ZMAP

ZMap is a fast single-packet network scanner optimized for Internet-wide network surveys. 

On a computer with a gigabit connection, ZMap can scan the entire public IPv4 address space on a single port in under 45 minutes. With a 10gigE connection and PF_RING, ZMap can scan the IPv4 address space in 5 minutes.

Installation (Ubuntu)

$ sudo apt install zmap

$ sudo zmap 192.168.31.0/24

Installation (manual)

$ cmake -DWITH_REDIS=ON -DWITH_JSON=ON -DCMAKE_INSTALL_PREFIX=/usr/local/bin .
$ make -j4
$ make install

Sample Usage

┌──(xx㉿wsl2)-[~]
└─$ sudo zmap --probe-module=icmp_echoscan 192.168.31.1/24 --quiet
Oct 24 19:07:15.790 [INFO] zmap: output module: csv
Oct 24 19:07:15.790 [INFO] csv: no output file selected, will use stdout
192.168.31.227
192.168.31.1
192.168.31.210
192.168.31.214
192.168.31.239
192.168.31.209
192.168.31.202
192.168.31.224
192.168.31.208
192.168.31.236
192.168.31.216
192.168.31.205
192.168.31.213
Oct 24 19:07:23.939 [INFO] zmap: completed

Links:

• The ZMap Project
• ZMap: The Internet Scanner and wiki
  

ApacheTomcatScanner

ApacheTomcatScanner - A python script to scan for Apache Tomcat server vulnerabilities.

Features:

• Multi-threaded workers to search for Apache tomcat servers.
• Multiple target source possible:   
• Retrieving list of computers from a Windows domain (through LDAP query)   
  
• Reading targets line by line from a file.        
• Reading individual targets (IP/DNS/CIDR) from -tt/--target option.    
• Custom list of ports to test.    
• Tests for /manager/html access and default credentials.    
• List the CVEs of each version with the --list-cves option
  

Links:

• https://github.com/p0dalirius/ApacheTomcatScanner
• https://www.kitploit.com/2022/09/apachetomcatscanner-python-script-to.html
  

SSH and TLS Enumeration

SSH and TLS/SSL are the two (2) most common encrypted protocols used daily by sysadm. Here, I listed some cmdline commonly used by me daily in troubleshooting the 2 protocols and some links below.

SSH (22/tcp):

Enumerate SSHD configuration with SSHscan

$ python sshscan.py -t 192.168.31.1

Enumerate SSH algorithm with NMAP

$ nmap --script ssh2-enum-algos 192.168.1.1

Print its (client) configuration after evaluating Host and Match blocks.

$ ssh -G 192.168.31.1

Queries ssh for the algorithms supported: cipher, cipher-auth, mac, kex, keq-gss, key, key-cert, key-plain, key-sig, protocol-version.

$ ssh -Q query_option

TLS/SSL (443/tcp):

$ sslyze www.facebook.com

$ ./sslscan.exe 192.168.31.1

$ tlsscan 192.168.31.1

$ ./tls-scan -c www.facebook.com --cacert=./ca-bundle.crt --pretty

Links:

• https://myseq.blogspot.com/2022/07/ssltls-recon.html
• https://myseq.blogspot.com/2022/07/sshscan.html
• https://myseq.blogspot.com/2022/07/sslyze-fast-and-powerful-ssltls.html
• https://myseq.blogspot.com/2022/07/ssl-configuration-generator.html
• https://security.stackexchange.com/questions/94390/whats-the-purpose-of-dh-parameters
• https://www.infoworld.com/article/3027557/openssl-patches-two-vulnerabilities-in-cryptographic-library.html
• https://nmap.org/nsedoc/scripts/ssh2-enum-algos.html
• https://stackoverflow.com/questions/16212816/setting-up-openssh-for-windows-using-public-key-authentication?rq=1 
• https://www.activestate.com/blog/how-to-manage-tls-certificate-expiration-with-python/
  

SSLyze – Fast and powerful SSL/TLS scanning tool

SSLyze tool is an automated cyber security tool that is used to scan the target domain for SSL/TLS vulnerabilities like Heartbleed, OpenSSL, and many more. This tool is developed in the Python language and is also available on the GitHub platform.

