Cybersecurity

Enumeration and Recon

Active scanning, passive intelligence gathering, and target enumeration.

13 snippets

bash1 min read

FTP enumeration

Gathering as much information as possible on an FTP server and attempt to gain access via a misconfiguration or weak credentials

#ftp
#enumeration
#nmap
+4

text1 min read

Google dorking cheat sheet

Search operators for surfacing exposed files, directories, and forgotten dev portals via Google.

#google-dorks
#osint
#passive-recon
+2

nmap1 min read

Host discovery & network mapping workflow

The recon sequence that is in the beggining of any penetration test.

#nmap
#host-discovery
#network-mapping
+2

sql1 min read

MySQL enumeration

Version fingerprinting, schema dumping, and brute-forcing MySQL servers.

#mysql
#sql
#enumeration
+3

bash2 min read

Passive information gathering & OSINT

What to collect about a target before probing it directly

#osint
#passive-recon
#dns
+10

bash1 min read

RDP enumeration

Confirm an RDP server is running and brute-force user accounts.

#rdp
#enumeration
#windows
+3

bash1 min read

SMB & NetBIOS enumeration

Full command reference for enumerating SMB shares, users, sessions and OS info.

#smb
#netbios
#enumeration
+7

bash1 min read

SMTP enumeration

Version fingerprinting and user enumeration on SMTP servers.

#smtp
#enumeration
#nmap
+2

bash1 min read

SNMP enumeration

Query SNMP-enabled devices for system data, users, and network config via community strings.

#snmp
#enumeration
#nmap
+1

bash1 min read

SSH enumeration

Version/algorithm fingerprinting, user enumeration, and brute-forcing on SSH servers.

#ssh
#enumeration
#nmap
+2

msfconsole1 min read

From service version to working exploit

The workflow connecting enumeration results to an actual exploit: MSF search, searchsploit, Nessus, WMAP, db_autopwn.

#vulnerability-scanning
#metasploit
#searchsploit
+1

bash1 min read

Web server & HTTP enumeration

Directory brute-forcing, header/version fingerprinting, and HTTP-verb testing against a web target.

#http
#web
#enumeration
+8

bash1 min read

WinRM enumeration

Confirm WinRM is running and brute-force credentials for remote Windows management access.

#winrm
#enumeration
#windows
+2