Scribd
Upload
194 views

Tryhackme Notes

notes for jr. penetration tester path

Uploaded by

harshakarebel
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
194 views

Tryhackme Notes

notes for jr. penetration tester path

Uploaded by

harshakarebel
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 21

Tryhackme notes

Rules of Engagement (ROE)

The ROE is a document that is created at the initial stages of a penetration


testing engagement. This document consists of three main sections
(explained in the table below), which are ultimately responsible for deciding
how the engagement is carried out. The SANS institute has a great example
of this document which you can view online here.

Stages of pen testing

NMAP

Port states in nmap


Important nmap cmds
Host dsicovery cmds
Arp request command

 netdiscover -r IP

file as input for your list of targets

 nmap -iL list_of_hosts.txt

list of hosts that Nmap will scan

 nmap -sL TARGETS

ARP scan without port-scanning

 nmap -PR -sn TARGETS

ICMP echo request

 sudo nmap -PE -sn MACHINE_IP/24

ICMP Timestamp

 nmap -PP -sn MACHINE_IP/24


Performance enhancing for scans

More nmap scans


Post port scan scans

CVSS - Common Vulnerability Scoring System


VPR- Vulnerability Priority Rating

Exploit-DB
Exploit-DB is a resource that we, as hackers, will find much more helpful
during an assessment. Exploit-DB retains exploits for software and
applications stored under the name, author and version of the software or
application.
Encoders in metasploit
Encoders will allow you to encode the exploit and payload in the hope that a signature-based
antivirus solution may miss them.

Signature-based antivirus and security solutions have a database of known threats. They
detect threats by comparing suspicious files to this database and raise an alert if there is a
match. Thus encoders can have a limited success rate as antivirus solutions can perform
additional checks

Evasion in metasploit
While encoders will encode the payload, they should not be considered a
direct attempt to evade antivirus software. On the other hand, “evasion”
modules will try that, with more or less success

NOPs
NOPs (No OPeration) do nothing, literally. They are represented in the Intel
x86 CPU family with 0x90, following which the CPU will do nothing for one
cycle. They are often used as a buffer to achieve consistent payload sizes.

Metasploit exploit rank

Privelege escalation
Post exploitation cmds
PIM AND PAM
Two key concepts are used to assign and manage the access rights of
individuals: Privileged Identity Management (PIM) and Privileged Access
Management (or PAM for short).

Initially, these two concepts can seem to overlap; however, they are different
from one another. PIM is used to translate a user's role within an
organisation into an access role on a system. Whereas PAM is the
management of the privileges a system's access role has, amongst other
things.

STRIDE framework for threat modeling:


CSIRT (incident response plan)

OSINT
Some useful OSINT tools:

 wappalyzer
 Wayback machine
 Github
 S3 buckets

Authentication bypass
Subdomain enumeration
Three ways:
OSINT
Virtual host
Brute force
OSINT:

-site:www.domain.com site:*.domain.com

Reset password

HASHING
Useful websites:
https://crackstation.net/

(searching a particular hash such as md5, sha,etc)


https://www.base64encode.org
(encode and decode base64, base32)

IDOR example

File inclusion
SSRF
XSS
Cookie stealing using netcat and xss
Code injection payloads:

https://github.com/payloadbox/command-injection-payload-list

Burp suite

Intruder attack types


Mail protocol

You might also like