Scanning and Vulnerabilities

Nmap

# Ping sweep for network
nmap -sn -PE <IP ADDRESS OR RANGE>

# Scan and show open ports
nmap --open <IP ADDRESS OR RANGE>

# Determine open services
nmap -sV <IP ADDRESS>

# Scan two common TCP ports, HTTP and HTTPS
nmap -p 80,443 <IP ADDRESS OR RANGE>

# Scan common UDP port, DNS
nmap -sU -p 53 <IP ADDRESS OR RANGE>

# Scan UDP and TCP together, be verbose on a single host 
# and include optional skip ping
nmap -v -Pn -SU -ST -p U:53,111,137,T:21-25,80,139,8080 <IP ADDRESS>

Nessus

# Basic Nessus scan
nessus -q -x -T html <NESSUS SERVER IP ADDRESS> <NESSUS SERVER PORT 1241> <ADMIN ACCOUNT> <ADMIN PASSWORD> <FILE WITH TARGETS>.txt <RESULTS FILE NAME>.html

nessus [-vnh] [-c .refile] [-V] [-T <format>]

# Batch-mode scan
nessus -q [-pPS] <HOST> <PORT> <USER NAME> <PASSWORD> <targets-file> <result-file>

# Report conversion
nessus -i in.[nsr|nbe] -o out.[xml|nsr|nbe|html|txt]

OpenVAS

  1. Install the server, client and plugin packages: apt-get install openvas-server openvas-client openvas-plugins-base openvas-plugins-dfsg

  2. Update the vulnerability database: openvas-nvt-sync

  3. Add a user to run the client: openvas-adduser

  4. Login: sysadm.

  5. Authentication (pass/cert) [pass]: [HIT ENTER].

  6. Login password: <PASSWORD>. You will then be asked to add “User rules”.

  7. Allow this user to scan authorized network by typing: accept <YOUR IP ADDRESS OR RANGE> default deny

  8. Type [CTRL]+D to exit, and then accept.

  9. Start the server: service openvas-server start

  10. Set targets to scan – Create a text file with a list of hosts/networks to scan: vi scanme.txt

  11. Add one host, network per line: <IP ADDRESS OR RANGE>

  12. Run scan: openvas-client -q 127.0.0.1 9390 sysadm nsrc+ws scanme.txt openvas-output-.html -T txt -V -x

  13. (Optional) Run scan with HTML format: openvas-client -q 127.0.0.1 9390 sysadm nsrc+ws scanme.txt openvas-output.txt -T html -V -x

Windows

Network discovery

:: Basic network discovery
net view /all
net view \\<HOST NAME>

:: Basic ping scan and write output to file
for /L %I in (1,1,254) do ping -w 30 -n 1 192.168.1.%I | find "Reply" >> <OUTPUT FILE NAME>.txt

DHCP

:: Enable DHCP server logging
reg add HKLM\System\CurrentControlSet\Services\DhcpServer\Parameters /v ActivityLogFlag /t REG_DWORD /d 1

:: Default Location Windows 2003/2008/2012
%windir%\System32\Dhcp

DNS

:: Default location Windows 2003
%SystemRoot%\System32\Dns

:: Default location Windows 2008
%SystemRoot%\System32\Winevt\Logs\DNSServer.evtx

:: Default location of enhanced DNS Windows 2012 R2
:: Ref. https://technet.microsoft.com/en­-us/library/cc940779.aspx 
%SystemRoot%\System32\Winevt\Logs\Microsoft­-Windows-DNSServer%4Analytical.etl

:: Enable DNS Logging
DNSCmd <DNS SERVER NAME> /config /logLevel 0x8100F331

:: Set log location
DNSCmd <DNS SERVER NAME> /config /LogFilePath <PATH TO LOG FILE>

:: Set size of log file
DNSCmd <DNS SERVER NAME> /config /logfilemaxsize 0xffffffff

Hashing

Resource: File Checksum Integrity Verifier (FCIV)

:: Hash a file
fciv.exe <FILE TO HASH>

:: Hash all files on C:\ into a database file
fciv.exe c:\ -r -md5 -xml <FILE NAME>.xml

:: List all hashed files
fciv.exe -list -sha1 -xml <FILE NAME>.xml

:: Verify previous hashes in db with file system
fciv.exe -v -sha1 -xml <FILE NAME>.xml

:: It may be possible to create a master DB and compare to all systems from a CMD line. Fast baseline and difference.
:: Ref. https://technet.microsoft.com/en­-us/library/dn520872.aspx

Get-FileHash <FILE TO HASH> | Format-List
Get-FileHash -algorithm md5 <FILE TO HASH>

certutil -hashfile <FILE TO HASH> SHA1
certutil -hashfile <FILE TO HASH> MD5

NetBIOS

:: Basic nbtstat scan
nbtstat -A <IP ADDRESS>

:: Cached NetBIOS info on localhost
nbtstat -c

:: Script loop scan
for /L %I in (1,1,254) do nbstat -An 192.168.1.%I

User Activity

:: Ref. https://technet.microsoft.com/en­-us/sysinternals/psloggedon.aspx

:: Get users logged on
psloggedon \\computername

:: Script loop scan
for /L %i in (1,1,254) do psloggedon \\192.168.1.%i >> C:\users_output.txt

