# Pentesting Notes and Snippets
## Recon
Copy pasta stuff I use for recon - both inside and outside of a target.
### Host Discovery
- Ping Sweeping:
```
IP_RANGE='192.168.0.0'
SUBNET_MASK='/24'
nmap -sn -oA onlineHosts "${IP_RANGE}/${SUBNET_MASK}"
```
```
`-sn`: Use ping scan for host discovery (don’t run a port scan)
`-oA`: Store output in normal, XML, and grepable file formats
```
- Parse IP Addresses from `gnmap` file
```
grep "^Host: " onlineHosts.gnmap | grep "Status: Up" | \
cut -d " " -f 2 | sort -n | uniq
```
- Skip ICMP checks
Use this when targets don’t respond to ping:
```
nmap -Pn "${TARGET_IP}"
```
`-Pn`: Skips the host discovery phase, and scans all addresses as if the system(s) were alive and responding to pings.
Useful when scanning an internet facing system.
**Resource:** [https://medium.com/@hakluke/haklukes-guide-to-nmap-port-scanning-is-just-the-beginning-25d971692fdb](https://medium.com/@hakluke/haklukes-guide-to-nmap-port-scanning-is-just-the-beginning-25d971692fdb)
### Test out of bound code execution with tcpdump
Use this: `tcpdump -i eth0 icmp and icmp[icmptype]=icmp-echo -vv` in conjunction with a ping command.
### Information Gathering
After host discovery, you can run the following to capture the discovered IP addresses in an array:
```
file=targets.gnmap
TARGET_IPS=($(grep "^Host: " $file | grep "Status: Up" | cut -d " " -f 2 | sort -n
| uniq))
```
After discovering what hosts are responding, you’ll want to know what ports they’re exposing.
There are many ways to accomplish this, but this is the process I tend to follow (depending on the target, engagement scope, etc.).
- Getting it done quickly with a SYN scan:
```
nmap -sS -p- "${TARGET_IP}"
```
`-sS`: SYN scan. Default choice, faster than TCP connect.
Does not complete the three way handshake, making it more stealthy. However, IPS/IDS and firewalls will detect and report a SYN scan.
`-p-`: Scan all 65535 ports - shorthand for `-p 1-65535`
If you’ve got the IP addresses in an array:
for ip in "${TARGET\_IPS\[@\]}"; do sudo nmap -sS -p- $ip; done
- When I want to be sure and am not worried about stealth:
Full three way handshake, not as fast as SYN scan and noisier. Considered most stable, and has least chance to crash the target.
```
nmap -sT -p- -Pn "${TARGET_IP}"
```
`-sT`: Run a TCP connect scan
`-sV`: Service version detection
`--version-intensity`: Used in conjunction with `-sV` to help identify running services.
The “intensity” value ranges between 0-9.
The higher the number, the more likely a service is to be properly identified. However, higher numbers also make scan times longer. Default number is 7.
- When I REALLY don’t care about stealth:
```
sudo nmap -A -p- -v "${TARGET_IP}"
```
`-A`: Enables OS detection, service version detection, script scanning, and traceroute
`-v`: Increase verbosity of output
- Version and OS enumeration:
```
sudo nmap -sV --version-intensity 9 -O
```
### Miscellaneous Nmap Stuff
Some useful nmap commands that don’t fit into any particular methodology I employ.
- Detailed scan
```
nmap -T4 -A -v -oA detailedScanResults "${IP_RANGE}/${SUBNET_MASK}"
```
`-T4`: Aggressive
`-oA`: Store output in normal, XML, and grepable file formats
- Single host TCP scan
```
nmap -Pn -sS --stats-every 3m --max-retries 1 \
--max-scan-delay 20 --defeat-rst-ratelimit \
-T4 -p- -oX $OUTPUT_FILENAME.xml $TAREGET
```
- Parse all ports out of xml output
Output will be returned as a comma separated list
```
cat $OUTPUT_FILENAME.xml | \
grep portid | \
grep protocol=\"tcp\" | \
cut -d'"' -f4 | paste -sd "," -
```
- Detailed single host TCP scan
Run this after running the above single host TCP scan.
```
nmap -nvv -Pn -sSV -T1 -p$(cat .xml | grep portid
| grep protocol=\"tcp\" | cut -d'"' -f4 | paste -sd "," -) --version-intensity 9
-A -oA