View difference between Paste ID: dyap3srg and JZdCHrN4

-#################
+############################################################
-# Passive Recon #
+# Pentester Academy External Security Testing Walk-Through #
-#################
+############################################################
 
-- Wikipedia Page
+My good friend Vivek Ramachandran asked me to do a set a videos for Pentester Academy.
-	- Are they Public or Private?
+
-	- Does the target have any subsidiaries?
+Vivek is a such a dear friend so I couldn't say no. I sincerely hope that you guys find this valuable.
-    	- Have they had any scandals?
+
 
-- Robtex
+If you want to follow along with me you can use this Pastebin for all of the download links for the slides, the virtual machine, and the list of all of the commands I will be covering today.
-	- Show system map
+
 Here are the slides I am using today:
 https://s3.amazonaws.com/StrategicSec-Files/PentesterAcademy/1-External+Scanning.pdf
-###################################################
+
-# Day 1: Identifying External Security Mechanisms #
+
-###################################################
+
 # VMWare #
-- I prefer to use Putty to SSH into my Linux host.
+
-- You can download Putty from here:
+- For this workshop you'll need the latest version of VMWare Workstation (Windows), Fusion (Mac), or Player.
-- http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
+
 - A 30-day trial of Workstation 11 can be downloaded from here:
-Here is the information to put into putty
+- https://my.vmware.com/web/vmware/info/slug/desktop_end_user_computing/vmware_workstation/11_0
 
-Host Name:          107.191.39.106
+- A 30-day trial of Fusion 7 can be downloaded from here:
-protocol:           ssh
+- https://my.vmware.com/web/vmware/info/slug/desktop_end_user_computing/vmware_fusion/7_0
-port:               22
+
-username:           ceh
+- The newest version of VMWare Player can be downloaded from here:
-password:           passtheceh
+- https://my.vmware.com/web/vmware/free#desktop_end_user_computing/vmware_player/7_0
 
 - Although you can get the VM to run in VirtualBox, I will not be supporting this configuration for this class.
 
 
 ################################
----------------------------Type This-----------------------------------
+# Download the virtual machine #
 ################################
 https://s3.amazonaws.com/StrategicSec-VMs/Strategicsec-Ubuntu-VPN-163.zip
 username: strategicsec
 password: strategicsec
 
 
 ############################################
-http://whois.domaintools.com/
+# Identifying External Security Mechanisms #
 ############################################
 
 Performing an external penetration test today is significantly harder than it was years ago.
 
----------------------------Type This-----------------------------------
+There are so many external security mechanisms such as load balancers, reverse proxies, intrusion prevention systems, and web application firewalls.
-dig axfr @nsztm1.digi.ninja zonetransfer.me
+
 Ok, let's do this!
 
 
-./ipcrawl 148.87.1.1 148.87.1.254
+
 ###########################
 # Target IP Determination #
 ###########################
 cd /home/strategicsec/toolz
 perl blindcrawl.pl -d motorola.com
 
 -- Take each IP address and look ip up here:
 http://www.networksolutions.com/whois/index.jsp
 
 cd ~/toolz/fierce2
 fierce -dns motorola.com
 cd ..
 
-########################
+
-# Scanning Methodology #
+dig axfr heartinternet.co.uk  @ns.heartinternet.co.uk
-########################
+
 
-- Ping Sweep
+
-What's alive?
+./ipcrawl 148.87.1.1 148.87.1.254				(DNS forward lookup against an IP range)
-------------
+
 
----------------------------Type this command-----------------------------------
+
-sudo nmap -sP 157.166.226.*
+
--------------------------------------------------------------------------------
+
 
 
 ###########################
-   -if -SP yields no results try:
+
----------------------------Type this command-----------------------------------
+
-sudo nmap -sL 157.166.226.*
+
--------------------------------------------------------------------------------
+
 	- http://toolbar.netcraft.com/site_report/
 	- Firefox LiveHTTP Headers (https://addons.mozilla.org/en-Us/firefox/addon/live-http-headers/)
 
-   -Look for hostnames:
+Here is an example:
----------------------------Type this command-----------------------------------
+http://toolbar.netcraft.com/site_report/?url=citigroup.com
-sudo nmap -sL 157.166.226.* | grep cnn
+
--------------------------------------------------------------------------------
+We found out that they are using a Citrix Netscaler Load Balancer.
 192.193.103.222         Citrix Netscaler
 192.193.219.58
 