Passwords

:: Password guessing or checks
for /f %i in (<PASSWORD FILE NAME>.txt) do @echo %i & net use \\<TARGET IP ADDRESS> %i /u:<USER NAME> 2>nul && pause

for /f %i in (<USER NAME FILE>.txt) do @(for /f %j in (<PASSWORD FILE NAME>.txt) do @echo %i:%j & @net use \\<TARGET IP ADDRESS> %j /u:%i 2>nul && echo %i:%j >> success.txt && net use \\<IP ADDRESS> /del)

Microsoft Baseline Security Analyzer (MBSA)

:: Basic scan of a target IP address
mbsacli.exe /target <TARGET IP ADDRESS> /n os+iis+sql+password

:: Basic scan of a target IP range
mbsacli.exe /r <IP ADDRESS RANGE> /n os+iis+sql+password

:: Basic scan of a target domain
mbsacli.exe /d <TARGET DOMAIN> /n os+iis+sql+password

:: Basic scan of a target computer names in text file
mbsacli.exe /listfile <LISTNAME OF COMPUTER NAMES>.txt /n os+iis+sql+password

Active Directory Inventory

:: List all OUs
dsquery ou DC=<DOMAIN>,DC=<DOMAIN EXTENSION>

:: List of workstations in the domain
netdom query WORKSTATION

:: List of servers in the domain
netdom query SERVER

:: List of domain controllers
netdom query DC

:: List of organizational units under which the 
:: specified user can create a machine object
netdom query OU

:: List of primary domain controller
netdom query PDC

:: List the domain trusts
netdom query TRUST

:: Query the domain for the current list of FSMO owners
netdom query FSMO

:: List all computers from Active Directory
dsquery COMPUTER "OU=servers,DC=<DOMAIN NAME>,DC=<DOMAIN EXTENSION>" -o rdn -limit 0 > C:\machines.txt

:: List user accounts inactive longer than 3 weeks
dsquery user domainroot -inactive 3

:: Find anything (or user) created on date in UTC
:: using timestamp format YYYYMMDDHHMMSS.sZ
dsquery * -filter "(whenCreated>=20101022083730,0Z)"
dsquery * -filter "((whenCreated>=20101022083730.0Z)&(objectClass=user))"

:: Alt option
ldifde -d ou=<OU NAME>,dC=<DOMAIN NAME>,dc=<DOMAIN EXTENSION> -l whencreated, whenchanged -p onelevel -r "(ObjectCategory=user)" -f <OUTPUT FILENAME>

:: The last logon timestamp format in UTC: YYYYMMDDHHMMSS
:: Alt option
dsquery * dc=<DOMAIN NAME>,dc=<DOMAIN EXTENSION> -filter "(&(objectCategory=Person)(objectClass=User)(whenCreated>=20151001000000.0Z))"

:: Alt option
adfind -csv -b dc=<DOMAIN NAME>,dc=<DOMAIN EXTENSION> -f "(&(objectCategory=Person)(objectClass=User)(whenCreated>=20151001000000.0Z))"

Using PowerShell, dump new Active Directory accounts in last 90 Days:

import-module activedirectory
Get-QADUser -CreatedAfter (Get­-Date).AddDays(-90)
Get-ADUser -Filter * -Properties whenCreated | Where-Object {$_.whenCreated -ge ((Get­-Date).AddDays(-90)).Date}

Linux

Network discovery

# Net view scan
smbtree -b
smbtree -D
smbtree -S

# View open SMB shares
smbclient -L <HOST NAME>
smbstatus

# Basic ping scan
for ip in $(seq 1 254); do ping -c 1 192.168.1.$ip>/dev/null; [ $? -eq 0 ] && echo "192.168.1.$ip UP" || : ; done

DHCP

View DHCP lease logs.

# Red Hat 3
cat /var/lib/dhcpd/dhcpd. leases

# Ubuntu
grep -Ei 'dhcp' /var/log/syslog.1

# Ubuntu DHCP logs
tail -f dhcpd. log

DNS

# Start DNS logging
rndc querylog

# View DNS logs
tail -f /var/log/messages I grep named

Hashing

# Hash all executable files in these specified locations
find /<PATHNAME TO ENUMERATE> -type f -exec md5sum {} >> md5sums.txt \;
md5deep -rs /> md5sums.txt

NetBIOS

# Basic nbtstat scan
nbtscan <IP ADDRESS OR RANGE>

Passwords

# Password and username guessing or checks
while read line; do username=$line; while read line; do smbclient -L <TARGET IP ADDRESS> -U $username%$line -g -d 0; echo $username:$line; done<<PASSWORDS>.txt; done<<USER NAMES>.txt