> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/enumeration.md). # Enumeration Common enumeration techniques. Copy and past the commands into your terminal and substitute example.com with your desired website and/or domain name whatis ``` whatis example.com ``` Whatweb ``` whatweb example.com ``` whois ``` whois example.com ``` dnsrecon ``` dnsrecon -d example.com ``` Wafw00f: Web application firewall detection ``` wafw00f example.com ``` sublist3r: A subdomains enumeration tool ``` sublist3r -d example.com -e google,yahoo ``` Uses the tool theHarvester to gather information on the domain "example.org" from Google, LinkedIn, Yahoo, and DNS Dumpster. ``` theHarvester -d hackersploit.org -b google.com,linkedin,yahoo,dnsdumpster ``` `haveibeenpwned.com :`Checks if an email address or username has been compromised in a data breach. Uses Nmap to perform host discovery without running a portscan on the IP range 192.168.2.0/24. ``` sudo nmap -sn 192.168.2.0/24 ``` Uses Netdiscover to perform host discovery on the IP range 10.0.2.0/24 using the network interface "eth0". ``` sudo netdiscover -I eth0 -r 10.0.2.0/24 ``` ### Enumerating DNS ``` nslookup ``` ### Attempting a zone transfer ``` host -l ``` ### Using SMBmap to enumerate shares ``` smbmap -H ``` ### Attempting anonymous login on SMB share ``` smbclient //active.htb/Replication -N ``` 1. `smbclient`: This is the command used to interact with SMB/CIFS (Common Internet File System) servers. It allows you to connect to and manage shared resources on remote servers, typically used in a Unix or Linux environment. 2. `//active.htb/Replication`: This part of the command specifies the location of the shared folder you want to access: * `//`: The double forward slashes indicate the beginning of the server and share path. * `active.htb`: This is the hostname or IP address of the SMB server you want to connect to. In this case, it's "active.htb." * `/Replication`: This is the name of the shared folder (or share) you want to access. You can replace "Replication" with the actual name of the shared folder you want to connect to. 3. `-N`: This is an option that tells `smbclient` to connect to the SMB server without providing a username and password. It's used for anonymous access. If the shared resource allows guest or anonymous access, this option allows you to connect without authentication. ### Downloading files to local machine with SMBClient ``` get ``` ### Logging in using SMBclient with username and password ``` smbclient -W -U /// ``` ### Logging in with NFS ``` showmount -e TARGET_IP ``` ### Using the mount command ``` mount -t nfs NFS_SERVER_IP:/REMOTE_EXPORT_PATH LOCAL_MOUNT_POINT ``` * `mount`: This is the command used to mount file systems in Unix-like operating systems. * `-t nfs`: This is an option for the `mount` command that specifies the type of file system to mount, which is NFS in this case. * `NFS_SERVER_IP`: This is the IP address of the NFS server you want to connect to. Replace it with the actual IP address of the NFS server. * `:/REMOTE_EXPORT_PATH`: This part of the command specifies the source NFS share on the server. It consists of two components separated by a colon: * `NFS_SERVER_IP`: The IP address of the NFS server. * `/REMOTE_EXPORT_PATH`: The path to the directory or file you want to mount from the NFS server. Replace it with the actual path you want to mount. * `LOCAL_MOUNT_POINT`: This is the local directory on your system where the NFS share will be mounted. You can choose any existing empty directory as the mount point on your local system. Replace it with the actual path of your desired mount point. ### Using Gobuster to search an IIS server ``` gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 30 -u http://10.10.10.151:80 -o gobuster.out -x aspx,asp ``` ### Recursively grabbing files with SMB ``` recurse on prompt off mget * ``` ### Using allinfo command in SMB ``` smb: \[Path_to_Directory]\> allinfo "[File_Name]" ``` * `[Path_to_Directory]`: This is where users should specify the path to the directory where the target file is located on the SMB server. * `[File_Name]`: This is where users should provide the name of the file for which they want to retrieve detailed information. Enclose the file name in double quotes if it contains spaces or special characters. ### Try searchsploit for software versions in the resulting Nmap scan ### Enumerating LDAP ``` root@kali:~/Desktop/htb/lightweight# locate ldap-search /usr/share/nmap/scripts/ldap-search.nse ``` ### Using the script ``` nmap -p 389 --script ldap-search 10.10.10.161 ``` ### Using Dig to attempt a zone transfer ``` dig axfr ``` 1. `dig`: The `dig` command is used for querying DNS servers. 2. `axfr`: This is an option used with `dig` to specify that you want to perform a DNS zone transfer (AXFR). 3. ``: Replace this with the IP address of the DNS server from which you want to perform the DNS zone transfer. This is the DNS server you want to query for zone data. 4. ``: Replace this with the domain name for which you want to perform the zone transfer. This is the domain for which you want to obtain DNS zone data. ### Finding a file size ``` du -hs ``` ``` du -hs * ```