Penetration Flashcards
How could you perform a ping sweep on the 172.16.10.0/24 subnet?
nmap -sn 172.16.10.0/24
The ‘-sn’ option instructs Nmap to perform host discovery via ICMP but not perform a port scan afterwards.
How could you perform an ARP scan of hosts on the 172.16.10.0/24 subnet? Suppose your machine has multiple network interfaces and the relevant subnet is on the ‘br_public’ interface.
sudo arp-scan 172.16.10.0/24 -I br_public
arp-scan requires root privileges, hence the ‘sudo’
The ‘-I’ option is used to specify the interface for arp-scan to use.
The ‘-f’ option can also be used to specify a file as input.
The ‘-x’ or ‘–plain’ option suppresses header/footer text. This is good for when the results will be parsed by a script.
When provided with no special options, what type of scan will Nmap provide by default? Assume we’re scanning a domain/subnet.
- Half-open scan. (sending an initial SYN packet but not completing the full TCP handshake, meaning ACK won’t be sent back)
- Scan the top 1000 most commonly used ports. It won’t scan the entire port range of 0–65,534, to conserve resources.
- Scan only TCP ports. Nmap won’t scan UDP ports by default.
Which Nmap option can be used to provide a file containing target hosts as input?
Suppose we want to scan all of the hosts listed in the ‘./known-hosts.txt’ file.
nmap -iL known-hosts.txt
The targets in this file must be separated by newlines.
How could you use Nmap to scan the 192.168.0.0/24 subnet for the version of each detected service, only on open ports?
nmap -sV 192.168.0.0/24 –open
The ‘-sV’ option is used to determine version info of all detected services.
The ‘–open’ option filters for only ‘open’ ports.
How could you use Rustscan to perform a port scan of ports 1-1024 on each host in the 172.16.10.0/24 subnet? The output should be in a format that makes for easy parsing by Bash.
rustscan -g -a 172.16.10.0/24 -r 1-1024
The ‘-g’ option stands for ‘greppable’ and forces Rustscan to output only the port information (useful for parsing with grep or outputting to a file).
The ‘-a’ option (address) takes a target address or address range.
The ‘-r’ option takes a range of ports to scan.
How could you use Netcat to perform a scan of TCP ports 1-1024 on 172.16.10.11?
nc -zv 172.16.10.11 1-1024
The ‘z’ option stands for ‘zero I/O mode’ which tells Netcat not to send/receive any data. Aside from port scanning, Netcat can be used for sending/receiving raw data over network connections.
The ‘-v’ option simply stands for verbose, instructing Netcat to display port scanning results.
Suppose you want to perform a default Nmap scan on the hosts listed in the ‘172-16-10-hosts.txt’ file. You want the output to be printed to the console in a format that is easily parsed. How can you do this?
nmap -iL 172-16-10-hosts.txt -oG -
Normally the ‘-oG’ option is used to tell Nmap to format its output in an easily ‘greppable’ format. Passing ‘-‘ to ‘-oG’ rather than a file name tells Nmap to print this ‘greppable’ output directly to the console rather than to an output file.
Nmap can also output its results in XML format with the ‘-oX’ option.
The Nmap Scripting Engine (NSE) allows penetration testers to write scripts in the Lua language to extend Nmap’s capabilities.
Where are the preinstalled Lua scripts stored?
/usr/share/nmap/scripts
Nmap can use these scripts via the ‘–script’ option
Which Nmap option instructs Nmap to attempt to figure out the operating system of the target host?
-O
Suppose you’re scanning a web application with “WhatWeb” and you want to log the output as JSON to the terminal rather than log file. How can you do this?
Assume you’re scanning 172.16.10.10 on port 80.
whatweb 172.16.10.10:80 –log-json=/dev/stdout –quiet
This can then be easily parsed with ‘jq’
Sending data to the device file ‘/dev/stdout’ will force the output to go to STDOUT.
The ‘–quiet’ option will suppress whatweb’s normal output.
What is Directory Indexing in web security?
Directory indexing is a server-side setting that, instead of
a web page, lists files located at certain web paths. When
enabled, the directory indexing setting lists the content of a
directory when an index file is missing (such as index.html or
index.php).
Directory indexing could highlight sensitive files in an application, such as configuration files with connection strings, local database files (such as SQLite files), and other environmental files.
How could you run a basic Nikto scan of port 80 172.16.10.11?
nikto –host 172.16.10.11 –port 80
You can suppress Nikto from asking to submit updates by passing the following option at the command line:
~~~
–ask no
~~~
What is a “robots.txt” file?
The “robots.txt” file is a text file placed on a web server that provides instructions to web and search engine crawlers for which pages on the site they are allowed to access and which ones they should not crawl or index, essentially managing how search engines interact with a website and preventing them from accessing sensitive areas like login pages or internal directories.
How could you perform a directory search of the ‘172.16.10.10:80’ URL?
dirsearch -u 172.16.10.10:80
The ‘-u’ option stands for URL.
By default, dirsearch will create a subdirectory named ‘reports’ inside which it will create further subdirectories per URL to save directory search results.
