# Enumeration

## Wordlists

* [Seclists](https://github.com/danielmiessler/SecLists)
  * Subdomain enumeration: /Discovery/DNS (subdomain\*)
  * Pages, Extensions, Directory, Parameters: /Discovery/Web-Content (directory-list\*.txt, web-extensions.txt, burp-parameter-names.txt)
  * LFI wordlist: /Fuzzing/LFI
* [Crunch](https://secf00tprint.github.io/blog/passwords/crunch/advanced/en) Word list generator

## Port mapping

### Nmap

<table><thead><tr><th width="269">Flag</th><th>Description</th></tr></thead><tbody><tr><td><code>-sC</code></td><td>Run scripts</td></tr><tr><td><code>-sV</code></td><td>Version scan</td></tr><tr><td><code>-p &#x3C;ports></code></td><td>Specify ports. Can be a list, can contain ranges</td></tr><tr><td><code>-p-</code></td><td>Scan all 65535 ports</td></tr><tr><td><code>--script=&#x3C;script name></code><br><code>-sC</code></td><td>Run a specific script from <code>usr/share/nmap/scripts</code></td></tr><tr><td><code>-A</code></td><td>Enable OS detection, version detection, script scanning, and traceroute (Loud)</td></tr><tr><td><code>--open</code></td><td>Show only open ports</td></tr><tr><td><code>-oA &#x3C;name_of_files></code></td><td>Save in all output formats with prefix of <code>name_of_files</code></td></tr><tr><td><code>-sn</code></td><td>Disables port scanning</td></tr><tr><td><code>-iL &#x3C;file></code></td><td>Scans a list of hosts from a file</td></tr><tr><td><code>--reason</code></td><td>Displays the reason for specific result.</td></tr><tr><td><code>--packet-trace</code></td><td>Shows all packets sent and received</td></tr><tr><td><code>-F</code></td><td>Fast Scan. Top 100 ports</td></tr><tr><td><code>--top-ports=10</code></td><td>Scans the specified top ports that have been defined as most frequent.</td></tr><tr><td><code>-n</code></td><td>Disable DNS resolution</td></tr><tr><td><code>--disable-arp-ping</code></td><td>Disables ARP ping.</td></tr><tr><td><code>--stats-every=5s</code></td><td>Shows status every 5 seconds</td></tr><tr><td><code>-v</code> or <code>-vv</code></td><td>Verbositiy level, increasing</td></tr><tr><td><code>-A</code></td><td>Performs service detection, OS detection, traceroute and uses defaults scripts to scan the target.</td></tr><tr><td><code>--min-rate &#x3C;number></code></td><td>Speed optimization parameter</td></tr><tr><td><code>-T &#x3C;0-5></code></td><td>Aggressiveness</td></tr><tr><td><code>--source-port 53</code></td><td>Performs the scans from specified source port.</td></tr><tr><td><code>--script-updatedb</code></td><td>Update scripts DB</td></tr></tbody></table>

Some useful nmap scripts (`/usr/share/nmap/scripts/`):

* [smb-os-discovery.nse](https://nmap.org/nsedoc/scripts/smb-os-discovery.html) (usually on `-p 445`)
* http-enum (example on port `-p 80`)

Some nmap usages examples:

* `-p 21 --packet-trace -Pn -n --disable-arp-ping` to scan port 21 and get a detailed information for the packet as the answer

#### Scan types

<table><thead><tr><th width="169">Flag</th><th>Description</th></tr></thead><tbody><tr><td><code>-PE</code></td><td>Performs the ping scan by using 'ICMP Echo requests' against the target.<br>Usually in combination with <code>--disable-arp-ping</code> to disable ARP Scanning</td></tr><tr><td><code>-sS</code></td><td>(Default as Root) SYN Scan</td></tr><tr><td><code>-sT</code></td><td>(Default as non-Root) TCP Scan</td></tr><tr><td><code>-sU</code></td><td>Performs a UDP scan.</td></tr><tr><td><code>-sV</code></td><td>Performs a service scan.</td></tr><tr><td><code>-sA</code></td><td>TCP ACK scan (hard to filter)</td></tr><tr><td><code>-Pn</code></td><td>Disable the ICMP echo requests (avoid checking if host is alive)</td></tr></tbody></table>

