ORA-00921
site:example.com ADODB






Google for generic RFIs

site:example.com ".php" "file="
site:example.com ".php" "folder="
site:example.com ".php" "path="
site:example.com ".php" "style="
site:example.com ".php" "template="
site:example.com ".php" "PHP_PATH="
site:example.com ".php" "doc="
site:example.com ".php" "document="
site:example.com ".php" "document_root="
site:example.com ".php" "pg="
site:example.com ".php" "pdf="
site:example.com ".php: "page="
site:example.com ".php: "inc="
site:example.com ".php: "dir="
site:example.com ".php: "frame="
site:example.com ".php: "swf="
site:example.com ".php: "host="