Skip to content

Latest commit

 

History

History
318 lines (258 loc) · 8.89 KB

Pentest-Methodology.md

File metadata and controls

318 lines (258 loc) · 8.89 KB

Fenrir Pentest Methodology

"Tools are the subtlest of traps. We become reliant upon them and in their absence we are vulnerable, weak, defenseless*

The 6 Phases

  • Pre-engagement
  • Intelligence Gathering (Reconnaissance)
  • Scanning
  • Exploitation
  • Post Exploitation
  • Reporting

Pre Engagement

Hardware

Wi-Fi Adapter Supporting packet injection

https://null-byte.wonderhowto.com/how-to/buy-best-wireless-network-adapter-for-wi-fi-hacking-2019-0178550/

  • TPLink Adapter

Software

Infrastructure

  • VMware
  • Virtualbox
  • QEMU/KVM
    • Windows 10 VM
    • Kali/Blackarch/ParrotOS VM

Assessment

  • Maltego - Maltego is an interactive data mining tool that renders directed graphs for link analysis.
  • Metasploit Framework - collection of remote exploits and post exploitation tools for all platforms
  • SET toolkit - designed to perform advanced attacks against the human element.
  • theHarvester - gathering e-mail accounts, user names and hostnames/subdomains from different public sources
  • mimikat - extract plain or hash of password.
  • dig - bind-utils
  • THC Hydra - for brute force
  • Powersploit - a collection of Microsoft PowerShell modules
  • CrackmapExec - post exploitation tools for Active Directory.
  • Burpsuite - can use as proxy as well as active scanner
  • Empire - powershell framework for remote and post exploitation.
  • Nmap - port scanner
  • knockpy - subdomain scanner
  • netcat - network utility
  • nishang - post exploitation powershell Framework

(more on https://github.com/FenrirSec/fenrir-tools)

Checklist

  • Determination of the type of pentest (Blackbox, Whitebox)
  • Key objectives behind this penetration test
  • Location address and contact (if it is an onsite job)
  • Validation that the Authorization Letter has been signed
  • URL of the web application that is in scope and validation that isaccessible
  • 2 sets of credentials (normal and admin or a privilege user) and validation that are working
  • Determination of the environment (Production or UAT)
  • Number of static and dynamic pages
  • Testing Boundaries (DoS, Brute force attacks etc.)
  • Technologies (PHP, ASP, .NET, IIS, Apache, Operating system etc.)
  • Any VPN or port numbers are needed and verify those ahead of time
  • Any web services that the site may use.
  • Any pages that the client does not want to be tested.
  • Any pages that submit emails
  • IP address of the tester
  • Escalation contact
  • 3rd parties that needs to be contacted in advance of the pentest
  • Web application firewalls and other IDS in place
  • Timeframe of the assessment (dates and hours)
  • Diagrams and any kind of documentation
  • Validation that a backup has been performed recently on theapplication
  • Other client requirements

Reconnaissance

Certificates transparency enumeration - https://securitytrails.com/list/apex_domain/fenrir.agency

Ressources

Scanning

Automatic Vuln scanners

Manual Scanner

  • nmap
  • Metaploit Framework

SSL scanners

  • testssh.sh
  • sslscan

Guides

Credential Spraying

Exploitation

AD exploitation

List of world-writables directories on Windows : https://gist.github.com/mattifestation/5f9de750470c9e0e1f9c9c33f0ec3e56

Write enumeration scripts with ADSI : https://dev-2null.github.io/Easy-Domain-Enumeration-with-ADSI/

Windows Evasion

https://jxy-s.github.io/herpaderping/

Initial Intrusion

Wapp/API Testing

WiFI

Post Exploitation

Windows

======= https://www.infosecmatter.com/powershell-commands-for-pentesters/

  • Windows sysinternals net use Z: https://live.sysinternals.com

Password dumping

  • Pwdump7
  • TBAL DPAIP Backdoor for local user
  • Dumping Domain Password
  • Dumping ClearText Creds
  • Empire Tips and Trick
  • Extract Remote Hash
  • Capturing NetNTML

AD

  • The worst of both worlds
  • pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy
  • Beyond LLMNR/NBNS Spoofing
  • Gathering AD Data with Powershell
  • kerberosting without mimikatz
  • Kerberost
  • Golden Ticket
  • pass-the-ticket
  • Gaining Domain Admin Rights
  • Attacking Kerberos : kicking the guard dog of hades
  • Token Impersonation

Privilege Escalation

  • https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite
  • Windows Privilege Escalation Fundamentals by FuzzySecurity
  • DLL Hijacking
  • Potato
  • RottenPotatoNG
  • Privilege Escalation Guide
  • Lateral Movement
  • RDP tunneling
  • SQL Server Link Crawling
  • Lateral Movement WinRM
  • CrackeMapExec
  • RDP Inception
  • RDP Lateral Movement
  • Powerview and crackmapExec
  • Persistent payload
  • port forwarding with netsh
  • The Trustpocalypse
  • DcShadow Explained
  • Domain Trust: Why You Should Care
  • A Guide to Attacking Domain Trusts
  • Javascript C2

Bypass techniques

  • evading autorun
  • mimikatz obfuscation
  • Putting data in Alternate data streams and how to execute it
  • Leveraging INF-SCT Fetch
  • Empire without powershell
  • Powershell without powershell
  • Exploitation Code Injection
  • Powershell to bypass Constraint mode
  • Bypass Constraint Mode with runscripthelper
  • InternetExplorer.Application for C2
  • We Don't Need Powershell.exe Part 2
  • WSH Injection

MISC

  • Borrowing Microsoft Code Signing Certificates
  • Guide to Attacking Domain Trust

Linux

Privilege Escalation

  • Basic Linux Privilge escalation by g0tmi1k
  • Exploit Database
  • Attack and Defend : Linux Privilege Escalation
  • SUID executable
  • Guide to Linux Privilege Escaltion
  • LDAP
  • Understand and Exploit web based LDAP
  • Web based LDAP injection
  • Lateral Movement
  • SSH port forwarding
  • SSH & meterpreter port forward
  • Tunneling & port forwarding

Web Shell

  • webshell
  • p0wny

Data Exfil

  • awesome-red-teaming
  • out of band Exploitation

Reporting

Ressources