Reconnaissance

Google Enum 

#Finding PGP and GnuPG Private Key rings
site:domain.com intitle:index.of intext:"secring.skr"| "secring.pgp" | "secring.bak"

#Shell History files in interesting domains
site:domain.com intitle:index.of bash_history

#Nessus Scan Results
intitle:"Nessus Scan Report" "This file was generated by Nessus"

SearchDiggity GUI tool

Finger Enumeration

Finger Enum Script
finger @10.10.10.76

perl finger-user-enum.pl -U ../../SecLists/Usernames/Names/names.txt -t 10.10.10.76

finger root@10.10.10.76

Enumerating Squid Proxy

nikto -h 10.10.10.10 -useproxy http://10.10.10.10:3128

get /etc/squid/squid.conf
get /etc/squid/squid.cgf
get /etc/squid/squid.config
Set a profile in foxy proxy to change to the squid proxy and add creds in it to access it properly. 


Burp Settings:

add upstream proxy --> 

destination: * 
host : IP_ADDRESS
port : 3128
Authentication type: Basic
Username: creds
Password: creds

Set foxyproxy to use burp

Go to proxy --> options --> Proxy listeners --> Add
Bind it to port: 80
Request handling  --> redirect to 127.0.0.1 & 80 

Droppescan Usage - Drupal Scan

./droopescan scan drupal -u 10.10.10.9 

File Transfer to Windows Webserver 

python /impacket/build/scripts-3.7/smbserver.py bhanu ~/Desktop/HTB/

SNMP Enum -- > Checklist

 Windows Version Information 

dig axfr @10.10.10.123 friendzoneportal.red

cat zonetransfer | grep friendzone | grep IN | awk '{print $1}' | sed 's/\.$//g' | sort -u > hosts

Mount a SMB Share when you have Credentials 

 mount -t cifs -o username=Finance,password=Acc0unting //10.10.10.59/ACCT /mnt/smb/


cd /mnt/smb/         //we can see the mounted data here
  
cp -r smb ~/Desktop/HTB/tally/     //Copy all the files to your drive

Iterate a number from 1 to 20 in the given Variable and check the difference 

 for i in $(seq 1 20); do echo -n "$i: "; curl -s http://10.10.10.10/index.php/jobs/apply/$i/ | grep '<title>';done

curl 10.11.1.71 -s -L | grep "title\|href" | sed -e 's/^[[:space:]]*//'    --> Get all the links from a page 

curl 10.11.1.71 -s -L | html2text -width '99' | uniq 

--> get Text in much better readable Format 

gobuster -u http://10.11.1.71/ -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,403,500' -e -x php
-->URL Brute forcing using Different word list and filtering with status codes

searchsploit --colour -t php 5.x | grep -v '/dos/' | grep -iv '\.php[^$]'

--> Search for PHP exploits using searchsploit ; remove .php unwanted files

Access a Binary from anywhere 

ln -s /root/Downloads/Tools/dirsearch/dirsearch.py /usr/local/bin/


#Change the binary location

echo $SHELL                  /Determine the shell

Download all the files from a FTP Directory using wget

wget --mirror 'ftp_user:password@10.10.10.10'