Initial Enumeration & Foothold


Port scanning

Command : sudo masscan -p1-65535,U:1-65535 <target-ip> --rate 50000 --open-only --wait 0 -e tun0

Ultra quick masscan to get a quick lay of the land

New flow

Command : bash nmap_automator.sh -H 10.10.10.175 -t All

https://github.com/21y4d/nmapAutomator

Command : nmap -sC -sV -sS -T4 -Pn <target-ip>

Quick nmap scan with default script.

Command : nmap --script="safe" -sC -sV -vvv -Pn -oN nmap_ <target-ip>

Quick nmap scan over tcp ports; running safe scripts.

Command : sudo nmap -sUV -F -Pn --version-intensity 0 -vvv -oN <dest_file <target-ip>

UDP ports scan. -F scans the 100 most common UDP ports

Command : sudo nmap -sS -A -O -p- -T4 -vvv -oN <dest-file> <target-ip>

Slower aggressive scan

Nmap scripts located here → /usr/share/nmap/scripts


SSH: 22

PREDICTABLE PRNG

Version: 4.3p2 Debian 9 (protocol 2.0)