Latest notes for PenTesting- MrLeet


MrLeet provides materials allowing anyone to gain practical hands-on experience with digital security, computer applications and network administration tasks.

#!/usr/bin/python

import sys
import os
import subprocess

if len(sys.argv) != 3:
print "Usage: dirbust.py <target url> <scan name>"
sys.exit(0)

url = str(sys.argv[1])
name = str(sys.argv[2])
folders = ["/usr/share/dirb/wordlists", "/usr/share/dirb/wordlists/vulns"]

found = []
print...


Score: 0


#!/bin/bash
#Takes a list of URLs (without trailing slashes) or domains and runs the host command on them, sorting them by IP.
#strip=$(cat $1|sed 's/https\?:\/\///')
cat $1| while read line; do host "$line"; done |grep -E "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|sort -n -t " " -k 4
...


Score: 0


#!/bin/bash
# linuxenum-btr.sh > privesc-enum.txt seklinde kullanalim
# SCRIPTI /var/tmp DIZINI ALTINDA CALISTIRALIM
# EGER SCRIPTI KULLANICINIZIN HOME DIZINI ALTINDA CALISTIRIRSANIZ KENDINIZE
printf '\n======================================================='
printf '\nTEMEL BILGILER'
printf '\n====================...


Score: 0


#!/bin/bash
strip=$(echo $1|sed 's/https\?:\/\///')
echo ""
echo "##################################################"
host $strip
echo "##################################################"
echo ""
masscan -p1-65535 $(dig +short $strip|grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|head -...


Score: 0


#!/usr/bin/env python

# ######################################################################################################################
# This script is based on the script by [Mike Czumak](http://www.securitysift.com/offsec-pwb-oscp/). But it is heavily rewritten, some things have been added, other stuff has been removed. The script is ...


Score: 0


#!/usr/bin/python

###################################################
#
# RemoteRecon - written by Justin Ohneiser
# ------------------------------------------------
# Inspired by reconscan.py by Mike Czumak
#
# This program will conduct full reconnaissance
# on a target using three steps:
# 1. Light NMAP scan -> to identify servi...


Score: 0


# Active Information Gathering

- [DNS Enumeration](#dns-enumeration)
- [Interacting with a DNS Server](#interacting-with-a-dns-server)
- [Automating lookups](#automating-lookups)
- [Forward Lookup Brute Force](#forward-lookup-brute-force)
- [Reverse Lookup Brute Force](#reverse-lookup-brute-force)
- [DNS Zone Transfers](#dns-zon...


Score: 0


# Testing for configuration management (OWASP Guide)

## Table of content

- [Test Network/Infrastructure Configuration (OTG-CONFIG-001)](#test-network-infrastructure-configuration--otg-config-001-)
- [How to Test](#how-to-test)
- [Test Application Platform Configuration (OTG-CONFIG-002)](#test-application-platform-configuration--otg-config...


Score: 0


# DNS Enumeration

- NMAP DNS Hostnames Lookup

```ShellSession
nmap -F --dns-server
```

- Host Lookup

```ShellSession
host -t ns [megacorpone.com](http://megacorpone.com/)
```

- Reverse Lookup Brute Force - find domains in the same range

```ShellSession
for ip in $(seq 155 190);do host 50.7.67.$ip;done |grep -v "not found...


Score: 0


# File Enumeration

- Find UID 0 files root execution

```ShellSession
/usr/bin/find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \\\\; 2>/dev/null
```

- Get handy linux file system enumeration script (/var/tmp)

```ShellSession
wget <https://highon.coffee/downloads/linux-local-enum.sh>

chmod +x ./linux-...


Score: 0