___
DNS lookup each hostname in the list:
```bash
kali@kali:~$ for ip in $(cat list.txt); do host $ip.megacorpone.com; done
www.megacorpone.com has address 149.56.244.87
Host ftp.megacorpone.com not found: 3(NXDOMAIN)
mail.megacorpone.com has address 51.222.169.212
Host owa.megacorpone.com not found: 3(NXDOMAIN)
Host proxy.megacorpone.com not found: 3(NXDOMAIN)
router.megacorpone.com has address 51.222.169.214
More comprehensive wordlists are available in the seclists directory.
Automate DNS Enumeration with DNSRecon and DNSenum
DNSRecon:
-d option to specify a domain name
-t option to specify the type of enumeration to perform (eg. standard)
kali@kali:~$ dnsrecon -d megacorpone.com -t std
-D to specify a file name (list.txt) containing potential subdomain strings
-t to specify the type of enumeration to perform (eg brute force)
SQL>SELECT name FROM sys.databases;SQL> USE database-name;
The master, tempdb, model and msdb databases are default ones.
List the tables within a database:
SQL>SELECT * FROM offsec.information_schema.tables;
List the records within a table:
SQL>select * from offsec.dbo.users;
Check user permissions
Is current user a sys admin?
select IS_SRVROLEMEMBER('sysadmin'); // 1 if true
What is the current user
select system_user;
Impersonate another users
# See which users can be impersonatedselect distinct b.name from sys.server_permissions a inner join sys.server_principals b on a.grantor_principal_id = b.principal_id were a.permission_name = 'IMPERSONATE'# Impersonate a userEXECUTE AS LOGIN = 'user';SELECT SYSTEM_USER;
MySQL
Connect to a MySQL server
Using mysql command:
kali@kali:~$ mysql -u root -p'root' -h 192.168.50.16 -P 3306
Enumerate MySQL properties
Version:
MySQL [(none)]> select version();MySQL [(none)]> select @@version;
Current database user:
MySQL [(none)]> select system_user();
Enumerate the database
Show available databases:
MySQL [(none)]> show databases;
Select a database:
MySQL [(none)]> use DATABASE;
Show tables:
MySQL [(none)]> show tables;
Base64 decode a column (e.g. password column)
SELECT username, CONVERT(FROM_BASE64(FROM_BASE64(password)), CHAR) FROM users;
Create a file with custom content
INTO OUTFILE
SELECT "file content" INTO OUTFILE "C:/path/to/file.php";
550 5.1.1 <idontexist>: Recipient address rejected: User unknown in local recipient table
___
A Python script which opens a TCP socket, connects to the SMTP server, and issues a VRFY command for a given username.
>[!code]- smtp.py
>```python
>#!/usr/bin/python
>
>import socket import sys
>
>if len(sys.argv) != 3:
>print("Usage: vrfy.py \<username> <target_ip>") sys.exit(0)
>
># Create a Socket
>s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
>
># Connect to the Server
>ip = sys.argv[2]
>connect = s.connect((ip,25))
>
># Receive the banner banner = s.recv(1024)
>
>print(banner)
>
># VRFY a user
>user = (sys.argv[1]).encode() s.send(b'VRFY ' + user + b'\r\n') result = s.recv(1024)
>
>print(result)
>
># Close the socket s.close()
>```
We can run the script by providing the username to be test as the first argument and the target IP as the second argument:
```bash
kali@kali:~/Desktop$ python3 smtp.py root 192.168.50.8
See whether a SMTP server is running using a Windows machine
First we must build a text file containing the community strings to brute force (community) and another one containing the IP addresses to scan:
kali@kali:~$ echo public > communitykali@kali:~$ echo private >> communitykali@kali:~$ echo manager >> communitykali@kali:~$ for ip in $(seq 1 254); do echo 192.168.50.$ip; done > ipskali@kali:~$ onesixtyone -c community -i ips
Enumerate the SNMP tree
Using snmpwalk, enumerate the entire MIB tree:
-c to specify the community string
-v to specify the SNMP version number
-t 10 to increase the timeout period to 10 seconds
kali@kali:~$ snmpwalk -c public -v1 -t 10 192.168.50.151
Eg., enumerate all currently running process:
kali@kali:~$ snmpwalk -c public -v1 192.168.50.151 1.3.6.1.2.1.25.4.2.1.2
Using snmp-check, enumerate the tree and obtain key information:
