This is my notes from the Junior Pentesting course at TryHackMe. This course takes you through the basics and some advanced topics regarding penetration testing.
Remember to add -sn if you are only interested in host discovery without port-scanning. Omitting -sn will let Nmap default to port-scanning the live hosts.
Option
Purpose
-n
no DNS lookup
-R
reverse-DNS lookup for all hosts
-sn
host discovery only
NMAP Basic Port Scans
Open: indicates that a service is listening on the specified port.
Closed: indicates that no service is listening on the specified port, although the port is accessible. By accessible, we mean that it is reachable and is not blocked by a firewall or other security appliances/programs.
Filtered: means that Nmap cannot determine if the port is open or closed because the port is not accessible. This state is usually due to a firewall preventing Nmap from reaching that port. Nmap’s packets may be blocked from reaching the port; alternatively, the responses are blocked from reaching Nmap’s host.
Unfiltered: means that Nmap cannot determine if the port is open or closed, although the port is accessible. This state is encountered when using an ACK scan -sA.
Open|Filtered: This means that Nmap cannot determine whether the port is open or filtered.
Closed|Filtered: This means that Nmap cannot decide whether a port is closed or filtered.
TCP Flags
URG: Urgent flag indicates that the urgent pointer filed is significant. The urgent pointer indicates that the incoming data is urgent, and that a TCP segment with the URG flag set is processed immediately without consideration of having to wait on previously sent TCP segments.
ACK: Acknowledgement flag indicates that the acknowledgement number is significant. It is used to acknowledge the receipt of a TCP segment.
PSH: Push flag asking TCP to pass the data to the application promptly.
RST: Reset flag is used to reset the connection. Another device, such as a firewall, might send it to tear a TCP connection. This flag is also used when data is sent to a host and there is no service on the receiving end to answer.
SYN: Synchronize flag is used to initiate a TCP 3-way handshake and synchronize sequence numbers with the other host. The sequence number should be set randomly during TCP connection establishment.
FIN: The sender has no more data to send.
Timings
Timings
Description
T0
paranoid (0)
T1
sneaky (1)
T2
polite (2)
T3
normal (3)
T4
aggressive (4)
T5
insane (5)
Summary
Port Scan Type
Example Command
TCP Connect Scan
nmap -sT MACHINE_IP
TCP SYN Scan
sudo nmap -sS MACHINE_IP
UDP Scan
sudo nmap -sU MACHINE_IP
These scan types should get you started discovering running TCP and UDP services on a target host.
These scan types rely on setting TCP flags in unexpected ways to prompt ports for a reply. Null, FIN, and Xmas scan provoke a response from closed ports, while Maimon, ACK, and Window scans provoke a response from open and closed ports.
This is a continued series where I document my path through different tryhackme courses. I recommend everyone that wants to learn cyber security to subscribe to tryhackme.com and take the courses there. Table Of ContentsKey TermsWhy is Encryption importantRSA – Rivest Shamir AdlemanDigital signatures and CertificatesSSH AuthenticationExplaining Diffie Hellman Key ExchangePGP, GPG and AES Key…
Work in Progress Table Of ContentsCoursesSourcesCallback function listExample: Using CertEnumSystemStore EDR TelematryHijackLibsMalapi.ioNo-defenderNtDoc – The native NT API online documentationParasite-invokeReverse engineering of everything MicrosoftVergilius projectUnprotect.itEvasion techniquesWindows Icons Courses SEKTOR7 Institute https://maldevacademy.com/ EvasionEDR By Matt Hand Sources URL Description Category https://github.com/NUL0x4C/HellShell HellShell GitHub repository Penetration Testing https://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/#weapon Exploit writing tutorial on Corelan.be Exploit Development https://www.corelan.be/ Corelan.be website Cybersecurity…
This is my notes from the Junior Pentesting course at TryHackMe. This course takes you through the basics and some advanced topics regarding penetration testing. Table Of ContentsXSS PayloadsWhat is a payload?Proof of ConceptSession StealingKey LoggerExampleBusiness LogicReflected XSSExample ScenarioPotential ImpactHow to test for Reflected XSSStored XSSExample ScenarioHow to test for Stored XSSDOM Based XSSWhat is…
This is my notes from the Junior Pentesting course at TryHackMe. This course takes you through the basics and some advanced topics regarding penetration testing. Table Of ContentsWhat is an SSRF?Types of SSRFWhat’s the impact?SSRF ExamplesFinding an SSRFDefeating Common SSRF DefensesDeny ListAllow ListOpen Redirect What is an SSRF? SSRF stands for Server-Side Request Forgery. It’s…
This is my notes from the Junior Pentesting course at TryHackMe. This course takes you through the basics and some advanced topics regarding penetration testing. Table Of ContentsWhat is Command Injection?Discovering Command InjectionExploiting Command InjectionDetecting Blind Command InjectionLinux WindowsRemediating Command InjectionVulnerable FunctionsInput sanitisationBypassing FiltersPractical: Command InjectionWhat user is this application running as?What are the contents of…
This is my notes from the Junior Pentesting course at TryHackMe. This course takes you through the basics and some advanced topics regarding penetration testing. Table Of ContentsLinux Privilege escalation checklistEnumerationhostnameuname -a/proc/version/etc/issueps Commandenvsudo -llsId/etc/passwdhistoryifconfignetstatfind CommandFind files:General Linux CommandsAutomated Enumeration ToolsPrivilege Escalation: Kernel ExploitsHint/notes Privilege Escalation: SudoLeverage LD_PRELOADPrivilege Escalation: SUIDOption 1: Crack shadow hashOption 2: Add user…