Installation:

$ cd repo

$ git clone https://github.com/nabla-c0d3/sslyze.git

$ cd sslyze

$ sudo python3 setup.py install

$ sslyze -h

$ sslyze www.geeksforgeeks.org

 

Links:

• https://github.com/nabla-c0d3/sslyze

• https://www.geeksforgeeks.org/sslyze-fast-and-powerful-ssl-tls-scanning-tool/
  

SSHScan

SSHScan is a testing tool that enumerates SSH Ciphers. Using SSHScan, weak ciphers can be easily detected.

Links:

• https://github.com/evict/SSHScan
  

SSl/TLS Recon

sslscan2 

• support legacy protocols, SSLv2 and SSLv3, as well as TLSv1.3
• no longer reliant on OpenSSL.
• enumerate server key exchange groups.
• enumerate server signature algorithms.
• can use docker.

tlsscan

• TLS/SSL protocol scanner
• support newer protocols and ciphers scan via upstream OpenSSL project.

tls-scan

• single threaded asynchronous/event-based program.
• track/test/debug certificate and TLS configuration.
  
• Scan for TLS-based server, collect X.509 certs and ciphers.
• Support TLS and StartTLS protocols.
  
• produces output in JSON.
  

Links:

• SSLscan2
• TLSscan
• TLS-scan 
  

Naabu - A Port Scanner

Naabu is a port scanning tool written in Go that allows you to enumerate valid ports for hosts in a fast and reliable manner. It is a really simple tool that does fast SYN/CONNECT scans on the host/list of hosts and lists all ports that return a reply.

naabu --host 192.168.233.81 -nmap-cli 'nmap -sV'

Installation

$ sudo apt install -y libpcap-dev

$ go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

 

Links:

• https://github.com/projectdiscovery/naabu
  

Nuclei - Community Powered Vulnerability Scanner

Nuclei is a fast and customizable vulnerability scanner based on simple YAML-based templates.

It has two components, 1) Nuclei engine - the core of the project allows scripting HTTP / DNS / Network / Headless / File protocols based checks in a very simple to read-and-write YAML-based format. 2) Nuclei templates - ready-to-use community-contributed vulnerability templates.

nuclei -u http://192.168.233.81 -t misconfiguration/

Installation

$ go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

Link:

• Nuclei - Community Powered Vulnerability Scanner 
• https://github.com/projectdiscovery/nuclei
  

httpX - HTTP toolkit

httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads.

echo 192.168.233.81:8080 | httpx -probe -title -tech-detect -status-code -jarm

Installation

$ go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

Links:

• https://github.com/projectdiscovery/httpx
  

DNSX - A Multi-purpose DNS Toolkit

dnsx is a fast and multi-purpose DNS toolkit allow you to perform multiple DNS queries with the supports of DNS wildcard filtering.

It supports:

• DNS resolution and brute-force mode
• Multiple resolver formats (TCP/UDP/DOH/DOT)
• Automatic wildcard handling

Installation

$  go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest

Links:

• https://github.com/projectdiscovery/dnsxdnsx is a fast and multi-purpose DNS toolkit allow to run multiple probes using retryabledns library, that allows you to perform multiple DNS queries of your choice with a list of user supplied resolvers, additionally supports DNS wildcard filtering like shuffledns.
  

Drop-in Replacement For Nmap

Smap - a drop-in replacement for NMAP that powered by Shodan. It is a replica of Nmap which uses shodan.io's free API for port scanning. It takes similar cmdline arguments as Nmap and produces the same output which makes it a drop-in replacement for Nmap.

Smap is super fast since it simple fetches existent port data from shodan.io. It can be used as:

• a super fast port scanner (200 hosts per second)
  
• vulnerability detection (services/version fingerprinting)
  
• reconnaissance on most common ports (limited to top 1237) 
  
• connection-less or passive-scan to the target
  

 

 Most important is, it doesn't require any account/api key.

Links:

• https://github.com/s0md3v/Smap
• https://www.kitploit.com/2022/04/smap-drop-in-replacement-for-nmap.html

A Pentest Story

This is an interesting story about penetration testing.

It demonstrates the pentest by starting from OSINT, recon, RCE, phishing, social engineering and finally getting a reverse shell access.

Enjoy the story at There is a shell in your lunch-box (by Rotimi Akinyele).

Links:

• https://hakin9.org/shell-lunch-box-rotimi-akinyele/
• Glassdoor - https://www.glassdoor.com/