Skip to main content

Random Notes

By

 

 

 

Cracking an email password 

## Step 1
The first thing you'll want to do is to go to https://haveibeenpwned.com/ and https://dehashed.com/ to find data breaches your victim is in. 9/10 times, they will be in at least one data breach if you're using an email address they use to sign up for accounts.

## Step 2
You're gonna want to go to https://rf.ws/databases and find the databases they're in, and unlock them (they're all 8 credits, you get 1-2 credits from posting on the forums). Prioritize ones with weak hashing algorithms or plaintext passwords.

## Step 3
Once you have your databases, download glogg (https://glogg.bonnefon.org/download.html) and use it to search for your victim's email address in your databases. 7/10 times, your victim will be in a breach that stores plaintext passwords, or in Collection #1-5/Antipublic data, though if you only manage to get password hashes, you can use hashcat (https://hashcat.net/hashcat/) to crack them.
Cracking Machines with RDP Access

1- You need a good I.P. Scanner; Here's KPortScan-3.0 which will get the job done.

Download: https://anonfiles.com/1921x2E6od/KPortScan_3.0_zip

What it looks like:


https://imgur.com/a/TTvUyH7


Now, you need IP's.


Go to this Website: https://www.countryipblocks.net/country_selection.php


https://imgur.com/a/617VXyS


Then Select the Country you want the RDP's to be from


https://imgur.com/a/55oZ0HP


Next, Save the IP ranges and import them into KPORT that you downloaded earlier


https://imgur.com/a/w14SXQR


Import IP's, do not mess with default settings and click start!


When it's done, it will spit out a .txt file with all the IP's


Now, that we have that juicy juicy IP list, we need to start the brute process.


For this; We're going to use DUBrute


Download: https://anonfiles.com/L433x2Eeo6/DUBrute_zip


Run DUBRUTE and follow the steps in the following images:


https://imgur.com/a/QbEz3Op


Next, Import your IP List from KPORT


https://imgur.com/a/n6KEdlj


You're almost ready; if you're not satisfied with the preexisting common password list that is provided, simply find one off the forums.


Before starting, make sure you edit your settings in CONFIG of DEBRUTE; if you have 2GB ram, set the Threads to 100, if you have 4GB ram, Set the threads to 200; ect.


https://imgur.com/a/uq7qzOD


For the Usernames in Debrute Use the following generic common logins:

administrator

admin
admin1
user
user1
user2
test
test1
test2
remote
server
manager
root
support
scanner
scan
temp

For passwords use this common password list: https://throwbin.io/6IsoAzQ


Now just click START and good luck!


The successful cracks will be in a .txt in the same folder 

Comments

Post a Comment

Popular posts from this blog

SQL DB & SQL Injection Pentest Cheat Sheet

By
1) MSSQL Injection Cheat Sheet | pentestmonkey 2) xp_cmdshell | Red Team tales 3) PentesterMonkey SQL Injection Cheatsheet Use dbeaver for GUI Access 4) SQL Injection Explanation | Graceful Security Common Ports Microsoft SQL: 1433/TCP (default listener) 1434/UDP (browser service) 4022/TCP (service broker) 5022/TCP (AlwaysOn High Availability default) 135/TCP (Transaction SQL Debugger) 2383/TCP (Analysis Services) 2382/TCP (SQL Server Browser Service) 500,4500/UDP (IPSec) 137-138/UDP (NetBios / CIFS) 139/TCP (NetBios CIFS) 445/TCP (CIFS) Oracle SQL: 1521/TCP 1630/TCP 3938/HTTP MongoDB : 27017,27018,27019/TCP PostgreSQL: 8432/TCP MySQL: 3306/TCP SQL DB Enum with nmap: nmap -p 1433 —script ms-sql-info —script-args mssql.instance-port=1433 IP_ADDRESS nmap -Pn -n -sS —script=ms-sql-xp-cmdshell.nse IP_ADDRESS -p1433 —script-args mssql.username=sa,mssql.password=password,ms-sql-xp-cmdshell.cmd="net user bhanu bhanu123 /add" nmap -Pn -n -sS —script=ms-sql-xp-cmds...
Post a Comment
Read more

Host and Application locally and access it over the internet via ngrock

By
 ngrock creates a tunnel from your local machine to ngrock server and host it on the internet via their HTTPS url  Resister an account on ngrock and login #Download the client curl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok.asc \ | sudo tee /etc/apt/trusted.gpg.d/ngrok.asc >/dev/null \ && echo "deb https://ngrok-agent.s3.amazonaws.com buster main" \ | sudo tee /etc/apt/sources.list.d/ngrok.list \ && sudo apt update \ && sudo apt install ngrok #add the authToken ngrok config add-authtoken 2p7Oc #start a python server on your application python -m http.server 3000 #start the server - use the same port as the python server (3000 in below example) ngrok http http://localhost:3000 --request-header-add "ngrok-skip-browser-warning: true" Setting up a Request Header - Login to the application --> Univeral Gateway --> Edges - Create an Edge --> Request Headers --> `ngrok-skip-browser-warning :12 - go back to overv...
Post a Comment
Read more

Cloud Pentest Cheatsheet - Azure

By
Azure Cloud offers a comprehensive ecosystem of tools and services. Among its core components are: Azure Active Directory (AAD) Azure Resource Manager (ARM) Office 365 (O365) Initial Access Try to get a user credential via OSINT/Social engineering or try to comprise a web application hosted on Azure VM. Enumerate the roles attached to the VM and try to escalate your privileges.   Entra ID Directory Role Entra ID directory roles are predefined roles that grant permissions to perform specific tasks within an Azure AD tenant. These roles are essential for managing administrative tasks in Entra ID. Types of Roles: Built-in Directory Roles Global Administrator Application Administrator User Administrator Custom Directory Roles Accessing APIs in Azure Entra ID - Access via Microsoft Graph API Endpoint {HTTP method} https://graph.microsoft.com/{version}/{resource}?{query-parameters} Azure Resource Manager API Endpoint (ARM-specific) {HTTP method} https://management.azure...
Post a Comment
Read more