pentesting_cheatsheet.txt

# Reconnaisance / Footprinting
- Webserver? Physically located? Offices of the company? Branch office? When was created? Who's in charge? Press releases? (marketwatch.com)
	* Visit the clients website, use different search engines, offers in job sites
		-> whois, HTTrack, link extractors, google dorks, GooScan, SearchDiggity, MetaGoofil, Goolink Scanner, SiteDigger
		-> ping site.com -f -l <packetsize>, traceroute
		
- Discover OS, Web Servers, & Platforms + Versions
	-> builtwith.com, dnstuff.com, netcraft.com, wayback machine, pentest-tools.com
- Network Info:
	* Domain names, Internal domains
	* IP Addresses (VPN, IP ranges, unmonitored/private websites)
	* TCP/UDP Services
	* IDS/Access Controls
	* Phone Numbers / VoIP.
- Operating System Info:
	* User & Group Names / Info
	* Banner Grabbing, Routing tables, SNMP?
	* System Architecture, Remote Systems, System Names
- Organization Information
	* Organization Website, Company Directory, Employee Details (facebook, twitter, linkedin, google+, job sites, job titles, personal info, etc)
		-> peoplesmart.com, anywho.com
	* Location Details, Phone numbers, Security Policies Deployed 
	* Comments in HTML Source Code, Web Server Links

Summary: Recon via: whois -> DNS -> network ranges -> search engines -> website -> email -> competitive intel -> google hacking -> social engineering

--> Create a blueprint

# Scanning
Self explanatory. Check scan_cheatsheet.


# Enumeration
Targets:	
	- Usernames
	- Groups
	- Machine names
	- Network resources
	- Services running
	- Routing tables
	- Auditing services
	- Applications
	- DNS & SNMP

Ports and services:
	DNS zone transfers: TCP 53
	SMTP: TCP 25
	MS RPC Endpoint: TCP 135
	Global Catalog Service: TCP/UDP 3368
	NetBIOS Naming Service: TCP 137
	LDAP: TCP/UDP 389
		-> DSA ports: TCP/UDP 389, LDAPS 636
		-> Global catalog: TCP/UDP 3268, LDAPS 3269
	SMB over NetBIOS: 139
	SNMP: UDP 161
	SMB over TCP: 445
	NTP: UDP 123
	SMTP: 25, 587 (submission)
	DNS: TCP/UDP 53
Tools:	
	-NetBIOS:
		NetBIOS Enumerator
		SuperScan4
		nbtstat: Displays protocol statistics and current TCP/IP connections using NTB over TCP/IP. | Useful opt: -a | sufixes cheatsheet: https://support.microsoft.com/es-es/kb/163409
		null session: net use \\ip\ipc$ "" /user:""
		winfo -> ntsecurity.nu useful tool, null sessions and others
		user2sid / sid2user
		dsget
	-SNMP:
		SolarWinds toolset, MIB Walker
	-LDAP: -> Disclose Group/user/system names, account info
		Jxplorer and hyena
	-NTP: -> Disclose hosts, IP addresses, System names, OS
		ntptrace, ntpdc> help|monlist, ntpq help|host|readlist
	-SMTP: -> Disclose valid users
		NetScanTools Pro
		smtp-user-enum -M  VRFY
	-DNS: 
		NSLookup
		DNSRecon