Recon and enumeration

Most of the time you get stuck it is because you skipped something here. Go through the whole list even if you think you already have the path.

Target 0 of 20

Hide completed

Commands use the values you typed in the cheat sheets (your IP, the target's, the domain...).

Ports and versions 0/5

Check the host is up and guess the OS from the TTL
Close to 64 is usually Linux; close to 128, Windows.
```
ping -c 1 10.10.11.20
```
Scan all 65535 TCP ports
Interesting services often sit on high ports that a default scan misses.
```
sudo nmap -p- --open -sS --min-rate 5000 -n -Pn 10.10.11.20 -oG puertos
```
Cheat sheet →
Run version detection and default scripts only on the open ports
```
nmap -sCV -p22,80 10.10.11.20 -oN objetivo
```
Check the most common UDP ports (SNMP, TFTP, DNS, IKE)
```
sudo nmap -sU --top-ports 100 --open -n -Pn 10.10.11.20
```
Look up every exact version in searchsploit and Google
Write the versions down: an old banner is often the way in.
```
searchsploit apache 2.4.49
```
Guide →

Only the ones that apply; if a service is not there, tick it as checked anyway.

FTP: anonymous login, files and write permissions
```
ftp [email protected]
```
Cheat sheet →
SMB: null or guest session, shares and what you can read
```
netexec smb 10.10.11.20 -u '' -p '' --shares
```
Guide →
NFS: mountable exports
```
showmount -e 10.10.11.20
```
Guide →
SNMP: default communities and processes with arguments
```
snmpwalk -v2c -c public 10.10.11.20
```
Guide →
DNS: zone transfer and subdomains
```
dig axfr @10.10.11.20 box.htb
```
Exposed databases (MySQL, MSSQL, PostgreSQL, Redis, MongoDB) with default credentials
SSH: version, auth methods and any users you find

Rarely the way in, but the place to reuse credentials.

Add the domain to /etc/hosts if there is a redirect
```
echo '10.10.11.20 box.htb' | sudo tee -a /etc/hosts
```
Identify technologies, headers and CMS version
```
whatweb http://box.htb
```

Look for virtual hosts and subdomains

ffuf -u http://box.htb -H 'Host: FUZZ.box.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -ac

Path and extension fuzzing

feroxbuster -u http://box.htb -x php,txt,bak -k

Write down users, emails, paths and versions you found

A user list is later useful for spraying, ASREPRoast and password reuse.
Rank the possible paths from most to least likely