CEH-Notes

Extra

1. FQDN of Domain Controller

• nslookup

1. Full Nmap Scan

• nmap -sC -sV -A -T4

1. Service Enumeration and Bruteforcing

   1. FTP

• hydra -L -P (IP) ftp

  1. SNMP
• nmap -sP (Host Live Check)
• nmap -sU (UDP service)
• snmp-check
• nmap snmp scripts and commands

• metasploit > msfconsole > search snmp > login

  1. SMB
• nmap -p 445 –script smb-enum-shares
• hydra -L -P (IP) smb
• nmap –script smb-brute.nse -p445 (For port 445)
• sudo nmap -sU -sS –script smb-brute.nse -p U:137,T:139 (For Port 137 and 139)

There are 2 Options to connect SMB :

• smbclient ///share_name -U

``OR

• sudo mount -t cifs ///share_name /mnt/smbshare -o username=,password= (Create /mnt/smbshare directory first)

• nmap smb scripts and commands

  1. RDP
• metasploit > msfconsole > rdp scanner
• hydra -L -P rdp://(IP) -s

• xfreerdp /u: /p: /v::

  1. NetBIOS
• nmap -sV –script nbstat.nse

1. Highest Entropy in ELF files

• ent -c your_file.elf

1. ELF entry point

• readelf -h ``OR``
• readelf –symbols

1. IOT publish message in pcap file

• wireshark filter mqtt.messageType == 3
• Open packet > View Packet Details

1. Crack Wifi Password from Handshake

• aircrack-ng -a2 -b -w

1. Vulnerability Analysis, End Of Life scan reports

• Openvas > login admin/password > scan > tasks > magic Wand icon for task wizard > enter IP > start scan