Asset Vulnerability Enumeration

Cheat Sheet

Network Discovery

Netdiscover

Scan for Find IPs

sudo netdiscover > /tmp/netdiscover.txt

Naabu

Scan for Find Ports

naabu -list /tmp/netdiscover.txt \
      -p - -udp -c 200 \
      -rate 1000 \
      -o /tmp/naabu.txt

Nmap

Scan IPs and Fingerprint Protocols

nmap -iL /tmp/naabu.txt \
     --mtu 5000 -sV -sC -O -T4 -Pn \
     -oX /tmp/nmap.xml

Scan Vulnerabilities

nmap -iL /tmp/naabu.txt \
     -sS -sU -sV -sC -A -T4 -O --mtu 5000 -Pn \
     --script="ssl-*,ftp-*,http-*,http-webdav-*,smtp-*,snmp-*,smb-*,imap-*,pop3-*,rdp-*,redis-*,memcached-*" \     
     -oX /tmp/nmap.xml

Nuclei

Misconfiguration & Vulnerabilities

nuclei -im /tmp/nmap.xml \
       -tags network,tcp,udp,dns,ssl,ftp,ssh,rdp,smb,mysql,postgres,redis,mongodb,vnc,oracle,default-login,misconfiguration,exposure \
       -o /tmp/nuclei.txt

SSL/TLS

testssl.sh

Test SSL/TLS vulnerabilities on a single host

testssl $TARGET

Test SSL/TLS vulnerabilities on a Subnet

testssl 192.168.1.0/24

Test SSL/TLS server implementation bugs

testssl --full $TARGET

FTP

Metasploit

Version Reconnaissance

msfconsole -qx "
    use auxiliary/scanner/ftp/ftp_version;
    set RHOSTS $WEBSITE;
    run;
    exit"

Anonymous Login

msfconsole -qx "
    use auxiliary/scanner/ftp/anonymous;
    set RHOSTS $WEBSITE;
    run;
    exit"

WebDAV

Metasploit

Scan WebDAV

msfconsole -qx "
    use auxiliary/scanner/http/webdav_scanner;
    set PATH /webdav;
    set RHOSTS $WEBSITE;
    exit"

davtest

Scan WebDAV

davtest -url $WEBSITE

SNMP

Metasploit

Enumerate SNMP Public

msfconsole -qx "
    use auxiliary/scanner/snmp/snmp_enum;
    set RHOSTS $WEBSITE;
    run;
    exit"

Enumerate Windows Users

msfconsole -qx "
    use auxiliary/scanner/snmp/snmp_enumusers;
    set RHOSTS $WEBSITE;
    run;
    exit"

Enumerate File Shares

msfconsole -qx "
    use auxiliary/scanner/snmp/snmp_enumshares;
    set RHOSTS $WEBSITE;
    run;
    exit"

SMB

Metasploit

Credential Brute Force

msfconsole -qx "
    use auxiliary/scanner/smb/smb_login;
    set RHOSTS $TARGET;
    set SMBUser Administrator;
    set PASS_FILE /usr/share/seclists/Passwords/Default-Credentials/default-passwords.txt;
    set STOP_ON_SUCCESS true;
    set ANONYMOUS_LOGIN true;
    set THREADS 10;
    run;
    exit"

Detect EternalBlue

msfconsole -qx "
    use auxiliary/scanner/smb/smb_ms17_010;
    set RHOSTS $TARGET;
    run;
    exit"

Redis

Metasploit

Redis Misconfiguration Check

msfconsole -qx "use auxiliary/gather/redis_extractor;
    set RHOSTS $TARGET;
    run;
    exit"