-- Port Scan
+
-What's where?
+
-------------
+
----------------------------Type this command-----------------------------------
+dig google.com
-sudo nmap -sS 162.243.126.247
+
--------------------------------------------------------------------------------
+
 ./lbd-0.1.sh motorola.com
 
 
-- Bannergrab/Version Query
+
-What versions of software are running
+
--------------------------------------
+
 
----------------------------Type this command-----------------------------------
+
-sudo nmap -sV 162.243.126.247
+
--------------------------------------------------------------------------------
+# Intrusion Prevention Detection #
 ##################################
 
 
 osstmm-afd -P HTTP -t www.strategicsec.com -v
-- Vulnerability Research
+
-Lookup the banner versions for public exploits
+cat /etc/xinetd.d/ssltest
-----------------------------------------------
+
-https://www.exploit-db.com/search
+cat /home/strategicsec/toolz/ssl_proxy.sh
-http://securityfocus.com/bid
+
-https://packetstormsecurity.com/files/tags/exploit/
+service xinetd status
 
 osstmm-afd -P HTTP -t 127.0.0.1 -p 8888 -v
 
-Network Penetration Testing Process (known vulnerabilities)
+****** If you are getting your IP blocked you can use a service like AceVPN to give you multiple IPs to launches your tests from. ******
------------------------------------------------------------
+
 
 
-1. Ping Sweep:
+
-The purpose of this step is to identify live hosts
+
 ######################################
-    nmap -sP <ip-address/ip-range>
+
 cd ~/toolz/wafw00f
 python wafw00f.py http://www.oracle.com
-2. Port Scan
+python wafw00f.py http://www.strategicsec.com
-Identify running services. We use the running services to map the network topology.
+
 
-    nmap -sS <ip-address/ip-range>
+
 sudo nmap -p 80 --script http-waf-detect.nse oracle.com
 
-3. Bannergrab
+sudo nmap -p 80 --script http-waf-detect.nse imperva.com
-Identify the version of version of software running on each port
+
 
-    nmap -sV <ip-address/ip-range>
+
-
+
 ################################################
 # 3rd Party Scanning, and scanning via proxies #
-4. Vulnerability Research
+################################################
-Use the software version number to research and determine if it is out of date (vulnerable).
+
 https://www.shodan.io
-    exploit-db.com/search
+
         Create a FREE account and login
 
         net:129.188.8.0/24
 
 
 
 cd /home/strategicsec/toolz/
 perl proxyfinder-0.3.pl multiproxy 3 proxies.txt	<-- This takes a long time to run, but provides a good list of proxies
 
-Skill Level 1. Run the scanners
+
--------------------------------
+
-    Nexpose
+sudo vi /etc/proxychains.conf  				<--- Make sure that last line of the file is: ocks4  127.0.0.1 9050
-    Qualys
+
-    Retina
+
-    Nessus              known vulnerabilities
+
-    OpenVas
+
-    Foundscan
+
-    GFI LanGuard
+vi ~/toolz/fix-proxychains-dns.sh
-    NCircle
+
 #!/bin/bash
 # This script is called by proxychains to resolve DNS names
-Skill Level 2. Manual vulnerability validation (known vulnerabilities)
+# DNS server used to resolve names
 # Reference: http://carnal0wnage.attackresearch.com/2013/09/changing-proxychains-hardcoded-dns.html
 DNS_SERVER=4.2.2.2
-    windows ->  systeminfo
+
-    Linux->     dpkg -l
+if [ $# = 0 ] ; then
-                rpm -qa
+echo " usage:"
 echo " proxyresolv <hostname> "
-	Mac OS X -> sudo find / -iname *.app
+exit
 fi
 
 export LD_PRELOAD=libproxychains.so.3
 dig $1 @$DNS_SERVER +tcp | awk '/A.+[0-9]+\.[0-9]+\.[0-9]/{print $5;}'
 -----------------------------------------------------------------------
 
 
 sudo ntpdate pool.ntp.org
-	- http://toolbar.netcraft.com/site_report
+
-	- https://addons.mozilla.org/en-US/firefox/addon/live-http-headers/
+tor-resolve strategicsec.com
 
 proxychains nmap -sT -p80 204.244.123.113
 
----------------------------Type This-----------------------------------
+proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,445,1433,1521,3306,3389,8080,10000 204.244.123.113