#### Types of ports states

<table data-header-hidden><thead><tr><th width="227">State</th><th>Description</th></tr></thead><tbody><tr><td><code>open</code></td><td>This indicates that the connection to the scanned port has been established. These connections can be <strong>TCP connections</strong>, <strong>UDP datagrams</strong> as well as <strong>SCTP associations</strong>.</td></tr><tr><td><code>closed</code></td><td>When the port is shown as closed, the TCP protocol indicates that the packet we received back contains an <code>RST</code> flag. This scanning method can also be used to determine if our target is alive or not.</td></tr><tr><td><code>filtered</code></td><td>Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target.</td></tr><tr><td><code>unfiltered</code></td><td>This state of a port only occurs during the <strong>TCP-ACK</strong> scan and means that the port is accessible, but it cannot be determined whether it is open or closed.</td></tr><tr><td><code>open|filtered</code></td><td>If we do not get a response for a specific port, <code>Nmap</code> will set it to that state. This indicates that a firewall or packet filter may protect the port.</td></tr><tr><td><code>closed|filtered</code></td><td>This state only occurs in the <strong>IP ID idle</strong> scans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall.</td></tr></tbody></table>

XML (`-oX`) output to HTML tool: xsltproc

## Fuzzing

### Ffuf

Typical Usage

```bash
ffuf -w ./SecLists/example.txt:FUZZ -u http://domain.com/FUZZ
```

Recursive search

```bash
-recursion -recursion-depth 1
```

File extension

```bash
-e .php
```

Setting and/or fuzz headers (example: VHosts)

```bash
-H "Host: FUZZ.domain.com"
```

Filter or Match

```bash
-f*
-m*
```

Example: Filter (remove) by response size anything of size 600

```
-fs 600
```

HTTP Verb

```bash
-X POST
```

Data

```bash
-d ""
```

Ignore comments

```bash
-ic
```

Colorize output

```bash
-c
```

Output to file

```bash
-o <file_name>
```

### PHP Config file defualt positions

`X.Y` is the php version

Nginx: `/etc/php/X.Y/fpm/php.ini`

Apache: `/etc/php/X.Y/apache2/php.ini`

## SNMP

Simple Networking Management Protocol

Can provide information such as process parameters, routing information, versions and services bound to interfaces

`snmpwalk` is used to interact with it

* Example: `snmpwalk -v 2c -c public 10.129.42.253 1.3.6.1.2.1.1.5.0`

[onesixtyone](https://github.com/trailofbits/onesixtyone) can bruteforce the community string names

* Example with included bruteforce file: `onesixtyone -c dict.txt 10.129.42.254`

## Gobuster

DNS, vhost, and directory brute-forcing

### Directory mode

`gobuster dir` option

<table><thead><tr><th width="222">Flag</th><th>Description</th></tr></thead><tbody><tr><td>-u &#x3C;URL></td><td>Defines the target URL</td></tr><tr><td>-w &#x3C;path_to_wordlist></td><td>Defines the wordlist</td></tr><tr><td></td><td></td></tr></tbody></table>

### DNS mode

<table><thead><tr><th width="222">Flag</th><th>Description</th></tr></thead><tbody><tr><td>-d &#x3C;domain></td><td>Defines the target domain</td></tr><tr><td>-w &#x3C;path_to_wordlist></td><td>Defines the wordlist (example: <code>SecLists/Discovery/DNS/namelist.txt</code>)</td></tr><tr><td></td><td></td></tr></tbody></table>

## FTP

If it has SSL we can use openssl to connect:

```shell-session
openssl s_client -connect 10.129.14.136:21 -starttls ftp
```

## Custom Wordlist Generation (CeWL)

{% embed url="<https://github.com/digininja/CeWL>" %}

## Others

* Webserver banner: Find in header, can use `curl -IL`
* [EyeWitness](https://github.com/FortyNorthSecurity/EyeWitness)
* Whatweb: handy tool and contains much functionality to automate web application enumeration