Note | Knowledge Garden

Knowledge Garden

Home
Notes
CTF Writeups
Blog
About

Notes Explorer

1. eJPT

1. Assessment Methodologies

Active & Passive Recon

MetaSploit

MSF Auxiliary Module

Services

HTTP (80)

Directory Listing

rejetto HFS (80)

01-FTP (21)⬇️

04-WebDAV (80,443)

05-Microsoft IIS (80,443)

07-NetBIOS (137,138,139)

11-MSSQL (1433)

12-MySQL (3306)

15-WinRM (5985,5986)

Shells

Tools

Brute Force

John The Ripper

Directory bruteforce

nmap

Scan Types

PrivEsc Tools

To Exploit WebDAV

John the Ripper

Powershell Empire

WordLists

2. Host Exploitation

AV Evasion

AV Evasion Techniques

Exploits

Compiling Exploits

Linux

Exploits & Vulnerability

CVE-2014-6271 (ShellShock) Bash

Linux Exploit Suggester

Linux Password Hashes

Misplaced Passwords

Windows

Credential Dumping

Credential Dumping

Unattended Installation

Exploits & Vulnerability

CVE-2017-0144 (EternalBlue) SMB

CVE-2019-0708 (BlueKeep) RDP

Alternate Data Streams

Windows Exploits Suggester

Windows Services 🪟

2. Host Exploitation

3. Network PenTesting

SMB Relay Attack

4. Post Exploitation

1. Linux

Linux Persistence

Persistence via Cronjobs

Persistence via SSH or backdoor user

Privilege Escalation

Dangerous SUID binaries

Shell permissions

Change root pass in shadow file

Dangerous SUID Binaries to Look For

LinEnum & LinPEAS

PrivEsc Linux Cheat Sheet

Vulnerabilities

chkrootkit v(0.5)

Ubuntu 18.04 privesc

Dump Linux Hashes

Enumerating LINUX Information

Linux Post-Exploitation Modules

2. Windows

Privilege Escalation

!ntro Win PrivEsc

Enumerating WINDOWS information

Windows Post-Exploitation Modules

3. Pivoting

Port Forwarding

What is Pivoting

Cleaning artifacts

Linux

Clear bash history

Windows

Clear Windows Event Log

4. Post Exploitation

Transfer files to Windows & Linux Targets

5. Web Pentesting

HTTP Request & Response

HTTP Request Methods

HTTP Response Component

Exam Notes

WINSERVER-01 (50)

WINSERVER-02 (51)

WINSERVER-03 (55)

2. SOC L1

4n6

Cheatsheets

Malware Analysis

Static Analysis

Brim

Brim Introduction

Email Analysis

Email Security

DKIM (DomainKeys Identified Mail)

DMARC (Domain-Based Message Authentication Reporting and Conformance)

S-MIME (Secure-Multipurpose Internet Mail Extensions)

SPF (Sender Policy Framework)

Phishing Prevention

Phishing Prevention Intro

Social Engineering

Email Phishing Tools

Email Body Analysis

Email Header Analysis Tools

Malware Sandbox

EZTools

Timeline Explorer

Incidents Playbooks

1- Ransomware Playbook

2- Phishing Playbook

5- Other Playbooks

Snort

Snort Introduction

TShark

TShark Advanced Filtering

TShark CLI Features

Wireshark

11- Matching Filters

2- TCP & UDP Filters

3- HTTP-S & DNS Analysis

6- DHCP Filters

7- NetBIOS & Kerberos

8- ICMP Filters

Brim vs Wireshark vs Zeek

Malware Traffic Analysis

3. eCIR

Glossary

Playbooks in SOC

Incident Handling vs Incident Response

HTB machines

Notes
1. eJPT
1. Assessment Methodologies
Services
HTTP (80)
Directory Listing

Is a configuration in Apache and other web services. It allows to store files withing an Index to store and access. It's typically used in download pages.